@skrr-ai/cli 0.1.8 → 0.1.9

package/dist/commands/tasks/triage.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
+const tasks_1 = require("../../lib/tasks");
 /**
  * A deliberately thin decision façade. Triage has no state machine of its own:
  * accepting and declining are ordinary TYPE-resolved moves, duplicate is the
@@ -29,7 +30,7 @@ class TasksTriage extends base_command_1.BaseCommand {
     static flags = {
         reason: core_1.Flags.string({ description: 'Reason returned to the task source when declining' }),
         priority: core_1.Flags.string({
-            options: ['low', 'medium', 'high', 'critical'],
+            options: [...tasks_1.TASK_PRIORITIES],
             description: 'Priority to set before accepting',
         }),
         of: core_1.Flags.string({ description: 'Canonical task for the duplicate decision' }),

package/dist/commands/tasks/update.js

@@ -45,7 +45,10 @@ class TasksUpdate extends base_command_1.BaseCommand {
             description: 'Input format for --description or from-json description',
             options: ['html', 'markdown', 'plain'],
         }),
-        priority: core_1.Flags.string({ description: 'New priority' }),
+        priority: core_1.Flags.string({
+            description: 'New priority',
+            options: [...tasks_1.TASK_PRIORITIES],
+        }),
         'start-date': core_1.Flags.string({ description: 'New planned start date (ISO string)' }),
         'due-date': core_1.Flags.string({ description: 'New due date (ISO string)' }),
         estimate: core_1.Flags.integer({ description: 'New estimate value from the Space estimate scale' }),

package/dist/commands/tasks/upsert.js

@@ -31,7 +31,10 @@ class TasksUpsert extends base_command_1.BaseCommand {
             description: 'Input format for --description or from-json description',
             options: ['html', 'markdown', 'plain'],
         }),
-        priority: core_1.Flags.string({ description: 'Task priority' }),
+        priority: core_1.Flags.string({
+            description: 'Task priority',
+            options: [...tasks_1.TASK_PRIORITIES],
+        }),
         parent: core_1.Flags.string({ description: 'Parent task ID' }),
         space: core_1.Flags.string({ description: 'Space ID' }),
         goal: core_1.Flags.string({ description: 'Goal ID' }),

package/dist/commands/usage.js

@@ -5,7 +5,7 @@ const base_command_1 = require("../base-command");
 const command_manifest_1 = require("../lib/command-manifest");
 const usage_discovery_1 = require("../lib/usage-discovery");
 class Usage extends base_command_1.BaseCommand {
-    static description = 'Progressively discover Sky commands from the manifest, one token-budgeted domain at a time.';
+    static description = 'Progressively discover skrr commands from the manifest, one token-budgeted domain at a time.';
     static examples = [
         '<%= config.bin %> usage',
         '<%= config.bin %> usage tasks',

package/dist/lib/agentic-stream.js

@@ -8,6 +8,8 @@ exports.toWebSocketOrigin = toWebSocketOrigin;
 const node_readline_1 = require("node:readline");
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const config_1 = require("./config");
+const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 /**
  * Small Node-side adapter for the existing Agentic Socket.IO contract.
  * It deliberately normalizes only lifecycle/text/tool events; the server's
@@ -458,9 +460,27 @@ class AgenticStreamClient {
     }
 }
 exports.AgenticStreamClient = AgenticStreamClient;
+/**
+ * Web apexes whose realtime traffic lives on their `api.` subdomain.
+ *
+ * Derived from the endpoint contract rather than written out, because the two
+ * hostnames used to be literals here and the domain cutover moved one of them:
+ * a CLI logged into the new prod apex fell through to `wss://<apex>`, which
+ * CloudFront cannot upgrade. Nothing errors at the call site — the socket just
+ * never connects, which reads as a network problem rather than a stale list.
+ *
+ * The retired prod apex stays, for the reverse reason: a config file written
+ * before the cutover still names it, and dropping it would strand exactly the
+ * sessions the entry exists to carry.
+ */
+const REALTIME_APEXES = new Set([
+    new URL(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS.prod.appUrl).hostname,
+    new URL(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS.dev.appUrl).hostname,
+    new URL(config_1.LEGACY_PROD_BASE_URL).hostname,
+]);
 function toWebSocketOrigin(baseURL) {
     const url = new URL(baseURL);
-    if (url.hostname === 'oversky.dev' || url.hostname === 'oversky.ai') {
+    if (REALTIME_APEXES.has(url.hostname)) {
         url.hostname = `api.${url.hostname}`;
     }
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';

package/dist/lib/api-fetch.d.ts

@@ -32,7 +32,7 @@ export declare class ApiFetchError extends Error {
     constructor(message: string, status: number, body?: string, code?: string);
 }
 /**
- * Call an skrr API endpoint with the current credential. Throws
+ * Call a skrr API endpoint with the current credential. Throws
  * `ApiFetchError` on any non-2xx status so callers can branch on
  * `err.status` / `err.code`.
  */

package/dist/lib/api-fetch.js

@@ -56,7 +56,7 @@ class ApiFetchError extends Error {
 }
 exports.ApiFetchError = ApiFetchError;
 /**
- * Call an skrr API endpoint with the current credential. Throws
+ * Call a skrr API endpoint with the current credential. Throws
  * `ApiFetchError` on any non-2xx status so callers can branch on
  * `err.status` / `err.code`.
  */

package/dist/lib/auth-core-init.js

@@ -85,6 +85,26 @@ function ensureAuthCoreConfigured() {
         // Phase D: share the daemon's config root so auth.lock and the
         // needs-reauth flag are coordinated across binaries.
         configDir: () => node_path_1.default.join(node_os_1.default.homedir(), '.skrr'),
+        /**
+         * The machine root, PINNED — never the active profile's directory.
+         *
+         * `machineConfigDir` defaults to `configDir()`, and while the CLI's
+         * `configDir` was unconditionally `~/.skrr` that default was correct and
+         * this line would have been noise. It stops being correct the moment
+         * `configDir` becomes profile-aware: machine identity would start drifting
+         * per profile, and the server binds `cliId` into the JWT `did` claim and
+         * REFUSES a rotation presented against a different one. A second profile
+         * would not degrade — it would fail to stay logged in.
+         *
+         * The daemon already learned this the expensive way. OSK-1478: pinning the
+         * machine UUID to a profile-scoped `configDir` silently killed the
+         * `legacyDaemonUuids()` fold safety net, because it scanned
+         * `<profileDir>/profiles/*`, which never exists.
+         *
+         * Wired ahead of the profile work rather than with it, so the landmine is
+         * gone before anything can step on it.
+         */
+        machineConfigDir: () => node_path_1.default.join(node_os_1.default.homedir(), '.skrr'),
         logger: cliLogger,
         killSwitches: {
             // CLI shares the same kill-switch surface as the daemon for ops parity.
@@ -139,13 +159,13 @@ async function settlesWithin(promise, timeoutMs, keepTimerRef = false) {
 function encryptedCredentialInitError(timedOut, cause) {
     const state = (0, cred_envelope_1.describeCredEnvelopeState)();
     if (timedOut) {
-        return new CliCredentialInitializationError('Stored Sky credentials are encrypted, but the local credential store did not ' +
+        return new CliCredentialInitializationError('Stored skrr credentials are encrypted, but the local credential store did not ' +
             `initialize within ${ENCRYPTED_CREDENTIAL_INIT_TIMEOUT_MS / 1000} seconds. ` +
-            'The credential remains protected; wait for other Sky processes to finish and retry.');
+            'The credential remains protected; wait for other skrr processes to finish and retry.');
     }
     const detail = state.kind === 'disabled' && state.reason ? `${state.kind} (${state.reason})` : state.kind;
     const causeMessage = cause instanceof Error ? cause.message.trim().slice(0, 200) : '';
-    return new CliCredentialInitializationError(`Stored Sky credentials are encrypted, but the local credential store is ${detail}. ` +
+    return new CliCredentialInitializationError(`Stored skrr credentials are encrypted, but the local credential store is ${detail}. ` +
         (causeMessage ? `Initialization failed: ${causeMessage}. ` : '') +
         'The credential remains protected; unlock or repair the OS credential store and retry.');
 }

package/dist/lib/auth-storage.d.ts

@@ -33,18 +33,6 @@ export interface WriteOptions {
  * function returns whatever is persisted.
  */
 export declare function readFromBackend(expectedServerOrigin?: string): ReadResult;
-/**
- * Persist a token bundle to the preferred backend.
- *
- * Writes to keychain when available, file otherwise. If keychain writes
- * fail mid-flight (e.g., user canceled the unlock prompt), we fall back
- * to the file backend so the CLI remains functional.
- *
- * Returns the backend that actually accepted the write. Callers wanting
- * a specific backend (bare mode, store-mode overrides) should call the
- * lower-level write helpers directly — not exported here to keep the
- * default path honest.
- */
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**
  * Clear both backends. Called on `skrr logout` (and internally during

package/dist/lib/auth-storage.js

@@ -357,6 +357,37 @@ function readFromBackend(expectedServerOrigin) {
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
  */
+/**
+ * Clear the DAEMON's needs-reauth latch as well as the CLI's own.
+ *
+ * `clearReauthState()` resolves `getAuthConfigDir()`, and the two binaries wire
+ * that differently: the CLI points auth-core at the machine root (`~/.skrr`),
+ * the daemon at its PROFILE dir (`~/.skrr/profiles/<profile>`). So the daemon
+ * latched at one path while `skrr login` cleared another — a file that on most
+ * machines does not exist at all, which made the clear a silent no-op.
+ *
+ * The visible cost was a loop with no exit: `skrr daemon status` reported
+ * "Cause: TOKEN_INVALID · Remedy: run `skrr login`", the login succeeded, and
+ * the flag never moved, so the daemon's realtime channel stayed down and it
+ * could not execute tasks. `auth-core-init.ts` states the intent — "share the
+ * daemon's config root so auth.lock and the needs-reauth flag are coordinated
+ * across binaries" — which stopped being true when the daemon became
+ * profile-scoped.
+ *
+ * The ACTIVE profile only, deliberately: a per-profile latch is correct because
+ * different profiles can hold different credentials, and a login re-authorises
+ * exactly the one it just wrote.
+ */
+function clearDaemonProfileReauthState() {
+    try {
+        const target = path.join(os.homedir(), '.skrr', 'profiles', keychain.getActiveProfile(), 'needs-reauth.json');
+        fs.rmSync(target, { force: true });
+    }
+    catch {
+        // Best effort: the CLI's own latch is already cleared, and failing to
+        // remove the daemon's must not fail a login that otherwise succeeded.
+    }
+}
 function writeToBackend(bundle, options = {}) {
     const requestedOrigin = options.serverOrigin ?? bundle.serverOrigin;
     let persistedBundle = bundle;
@@ -373,8 +404,10 @@ function writeToBackend(bundle, options = {}) {
             // Remove any stale file copy so we don't have two sources of truth.
             deleteFileBackend();
             backend = 'keychain';
-            if (options.clearReauth)
+            if (options.clearReauth) {
                 (0, auth_core_1.clearReauthState)();
+                clearDaemonProfileReauthState();
+            }
             return backend;
         }
         // Keychain failed — fall through to the file backend rather than
@@ -386,8 +419,10 @@ function writeToBackend(bundle, options = {}) {
     }
     writeToFile(persistedBundle);
     backend = 'file';
-    if (options.clearReauth)
+    if (options.clearReauth) {
         (0, auth_core_1.clearReauthState)();
+        clearDaemonProfileReauthState();
+    }
     return backend;
 }
 /**

package/dist/lib/config.d.ts

@@ -128,9 +128,9 @@ export declare function canonicalizeKnownBaseURL(value: string): string;
  */
 export declare function isEnvAuthOverride(): boolean;
 /**
- * Read the config file. Returns defaults if missing. Throws on corrupt
- * JSON. Performs a one-shot legacy → new copy when only the legacy file
- * exists, so existing users don't have to re-login.
+ * Read the config file. Returns defaults if missing. Throws on corrupt JSON.
+ * Performs a one-shot legacy → new copy when only the legacy file exists, so
+ * existing users don't have to re-login.
  */
 export declare function loadConfig(): CliConfig;
 /** Write the config file with mode 0600 inside a 0700 directory. */

package/dist/lib/config.js

@@ -48,6 +48,7 @@ exports.saveRawConfig = saveRawConfig;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+const keychain_1 = require("./keychain");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -138,18 +139,46 @@ const ENV_VAR = {
     refreshToken: 'OVERSKY_REFRESH_TOKEN',
     cliId: 'OVERSKY_CLI_ID',
 };
+/**
+ * Read one overlay variable under either prefix.
+ *
+ * The ~921 `OVERSKY_*` variables are RETAINED by decision
+ * (docs/product/skrr-env-inventory.md), so this migrates nothing and changes no
+ * existing environment: the legacy spelling still wins when both are set. What
+ * it stops is the renamed product SILENTLY IGNORING the prefix its own
+ * contributor docs tell new code to use. `SKRR_BASE_URL=https://oversky.dev`
+ * previously did nothing at all — the command ran happily against production
+ * and reported success, which is the worst available outcome for a variable
+ * whose entire job is choosing the deployment.
+ *
+ * A disagreement is reported rather than resolved quietly, because two
+ * different values for one setting is a mistake either way.
+ */
+let warnedEnvPrefixConflict = false;
+function envOverlayValue(key) {
+    const legacyName = ENV_VAR[key];
+    const renamedName = legacyName.replace(/^OVERSKY_/, 'SKRR_');
+    const legacy = process.env[legacyName]?.trim();
+    const renamed = process.env[renamedName]?.trim();
+    if (legacy && renamed && legacy !== renamed && !warnedEnvPrefixConflict) {
+        warnedEnvPrefixConflict = true;
+        process.stderr.write(`warning: ${legacyName} and ${renamedName} are both set and disagree. ` +
+            `Using ${legacyName}=${legacy}.\n`);
+    }
+    return legacy && legacy.length > 0 ? legacy : renamed && renamed.length > 0 ? renamed : undefined;
+}
 function overlayEnv(cfg) {
     const out = { ...cfg };
-    const bu = process.env[ENV_VAR.baseURL] || process.env[ENV_VAR.serverUrl];
+    const bu = envOverlayValue('baseURL') || envOverlayValue('serverUrl');
     if (bu && bu.length > 0)
         out.baseURL = canonicalizeKnownBaseURL(bu);
-    const tok = process.env[ENV_VAR.token];
+    const tok = envOverlayValue('token');
     if (tok && tok.length > 0)
         out.token = tok;
-    const rt = process.env[ENV_VAR.refreshToken];
+    const rt = envOverlayValue('refreshToken');
     if (rt && rt.length > 0)
         out.refreshToken = rt;
-    const cid = process.env[ENV_VAR.cliId];
+    const cid = envOverlayValue('cliId');
     if (cid && cid.length > 0)
         out.cliId = cid;
     return out;
@@ -161,8 +190,9 @@ function overlayEnv(cfg) {
  * us persist a rotated pair that the next `loadConfig()` would shadow.
  */
 function isEnvAuthOverride() {
-    return !!((process.env[ENV_VAR.token] && process.env[ENV_VAR.token].length > 0) ||
-        (process.env[ENV_VAR.refreshToken] && process.env[ENV_VAR.refreshToken].length > 0));
+    // Both prefixes, or a credential injected as SKRR_TOKEN would be used for the
+    // request while the process still believed it could refresh and persist.
+    return !!(envOverlayValue('token') || envOverlayValue('refreshToken'));
 }
 /**
  * Storage layout (Phase H+).
@@ -178,9 +208,100 @@ function isEnvAuthOverride() {
 function newConfigDir() {
     return path.join(os.homedir(), '.skrr');
 }
+/**
+ * Fields that belong to the MACHINE, not to a profile.
+ *
+ * `cliId` is the sharp one. Its own doc says it is presented at login and at
+ * every refresh rotation, and that the server binds it into the JWT `did` claim
+ * and rejects a rotation against a different one. Split it per profile and a
+ * second profile does not degrade — it fails to stay logged in.
+ *
+ * `credentials.store` is a machine posture (keychain / file / env-only), and
+ * `migrated` is a breadcrumb about this machine's DISK LAYOUT. Neither is a
+ * property of which deployment you are addressing.
+ *
+ * Everything else follows the profile, because everything else IS the
+ * deployment: `baseURL`, who you are there (`userId`, `email`), and what you
+ * chose there (`workspaceId`, `skyCodeAgentId`).
+ */
+const MACHINE_SCOPED_KEYS = ['cliId', 'credentials', 'migrated'];
+/**
+ * Where this profile's config lives.
+ *
+ * The DEFAULT profile keeps `~/.skrr/cli-config.json` — the exact path it has
+ * always used. That is the whole reason this change needs no migration and
+ * carries almost no risk: profiles are ADDITIVE. An existing install is the
+ * default profile, its file does not move, and nothing about it is rewritten.
+ *
+ * A named profile gets `~/.skrr/profiles/<name>/cli-config.json`, sharing the
+ * tree the daemon already uses for the same idea. Sharing rather than inventing
+ * `cli-profiles/` is deliberate: today's worst failure is the CLI and the daemon
+ * pointing at different deployments (OSK-279), and one profile namespace makes
+ * that harder to produce, not easier.
+ */
+function profileConfigDir() {
+    const profile = (0, keychain_1.getActiveProfile)();
+    if (!profile || profile === keychain_1.DEFAULT_PROFILE)
+        return newConfigDir();
+    return path.join(newConfigDir(), 'profiles', profile);
+}
 function newConfigFile() {
+    return path.join(profileConfigDir(), 'cli-config.json');
+}
+/** The machine-scoped file, which never moves with the profile. */
+function machineConfigFile() {
     return path.join(newConfigDir(), 'cli-config.json');
 }
+/** Split a config into the half that follows the profile and the half that does not. */
+function splitByScope(config) {
+    const machine = {};
+    const profile = {};
+    for (const [key, value] of Object.entries(config)) {
+        if (MACHINE_SCOPED_KEYS.includes(key))
+            machine[key] = value;
+        else
+            profile[key] = value;
+    }
+    return { machine, profile };
+}
+/**
+ * Machine-scoped fields, read from the machine file regardless of profile.
+ *
+ * Returns an empty object rather than throwing: a named profile on a machine
+ * that has never run the default one has no machine file yet, and that is a
+ * first run, not a fault.
+ */
+function readMachineScoped() {
+    const p = machineConfigFile();
+    if (!fs.existsSync(p))
+        return {};
+    try {
+        return splitByScope(readJsonOrThrow(p)).machine;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * The PRE-RENAME config root — the generation between `.sky` and `.skrr`.
+ *
+ * This was missing from the fallback chain, which went straight from `.skrr` to
+ * `.sky` and skipped the directory that every current install actually has.
+ * The effect is not a missing preference: with no config found, `loadConfig`
+ * returns DEFAULT_CONFIG, whose baseURL is the production apex — so a CLI that
+ * had been pointed at the dev deployment silently starts addressing PRODUCTION,
+ * and its `workspaceId` is gone. Nothing errors; commands just answer about a
+ * different backend.
+ *
+ * Note the filename differs by generation: `.sky` used `config.json`, `.oversky`
+ * and `.skrr` use `cli-config.json`.
+ */
+function priorConfigDir() {
+    return path.join(os.homedir(), '.oversky');
+}
+function priorConfigFile() {
+    return path.join(priorConfigDir(), 'cli-config.json');
+}
 function legacyConfigDir() {
     return path.join(os.homedir(), '.sky');
 }
@@ -188,41 +309,221 @@ function legacyConfigFile() {
     return path.join(legacyConfigDir(), 'config.json');
 }
 /**
- * Read the config file. Returns defaults if missing. Throws on corrupt
- * JSON. Performs a one-shot legacy → new copy when only the legacy file
- * exists, so existing users don't have to re-login.
+ * Breadcrumb proving the carry-forward already ran on this machine.
+ *
+ * Deliberately OUTSIDE the file it produces. The migration's own record used to
+ * be the config it wrote, which made it one-shot only for as long as that file
+ * survived: any moment where `cli-config.json` was absent looked exactly like a
+ * first run, and the pre-rename config was adopted again — `baseURL` included.
+ *
+ * Follows the `.migrated-*` convention already used by the daemon's
+ * profile-migration and keychain-hygiene passes.
+ */
+const CARRY_FORWARD_BREADCRUMB = '.migrated-2026-09-02-cli-config-carry-forward';
+function carryForwardBreadcrumbPath() {
+    return path.join(newConfigDir(), CARRY_FORWARD_BREADCRUMB);
+}
+function hasCarriedForward() {
+    try {
+        return fs.existsSync(carryForwardBreadcrumbPath());
+    }
+    catch {
+        return false;
+    }
+}
+function markCarriedForward() {
+    try {
+        const dir = newConfigDir();
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(carryForwardBreadcrumbPath(), `${new Date().toISOString()}\n`, {
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Best effort. Failing to record it means the migration may run again,
+        // which is the old behaviour — not worse.
+    }
+}
+let announcedAdoptedDeployment = false;
+/**
+ * Say when the CLI adopts a deployment the user did not name in this command.
+ *
+ * Whatever the source, changing which DEPLOYMENT a session addresses is not a
+ * detail: the failure it produces is an empty list, not an error, because a
+ * successful `200 {"data": []}` from the wrong deployment is indistinguishable
+ * from having no rows.
+ */
+function announceAdoptedDeployment(baseURL, source) {
+    if (announcedAdoptedDeployment)
+        return;
+    announcedAdoptedDeployment = true;
+    process.stderr.write(`note: no CLI config found; using ${baseURL} (from ${source}).\n` +
+        `      If that is the wrong deployment:  skrr login --base-url <url>\n`);
+}
+/**
+ * Read the config file. Returns defaults if missing. Throws on corrupt JSON.
+ * Performs a one-shot legacy → new copy when only the legacy file exists, so
+ * existing users don't have to re-login.
  */
 function loadConfig() {
     const newPath = newConfigFile();
+    const named = newPath !== machineConfigFile();
     if (fs.existsSync(newPath)) {
-        return overlayEnv(migrateLegacyBaseURL(readJsonOrThrow(newPath)));
+        const current = migrateLegacyBaseURL(readJsonOrThrow(newPath));
+        warnIfStrandedPriorConfig(current);
+        // A named profile's file holds only its own half; the machine half is read
+        // from the machine file so `cliId` is one value for this machine no matter
+        // how many profiles exist.
+        return overlayEnv(named ? { ...current, ...readMachineScoped() } : current);
     }
-    const legacyPath = legacyConfigFile();
-    if (fs.existsSync(legacyPath)) {
-        const legacy = migrateLegacyBaseURL(readJsonOrThrow(legacyPath));
-        try {
-            saveConfig(legacy);
-        }
-        catch {
-            /* swallow — caller still has a usable config in memory */
+    // A named profile that has never been used is a FIRST RUN for that profile,
+    // not a machine without config. It must not adopt the default profile's
+    // deployment — that is how "switch to dev" would silently keep talking to
+    // prod — so it starts from the documented default, carrying only the machine
+    // half forward. The generation carry-forward below is deliberately skipped:
+    // there is no `.sky`/`.oversky` ancestor of a profile that did not exist then.
+    if (named) {
+        return overlayEnv({ ...DEFAULT_CONFIG, ...readMachineScoped() });
+    }
+    // Newest first, and ONCE per machine. Each generation is copied forward so a
+    // user never has to re-login because a directory was renamed — but only on a
+    // genuine first run. After the breadcrumb exists, a missing config means the
+    // file went away, not that this machine is pre-rename, and re-adopting the
+    // old file would silently move the session to the old DEPLOYMENT.
+    if (!hasCarriedForward()) {
+        for (const carriedPath of [priorConfigFile(), legacyConfigFile()]) {
+            if (!fs.existsSync(carriedPath))
+                continue;
+            const carried = migrateLegacyBaseURL(readJsonOrThrow(carriedPath));
+            try {
+                saveConfig(carried);
+            }
+            catch {
+                /* swallow — caller still has a usable config in memory */
+            }
+            markCarriedForward();
+            announceAdoptedDeployment(carried.baseURL, carriedPath);
+            return overlayEnv(carried);
         }
-        return overlayEnv(legacy);
     }
+    // Nothing to carry: fall through to the documented default. Deliberately NOT
+    // derived from the stored credential's origin — making config resolution read
+    // the keychain would let ambient machine state override a documented default,
+    // and a fresh install defaulting to dev is intended behaviour, not a bug.
     return overlayEnv({ ...DEFAULT_CONFIG });
 }
+/**
+ * Surface the one case this fix cannot repair on its own.
+ *
+ * A CLI that ran after the directory rename but before this migration existed
+ * already wrote a `.skrr` config from DEFAULT_CONFIG. The copy-forward above
+ * will not fire for it, and it must not: once a config exists, "the user chose
+ * this backend" and "the default landed here" are indistinguishable, and
+ * silently rewriting a deliberate choice is worse than the bug.
+ *
+ * So it says so instead of guessing. Warned once per process, to stderr, and
+ * only when the two disagree — agreement needs no warning.
+ */
+let warnedStrandedPriorConfig = false;
+function warnIfStrandedPriorConfig(current) {
+    if (warnedStrandedPriorConfig)
+        return;
+    // On EVERY command, forever, was the complaint — and it is fair: once you have
+    // read it and meant the deployment you are on, it is pure noise burying real
+    // stderr. Deleting the old file is one exit; this is the other, for a machine
+    // that wants to keep it.
+    if ((process.env[QUIET_ENV] ?? '').trim().length > 0)
+        return;
+    const priorPath = priorConfigFile();
+    if (!fs.existsSync(priorPath))
+        return;
+    let prior;
+    try {
+        prior = readJsonOrThrow(priorPath);
+    }
+    catch {
+        return; // an unreadable prior config is not evidence of anything
+    }
+    const priorBase = canonicalizeKnownBaseURL(prior.baseURL);
+    if (!priorBase || priorBase === canonicalizeKnownBaseURL(current.baseURL))
+        return;
+    warnedStrandedPriorConfig = true;
+    const stranded = strandedSettings(prior);
+    const alsoHolds = stranded.length > 0 ? ` (it also holds ${stranded.join(', ')})` : '';
+    process.stderr.write(`warning: ${priorPath} points at ${priorBase}; this CLI is using ${current.baseURL}.\n` +
+        `         Use it instead:  skrr login --base-url ${priorBase}\n` +
+        `         Or silence this: set ${QUIET_ENV}=1, or delete that file${alsoHolds}\n`);
+}
+/** Opt out once you have read the warning and meant the deployment you are on. */
+const QUIET_ENV = 'SKRR_QUIET_CONFIG_WARNING';
+/**
+ * The settings that deleting the prior config would discard.
+ *
+ * The migration did not carry these forward, so the old file is their only
+ * copy — naming them is the difference between an instruction and a trap.
+ */
+function strandedSettings(prior) {
+    const carried = new Set(['baseURL', 'migrated', 'cliId']);
+    return Object.keys(prior)
+        .filter((k) => !carried.has(k) && prior[k] !== undefined)
+        .sort();
+}
+function newPath() {
+    return newConfigFile();
+}
 /** Write the config file with mode 0600 inside a 0700 directory. */
 function saveConfig(config) {
-    const dir = newConfigDir();
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    const p = newConfigFile();
     const canonical = {
         ...config,
         baseURL: canonicalizeKnownBaseURL(config.baseURL),
     };
-    fs.writeFileSync(p, JSON.stringify(canonical, null, 2), { mode: 0o600 });
-    fs.chmodSync(p, 0o600);
+    const target = newConfigFile();
+    const machineFile = machineConfigFile();
+    // Default profile: one file, exactly as before. Nothing is split, nothing
+    // moves, and an existing install cannot notice this change.
+    if (target === machineFile) {
+        writeConfigFile(target, canonical);
+        return;
+    }
+    const { machine, profile } = splitByScope(canonical);
+    writeConfigFile(target, profile);
+    // Machine-scoped fields are MERGED into the machine file rather than
+    // replacing it: the default profile's deployment, workspace and account live
+    // in that same file, and a named profile writing its own half over the top
+    // would sign the default profile out.
+    const existingMachine = fs.existsSync(machineFile) ? readJsonOrThrow(machineFile) : {};
+    const merged = { ...existingMachine, ...machine };
+    if (JSON.stringify(merged) !== JSON.stringify(existingMachine)) {
+        writeConfigFile(machineFile, merged);
+    }
+}
+/**
+ * Warn once when a write happens before the profile was chosen.
+ *
+ * Such a write lands in the default profile's file whatever `--profile` said,
+ * because the choice had not been made yet. It is silent, it is permanent, and
+ * the only way anyone finds it is by wondering why a named profile keeps
+ * forgetting things. The daemon carries the same guard for the same reason.
+ */
+let warnedUnresolvedProfile = false;
+function warnIfProfileUnresolved(target) {
+    if ((0, keychain_1.isProfileResolved)() || warnedUnresolvedProfile)
+        return;
+    warnedUnresolvedProfile = true;
+    process.stderr.write(`[profile] config written to ${target} before the profile was resolved; ` +
+        'it landed in the default profile. If this was not the crash path, it is a ' +
+        'regression — a writer is running before BaseCommand.init().\n');
+}
+/** Write one config file with the directory created and 0600 enforced. */
+function writeConfigFile(target, contents) {
+    warnIfProfileUnresolved(target);
+    const dir = path.dirname(target);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    fs.writeFileSync(target, JSON.stringify(contents, null, 2), { mode: 0o600 });
+    fs.chmodSync(target, 0o600);
 }
 /**
  * One-shot migration for clients installed before oversky.dev became the dev