@inerrata-corporation/errata 2.0.14-dev.3125 → 2.0.14-dev.3128

package/errata.mjs

@@ -81027,7 +81027,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3125" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3128" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -83521,6 +83521,151 @@ async function listenServer(fetchFn, port) {
 init_registry();
 init_identity2();
 
+// src/cli-identity.ts
+init_cloud_auth();
+init_config();
+init_consent();
+init_identity2();
+init_profile2();
+
+// src/project-link.ts
+init_profile2();
+import { execFile as execFile3 } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile3);
+function isClaimedElsewhere(err2) {
+  if (!err2 || typeof err2 !== "object") return false;
+  const e = err2;
+  return e.status === 409 && e.code === "claimed_elsewhere";
+}
+function claimHoldStands(onDisk) {
+  return Boolean(onDisk && !onDisk.projectId && onDisk.projectLinkHold);
+}
+var LINK_FIELDS = [
+  "projectId",
+  "projectLocator",
+  "projectLinkHold",
+  "projectLinkDisabled",
+  "rootCommitReportedFor"
+];
+function adoptLinkFields(into, from) {
+  for (const k of LINK_FIELDS) {
+    if (from[k] === void 0) delete into[k];
+    else into[k] = from[k];
+  }
+}
+async function readRootCommit(root) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 15e3,
+      windowsHide: true
+    });
+    const sha2 = stdout.split(/\s+/).filter(Boolean).pop();
+    return sha2 && /^[0-9a-f]{40,64}$/i.test(sha2) ? sha2.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureProjectLink(root, profile, client, rootCommit = readRootCommit) {
+  if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
+  const locator = profile.repoLocator;
+  if (!locator) return { linked: false, reason: "no-locator" };
+  if (profile.projectId && profile.projectLocator === locator) {
+    if (profile.rootCommitReportedFor !== profile.projectId && client.recordProjectRootCommit) {
+      const sha2 = await rootCommit(root);
+      if (sha2) {
+        try {
+          await client.recordProjectRootCommit(profile.projectId, sha2);
+          profile.rootCommitReportedFor = profile.projectId;
+          saveProfile(root, profile);
+        } catch {
+        }
+      }
+    }
+    return { linked: false, reason: "already-linked" };
+  }
+  try {
+    const sha2 = await rootCommit(root);
+    const res = await client.resolveProject(locator, profile.name, sha2 ?? void 0);
+    profile.projectId = res.project.id;
+    profile.projectLocator = locator;
+    if (sha2) profile.rootCommitReportedFor = res.project.id;
+    delete profile.projectLinkHold;
+    saveProfile(root, profile);
+    return { linked: true, projectId: res.project.id, created: res.created };
+  } catch (err2) {
+    if (isClaimedElsewhere(err2)) {
+      if (profile.projectLinkHold?.locator !== locator) {
+        profile.projectLinkHold = { reason: "claimed-elsewhere", locator, since: Date.now() };
+        saveProfile(root, profile);
+      }
+      return {
+        linked: false,
+        reason: "held",
+        detail: "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
+      };
+    }
+    return {
+      linked: false,
+      reason: "error",
+      detail: err2 instanceof Error ? err2.message : String(err2)
+    };
+  }
+}
+
+// src/cli-identity.ts
+init_registry();
+function workspaceCloud(cfg, entry, env2 = process.env) {
+  if (registryCorrupt() && !env2["ERRATA_CONFIG_PATH"]) throw new IdentityBlockedError("workspace registry is unreadable");
+  const identity = resolveWorkspaceIdentity(cfg, entry, env2);
+  if (identity.invalid) throw new IdentityBlockedError(identity.reason);
+  const name2 = identity.profileName ?? cfg.activeInstallationProfile;
+  const profile = name2 ? cfg.installationProfiles[name2] : void 0;
+  if (name2 && !profile) throw new IdentityBlockedError(`installation profile not found: ${name2}`);
+  const config2 = profile ? { ...cfg, ...profile, activeInstallationProfile: name2 } : cfg;
+  return {
+    identity,
+    config: config2,
+    profile,
+    hasCredential: hasCloudCredential(config2),
+    client: name2 ? authedCloudClientForProfile(cfg, name2) : authedCloudClient(cfg),
+    profileName: name2
+  };
+}
+function configWithDeviceLogin(cfg, input) {
+  const name2 = input.profileName.trim();
+  if (!name2 || name2.length > 80) throw new Error("profile name must be 1\u201380 characters");
+  const selected = input.makeDefault || cfg.activeInstallationProfile === name2;
+  return {
+    ...cfg,
+    ...selected ? { ...input.profile, activeInstallationProfile: name2 } : {},
+    installationProfiles: { ...cfg.installationProfiles, [name2]: input.profile }
+  };
+}
+async function saveVerifiedInstallationProfile(name2, installationId, cfg) {
+  const result = await authedCloudClient(cfg).context();
+  if (result.context.installation_id?.toLowerCase() !== installationId.toLowerCase()) {
+    throw new Error("credential belongs to a different installation (or is unbound); use login --device for the requested installation");
+  }
+  return saveInstallationProfile(name2, installationId, cfg);
+}
+async function linkRegisteredWorkspaces(cfg, loggedInProfile = cfg.activeInstallationProfile, log = console.log, env2 = process.env) {
+  for (const entry of listWorkspaces()) {
+    try {
+      const cloud = workspaceCloud(cfg, entry, env2);
+      if (cloud.profileName !== loggedInProfile || !cloud.hasCredential) continue;
+      const profile = loadProfile(entry.path);
+      if (!profile || !effectiveConsent(cloud.config, profile).sync) continue;
+      refreshRepoLocator(entry.path, profile);
+      const out2 = await ensureProjectLink(entry.path, profile, cloud.client);
+      if (out2.linked) log(`  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""} \xB7 profile ${cloud.profileName ?? "default"}`);
+    } catch {
+    }
+  }
+}
+
 // src/instance-receipts.ts
 import { createHash as createHash18 } from "node:crypto";
 var FIELDS = ["contributedAtSeq", "cloudNodeId", "anchorsContributedDigest", "projectAnchorsContributedDigest", "semanticEdgesContributedDigest", "shipRefusedSinceSeq", "shipRefusedCount", "shipRefusedReason", "shipRefusedFingerprint"];
@@ -84825,12 +84970,12 @@ function startUpdatePoller(opts) {
   const check2 = opts.check ?? (() => checkForUpdate(opts.channel));
   const base = opts.intervalMs ?? POLL_INTERVAL_MS[opts.channel];
   let pending = null;
-  let inFlight = false;
+  let inFlight2 = false;
   let timer = null;
   let stopped = false;
   const runOnce = async () => {
-    if (inFlight) return;
-    inFlight = true;
+    if (inFlight2) return;
+    inFlight2 = true;
     try {
       const status = await check2();
       if (status.latest === null) return;
@@ -84840,7 +84985,7 @@ function startUpdatePoller(opts) {
       if (changed) opts.onChange?.(pending);
     } catch {
     } finally {
-      inFlight = false;
+      inFlight2 = false;
     }
   };
   const schedule = () => {
@@ -84912,93 +85057,6 @@ function liveCloudClient(src) {
 // src/multi.ts
 init_identity2();
 
-// src/project-link.ts
-init_profile2();
-import { execFile as execFile3 } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile3);
-function isClaimedElsewhere(err2) {
-  if (!err2 || typeof err2 !== "object") return false;
-  const e = err2;
-  return e.status === 409 && e.code === "claimed_elsewhere";
-}
-function claimHoldStands(onDisk) {
-  return Boolean(onDisk && !onDisk.projectId && onDisk.projectLinkHold);
-}
-var LINK_FIELDS = [
-  "projectId",
-  "projectLocator",
-  "projectLinkHold",
-  "projectLinkDisabled",
-  "rootCommitReportedFor"
-];
-function adoptLinkFields(into, from) {
-  for (const k of LINK_FIELDS) {
-    if (from[k] === void 0) delete into[k];
-    else into[k] = from[k];
-  }
-}
-async function readRootCommit(root) {
-  try {
-    const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
-      cwd: root,
-      encoding: "utf8",
-      timeout: 15e3,
-      windowsHide: true
-    });
-    const sha2 = stdout.split(/\s+/).filter(Boolean).pop();
-    return sha2 && /^[0-9a-f]{40,64}$/i.test(sha2) ? sha2.toLowerCase() : null;
-  } catch {
-    return null;
-  }
-}
-async function ensureProjectLink(root, profile, client, rootCommit = readRootCommit) {
-  if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
-  const locator = profile.repoLocator;
-  if (!locator) return { linked: false, reason: "no-locator" };
-  if (profile.projectId && profile.projectLocator === locator) {
-    if (profile.rootCommitReportedFor !== profile.projectId && client.recordProjectRootCommit) {
-      const sha2 = await rootCommit(root);
-      if (sha2) {
-        try {
-          await client.recordProjectRootCommit(profile.projectId, sha2);
-          profile.rootCommitReportedFor = profile.projectId;
-          saveProfile(root, profile);
-        } catch {
-        }
-      }
-    }
-    return { linked: false, reason: "already-linked" };
-  }
-  try {
-    const sha2 = await rootCommit(root);
-    const res = await client.resolveProject(locator, profile.name, sha2 ?? void 0);
-    profile.projectId = res.project.id;
-    profile.projectLocator = locator;
-    if (sha2) profile.rootCommitReportedFor = res.project.id;
-    delete profile.projectLinkHold;
-    saveProfile(root, profile);
-    return { linked: true, projectId: res.project.id, created: res.created };
-  } catch (err2) {
-    if (isClaimedElsewhere(err2)) {
-      if (profile.projectLinkHold?.locator !== locator) {
-        profile.projectLinkHold = { reason: "claimed-elsewhere", locator, since: Date.now() };
-        saveProfile(root, profile);
-      }
-      return {
-        linked: false,
-        reason: "held",
-        detail: "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
-      };
-    }
-    return {
-      linked: false,
-      reason: "error",
-      detail: err2 instanceof Error ? err2.message : String(err2)
-    };
-  }
-}
-
 // src/project-hydrate.ts
 init_src11();
 init_profile2();
@@ -85409,7 +85467,31 @@ import { extname as extname3 } from "node:path";
 init_profile2();
 var exec = promisify2(execFile4);
 var KINDS = { function: "Function", class: "Class", method: "Method", interface: "Interface", const: "Const", enum: "Enum", typealias: "TypeAlias", namespace: "Namespace", property: "Property" };
+var inFlight = /* @__PURE__ */ new Map();
 async function syncHistoryRevision(opts) {
+  const current = inFlight.get(opts.root);
+  if (current) return current;
+  const work = (async () => {
+    const started2 = Date.now();
+    let changed = 0, remaining = false;
+    const pages = Math.min(20, Math.max(1, opts.maxPages ?? 10));
+    for (let i2 = 0; i2 < pages; i2++) {
+      const result = await syncHistoryRevisionPage(opts);
+      changed += result.changed;
+      remaining = result.remaining;
+      if (!remaining || Date.now() - started2 >= (opts.budgetMs ?? 45e3)) break;
+      await new Promise((resolve7) => setImmediate(resolve7));
+    }
+    return { changed, remaining };
+  })();
+  inFlight.set(opts.root, work);
+  try {
+    return await work;
+  } finally {
+    if (inFlight.get(opts.root) === work) inFlight.delete(opts.root);
+  }
+}
+async function syncHistoryRevisionPage(opts) {
   const { root, profile, store, cloud, salt } = opts;
   if (!profile.projectId) return { changed: 0, remaining: false };
   const projectId = profile.projectId;
@@ -85419,7 +85501,8 @@ async function syncHistoryRevision(opts) {
   const oldCursor = profile.historyRevisionCursor;
   const same = oldCursor?.atCommit === atCommit;
   if (same && oldCursor.complete && Date.now() - oldCursor.updatedAt < 60 * 6e4) return { changed: 0, remaining: false };
-  const after = same && !oldCursor.complete ? oldCursor.after : void 0;
+  const after = oldCursor && !oldCursor.complete ? oldCursor.after : void 0;
+  const sweepCommit = after ? oldCursor.atCommit : atCommit;
   const page = await cloud.getHistoryOccurrences(projectId, atCommit, after);
   if (!Array.isArray(page.occurrences) || page.occurrences.length > 50 || page.occurrences.some((o, i2) => o.occurrenceId <= (page.occurrences[i2 - 1]?.occurrenceId ?? after ?? "")) || page.cursor !== null && page.cursor !== page.occurrences.at(-1)?.occurrenceId) throw new Error("invalid history occurrence page");
   const parents = (await git3(["rev-list", "--parents", "--max-count=8192", atCommit])).trim().split("\n").filter(Boolean).map((row) => {
@@ -85475,7 +85558,7 @@ async function syncHistoryRevision(opts) {
   }
   const response = page.occurrences.length ? await cloud.reconcileHistory(projectId, { atCommit, parents, observations }) : { atCommit, receipts: [] };
   if (response.atCommit !== atCommit || response.receipts.length !== page.occurrences.length || new Set(response.receipts.map((r) => r.occurrenceId)).size !== response.receipts.length || response.receipts.some((r) => r.atCommit !== atCommit || !observations.some((o) => o.occurrenceId === r.occurrenceId))) throw new Error("incomplete history reconciliation response");
-  if ((await git3(["rev-parse", "--verify", "HEAD"])).trim() !== atCommit) return { changed: 0, remaining: true };
+  const headChanged = (await git3(["rev-parse", "--verify", "HEAD"])).trim() !== atCommit;
   let changed = 0;
   for (const occurrence of page.occurrences) {
     const node2 = store.getNode(occurrence.canonicalId) ?? (occurrence.nodeId ? store.getNode(occurrence.nodeId) : null);
@@ -85491,9 +85574,9 @@ async function syncHistoryRevision(opts) {
     } } });
     changed++;
   }
-  profile.historyRevisionCursor = { atCommit, ...page.cursor ? { after: page.cursor } : {}, complete: page.cursor === null, updatedAt: Date.now() };
+  profile.historyRevisionCursor = { atCommit: sweepCommit, ...page.cursor ? { after: page.cursor } : {}, complete: page.cursor === null, updatedAt: Date.now() };
   (opts.save ?? ((p) => saveProfile(root, p)))(profile);
-  return { changed, remaining: page.cursor !== null };
+  return { changed, remaining: page.cursor !== null || headChanged || sweepCommit !== atCommit };
 }
 
 // src/project-history.ts
@@ -88054,6 +88137,8 @@ async function startMultiDaemon(opts = {}) {
     // eslint-disable-next-line no-console
     log: (line) => console.log(line)
   });
+  const revisionBacklog = /* @__PURE__ */ new Set();
+  const lastAnchorPull = /* @__PURE__ */ new Map();
   const pullProjectAnchors = async (r, client, salt) => {
     const donePass = markPass(`anchor-pull:${r.engine.profile.name}`);
     const beforeCorrections = r.engine.profile.projectHistoryCorrectionCursor ?? 0;
@@ -88070,6 +88155,8 @@ async function startMultiDaemon(opts = {}) {
     }
     try {
       const revision = await syncHistoryRevision({ root: r.root, profile: r.engine.profile, store: r.engine.store, cloud: client, salt });
+      if (revision.remaining) revisionBacklog.add(r.root);
+      else revisionBacklog.delete(r.root);
       if (revision.changed) r.engine.markContextDirty();
     } catch (err2) {
       console.warn(`[errata] history revision reconciliation failed for ${r.engine.profile.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
@@ -88086,30 +88173,39 @@ async function startMultiDaemon(opts = {}) {
     }
   };
   const ANCHOR_PULL_INTERVAL_MS = 10 * 60 * 1e3;
+  let anchorPullRunning = false;
   const anchorPullAll = async () => {
-    const c = loadConfig();
-    if (registryCorrupt()) return;
-    for (const r of records) {
-      const projectId = r.engine.profile.projectId;
-      if (!projectId || !effectiveConsent(c, r.engine.profile).sync) continue;
-      const identity = identityFor(liveWorkspaceEntry(r.entry));
-      if (identity.invalid) {
-        noteIdentityBlock(r.id, r.entry.name, identity);
-        continue;
-      }
-      if (identity.rule !== "workspace-binding" && !hasCloudCredential(c)) continue;
-      const client = cloudForIdentity(identity);
-      try {
-        const { salt } = await resolveProjectSymbolSalt(client, projectId);
-        await pullProjectAnchors(r, client, salt);
-      } catch (err2) {
-        console.warn(`[errata] anchor pull skipped for ${r.engine.profile.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    if (anchorPullRunning) return;
+    anchorPullRunning = true;
+    try {
+      const c = loadConfig();
+      if (registryCorrupt()) return;
+      for (const r of records) {
+        if (!revisionBacklog.has(r.root) && Date.now() - (lastAnchorPull.get(r.root) ?? 0) < ANCHOR_PULL_INTERVAL_MS) continue;
+        const projectId = r.engine.profile.projectId;
+        if (!projectId || !effectiveConsent(c, r.engine.profile).sync) continue;
+        const identity = identityFor(liveWorkspaceEntry(r.entry));
+        if (identity.invalid) {
+          noteIdentityBlock(r.id, r.entry.name, identity);
+          continue;
+        }
+        if (identity.rule !== "workspace-binding" && !hasCloudCredential(c)) continue;
+        const client = cloudForIdentity(identity);
+        try {
+          const { salt } = await resolveProjectSymbolSalt(client, projectId);
+          await pullProjectAnchors(r, client, salt);
+          lastAnchorPull.set(r.root, Date.now());
+        } catch (err2) {
+          console.warn(`[errata] anchor pull skipped for ${r.engine.profile.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+        }
       }
+    } finally {
+      anchorPullRunning = false;
     }
   };
   const anchorPull = setInterval(() => {
     void anchorPullAll();
-  }, ANCHOR_PULL_INTERVAL_MS);
+  }, 6e4);
   const ambientLinkAll = async () => {
     const c = loadConfig();
     if (registryCorrupt()) return;
@@ -89024,7 +89120,6 @@ async function startMultiDaemon(opts = {}) {
 // src/cli.ts
 init_src5();
 init_profile2();
-init_consent();
 init_git_remote();
 init_config();
 init_src7();
@@ -90222,7 +90317,7 @@ Commands:
   login               Sign in with the cloud. Default: short verification URL +
                       typeable code (device-bridged OAuth). Flags: --browser
                       (loopback code flow) \xB7 --token <key> \xB7
-                      --device --installation <uuid> [--profile <name>]
+                      --device --installation <uuid> [--profile <name>] [--make-default]
                       (headless, installation-bound console device authorization)
   logout              Clear local cloud credentials
   doctor [--json]     Verify profile, credential authority, renewal, endpoint,
@@ -90852,6 +90947,7 @@ function parseFlags(args2) {
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
     else if (a === "--device") out2.device = true;
+    else if (a === "--make-default") out2.makeDefault = true;
     else if (a === "--browser") out2.browser = true;
     else if (a === "--installation") out2.installation = args2[++i2];
     else if (a.startsWith("--installation=")) out2.installation = a.slice("--installation=".length);
@@ -90925,6 +91021,8 @@ async function applyToken(cfg, token) {
     cfg.oauthClientId = null;
     cfg.userId = me.agentId;
     cfg.email = me.handle;
+    cfg.activeInstallationProfile = null;
+    cfg.activeAgent = null;
     saveConfig(cfg);
     console.log(`logged in as ${me.handle} (${me.tier}) \u2014 key stored`);
     return true;
@@ -90975,7 +91073,9 @@ async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
     refreshToken: result.tokens.refreshToken ?? null,
     tokenEndpoint: result.tokenEndpoint,
     oauthClientId: result.clientId,
-    apiKey: null
+    apiKey: null,
+    activeInstallationProfile: null,
+    activeAgent: null
   };
   try {
     const me = await authedCloudClient(nextCfg).me();
@@ -91016,58 +91116,38 @@ async function cmdLoginOAuthDevice(cfg, input) {
         console.log(`code: ${userCode} \xB7 expires in ${Math.round(expiresInSec / 60)} minutes`);
       }
     });
-    const nextCfg = {
-      ...cfg,
-      apiKey: null,
-      accessToken: result.tokens.accessToken,
-      refreshToken: result.tokens.refreshToken ?? null,
-      tokenEndpoint: result.tokenEndpoint,
-      oauthClientId: result.clientId,
-      activeInstallationProfile: profileName,
-      installationProfiles: {
-        ...cfg.installationProfiles,
-        [profileName]: {
-          installationId: result.installationId,
-          cloudUrl: cfg.cloudUrl,
-          apiKey: null,
-          accessToken: result.tokens.accessToken,
-          refreshToken: result.tokens.refreshToken ?? null,
-          tokenEndpoint: result.tokenEndpoint,
-          oauthClientId: result.clientId,
-          activeAgent: cfg.activeAgent
-        }
+    const nextCfg = configWithDeviceLogin(loadConfig(), {
+      profileName,
+      makeDefault: input.makeDefault ?? !input.profileName,
+      profile: {
+        installationId: result.installationId,
+        cloudUrl: cfg.cloudUrl,
+        apiKey: null,
+        accessToken: result.tokens.accessToken,
+        refreshToken: result.tokens.refreshToken ?? null,
+        tokenEndpoint: result.tokenEndpoint,
+        oauthClientId: result.clientId,
+        activeAgent: null
       }
-    };
-    const me = await authedCloudClient(nextCfg).me();
-    nextCfg.userId = me.agentId;
-    nextCfg.email = me.handle;
+    });
+    const me = await authedCloudClientForProfile(nextCfg, profileName).me();
+    if (nextCfg.activeInstallationProfile === profileName) {
+      nextCfg.userId = me.agentId;
+      nextCfg.email = me.handle;
+    }
     saveConfig(nextCfg);
     console.log(
       `logged in as ${me.handle} (${me.tier}) \xB7 profile ${profileName} \xB7 installation ${result.installationId}`
     );
-    await linkRegisteredWorkspaces(nextCfg);
+    await linkRegisteredWorkspaces(nextCfg, profileName);
+    console.log(`machine default: ${nextCfg.activeInstallationProfile ?? "top-level credential"}; workspaces using this profile: ${listWorkspaces().filter((w) => w.installationProfile === profileName || !w.installationProfile && nextCfg.activeInstallationProfile === profileName).map((w) => w.name).join(", ") || "none (bind a workspace to use it)"}`);
   } catch (err2) {
     console.error(`device login failed: ${err2 instanceof Error ? err2.message : err2}`);
     console.error("  no credential was stored; retry from Console \u2192 Connect");
     process.exitCode = 1;
   }
 }
-async function linkRegisteredWorkspaces(cfg) {
-  const client = authedCloudClient(cfg);
-  for (const w of listWorkspaces()) {
-    try {
-      const profile = loadProfile(w.path);
-      if (!profile || !effectiveConsent(cfg, profile).sync) continue;
-      refreshRepoLocator(w.path, profile);
-      const out2 = await ensureProjectLink(w.path, profile, client);
-      if (out2.linked) {
-        console.log(`  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`);
-      }
-    } catch {
-    }
-  }
-}
-async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
+async function bindWorkspaceToLinkInstallation(cfg, out2, orgId, cloudUrl) {
   const installationId = out2.installationId;
   if (!out2.deviceSession) {
     console.warn(
@@ -91091,7 +91171,7 @@ async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
         ...cfg.installationProfiles,
         [profileName]: {
           installationId,
-          cloudUrl: cfg.cloudUrl,
+          cloudUrl,
           apiKey: null,
           accessToken: minted.tokens.accessToken,
           refreshToken: minted.tokens.refreshToken ?? null,
@@ -91123,8 +91203,9 @@ async function cmdLink(args2) {
     return;
   }
   const cfg = loadConfig();
+  const cloud = workspaceCloud(cfg, workspaceEntryForPath(ROOT));
   const wantsLocal = args2.includes("--local") || Boolean(flag("--project")) || Boolean(flag("--name"));
-  if (wantsLocal && !hasCloudCredential(cfg)) {
+  if (wantsLocal && !cloud.hasCredential) {
     console.error("not logged in \u2014 run `errata login` first (linking needs your cloud identity)");
     process.exitCode = 1;
     return;
@@ -91149,7 +91230,7 @@ async function cmdLink(args2) {
       return;
     }
     saveProfile(ROOT, profile);
-    const activeProfile = cfg.activeInstallationProfile ? cfg.installationProfiles[cfg.activeInstallationProfile] : void 0;
+    const activeProfile = cloud.profile;
     const facts = {
       locator: profile.repoLocator,
       name: profile.name,
@@ -91158,7 +91239,7 @@ async function cmdLink(args2) {
     };
     try {
       const out3 = await linkThroughConsole({
-        cloudUrl: cfg.cloudUrl,
+        cloudUrl: cloud.config.cloudUrl,
         facts,
         timeoutMs: 15 * 6e4,
         onVerification: ({ url: url2, userCode, expiresInSec }) => {
@@ -91191,24 +91272,28 @@ async function cmdLink(args2) {
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
-      let reportClient = authedCloudClient(applied.config);
+      let reportCloud = workspaceCloud(applied.config, workspaceEntryForPath(ROOT));
+      let reportClient = reportCloud.client;
       if (out3.installationId && out3.installationId !== activeProfile?.installationId) {
-        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId);
+        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId, cloud.config.cloudUrl);
         if (bound) {
-          reportClient = authedCloudClientForProfile(bound.config, bound.profileName);
+          reportCloud = workspaceCloud(bound.config, workspaceEntryForPath(ROOT));
+          reportClient = reportCloud.client;
           console.log(
             `this workspace now uses installation ${out3.installationId.slice(0, 8)} (profile ${bound.profileName}) in org ${d.orgId.slice(0, 8)}; your machine default is unchanged`
           );
+        } else {
+          return;
         }
       }
-      if (!hasCloudCredential(cfg)) {
+      if (!reportCloud.hasCredential) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
         return;
       }
       const consents = historyConsents(applied.profile);
       const reported = await reportHistoryStage(reportClient, applied.profile, (line) => console.warn(line));
       if (reported?.consents) {
-        const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
+        const synced = applyConsents(applied.profile, loadConfig(), reported.consents, (/* @__PURE__ */ new Date()).toISOString());
         if (synced.changed) {
           saveProfile(ROOT, synced.profile);
           saveConfig(synced.config);
@@ -91220,7 +91305,7 @@ async function cmdLink(args2) {
       return;
     } catch (err2) {
       const message2 = err2 instanceof Error ? err2.message : String(err2);
-      if (!/does not offer the link flow/.test(message2) || !hasCloudCredential(cfg)) {
+      if (!/does not offer the link flow/.test(message2) || !cloud.hasCredential) {
         console.error(`link failed: ${message2}`);
         process.exitCode = 1;
         return;
@@ -91228,7 +91313,7 @@ async function cmdLink(args2) {
       console.log(`${message2}; falling back to the ambient resolve`);
     }
   }
-  const client = authedCloudClient(cfg);
+  const client = cloud.client;
   const adoptId = flag("--project");
   if (adoptId) {
     if (!profile.repoLocator) {
@@ -91285,7 +91370,12 @@ async function cmdUnlink() {
 async function cmdLogin() {
   const cfg = loadConfig();
   const flags2 = parseFlags(rest);
-  if (flags2.cloud) applyCloudUrl(cfg, flags2.cloud);
+  if (flags2.profile && (!flags2.device || flags2.token)) {
+    console.error("--profile requires --device --installation <uuid>; the machine default was not changed");
+    process.exitCode = 1;
+    return;
+  }
+  if (flags2.cloud) cfg.cloudUrl = normalizeCloudUrl(flags2.cloud);
   if (flags2.token) {
     await applyToken(cfg, flags2.token);
     printBoundWorkspaceNotice();
@@ -91299,7 +91389,8 @@ async function cmdLogin() {
     }
     await cmdLoginOAuthDevice(cfg, {
       installationId: flags2.installation,
-      ...flags2.profile ? { profileName: flags2.profile } : {}
+      ...flags2.profile ? { profileName: flags2.profile } : {},
+      ...flags2.makeDefault ? { makeDefault: true } : {}
     });
     printBoundWorkspaceNotice();
     return;
@@ -91361,6 +91452,8 @@ async function cmdLogin() {
       cfg.oauthClientId = null;
       cfg.userId = poll.agentId ?? null;
       cfg.email = poll.handle ?? handle2;
+      cfg.activeInstallationProfile = null;
+      cfg.activeAgent = null;
       saveConfig(cfg);
       try {
         const me = await authedCloudClient(cfg).me();
@@ -91421,7 +91514,7 @@ function printBoundWorkspaceNotice() {
   } catch {
   }
 }
-function cmdInstallationProfile(args2) {
+async function cmdInstallationProfile(args2) {
   const cfg = loadConfig();
   const action = args2[0] ?? "list";
   if (action === "list") {
@@ -91458,7 +91551,7 @@ function cmdInstallationProfile(args2) {
     if (!hasCloudCredential(cfg)) {
       throw new Error("not logged in \u2014 install the Console credential before saving a profile");
     }
-    saveInstallationProfile(name2, installationId, cfg);
+    await saveVerifiedInstallationProfile(name2, installationId, cfg);
     console.log(`profile saved: ${name2} \xB7 installation ${installationId}`);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3125",
+  "version": "2.0.14-dev.3128",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {