@inerrata-corporation/errata 2.0.7-dev.2797 → 2.0.7-dev.2822

package/errata.mjs

@@ -79931,7 +79931,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.7-dev.2797" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.7-dev.2822" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -82219,6 +82219,14 @@ B: ${b}`,
         const pending = existsSync25(paths.outbox) ? readdirSync10(paths.outbox).filter((f) => f.endsWith(".json")).length : 0;
         return { uploaded: 0, failed: 0, remaining: pending };
       }
+      const onDisk = loadProfile(opts.workspaceRoot);
+      if (!onDisk?.projectId && onDisk?.projectLinkHold) {
+        console.log(
+          "[errata] sync held \u2014 this repo is already on errata in another workspace; run `errata link` to join it or create your own project"
+        );
+        const pending = existsSync25(paths.outbox) ? readdirSync10(paths.outbox).filter((f) => f.endsWith(".json")).length : 0;
+        return { uploaded: 0, failed: 0, remaining: pending };
+      }
       try {
         const ignorePatterns = loadClaimIgnorePatterns(opts.workspaceRoot);
         const claimPayload = buildClaimIngest(store, profile, DAEMON_VERSION, 1, ignorePatterns);
@@ -83715,6 +83723,11 @@ init_profile2();
 import { execFile as execFile3 } from "node:child_process";
 import { promisify } from "node:util";
 var execFileAsync = promisify(execFile3);
+function isClaimedElsewhere(err2) {
+  if (!err2 || typeof err2 !== "object") return false;
+  const e = err2;
+  return e.status === 409 && e.code === "claimed_elsewhere";
+}
 async function readRootCommit(root) {
   try {
     const { stdout } = await execFileAsync("git", ["rev-list", "--max-parents=0", "HEAD"], {
@@ -83753,9 +83766,21 @@ async function ensureProjectLink(root, profile, client, rootCommit = readRootCom
     profile.projectId = res.project.id;
     profile.projectLocator = locator;
     if (sha2) profile.rootCommitReportedFor = res.project.id;
+    delete profile.projectLinkHold;
     saveProfile(root, profile);
     return { linked: true, projectId: res.project.id, created: res.created };
   } catch (err2) {
+    if (isClaimedElsewhere(err2)) {
+      if (profile.projectLinkHold?.locator !== locator) {
+        profile.projectLinkHold = { reason: "claimed-elsewhere", locator, since: Date.now() };
+        saveProfile(root, profile);
+      }
+      return {
+        linked: false,
+        reason: "held",
+        detail: "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
+      };
+    }
     return {
       linked: false,
       reason: "error",
@@ -85034,16 +85059,28 @@ async function loginOAuthDevice(opts) {
   if (approvedInstallation !== opts.installationId) {
     throw new Error("approved installation does not match the terminal request");
   }
-  const resourceResponse = await fetchFn(device.resource, {
+  return exchangeDeviceSession({
+    fetchFn,
+    resourceUrl: device.resource,
+    deviceSession,
+    installationId: approvedInstallation,
+    clientId,
+    scope
+  });
+}
+async function exchangeDeviceSession(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const resourceResponse = await fetchFn(opts.resourceUrl, {
     method: "POST",
     headers: {
-      authorization: `Bearer ${deviceSession}`,
+      authorization: `Bearer ${opts.deviceSession}`,
       "content-type": "application/json",
       accept: "application/json"
     },
     body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
+      installationId: opts.installationId,
+      clientId: opts.clientId,
       scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
     })
   });
@@ -85052,12 +85089,12 @@ async function loginOAuthDevice(opts) {
     throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
   }
   return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
+    installationId: opts.installationId,
+    clientId: opts.clientId,
+    tokenEndpoint: opts.resourceUrl,
     tokens: {
       accessToken: resource["access_token"],
-      refreshToken: deviceSession,
+      refreshToken: opts.deviceSession,
       ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
     }
   };
@@ -85271,7 +85308,10 @@ async function linkThroughConsole(opts) {
     return {
       status: "approved",
       decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null,
+      deviceSession: typeof payload?.["access_token"] === "string" ? payload["access_token"] : null,
+      resourceUrl: device.resource,
+      clientId
     };
   }
   return { status: "expired" };
@@ -86462,6 +86502,8 @@ async function startMultiDaemon(opts = {}) {
         );
       } else if (out2.reason === "error") {
         console.warn(`[errata] project link failed for ${r.engine.profile.name}: ${out2.detail}`);
+      } else if (out2.reason === "held") {
+        noteProjectHold(r.id, r.engine.profile.name, out2.detail);
       }
       let primeSalt = null;
       if (r.engine.profile.projectId && !r.engine.profile.projectHydratedAt) {
@@ -86919,7 +86961,16 @@ async function startMultiDaemon(opts = {}) {
         const client = poolFor(recordIdentity);
         const store = r.engine.store;
         const projectName = r.engine.profile.name ?? r.engine.profile.id;
-        const onDiskProjectId = loadProfile(r.root)?.projectId;
+        const onDisk = loadProfile(r.root);
+        const onDiskProjectId = onDisk?.projectId;
+        if (!onDiskProjectId && onDisk?.projectLinkHold) {
+          noteProjectHold(
+            r.id,
+            r.entry.name,
+            "this repo is already on errata in another workspace \u2014 run `errata link` to join it or create your own project"
+          );
+          continue;
+        }
         if (onDiskProjectId !== r.engine.profile.projectId) {
           if (onDiskProjectId) r.engine.profile.projectId = onDiskProjectId;
           else delete r.engine.profile.projectId;
@@ -88679,6 +88730,11 @@ async function cmdStatus() {
     console.log(
       `    repo:      ${profile.repoLocator ? `${profile.repoLocator}${link}` : "(no git remote \u2014 unlinked)"}`
     );
+    if (!profile.projectId && profile.projectLinkHold) {
+      console.log(
+        `    HELD:      this repo is already on errata in another workspace. Nothing syncs until you decide: run \`errata link\` to join it or create your own project.`
+      );
+    }
     for (const h of await daemonHolds()) {
       if (h.workspace !== profile.name && h.workspace !== profile.id) continue;
       console.log(
@@ -89261,6 +89317,50 @@ async function linkRegisteredWorkspaces(cfg) {
     }
   }
 }
+async function bindWorkspaceToLinkInstallation(cfg, out2, orgId) {
+  const installationId = out2.installationId;
+  if (!out2.deviceSession) {
+    console.warn(
+      `  note: the project is in another org; run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+  try {
+    const minted = await exchangeDeviceSession({
+      resourceUrl: out2.resourceUrl,
+      deviceSession: out2.deviceSession,
+      installationId,
+      clientId: out2.clientId
+    });
+    const existing = Object.entries(cfg.installationProfiles).find(([, p]) => p.installationId === installationId)?.[0];
+    let profileName = existing ?? `link-${orgId.slice(0, 8)}`;
+    for (let i2 = 2; !existing && cfg.installationProfiles[profileName]; i2++) profileName = `link-${orgId.slice(0, 8)}-${i2}`;
+    const next = {
+      ...cfg,
+      installationProfiles: {
+        ...cfg.installationProfiles,
+        [profileName]: {
+          installationId,
+          cloudUrl: cfg.cloudUrl,
+          apiKey: null,
+          accessToken: minted.tokens.accessToken,
+          refreshToken: minted.tokens.refreshToken ?? null,
+          tokenEndpoint: minted.tokenEndpoint,
+          oauthClientId: minted.clientId,
+          activeAgent: null
+        }
+      }
+    };
+    saveConfig(next);
+    setWorkspaceBinding(workspaceEntryForPath(ROOT)?.id ?? ROOT, profileName);
+    return { config: next, profileName };
+  } catch (err2) {
+    console.warn(
+      `  note: the project is linked, but this workspace could not take the other org's credential (${err2 instanceof Error ? err2.message : String(err2)}); run \`errata login --device --installation ${installationId} --profile <name>\` then \`errata workspace bind . --profile <name>\``
+    );
+    return null;
+  }
+}
 async function cmdLink(args2) {
   const flag = (name2) => {
     const i2 = args2.indexOf(name2);
@@ -89280,6 +89380,7 @@ async function cmdLink(args2) {
     return;
   }
   delete profile.projectLinkDisabled;
+  delete profile.projectLinkHold;
   const remote = flag("--remote");
   if (remote) {
     const loc = detectRepoLocator(ROOT, remote);
@@ -89340,12 +89441,22 @@ async function cmdLink(args2) {
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
+      let reportClient = authedCloudClient(applied.config);
+      if (out3.installationId && out3.installationId !== activeProfile?.installationId) {
+        const bound = await bindWorkspaceToLinkInstallation(applied.config, out3, d.orgId);
+        if (bound) {
+          reportClient = authedCloudClientForProfile(bound.config, bound.profileName);
+          console.log(
+            `this workspace now uses installation ${out3.installationId.slice(0, 8)} (profile ${bound.profileName}) in org ${d.orgId.slice(0, 8)}; your machine default is unchanged`
+          );
+        }
+      }
       if (!hasCloudCredential(cfg)) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
         return;
       }
       const consents = historyConsents(applied.profile);
-      const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      const reported = await reportHistoryStage(reportClient, applied.profile, (line) => console.warn(line));
       if (reported?.consents) {
         const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
         if (synced.changed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.7-dev.2797",
+  "version": "2.0.7-dev.2822",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {