@inerrata-corporation/errata 2.0.7-dev.2797 → 2.0.7-dev.2821

package/errata.mjs

@@ -79931,7 +79931,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.7-dev.2797" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.7-dev.2821" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -85034,16 +85034,28 @@ async function loginOAuthDevice(opts) {
   if (approvedInstallation !== opts.installationId) {
     throw new Error("approved installation does not match the terminal request");
   }
-  const resourceResponse = await fetchFn(device.resource, {
+  return exchangeDeviceSession({
+    fetchFn,
+    resourceUrl: device.resource,
+    deviceSession,
+    installationId: approvedInstallation,
+    clientId,
+    scope
+  });
+}
+async function exchangeDeviceSession(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const resourceResponse = await fetchFn(opts.resourceUrl, {
     method: "POST",
     headers: {
-      authorization: `Bearer ${deviceSession}`,
+      authorization: `Bearer ${opts.deviceSession}`,
       "content-type": "application/json",
       accept: "application/json"
     },
     body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
+      installationId: opts.installationId,
+      clientId: opts.clientId,
       scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
     })
   });
@@ -85052,12 +85064,12 @@ async function loginOAuthDevice(opts) {
     throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
   }
   return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
+    installationId: opts.installationId,
+    clientId: opts.clientId,
+    tokenEndpoint: opts.resourceUrl,
     tokens: {
       accessToken: resource["access_token"],
-      refreshToken: deviceSession,
+      refreshToken: opts.deviceSession,
       ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
     }
   };
@@ -85271,7 +85283,10 @@ async function linkThroughConsole(opts) {
     return {
       status: "approved",
       decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null,
+      deviceSession: typeof payload?.["access_token"] === "string" ? payload["access_token"] : null,
+      resourceUrl: device.resource,
+      clientId
     };
   }
   return { status: "expired" };
@@ -89261,6 +89276,50 @@ async function linkRegisteredWorkspaces(cfg) {
     }
   }
 }
+async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
+  const installationId = out2.installationId;
+  if (!out2.deviceSession) {
+    console.warn(
+      `  note: the project is in another org; run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+  try {
+    const minted = await exchangeDeviceSession({
+      resourceUrl: out2.resourceUrl,
+      deviceSession: out2.deviceSession,
+      installationId,
+      clientId: out2.clientId
+    });
+    const existing = Object.entries(cfg.installationProfiles).find(([, p]) => p.installationId === installationId)?.[0];
+    let profileName = existing ?? `link-${orgId.slice(0, 8)}`;
+    for (let i2 = 2; !existing && cfg.installationProfiles[profileName]; i2++) profileName = `link-${orgId.slice(0, 8)}-${i2}`;
+    const next = {
+      ...cfg,
+      installationProfiles: {
+        ...cfg.installationProfiles,
+        [profileName]: {
+          installationId,
+          cloudUrl: cfg.cloudUrl,
+          apiKey: null,
+          accessToken: minted.tokens.accessToken,
+          refreshToken: minted.tokens.refreshToken ?? null,
+          tokenEndpoint: minted.tokenEndpoint,
+          oauthClientId: minted.clientId,
+          activeAgent: null
+        }
+      }
+    };
+    saveConfig(next);
+    setWorkspaceBinding(workspaceEntryForPath(ROOT)?.id ?? ROOT, profileName);
+    return { config: next, profileName };
+  } catch (err2) {
+    console.warn(
+      `  note: the project is linked, but this workspace could not take the other org's credential (${err2 instanceof Error ? err2.message : String(err2)}); run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+}
 async function cmdLink(args2) {
   const flag = (name2) => {
     const i2 = args2.indexOf(name2);
@@ -89340,12 +89399,22 @@ async function cmdLink(args2) {
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
+      let reportClient = authedCloudClient(applied.config);
+      if (out3.installationId && out3.installationId !== activeProfile?.installationId) {
+        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId);
+        if (bound) {
+          reportClient = authedCloudClientForProfile(bound.config, bound.profileName);
+          console.log(
+            `this workspace now uses installation ${out3.installationId.slice(0, 8)} (profile ${bound.profileName}) in org ${d.orgId.slice(0, 8)}; your machine default is unchanged`
+          );
+        }
+      }
       if (!hasCloudCredential(cfg)) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
         return;
       }
       const consents = historyConsents(applied.profile);
-      const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      const reported = await reportHistoryStage(reportClient, applied.profile, (line) => console.warn(line));
       if (reported?.consents) {
         const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
         if (synced.changed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.7-dev.2797",
+  "version": "2.0.7-dev.2821",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {