@inerrata-corporation/errata 2.0.0-dev.96 → 2.0.0-dev.98

package/errata.mjs

@@ -21786,11 +21786,24 @@ var init_client = __esm({
       async actableAgents() {
         return this.json("GET", "/api/gate/actable-agents");
       }
+      /** Resolve the exact installation and credential context used by this client. */
+      async context() {
+        return this.json("GET", "/api/gate/context");
+      }
+      /** Resolve context after an audited, sessionless act-as re-mint. Useful for
+       * CLI diagnostics that must report the same identity a selected agent uses. */
+      async contextAs(handle2, teamId) {
+        const acting = await this.actAs(handle2, teamId);
+        return this.json("GET", "/api/gate/context", void 0, { bearerToken: acting.token });
+      }
       /** Mint a fresh gateway JWT stamped with `handle` (authz-checked + audited
        *  server-side). The returned `token` bears the acting-agent identity for
        *  subsequent cloud calls. Authenticated with the caller's base JWT. */
-      async actAs(handle2) {
-        return this.json("POST", "/api/gate/act-as", { handle: handle2 });
+      async actAs(handle2, teamId) {
+        return this.json("POST", "/api/gate/act-as", {
+          handle: handle2,
+          ...teamId !== void 0 ? { teamId } : {}
+        });
       }
       /** Resolve-or-create the org's project for a repo locator (ambient link,
        *  PJ-entity). Requires user identity on the JWT — login-gated like actAs. */
@@ -22163,7 +22176,7 @@ var init_client = __esm({
           ...provenanceHeaders(this.provenance)
         };
         if (!opts?.skipAuth) {
-          const token = await this.authToken();
+          const token = opts?.bearerToken ?? await this.authToken();
           if (token) headers["authorization"] = `Bearer ${token}`;
         }
         const ac = new AbortController();
@@ -22377,7 +22390,9 @@ function defaultConfig() {
     onboardedAt: null,
     machineId: null,
     updateChannel: "dev",
-    activeAgent: null
+    activeAgent: null,
+    installationProfiles: {},
+    activeInstallationProfile: null
   };
 }
 function loadConfig() {
@@ -22402,14 +22417,89 @@ function loadConfig() {
     cloudUrl: envCloudUrl ?? (migrateLegacyDefault ? DEFAULT_CLOUD_URL : parsed.cloudUrl ?? base.cloudUrl),
     // Deep-merge consent so an old/partial config keeps the opt-in defaults
     // for any channel it doesn't mention.
-    consent: { ...base.consent, ...parsed.consent ?? {} }
+    consent: { ...base.consent, ...parsed.consent ?? {} },
+    installationProfiles: { ...parsed.installationProfiles ?? {} }
   };
   if (migrateLegacyDefault && !envCloudUrl) saveConfig(resolved);
   return resolved;
 }
 function saveConfig(cfg) {
   ensureDir(globalDir());
-  writeFileSync5(globalConfigPath(), JSON.stringify(cfg, null, 2), { encoding: "utf8", mode: 384 });
+  const normalized = snapshotActiveInstallationProfile(cfg);
+  writeFileSync5(globalConfigPath(), JSON.stringify(normalized, null, 2), { encoding: "utf8", mode: 384 });
+}
+function profileFromCurrent(cfg, installationId) {
+  return {
+    installationId,
+    cloudUrl: cfg.cloudUrl,
+    apiKey: cfg.apiKey,
+    accessToken: cfg.accessToken,
+    refreshToken: cfg.refreshToken,
+    tokenEndpoint: cfg.tokenEndpoint,
+    oauthClientId: cfg.oauthClientId,
+    activeAgent: cfg.activeAgent
+  };
+}
+function snapshotActiveInstallationProfile(cfg) {
+  const name2 = cfg.activeInstallationProfile;
+  if (!name2) return cfg;
+  const existing = cfg.installationProfiles[name2];
+  if (!existing) return { ...cfg, activeInstallationProfile: null };
+  return {
+    ...cfg,
+    installationProfiles: {
+      ...cfg.installationProfiles,
+      [name2]: profileFromCurrent(cfg, existing.installationId)
+    }
+  };
+}
+function saveInstallationProfile(name2, installationId, cfg = loadConfig()) {
+  const normalizedName = name2.trim();
+  if (!normalizedName || normalizedName.length > 80) {
+    throw new Error("profile name must be 1\u201380 characters");
+  }
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(installationId)) {
+    throw new Error("installation id must be a UUID");
+  }
+  const next = {
+    ...cfg,
+    installationProfiles: {
+      ...cfg.installationProfiles,
+      [normalizedName]: profileFromCurrent(cfg, installationId)
+    },
+    activeInstallationProfile: normalizedName
+  };
+  saveConfig(next);
+  return next;
+}
+function useInstallationProfile(name2, cfg = loadConfig()) {
+  const profile = cfg.installationProfiles[name2];
+  if (!profile) throw new Error(`installation profile not found: ${name2}`);
+  const next = {
+    ...cfg,
+    cloudUrl: profile.cloudUrl,
+    apiKey: profile.apiKey,
+    accessToken: profile.accessToken,
+    refreshToken: profile.refreshToken,
+    tokenEndpoint: profile.tokenEndpoint,
+    oauthClientId: profile.oauthClientId,
+    activeAgent: profile.activeAgent,
+    activeInstallationProfile: name2
+  };
+  saveConfig(next);
+  return next;
+}
+function removeInstallationProfile(name2, cfg = loadConfig()) {
+  if (!cfg.installationProfiles[name2]) return cfg;
+  const installationProfiles = { ...cfg.installationProfiles };
+  delete installationProfiles[name2];
+  const next = {
+    ...cfg,
+    installationProfiles,
+    activeInstallationProfile: cfg.activeInstallationProfile === name2 ? null : cfg.activeInstallationProfile
+  };
+  saveConfig(next);
+  return next;
 }
 function machineId() {
   const fromEnv = process.env["ERRATA_MACHINE_ID"];
@@ -22444,12 +22534,30 @@ var init_config = __esm({
 });
 
 // src/cloud-endpoint-policy.ts
+function warnDirectV1OverrideOnce() {
+  if (warnedDirectV1Override) return;
+  warnedDirectV1Override = true;
+  console.error(
+    [
+      "",
+      "!!! DIRECT V1 OVERRIDE ACTIVE !!!",
+      `${DIRECT_V1_OVERRIDE_ENV} + ${DIRECT_V1_ACK_ENV} are set: this daemon is talking`,
+      "straight to the legacy v1 data plane, BYPASSING the Console Gateway \u2014",
+      "no metering, no signed context enforcement, no write-target binding.",
+      "Staff testing only. This escape hatch is removed at v1 EOL.",
+      ""
+    ].join("\n")
+  );
+}
+function isDirectV1OverrideRequested() {
+  const raw2 = process.env[DIRECT_V1_OVERRIDE_ENV]?.trim().toLowerCase();
+  return raw2 === "1" || raw2 === "true" || raw2 === "yes" || raw2 === "on";
+}
 function normalizeCloudUrl(url2) {
   return url2.replace(/\/+$/, "");
 }
 function isDirectV1OverrideEnabled() {
-  const raw2 = process.env[DIRECT_V1_OVERRIDE_ENV]?.trim().toLowerCase();
-  return raw2 === "1" || raw2 === "true" || raw2 === "yes" || raw2 === "on";
+  return isDirectV1OverrideRequested() && process.env[DIRECT_V1_ACK_ENV]?.trim() === DIRECT_V1_ACK_VALUE;
 }
 function isLocalCloudUrl(url2) {
   try {
@@ -22481,18 +22589,20 @@ function evaluateCloudEndpoint(url2, inspection) {
     return { allowed: true, label: "gateway-configured" };
   }
   if (isDirectV1OverrideEnabled()) {
+    warnDirectV1OverrideOnce();
     return {
       allowed: true,
       label: "legacy-direct (override)",
-      reason: `${DIRECT_V1_OVERRIDE_ENV} is enabled`
+      reason: `${DIRECT_V1_OVERRIDE_ENV} acknowledged via ${DIRECT_V1_ACK_ENV}`
     };
   }
   const service = inspection?.service ? ` (${inspection.service})` : "";
+  const unacked = isDirectV1OverrideRequested() ? ` ${DIRECT_V1_OVERRIDE_ENV} is set but unacknowledged \u2014 staff testing additionally requires ${DIRECT_V1_ACK_ENV}=${DIRECT_V1_ACK_VALUE}.` : "";
   return {
     allowed: false,
     label: "legacy-direct blocked",
     reason: `non-local cloud endpoint is not the Console Gateway${service}`,
-    guidance: `Point ERRATA_CLOUD_URL at the Console Gateway, or set ${DIRECT_V1_OVERRIDE_ENV}=1 only for accepted legacy/direct-v1 testing.`
+    guidance: `Point ERRATA_CLOUD_URL at the Console Gateway.${unacked}`
   };
 }
 function formatCloudEndpointBlock(url2, decision) {
@@ -22634,13 +22744,16 @@ async function fetchHealthJson(fetchFn, url2, timeoutMs) {
     clearTimeout(tid);
   }
 }
-var DIRECT_V1_OVERRIDE_ENV, GATEWAY_SERVICE, PROBE_TIMEOUT_MS, CloudEndpointPolicyError, BLOCKED_RECHECK_MS;
+var DIRECT_V1_OVERRIDE_ENV, DIRECT_V1_ACK_ENV, DIRECT_V1_ACK_VALUE, GATEWAY_SERVICE, PROBE_TIMEOUT_MS, warnedDirectV1Override, CloudEndpointPolicyError, BLOCKED_RECHECK_MS;
 var init_cloud_endpoint_policy = __esm({
   "src/cloud-endpoint-policy.ts"() {
     "use strict";
     DIRECT_V1_OVERRIDE_ENV = "ERRATA_ALLOW_DIRECT_V1_CLOUD";
+    DIRECT_V1_ACK_ENV = "ERRATA_DIRECT_V1_ACK";
+    DIRECT_V1_ACK_VALUE = "I_ACCEPT_UNMETERED_DIRECT_V1";
     GATEWAY_SERVICE = "console-gateway";
     PROBE_TIMEOUT_MS = 2e3;
+    warnedDirectV1Override = false;
     CloudEndpointPolicyError = class extends Error {
       decision;
       constructor(message, decision) {
@@ -22678,6 +22791,7 @@ function authedCloudClient(cfg, opts = {}) {
   const versionOpts = opts.daemonVersion ? { daemonVersion: opts.daemonVersion, daemonChannel: cfg.updateChannel } : {};
   if (cfg.accessToken) {
     const tokenEndpoint = cfg.tokenEndpoint;
+    const installationId = cfg.activeInstallationProfile ? cfg.installationProfiles[cfg.activeInstallationProfile]?.installationId : void 0;
     return new CloudClient({
       baseUrl,
       accessToken: cfg.accessToken,
@@ -22687,7 +22801,11 @@ function authedCloudClient(cfg, opts = {}) {
       provenance: daemonProvenance(),
       ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {},
       ...tokenEndpoint && cfg.refreshToken ? {
-        refreshFn: (rt) => refreshAccessToken(opts.fetchFn ?? fetch, tokenEndpoint, {
+        refreshFn: (rt) => tokenEndpoint.endsWith("/api/gate/session-token") && installationId ? refreshDeviceSessionToken(opts.fetchFn ?? fetch, tokenEndpoint, {
+          sessionToken: rt,
+          installationId,
+          clientId: cfg.oauthClientId ?? oauthClientId()
+        }) : refreshAccessToken(opts.fetchFn ?? fetch, tokenEndpoint, {
           refreshToken: rt,
           clientId: cfg.oauthClientId ?? oauthClientId()
         }),
@@ -22710,6 +22828,30 @@ function authedCloudClient(cfg, opts = {}) {
     ...opts.timeoutMs ? { timeoutMs: opts.timeoutMs } : {}
   });
 }
+async function refreshDeviceSessionToken(fetchFn, endpoint, input) {
+  const response = await fetchFn(endpoint, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input.sessionToken}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({
+      installationId: input.installationId,
+      clientId: input.clientId,
+      scopes: ["graph:read", "graph:write", "mcp:tools"]
+    })
+  });
+  const body2 = await response.json().catch(() => null);
+  if (!response.ok || typeof body2?.["access_token"] !== "string") {
+    throw new Error(`device session refresh failed: HTTP ${response.status}`);
+  }
+  return {
+    accessToken: body2["access_token"],
+    refreshToken: input.sessionToken,
+    ...typeof body2["expires_in"] === "number" ? { expiresInSec: body2["expires_in"] } : {}
+  };
+}
 function hasCloudCredential(cfg) {
   return Boolean(cfg.accessToken || cfg.apiKey);
 }
@@ -36701,14 +36843,15 @@ function createMcpHandler(store, ctx = {}) {
   };
 }
 function buildToolContext() {
+  const base = { switchInstallationProfile: useInstallationProfile };
   try {
     const cfg = loadConfig();
     if (cfg.consent.sync && hasCloudCredential(cfg) && cfg.cloudUrl) {
-      return { cloud: authedCloudClient(cfg) };
+      return { ...base, cloud: authedCloudClient(cfg) };
     }
   } catch {
   }
-  return {};
+  return base;
 }
 async function runMcpServer(workspaceRoot) {
   const paths = workspacePaths(workspaceRoot);
@@ -36817,6 +36960,41 @@ var init_mcp = __esm({
     AUDIT_NUDGE_COOLDOWN = 12;
     AUDIT_FLAG_NUDGE = "\u26A1 errata \u2014 reading/auditing? anything you notice that's off, flag it inline as `[!one line]` (`[?\u2026]` = TODO) \u2014 no tool call, we harvest it.";
     TOOLS = [
+      {
+        name: "errata.switch_context",
+        description: "Switch this daemon to an already-installed Personal, organization, or Team profile. The profile's full credential set changes with the selection; this never widens the current token or carries consent between installations. Returns the selected installation descriptor so the caller can verify what changed.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            profile: {
+              type: "string",
+              minLength: 1,
+              maxLength: 80,
+              description: "Exact name from `errata profile list`."
+            }
+          },
+          required: ["profile"],
+          additionalProperties: false
+        },
+        handler: (args2, _store, ctx) => {
+          const profileName = typeof args2["profile"] === "string" ? args2["profile"].trim() : "";
+          if (!profileName) throw new Error("profile is required");
+          const next = (ctx.switchInstallationProfile ?? useInstallationProfile)(profileName);
+          const profile = next.installationProfiles[profileName];
+          if (!profile) throw new Error(`installation profile not found: ${profileName}`);
+          return {
+            switched: true,
+            profile: profileName,
+            installation_id: profile.installationId,
+            cloud_url: profile.cloudUrl,
+            credential_type: profile.accessToken ? "oauth" : profile.apiKey ? "api_key" : "none",
+            actor: profile.activeAgent,
+            authority_changed: true,
+            standing_consent_carried: false,
+            note: "Live graph visibility and write target are resolved server-side for each request."
+          };
+        }
+      },
       {
         name: "errata.search",
         description: "Find a symbol, string, or comment across the live code graph \u2014 reaches matches by structure, not just text. Multi-word queries are tokenized and OR'd (more terms matched ranks higher, then pageRank), so word order and punctuation don't matter. Returns up to `limit` hits with id, label, description, and pageRank (higher pageRank = more central \u2014 start there). A comment that documents a symbol resolves to that SYMBOL (the comment rides along as `via` \u2014 it's the why, not the destination); test scaffolding and floating comments sort below production code. When the collective is reachable, results BLEND cross-project knowledge, each tagged `provenance` (local | collective | corroborated) with `usageCount`.",
@@ -49644,8 +49822,8 @@ function tagEdgeCorroborated(targetAnchorIds, sessionTouchedNodeIds, independent
   for (const a of targetAnchorIds) if (sessionTouchedNodeIds.has(a)) return true;
   return false;
 }
-function typePriorEdge(sourceLabel, targetLabel, sentence = "") {
-  const direct = LABEL_PAIR[`${sourceLabel}>${targetLabel}`];
+function typePriorEdge(sourceLabel, targetLabel2, sentence = "") {
+  const direct = LABEL_PAIR[`${sourceLabel}>${targetLabel2}`];
   if (direct) return direct;
   if (sentence && !NEG.test(sentence)) {
     const t = TIEBREAK.find((c) => c.re.test(sentence));
@@ -51471,7 +51649,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.96" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.98" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -54629,6 +54807,102 @@ init_cloud_auth();
 import { createServer } from "node:http";
 var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
 var strip = (u) => u.replace(/\/+$/, "");
+function deviceEndpoints(tokenEndpoint) {
+  const token = new URL(tokenEndpoint);
+  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
+  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
+  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
+  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
+  return {
+    code: at(`${prefix}/api/auth/device/code`),
+    token: at(`${prefix}/api/auth/device/token`),
+    resource: at(`${prefix}/api/gate/session-token`)
+  };
+}
+async function loginOAuthDevice(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope })
+  });
+  if (!codeResponse.ok) {
+    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("device authorization returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  let deviceSession = null;
+  let approvedInstallation = null;
+  while (Date.now() < deadline) {
+    await (opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms))))(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      throw new Error(`device authorization failed: ${error48}`);
+    }
+    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
+    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
+    break;
+  }
+  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
+  if (approvedInstallation !== opts.installationId) {
+    throw new Error("approved installation does not match the terminal request");
+  }
+  const resourceResponse = await fetchFn(device.resource, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${deviceSession}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({
+      installationId: approvedInstallation,
+      clientId,
+      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
+    })
+  });
+  const resource = await resourceResponse.json().catch(() => null);
+  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
+    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
+  }
+  return {
+    installationId: approvedInstallation,
+    clientId,
+    tokenEndpoint: device.resource,
+    tokens: {
+      accessToken: resource["access_token"],
+      refreshToken: deviceSession,
+      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
+    }
+  };
+}
 async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
   let consoleUrl = cloudUrl;
   try {
@@ -54752,6 +55026,193 @@ async function loginOAuthLoopback(opts) {
   return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
 }
 
+// src/device-login.ts
+init_src6();
+var DEFAULT_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var BRIDGE_REDIRECT_URI = "http://127.0.0.1:1/device-bridge-callback";
+var strip2 = (u) => u.replace(/\/+$/, "");
+async function discoverDeviceEndpoint(cloudUrl, fetchFn = fetch) {
+  try {
+    const res = await fetchFn(`${strip2(cloudUrl)}/.well-known/oauth-authorization-server`);
+    if (res.ok) {
+      const j = await res.json();
+      if (j.device_authorization_endpoint) return j.device_authorization_endpoint;
+    }
+  } catch {
+  }
+  return `${strip2(cloudUrl)}/device`;
+}
+async function requestDeviceAuthorization(fetchFn, deviceEndpoint, p) {
+  const res = await fetchFn(deviceEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: p.clientId, scope: p.scope })
+  });
+  if (!res.ok) throw new Error(`device authorization failed: HTTP ${res.status}`);
+  const j = await res.json();
+  if (!j.device_code || !j.user_code || !j.verification_uri) {
+    throw new Error("device authorization response missing device_code/user_code/verification_uri");
+  }
+  return {
+    deviceCode: j.device_code,
+    userCode: j.user_code,
+    verificationUri: j.verification_uri,
+    ...j.verification_uri_complete ? { verificationUriComplete: j.verification_uri_complete } : {},
+    expiresInSeconds: j.expires_in ?? 1800,
+    intervalSeconds: j.interval ?? 5
+  };
+}
+async function pollDeviceApproval(fetchFn, deviceEndpoint, p, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+  const deadline = Date.now() + p.timeoutMs;
+  let intervalMs = Math.max(1, p.intervalSeconds) * 1e3;
+  for (; ; ) {
+    if (Date.now() >= deadline) throw new Error("device approval timed out \u2014 run `errata login` again");
+    await sleep(intervalMs);
+    const res = await fetchFn(`${strip2(deviceEndpoint)}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: p.deviceCode,
+        client_id: p.clientId
+      })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (res.ok && j.access_token) return j.access_token;
+    if (j.error === "authorization_pending") continue;
+    if (j.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    throw new Error(`device approval failed: ${j.error ?? `HTTP ${res.status}`}`);
+  }
+}
+async function authorizeWithSession(fetchFn, p) {
+  const u = new URL(p.authorizationEndpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", BRIDGE_REDIRECT_URI);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  const res = await fetchFn(u.toString(), {
+    method: "GET",
+    headers: { authorization: `Bearer ${p.sessionToken}`, accept: "application/json" },
+    redirect: "manual"
+  });
+  const location = res.headers.get("location");
+  if (!location) throw new Error(`authorize did not redirect (HTTP ${res.status}) \u2014 is the session valid?`);
+  const codeFromLocation = extractCode(location, p.state);
+  if (codeFromLocation) return { code: codeFromLocation };
+  const consentUrl = new URL(location);
+  const consentCode = consentUrl.searchParams.get("consent_code");
+  if (!consentCode) throw new Error(`authorize redirected without code or consent_code: ${consentUrl.pathname}`);
+  const pagePath = "/oauth/consent";
+  const prefix = consentUrl.pathname.endsWith(pagePath) ? consentUrl.pathname.slice(0, -pagePath.length) : "";
+  const consentApi = `${consentUrl.origin}${prefix}/api/auth/oauth2/consent`;
+  const consentRes = await fetchFn(consentApi, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${p.sessionToken}`
+    },
+    body: JSON.stringify({ accept: true, consent_code: consentCode })
+  });
+  if (!consentRes.ok) throw new Error(`consent approval failed: HTTP ${consentRes.status}`);
+  const consentBody = await consentRes.json();
+  const code = consentBody.redirectURI ? extractCode(consentBody.redirectURI, p.state) : null;
+  if (!code) throw new Error("consent approved but no authorization code returned");
+  return { code };
+}
+function extractCode(redirectUrl, expectedState) {
+  try {
+    const u = new URL(redirectUrl);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code) return null;
+    if (state !== expectedState) throw new Error("state mismatch in authorization redirect");
+    return code;
+  } catch (err2) {
+    if (err2 instanceof Error && err2.message.includes("state mismatch")) throw err2;
+    return null;
+  }
+}
+async function loginViaDeviceBridge(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const log = opts.log ?? console.log;
+  const scope = opts.scope ?? DEFAULT_SCOPE;
+  const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const deviceEndpoint = await discoverDeviceEndpoint(opts.cloudUrl, fetchFn);
+  if (!endpoints.registrationEndpoint) {
+    throw new Error("cloud does not advertise dynamic client registration \u2014 try `errata login --browser`");
+  }
+  const { clientId } = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+    redirectUri: BRIDGE_REDIRECT_URI,
+    scope,
+    clientName: "errata daemon"
+  });
+  const grant = await requestDeviceAuthorization(fetchFn, deviceEndpoint, { clientId, scope });
+  log(`approve this login:`);
+  log(`  visit  ${grant.verificationUri}`);
+  log(`  code   ${grant.userCode}`);
+  if (grant.verificationUriComplete && opts.open) opts.open(grant.verificationUriComplete);
+  const sessionToken = await pollDeviceApproval(fetchFn, deviceEndpoint, {
+    clientId,
+    deviceCode: grant.deviceCode,
+    intervalSeconds: grant.intervalSeconds,
+    timeoutMs
+  });
+  const pkce = generatePkce();
+  const state = randomState();
+  const { code } = await authorizeWithSession(fetchFn, {
+    authorizationEndpoint: endpoints.authorizationEndpoint,
+    sessionToken,
+    clientId,
+    scope,
+    state,
+    challenge: pkce.challenge,
+    method: pkce.method
+  });
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri: BRIDGE_REDIRECT_URI,
+    clientId
+  });
+  try {
+    const consoleAuthBase = deriveAuthBase(grant.verificationUri);
+    if (consoleAuthBase) {
+      await fetchFn(`${consoleAuthBase}/sign-out`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${sessionToken}`, "content-type": "application/json" },
+        body: "{}"
+      });
+    }
+  } catch {
+  }
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+function deriveAuthBase(verificationUri) {
+  try {
+    const origin = new URL(verificationUri).origin;
+    return `${origin}/newapp/api/auth`;
+  } catch {
+    return null;
+  }
+}
+function openInBrowser(url2) {
+  try {
+    void import("node:child_process").then(({ spawn: spawn4 }) => {
+      const [cmd2, args2] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
+      spawn4(cmd2, args2, { detached: true, stdio: "ignore" }).unref();
+    });
+  } catch {
+  }
+}
+
 // src/cli.ts
 init_paths();
 
@@ -54811,6 +55272,116 @@ function shouldUseOAuthLogin(flags2, env2 = process.env) {
   return Boolean(flags2.oauth || !flags2.device && isDaemonOAuthDefaultEnabled(env2));
 }
 
+// src/doctor.ts
+async function diagnoseInstallation(cfg, dependencies) {
+  const checks = [];
+  const profileName = cfg.activeInstallationProfile;
+  const profile = profileName ? cfg.installationProfiles[profileName] : void 0;
+  checks.push(
+    profile ? { id: "installation_profile", status: "pass", detail: `${profileName} is selected` } : {
+      id: "installation_profile",
+      status: "fail",
+      detail: "No installation profile is selected"
+    }
+  );
+  const credentialType = cfg.accessToken ? "oauth" : cfg.apiKey ? "api_key" : "none";
+  checks.push(
+    credentialType === "none" ? { id: "credential", status: "fail", detail: "No credential is installed" } : { id: "credential", status: "pass", detail: `${credentialType} credential is present` }
+  );
+  const authorityMatches = !profile || profile.cloudUrl === cfg.cloudUrl && profile.apiKey === cfg.apiKey && profile.accessToken === cfg.accessToken && profile.refreshToken === cfg.refreshToken;
+  checks.push(
+    authorityMatches ? {
+      id: "profile_authority",
+      status: profile ? "pass" : "warn",
+      detail: profile ? "Selected profile and active credential set match" : "Cannot compare authority without a selected profile"
+    } : {
+      id: "profile_authority",
+      status: "fail",
+      detail: "Selected profile and active credential set differ; reselect the profile"
+    }
+  );
+  if (credentialType === "oauth") {
+    checks.push(
+      cfg.refreshToken && cfg.tokenEndpoint ? { id: "renewal", status: "pass", detail: "OAuth renewal is configured" } : {
+        id: "renewal",
+        status: "fail",
+        detail: "OAuth access exists without a refresh credential or token endpoint"
+      }
+    );
+  }
+  try {
+    const inspection = await dependencies.inspect();
+    checks.push(
+      inspection.reachable ? {
+        id: "endpoint",
+        status: "pass",
+        detail: `Cloud is reachable via ${inspection.probe}`
+      } : {
+        id: "endpoint",
+        status: "fail",
+        detail: inspection.error ?? "Cloud endpoint is unreachable"
+      }
+    );
+  } catch (cause) {
+    checks.push({
+      id: "endpoint",
+      status: "fail",
+      detail: cause instanceof Error ? cause.message : String(cause)
+    });
+  }
+  if (credentialType !== "none") {
+    try {
+      const identity = await dependencies.authenticate();
+      checks.push({
+        id: "authentication",
+        status: "pass",
+        detail: `Authenticated as ${identity.handle} (${identity.tier})`
+      });
+    } catch (cause) {
+      checks.push({
+        id: "authentication",
+        status: "fail",
+        detail: cause instanceof Error ? cause.message : String(cause)
+      });
+    }
+  }
+  return {
+    ok: checks.every((check2) => check2.status !== "fail"),
+    profile: profileName,
+    installationId: profile?.installationId ?? null,
+    credentialType,
+    checks
+  };
+}
+
+// src/whoami.ts
+async function resolveWhoami(client, actingHandle) {
+  return actingHandle ? client.contextAs(actingHandle) : client.context();
+}
+function targetLabel(context) {
+  const target = context.default_write_target;
+  if (!target) return "read-only";
+  if (target.visibility === "public") return "public graph";
+  if (target.visibility === "org") return `organization graph (${target.org_id})`;
+  return `private Team graph (${target.team_id})`;
+}
+function formatWhoami(response, localProfile) {
+  const { context, identity } = response;
+  return [
+    `inErrata context \u2014 ${context.profile_name ?? localProfile ?? "unbound credential"}`,
+    `  workspace:    ${context.workspace_kind} \xB7 ${context.org_id}`,
+    `  team:         ${context.team_id ?? "(none)"}`,
+    `  agent:        ${context.agent_id ?? "(default identity)"}`,
+    `  installation: ${context.installation_id ?? "(unbound)"}`,
+    `  environment:  ${context.environment} \xB7 ${context.client_kind}`,
+    `  reads:        ${context.read_visibilities.join(" + ")}`,
+    `  contributes:  ${targetLabel(context)}`,
+    `  policy:       ${context.policy_version ?? "(legacy)"}`,
+    `  credential:   ${identity.credential_type} \xB7 ${identity.credential_id}`,
+    `  actor:        ${identity.actor_type} \xB7 ${identity.actor_id}`
+  ];
+}
+
 // src/consolidation-trigger.ts
 var DEFAULT_CONSOLIDATION_POLICY = {
   baseFloorMs: 6e4,
@@ -54868,8 +55439,13 @@ async function main() {
       return cmdStop();
     case "status":
       return cmdStatus();
+    case "doctor":
+    case "verify":
+      return cmdDoctor(rest);
     case "usage":
       return cmdUsage();
+    case "whoami":
+      return cmdWhoami(rest);
     case "login":
       return cmdLogin();
     case "logout":
@@ -54880,6 +55456,8 @@ async function main() {
       return cmdUnlink();
     case "use":
       return cmdUse(rest);
+    case "profile":
+      return cmdInstallationProfile(rest);
     case "review":
       return cmdReview();
     case "tick":
@@ -54958,6 +55536,8 @@ Commands:
   status              Print workspace + cloud status (incl. version + pending update)
   usage               Show current cloud plan, units remaining, estimated cost,
                       and per-tool usage (reads the gateway's batched Hono ledger)
+  whoami [--json]     Show the Console-resolved Personal/org/Team, agent,
+                      read visibility, and exact default contribution target.
   update [--channel dev|latest] [--check]
                       Pull the newest build on this machine's channel via npm.
                       --check only reports; --channel switches + persists channel.
@@ -55004,8 +55584,14 @@ Commands:
                       Flags: --port N (default 7891)
   mcp                 Run the MCP stdio server \u2014 the agent's full errata tool
                       surface (navigation, problems, claims, burst, health)
-  login               Sign in with the cloud (OAuth by default; --device for legacy device-code)
+  login               Sign in with the cloud. Default: short verification URL +
+                      typeable code (device-bridged OAuth). Flags: --browser
+                      (loopback code flow) \xB7 --token <key> \xB7
+                      --device --installation <uuid> [--profile <name>]
+                      (headless, installation-bound console device authorization)
   logout              Clear local cloud credentials
+  doctor [--json]     Verify profile, credential authority, renewal, endpoint,
+                      and authentication without printing secrets (alias: verify)
   link                Corrective project link (ambient linking covers the happy path).
                       Flags: --project <id> adopt an existing project (fork\u2192upstream);
                       --remote <name> derive the locator from a non-origin remote;
@@ -55014,6 +55600,12 @@ Commands:
   use [<handle>]      Set the sticky session active agent the daemon acts as.
                       No arg lists the agents you can act as + the current one;
                       --none (or --clear) reverts to your default identity.
+  profile             List named installation profiles and the active one.
+  profile save <name> --installation <uuid>
+                      Bind the current credential to a named Console installation.
+  profile use <name>  Switch credential + agent context to an installed profile.
+  profile remove <name>
+                      Remove a local profile (does not revoke it in the Console).
   sync now            Flush outbox to the cloud once
   privacy             Show what is collected/scrubbed + your consent state
   consent <channel> <on|off>
@@ -55026,7 +55618,8 @@ Commands:
 
 Environment:
   ERRATA_CLOUD_URL                Cloud base URL (default ${DEFAULT_CLOUD_URL})
-  ERRATA_ALLOW_DIRECT_V1_CLOUD=1  Allow non-local legacy v1 cloud testing
+  ERRATA_ALLOW_DIRECT_V1_CLOUD=1  Staff-only: request direct legacy v1 (bypasses the gateway;
+                                  also requires ERRATA_DIRECT_V1_ACK=I_ACCEPT_UNMETERED_DIRECT_V1)
   ${OAUTH_DEFAULT_ENV}=0       Test/dev escape hatch: plain \`errata login\` uses legacy device-code
 `);
 }
@@ -55048,9 +55641,7 @@ function resolveHookPort(explicit) {
 async function cmdInit() {
   const skipHooks = rest.includes("--skip-hooks");
   const portIdx = rest.indexOf("--port");
-  const port = resolveHookPort(
-    portIdx >= 0 && rest[portIdx + 1] ? Number(rest[portIdx + 1]) : void 0
-  );
+  const port = resolveHookPort(portIdx >= 0 && rest[portIdx + 1] ? Number(rest[portIdx + 1]) : void 0);
   const existing = loadProfile(ROOT);
   if (existing) {
     console.log(`already initialized: ${existing.id} (${existing.name})`);
@@ -55167,9 +55758,7 @@ async function cmdStart() {
         if (claimed) {
           const adopted = autodetectProfile(ROOT);
           saveProfile(ROOT, adopted);
-          console.log(
-            `adopted: ${locator} is claimed by your org (project ${claimed.id}) \u2014 workspace initialized`
-          );
+          console.log(`adopted: ${locator} is claimed by your org (project ${claimed.id}) \u2014 workspace initialized`);
         }
       } catch {
       }
@@ -55234,7 +55823,9 @@ async function cmdStatus() {
   console.log(`  workspace: ${profile ? `${profile.name} (${profile.id})` : "(not initialized)"}`);
   if (profile) {
     const link = profile.projectId ? ` \u2192 project ${profile.projectId.slice(0, 8)}` : " (unlinked)";
-    console.log(`    repo:      ${profile.repoLocator ? `${profile.repoLocator}${link}` : "(no git remote \u2014 unlinked)"}`);
+    console.log(
+      `    repo:      ${profile.repoLocator ? `${profile.repoLocator}${link}` : "(no git remote \u2014 unlinked)"}`
+    );
     console.log(`    stack:     ${profile.stack.join(", ") || "(none)"}`);
     console.log(`    languages: ${profile.languages.join(", ") || "(none)"}`);
   }
@@ -55256,12 +55847,13 @@ async function cmdStatus() {
   );
   console.log(`  cloud:`);
   console.log(`    url:    ${cfg.cloudUrl}`);
+  console.log(`    profile: ${cfg.activeInstallationProfile ?? "(unbound legacy credential)"}`);
   if (!hasCloudCredential(cfg)) {
     console.log(`    logged in: no`);
   } else if (cfg.accessToken) {
     console.log(`    logged in: yes (${cfg.email}) \u2014 attested daemon, can contribute`);
   } else {
-    console.log(`    logged in: yes (${cfg.email}) \u2014 READ-ONLY key; run \`errata login\` to attest for graph-write`);
+    console.log(`    logged in: yes (${cfg.email}) \u2014 key capability enforced by Console installation/scopes`);
   }
   const active = getActiveAgent(cfg);
   console.log(
@@ -55301,6 +55893,53 @@ async function cmdStatus() {
   \u26A1 update available: ${upd.current} \u2192 ${upd.latest} \u2014 run: errata update`);
   }
 }
+async function cmdWhoami(args2) {
+  const cfg = loadConfig();
+  if (!hasCloudCredential(cfg)) {
+    console.error("not logged in \u2014 run `errata login` or select an installation profile");
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const active = getActiveAgent(cfg);
+    const response = await resolveWhoami(authedCloudClient(cfg), active?.handle ?? null);
+    if (args2.includes("--json")) {
+      console.log(JSON.stringify(response, null, 2));
+      return;
+    }
+    for (const line of formatWhoami(response, cfg.activeInstallationProfile)) console.log(line);
+  } catch (err2) {
+    console.error(`could not resolve context: ${err2 instanceof Error ? err2.message : err2}`);
+    process.exitCode = 1;
+  }
+}
+async function cmdDoctor(args2) {
+  const cfg = loadConfig();
+  const report = await diagnoseInstallation(cfg, {
+    inspect: () => inspectCloudEndpoint(cfg.cloudUrl),
+    authenticate: async () => {
+      const me = await authedCloudClient(cfg).me();
+      return { handle: me.handle, tier: me.tier };
+    }
+  });
+  if (args2.includes("--json")) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    console.log(`inErrata doctor \u2014 ${report.ok ? "ready" : "needs attention"}`);
+    console.log(`  profile: ${report.profile ?? "(none)"}`);
+    console.log(`  installation: ${report.installationId ?? "(none)"}`);
+    for (const check2 of report.checks) {
+      const marker = check2.status === "pass" ? "\u2713" : check2.status === "warn" ? "!" : "\u2717";
+      console.log(`  ${marker} ${check2.id}: ${check2.detail}`);
+    }
+    if (!report.ok) {
+      console.log(
+        "  recovery: `errata profile list`, then `errata profile use <name>`; re-login if authentication still fails."
+      );
+    }
+  }
+  if (!report.ok) process.exitCode = 1;
+}
 async function cmdUpdate(args2) {
   const cfg = loadConfig();
   let channel = cfg.updateChannel;
@@ -55360,6 +55999,11 @@ function parseFlags(args2) {
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
     else if (a === "--device") out2.device = true;
+    else if (a === "--browser") out2.browser = true;
+    else if (a === "--installation") out2.installation = args2[++i2];
+    else if (a.startsWith("--installation=")) out2.installation = a.slice("--installation=".length);
+    else if (a === "--profile") out2.profile = args2[++i2];
+    else if (a.startsWith("--profile=")) out2.profile = a.slice("--profile=".length);
     else if (!a.startsWith("--")) out2._.push(a);
   }
   return out2;
@@ -55390,14 +56034,20 @@ async function cmdUsage() {
       console.log(`  held:   ${status.quota.units_reserved.toLocaleString()} units reserved by in-flight calls`);
     }
     console.log(`  cost:   $${(status.quota.estimated_cents_current / 100).toFixed(2)} estimated`);
-    console.log(`  rate:   $${(status.pricing.cents_per_1000_units / 100).toFixed(2)} / 1,000 units${status.pricing.estimate_only ? " (estimate, not an invoice)" : ""}`);
+    console.log(
+      `  rate:   $${(status.pricing.cents_per_1000_units / 100).toFixed(2)} / 1,000 units${status.pricing.estimate_only ? " (estimate, not an invoice)" : ""}`
+    );
     if (status.by_tool.length > 0) {
       console.log("  tools:");
       for (const row of [...status.by_tool].sort((a, b) => b.units - a.units).slice(0, 10)) {
-        console.log(`    ${row.tool.padEnd(24)} ${row.units.toLocaleString().padStart(8)} units  ${row.event_count.toLocaleString().padStart(6)} calls`);
+        console.log(
+          `    ${row.tool.padEnd(24)} ${row.units.toLocaleString().padStart(8)} units  ${row.event_count.toLocaleString().padStart(6)} calls`
+        );
       }
     }
-    console.log(`  as of:  ${status.as_of} (ledger + live reservations; poll again after ${Math.ceil(status.poll_after_ms / 1e3)}s)`);
+    console.log(
+      `  as of:  ${status.as_of} (ledger + live reservations; poll again after ${Math.ceil(status.poll_after_ms / 1e3)}s)`
+    );
   } catch (err2) {
     console.error(`usage unavailable: ${err2 instanceof Error ? err2.message : err2}`);
     process.exitCode = 1;
@@ -55441,7 +56091,7 @@ async function warnIfApprovalUnreachable(url2) {
   } catch {
   }
 }
-async function cmdLoginOAuth(cfg) {
+async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
   const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
   try {
     assertCloudEndpointAllowed(cfg.cloudUrl, inspection);
@@ -55453,10 +56103,11 @@ async function cmdLoginOAuth(cfg) {
   console.log(`signing in via OAuth at ${cfg.cloudUrl} \u2026`);
   let result;
   try {
-    result = await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 });
+    result = useBrowserLoopback ? await loginOAuthLoopback({ cloudUrl: cfg.cloudUrl, timeoutMs: 5 * 6e4 }) : await loginViaDeviceBridge({ cloudUrl: cfg.cloudUrl, timeoutMs: 15 * 6e4, open: openInBrowser });
   } catch (err2) {
     console.error(`oauth login failed: ${err2 instanceof Error ? err2.message : err2}`);
-    console.error(`  fall back to device code:  errata login --device`);
+    if (!useBrowserLoopback) console.error(`  try the browser flow:      errata login --browser`);
+    console.error(`  use headless device login: errata login --device --installation <uuid>`);
     console.error(`  or paste a key:            errata login --token <key>`);
     process.exitCode = 1;
     return;
@@ -55482,6 +56133,68 @@ async function cmdLoginOAuth(cfg) {
     process.exitCode = 1;
   }
 }
+async function cmdLoginOAuthDevice(cfg, input) {
+  const profileName = input.profileName?.trim() || `device-${input.installationId.slice(0, 8)}`;
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(input.installationId)) {
+    console.error("--installation must be a UUID from Console \u2192 Connect");
+    process.exitCode = 1;
+    return;
+  }
+  const inspection = await inspectCloudEndpoint(cfg.cloudUrl);
+  try {
+    assertCloudEndpointAllowed(cfg.cloudUrl, inspection);
+  } catch (err2) {
+    console.error(err2 instanceof Error ? err2.message : cloudPolicyMessage(cfg, inspection));
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const result = await loginOAuthDevice({
+      cloudUrl: cfg.cloudUrl,
+      installationId: input.installationId,
+      timeoutMs: 15 * 6e4,
+      onVerification: ({ url: url2, userCode, expiresInSec }) => {
+        console.log(`approve this device in the Console:
+  ${url2}`);
+        console.log(`code: ${userCode} \xB7 expires in ${Math.round(expiresInSec / 60)} minutes`);
+      }
+    });
+    const nextCfg = {
+      ...cfg,
+      apiKey: null,
+      accessToken: result.tokens.accessToken,
+      refreshToken: result.tokens.refreshToken ?? null,
+      tokenEndpoint: result.tokenEndpoint,
+      oauthClientId: result.clientId,
+      activeInstallationProfile: profileName,
+      installationProfiles: {
+        ...cfg.installationProfiles,
+        [profileName]: {
+          installationId: result.installationId,
+          cloudUrl: cfg.cloudUrl,
+          apiKey: null,
+          accessToken: result.tokens.accessToken,
+          refreshToken: result.tokens.refreshToken ?? null,
+          tokenEndpoint: result.tokenEndpoint,
+          oauthClientId: result.clientId,
+          activeAgent: cfg.activeAgent
+        }
+      }
+    };
+    const me = await authedCloudClient(nextCfg).me();
+    nextCfg.userId = me.agentId;
+    nextCfg.email = me.handle;
+    saveConfig(nextCfg);
+    console.log(
+      `logged in as ${me.handle} (${me.tier}) \xB7 profile ${profileName} \xB7 installation ${result.installationId}`
+    );
+    await linkRegisteredWorkspaces(nextCfg);
+  } catch (err2) {
+    console.error(`device login failed: ${err2 instanceof Error ? err2.message : err2}`);
+    console.error("  no credential was stored; retry from Console \u2192 Connect");
+    process.exitCode = 1;
+  }
+}
 async function linkRegisteredWorkspaces(cfg) {
   if (!cfg.consent.sync) return;
   const client = authedCloudClient(cfg);
@@ -55492,9 +56205,7 @@ async function linkRegisteredWorkspaces(cfg) {
       refreshRepoLocator(w.path, profile);
       const out2 = await ensureProjectLink(w.path, profile, client);
       if (out2.linked) {
-        console.log(
-          `  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`
-        );
+        console.log(`  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`);
       }
     } catch {
     }
@@ -55576,7 +56287,9 @@ async function cmdUnlink() {
   delete profile.projectLocator;
   profile.projectLinkDisabled = true;
   saveProfile(ROOT, profile);
-  console.log(had ? `unlinked from project ${had} (ambient linking disabled \u2014 re-enable with \`errata link\`)` : "already unlinked (ambient linking disabled)");
+  console.log(
+    had ? `unlinked from project ${had} (ambient linking disabled \u2014 re-enable with \`errata link\`)` : "already unlinked (ambient linking disabled)"
+  );
 }
 async function cmdLogin() {
   const cfg = loadConfig();
@@ -55586,8 +56299,20 @@ async function cmdLogin() {
     await applyToken(cfg, flags2.token);
     return;
   }
+  if (flags2.device) {
+    if (!flags2.installation) {
+      console.error("device login requires --installation <uuid> from Console \u2192 Connect");
+      process.exitCode = 1;
+      return;
+    }
+    await cmdLoginOAuthDevice(cfg, {
+      installationId: flags2.installation,
+      ...flags2.profile ? { profileName: flags2.profile } : {}
+    });
+    return;
+  }
   if (shouldUseOAuthLogin(flags2)) {
-    await cmdLoginOAuth(cfg);
+    await cmdLoginOAuth(cfg, flags2.browser ?? false);
     return;
   }
   const c = new CloudClient({ baseUrl: cfg.cloudUrl });
@@ -55620,7 +56345,9 @@ async function cmdLogin() {
   await warnIfApprovalUnreachable(dc.verificationUrl);
   console.log(`approve this device in your browser:
   ${dc.verificationUrl}`);
-  console.log(`(code expires in ${Math.round(dc.expiresIn / 60)} minutes \u2014 or paste a key: errata login --token <key>)`);
+  console.log(
+    `(code expires in ${Math.round(dc.expiresIn / 60)} minutes \u2014 or paste a key: errata login --token <key>)`
+  );
   const deadline = Date.now() + dc.expiresIn * 1e3;
   const intervalMs = Math.max(2, dc.interval) * 1e3;
   for (; ; ) {
@@ -55689,6 +56416,48 @@ async function cmdUse(args2) {
   const code = await runUse(action, ctx);
   if (code !== 0) process.exitCode = code;
 }
+function cmdInstallationProfile(args2) {
+  const cfg = loadConfig();
+  const action = args2[0] ?? "list";
+  if (action === "list") {
+    const entries = Object.entries(cfg.installationProfiles).sort(([a], [b]) => a.localeCompare(b));
+    if (entries.length === 0) {
+      console.log("(no installation profiles \u2014 create one in the Console, then run profile save)");
+      return;
+    }
+    for (const [name3, profile] of entries) {
+      const marker = cfg.activeInstallationProfile === name3 ? "*" : " ";
+      console.log(`${marker} ${name3} \xB7 ${profile.installationId} \xB7 ${profile.cloudUrl}`);
+    }
+    return;
+  }
+  const name2 = args2[1]?.trim();
+  if (!name2) throw new Error(`usage: errata profile ${action} <name>`);
+  if (action === "use") {
+    const selected = useInstallationProfile(name2, cfg);
+    const profile = selected.installationProfiles[name2];
+    console.log(`profile active: ${name2} \xB7 installation ${profile.installationId}`);
+    return;
+  }
+  if (action === "remove") {
+    removeInstallationProfile(name2, cfg);
+    console.log(`profile removed locally: ${name2}`);
+    return;
+  }
+  if (action === "save") {
+    const direct = args2.find((arg) => arg.startsWith("--installation="))?.slice("--installation=".length);
+    const flag = args2.indexOf("--installation");
+    const installationId = direct ?? (flag >= 0 ? args2[flag + 1] : void 0);
+    if (!installationId) throw new Error("usage: errata profile save <name> --installation <uuid>");
+    if (!hasCloudCredential(cfg)) {
+      throw new Error("not logged in \u2014 install the Console credential before saving a profile");
+    }
+    saveInstallationProfile(name2, installationId, cfg);
+    console.log(`profile saved: ${name2} \xB7 installation ${installationId}`);
+    return;
+  }
+  throw new Error(`unknown profile action: ${action}`);
+}
 async function cmdReview() {
   const paths = workspacePaths(ROOT);
   if (!existsSync24(paths.reviewQueue)) {
@@ -55769,9 +56538,7 @@ async function cmdLocate(relPath) {
     const file2 = findFileByPath2(store, relPath);
     if (!file2) {
       console.error(`not indexed: ${relPath}`);
-      console.error(
-        "  \u2192 did you run `errata reindex --clean`? did you spell the relative path right?"
-      );
+      console.error("  \u2192 did you run `errata reindex --clean`? did you spell the relative path right?");
       process.exit(2);
     }
     const symbols = store.outEdges(file2.id, ["DEFINES", "CONTAINS"]).map((e) => store.getNode(e.to)).filter((n) => n != null);
@@ -56019,9 +56786,7 @@ async function cmdSearch(args2) {
       for (const h of dual.results) {
         console.log(`${h.id}`);
         console.log(`  [${h.label}] ${h.name.slice(0, 100)}`);
-        console.log(
-          `  score ${Number(h.score).toFixed(4)}${h.provenance ? ` \xB7 ${h.provenance}` : ""}`
-        );
+        console.log(`  score ${Number(h.score).toFixed(4)}${h.provenance ? ` \xB7 ${h.provenance}` : ""}`);
       }
       return;
     }
@@ -56131,9 +56896,7 @@ async function cmdSimilar(args2) {
     }
     console.log(`seed: ${r.seedId}`);
     for (const h of r.hits) {
-      console.log(
-        `  ${h.score.toFixed(4)}  [${h.label}] ${h.name.slice(0, 80)} (${h.id})`
-      );
+      console.log(`  ${h.score.toFixed(4)}  [${h.label}] ${h.name.slice(0, 80)} (${h.id})`);
     }
   });
 }
@@ -56165,7 +56928,10 @@ unresolved \u2014 no node matched "${seed}". Try \`errata search ${seed}\` for f
       return;
     }
     process.stdout.write(
-      formatBurstMd2(result, { limit, seedLabel: seed })
+      formatBurstMd2(result, {
+        limit,
+        seedLabel: seed
+      })
     );
   });
 }
@@ -56243,8 +57009,18 @@ async function gatherRepo(store, ws) {
     const sol = firstHop(store, p.id, ["SOLVED_BY", "FIXED_BY"]);
     const cause = firstHop(store, p.id, ["CAUSED_BY", "MANIFESTS_AS"]);
     const pi = addSpine(p, "Problem");
-    if (cause) spineEdges.push({ a: pi, b: addSpine(cause, spineType(cause.label, "RootCause")), kind: "causal" });
-    if (sol) spineEdges.push({ a: pi, b: addSpine(sol, spineType(sol.label, "Solution")), kind: "causal" });
+    if (cause)
+      spineEdges.push({
+        a: pi,
+        b: addSpine(cause, spineType(cause.label, "RootCause")),
+        kind: "causal"
+      });
+    if (sol)
+      spineEdges.push({
+        a: pi,
+        b: addSpine(sol, spineType(sol.label, "Solution")),
+        kind: "causal"
+      });
     if (pIdx >= LEARNED_MAX) continue;
     const srcCount = Array.isArray(p.attrs["sources"]) ? p.attrs["sources"].length : p.attrs["sources"] ? 1 : 0;
     const agents = Math.max(1, srcCount + Number(p.attrs["corroborations"] ?? 0));
@@ -56309,11 +57085,21 @@ async function gatherRepo(store, ws) {
   if (byFile.size > 0) {
     const ranked = [...byFile].sort((a, b) => b[1] - a[1]).slice(0, 6);
     const maxC = ranked[0]?.[1] ?? 1;
-    hotspots = ranked.map(([file2, c]) => ({ file: file2.split(/[\\/]/).pop() ?? file2, problemCount: c, weight: c / maxC, unit: "probs" }));
+    hotspots = ranked.map(([file2, c]) => ({
+      file: file2.split(/[\\/]/).pop() ?? file2,
+      problemCount: c,
+      weight: c / maxC,
+      unit: "probs"
+    }));
   } else {
     const fan = await runTool2("errata.hotspots", { kind: "fan-in", limit: 6 }, store);
     const maxF = fan.items[0]?.fanIn ?? 1;
-    hotspots = fan.items.map((h) => ({ file: h.name.split(/[\\/]/).pop() ?? h.name, problemCount: h.fanIn, weight: (h.fanIn ?? 0) / maxF, unit: "fan-in" }));
+    hotspots = fan.items.map((h) => ({
+      file: h.name.split(/[\\/]/).pop() ?? h.name,
+      problemCount: h.fanIn,
+      weight: (h.fanIn ?? 0) / maxF,
+      unit: "fan-in"
+    }));
   }
   const revisit = await runTool2("errata.needs_revisit", {}, store);
   const machineOnly = SEMANTIC_LABELS2.reduce((sum, l) => sum + store.findNodesByLabel(l).length, 0);
@@ -56404,14 +57190,14 @@ async function cmdReport(args2) {
   for (const f of files) writeFileSync18(join26(outDir, f.name), f.html, "utf8");
   const indexPath = join26(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
-  console.log(`  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`);
+  console.log(
+    `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
+  );
   console.log(`  open: file://${indexPath.replace(/\\/g, "/")}`);
 }
 async function cmdStop() {
   const { unlinkSync: unlinkSync4 } = await import("node:fs");
-  const lockPath = [globalDaemonLock(), workspacePaths(ROOT).daemonLock].find(
-    (p) => readDaemonLock(p) !== null
-  );
+  const lockPath = [globalDaemonLock(), workspacePaths(ROOT).daemonLock].find((p) => readDaemonLock(p) !== null);
   if (!lockPath) {
     console.log(`no daemon lock found \u2014 nothing to stop`);
     return;
@@ -56486,9 +57272,7 @@ function ensureSingletonRunning() {
 async function cmdInstallHooks(args2) {
   const harness = (args2[0] && !args2[0].startsWith("-") ? args2[0] : "claude").toLowerCase();
   const portIdx = args2.indexOf("--port");
-  const port = resolveHookPort(
-    portIdx >= 0 && args2[portIdx + 1] ? Number(args2[portIdx + 1]) : void 0
-  );
+  const port = resolveHookPort(portIdx >= 0 && args2[portIdx + 1] ? Number(args2[portIdx + 1]) : void 0);
   switch (harness) {
     case "claude":
       await installClaudeHooks(port);
@@ -56794,7 +57578,13 @@ async function cmdDash(args2) {
   const reindexOnStart = !args2.includes("--no-reindex");
   const skipEmbed = !args2.includes("--embed");
   const skipWatchers = args2.includes("--no-watch");
-  const handle2 = await startMultiDaemon({ webPort: port, reindexOnStart, skipEmbed, skipWatchers, updateCheck: true });
+  const handle2 = await startMultiDaemon({
+    webPort: port,
+    reindexOnStart,
+    skipEmbed,
+    skipWatchers,
+    updateCheck: true
+  });
   console.log(`errata multi-daemon running`);
   console.log(`  endpoint:  ${handle2.url}  (JSON \u2014 the human view is \`errata report\`)`);
   console.log(`  projects:  ${handle2.records.length}`);
@@ -56851,7 +57641,10 @@ async function cmdDash(args2) {
           scheduleQuiescenceFlush();
         }
         if (notifyEnabled && (r.problemsResolved || r.reviewsTriggered)) {
-          notifyTick({ problemsResolved: r.problemsResolved, reviewsTriggered: r.reviewsTriggered });
+          notifyTick({
+            problemsResolved: r.problemsResolved,
+            reviewsTriggered: r.reviewsTriggered
+          });
         }
       }
     }).finally(() => {
@@ -56877,7 +57670,10 @@ async function cmdDash(args2) {
       }
     }
     if (skillsLearned > 0) {
-      notifyEvent("skill-learned", skillsLearned === 1 ? "Distilled a new reusable skill from your work." : `Distilled ${skillsLearned} new skills from your work.`);
+      notifyEvent(
+        "skill-learned",
+        skillsLearned === 1 ? "Distilled a new reusable skill from your work." : `Distilled ${skillsLearned} new skills from your work.`
+      );
     }
     const p = await handle2.percolateAll();
     const touched = /* @__PURE__ */ new Set();
@@ -56968,7 +57764,9 @@ async function cmdDash(args2) {
         const fanIn = wStore.inEdges(anchor.to, [...CODE_REACH_EDGES]).length;
         if (fanIn < HOTSPOT_FANIN) continue;
         const sym = wStore.getNode(anchor.to)?.description ?? "a symbol";
-        notifyEvent("hotspot-problem", `"${p2.description.slice(0, 60)}" touches ${sym} (${fanIn} dependents).`, { key: p2.id });
+        notifyEvent("hotspot-problem", `"${p2.description.slice(0, 60)}" touches ${sym} (${fanIn} dependents).`, {
+          key: p2.id
+        });
       }
     }
     void handle2.syncPrinciplesPublic().then((r) => {
@@ -56998,7 +57796,9 @@ async function cmdDash(args2) {
       try {
         await materializeOverview2(r.root, r.engine.store);
       } catch (err2) {
-        console.warn(`[errata] overview refresh failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
+        console.warn(
+          `[errata] overview refresh failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`
+        );
       }
     }
     maybeFlushDigests();
@@ -57013,7 +57813,12 @@ async function cmdDash(args2) {
     if (consolidating) return;
     if (process.uptime() < CONSOLIDATE_BOOT_GRACE_S) return;
     consolidationState.momentum = totalMutations() - consolidatedAtMutations;
-    if (!shouldConsolidate({ now: Date.now(), state: consolidationState, policy: consolidationPolicy, force })) {
+    if (!shouldConsolidate({
+      now: Date.now(),
+      state: consolidationState,
+      policy: consolidationPolicy,
+      force
+    })) {
       return;
     }
     consolidating = true;
@@ -57111,9 +57916,7 @@ async function cmdFeedback(args2) {
 }
 async function ensureProfile() {
   if (!loadProfile(ROOT)) {
-    console.error(
-      `no errata workspace in ${ROOT}. Run 'errata init' first.`
-    );
+    console.error(`no errata workspace in ${ROOT}. Run 'errata init' first.`);
     process.exit(2);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.96",
+  "version": "2.0.0-dev.98",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {