@inerrata-corporation/errata 2.0.14-dev.3126 → 2.0.14-dev.3128

package/errata.mjs

@@ -81027,7 +81027,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3126" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3128" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -83521,6 +83521,151 @@ async function listenServer(fetchFn, port) {
 init_registry();
 init_identity2();
 
+// src/cli-identity.ts
+init_cloud_auth();
+init_config();
+init_consent();
+init_identity2();
+init_profile2();
+
+// src/project-link.ts
+init_profile2();
+import { execFile as execFile3 } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile3);
+function isClaimedElsewhere(err2) {
+  if (!err2 || typeof err2 !== "object") return false;
+  const e = err2;
+  return e.status === 409 && e.code === "claimed_elsewhere";
+}
+function claimHoldStands(onDisk) {
+  return Boolean(onDisk && !onDisk.projectId && onDisk.projectLinkHold);
+}
+var LINK_FIELDS = [
+  "projectId",
+  "projectLocator",
+  "projectLinkHold",
+  "projectLinkDisabled",
+  "rootCommitReportedFor"
+];
+function adoptLinkFields(into, from) {
+  for (const k of LINK_FIELDS) {
+    if (from[k] === void 0) delete into[k];
+    else into[k] = from[k];
+  }
+}
+async function readRootCommit(root) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 15e3,
+      windowsHide: true
+    });
+    const sha2 = stdout.split(/\s+/).filter(Boolean).pop();
+    return sha2 && /^[0-9a-f]{40,64}$/i.test(sha2) ? sha2.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureProjectLink(root, profile, client, rootCommit = readRootCommit) {
+  if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
+  const locator = profile.repoLocator;
+  if (!locator) return { linked: false, reason: "no-locator" };
+  if (profile.projectId && profile.projectLocator === locator) {
+    if (profile.rootCommitReportedFor !== profile.projectId && client.recordProjectRootCommit) {
+      const sha2 = await rootCommit(root);
+      if (sha2) {
+        try {
+          await client.recordProjectRootCommit(profile.projectId, sha2);
+          profile.rootCommitReportedFor = profile.projectId;
+          saveProfile(root, profile);
+        } catch {
+        }
+      }
+    }
+    return { linked: false, reason: "already-linked" };
+  }
+  try {
+    const sha2 = await rootCommit(root);
+    const res = await client.resolveProject(locator, profile.name, sha2 ?? void 0);
+    profile.projectId = res.project.id;
+    profile.projectLocator = locator;
+    if (sha2) profile.rootCommitReportedFor = res.project.id;
+    delete profile.projectLinkHold;
+    saveProfile(root, profile);
+    return { linked: true, projectId: res.project.id, created: res.created };
+  } catch (err2) {
+    if (isClaimedElsewhere(err2)) {
+      if (profile.projectLinkHold?.locator !== locator) {
+        profile.projectLinkHold = { reason: "claimed-elsewhere", locator, since: Date.now() };
+        saveProfile(root, profile);
+      }
+      return {
+        linked: false,
+        reason: "held",
+        detail: "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
+      };
+    }
+    return {
+      linked: false,
+      reason: "error",
+      detail: err2 instanceof Error ? err2.message : String(err2)
+    };
+  }
+}
+
+// src/cli-identity.ts
+init_registry();
+function workspaceCloud(cfg, entry, env2 = process.env) {
+  if (registryCorrupt() && !env2["ERRATA_CONFIG_PATH"]) throw new IdentityBlockedError("workspace registry is unreadable");
+  const identity = resolveWorkspaceIdentity(cfg, entry, env2);
+  if (identity.invalid) throw new IdentityBlockedError(identity.reason);
+  const name2 = identity.profileName ?? cfg.activeInstallationProfile;
+  const profile = name2 ? cfg.installationProfiles[name2] : void 0;
+  if (name2 && !profile) throw new IdentityBlockedError(`installation profile not found: ${name2}`);
+  const config2 = profile ? { ...cfg, ...profile, activeInstallationProfile: name2 } : cfg;
+  return {
+    identity,
+    config: config2,
+    profile,
+    hasCredential: hasCloudCredential(config2),
+    client: name2 ? authedCloudClientForProfile(cfg, name2) : authedCloudClient(cfg),
+    profileName: name2
+  };
+}
+function configWithDeviceLogin(cfg, input) {
+  const name2 = input.profileName.trim();
+  if (!name2 || name2.length > 80) throw new Error("profile name must be 1\u201380 characters");
+  const selected = input.makeDefault || cfg.activeInstallationProfile === name2;
+  return {
+    ...cfg,
+    ...selected ? { ...input.profile, activeInstallationProfile: name2 } : {},
+    installationProfiles: { ...cfg.installationProfiles, [name2]: input.profile }
+  };
+}
+async function saveVerifiedInstallationProfile(name2, installationId, cfg) {
+  const result = await authedCloudClient(cfg).context();
+  if (result.context.installation_id?.toLowerCase() !== installationId.toLowerCase()) {
+    throw new Error("credential belongs to a different installation (or is unbound); use login --device for the requested installation");
+  }
+  return saveInstallationProfile(name2, installationId, cfg);
+}
+async function linkRegisteredWorkspaces(cfg, loggedInProfile = cfg.activeInstallationProfile, log = console.log, env2 = process.env) {
+  for (const entry of listWorkspaces()) {
+    try {
+      const cloud = workspaceCloud(cfg, entry, env2);
+      if (cloud.profileName !== loggedInProfile || !cloud.hasCredential) continue;
+      const profile = loadProfile(entry.path);
+      if (!profile || !effectiveConsent(cloud.config, profile).sync) continue;
+      refreshRepoLocator(entry.path, profile);
+      const out2 = await ensureProjectLink(entry.path, profile, cloud.client);
+      if (out2.linked) log(`  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""} \xB7 profile ${cloud.profileName ?? "default"}`);
+    } catch {
+    }
+  }
+}
+
 // src/instance-receipts.ts
 import { createHash as createHash18 } from "node:crypto";
 var FIELDS = ["contributedAtSeq", "cloudNodeId", "anchorsContributedDigest", "projectAnchorsContributedDigest", "semanticEdgesContributedDigest", "shipRefusedSinceSeq", "shipRefusedCount", "shipRefusedReason", "shipRefusedFingerprint"];
@@ -84912,93 +85057,6 @@ function liveCloudClient(src) {
 // src/multi.ts
 init_identity2();
 
-// src/project-link.ts
-init_profile2();
-import { execFile as execFile3 } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile3);
-function isClaimedElsewhere(err2) {
-  if (!err2 || typeof err2 !== "object") return false;
-  const e = err2;
-  return e.status === 409 && e.code === "claimed_elsewhere";
-}
-function claimHoldStands(onDisk) {
-  return Boolean(onDisk && !onDisk.projectId && onDisk.projectLinkHold);
-}
-var LINK_FIELDS = [
-  "projectId",
-  "projectLocator",
-  "projectLinkHold",
-  "projectLinkDisabled",
-  "rootCommitReportedFor"
-];
-function adoptLinkFields(into, from) {
-  for (const k of LINK_FIELDS) {
-    if (from[k] === void 0) delete into[k];
-    else into[k] = from[k];
-  }
-}
-async function readRootCommit(root) {
-  try {
-    const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
-      cwd: root,
-      encoding: "utf8",
-      timeout: 15e3,
-      windowsHide: true
-    });
-    const sha2 = stdout.split(/\s+/).filter(Boolean).pop();
-    return sha2 && /^[0-9a-f]{40,64}$/i.test(sha2) ? sha2.toLowerCase() : null;
-  } catch {
-    return null;
-  }
-}
-async function ensureProjectLink(root, profile, client, rootCommit = readRootCommit) {
-  if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
-  const locator = profile.repoLocator;
-  if (!locator) return { linked: false, reason: "no-locator" };
-  if (profile.projectId && profile.projectLocator === locator) {
-    if (profile.rootCommitReportedFor !== profile.projectId && client.recordProjectRootCommit) {
-      const sha2 = await rootCommit(root);
-      if (sha2) {
-        try {
-          await client.recordProjectRootCommit(profile.projectId, sha2);
-          profile.rootCommitReportedFor = profile.projectId;
-          saveProfile(root, profile);
-        } catch {
-        }
-      }
-    }
-    return { linked: false, reason: "already-linked" };
-  }
-  try {
-    const sha2 = await rootCommit(root);
-    const res = await client.resolveProject(locator, profile.name, sha2 ?? void 0);
-    profile.projectId = res.project.id;
-    profile.projectLocator = locator;
-    if (sha2) profile.rootCommitReportedFor = res.project.id;
-    delete profile.projectLinkHold;
-    saveProfile(root, profile);
-    return { linked: true, projectId: res.project.id, created: res.created };
-  } catch (err2) {
-    if (isClaimedElsewhere(err2)) {
-      if (profile.projectLinkHold?.locator !== locator) {
-        profile.projectLinkHold = { reason: "claimed-elsewhere", locator, since: Date.now() };
-        saveProfile(root, profile);
-      }
-      return {
-        linked: false,
-        reason: "held",
-        detail: "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
-      };
-    }
-    return {
-      linked: false,
-      reason: "error",
-      detail: err2 instanceof Error ? err2.message : String(err2)
-    };
-  }
-}
-
 // src/project-hydrate.ts
 init_src11();
 init_profile2();
@@ -89062,7 +89120,6 @@ async function startMultiDaemon(opts = {}) {
 // src/cli.ts
 init_src5();
 init_profile2();
-init_consent();
 init_git_remote();
 init_config();
 init_src7();
@@ -90260,7 +90317,7 @@ Commands:
   login               Sign in with the cloud. Default: short verification URL +
                       typeable code (device-bridged OAuth). Flags: --browser
                       (loopback code flow) \xB7 --token <key> \xB7
-                      --device --installation <uuid> [--profile <name>]
+                      --device --installation <uuid> [--profile <name>] [--make-default]
                       (headless, installation-bound console device authorization)
   logout              Clear local cloud credentials
   doctor [--json]     Verify profile, credential authority, renewal, endpoint,
@@ -90890,6 +90947,7 @@ function parseFlags(args2) {
     else if (a.startsWith("--token=")) out2.token = a.slice("--token=".length);
     else if (a === "--oauth") out2.oauth = true;
     else if (a === "--device") out2.device = true;
+    else if (a === "--make-default") out2.makeDefault = true;
     else if (a === "--browser") out2.browser = true;
     else if (a === "--installation") out2.installation = args2[++i2];
     else if (a.startsWith("--installation=")) out2.installation = a.slice("--installation=".length);
@@ -90963,6 +91021,8 @@ async function applyToken(cfg, token) {
     cfg.oauthClientId = null;
     cfg.userId = me.agentId;
     cfg.email = me.handle;
+    cfg.activeInstallationProfile = null;
+    cfg.activeAgent = null;
     saveConfig(cfg);
     console.log(`logged in as ${me.handle} (${me.tier}) \u2014 key stored`);
     return true;
@@ -91013,7 +91073,9 @@ async function cmdLoginOAuth(cfg, useBrowserLoopback = false) {
     refreshToken: result.tokens.refreshToken ?? null,
     tokenEndpoint: result.tokenEndpoint,
     oauthClientId: result.clientId,
-    apiKey: null
+    apiKey: null,
+    activeInstallationProfile: null,
+    activeAgent: null
   };
   try {
     const me = await authedCloudClient(nextCfg).me();
@@ -91054,58 +91116,38 @@ async function cmdLoginOAuthDevice(cfg, input) {
         console.log(`code: ${userCode} \xB7 expires in ${Math.round(expiresInSec / 60)} minutes`);
       }
     });
-    const nextCfg = {
-      ...cfg,
-      apiKey: null,
-      accessToken: result.tokens.accessToken,
-      refreshToken: result.tokens.refreshToken ?? null,
-      tokenEndpoint: result.tokenEndpoint,
-      oauthClientId: result.clientId,
-      activeInstallationProfile: profileName,
-      installationProfiles: {
-        ...cfg.installationProfiles,
-        [profileName]: {
-          installationId: result.installationId,
-          cloudUrl: cfg.cloudUrl,
-          apiKey: null,
-          accessToken: result.tokens.accessToken,
-          refreshToken: result.tokens.refreshToken ?? null,
-          tokenEndpoint: result.tokenEndpoint,
-          oauthClientId: result.clientId,
-          activeAgent: cfg.activeAgent
-        }
+    const nextCfg = configWithDeviceLogin(loadConfig(), {
+      profileName,
+      makeDefault: input.makeDefault ?? !input.profileName,
+      profile: {
+        installationId: result.installationId,
+        cloudUrl: cfg.cloudUrl,
+        apiKey: null,
+        accessToken: result.tokens.accessToken,
+        refreshToken: result.tokens.refreshToken ?? null,
+        tokenEndpoint: result.tokenEndpoint,
+        oauthClientId: result.clientId,
+        activeAgent: null
       }
-    };
-    const me = await authedCloudClient(nextCfg).me();
-    nextCfg.userId = me.agentId;
-    nextCfg.email = me.handle;
+    });
+    const me = await authedCloudClientForProfile(nextCfg, profileName).me();
+    if (nextCfg.activeInstallationProfile === profileName) {
+      nextCfg.userId = me.agentId;
+      nextCfg.email = me.handle;
+    }
     saveConfig(nextCfg);
     console.log(
       `logged in as ${me.handle} (${me.tier}) \xB7 profile ${profileName} \xB7 installation ${result.installationId}`
     );
-    await linkRegisteredWorkspaces(nextCfg);
+    await linkRegisteredWorkspaces(nextCfg, profileName);
+    console.log(`machine default: ${nextCfg.activeInstallationProfile ?? "top-level credential"}; workspaces using this profile: ${listWorkspaces().filter((w) => w.installationProfile === profileName || !w.installationProfile && nextCfg.activeInstallationProfile === profileName).map((w) => w.name).join(", ") || "none (bind a workspace to use it)"}`);
   } catch (err2) {
     console.error(`device login failed: ${err2 instanceof Error ? err2.message : err2}`);
     console.error("  no credential was stored; retry from Console \u2192 Connect");
     process.exitCode = 1;
   }
 }
-async function linkRegisteredWorkspaces(cfg) {
-  const client = authedCloudClient(cfg);
-  for (const w of listWorkspaces()) {
-    try {
-      const profile = loadProfile(w.path);
-      if (!profile || !effectiveConsent(cfg, profile).sync) continue;
-      refreshRepoLocator(w.path, profile);
-      const out2 = await ensureProjectLink(w.path, profile, client);
-      if (out2.linked) {
-        console.log(`  linked ${profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`);
-      }
-    } catch {
-    }
-  }
-}
-async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
+async function bindWorkspaceToLinkInstallation(cfg, out2, orgId, cloudUrl) {
   const installationId = out2.installationId;
   if (!out2.deviceSession) {
     console.warn(
@@ -91129,7 +91171,7 @@ async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
         ...cfg.installationProfiles,
         [profileName]: {
           installationId,
-          cloudUrl: cfg.cloudUrl,
+          cloudUrl,
           apiKey: null,
           accessToken: minted.tokens.accessToken,
           refreshToken: minted.tokens.refreshToken ?? null,
@@ -91161,8 +91203,9 @@ async function cmdLink(args2) {
     return;
   }
   const cfg = loadConfig();
+  const cloud = workspaceCloud(cfg, workspaceEntryForPath(ROOT));
   const wantsLocal = args2.includes("--local") || Boolean(flag("--project")) || Boolean(flag("--name"));
-  if (wantsLocal && !hasCloudCredential(cfg)) {
+  if (wantsLocal && !cloud.hasCredential) {
     console.error("not logged in \u2014 run `errata login` first (linking needs your cloud identity)");
     process.exitCode = 1;
     return;
@@ -91187,7 +91230,7 @@ async function cmdLink(args2) {
       return;
     }
     saveProfile(ROOT, profile);
-    const activeProfile = cfg.activeInstallationProfile ? cfg.installationProfiles[cfg.activeInstallationProfile] : void 0;
+    const activeProfile = cloud.profile;
     const facts = {
       locator: profile.repoLocator,
       name: profile.name,
@@ -91196,7 +91239,7 @@ async function cmdLink(args2) {
     };
     try {
       const out3 = await linkThroughConsole({
-        cloudUrl: cfg.cloudUrl,
+        cloudUrl: cloud.config.cloudUrl,
         facts,
         timeoutMs: 15 * 6e4,
         onVerification: ({ url: url2, userCode, expiresInSec }) => {
@@ -91229,24 +91272,28 @@ async function cmdLink(args2) {
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
-      let reportClient = authedCloudClient(applied.config);
+      let reportCloud = workspaceCloud(applied.config, workspaceEntryForPath(ROOT));
+      let reportClient = reportCloud.client;
       if (out3.installationId && out3.installationId !== activeProfile?.installationId) {
-        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId);
+        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId, cloud.config.cloudUrl);
         if (bound) {
-          reportClient = authedCloudClientForProfile(bound.config, bound.profileName);
+          reportCloud = workspaceCloud(bound.config, workspaceEntryForPath(ROOT));
+          reportClient = reportCloud.client;
           console.log(
             `this workspace now uses installation ${out3.installationId.slice(0, 8)} (profile ${bound.profileName}) in org ${d.orgId.slice(0, 8)}; your machine default is unchanged`
           );
+        } else {
+          return;
         }
       }
-      if (!hasCloudCredential(cfg)) {
+      if (!reportCloud.hasCredential) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
         return;
       }
       const consents = historyConsents(applied.profile);
       const reported = await reportHistoryStage(reportClient, applied.profile, (line) => console.warn(line));
       if (reported?.consents) {
-        const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
+        const synced = applyConsents(applied.profile, loadConfig(), reported.consents, (/* @__PURE__ */ new Date()).toISOString());
         if (synced.changed) {
           saveProfile(ROOT, synced.profile);
           saveConfig(synced.config);
@@ -91258,7 +91305,7 @@ async function cmdLink(args2) {
       return;
     } catch (err2) {
       const message2 = err2 instanceof Error ? err2.message : String(err2);
-      if (!/does not offer the link flow/.test(message2) || !hasCloudCredential(cfg)) {
+      if (!/does not offer the link flow/.test(message2) || !cloud.hasCredential) {
         console.error(`link failed: ${message2}`);
         process.exitCode = 1;
         return;
@@ -91266,7 +91313,7 @@ async function cmdLink(args2) {
       console.log(`${message2}; falling back to the ambient resolve`);
     }
   }
-  const client = authedCloudClient(cfg);
+  const client = cloud.client;
   const adoptId = flag("--project");
   if (adoptId) {
     if (!profile.repoLocator) {
@@ -91323,7 +91370,12 @@ async function cmdUnlink() {
 async function cmdLogin() {
   const cfg = loadConfig();
   const flags2 = parseFlags(rest);
-  if (flags2.cloud) applyCloudUrl(cfg, flags2.cloud);
+  if (flags2.profile && (!flags2.device || flags2.token)) {
+    console.error("--profile requires --device --installation <uuid>; the machine default was not changed");
+    process.exitCode = 1;
+    return;
+  }
+  if (flags2.cloud) cfg.cloudUrl = normalizeCloudUrl(flags2.cloud);
   if (flags2.token) {
     await applyToken(cfg, flags2.token);
     printBoundWorkspaceNotice();
@@ -91337,7 +91389,8 @@ async function cmdLogin() {
     }
     await cmdLoginOAuthDevice(cfg, {
       installationId: flags2.installation,
-      ...flags2.profile ? { profileName: flags2.profile } : {}
+      ...flags2.profile ? { profileName: flags2.profile } : {},
+      ...flags2.makeDefault ? { makeDefault: true } : {}
     });
     printBoundWorkspaceNotice();
     return;
@@ -91399,6 +91452,8 @@ async function cmdLogin() {
       cfg.oauthClientId = null;
       cfg.userId = poll.agentId ?? null;
       cfg.email = poll.handle ?? handle2;
+      cfg.activeInstallationProfile = null;
+      cfg.activeAgent = null;
       saveConfig(cfg);
       try {
         const me = await authedCloudClient(cfg).me();
@@ -91459,7 +91514,7 @@ function printBoundWorkspaceNotice() {
   } catch {
   }
 }
-function cmdInstallationProfile(args2) {
+async function cmdInstallationProfile(args2) {
   const cfg = loadConfig();
   const action = args2[0] ?? "list";
   if (action === "list") {
@@ -91496,7 +91551,7 @@ function cmdInstallationProfile(args2) {
     if (!hasCloudCredential(cfg)) {
       throw new Error("not logged in \u2014 install the Console credential before saving a profile");
     }
-    saveInstallationProfile(name2, installationId, cfg);
+    await saveVerifiedInstallationProfile(name2, installationId, cfg);
     console.log(`profile saved: ${name2} \xB7 installation ${installationId}`);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3126",
+  "version": "2.0.14-dev.3128",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {