@inerrata-corporation/errata 2.0.6-dev.1989 → 2.0.6-dev.2029

package/errata.mjs

@@ -15711,6 +15711,15 @@ function provenanceBand(source) {
 function isSeedProvenance(source) {
   return provenanceBand(source) === "seed";
 }
+function anchorVersionAttrs(attrs) {
+  if (!attrs) return {};
+  const commit = attrs["observedAtCommit"];
+  const hash2 = attrs["symbolContentHash"];
+  return {
+    ...typeof commit === "string" && ANCHOR_COMMIT_SHA_RE.test(commit) ? { observedAtCommit: commit } : {},
+    ...typeof hash2 === "string" && ANCHOR_BODY_HASH_RE.test(hash2) ? { symbolContentHash: hash2 } : {}
+  };
+}
 function validateCastaliaPayload(p) {
   const errors = [];
   const labelByCid = /* @__PURE__ */ new Map();
@@ -15740,7 +15749,7 @@ function summarizeIngestResult(r) {
     ...r.patternReconciliation ? { patternReconciliation: r.patternReconciliation } : {}
   };
 }
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15844,6 +15853,8 @@ var init_wire = __esm({
       independent: external_exports.number().int().min(0).optional(),
       inferredIndependent: external_exports.number().int().min(0).optional()
     });
+    ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
+    ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15862,8 +15873,8 @@ var init_wire = __esm({
          *  (reanchor) compares the hash with its local symbol's `bodyHash` to
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
-        observedAtCommit: external_exports.string().regex(/^[0-9a-f]{7,40}$/).optional(),
-        symbolContentHash: external_exports.string().regex(/^[0-9a-f]{8,64}$/).optional()
+        observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(
@@ -15951,6 +15962,9 @@ function projectSymbolId(projectSalt, projectId, relPath, qname, kind) {
   const path2 = normalizeSymbolPath(relPath);
   return `sym_${createHmac("sha256", projectSalt).update(`${projectId}:${path2}:${qname}:${kind}`).digest("hex").slice(0, 24)}`;
 }
+function projectSaltedNodeId(canonicalId, salt) {
+  return `projn_${createHmac("sha256", salt).update(canonicalId).digest("hex").slice(0, 24)}`;
+}
 function isMembraneSaltedId(id) {
   return typeof id === "string" && /^(orgn_|teamn_|projn_)/.test(id);
 }
@@ -16334,6 +16348,8 @@ __export(src_exports, {
   ALL_EDGE_TYPES: () => ALL_EDGE_TYPES,
   ALL_NODE_LABELS: () => ALL_NODE_LABELS,
   AMBIGUOUS_ALIASES: () => AMBIGUOUS_ALIASES,
+  ANCHOR_BODY_HASH_RE: () => ANCHOR_BODY_HASH_RE,
+  ANCHOR_COMMIT_SHA_RE: () => ANCHOR_COMMIT_SHA_RE,
   ANCHOR_REFUSAL_REASONS: () => ANCHOR_REFUSAL_REASONS,
   BELIEF_EDGES: () => BELIEF_EDGES,
   BRIDGE_EDGES: () => BRIDGE_EDGES,
@@ -16392,6 +16408,7 @@ __export(src_exports, {
   VALIDATION_SOURCES: () => VALIDATION_SOURCES,
   aliasesLongestFirst: () => aliasesLongestFirst,
   allEntities: () => allEntities,
+  anchorVersionAttrs: () => anchorVersionAttrs,
   assertGraphEventVocabulary: () => assertGraphEventVocabulary,
   buildSpine: () => buildSpine,
   canonicalClaimId: () => canonicalClaimId,
@@ -16446,6 +16463,7 @@ __export(src_exports, {
   parsePnpmLock: () => parsePnpmLock,
   prefilterEntities: () => prefilterEntities,
   problemIdFromError: () => problemIdFromError,
+  projectSaltedNodeId: () => projectSaltedNodeId,
   projectSymbolId: () => projectSymbolId,
   provenanceBand: () => provenanceBand,
   resolveCanonical: () => resolveCanonical,
@@ -17241,6 +17259,11 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
           countByLabel: this.db.prepare(
             "SELECT COUNT(*) AS n FROM nodes WHERE label = ? AND valid_to IS NULL"
           ),
+          // Identity twin of findByLabel — same live-row semantics, two attrs read in
+          // SQL, no attrs JSON.parse or embedding decode (PJ-anchor-reach).
+          identitiesByLabel: this.db.prepare(
+            "SELECT id, json_extract(attrs_json, '$.relPath') AS relPath, json_extract(attrs_json, '$.qname') AS qname FROM nodes WHERE label = ? AND valid_to IS NULL"
+          ),
           // ALL versions of a label — incl frozen/closed (valid_to set). Used by the
           // clean-reindex purge so a true wipe removes history too, not just live rows.
           findByLabelAll: this.db.prepare("SELECT * FROM nodes WHERE label = ?"),
@@ -17541,6 +17564,14 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
       countNodesByLabel(label) {
         return Number(this.stmts.countByLabel.get(label).n);
       }
+      findNodeIdentitiesByLabel(label) {
+        const rows = this.stmts.identitiesByLabel.all(label);
+        return rows.map((r) => ({
+          id: r.id,
+          relPath: typeof r.relPath === "string" ? r.relPath : null,
+          qname: typeof r.qname === "string" ? r.qname : null
+        }));
+      }
       findAllVersionsByLabel(label) {
         const rows = this.stmts.findByLabelAll.all(label);
         return rows.map(rowToNode);
@@ -24536,7 +24567,7 @@ function toWirePayload(batch, runId) {
         ...typeof e.confidence === "number" ? { confidence: clamp012(e.confidence) } : {},
         ...perContext ? { perContext } : {},
         // PJ-anchor-version: the two opaque version stamps ride on anchors only.
-        ...e.type === "ANCHORED_AT" ? wireAnchorVersion(e.attrs) : {}
+        ...e.type === "ANCHORED_AT" ? anchorVersionAttrs(e.attrs) : {}
       }
     };
   });
@@ -24572,15 +24603,6 @@ function textOrThrow(value, field) {
   if (!text) throw new TypeError(`${field} must be a non-empty string`);
   return text;
 }
-function wireAnchorVersion(attrs) {
-  if (!attrs) return {};
-  const commit = attrs["observedAtCommit"];
-  const hash2 = attrs["symbolContentHash"];
-  return {
-    ...typeof commit === "string" && HEX_SHA.test(commit) ? { observedAtCommit: commit } : {},
-    ...typeof hash2 === "string" && HEX_BODY.test(hash2) ? { symbolContentHash: hash2 } : {}
-  };
-}
 function optionalEdgeAttrs(confidence) {
   return typeof confidence === "number" ? { confidence: clamp012(confidence) } : void 0;
 }
@@ -24706,15 +24728,13 @@ function provenanceHeaders(provenance) {
     ...provenance.agentModel ? { "x-inerrata-agent-model": provenance.agentModel } : {}
   };
 }
-var asWireCount, HEX_SHA, HEX_BODY, INGEST_NODE_CHUNK, E6B_PUBLIC_CONTEXT_SENTINEL, CloudClient, CloudError;
+var asWireCount, INGEST_NODE_CHUNK, E6B_PUBLIC_CONTEXT_SENTINEL, CloudClient, CloudError;
 var init_client = __esm({
   "../../packages/cloud-client/src/client.ts"() {
     "use strict";
     init_oauth();
     init_src();
     asWireCount = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0 ? Math.floor(n) : null;
-    HEX_SHA = /^[0-9a-f]{7,40}$/;
-    HEX_BODY = /^[0-9a-f]{8,64}$/;
     INGEST_NODE_CHUNK = 8;
     E6B_PUBLIC_CONTEXT_SENTINEL = "00000000-0000-4e6b-8000-000000000e6b";
     CloudClient = class {
@@ -25210,6 +25230,28 @@ var init_client = __esm({
         }));
         return { nodes, edges, anchorEdges, symbolIds: res.symbolIds ?? [] };
       }
+      /**
+       * PJ-anchor-reach: one cursor page of the project's symbol anchors, newest
+       * stamp last. `since` is the cursor from the previous page (0 = from the
+       * beginning); the returned `cursor` continues it. Rank-independent — the
+       * daemon filters the page against its own checkout, and nothing about which
+       * symbols it holds is sent. Same membership gate as priors.
+       */
+      async getProjectAnchors(projectId, since, limit = 200) {
+        const res = await this.json(
+          "GET",
+          `/v2/projects/${encodeURIComponent(projectId)}/anchors?since=${String(Math.max(0, Math.floor(since)))}&limit=${String(limit)}`
+        );
+        const { nodes } = this.toCastalia({ nodes: res.nodes ?? [], edges: [] });
+        const anchors = (res.anchors ?? []).map((a) => ({
+          from: a.fromCanonicalId,
+          toSymbolId: a.toSymbolId,
+          type: a.type,
+          attrs: a.attrs ?? {},
+          stampedAt: typeof a.stampedAt === "number" ? a.stampedAt : 0
+        }));
+        return { nodes, anchors, cursor: typeof res.cursor === "number" ? res.cursor : since };
+      }
       /** Pull cloud-induced skills + the session-bootstrap prime payload. `seed` is the
        *  canonical ids of the agent's recent problems — the cloud ranks the skills whose
        *  motifs those problems match first (the rest are baseline). `techSeed`
@@ -70006,13 +70048,13 @@ function esc3(s) {
 function slug(name2) {
   return name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
 }
-function isLive2(verb) {
+function isLive3(verb) {
   return LIVE_VERBS.has(verb);
 }
 function nextHtml(n, opts) {
   if (!n) return "";
   const cmd2 = `errata ${n.verb}${n.arg ? " " + n.arg : ""}`;
-  const live2 = isLive2(n.verb);
+  const live2 = isLive3(n.verb);
   if (!live2 && !opts.includeFutureVerbs) return "";
   const hint = n.hint ? ` \u2014 ${esc3(n.hint)}` : "";
   const cls = live2 ? "next" : "next soon";
@@ -77005,7 +77047,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.1989" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2029" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -79334,7 +79376,7 @@ init_identity2();
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync30, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
 
 // src/principle-sync.ts
 init_src5();
@@ -79729,15 +79771,6 @@ function contributedWireId(n) {
 }
 var WIRE_CANONICAL_ID_MIN = 6;
 var SHIP_TERMINAL_REFUSALS = 3;
-function anchorVersionAttrs(attrs) {
-  if (!attrs) return {};
-  const commit = attrs["observedAtCommit"];
-  const hash2 = attrs["symbolContentHash"];
-  return {
-    ...typeof commit === "string" && /^[0-9a-f]{7,40}$/.test(commit) ? { observedAtCommit: commit } : {},
-    ...typeof hash2 === "string" && /^[0-9a-f]{8,64}$/.test(hash2) ? { symbolContentHash: hash2 } : {}
-  };
-}
 function refusalFingerprint(reason, description) {
   return digest(`${reason}\0${description}`);
 }
@@ -80512,16 +80545,88 @@ function buildReverseSymbolMap(opts) {
   const { store, salt, projectId } = opts;
   const reverse = /* @__PURE__ */ new Map();
   for (const kind of ANCHOR_SYMBOL_KINDS) {
-    for (const n of store.findNodesByLabel(kind)) {
-      const relPath = n.attrs["relPath"];
-      const qname = n.attrs["qname"];
-      if (typeof relPath !== "string" || typeof qname !== "string") continue;
-      const sym = projectSymbolId(salt, projectId, relPath, qname, n.label);
+    for (const n of store.findNodeIdentitiesByLabel(kind)) {
+      const { relPath, qname } = n;
+      if (relPath === null || qname === null) continue;
+      const sym = projectSymbolId(salt, projectId, relPath, qname, kind);
       if (!reverse.has(sym)) reverse.set(sym, n.id);
+      const twin = projectSaltedNodeId(sym, salt);
+      if (!reverse.has(twin)) reverse.set(twin, n.id);
     }
   }
   return reverse;
 }
+var ANCHOR_SOURCE_KINDS = [
+  "Problem",
+  "Solution",
+  "RootCause",
+  "Pattern",
+  "Technique",
+  "AntiPattern"
+];
+function buildOwnKnowledgeMap(opts) {
+  const { store, salt } = opts;
+  const own = /* @__PURE__ */ new Map();
+  for (const kind of ANCHOR_SOURCE_KINDS) {
+    for (const n of store.findNodeIdentitiesByLabel(kind)) {
+      if (n.id.startsWith("projn_")) continue;
+      own.set(projectSaltedNodeId(n.id, salt), n.id);
+    }
+  }
+  return own;
+}
+function resolveAnchorSource(store, from, own) {
+  if (store.getNode(from)) return from;
+  return own().get(from) ?? null;
+}
+function existingAnchor(store, from, to) {
+  const matches = store.outEdges(from, ["ANCHORED_AT"]).filter((e) => e.to === to);
+  return matches.find((e) => e.attrs["source"] !== "cloud") ?? matches[0] ?? null;
+}
+var reverseCache = /* @__PURE__ */ new WeakMap();
+var ownCache = /* @__PURE__ */ new WeakMap();
+function cachedMap(cache2, store, key, build) {
+  let refreshed = false;
+  const put = () => {
+    const map2 = build();
+    cache2.set(store, { key, map: map2 });
+    return map2;
+  };
+  return {
+    get: () => {
+      const hit = cache2.get(store);
+      if (hit && hit.key === key) return hit.map;
+      refreshed = true;
+      return put();
+    },
+    refresh: () => {
+      if (refreshed) return cache2.get(store)?.map ?? put();
+      refreshed = true;
+      return put();
+    }
+  };
+}
+function lookupLive(store, m, id) {
+  const first = m.get().get(id);
+  if (first && isLive2(store, first)) return first;
+  const second = m.refresh().get(id);
+  return second && isLive2(store, second) ? second : null;
+}
+function isLive2(store, id) {
+  const n = store.getNode(id);
+  return n !== null && (n.validTo === null || n.validTo === void 0);
+}
+function lazy2(make) {
+  let value;
+  let made = false;
+  return () => {
+    if (!made) {
+      value = make();
+      made = true;
+    }
+    return value;
+  };
+}
 async function reanchorProject(opts) {
   const { root, profile, store, cloud, salt } = opts;
   if (!profile.projectId) return { reanchored: false, reason: "no-project" };
@@ -80532,6 +80637,7 @@ async function reanchorProject(opts) {
   try {
     const res = await cloud.getProjectPriors(profile.projectId, opts.limit ?? DEFAULT_LIMIT2);
     const now = Date.now();
+    const own = lazy2(() => buildOwnKnowledgeMap({ store, salt }));
     let anchors = 0;
     let dropped = 0;
     for (const a of res.anchorEdges) {
@@ -80540,15 +80646,16 @@ async function reanchorProject(opts) {
         dropped++;
         continue;
       }
-      if (!store.getNode(a.from)) {
+      const from = resolveAnchorSource(store, a.from, own);
+      if (!from) {
         dropped++;
         continue;
       }
-      const id = edgeId(a.from, "ANCHORED_AT", localTo);
-      if (store.getEdge(id)) continue;
+      if (existingAnchor(store, from, localTo)) continue;
+      const id = edgeId(from, "ANCHORED_AT", localTo);
       const edge2 = {
         id,
-        from: a.from,
+        from,
         to: localTo,
         type: "ANCHORED_AT",
         confidence: typeof a.attrs["confidence"] === "number" ? Math.max(0, Math.min(1, a.attrs["confidence"])) : 0.5,
@@ -80576,6 +80683,92 @@ async function reanchorProject(opts) {
     };
   }
 }
+var SYNC_PAGE = 200;
+var SYNC_MAX_PAGES = 25;
+async function syncProjectAnchors(opts) {
+  const { root, profile, store, cloud, salt } = opts;
+  if (!profile.projectId) return { synced: false, reason: "no-project" };
+  const projectId = profile.projectId;
+  const key = `${projectId}|${salt}`;
+  const reverse = cachedMap(reverseCache, store, key, () => buildReverseSymbolMap({ store, salt, projectId }));
+  const own = cachedMap(ownCache, store, salt, () => buildOwnKnowledgeMap({ store, salt }));
+  const limit = opts.limit ?? SYNC_PAGE;
+  const maxPages = opts.maxPages ?? SYNC_MAX_PAGES;
+  let anchors = 0;
+  let updated = 0;
+  let dropped = 0;
+  let landed = 0;
+  let cursor = profile.projectAnchorCursor ?? 0;
+  try {
+    for (let page = 0; page < maxPages; page++) {
+      const res = await cloud.getProjectAnchors(projectId, cursor, limit);
+      if (res.anchors.length === 0) break;
+      if (reverse.get().size === 0 && reverse.refresh().size === 0) {
+        return { synced: false, reason: "no-local-symbols" };
+      }
+      const byId = new Map(res.nodes.map((n) => [n.id, n]));
+      const now = Date.now();
+      for (const a of res.anchors) {
+        if (a.type !== "ANCHORED_AT") continue;
+        const localTo = lookupLive(store, reverse, a.toSymbolId);
+        if (!localTo) {
+          dropped++;
+          continue;
+        }
+        let from = store.getNode(a.from) ? a.from : lookupLive(store, own, a.from);
+        if (!from) {
+          const node2 = byId.get(a.from);
+          if (!node2) {
+            dropped++;
+            continue;
+          }
+          store.mergeNode(node2);
+          landed++;
+          from = node2.id;
+        }
+        const existing = existingAnchor(store, from, localTo);
+        const id = existing?.id ?? edgeId(from, "ANCHORED_AT", localTo);
+        if (existing) {
+          if (existing.attrs["source"] !== "cloud") continue;
+          if (existing.attrs["symbolContentHash"] === a.attrs["symbolContentHash"] && existing.attrs["observedAtCommit"] === a.attrs["observedAtCommit"]) {
+            continue;
+          }
+        }
+        const edge2 = {
+          id,
+          from,
+          to: localTo,
+          type: "ANCHORED_AT",
+          confidence: typeof a.attrs["confidence"] === "number" ? Math.max(0, Math.min(1, a.attrs["confidence"])) : existing?.confidence ?? 0.5,
+          extractionSource: "agent-observed",
+          createdAt: existing?.createdAt ?? now,
+          lastSeenAt: now,
+          navSuccesses: existing?.navSuccesses ?? 0,
+          navFailures: existing?.navFailures ?? 0,
+          attrs: {
+            ...existing?.attrs ?? {},
+            ...a.attrs,
+            source: "cloud",
+            anchorState: classifyAnchorVersion(a.attrs, store.getNode(localTo))
+          }
+        };
+        store.mergeEdge(edge2);
+        if (existing) updated++;
+        else anchors++;
+      }
+      const next = typeof res.cursor === "number" && res.cursor > cursor ? res.cursor : cursor;
+      if (next !== cursor) {
+        cursor = next;
+        profile.projectAnchorCursor = cursor;
+        saveProfile(root, profile);
+      }
+      if (res.anchors.length < limit) break;
+    }
+    return { synced: true, anchors, updated, dropped, landed, cursor };
+  } catch (err2) {
+    return { synced: false, reason: "error", detail: err2 instanceof Error ? err2.message : String(err2) };
+  }
+}
 
 // src/project-history.ts
 init_src7();
@@ -82299,10 +82492,14 @@ function applyStopRequest(profile, now = () => /* @__PURE__ */ new Date()) {
     }
   };
 }
-async function startHistoryStage(root, profile, client, walk10 = {}) {
+async function startHistoryStage(root, input, client, walk10 = {}) {
+  let profile = input;
   if (!profile.projectId) return { started: false, reason: "no-project", profile };
-  const consents = historyConsents(profile);
   const response = await reportHistoryStage(client, profile);
+  if (response?.consents && walk10.applyConsents) {
+    profile = walk10.applyConsents(profile, response.consents);
+  }
+  const consents = historyConsents(profile);
   if (response?.stopRequested && profile.historyStage && profile.historyStage.state !== "refused") {
     const stopped = applyStopRequest(profile);
     await reportHistoryStage(client, stopped);
@@ -82313,17 +82510,414 @@ async function startHistoryStage(root, profile, client, walk10 = {}) {
   return { started: true, profile: outcome.profile };
 }
 
+// src/link-flow.ts
+init_cloud_auth();
+import { createHash as createHash15 } from "node:crypto";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync29, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join34 } from "node:path";
+
+// src/oauth-login.ts
+init_src7();
+init_cloud_auth();
+import { createServer } from "node:http";
+var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var strip = (u) => u.replace(/\/+$/, "");
+function deviceEndpoints(tokenEndpoint) {
+  const token = new URL(tokenEndpoint);
+  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
+  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
+  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
+  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
+  return {
+    code: at(`${prefix}/api/auth/device/code`),
+    token: at(`${prefix}/api/auth/device/token`),
+    resource: at(`${prefix}/api/gate/session-token`)
+  };
+}
+async function loginOAuthDevice(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope })
+  });
+  if (!codeResponse.ok) {
+    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("device authorization returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  let deviceSession = null;
+  let approvedInstallation = null;
+  while (Date.now() < deadline) {
+    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      throw new Error(`device authorization failed: ${error48}`);
+    }
+    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
+    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
+    break;
+  }
+  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
+  if (approvedInstallation !== opts.installationId) {
+    throw new Error("approved installation does not match the terminal request");
+  }
+  const resourceResponse = await fetchFn(device.resource, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${deviceSession}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({
+      installationId: approvedInstallation,
+      clientId,
+      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
+    })
+  });
+  const resource = await resourceResponse.json().catch(() => null);
+  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
+    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
+  }
+  return {
+    installationId: approvedInstallation,
+    clientId,
+    tokenEndpoint: device.resource,
+    tokens: {
+      accessToken: resource["access_token"],
+      refreshToken: deviceSession,
+      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
+    }
+  };
+}
+async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
+  let consoleUrl = cloudUrl;
+  try {
+    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
+    if (prm.ok) {
+      const j = await prm.json();
+      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
+    }
+  } catch {
+  }
+  try {
+    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
+    if (asm.ok) {
+      const j = await asm.json();
+      if (j.authorization_endpoint && j.token_endpoint) {
+        return {
+          authorizationEndpoint: j.authorization_endpoint,
+          tokenEndpoint: j.token_endpoint,
+          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
+        };
+      }
+    }
+  } catch {
+  }
+  const base = strip(consoleUrl);
+  return {
+    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
+    tokenEndpoint: `${base}/api/auth/oauth2/token`
+  };
+}
+function buildAuthorizeUrl(endpoint, p) {
+  const u = new URL(endpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", p.redirectUri);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  return u.toString();
+}
+async function loginOAuthLoopback(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const pkce = generatePkce();
+  const state = randomState();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const { code, redirectUri, clientId } = await new Promise(
+    (resolve7, reject) => {
+      const server = createServer((req, res) => {
+        const u = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (u.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const addr2 = server.address();
+        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+        const err2 = u.searchParams.get("error");
+        const code2 = u.searchParams.get("code");
+        const returnedState = u.searchParams.get("state");
+        if (err2 || !code2 || returnedState !== state) {
+          res.writeHead(400, { "content-type": "text/plain" });
+          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
+          server.close();
+          reject(new Error(err2 ?? "invalid_callback"));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html" });
+        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
+        server.close();
+        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
+      });
+      let activeClientId = oauthClientId();
+      server.on("error", reject);
+      server.listen(0, "127.0.0.1", () => {
+        void (async () => {
+          try {
+            const addr2 = server.address();
+            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
+            if (endpoints.registrationEndpoint) {
+              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+                redirectUri: redirectUri2,
+                scope,
+                clientName: "errata daemon"
+              });
+              activeClientId = registered.clientId;
+            }
+            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
+              clientId: activeClientId,
+              redirectUri: redirectUri2,
+              scope,
+              state,
+              challenge: pkce.challenge,
+              method: pkce.method
+            });
+            if (opts.open) opts.open(url2);
+            else console.log(`approve this login in your browser:
+  ${url2}`);
+          } catch (err2) {
+            server.close();
+            reject(err2);
+          }
+        })();
+      });
+      if (opts.timeoutMs) {
+        setTimeout(() => {
+          server.close();
+          reject(new Error("login timed out \u2014 run `errata login` again"));
+        }, opts.timeoutMs).unref?.();
+      }
+    }
+  );
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri,
+    clientId
+  });
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+
+// src/link-flow.ts
+function remoteFingerprint(locator) {
+  return createHash15("sha256").update(locator).digest("hex");
+}
+function isDecision(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
+}
+async function linkThroughConsole(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const link = {
+    locator: opts.facts.locator,
+    remoteFingerprint: remoteFingerprint(opts.facts.locator),
+    ...opts.facts.name ? { name: opts.facts.name } : {},
+    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
+    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
+    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
+    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
+  };
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
+  });
+  if (!codeResponse.ok) {
+    const text = (await codeResponse.text()).slice(0, 200);
+    if (codeResponse.status === 404) {
+      throw new Error("this console does not offer the link flow yet (device authorization is off)");
+    }
+    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("link request returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      if (error48 === "access_denied") return { status: "denied" };
+      if (error48 === "expired_token") return { status: "expired" };
+      throw new Error(`link approval failed: ${error48}`);
+    }
+    const decision = payload?.["link"];
+    if (!isDecision(decision)) {
+      throw new Error("the console approved the device but returned no link decision");
+    }
+    return {
+      status: "approved",
+      decision,
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+    };
+  }
+  return { status: "expired" };
+}
+function collectRepoFacts(root) {
+  const git3 = (args2) => {
+    try {
+      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
+  const count = git3(["rev-list", "--count", "HEAD"]);
+  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
+  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
+  return {
+    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
+    ...typeof commitCount === "number" ? { commitCount } : {}
+  };
+}
+var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
+# Paths, content keywords and tags listed here are dropped from hunks and
+# narrative before anything leaves this machine, and an ignored path yields no
+# symbol anchor at all. Scrubbing is best effort; this list is absolute.
+# A personal list can only add to the organization's list, never weaken it.
+
+# secrets and environment
+.env
+.env.*
+*.pem
+*.key
+*.p12
+secrets/
+credentials*
+
+# fixtures and captured data
+fixtures/
+**/testdata/
+*.dump
+*.sql.gz
+`;
+function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
+  const nextConfig = {
+    ...config2,
+    consent: {
+      ...config2.consent,
+      sync: c.sync !== "off",
+      telemetry: c.telemetry,
+      contributePackages: c.packages && c.sync !== "off"
+    },
+    onboardedAt: config2.onboardedAt ?? now()
+  };
+  const nextProfile = {
+    ...profile,
+    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
+    linkConsents: {
+      structure: c.structure,
+      mineHistory: c.mineHistory,
+      contributeHistory: c.contributeHistory && c.mineHistory && c.sync !== "off",
+      decidedAt
+    }
+  };
+  const prev = profile.linkConsents;
+  const changed = profile.syncConsent !== nextProfile.syncConsent || config2.consent.sync !== nextConfig.consent.sync || config2.consent.telemetry !== nextConfig.consent.telemetry || config2.consent.contributePackages !== nextConfig.consent.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
+  return { profile: nextProfile, config: nextConfig, changed };
+}
+function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
+  const applied = applyConsents(profile, config2, decision.consents, decision.approvedAt, now);
+  const nextConfig = applied.config;
+  const nextProfile = {
+    ...applied.profile,
+    projectId: decision.projectId,
+    projectLocator: decision.locator
+  };
+  delete nextProfile.projectLinkDisabled;
+  let wroteIgnore = false;
+  if (decision.writeIgnoreStarter !== false) {
+    const target = join34(root, ".errataignore");
+    if (!existsSync29(target)) {
+      writeFileSync22(target, IGNORE_STARTER, "utf8");
+      wroteIgnore = true;
+    }
+  }
+  return { profile: nextProfile, config: nextConfig, wroteIgnore };
+}
+
 // src/multi.ts
 init_registry();
 
 // src/adopt.ts
 init_git_remote();
-import { existsSync as existsSync29 } from "node:fs";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { existsSync as existsSync30 } from "node:fs";
+import { dirname as dirname12, join as join35 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync29(join34(dir, ".git"))) return dir;
+    if (existsSync30(join35(dir, ".git"))) return dir;
     const parent = dirname12(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -82843,7 +83437,7 @@ async function startMultiDaemon(opts = {}) {
     records.push(rec);
     void ambientLinkAll();
     try {
-      writeFileSync22(
+      writeFileSync23(
         rec.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${rec.id}`, startedAt: Date.now() }),
         "utf8"
@@ -83056,7 +83650,7 @@ async function startMultiDaemon(opts = {}) {
         lastActiveAt = Math.max(lastActiveAt, rec.engine.lastActivityAt());
       } catch {
       }
-      const reason = retireDecision({ exists: existsSync30(rec.root), lastActiveAt, now });
+      const reason = retireDecision({ exists: existsSync31(rec.root), lastActiveAt, now });
       if (reason) void retireWorkspace(rec, reason);
     }
   };
@@ -83124,7 +83718,7 @@ async function startMultiDaemon(opts = {}) {
   baseUrl = `http://127.0.0.1:${port}`;
   try {
     ensureDir(globalDir());
-    writeFileSync22(
+    writeFileSync23(
       lockPath,
       JSON.stringify({ pid: process.pid, webUiUrl: baseUrl, startedAt: Date.now() }),
       "utf8"
@@ -83133,7 +83727,7 @@ async function startMultiDaemon(opts = {}) {
   }
   for (const r of records) {
     try {
-      writeFileSync22(
+      writeFileSync23(
         r.engine.paths.daemonLock,
         JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${r.id}`, startedAt: Date.now() }),
         "utf8"
@@ -83164,6 +83758,44 @@ async function startMultiDaemon(opts = {}) {
     // eslint-disable-next-line no-console
     log: (line) => console.log(line)
   });
+  const pullProjectAnchors = async (r, client, salt) => {
+    const sync = await syncProjectAnchors({
+      root: r.root,
+      profile: r.engine.profile,
+      store: r.engine.store,
+      cloud: client,
+      salt
+    });
+    if (sync.synced) {
+      if (sync.anchors + sync.updated > 0) {
+        r.engine.markContextDirty();
+        console.log(
+          `[errata] anchors pulled for ${r.engine.profile.name} \u2014 ${sync.anchors} new, ${sync.updated} re-versioned, ${sync.dropped} unresolved (${sync.landed} priors landed, cursor ${sync.cursor})`
+        );
+      }
+    } else if (sync.reason === "error") {
+      console.warn(`[errata] anchor pull failed for ${r.engine.profile.name}: ${sync.detail}`);
+    }
+  };
+  const ANCHOR_PULL_INTERVAL_MS = 10 * 60 * 1e3;
+  const anchorPullAll = async () => {
+    const c = loadConfig();
+    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    const client = cloudNow();
+    for (const r of records) {
+      const projectId = r.engine.profile.projectId;
+      if (!projectId) continue;
+      try {
+        const { salt } = await resolveProjectSymbolSalt(client, projectId);
+        await pullProjectAnchors(r, client, salt);
+      } catch (err2) {
+        console.warn(`[errata] anchor pull skipped for ${r.engine.profile.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+      }
+    }
+  };
+  const anchorPull = setInterval(() => {
+    void anchorPullAll();
+  }, ANCHOR_PULL_INTERVAL_MS);
   const ambientLinkAll = async () => {
     const c = loadConfig();
     if (!c.consent.sync || !hasCloudCredential(c)) return;
@@ -83209,7 +83841,8 @@ async function startMultiDaemon(opts = {}) {
           } else if (re.reason === "error") {
             console.warn(`[errata] project reanchor failed for ${r.engine.profile.name}: ${re.detail}`);
           }
-          if (r.engine.profile.linkConsents && r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
+          await pullProjectAnchors(r, client, salt);
+          if (r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
             historyInFlight.add(r.root);
             const engine = r.engine;
             const root = r.root;
@@ -83223,6 +83856,22 @@ async function startMultiDaemon(opts = {}) {
             };
             void startHistoryStage(root, engine.profile, client, {
               anchors: { index: anchorIndex, salt },
+              // PS-web projects: the console's consents (Privacy tab) win over
+              // the profile's memory; applied to config and profile here, with
+              // the change printed so a flipped switch is visible in the log.
+              applyConsents: (p, consents) => {
+                const cfg2 = loadConfig();
+                const applied = applyConsents(p, cfg2, consents, (/* @__PURE__ */ new Date()).toISOString());
+                if (applied.changed) {
+                  saveConfig(applied.config);
+                  Object.assign(engine.profile, applied.profile);
+                  saveProfile(root, engine.profile);
+                  console.log(
+                    `[errata] consents applied from the console for ${engine.profile.name}: sync=${consents.sync} telemetry=${consents.telemetry ? "on" : "off"} packages=${consents.packages ? "on" : "off"} structure=${consents.structure ? "on" : "off"} history=${consents.mineHistory ? consents.contributeHistory ? "mine+contribute" : "mine" : "off"}`
+                  );
+                }
+                return applied.profile;
+              },
               saveProfile: (p) => {
                 Object.assign(engine.profile, p);
                 saveProfile(root, engine.profile);
@@ -83844,6 +84493,7 @@ async function startMultiDaemon(opts = {}) {
     async stop() {
       clearInterval(idleSweep);
       clearInterval(codexWake);
+      clearInterval(anchorPull);
       clearTimeout(codexWakeBoot);
       try {
         const cur = readFileSync30(lockPath, "utf8");
@@ -84008,392 +84658,6 @@ function errText(err2) {
 // src/cli.ts
 init_cloud_endpoint_policy();
 
-// src/oauth-login.ts
-init_src7();
-init_cloud_auth();
-import { createServer } from "node:http";
-var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
-var strip = (u) => u.replace(/\/+$/, "");
-function deviceEndpoints(tokenEndpoint) {
-  const token = new URL(tokenEndpoint);
-  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
-  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
-  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
-  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
-  return {
-    code: at(`${prefix}/api/auth/device/code`),
-    token: at(`${prefix}/api/auth/device/token`),
-    resource: at(`${prefix}/api/gate/session-token`)
-  };
-}
-async function loginOAuthDevice(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope })
-  });
-  if (!codeResponse.ok) {
-    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
-  }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("device authorization returned an incomplete response");
-  }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  let deviceSession = null;
-  let approvedInstallation = null;
-  while (Date.now() < deadline) {
-    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
-      }
-      throw new Error(`device authorization failed: ${error48}`);
-    }
-    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
-    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
-    break;
-  }
-  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
-  if (approvedInstallation !== opts.installationId) {
-    throw new Error("approved installation does not match the terminal request");
-  }
-  const resourceResponse = await fetchFn(device.resource, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${deviceSession}`,
-      "content-type": "application/json",
-      accept: "application/json"
-    },
-    body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
-      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
-    })
-  });
-  const resource = await resourceResponse.json().catch(() => null);
-  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
-    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
-  }
-  return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
-    tokens: {
-      accessToken: resource["access_token"],
-      refreshToken: deviceSession,
-      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
-    }
-  };
-}
-async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
-  let consoleUrl = cloudUrl;
-  try {
-    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
-    if (prm.ok) {
-      const j = await prm.json();
-      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
-    }
-  } catch {
-  }
-  try {
-    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
-    if (asm.ok) {
-      const j = await asm.json();
-      if (j.authorization_endpoint && j.token_endpoint) {
-        return {
-          authorizationEndpoint: j.authorization_endpoint,
-          tokenEndpoint: j.token_endpoint,
-          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
-        };
-      }
-    }
-  } catch {
-  }
-  const base = strip(consoleUrl);
-  return {
-    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
-    tokenEndpoint: `${base}/api/auth/oauth2/token`
-  };
-}
-function buildAuthorizeUrl(endpoint, p) {
-  const u = new URL(endpoint);
-  u.searchParams.set("response_type", "code");
-  u.searchParams.set("client_id", p.clientId);
-  u.searchParams.set("redirect_uri", p.redirectUri);
-  u.searchParams.set("scope", p.scope);
-  u.searchParams.set("state", p.state);
-  u.searchParams.set("code_challenge", p.challenge);
-  u.searchParams.set("code_challenge_method", p.method);
-  return u.toString();
-}
-async function loginOAuthLoopback(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const pkce = generatePkce();
-  const state = randomState();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const { code, redirectUri, clientId } = await new Promise(
-    (resolve7, reject) => {
-      const server = createServer((req, res) => {
-        const u = new URL(req.url ?? "/", "http://127.0.0.1");
-        if (u.pathname !== "/callback") {
-          res.writeHead(404);
-          res.end();
-          return;
-        }
-        const addr2 = server.address();
-        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-        const err2 = u.searchParams.get("error");
-        const code2 = u.searchParams.get("code");
-        const returnedState = u.searchParams.get("state");
-        if (err2 || !code2 || returnedState !== state) {
-          res.writeHead(400, { "content-type": "text/plain" });
-          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
-          server.close();
-          reject(new Error(err2 ?? "invalid_callback"));
-          return;
-        }
-        res.writeHead(200, { "content-type": "text/html" });
-        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
-        server.close();
-        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
-      });
-      let activeClientId = oauthClientId();
-      server.on("error", reject);
-      server.listen(0, "127.0.0.1", () => {
-        void (async () => {
-          try {
-            const addr2 = server.address();
-            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
-            if (endpoints.registrationEndpoint) {
-              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
-                redirectUri: redirectUri2,
-                scope,
-                clientName: "errata daemon"
-              });
-              activeClientId = registered.clientId;
-            }
-            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
-              clientId: activeClientId,
-              redirectUri: redirectUri2,
-              scope,
-              state,
-              challenge: pkce.challenge,
-              method: pkce.method
-            });
-            if (opts.open) opts.open(url2);
-            else console.log(`approve this login in your browser:
-  ${url2}`);
-          } catch (err2) {
-            server.close();
-            reject(err2);
-          }
-        })();
-      });
-      if (opts.timeoutMs) {
-        setTimeout(() => {
-          server.close();
-          reject(new Error("login timed out \u2014 run `errata login` again"));
-        }, opts.timeoutMs).unref?.();
-      }
-    }
-  );
-  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
-    code,
-    codeVerifier: pkce.verifier,
-    redirectUri,
-    clientId
-  });
-  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
-}
-
-// src/link-flow.ts
-init_cloud_auth();
-import { createHash as createHash15 } from "node:crypto";
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync31, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join35 } from "node:path";
-function remoteFingerprint(locator) {
-  return createHash15("sha256").update(locator).digest("hex");
-}
-function isDecision(value) {
-  if (!value || typeof value !== "object") return false;
-  const v = value;
-  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
-}
-async function linkThroughConsole(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const link = {
-    locator: opts.facts.locator,
-    remoteFingerprint: remoteFingerprint(opts.facts.locator),
-    ...opts.facts.name ? { name: opts.facts.name } : {},
-    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
-    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
-    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
-    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
-  };
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
-  });
-  if (!codeResponse.ok) {
-    const text = (await codeResponse.text()).slice(0, 200);
-    if (codeResponse.status === 404) {
-      throw new Error("this console does not offer the link flow yet (device authorization is off)");
-    }
-    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
-  }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("link request returned an incomplete response");
-  }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
-      }
-      if (error48 === "access_denied") return { status: "denied" };
-      if (error48 === "expired_token") return { status: "expired" };
-      throw new Error(`link approval failed: ${error48}`);
-    }
-    const decision = payload?.["link"];
-    if (!isDecision(decision)) {
-      throw new Error("the console approved the device but returned no link decision");
-    }
-    return {
-      status: "approved",
-      decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
-    };
-  }
-  return { status: "expired" };
-}
-function collectRepoFacts(root) {
-  const git3 = (args2) => {
-    try {
-      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    } catch {
-      return null;
-    }
-  };
-  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
-  const count = git3(["rev-list", "--count", "HEAD"]);
-  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
-  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
-  return {
-    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
-    ...typeof commitCount === "number" ? { commitCount } : {}
-  };
-}
-var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
-# Paths, content keywords and tags listed here are dropped from hunks and
-# narrative before anything leaves this machine, and an ignored path yields no
-# symbol anchor at all. Scrubbing is best effort; this list is absolute.
-# A personal list can only add to the organization's list, never weaken it.
-
-# secrets and environment
-.env
-.env.*
-*.pem
-*.key
-*.p12
-secrets/
-credentials*
-
-# fixtures and captured data
-fixtures/
-**/testdata/
-*.dump
-*.sql.gz
-`;
-function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
-  const c = decision.consents;
-  const nextConfig = {
-    ...config2,
-    consent: {
-      ...config2.consent,
-      sync: c.sync !== "off",
-      telemetry: c.telemetry,
-      contributePackages: c.packages && c.sync !== "off"
-    },
-    onboardedAt: config2.onboardedAt ?? now()
-  };
-  const nextProfile = {
-    ...profile,
-    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
-    projectId: decision.projectId,
-    projectLocator: decision.locator,
-    linkConsents: {
-      structure: c.structure,
-      mineHistory: c.mineHistory,
-      contributeHistory: c.contributeHistory && c.sync !== "off",
-      decidedAt: decision.approvedAt
-    }
-  };
-  delete nextProfile.projectLinkDisabled;
-  let wroteIgnore = false;
-  if (decision.writeIgnoreStarter !== false) {
-    const target = join35(root, ".errataignore");
-    if (!existsSync31(target)) {
-      writeFileSync23(target, IGNORE_STARTER, "utf8");
-      wroteIgnore = true;
-    }
-  }
-  return { profile: nextProfile, config: nextConfig, wroteIgnore };
-}
-
 // src/device-login.ts
 init_src7();
 var DEFAULT_SCOPE = "openid profile graph:read graph:write mcp:tools";
@@ -86076,6 +86340,13 @@ async function cmdLink(args2) {
       }
       const consents = historyConsents(applied.profile);
       const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      if (reported?.consents) {
+        const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
+        if (synced.changed) {
+          saveProfile(ROOT, synced.profile);
+          saveConfig(synced.config);
+        }
+      }
       if (!consents.mineHistory) console.log("history: not mined (consent off)");
       else if (reported?.stopRequested) console.log("history: a stop request is standing in the console; the daemon honours it");
       else console.log(`history: consents recorded${consents.contributeHistory ? "" : " (mine only)"} \xB7 the daemon walks the repo on its next pass`);