@skrr-ai/cli 0.1.8 → 0.1.10

package/dist/lib/daemon-ref.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The two halves of the daemon-reference contract: how a daemon id is DISPLAYED
+ * and how a displayed one is READ BACK.
+ *
+ * `list-daemons` prints a decorated short form — `d_6a323ae4...` — and the two
+ * commands that consume a daemon reference (`revoke-daemon`,
+ * `set-capabilities`) matched the raw argument against `id.startsWith(prefix)`.
+ * So the value the product printed in a column literally headed DAEMON REF was
+ * rejected by every command that takes one, and the failure looked like "no such
+ * daemon" rather than "that is not the format I want". The sibling
+ * `machines show` accepts what `machines list` prints, which is the behaviour
+ * people reasonably expect here too.
+ *
+ * Keeping the decoration and accepting it back is the right trade: the `d_`
+ * prefix and the ellipsis are what tell a reader the value is truncated, and
+ * dropping them would make an 8-character fragment look like a full id.
+ */
+/**
+ * Format a full daemon ObjectId as a short readable label:
+ * `d_xY3p...` — prefix + first 8 hex chars + an ellipsis.
+ */
+export declare function formatDaemonRef(id: string): string;
+/**
+ * Read back anything `formatDaemonRef` may have produced, plus what a person
+ * plausibly pastes: with or without the `d_`, with or without a trailing `...`
+ * or a real ellipsis character, and with surrounding whitespace.
+ *
+ * A value that was never decorated passes through untouched, so a full id and a
+ * hand-typed prefix keep working exactly as before.
+ */
+export declare function normalizeDaemonRef(input: string): string;

package/dist/lib/daemon-ref.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * The two halves of the daemon-reference contract: how a daemon id is DISPLAYED
+ * and how a displayed one is READ BACK.
+ *
+ * `list-daemons` prints a decorated short form — `d_6a323ae4...` — and the two
+ * commands that consume a daemon reference (`revoke-daemon`,
+ * `set-capabilities`) matched the raw argument against `id.startsWith(prefix)`.
+ * So the value the product printed in a column literally headed DAEMON REF was
+ * rejected by every command that takes one, and the failure looked like "no such
+ * daemon" rather than "that is not the format I want". The sibling
+ * `machines show` accepts what `machines list` prints, which is the behaviour
+ * people reasonably expect here too.
+ *
+ * Keeping the decoration and accepting it back is the right trade: the `d_`
+ * prefix and the ellipsis are what tell a reader the value is truncated, and
+ * dropping them would make an 8-character fragment look like a full id.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatDaemonRef = formatDaemonRef;
+exports.normalizeDaemonRef = normalizeDaemonRef;
+/** Prefix the short form carries so a truncated id is visibly truncated. */
+const DISPLAY_PREFIX = 'd_';
+/**
+ * Format a full daemon ObjectId as a short readable label:
+ * `d_xY3p...` — prefix + first 8 hex chars + an ellipsis.
+ */
+function formatDaemonRef(id) {
+    if (!id || id.length < 8)
+        return id || '—';
+    return `${DISPLAY_PREFIX}${id.slice(0, 8)}...`;
+}
+/**
+ * Read back anything `formatDaemonRef` may have produced, plus what a person
+ * plausibly pastes: with or without the `d_`, with or without a trailing `...`
+ * or a real ellipsis character, and with surrounding whitespace.
+ *
+ * A value that was never decorated passes through untouched, so a full id and a
+ * hand-typed prefix keep working exactly as before.
+ */
+function normalizeDaemonRef(input) {
+    let out = input.trim();
+    if (out.toLowerCase().startsWith(DISPLAY_PREFIX))
+        out = out.slice(DISPLAY_PREFIX.length);
+    out = out.replace(/(?:\.{3}|…)$/, '');
+    return out.trim();
+}

package/dist/lib/daemonBroker.js

@@ -286,7 +286,7 @@ async function attemptDaemonBrokerLogin(opts) {
             return {
                 ok: false,
                 reason: 'base_url_mismatch',
-                detail: `No local oversky daemon is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
+                detail: `No local skrr runtime is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
                 daemonServerUrl: mismatchedBootstrap.serverUrl,
             };
         }

package/dist/lib/delegated-cli.js

@@ -22,7 +22,7 @@ function isDelegatedCliSession(env = process.env) {
 function trustedLoopbackUrl(raw) {
     const url = new URL(raw);
     if (url.protocol !== 'http:' || !['127.0.0.1', 'localhost', '::1'].includes(url.hostname)) {
-        throw new Error('Delegated Sky CLI broker must be a loopback HTTP URL.');
+        throw new Error('Delegated skrr CLI broker must be a loopback HTTP URL.');
     }
     return url.toString();
 }
@@ -82,11 +82,11 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
                 if (body?.code === 'DELEGATED_CLI_CAPABILITY_REJECTED')
                     return null;
             }
-            throw new Error(`Delegated Sky CLI credential broker returned HTTP ${res.status}.`);
+            throw new Error(`Delegated skrr CLI credential broker returned HTTP ${res.status}.`);
         }
         const body = (await res.json());
         if (typeof body.accessToken !== 'string' || body.accessToken.length === 0) {
-            throw new Error('Delegated Sky CLI credential broker returned no access token.');
+            throw new Error('Delegated skrr CLI credential broker returned no access token.');
         }
         const credential = {
             token: body.accessToken,

package/dist/lib/exec-oversky.d.ts

@@ -3,8 +3,25 @@ export declare const RUNTIME_BINARY_NAMES: readonly ["skrrd", "oversky"];
 /** Resolve the absolute path of `oversky` if it exists, else return null. */
 export declare function findOverskyBinary(): string | null;
 /**
- * Pretty hint shown when `oversky` isn't installed. Kept short — points
+ * Pretty hint shown when the runtime isn't installed. Kept short — points
  * users at the canonical install paths rather than enumerating them.
+ *
+ * THE ADDRESSES BELOW STILL SAY `oversky`, ON PURPOSE.
+ * ---------------------------------------------------
+ * The rename moved this text to `skrr` and pointed it at
+ * `dush1023/skrr/skrrd`, `raw.githubusercontent.com/dush1023/skrr/...` and
+ * `github.com/dush1023/skrr` — none of which exist. The tap
+ * `dush1023/homebrew-skrr` 404s; only `dush1023/homebrew-oversky` is
+ * published, and the repository is still `dush1023/OverSky`.
+ *
+ * An install instruction is only worth what it installs. Renaming these
+ * before the tap and repository move produces a message that reads correct
+ * and fails when followed — the same defect as the "install it with
+ * `sky code install`" hint, which named a command that never existed.
+ *
+ * They move when the Homebrew tap is published (that work is tracked
+ * separately) and when the repository is renamed — not before, and not as
+ * part of a copy sweep.
  */
 export declare function notInstalledMessage(): string;
 /**

package/dist/lib/exec-oversky.js

@@ -76,17 +76,34 @@ function isExecutable(p) {
     }
 }
 /**
- * Pretty hint shown when `oversky` isn't installed. Kept short — points
+ * Pretty hint shown when the runtime isn't installed. Kept short — points
  * users at the canonical install paths rather than enumerating them.
+ *
+ * THE ADDRESSES BELOW STILL SAY `oversky`, ON PURPOSE.
+ * ---------------------------------------------------
+ * The rename moved this text to `skrr` and pointed it at
+ * `dush1023/skrr/skrrd`, `raw.githubusercontent.com/dush1023/skrr/...` and
+ * `github.com/dush1023/skrr` — none of which exist. The tap
+ * `dush1023/homebrew-skrr` 404s; only `dush1023/homebrew-oversky` is
+ * published, and the repository is still `dush1023/OverSky`.
+ *
+ * An install instruction is only worth what it installs. Renaming these
+ * before the tap and repository move produces a message that reads correct
+ * and fails when followed — the same defect as the "install it with
+ * `sky code install`" hint, which named a command that never existed.
+ *
+ * They move when the Homebrew tap is published (that work is tracked
+ * separately) and when the repository is renamed — not before, and not as
+ * part of a copy sweep.
  */
 function notInstalledMessage() {
     return [
         'The skrr local runtime is not installed on this machine.',
         '',
         'Install:',
-        '  macOS:   brew install dush1023/skrr/skrrd',
-        '  Linux:   curl -fsSL https://raw.githubusercontent.com/dush1023/skrr/main/scripts/install-daemon.sh | bash',
-        '  Other:   https://github.com/dush1023/skrr#installation',
+        '  macOS:   brew install dush1023/oversky/oversky',
+        '  Linux:   curl -fsSL https://raw.githubusercontent.com/dush1023/OverSky/main/scripts/install-daemon.sh | bash',
+        '  Other:   https://github.com/dush1023/OverSky#installation',
         '',
         'Once installed, re-run your command.',
     ].join('\n');

package/dist/lib/html-text.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Render server-stored rich text as something a terminal can read.
+ *
+ * Task, goal and project descriptions are persisted as HTML — `--description
+ * -format markdown` is converted on the way in — so a CLI that prints the field
+ * verbatim shows the user `<p>…</p>` and `<code>…</code>` around their own
+ * words. They wrote markdown and got tags back.
+ *
+ * Deliberately NOT a general HTML renderer. It converts the block boundaries
+ * that carry meaning in a paragraph of prose, drops the rest of the tags, and
+ * decodes the entity set the server actually emits. Anything that does not look
+ * like markup is returned untouched, so a plain-text description keeps its own
+ * whitespace instead of being reflowed by a converter it never needed.
+ */
+export declare function htmlToDisplayText(value: string): string;

package/dist/lib/html-text.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Render server-stored rich text as something a terminal can read.
+ *
+ * Task, goal and project descriptions are persisted as HTML — `--description
+ * -format markdown` is converted on the way in — so a CLI that prints the field
+ * verbatim shows the user `<p>…</p>` and `<code>…</code>` around their own
+ * words. They wrote markdown and got tags back.
+ *
+ * Deliberately NOT a general HTML renderer. It converts the block boundaries
+ * that carry meaning in a paragraph of prose, drops the rest of the tags, and
+ * decodes the entity set the server actually emits. Anything that does not look
+ * like markup is returned untouched, so a plain-text description keeps its own
+ * whitespace instead of being reflowed by a converter it never needed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.htmlToDisplayText = htmlToDisplayText;
+/** Cheap, deliberate: a tag-shaped substring is the only trigger. */
+function looksLikeHtml(value) {
+    return /<\/?[a-z][^>]*>/i.test(value);
+}
+function htmlToDisplayText(value) {
+    if (!looksLikeHtml(value))
+        return value;
+    return (value
+        .replace(/<br\s*\/?>/gi, '\n')
+        .replace(/<\/(p|div|li|h[1-6])>/gi, '\n')
+        .replace(/<li[^>]*>/gi, '  - ')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&#39;/g, "'")
+        .replace(/&quot;/g, '"')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        // `&amp;` LAST, or `&amp;lt;` would decode twice into a bare `<`.
+        .replace(/&amp;/g, '&')
+        .replace(/[ \t]+/g, ' ')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim());
+}

package/dist/lib/keychain.d.ts

@@ -1,4 +1,15 @@
+/** Pre-Phase-K namespace; reserved for a future migration helper. */
+export declare const DEFAULT_PROFILE = "default";
 export declare function setActiveProfile(profile: string): void;
+/**
+ * Whether the profile has been chosen for this process.
+ *
+ * Borrowed from `daemon/src/config.ts`, which warns when a writer runs before
+ * `setActiveProfile()` and says why: such a caller "is a bug — they're writing
+ * to the legacy single-tenant root instead of the active profile's dir". The
+ * failure is silent and permanent, so it needs to be noisy once.
+ */
+export declare function isProfileResolved(): boolean;
 export declare function getActiveProfile(): string;
 /** @internal exposed for tests / diagnostics. */
 export declare function __currentServiceForTest(): string;
@@ -38,8 +49,40 @@ export declare function writeServerOrigin(origin: string): boolean;
 export declare function deleteServerOrigin(): void;
 export declare function deleteToken(): void;
 export declare function deleteRefreshToken(): void;
+/**
+ * Remove the credentials this product wrote under its previous brand.
+ *
+ * `logout` used to delete only the CURRENT service and report an unqualified
+ * "Signed out." On a machine carried through the rename that left the
+ * pre-rename CLI credential, the pre-rename daemon credentials, and BOTH KEKs
+ * in place — so the sealed envelope and the key that unwraps it were still
+ * sitting there after the product said you were signed out. `logout --help`
+ * offers `--all-devices` for "a stolen-laptop incident", which is the one
+ * situation where that is exactly wrong.
+ *
+ * Returns the services it actually removed something from, so the caller can
+ * say what happened instead of destroying credentials silently.
+ *
+ * NOTE this also signs out the retired `oversky` binary, if one is still
+ * installed. That is the intent — same account, same machine — and the cutover
+ * runbook already lists these items for removal.
+ */
+export declare function deleteLegacyBrandEntries(): string[];
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.
  */
 export declare function deleteAll(): void;
+/**
+ * Pull `--profile` out of raw argv.
+ *
+ * Deliberately minimal: it recognises `--profile x` and `--profile=x` and
+ * nothing else. This runs before any validation, so it must not throw, must not
+ * consume anything it does not own, and must not care about flag ordering —
+ * anything it gets wrong is corrected microseconds later when oclif parses the
+ * same argv properly and rejects a malformed invocation.
+ *
+ * Returns null rather than the default, so the caller can fall through to
+ * `OVERSKY_PROFILE` without a flag having to out-rank an env var it never saw.
+ */
+export declare function resolveProfileFromArgv(argv: readonly string[] | undefined): string | null;

package/dist/lib/keychain.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROFILE = void 0;
 exports.setActiveProfile = setActiveProfile;
+exports.isProfileResolved = isProfileResolved;
 exports.getActiveProfile = getActiveProfile;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
@@ -14,7 +16,9 @@ exports.writeServerOrigin = writeServerOrigin;
 exports.deleteServerOrigin = deleteServerOrigin;
 exports.deleteToken = deleteToken;
 exports.deleteRefreshToken = deleteRefreshToken;
+exports.deleteLegacyBrandEntries = deleteLegacyBrandEntries;
 exports.deleteAll = deleteAll;
+exports.resolveProfileFromArgv = resolveProfileFromArgv;
 /**
  * keychain.ts — macOS Keychain-backed token storage for the Sky CLI.
  *
@@ -44,10 +48,11 @@ exports.deleteAll = deleteAll;
  */
 const node_child_process_1 = require("node:child_process");
 const cred_envelope_1 = require("./cred-envelope");
+const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
 const SERVICE_BASE = 'ai.skrr.cli';
 /** Pre-Phase-K namespace; reserved for a future migration helper. */
-const DEFAULT_PROFILE = 'default';
+exports.DEFAULT_PROFILE = 'default';
 const ACCOUNT_TOKEN = 'cli-token';
 const ACCOUNT_EXPIRES = 'cli-token-expires';
 const ACCOUNT_REFRESH = 'cli-refresh';
@@ -58,14 +63,35 @@ const SECURITY_ITEM_NOT_FOUND = 44;
 /** Cached availability — probed once at first call. */
 let _availability = null;
 /**
- * Active profile for this process. Phase K will wire `setActiveProfile('work')`
- * onto a `--profile` flag; today everything resolves to `default`.
+ * Active profile for this process.
+ *
+ * Wired from `--profile` / `OVERSKY_PROFILE` in `BaseCommand.init()`, before
+ * anything reads a credential. The comment here used to say "Phase K will wire
+ * `setActiveProfile('work')` onto a `--profile` flag; today everything resolves
+ * to `default`" — and that stayed true long enough to cost something: with one
+ * slot, signing into a second deployment EVICTED the first, so a round trip
+ * meant two interactive logins and an agent could not make one at all
+ * (OSK-290).
  */
-let _activeProfile = DEFAULT_PROFILE;
+let _activeProfile = exports.DEFAULT_PROFILE;
+/** True once a caller has chosen, so a writer can tell "default" from "unset". */
+let _profileResolved = false;
 function setActiveProfile(profile) {
+    _profileResolved = true;
     if (profile && profile.length > 0)
         _activeProfile = profile;
 }
+/**
+ * Whether the profile has been chosen for this process.
+ *
+ * Borrowed from `daemon/src/config.ts`, which warns when a writer runs before
+ * `setActiveProfile()` and says why: such a caller "is a bug — they're writing
+ * to the legacy single-tenant root instead of the active profile's dir". The
+ * failure is silent and permanent, so it needs to be noisy once.
+ */
+function isProfileResolved() {
+    return _profileResolved;
+}
 function getActiveProfile() {
     return _activeProfile;
 }
@@ -307,6 +333,88 @@ function deleteRefreshToken() {
     deleteSlot(ACCOUNT_REFRESH);
     deleteSlot(ACCOUNT_REFRESH_EXPIRES);
 }
+/**
+ * Every Keychain service this product wrote under its PREVIOUS brand.
+ *
+ * Discovered rather than enumerated, because the daemon's services carry a
+ * per-profile hash (`ai.oversky.daemon.dev-f00ad7c1`) that cannot be
+ * reconstructed from a name. Metadata only — `dump-keychain` without `-d`
+ * prints service names and does not prompt for or reveal any secret.
+ *
+ * Filtered to `LEGACY_NATIVE_ID_PREFIXES` followed by a dot, so a third-party
+ * item that merely starts with the same letters is never in scope.
+ */
+function discoverLegacyBrandServices() {
+    let dump;
+    try {
+        dump = (0, node_child_process_1.execFileSync)('security', ['dump-keychain'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        return [];
+    }
+    const found = new Set();
+    for (const match of dump.matchAll(/"svce"<blob>="([^"]*)"/g)) {
+        const service = match[1];
+        if (auth_core_1.LEGACY_NATIVE_ID_PREFIXES.some((prefix) => service.startsWith(`${prefix}.`))) {
+            found.add(service);
+        }
+    }
+    return [...found].sort();
+}
+/**
+ * Delete every item under one service, without needing its account names.
+ *
+ * `delete-generic-password -s <svc>` removes ONE matching item, so a service
+ * holding a token, its expiry and a refresh pair needs several passes. Bounded,
+ * because a delete that never reports "not found" would otherwise spin.
+ */
+function deleteEntireService(service) {
+    let removedAny = false;
+    for (let i = 0; i < 32; i += 1) {
+        try {
+            (0, node_child_process_1.execFileSync)('security', ['delete-generic-password', '-s', service], {
+                stdio: ['ignore', 'ignore', 'ignore'],
+            });
+            removedAny = true;
+        }
+        catch (err) {
+            const status = err.status;
+            if (status === SECURITY_ITEM_NOT_FOUND)
+                return removedAny;
+            if (process.env.DEBUG) {
+                console.error(`[cli/keychain] legacy sweep failed for ${service} (status=${status ?? 'unknown'})`);
+            }
+            return removedAny;
+        }
+    }
+    return removedAny;
+}
+/**
+ * Remove the credentials this product wrote under its previous brand.
+ *
+ * `logout` used to delete only the CURRENT service and report an unqualified
+ * "Signed out." On a machine carried through the rename that left the
+ * pre-rename CLI credential, the pre-rename daemon credentials, and BOTH KEKs
+ * in place — so the sealed envelope and the key that unwraps it were still
+ * sitting there after the product said you were signed out. `logout --help`
+ * offers `--all-devices` for "a stolen-laptop incident", which is the one
+ * situation where that is exactly wrong.
+ *
+ * Returns the services it actually removed something from, so the caller can
+ * say what happened instead of destroying credentials silently.
+ *
+ * NOTE this also signs out the retired `oversky` binary, if one is still
+ * installed. That is the intent — same account, same machine — and the cutover
+ * runbook already lists these items for removal.
+ */
+function deleteLegacyBrandEntries() {
+    if (!isAvailable())
+        return [];
+    return discoverLegacyBrandServices().filter((service) => deleteEntireService(service));
+}
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.
@@ -316,3 +424,36 @@ function deleteAll() {
     deleteRefreshToken();
     deleteServerOrigin();
 }
+/**
+ * Pull `--profile` out of raw argv.
+ *
+ * Deliberately minimal: it recognises `--profile x` and `--profile=x` and
+ * nothing else. This runs before any validation, so it must not throw, must not
+ * consume anything it does not own, and must not care about flag ordering —
+ * anything it gets wrong is corrected microseconds later when oclif parses the
+ * same argv properly and rejects a malformed invocation.
+ *
+ * Returns null rather than the default, so the caller can fall through to
+ * `OVERSKY_PROFILE` without a flag having to out-rank an env var it never saw.
+ */
+function resolveProfileFromArgv(argv) {
+    // `undefined` is a real input, not a defensive flourish: a command
+    // constructed directly — as several suites do — has no argv yet when `init()`
+    // runs. The contract above says this must not throw, and it did.
+    if (!Array.isArray(argv))
+        return null;
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i];
+        if (token === '--')
+            break;
+        if (token === '--profile') {
+            const value = argv[i + 1];
+            return value && !value.startsWith('-') ? value : null;
+        }
+        if (token.startsWith('--profile=')) {
+            const value = token.slice('--profile='.length);
+            return value.length > 0 ? value : null;
+        }
+    }
+    return null;
+}

package/dist/lib/login.js

@@ -82,7 +82,7 @@ async function cliLogin(opts = {}) {
         });
         if (brokerResult.ok) {
             console.log('');
-            console.log('  Authorized via the local oversky daemon (no browser needed).');
+            console.log('  Authorized via the local skrr runtime (no browser needed).');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -105,7 +105,7 @@ async function cliLogin(opts = {}) {
         // broker failures — missing bootstrap, network blip, server 5xx —
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
-            throw new Error('The local oversky daemon is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
+            throw new Error('The local skrr runtime is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
                 'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
                 'or run `skrr login` on a machine where the daemon was authenticated interactively.');
         }
@@ -116,7 +116,7 @@ async function cliLogin(opts = {}) {
         // "I'm logging into a different server than the daemon".
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The local oversky daemon is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
+            console.log(`  The local skrr runtime is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
             console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
         }
     }

package/dist/lib/node-adapter.js

@@ -298,7 +298,7 @@ function createNodeAdapter(opts = {}) {
             else {
                 // Refresh-token rotation rejected (revoked / family burned /
                 // passwordChangedAt cutover). As a last resort, ask the local
-                // oversky daemon to broker a fresh cli-scope family — covers
+                // skrr runtime to broker a fresh cli-scope family — covers
                 // "user reset their account but daemon is still authed",
                 // "stale pre-broker keychain token", and similar drift cases.
                 const brokered = await tryDaemonBrokerRecovery();

package/dist/lib/oauthLogin.js

@@ -45,6 +45,7 @@ const node_child_process_1 = require("node:child_process");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
 const device_id_1 = require("./device-id");
+const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // ---------------------------------------------------------------------------
 // PKCE helpers
 // ---------------------------------------------------------------------------
@@ -64,17 +65,27 @@ function generateState() {
 // ---------------------------------------------------------------------------
 const CLIENT_ID = 'oversky-cli';
 const DEFAULT_SCOPES = Object.freeze(['cli']);
+// Both directions are DERIVED from config/public-endpoints.json via the
+// generated constant rather than hand-listed. The hand-listed pair predated the
+// domain cutover and knew only `oversky.*`, so the CURRENT prod apex
+// (`skrr.ai`) resolved to itself: a login against it would exchange tokens on
+// the app origin instead of the API one. Mirrors the same derivation in
+// `web-url.ts`, which needs the inverse map for exactly the same reason.
 const OAUTH_API_URL_FROM_WEB = {
+    ...Object.fromEntries(Object.values(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS).map((e) => [
+        e.appUrl.toLowerCase(),
+        e.realtimeUrl,
+    ])),
+    // Prod's retained previous origin, and the `www.` spelling of it.
     'https://oversky.ai': 'https://api.oversky.ai',
     'https://www.oversky.ai': 'https://api.oversky.ai',
-    // Dev split onto its own apex (oversky.dev) with an ALB-direct api. subdomain.
-    // Mirrors config/public-endpoints.json so `skrr login` against dev exchanges
-    // tokens on the same origin family prod uses.
-    'https://oversky.dev': 'https://api.oversky.dev',
 };
 const OAUTH_WEB_URL_FROM_API = {
+    ...Object.fromEntries(Object.values(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS).map((e) => [
+        e.realtimeUrl.toLowerCase(),
+        e.appUrl,
+    ])),
     'https://api.oversky.ai': 'https://oversky.ai',
-    'https://api.oversky.dev': 'https://oversky.dev',
 };
 function resolveOAuthEndpoints(serverUrl) {
     const normalized = serverUrl.replace(/\/+$/, '');
@@ -351,7 +362,7 @@ async function runOAuthLogin(opts) {
                     // refresh.ts:169 and :296. So the credential was rejected by its
                     // own issuer check the instant it was written:
                     //
-                    //   [sky] Ignoring stored credentials issued by
+                    //   [skrr] Ignoring stored credentials issued by
                     //         https://api.oversky.ai; skrr is configured for
                     //         https://oversky.ai.
                     //

package/dist/lib/sky-code-agent.d.ts

@@ -113,7 +113,7 @@ export interface SkyCodeAgentOptions {
      * May resolution CREATE the default agent when nothing else answers?
      *
      * Defaults to true, because a session that cannot name an agent cannot run.
-     * `skrr code oversky-agent` (with no `--create`) passes false: a command whose
+     * `skrr code skrr-agent` (with no `--create`) passes false: a command whose
      * job is to report what would happen must not make it happen.
      */
     createDefault?: boolean;

package/dist/lib/sky-code-agent.js

@@ -96,7 +96,7 @@ exports.SkyCodeAgentError = SkyCodeAgentError;
  */
 async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     const configured = deps.configuredAgentId ?? (() => (0, config_1.loadConfig)().skyCodeAgentId);
-    const explicitLabel = options.explicitLabel ?? sky_code_managed_1.OVERSKY_AGENT_FLAG;
+    const explicitLabel = options.explicitLabel ?? sky_code_managed_1.SKRR_AGENT_FLAG;
     let cached = null;
     const roster = async () => {
         if (cached)
@@ -123,7 +123,7 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
         }
         if (byName.length > 1) {
             throw new SkyCodeAgentError('agent-ambiguous', `${describeSource(source, ref, explicitLabel)} matches ${byName.length} agents. ` +
-                `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} with an id instead: ${candidates(byName)}`);
+                `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} with an id instead: ${candidates(byName)}`);
         }
         // Not in the bounded roster. It may still be a real id belonging to a user with
         // more agents than the roster shows, so ask directly before refusing.
@@ -186,7 +186,7 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     //    exactly this and belongs to nobody else.
     //    `createDefault: false` makes this a READ: the endpoint is get-or-create
     //    and has no read-only mode, so a caller that is only ASKING
-    //    (`skrr code oversky-agent`) recognises an existing default from the roster
+    //    (`skrr code skrr-agent`) recognises an existing default from the roster
     //    it has already fetched instead. `defaultForHarness` rides the same
     //    summary projection `author` does, so this costs no extra request.
     //
@@ -220,8 +220,8 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
         if (isAbortError(err))
             throw err;
         throw new SkyCodeAgentError('agent-unset', `could not establish your default skrr Code agent — ${message(err)}. ` +
-            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set one with ` +
-            '`skrr code oversky-agent --set <id>`' +
+            `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} <id-or-name>, or set one with ` +
+            '`skrr code skrr-agent --set <id>`' +
             (rows.length ? `. Yours: ${candidates(rows)}` : ''));
     }
     // Asked, not told: the caller opted out of creation, so "no default" is a fact
@@ -229,14 +229,14 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     if (options.createDefault === false) {
         throw new SkyCodeAgentError('agent-unset', 'nothing is configured and you have no skrr Code default agent yet. ' +
             'One is created automatically the first time you run a managed session — ' +
-            'or make it now with `skrr code oversky-agent --create`' +
+            'or make it now with `skrr code skrr-agent --create`' +
             (rows.length ? `. Yours: ${candidates(rows)}` : ''));
     }
     // The endpoint answered without an agent. Nothing here can repair that, but
     // the user still has every ordinary way to name one.
     throw new SkyCodeAgentError('agent-unset', rows.length
         ? `skrr Code has no default agent for you and will not pick one of your ${rows.length}. ` +
-            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set "${sky_code_managed_1.AGENT_CONFIG_KEY}" in ` +
+            `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} <id-or-name>, or set "${sky_code_managed_1.AGENT_CONFIG_KEY}" in ` +
             `${configPathHint()}. Yours: ${candidates(rows)}`
         : 'you have no agents and no default could be created, yet a managed skrr Code session ' +
             'runs as one. Create an agent in the skrr app first');
@@ -278,7 +278,7 @@ async function setConfiguredAgentId(ref, deps = {}, options = {}) {
         // Name the thing the user actually typed. Without this a bad `--set` value
         // is refused with "--oversky-agent \"typo\" is not an agent you can run",
         // pointing at a flag that was never on the command line.
-        explicitLabel: 'skrr code oversky-agent --set',
+        explicitLabel: 'skrr code skrr-agent --set',
         ...options,
     });
     writeConfigKey(resolved.id);