@inerrata-corporation/errata 2.0.7-dev.2782 → 2.0.7-dev.2821

package/errata.mjs

@@ -25433,8 +25433,17 @@ var init_client = __esm({
       }
       /** Resolve-or-create the org's project for a repo locator (ambient link,
        *  PJ-entity). Requires user identity on the JWT — login-gated like actAs. */
-      async resolveProject(locator, name2) {
-        return this.json("POST", "/api/gate/projects/resolve", name2 ? { locator, name: name2 } : { locator });
+      async resolveProject(locator, name2, rootCommitSha) {
+        return this.json("POST", "/api/gate/projects/resolve", {
+          locator,
+          ...name2 ? { name: name2 } : {},
+          ...rootCommitSha ? { rootCommitSha } : {}
+        });
+      }
+      /** PJ-claim-fingerprint: tell an already-linked project its repo's root commit.
+       *  Org-scoped and record-if-absent server-side; never creates a project. */
+      async recordProjectRootCommit(projectId, rootCommitSha) {
+        return this.json("POST", "/api/gate/projects/fingerprint", { projectId, rootCommitSha });
       }
       /** PJ-ingest-history: report the history stage so the console mirrors it;
        *  the answer carries the console's standing Stop. Org-scoped; foreign ids 404. */
@@ -62967,7 +62976,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-client.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Client = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -63007,7 +63016,7 @@ var require_mock_client = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -63020,7 +63029,7 @@ var require_mock_client = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -63060,7 +63069,7 @@ var require_mock_pool = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -79922,7 +79931,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.7-dev.2782" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.7-dev.2821" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -83703,17 +83712,47 @@ init_identity2();
 
 // src/project-link.ts
 init_profile2();
-async function ensureProjectLink(root, profile, client) {
+import { execFile as execFile3 } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile3);
+async function readRootCommit(root) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 15e3,
+      windowsHide: true
+    });
+    const sha2 = stdout.split(/\s+/).filter(Boolean).pop();
+    return sha2 && /^[0-9a-f]{40,64}$/i.test(sha2) ? sha2.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureProjectLink(root, profile, client, rootCommit = readRootCommit) {
   if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
   const locator = profile.repoLocator;
   if (!locator) return { linked: false, reason: "no-locator" };
   if (profile.projectId && profile.projectLocator === locator) {
+    if (profile.rootCommitReportedFor !== profile.projectId && client.recordProjectRootCommit) {
+      const sha2 = await rootCommit(root);
+      if (sha2) {
+        try {
+          await client.recordProjectRootCommit(profile.projectId, sha2);
+          profile.rootCommitReportedFor = profile.projectId;
+          saveProfile(root, profile);
+        } catch {
+        }
+      }
+    }
     return { linked: false, reason: "already-linked" };
   }
   try {
-    const res = await client.resolveProject(locator, profile.name);
+    const sha2 = await rootCommit(root);
+    const res = await client.resolveProject(locator, profile.name, sha2 ?? void 0);
     profile.projectId = res.project.id;
     profile.projectLocator = locator;
+    if (sha2) profile.rootCommitReportedFor = res.project.id;
     saveProfile(root, profile);
     return { linked: true, projectId: res.project.id, created: res.created };
   } catch (err2) {
@@ -84065,10 +84104,10 @@ async function hydrateProject(opts) {
 // src/project-history.ts
 init_src7();
 init_src();
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile4 } from "node:child_process";
 import { readFileSync as readFileSync32 } from "node:fs";
 import { join as join36 } from "node:path";
-import { promisify } from "node:util";
+import { promisify as promisify2 } from "node:util";
 
 // src/history-walk.ts
 var LOCKFILE_NAMES = /* @__PURE__ */ new Set([
@@ -84442,14 +84481,14 @@ var GitBlobReader = class {
 
 // src/project-history.ts
 init_profile2();
-var execFileAsync = promisify(execFile3);
+var execFileAsync2 = promisify2(execFile4);
 var HISTORY_EXTRACTOR_VERSION = "history-2";
 var LEASE_POLL_MS = 2e4;
 var RECOVERY_DEADLINE_MS = 15 * 6e4;
 var MAX_ANCHORS_PER_TOKEN = 20;
 var DEFAULT_LOOKAHEAD = 2;
 async function defaultGit(root, args2) {
-  const { stdout } = await execFileAsync("git", ["-C", root, ...args2], { maxBuffer: 64 * 1024 * 1024, windowsHide: true });
+  const { stdout } = await execFileAsync2("git", ["-C", root, ...args2], { maxBuffer: 64 * 1024 * 1024, windowsHide: true });
   return stdout;
 }
 function readIgnoreLines(root, profile) {
@@ -84995,16 +85034,28 @@ async function loginOAuthDevice(opts) {
   if (approvedInstallation !== opts.installationId) {
     throw new Error("approved installation does not match the terminal request");
   }
-  const resourceResponse = await fetchFn(device.resource, {
+  return exchangeDeviceSession({
+    fetchFn,
+    resourceUrl: device.resource,
+    deviceSession,
+    installationId: approvedInstallation,
+    clientId,
+    scope
+  });
+}
+async function exchangeDeviceSession(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const resourceResponse = await fetchFn(opts.resourceUrl, {
     method: "POST",
     headers: {
-      authorization: `Bearer ${deviceSession}`,
+      authorization: `Bearer ${opts.deviceSession}`,
       "content-type": "application/json",
       accept: "application/json"
     },
     body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
+      installationId: opts.installationId,
+      clientId: opts.clientId,
       scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
     })
   });
@@ -85013,12 +85064,12 @@ async function loginOAuthDevice(opts) {
     throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
   }
   return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
+    installationId: opts.installationId,
+    clientId: opts.clientId,
+    tokenEndpoint: opts.resourceUrl,
     tokens: {
       accessToken: resource["access_token"],
-      refreshToken: deviceSession,
+      refreshToken: opts.deviceSession,
       ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
     }
   };
@@ -85232,7 +85283,10 @@ async function linkThroughConsole(opts) {
     return {
       status: "approved",
       decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null,
+      deviceSession: typeof payload?.["access_token"] === "string" ? payload["access_token"] : null,
+      resourceUrl: device.resource,
+      clientId
     };
   }
   return { status: "expired" };
@@ -89222,6 +89276,50 @@ async function linkRegisteredWorkspaces(cfg) {
     }
   }
 }
+async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
+  const installationId = out2.installationId;
+  if (!out2.deviceSession) {
+    console.warn(
+      `  note: the project is in another org; run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+  try {
+    const minted = await exchangeDeviceSession({
+      resourceUrl: out2.resourceUrl,
+      deviceSession: out2.deviceSession,
+      installationId,
+      clientId: out2.clientId
+    });
+    const existing = Object.entries(cfg.installationProfiles).find(([, p]) => p.installationId === installationId)?.[0];
+    let profileName = existing ?? `link-${orgId.slice(0, 8)}`;
+    for (let i2 = 2; !existing && cfg.installationProfiles[profileName]; i2++) profileName = `link-${orgId.slice(0, 8)}-${i2}`;
+    const next = {
+      ...cfg,
+      installationProfiles: {
+        ...cfg.installationProfiles,
+        [profileName]: {
+          installationId,
+          cloudUrl: cfg.cloudUrl,
+          apiKey: null,
+          accessToken: minted.tokens.accessToken,
+          refreshToken: minted.tokens.refreshToken ?? null,
+          tokenEndpoint: minted.tokenEndpoint,
+          oauthClientId: minted.clientId,
+          activeAgent: null
+        }
+      }
+    };
+    saveConfig(next);
+    setWorkspaceBinding(workspaceEntryForPath(ROOT)?.id ?? ROOT, profileName);
+    return { config: next, profileName };
+  } catch (err2) {
+    console.warn(
+      `  note: the project is linked, but this workspace could not take the other org's credential (${err2 instanceof Error ? err2.message : String(err2)}); run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+}
 async function cmdLink(args2) {
   const flag = (name2) => {
     const i2 = args2.indexOf(name2);
@@ -89301,12 +89399,22 @@ async function cmdLink(args2) {
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
+      let reportClient = authedCloudClient(applied.config);
+      if (out3.installationId && out3.installationId !== activeProfile?.installationId) {
+        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId);
+        if (bound) {
+          reportClient = authedCloudClientForProfile(bound.config, bound.profileName);
+          console.log(
+            `this workspace now uses installation ${out3.installationId.slice(0, 8)} (profile ${bound.profileName}) in org ${d.orgId.slice(0, 8)}; your machine default is unchanged`
+          );
+        }
+      }
       if (!hasCloudCredential(cfg)) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
         return;
       }
       const consents = historyConsents(applied.profile);
-      const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      const reported = await reportHistoryStage(reportClient, applied.profile, (line) => console.warn(line));
       if (reported?.consents) {
         const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
         if (synced.changed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.7-dev.2782",
+  "version": "2.0.7-dev.2821",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {