@inerrata-corporation/errata 2.0.6-dev.1989 → 2.0.6-dev.2028

package/consolidate-worker.mjs

@@ -15267,7 +15267,7 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15368,6 +15368,8 @@ var init_wire = __esm({
       independent: external_exports.number().int().min(0).optional(),
       inferredIndependent: external_exports.number().int().min(0).optional()
     });
+    ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
+    ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15386,8 +15388,8 @@ var init_wire = __esm({
          *  (reanchor) compares the hash with its local symbol's `bodyHash` to
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
-        observedAtCommit: external_exports.string().regex(/^[0-9a-f]{7,40}$/).optional(),
-        symbolContentHash: external_exports.string().regex(/^[0-9a-f]{8,64}$/).optional()
+        observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(

package/errata.mjs

@@ -15711,6 +15711,15 @@ function provenanceBand(source) {
 function isSeedProvenance(source) {
   return provenanceBand(source) === "seed";
 }
+function anchorVersionAttrs(attrs) {
+  if (!attrs) return {};
+  const commit = attrs["observedAtCommit"];
+  const hash2 = attrs["symbolContentHash"];
+  return {
+    ...typeof commit === "string" && ANCHOR_COMMIT_SHA_RE.test(commit) ? { observedAtCommit: commit } : {},
+    ...typeof hash2 === "string" && ANCHOR_BODY_HASH_RE.test(hash2) ? { symbolContentHash: hash2 } : {}
+  };
+}
 function validateCastaliaPayload(p) {
   const errors = [];
   const labelByCid = /* @__PURE__ */ new Map();
@@ -15740,7 +15749,7 @@ function summarizeIngestResult(r) {
     ...r.patternReconciliation ? { patternReconciliation: r.patternReconciliation } : {}
   };
 }
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15844,6 +15853,8 @@ var init_wire = __esm({
       independent: external_exports.number().int().min(0).optional(),
       inferredIndependent: external_exports.number().int().min(0).optional()
     });
+    ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
+    ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15862,8 +15873,8 @@ var init_wire = __esm({
          *  (reanchor) compares the hash with its local symbol's `bodyHash` to
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
-        observedAtCommit: external_exports.string().regex(/^[0-9a-f]{7,40}$/).optional(),
-        symbolContentHash: external_exports.string().regex(/^[0-9a-f]{8,64}$/).optional()
+        observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(
@@ -16334,6 +16345,8 @@ __export(src_exports, {
   ALL_EDGE_TYPES: () => ALL_EDGE_TYPES,
   ALL_NODE_LABELS: () => ALL_NODE_LABELS,
   AMBIGUOUS_ALIASES: () => AMBIGUOUS_ALIASES,
+  ANCHOR_BODY_HASH_RE: () => ANCHOR_BODY_HASH_RE,
+  ANCHOR_COMMIT_SHA_RE: () => ANCHOR_COMMIT_SHA_RE,
   ANCHOR_REFUSAL_REASONS: () => ANCHOR_REFUSAL_REASONS,
   BELIEF_EDGES: () => BELIEF_EDGES,
   BRIDGE_EDGES: () => BRIDGE_EDGES,
@@ -16392,6 +16405,7 @@ __export(src_exports, {
   VALIDATION_SOURCES: () => VALIDATION_SOURCES,
   aliasesLongestFirst: () => aliasesLongestFirst,
   allEntities: () => allEntities,
+  anchorVersionAttrs: () => anchorVersionAttrs,
   assertGraphEventVocabulary: () => assertGraphEventVocabulary,
   buildSpine: () => buildSpine,
   canonicalClaimId: () => canonicalClaimId,
@@ -24536,7 +24550,7 @@ function toWirePayload(batch, runId) {
         ...typeof e.confidence === "number" ? { confidence: clamp012(e.confidence) } : {},
         ...perContext ? { perContext } : {},
         // PJ-anchor-version: the two opaque version stamps ride on anchors only.
-        ...e.type === "ANCHORED_AT" ? wireAnchorVersion(e.attrs) : {}
+        ...e.type === "ANCHORED_AT" ? anchorVersionAttrs(e.attrs) : {}
       }
     };
   });
@@ -24572,15 +24586,6 @@ function textOrThrow(value, field) {
   if (!text) throw new TypeError(`${field} must be a non-empty string`);
   return text;
 }
-function wireAnchorVersion(attrs) {
-  if (!attrs) return {};
-  const commit = attrs["observedAtCommit"];
-  const hash2 = attrs["symbolContentHash"];
-  return {
-    ...typeof commit === "string" && HEX_SHA.test(commit) ? { observedAtCommit: commit } : {},
-    ...typeof hash2 === "string" && HEX_BODY.test(hash2) ? { symbolContentHash: hash2 } : {}
-  };
-}
 function optionalEdgeAttrs(confidence) {
   return typeof confidence === "number" ? { confidence: clamp012(confidence) } : void 0;
 }
@@ -24706,15 +24711,13 @@ function provenanceHeaders(provenance) {
     ...provenance.agentModel ? { "x-inerrata-agent-model": provenance.agentModel } : {}
   };
 }
-var asWireCount, HEX_SHA, HEX_BODY, INGEST_NODE_CHUNK, E6B_PUBLIC_CONTEXT_SENTINEL, CloudClient, CloudError;
+var asWireCount, INGEST_NODE_CHUNK, E6B_PUBLIC_CONTEXT_SENTINEL, CloudClient, CloudError;
 var init_client = __esm({
   "../../packages/cloud-client/src/client.ts"() {
     "use strict";
     init_oauth();
     init_src();
     asWireCount = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0 ? Math.floor(n) : null;
-    HEX_SHA = /^[0-9a-f]{7,40}$/;
-    HEX_BODY = /^[0-9a-f]{8,64}$/;
     INGEST_NODE_CHUNK = 8;
     E6B_PUBLIC_CONTEXT_SENTINEL = "00000000-0000-4e6b-8000-000000000e6b";
     CloudClient = class {
@@ -77005,7 +77008,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.1989" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2028" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -79334,7 +79337,7 @@ init_identity2();
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync30, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
 
 // src/principle-sync.ts
 init_src5();
@@ -79729,15 +79732,6 @@ function contributedWireId(n) {
 }
 var WIRE_CANONICAL_ID_MIN = 6;
 var SHIP_TERMINAL_REFUSALS = 3;
-function anchorVersionAttrs(attrs) {
-  if (!attrs) return {};
-  const commit = attrs["observedAtCommit"];
-  const hash2 = attrs["symbolContentHash"];
-  return {
-    ...typeof commit === "string" && /^[0-9a-f]{7,40}$/.test(commit) ? { observedAtCommit: commit } : {},
-    ...typeof hash2 === "string" && /^[0-9a-f]{8,64}$/.test(hash2) ? { symbolContentHash: hash2 } : {}
-  };
-}
 function refusalFingerprint(reason, description) {
   return digest(`${reason}\0${description}`);
 }
@@ -82299,10 +82293,14 @@ function applyStopRequest(profile, now = () => /* @__PURE__ */ new Date()) {
     }
   };
 }
-async function startHistoryStage(root, profile, client, walk10 = {}) {
+async function startHistoryStage(root, input, client, walk10 = {}) {
+  let profile = input;
   if (!profile.projectId) return { started: false, reason: "no-project", profile };
-  const consents = historyConsents(profile);
   const response = await reportHistoryStage(client, profile);
+  if (response?.consents && walk10.applyConsents) {
+    profile = walk10.applyConsents(profile, response.consents);
+  }
+  const consents = historyConsents(profile);
   if (response?.stopRequested && profile.historyStage && profile.historyStage.state !== "refused") {
     const stopped = applyStopRequest(profile);
     await reportHistoryStage(client, stopped);
@@ -82313,17 +82311,414 @@ async function startHistoryStage(root, profile, client, walk10 = {}) {
   return { started: true, profile: outcome.profile };
 }
 
+// src/link-flow.ts
+init_cloud_auth();
+import { createHash as createHash15 } from "node:crypto";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync29, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join34 } from "node:path";
+
+// src/oauth-login.ts
+init_src7();
+init_cloud_auth();
+import { createServer } from "node:http";
+var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var strip = (u) => u.replace(/\/+$/, "");
+function deviceEndpoints(tokenEndpoint) {
+  const token = new URL(tokenEndpoint);
+  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
+  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
+  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
+  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
+  return {
+    code: at(`${prefix}/api/auth/device/code`),
+    token: at(`${prefix}/api/auth/device/token`),
+    resource: at(`${prefix}/api/gate/session-token`)
+  };
+}
+async function loginOAuthDevice(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope })
+  });
+  if (!codeResponse.ok) {
+    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("device authorization returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  let deviceSession = null;
+  let approvedInstallation = null;
+  while (Date.now() < deadline) {
+    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      throw new Error(`device authorization failed: ${error48}`);
+    }
+    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
+    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
+    break;
+  }
+  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
+  if (approvedInstallation !== opts.installationId) {
+    throw new Error("approved installation does not match the terminal request");
+  }
+  const resourceResponse = await fetchFn(device.resource, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${deviceSession}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({
+      installationId: approvedInstallation,
+      clientId,
+      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
+    })
+  });
+  const resource = await resourceResponse.json().catch(() => null);
+  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
+    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
+  }
+  return {
+    installationId: approvedInstallation,
+    clientId,
+    tokenEndpoint: device.resource,
+    tokens: {
+      accessToken: resource["access_token"],
+      refreshToken: deviceSession,
+      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
+    }
+  };
+}
+async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
+  let consoleUrl = cloudUrl;
+  try {
+    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
+    if (prm.ok) {
+      const j = await prm.json();
+      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
+    }
+  } catch {
+  }
+  try {
+    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
+    if (asm.ok) {
+      const j = await asm.json();
+      if (j.authorization_endpoint && j.token_endpoint) {
+        return {
+          authorizationEndpoint: j.authorization_endpoint,
+          tokenEndpoint: j.token_endpoint,
+          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
+        };
+      }
+    }
+  } catch {
+  }
+  const base = strip(consoleUrl);
+  return {
+    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
+    tokenEndpoint: `${base}/api/auth/oauth2/token`
+  };
+}
+function buildAuthorizeUrl(endpoint, p) {
+  const u = new URL(endpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", p.redirectUri);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  return u.toString();
+}
+async function loginOAuthLoopback(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const pkce = generatePkce();
+  const state = randomState();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const { code, redirectUri, clientId } = await new Promise(
+    (resolve7, reject) => {
+      const server = createServer((req, res) => {
+        const u = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (u.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const addr2 = server.address();
+        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+        const err2 = u.searchParams.get("error");
+        const code2 = u.searchParams.get("code");
+        const returnedState = u.searchParams.get("state");
+        if (err2 || !code2 || returnedState !== state) {
+          res.writeHead(400, { "content-type": "text/plain" });
+          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
+          server.close();
+          reject(new Error(err2 ?? "invalid_callback"));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html" });
+        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
+        server.close();
+        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
+      });
+      let activeClientId = oauthClientId();
+      server.on("error", reject);
+      server.listen(0, "127.0.0.1", () => {
+        void (async () => {
+          try {
+            const addr2 = server.address();
+            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
+            if (endpoints.registrationEndpoint) {
+              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+                redirectUri: redirectUri2,
+                scope,
+                clientName: "errata daemon"
+              });
+              activeClientId = registered.clientId;
+            }
+            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
+              clientId: activeClientId,
+              redirectUri: redirectUri2,
+              scope,
+              state,
+              challenge: pkce.challenge,
+              method: pkce.method
+            });
+            if (opts.open) opts.open(url2);
+            else console.log(`approve this login in your browser:
+  ${url2}`);
+          } catch (err2) {
+            server.close();
+            reject(err2);
+          }
+        })();
+      });
+      if (opts.timeoutMs) {
+        setTimeout(() => {
+          server.close();
+          reject(new Error("login timed out \u2014 run `errata login` again"));
+        }, opts.timeoutMs).unref?.();
+      }
+    }
+  );
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri,
+    clientId
+  });
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+
+// src/link-flow.ts
+function remoteFingerprint(locator) {
+  return createHash15("sha256").update(locator).digest("hex");
+}
+function isDecision(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
+}
+async function linkThroughConsole(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const link = {
+    locator: opts.facts.locator,
+    remoteFingerprint: remoteFingerprint(opts.facts.locator),
+    ...opts.facts.name ? { name: opts.facts.name } : {},
+    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
+    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
+    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
+    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
+  };
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
+  });
+  if (!codeResponse.ok) {
+    const text = (await codeResponse.text()).slice(0, 200);
+    if (codeResponse.status === 404) {
+      throw new Error("this console does not offer the link flow yet (device authorization is off)");
+    }
+    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("link request returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      if (error48 === "access_denied") return { status: "denied" };
+      if (error48 === "expired_token") return { status: "expired" };
+      throw new Error(`link approval failed: ${error48}`);
+    }
+    const decision = payload?.["link"];
+    if (!isDecision(decision)) {
+      throw new Error("the console approved the device but returned no link decision");
+    }
+    return {
+      status: "approved",
+      decision,
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+    };
+  }
+  return { status: "expired" };
+}
+function collectRepoFacts(root) {
+  const git3 = (args2) => {
+    try {
+      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
+  const count = git3(["rev-list", "--count", "HEAD"]);
+  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
+  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
+  return {
+    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
+    ...typeof commitCount === "number" ? { commitCount } : {}
+  };
+}
+var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
+# Paths, content keywords and tags listed here are dropped from hunks and
+# narrative before anything leaves this machine, and an ignored path yields no
+# symbol anchor at all. Scrubbing is best effort; this list is absolute.
+# A personal list can only add to the organization's list, never weaken it.
+
+# secrets and environment
+.env
+.env.*
+*.pem
+*.key
+*.p12
+secrets/
+credentials*
+
+# fixtures and captured data
+fixtures/
+**/testdata/
+*.dump
+*.sql.gz
+`;
+function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
+  const nextConfig = {
+    ...config2,
+    consent: {
+      ...config2.consent,
+      sync: c.sync !== "off",
+      telemetry: c.telemetry,
+      contributePackages: c.packages && c.sync !== "off"
+    },
+    onboardedAt: config2.onboardedAt ?? now()
+  };
+  const nextProfile = {
+    ...profile,
+    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
+    linkConsents: {
+      structure: c.structure,
+      mineHistory: c.mineHistory,
+      contributeHistory: c.contributeHistory && c.mineHistory && c.sync !== "off",
+      decidedAt
+    }
+  };
+  const prev = profile.linkConsents;
+  const changed = profile.syncConsent !== nextProfile.syncConsent || config2.consent.sync !== nextConfig.consent.sync || config2.consent.telemetry !== nextConfig.consent.telemetry || config2.consent.contributePackages !== nextConfig.consent.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
+  return { profile: nextProfile, config: nextConfig, changed };
+}
+function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
+  const applied = applyConsents(profile, config2, decision.consents, decision.approvedAt, now);
+  const nextConfig = applied.config;
+  const nextProfile = {
+    ...applied.profile,
+    projectId: decision.projectId,
+    projectLocator: decision.locator
+  };
+  delete nextProfile.projectLinkDisabled;
+  let wroteIgnore = false;
+  if (decision.writeIgnoreStarter !== false) {
+    const target = join34(root, ".errataignore");
+    if (!existsSync29(target)) {
+      writeFileSync22(target, IGNORE_STARTER, "utf8");
+      wroteIgnore = true;
+    }
+  }
+  return { profile: nextProfile, config: nextConfig, wroteIgnore };
+}
+
 // src/multi.ts
 init_registry();
 
 // src/adopt.ts
 init_git_remote();
-import { existsSync as existsSync29 } from "node:fs";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { dirname as dirname12, join as join35 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync29(join34(dir, ".git"))) return dir;
+    if (existsSync30(join35(dir, ".git"))) return dir;
     const parent = dirname12(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -82843,7 +83238,7 @@ async function startMultiDaemon(opts = {}) {
     records.push(rec);
     void ambientLinkAll();
     try {
-      writeFileSync22(
+      writeFileSync23(
         rec.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${rec.id}`, startedAt: Date.now() }),
         "utf8"
@@ -83056,7 +83451,7 @@ async function startMultiDaemon(opts = {}) {
         lastActiveAt = Math.max(lastActiveAt, rec.engine.lastActivityAt());
       } catch {
       }
-      const reason = retireDecision({ exists: existsSync30(rec.root), lastActiveAt, now });
+      const reason = retireDecision({ exists: existsSync31(rec.root), lastActiveAt, now });
       if (reason) void retireWorkspace(rec, reason);
     }
   };
@@ -83124,7 +83519,7 @@ async function startMultiDaemon(opts = {}) {
   baseUrl = `http://127.0.0.1:${port}`;
   try {
     ensureDir(globalDir());
-    writeFileSync22(
+    writeFileSync23(
       lockPath,
       JSON.stringify({ pid: process.pid, webUiUrl: baseUrl, startedAt: Date.now() }),
       "utf8"
@@ -83133,7 +83528,7 @@ async function startMultiDaemon(opts = {}) {
   }
   for (const r of records) {
     try {
-      writeFileSync22(
+      writeFileSync23(
         r.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${r.id}`, startedAt: Date.now() }),
         "utf8"
@@ -83209,7 +83604,7 @@ async function startMultiDaemon(opts = {}) {
           } else if (re.reason === "error") {
             console.warn(`[errata] project reanchor failed for ${r.engine.profile.name}: ${re.detail}`);
           }
-          if (r.engine.profile.linkConsents && r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
+          if (r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
             historyInFlight.add(r.root);
             const engine = r.engine;
             const root = r.root;
@@ -83223,6 +83618,22 @@ async function startMultiDaemon(opts = {}) {
             };
             void startHistoryStage(root, engine.profile, client, {
               anchors: { index: anchorIndex, salt },
+              // PS-web projects: the console's consents (Privacy tab) win over
+              // the profile's memory; applied to config and profile here, with
+              // the change printed so a flipped switch is visible in the log.
+              applyConsents: (p, consents) => {
+                const cfg2 = loadConfig();
+                const applied = applyConsents(p, cfg2, consents, (/* @__PURE__ */ new Date()).toISOString());
+                if (applied.changed) {
+                  saveConfig(applied.config);
+                  Object.assign(engine.profile, applied.profile);
+                  saveProfile(root, engine.profile);
+                  console.log(
+                    `[errata] consents applied from the console for ${engine.profile.name}: sync=${consents.sync} telemetry=${consents.telemetry ? "on" : "off"} packages=${consents.packages ? "on" : "off"} structure=${consents.structure ? "on" : "off"} history=${consents.mineHistory ? consents.contributeHistory ? "mine+contribute" : "mine" : "off"}`
+                  );
+                }
+                return applied.profile;
+              },
               saveProfile: (p) => {
                 Object.assign(engine.profile, p);
                 saveProfile(root, engine.profile);
@@ -84008,392 +84419,6 @@ function errText(err2) {
 // src/cli.ts
 init_cloud_endpoint_policy();
 
-// src/oauth-login.ts
-init_src7();
-init_cloud_auth();
-import { createServer } from "node:http";
-var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
-var strip = (u) => u.replace(/\/+$/, "");
-function deviceEndpoints(tokenEndpoint) {
-  const token = new URL(tokenEndpoint);
-  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
-  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
-  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
-  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
-  return {
-    code: at(`${prefix}/api/auth/device/code`),
-    token: at(`${prefix}/api/auth/device/token`),
-    resource: at(`${prefix}/api/gate/session-token`)
-  };
-}
-async function loginOAuthDevice(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope })
-  });
-  if (!codeResponse.ok) {
-    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
-  }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("device authorization returned an incomplete response");
-  }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  let deviceSession = null;
-  let approvedInstallation = null;
-  while (Date.now() < deadline) {
-    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
-      }
-      throw new Error(`device authorization failed: ${error48}`);
-    }
-    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
-    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
-    break;
-  }
-  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
-  if (approvedInstallation !== opts.installationId) {
-    throw new Error("approved installation does not match the terminal request");
-  }
-  const resourceResponse = await fetchFn(device.resource, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${deviceSession}`,
-      "content-type": "application/json",
-      accept: "application/json"
-    },
-    body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
-      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
-    })
-  });
-  const resource = await resourceResponse.json().catch(() => null);
-  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
-    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
-  }
-  return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
-    tokens: {
-      accessToken: resource["access_token"],
-      refreshToken: deviceSession,
-      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
-    }
-  };
-}
-async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
-  let consoleUrl = cloudUrl;
-  try {
-    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
-    if (prm.ok) {
-      const j = await prm.json();
-      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
-    }
-  } catch {
-  }
-  try {
-    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
-    if (asm.ok) {
-      const j = await asm.json();
-      if (j.authorization_endpoint && j.token_endpoint) {
-        return {
-          authorizationEndpoint: j.authorization_endpoint,
-          tokenEndpoint: j.token_endpoint,
-          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
-        };
-      }
-    }
-  } catch {
-  }
-  const base = strip(consoleUrl);
-  return {
-    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
-    tokenEndpoint: `${base}/api/auth/oauth2/token`
-  };
-}
-function buildAuthorizeUrl(endpoint, p) {
-  const u = new URL(endpoint);
-  u.searchParams.set("response_type", "code");
-  u.searchParams.set("client_id", p.clientId);
-  u.searchParams.set("redirect_uri", p.redirectUri);
-  u.searchParams.set("scope", p.scope);
-  u.searchParams.set("state", p.state);
-  u.searchParams.set("code_challenge", p.challenge);
-  u.searchParams.set("code_challenge_method", p.method);
-  return u.toString();
-}
-async function loginOAuthLoopback(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const pkce = generatePkce();
-  const state = randomState();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const { code, redirectUri, clientId } = await new Promise(
-    (resolve7, reject) => {
-      const server = createServer((req, res) => {
-        const u = new URL(req.url ?? "/", "http://127.0.0.1");
-        if (u.pathname !== "/callback") {
-          res.writeHead(404);
-          res.end();
-          return;
-        }
-        const addr2 = server.address();
-        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-        const err2 = u.searchParams.get("error");
-        const code2 = u.searchParams.get("code");
-        const returnedState = u.searchParams.get("state");
-        if (err2 || !code2 || returnedState !== state) {
-          res.writeHead(400, { "content-type": "text/plain" });
-          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
-          server.close();
-          reject(new Error(err2 ?? "invalid_callback"));
-          return;
-        }
-        res.writeHead(200, { "content-type": "text/html" });
-        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
-        server.close();
-        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
-      });
-      let activeClientId = oauthClientId();
-      server.on("error", reject);
-      server.listen(0, "127.0.0.1", () => {
-        void (async () => {
-          try {
-            const addr2 = server.address();
-            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
-            if (endpoints.registrationEndpoint) {
-              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
-                redirectUri: redirectUri2,
-                scope,
-                clientName: "errata daemon"
-              });
-              activeClientId = registered.clientId;
-            }
-            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
-              clientId: activeClientId,
-              redirectUri: redirectUri2,
-              scope,
-              state,
-              challenge: pkce.challenge,
-              method: pkce.method
-            });
-            if (opts.open) opts.open(url2);
-            else console.log(`approve this login in your browser:
-  ${url2}`);
-          } catch (err2) {
-            server.close();
-            reject(err2);
-          }
-        })();
-      });
-      if (opts.timeoutMs) {
-        setTimeout(() => {
-          server.close();
-          reject(new Error("login timed out \u2014 run `errata login` again"));
-        }, opts.timeoutMs).unref?.();
-      }
-    }
-  );
-  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
-    code,
-    codeVerifier: pkce.verifier,
-    redirectUri,
-    clientId
-  });
-  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
-}
-
-// src/link-flow.ts
-init_cloud_auth();
-import { createHash as createHash15 } from "node:crypto";
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync31, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join35 } from "node:path";
-function remoteFingerprint(locator) {
-  return createHash15("sha256").update(locator).digest("hex");
-}
-function isDecision(value) {
-  if (!value || typeof value !== "object") return false;
-  const v = value;
-  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
-}
-async function linkThroughConsole(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const link = {
-    locator: opts.facts.locator,
-    remoteFingerprint: remoteFingerprint(opts.facts.locator),
-    ...opts.facts.name ? { name: opts.facts.name } : {},
-    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
-    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
-    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
-    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
-  };
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
-  });
-  if (!codeResponse.ok) {
-    const text = (await codeResponse.text()).slice(0, 200);
-    if (codeResponse.status === 404) {
-      throw new Error("this console does not offer the link flow yet (device authorization is off)");
-    }
-    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
-  }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("link request returned an incomplete response");
-  }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
-      }
-      if (error48 === "access_denied") return { status: "denied" };
-      if (error48 === "expired_token") return { status: "expired" };
-      throw new Error(`link approval failed: ${error48}`);
-    }
-    const decision = payload?.["link"];
-    if (!isDecision(decision)) {
-      throw new Error("the console approved the device but returned no link decision");
-    }
-    return {
-      status: "approved",
-      decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
-    };
-  }
-  return { status: "expired" };
-}
-function collectRepoFacts(root) {
-  const git3 = (args2) => {
-    try {
-      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    } catch {
-      return null;
-    }
-  };
-  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
-  const count = git3(["rev-list", "--count", "HEAD"]);
-  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
-  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
-  return {
-    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
-    ...typeof commitCount === "number" ? { commitCount } : {}
-  };
-}
-var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
-# Paths, content keywords and tags listed here are dropped from hunks and
-# narrative before anything leaves this machine, and an ignored path yields no
-# symbol anchor at all. Scrubbing is best effort; this list is absolute.
-# A personal list can only add to the organization's list, never weaken it.
-
-# secrets and environment
-.env
-.env.*
-*.pem
-*.key
-*.p12
-secrets/
-credentials*
-
-# fixtures and captured data
-fixtures/
-**/testdata/
-*.dump
-*.sql.gz
-`;
-function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
-  const c = decision.consents;
-  const nextConfig = {
-    ...config2,
-    consent: {
-      ...config2.consent,
-      sync: c.sync !== "off",
-      telemetry: c.telemetry,
-      contributePackages: c.packages && c.sync !== "off"
-    },
-    onboardedAt: config2.onboardedAt ?? now()
-  };
-  const nextProfile = {
-    ...profile,
-    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
-    projectId: decision.projectId,
-    projectLocator: decision.locator,
-    linkConsents: {
-      structure: c.structure,
-      mineHistory: c.mineHistory,
-      contributeHistory: c.contributeHistory && c.sync !== "off",
-      decidedAt: decision.approvedAt
-    }
-  };
-  delete nextProfile.projectLinkDisabled;
-  let wroteIgnore = false;
-  if (decision.writeIgnoreStarter !== false) {
-    const target = join35(root, ".errataignore");
-    if (!existsSync31(target)) {
-      writeFileSync23(target, IGNORE_STARTER, "utf8");
-      wroteIgnore = true;
-    }
-  }
-  return { profile: nextProfile, config: nextConfig, wroteIgnore };
-}
-
 // src/device-login.ts
 init_src7();
 var DEFAULT_SCOPE = "openid profile graph:read graph:write mcp:tools";
@@ -86076,6 +86101,13 @@ async function cmdLink(args2) {
       }
       const consents = historyConsents(applied.profile);
       const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      if (reported?.consents) {
+        const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
+        if (synced.changed) {
+          saveProfile(ROOT, synced.profile);
+          saveConfig(synced.config);
+        }
+      }
       if (!consents.mineHistory) console.log("history: not mined (consent off)");
       else if (reported?.stopRequested) console.log("history: a stop request is standing in the console; the daemon honours it");
       else console.log(`history: consents recorded${consents.contributeHistory ? "" : " (mine only)"} \xB7 the daemon walks the repo on its next pass`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.6-dev.1989",
+  "version": "2.0.6-dev.2028",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -15140,7 +15140,7 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15241,6 +15241,8 @@ var init_wire = __esm({
       independent: external_exports.number().int().min(0).optional(),
       inferredIndependent: external_exports.number().int().min(0).optional()
     });
+    ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
+    ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15259,8 +15261,8 @@ var init_wire = __esm({
          *  (reanchor) compares the hash with its local symbol's `bodyHash` to
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
-        observedAtCommit: external_exports.string().regex(/^[0-9a-f]{7,40}$/).optional(),
-        symbolContentHash: external_exports.string().regex(/^[0-9a-f]{8,64}$/).optional()
+        observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(