@skrr-ai/cli 0.1.122 → 0.1.124

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/profileStateDir.js

@@ -45,6 +45,7 @@ var import_node_crypto = require("node:crypto");
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const PROFILES_SEGMENT = "profiles";
 const SUPERSEDED_MARKER_SUFFIX = ".superseded.json";
 const SUPERSEDED_COPY_SUFFIX = ".superseded";
@@ -190,28 +191,6 @@ function sha256OfFile(target) {
     return null;
   }
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, value);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 function adopt(fromDir, toDir, files, dryRun) {
   const written = [];
   for (const name of files) {
@@ -219,8 +198,9 @@ function adopt(fromDir, toDir, files, dryRun) {
     if (!existsFile(source))
       continue;
     const target = import_node_path.default.join(toDir, name);
-    if (!dryRun)
-      atomicWrite0600(target, import_node_fs.default.readFileSync(source));
+    if (!dryRun) {
+      (0, import_stateFiles.atomicWrite0600)(target, import_node_fs.default.readFileSync(source), `adopt ${name} into ${toDir}`);
+    }
     written.push(target);
   }
   return { written, supersededAside: [] };
@@ -232,7 +212,7 @@ function moveAside(dir, files, suffix = SUPERSEDED_COPY_SUFFIX) {
     const target = import_node_path.default.join(dir, name);
     if (!existsFile(target))
       continue;
-    import_node_fs.default.renameSync(target, `${target}${suffix}.${stamp}`);
+    (0, import_stateFiles.renameStateFile)(target, `${target}${suffix}.${stamp}`, `set aside ${target}`);
     aside.push(target);
   }
   return aside;
@@ -248,8 +228,8 @@ function writeMarker(markerPath, supersededBy, reason) {
     at: (/* @__PURE__ */ new Date()).toISOString(),
     note: "Kept deliberately. This file is the pre-consolidation copy (OSK-10314); older binaries read it and it is the only rollback that needs no operator step. Remove it only through logout."
   };
-  atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}
-`, "utf-8"));
+  (0, import_stateFiles.atomicWrite0600)(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}
+`, "utf-8"), `write the consolidation marker ${markerPath}`);
 }
 function emitOutcome(spec, status, meta) {
   spec.onEvent?.(`path_consolidation.${status}`, status !== "conflict", {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.d.ts

@@ -231,7 +231,7 @@ export type DeviceProofSigner = (params: {
     method: string;
     url: string;
     refreshToken: string;
-}) => string | null | undefined;
+}) => string | null | undefined | Promise<string | null | undefined>;
 export declare function refreshDaemonToken(serverUrl: string, currentRefreshToken: string, daemonId: string, options?: {
     machineUuid?: string;
     origin?: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.js

@@ -49,7 +49,9 @@ var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_runtime = require("./runtime.js");
+var import_liveState = require("./liveState.js");
 var import_refreshClassification = require("./refreshClassification.js");
+var import_stateFiles = require("./stateFiles.js");
 var import_types = require("./types.js");
 const LOCK_STALE_MS = 5e3;
 const LOCK_RETRY_MS = 100;
@@ -125,9 +127,9 @@ async function withAuthLock(body, daemonId) {
   const lockPath = authLockPath();
   const dir = import_node_path.default.dirname(lockPath);
   if (!import_node_fs.default.existsSync(dir))
-    import_node_fs.default.mkdirSync(dir, { recursive: true });
+    (0, import_stateFiles.ensureStateDir)(dir, "create the auth lock directory", null);
   if (!import_node_fs.default.existsSync(lockPath)) {
-    import_node_fs.default.writeFileSync(lockPath, "", { mode: 384 });
+    (0, import_stateFiles.writeStateFile)(lockPath, "", { mode: 384 }, "create the auth lock");
   }
   const acquireStart = Date.now();
   (0, import_runtime.emitAuthTelemetry)({
@@ -282,7 +284,9 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
   if (options.machineUuid) {
     body.machineUuid = options.machineUuid;
   }
-  function buildRequestInit() {
+  let proofAttached = false;
+  async function buildRequestInit() {
+    proofAttached = false;
     const headers = { "Content-Type": "application/json" };
     if (options.origin) {
       headers["X-Oversky-Origin"] = options.origin;
@@ -290,7 +294,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
     __refreshDiagnostics.requestAttemptCount += 1;
     if (options.signRequestProof) {
       try {
-        const proof = options.signRequestProof({
+        const proof = await options.signRequestProof({
           method: "POST",
           url,
           refreshToken: currentRefreshToken
@@ -298,6 +302,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         __refreshDiagnostics.proofAttemptCount += 1;
         if (typeof proof === "string" && proof.length > 0) {
           headers["OverSky-DPoP"] = proof;
+          proofAttached = true;
         }
       } catch (err) {
         __refreshDiagnostics.proofAttemptCount += 1;
@@ -312,7 +317,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
   }
   let response;
   try {
-    response = await fetch(url, buildRequestInit());
+    response = await fetch(url, await buildRequestInit());
     (0, import_runtime.notifyResponseObserver)(response);
   } catch (err) {
     log.warn(`[auth/refresh] network error: ${err?.message}`);
@@ -426,10 +431,13 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
       });
       throw new import_types.PermanentAuthFailure(code, parsedBody.message || code, revocationReason);
     }
+    const noLocalProof = parsedBody.code === "DEVICE_PROOF_MISSING" && !proofAttached;
+    const latchReason = noLocalProof ? "DEVICE_KEY_UNAVAILABLE" : "UNKNOWN_401";
     const message = parsedBody.message || "Unknown auth failure";
+    const latchMessage = noLocalProof ? `This computer has no usable device key, so the refresh carried no device proof (server: ${message})` : message;
     const { exhausted, count } = recordUnknown401(daemonId, Date.now());
     if (!exhausted) {
-      log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) \u2014 treating as transient, will retry: ${message}`);
+      log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) \u2014 treating as transient, will retry: ${message}` + (noLocalProof ? " (no device proof was sent: this machine has no usable device key)" : ""));
       (0, import_runtime.emitAuthTelemetry)({
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         eventType: "auth",
@@ -448,7 +456,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
       });
       throw new import_types.TransientAuthFailure(`Unknown auth failure (transient, retrying): ${message}`);
     }
-    log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) \u2014 latching permanent: ${message}`);
+    log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) \u2014 latching permanent ${latchReason}: ${message}`);
     (0, import_runtime.emitAuthTelemetry)({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       eventType: "auth",
@@ -457,18 +465,18 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         event: "refresh_failure",
         daemonId,
         durationMs: Date.now() - startMs,
-        errorCode: "UNKNOWN_401",
+        errorCode: latchReason,
         statusCode: 401,
         transient: false,
         unknown401Streak: count
       }
     });
     persistReauthState({
-      code: "UNKNOWN_401",
-      message,
+      code: latchReason,
+      message: latchMessage,
       at: Date.now()
     });
-    throw new import_types.PermanentAuthFailure("UNKNOWN_401", message);
+    throw new import_types.PermanentAuthFailure(latchReason, latchMessage);
   }
   let bodyText = "";
   try {
@@ -495,11 +503,10 @@ function persistReauthState(state) {
   try {
     const dir = import_node_path.default.dirname(flagPath);
     if (!import_node_fs.default.existsSync(dir))
-      import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-    import_node_fs.default.writeFileSync(flagPath, JSON.stringify(state, null, 2) + "\n", {
-      mode: 384
-    });
+      (0, import_stateFiles.ensureStateDir)(dir, "create the re-auth latch directory");
+    (0, import_stateFiles.writeStateFile)(flagPath, JSON.stringify(state, null, 2) + "\n", { mode: 384 }, "write the re-auth latch");
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     log.debug(`[auth/refresh] failed to persist reauth flag: ${err?.message}`);
   }
 }
@@ -526,8 +533,9 @@ function clearReauthState() {
   try {
     const flagPath = reauthFlagPath();
     if (import_node_fs.default.existsSync(flagPath))
-      import_node_fs.default.unlinkSync(flagPath);
+      (0, import_stateFiles.removeStateFile)(flagPath, "clear the re-auth latch");
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     log.debug(`[auth/refresh] clearReauthState: ${err?.message}`);
   }
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/stateFiles.d.ts

@@ -0,0 +1,31 @@
+/**
+ * stateFiles.ts — the ONE place auth-core mutates credential state on disk.
+ *
+ * Every write, delete, rename and mkdir of a wrapped DEK, a device key, an enrollment marker, a
+ * lock sentinel, a re-auth latch or a machine identity goes through a function here, and each
+ * asks `assertMayMutateLiveState` first: a test process aimed at the account's real home is
+ * refused with a named error before a byte changes (`liveState.ts` says why that cannot be left
+ * to each runner).
+ *
+ * This is the "own a control surface, or do not touch it" rule applied to the real home. The
+ * atomic writer used to exist three times (device identity, credential envelope, profile
+ * consolidation), so a guard added to one left two doors open. `stateFileBoundary.spec.ts`
+ * fails when a file other than this one starts calling a raw `fs` mutator, so a fourth copy
+ * cannot appear unguarded.
+ *
+ * Outside a test process every function here is exactly the `fs` call it wraps.
+ */
+import fs from 'node:fs';
+/** `mkdir -p` for a state directory, 0700 unless `mode` says otherwise. */
+export declare function ensureStateDir(dir: string, what: string, mode?: number | null): void;
+/**
+ * Atomic 0600 write — tmp+fsync+rename+dir-fsync. The same shape the daemon and CLI always used,
+ * so a partial-write race between `skrr` and `skrrd` produces the same on-disk transitions.
+ */
+export declare function atomicWrite0600(target: string, value: Buffer | string, what: string): void;
+/** `fs.writeFileSync` for a state file: lock sentinels, a re-auth latch, a machine identity. */
+export declare function writeStateFile(target: string, data: string | NodeJS.ArrayBufferView, options: fs.WriteFileOptions, what: string): void;
+/** `fs.unlinkSync` for a state file. Throws what `unlinkSync` throws, ENOENT included. */
+export declare function removeStateFile(target: string, what: string): void;
+/** `fs.renameSync` between state paths; both ends are checked. */
+export declare function renameStateFile(from: string, to: string, what: string): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/stateFiles.js

@@ -0,0 +1,89 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var stateFiles_exports = {};
+__export(stateFiles_exports, {
+  atomicWrite0600: () => atomicWrite0600,
+  ensureStateDir: () => ensureStateDir,
+  removeStateFile: () => removeStateFile,
+  renameStateFile: () => renameStateFile,
+  writeStateFile: () => writeStateFile
+});
+module.exports = __toCommonJS(stateFiles_exports);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_liveState = require("./liveState.js");
+function ensureStateDir(dir, what, mode = 448) {
+  (0, import_liveState.assertMayMutateLiveState)(dir, what);
+  import_node_fs.default.mkdirSync(dir, mode === null ? { recursive: true } : { recursive: true, mode });
+}
+function atomicWrite0600(target, value, what) {
+  (0, import_liveState.assertMayMutateLiveState)(target, what);
+  const dir = import_node_path.default.dirname(target);
+  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+  const buf = typeof value === "string" ? Buffer.from(value, "utf-8") : value;
+  const fd = import_node_fs.default.openSync(tmp, "w", 384);
+  try {
+    import_node_fs.default.writeSync(fd, buf);
+    import_node_fs.default.fsyncSync(fd);
+  } finally {
+    import_node_fs.default.closeSync(fd);
+  }
+  import_node_fs.default.renameSync(tmp, target);
+  try {
+    const dirFd = import_node_fs.default.openSync(dir, "r");
+    try {
+      import_node_fs.default.fsyncSync(dirFd);
+    } finally {
+      import_node_fs.default.closeSync(dirFd);
+    }
+  } catch {
+  }
+}
+function writeStateFile(target, data, options, what) {
+  (0, import_liveState.assertMayMutateLiveState)(target, what);
+  import_node_fs.default.writeFileSync(target, data, options);
+}
+function removeStateFile(target, what) {
+  (0, import_liveState.assertMayMutateLiveState)(target, what);
+  import_node_fs.default.unlinkSync(target);
+}
+function renameStateFile(from, to, what) {
+  (0, import_liveState.assertMayMutateLiveState)(from, what);
+  (0, import_liveState.assertMayMutateLiveState)(to, what);
+  import_node_fs.default.renameSync(from, to);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  atomicWrite0600,
+  ensureStateDir,
+  removeStateFile,
+  renameStateFile,
+  writeStateFile
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.d.ts

@@ -61,6 +61,9 @@ export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
 export declare const QR_SIGN_IN_REDACTION: "[redacted]";
 /** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
 export declare function isQrSignInSecretField(key: string): boolean;
+export declare function isOAuthQuerySecretField(key: string): boolean;
+export declare function isOAuthQueryContainerField(key: string): boolean;
+export declare function isGraphHandoffCookieField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.js

@@ -20,6 +20,9 @@ var telemetryRedaction_exports = {};
 __export(telemetryRedaction_exports, {
   PREVIEW_TOKEN_REDACTION: () => PREVIEW_TOKEN_REDACTION,
   QR_SIGN_IN_REDACTION: () => QR_SIGN_IN_REDACTION,
+  isGraphHandoffCookieField: () => isGraphHandoffCookieField,
+  isOAuthQueryContainerField: () => isOAuthQueryContainerField,
+  isOAuthQuerySecretField: () => isOAuthQuerySecretField,
   isQrSignInSecretField: () => isQrSignInSecretField,
   redactPreviewTokens: () => redactPreviewTokens,
   redactPreviewTokensDeep: () => redactPreviewTokensDeep,
@@ -53,6 +56,18 @@ function isQrSignInSecretField(key) {
   return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, "").toLowerCase());
 }
 const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+const OAUTH_QUERY_SECRET = /(^|[?&]|%(?:25)*26)(code|state|error_description|handoff)(=|%(?:25)*3[dD])([^&#\s"'<>]*)/gi;
+function isOAuthQuerySecretField(key) {
+  return ["code", "state", "error_description", "handoff"].includes(key.toLowerCase());
+}
+function isOAuthQueryContainerField(key) {
+  const leaf = (key.split(".").pop() || "").replace(/[_-]/g, "").toLowerCase();
+  return leaf === "query" || leaf === "querystring";
+}
+function isGraphHandoffCookieField(key) {
+  return key.toLowerCase() === "__secure-pc-graph-handoff";
+}
+const GRAPH_HANDOFF_COOKIE = /((?:_|%(?:25)*5[fF]){2}secure(?:-|%(?:25)*2[dD])pc(?:-|%(?:25)*2[dD])graph(?:-|%(?:25)*2[dD])handoff(?:=|%(?:25)*3[dD]))([^;,&\s"'<>]+)/gi;
 function redactQrSignInText(value) {
   const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value) ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
   return standaloneQuery.replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`).replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`)).replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
@@ -62,7 +77,7 @@ const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 function redactPreviewTokens(value) {
   if (typeof value !== "string")
     return value;
-  const qrSafe = redactQrSignInText(value);
+  const qrSafe = redactQrSignInText(value).replace(OAUTH_QUERY_SECRET, "$1$2$3[redacted]").replace(GRAPH_HANDOFF_COOKIE, "$1[redacted]");
   if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
     return qrSafe;
   return qrSafe.replace(PREVIEW_TOKEN, PREVIEW_TOKEN_REDACTION).replace(SIGNED_CREDENTIAL, credentialMarker).replace(LEGACY_OPERATOR_CODE, credentialMarker);
@@ -81,7 +96,7 @@ function redactPreviewTokensDeep(root, limits = {}) {
     let visited = 0;
     let complete = true;
     const rewrite = (holder, key, current) => {
-      const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
+      const next = isQrSignInSecretField(key) || isGraphHandoffCookieField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
       if (next === current) {
         return;
       }
@@ -119,7 +134,27 @@ function redactPreviewTokensDeep(root, limits = {}) {
           complete = false;
           continue;
         }
-        if (isQrSignInSecretField(key) || typeof child === "string") {
+        if (isOAuthQueryContainerField(key) && Array.isArray(child)) {
+          try {
+            holder[key] = "[redacted]";
+          } catch {
+            complete = false;
+          }
+          if (holder[key] !== "[redacted]")
+            complete = false;
+          continue;
+        }
+        if (isOAuthQueryContainerField(key) && child && typeof child === "object" && !Array.isArray(child)) {
+          const query = child;
+          for (const queryKey of Object.keys(query)) {
+            if (isOAuthQuerySecretField(queryKey)) {
+              query[queryKey] = "[redacted]";
+              if (query[queryKey] !== "[redacted]")
+                complete = false;
+            }
+          }
+        }
+        if (isQrSignInSecretField(key) || isGraphHandoffCookieField(key) || typeof child === "string") {
           rewrite(holder, key, child);
         } else if (child !== null && typeof child === "object") {
           if (depth + 1 > maxDepth) {
@@ -166,6 +201,9 @@ function withPreviewTokenRedaction(options) {
 0 && (module.exports = {
   PREVIEW_TOKEN_REDACTION,
   QR_SIGN_IN_REDACTION,
+  isGraphHandoffCookieField,
+  isOAuthQueryContainerField,
+  isOAuthQuerySecretField,
   isQrSignInSecretField,
   redactPreviewTokens,
   redactPreviewTokensDeep,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/types.d.ts

@@ -67,6 +67,12 @@ export interface TokenPair {
  *                       (server code `DEVICE_PROOF_THUMBPRINT_MISMATCH`).
  *                       The daemon signs every retry with the same key, so
  *                       retrying can never succeed.
+ *   - DEVICE_KEY_UNAVAILABLE — the server demanded a device proof
+ *                       (`DEVICE_PROOF_MISSING`) and this process had none
+ *                       to send: the key is unreadable, never created, or no
+ *                       signer is wired. Unlike `DEVICE_KEY_MISMATCH` there is
+ *                       no second key to reconcile; the fix is an interactive
+ *                       daemon sign-in, which mints and re-pins a new one.
  *   - UNKNOWN_401     — server returned 401 with a code we don't
  *                       recognize. Treated as permanent (better to prompt
  *                       re-auth than to loop forever) but tagged
@@ -79,7 +85,7 @@ export interface TokenPair {
  * Without this, the client `describeAuthFailure` exhaustiveness check
  * was silently broken for the non-REFRESH branches.
  */
-export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
+export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'DEVICE_KEY_UNAVAILABLE' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
 export declare class PermanentAuthFailure extends Error {
     readonly code: PermanentAuthReason;
     /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.d.ts

@@ -161,7 +161,11 @@ export type DaemonSupervisor = 'desktop' | 'service';
 export declare function daemonSignInRemedy(opts?: {
     /** How the daemon is run; absent when the caller cannot tell. */
     supervisor?: DaemonSupervisor;
-    /** The exact `skrrd … login` for this profile, when the daemon knows it. */
+    /**
+     * The exact login command for this profile (`skrrd … login`, or
+     * `skrr daemon login --profile …`), when the caller knows it. Used when the
+     * supervisor is `service` or unknown; a desktop-hosted daemon is never told one.
+     */
     loginCommand?: string;
     /** The refusal was DEVICE_PROOF_PIN_MISMATCH: say that a sign-in re-pins. */
     repinsDeviceKey?: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.js

@@ -167,7 +167,10 @@ export function daemonSignInRemedy(opts = {}) {
         const login = opts.loginCommand ? `\`${opts.loginCommand}\`` : '`skrr daemon login`';
         return `run ${login}${repin ? ' — an interactive login re-pins the device key' : ''}`;
     }
+    // A caller that cannot tell who runs the daemon may still know which profile it
+    // is on: `skrr daemon login` with no `--profile` signs the DEFAULT daemon in
+    // (OSK-16435), so the command it names is the one it was given.
     return ('sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit ' +
-        'and reopen the app; otherwise run `skrr daemon login`' +
+        `and reopen the app; otherwise run \`${opts.loginCommand ?? 'skrr daemon login'}\`` +
         (repin ? ' (either one re-pins the device key)' : ''));
 }