@skrr-ai/cli 0.1.8 → 0.1.9

package/dist/lib/created-line.d.ts

@@ -0,0 +1,22 @@
+/**
+ * One shape for "you just created a thing".
+ *
+ * The four core entities each printed a different confirmation: the identifier
+ * was a human ref for a project, a raw uuid for a goal and a space, and both for
+ * a task; the separator was an em dash for two and a hyphen for the other two;
+ * and goals and spaces appended context (`in space <uuid>`,
+ * `(subspace of <uuid>)`) that the link on the next line already carries.
+ *
+ * Reading four of these in a row, you cannot tell what you are being handed —
+ * which is what makes the difference between "did this work" and "what do I
+ * paste into the next command" harder than it should be.
+ *
+ * The rule: prefer the ref a person can type, fall back to the id, and put the
+ * title after a single em dash. The `View it at <url>` line that follows is
+ * already consistent and is left alone.
+ */
+export declare function createdLine(entity: string, opts: {
+    ref?: string | null;
+    id?: string | null;
+    title?: string | null;
+}): string;

package/dist/lib/created-line.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createdLine = createdLine;
+/**
+ * One shape for "you just created a thing".
+ *
+ * The four core entities each printed a different confirmation: the identifier
+ * was a human ref for a project, a raw uuid for a goal and a space, and both for
+ * a task; the separator was an em dash for two and a hyphen for the other two;
+ * and goals and spaces appended context (`in space <uuid>`,
+ * `(subspace of <uuid>)`) that the link on the next line already carries.
+ *
+ * Reading four of these in a row, you cannot tell what you are being handed —
+ * which is what makes the difference between "did this work" and "what do I
+ * paste into the next command" harder than it should be.
+ *
+ * The rule: prefer the ref a person can type, fall back to the id, and put the
+ * title after a single em dash. The `View it at <url>` line that follows is
+ * already consistent and is left alone.
+ */
+function createdLine(entity, opts) {
+    const label = (opts.ref ?? '').trim() || (opts.id ?? '').trim() || '?';
+    const title = (opts.title ?? '').trim() || '(no title)';
+    return `Created ${entity} ${label} — ${title}`;
+}

package/dist/lib/daemon-binding.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Defaults for the flags that decide WHICH deployment and WHICH profile a
+ * newly installed daemon binds to.
+ *
+ * `skrr daemon *` are pass-throughs to the `skrrd` binary, and the two
+ * programs keep SEPARATE configuration: the CLI's deployment and profile live
+ * in `cli-config.json`, the daemon's in `daemon.json`. Nothing has ever made
+ * one follow the other, so the ordinary way to end up split is to do nothing
+ * unusual at all — log the CLI into one deployment and leave the daemon on
+ * whichever it was installed against. That is OSK-279, observed on this
+ * machine as a daemon on dev serving a CLI on prod.
+ *
+ * The fix is deliberately scoped to INSTALL, the moment a daemon is created
+ * and the only moment its binding is not yet somebody's decision. `start` is
+ * left alone on purpose: it starts a daemon that already has a binding, and
+ * silently overriding it would break the operator who split the two knowingly
+ * — running a dev daemon against a prod CLI is a legitimate thing to do, and
+ * it is not this function's place to overrule it. `skrr daemon status` reports
+ * a split instead of correcting one.
+ */
+/** Whether `argv` already carries `--name` or `--name=value` (or `-alias`). */
+export declare function hasFlag(argv: readonly string[], name: string, alias?: string): boolean;
+/**
+ * Append `--server` / `--profile` describing the CLI's own session, for any
+ * the caller did not pass. An explicit flag always wins — this only fills a
+ * silence, so `skrr daemon install --env prod` still installs against prod
+ * while the CLI sits on dev.
+ */
+export declare function bindToCliSession(argv: readonly string[]): string[];

package/dist/lib/daemon-binding.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasFlag = hasFlag;
+exports.bindToCliSession = bindToCliSession;
+const config_1 = require("./config");
+const keychain_1 = require("./keychain");
+/**
+ * Defaults for the flags that decide WHICH deployment and WHICH profile a
+ * newly installed daemon binds to.
+ *
+ * `skrr daemon *` are pass-throughs to the `skrrd` binary, and the two
+ * programs keep SEPARATE configuration: the CLI's deployment and profile live
+ * in `cli-config.json`, the daemon's in `daemon.json`. Nothing has ever made
+ * one follow the other, so the ordinary way to end up split is to do nothing
+ * unusual at all — log the CLI into one deployment and leave the daemon on
+ * whichever it was installed against. That is OSK-279, observed on this
+ * machine as a daemon on dev serving a CLI on prod.
+ *
+ * The fix is deliberately scoped to INSTALL, the moment a daemon is created
+ * and the only moment its binding is not yet somebody's decision. `start` is
+ * left alone on purpose: it starts a daemon that already has a binding, and
+ * silently overriding it would break the operator who split the two knowingly
+ * — running a dev daemon against a prod CLI is a legitimate thing to do, and
+ * it is not this function's place to overrule it. `skrr daemon status` reports
+ * a split instead of correcting one.
+ */
+/** Whether `argv` already carries `--name` or `--name=value` (or `-alias`). */
+function hasFlag(argv, name, alias) {
+    return argv.some((arg) => {
+        if (arg === '--')
+            return false;
+        return (arg === name ||
+            arg.startsWith(`${name}=`) ||
+            (alias !== undefined && (arg === alias || arg.startsWith(`${alias}=`))));
+    });
+}
+/**
+ * Append `--server` / `--profile` describing the CLI's own session, for any
+ * the caller did not pass. An explicit flag always wins — this only fills a
+ * silence, so `skrr daemon install --env prod` still installs against prod
+ * while the CLI sits on dev.
+ */
+function bindToCliSession(argv) {
+    const extra = [];
+    // `--env` resolves to a server URL inside the daemon, so passing one is
+    // passing the other. Adding `--server` beside it would be an ambiguous
+    // instruction where the daemon's own precedence, not ours, decides.
+    if (!hasFlag(argv, '--server', '-s') && !hasFlag(argv, '--env', '-e')) {
+        const { baseURL } = (0, config_1.loadConfig)();
+        if (baseURL)
+            extra.push('--server', baseURL);
+    }
+    if (!hasFlag(argv, '--profile')) {
+        // The CLI's own profile, resolved the same way `BaseCommand` resolves it.
+        // These commands extend `Command`, so `init()` never ran and the module
+        // state `getActiveProfile()` reads was never set — asking it here would
+        // report `default` no matter what the user typed.
+        const profile = (0, keychain_1.resolveProfileFromArgv)(argv) ?? process.env.OVERSKY_PROFILE ?? null;
+        if (profile && profile !== keychain_1.DEFAULT_PROFILE)
+            extra.push('--profile', profile);
+    }
+    return [...argv, ...extra];
+}

package/dist/lib/daemon-ref.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The two halves of the daemon-reference contract: how a daemon id is DISPLAYED
+ * and how a displayed one is READ BACK.
+ *
+ * `list-daemons` prints a decorated short form — `d_6a323ae4...` — and the two
+ * commands that consume a daemon reference (`revoke-daemon`,
+ * `set-capabilities`) matched the raw argument against `id.startsWith(prefix)`.
+ * So the value the product printed in a column literally headed DAEMON REF was
+ * rejected by every command that takes one, and the failure looked like "no such
+ * daemon" rather than "that is not the format I want". The sibling
+ * `machines show` accepts what `machines list` prints, which is the behaviour
+ * people reasonably expect here too.
+ *
+ * Keeping the decoration and accepting it back is the right trade: the `d_`
+ * prefix and the ellipsis are what tell a reader the value is truncated, and
+ * dropping them would make an 8-character fragment look like a full id.
+ */
+/**
+ * Format a full daemon ObjectId as a short readable label:
+ * `d_xY3p...` — prefix + first 8 hex chars + an ellipsis.
+ */
+export declare function formatDaemonRef(id: string): string;
+/**
+ * Read back anything `formatDaemonRef` may have produced, plus what a person
+ * plausibly pastes: with or without the `d_`, with or without a trailing `...`
+ * or a real ellipsis character, and with surrounding whitespace.
+ *
+ * A value that was never decorated passes through untouched, so a full id and a
+ * hand-typed prefix keep working exactly as before.
+ */
+export declare function normalizeDaemonRef(input: string): string;

package/dist/lib/daemon-ref.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * The two halves of the daemon-reference contract: how a daemon id is DISPLAYED
+ * and how a displayed one is READ BACK.
+ *
+ * `list-daemons` prints a decorated short form — `d_6a323ae4...` — and the two
+ * commands that consume a daemon reference (`revoke-daemon`,
+ * `set-capabilities`) matched the raw argument against `id.startsWith(prefix)`.
+ * So the value the product printed in a column literally headed DAEMON REF was
+ * rejected by every command that takes one, and the failure looked like "no such
+ * daemon" rather than "that is not the format I want". The sibling
+ * `machines show` accepts what `machines list` prints, which is the behaviour
+ * people reasonably expect here too.
+ *
+ * Keeping the decoration and accepting it back is the right trade: the `d_`
+ * prefix and the ellipsis are what tell a reader the value is truncated, and
+ * dropping them would make an 8-character fragment look like a full id.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatDaemonRef = formatDaemonRef;
+exports.normalizeDaemonRef = normalizeDaemonRef;
+/** Prefix the short form carries so a truncated id is visibly truncated. */
+const DISPLAY_PREFIX = 'd_';
+/**
+ * Format a full daemon ObjectId as a short readable label:
+ * `d_xY3p...` — prefix + first 8 hex chars + an ellipsis.
+ */
+function formatDaemonRef(id) {
+    if (!id || id.length < 8)
+        return id || '—';
+    return `${DISPLAY_PREFIX}${id.slice(0, 8)}...`;
+}
+/**
+ * Read back anything `formatDaemonRef` may have produced, plus what a person
+ * plausibly pastes: with or without the `d_`, with or without a trailing `...`
+ * or a real ellipsis character, and with surrounding whitespace.
+ *
+ * A value that was never decorated passes through untouched, so a full id and a
+ * hand-typed prefix keep working exactly as before.
+ */
+function normalizeDaemonRef(input) {
+    let out = input.trim();
+    if (out.toLowerCase().startsWith(DISPLAY_PREFIX))
+        out = out.slice(DISPLAY_PREFIX.length);
+    out = out.replace(/(?:\.{3}|…)$/, '');
+    return out.trim();
+}

package/dist/lib/daemonBroker.js

@@ -286,7 +286,7 @@ async function attemptDaemonBrokerLogin(opts) {
             return {
                 ok: false,
                 reason: 'base_url_mismatch',
-                detail: `No local oversky daemon is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
+                detail: `No local skrr runtime is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
                 daemonServerUrl: mismatchedBootstrap.serverUrl,
             };
         }

package/dist/lib/delegated-cli.js

@@ -22,7 +22,7 @@ function isDelegatedCliSession(env = process.env) {
 function trustedLoopbackUrl(raw) {
     const url = new URL(raw);
     if (url.protocol !== 'http:' || !['127.0.0.1', 'localhost', '::1'].includes(url.hostname)) {
-        throw new Error('Delegated Sky CLI broker must be a loopback HTTP URL.');
+        throw new Error('Delegated skrr CLI broker must be a loopback HTTP URL.');
     }
     return url.toString();
 }
@@ -82,11 +82,11 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
                 if (body?.code === 'DELEGATED_CLI_CAPABILITY_REJECTED')
                     return null;
             }
-            throw new Error(`Delegated Sky CLI credential broker returned HTTP ${res.status}.`);
+            throw new Error(`Delegated skrr CLI credential broker returned HTTP ${res.status}.`);
         }
         const body = (await res.json());
         if (typeof body.accessToken !== 'string' || body.accessToken.length === 0) {
-            throw new Error('Delegated Sky CLI credential broker returned no access token.');
+            throw new Error('Delegated skrr CLI credential broker returned no access token.');
         }
         const credential = {
             token: body.accessToken,

package/dist/lib/exec-oversky.d.ts

@@ -3,8 +3,25 @@ export declare const RUNTIME_BINARY_NAMES: readonly ["skrrd", "oversky"];
 /** Resolve the absolute path of `oversky` if it exists, else return null. */
 export declare function findOverskyBinary(): string | null;
 /**
- * Pretty hint shown when `oversky` isn't installed. Kept short — points
+ * Pretty hint shown when the runtime isn't installed. Kept short — points
  * users at the canonical install paths rather than enumerating them.
+ *
+ * THE ADDRESSES BELOW STILL SAY `oversky`, ON PURPOSE.
+ * ---------------------------------------------------
+ * The rename moved this text to `skrr` and pointed it at
+ * `dush1023/skrr/skrrd`, `raw.githubusercontent.com/dush1023/skrr/...` and
+ * `github.com/dush1023/skrr` — none of which exist. The tap
+ * `dush1023/homebrew-skrr` 404s; only `dush1023/homebrew-oversky` is
+ * published, and the repository is still `dush1023/OverSky`.
+ *
+ * An install instruction is only worth what it installs. Renaming these
+ * before the tap and repository move produces a message that reads correct
+ * and fails when followed — the same defect as the "install it with
+ * `sky code install`" hint, which named a command that never existed.
+ *
+ * They move when the Homebrew tap is published (that work is tracked
+ * separately) and when the repository is renamed — not before, and not as
+ * part of a copy sweep.
  */
 export declare function notInstalledMessage(): string;
 /**

package/dist/lib/exec-oversky.js

@@ -76,17 +76,34 @@ function isExecutable(p) {
     }
 }
 /**
- * Pretty hint shown when `oversky` isn't installed. Kept short — points
+ * Pretty hint shown when the runtime isn't installed. Kept short — points
  * users at the canonical install paths rather than enumerating them.
+ *
+ * THE ADDRESSES BELOW STILL SAY `oversky`, ON PURPOSE.
+ * ---------------------------------------------------
+ * The rename moved this text to `skrr` and pointed it at
+ * `dush1023/skrr/skrrd`, `raw.githubusercontent.com/dush1023/skrr/...` and
+ * `github.com/dush1023/skrr` — none of which exist. The tap
+ * `dush1023/homebrew-skrr` 404s; only `dush1023/homebrew-oversky` is
+ * published, and the repository is still `dush1023/OverSky`.
+ *
+ * An install instruction is only worth what it installs. Renaming these
+ * before the tap and repository move produces a message that reads correct
+ * and fails when followed — the same defect as the "install it with
+ * `sky code install`" hint, which named a command that never existed.
+ *
+ * They move when the Homebrew tap is published (that work is tracked
+ * separately) and when the repository is renamed — not before, and not as
+ * part of a copy sweep.
  */
 function notInstalledMessage() {
     return [
         'The skrr local runtime is not installed on this machine.',
         '',
         'Install:',
-        '  macOS:   brew install dush1023/skrr/skrrd',
-        '  Linux:   curl -fsSL https://raw.githubusercontent.com/dush1023/skrr/main/scripts/install-daemon.sh | bash',
-        '  Other:   https://github.com/dush1023/skrr#installation',
+        '  macOS:   brew install dush1023/oversky/oversky',
+        '  Linux:   curl -fsSL https://raw.githubusercontent.com/dush1023/OverSky/main/scripts/install-daemon.sh | bash',
+        '  Other:   https://github.com/dush1023/OverSky#installation',
         '',
         'Once installed, re-run your command.',
     ].join('\n');

package/dist/lib/html-text.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Render server-stored rich text as something a terminal can read.
+ *
+ * Task, goal and project descriptions are persisted as HTML — `--description
+ * -format markdown` is converted on the way in — so a CLI that prints the field
+ * verbatim shows the user `<p>…</p>` and `<code>…</code>` around their own
+ * words. They wrote markdown and got tags back.
+ *
+ * Deliberately NOT a general HTML renderer. It converts the block boundaries
+ * that carry meaning in a paragraph of prose, drops the rest of the tags, and
+ * decodes the entity set the server actually emits. Anything that does not look
+ * like markup is returned untouched, so a plain-text description keeps its own
+ * whitespace instead of being reflowed by a converter it never needed.
+ */
+export declare function htmlToDisplayText(value: string): string;

package/dist/lib/html-text.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Render server-stored rich text as something a terminal can read.
+ *
+ * Task, goal and project descriptions are persisted as HTML — `--description
+ * -format markdown` is converted on the way in — so a CLI that prints the field
+ * verbatim shows the user `<p>…</p>` and `<code>…</code>` around their own
+ * words. They wrote markdown and got tags back.
+ *
+ * Deliberately NOT a general HTML renderer. It converts the block boundaries
+ * that carry meaning in a paragraph of prose, drops the rest of the tags, and
+ * decodes the entity set the server actually emits. Anything that does not look
+ * like markup is returned untouched, so a plain-text description keeps its own
+ * whitespace instead of being reflowed by a converter it never needed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.htmlToDisplayText = htmlToDisplayText;
+/** Cheap, deliberate: a tag-shaped substring is the only trigger. */
+function looksLikeHtml(value) {
+    return /<\/?[a-z][^>]*>/i.test(value);
+}
+function htmlToDisplayText(value) {
+    if (!looksLikeHtml(value))
+        return value;
+    return (value
+        .replace(/<br\s*\/?>/gi, '\n')
+        .replace(/<\/(p|div|li|h[1-6])>/gi, '\n')
+        .replace(/<li[^>]*>/gi, '  - ')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&#39;/g, "'")
+        .replace(/&quot;/g, '"')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        // `&amp;` LAST, or `&amp;lt;` would decode twice into a bare `<`.
+        .replace(/&amp;/g, '&')
+        .replace(/[ \t]+/g, ' ')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim());
+}

package/dist/lib/keychain.d.ts

@@ -1,4 +1,15 @@
+/** Pre-Phase-K namespace; reserved for a future migration helper. */
+export declare const DEFAULT_PROFILE = "default";
 export declare function setActiveProfile(profile: string): void;
+/**
+ * Whether the profile has been chosen for this process.
+ *
+ * Borrowed from `daemon/src/config.ts`, which warns when a writer runs before
+ * `setActiveProfile()` and says why: such a caller "is a bug — they're writing
+ * to the legacy single-tenant root instead of the active profile's dir". The
+ * failure is silent and permanent, so it needs to be noisy once.
+ */
+export declare function isProfileResolved(): boolean;
 export declare function getActiveProfile(): string;
 /** @internal exposed for tests / diagnostics. */
 export declare function __currentServiceForTest(): string;
@@ -38,8 +49,40 @@ export declare function writeServerOrigin(origin: string): boolean;
 export declare function deleteServerOrigin(): void;
 export declare function deleteToken(): void;
 export declare function deleteRefreshToken(): void;
+/**
+ * Remove the credentials this product wrote under its previous brand.
+ *
+ * `logout` used to delete only the CURRENT service and report an unqualified
+ * "Signed out." On a machine carried through the rename that left the
+ * pre-rename CLI credential, the pre-rename daemon credentials, and BOTH KEKs
+ * in place — so the sealed envelope and the key that unwraps it were still
+ * sitting there after the product said you were signed out. `logout --help`
+ * offers `--all-devices` for "a stolen-laptop incident", which is the one
+ * situation where that is exactly wrong.
+ *
+ * Returns the services it actually removed something from, so the caller can
+ * say what happened instead of destroying credentials silently.
+ *
+ * NOTE this also signs out the retired `oversky` binary, if one is still
+ * installed. That is the intent — same account, same machine — and the cutover
+ * runbook already lists these items for removal.
+ */
+export declare function deleteLegacyBrandEntries(): string[];
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.
  */
 export declare function deleteAll(): void;
+/**
+ * Pull `--profile` out of raw argv.
+ *
+ * Deliberately minimal: it recognises `--profile x` and `--profile=x` and
+ * nothing else. This runs before any validation, so it must not throw, must not
+ * consume anything it does not own, and must not care about flag ordering —
+ * anything it gets wrong is corrected microseconds later when oclif parses the
+ * same argv properly and rejects a malformed invocation.
+ *
+ * Returns null rather than the default, so the caller can fall through to
+ * `OVERSKY_PROFILE` without a flag having to out-rank an env var it never saw.
+ */
+export declare function resolveProfileFromArgv(argv: readonly string[] | undefined): string | null;

package/dist/lib/keychain.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROFILE = void 0;
 exports.setActiveProfile = setActiveProfile;
+exports.isProfileResolved = isProfileResolved;
 exports.getActiveProfile = getActiveProfile;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
@@ -14,7 +16,9 @@ exports.writeServerOrigin = writeServerOrigin;
 exports.deleteServerOrigin = deleteServerOrigin;
 exports.deleteToken = deleteToken;
 exports.deleteRefreshToken = deleteRefreshToken;
+exports.deleteLegacyBrandEntries = deleteLegacyBrandEntries;
 exports.deleteAll = deleteAll;
+exports.resolveProfileFromArgv = resolveProfileFromArgv;
 /**
  * keychain.ts — macOS Keychain-backed token storage for the Sky CLI.
  *
@@ -44,10 +48,11 @@ exports.deleteAll = deleteAll;
  */
 const node_child_process_1 = require("node:child_process");
 const cred_envelope_1 = require("./cred-envelope");
+const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
 const SERVICE_BASE = 'ai.skrr.cli';
 /** Pre-Phase-K namespace; reserved for a future migration helper. */
-const DEFAULT_PROFILE = 'default';
+exports.DEFAULT_PROFILE = 'default';
 const ACCOUNT_TOKEN = 'cli-token';
 const ACCOUNT_EXPIRES = 'cli-token-expires';
 const ACCOUNT_REFRESH = 'cli-refresh';
@@ -58,14 +63,35 @@ const SECURITY_ITEM_NOT_FOUND = 44;
 /** Cached availability — probed once at first call. */
 let _availability = null;
 /**
- * Active profile for this process. Phase K will wire `setActiveProfile('work')`
- * onto a `--profile` flag; today everything resolves to `default`.
+ * Active profile for this process.
+ *
+ * Wired from `--profile` / `OVERSKY_PROFILE` in `BaseCommand.init()`, before
+ * anything reads a credential. The comment here used to say "Phase K will wire
+ * `setActiveProfile('work')` onto a `--profile` flag; today everything resolves
+ * to `default`" — and that stayed true long enough to cost something: with one
+ * slot, signing into a second deployment EVICTED the first, so a round trip
+ * meant two interactive logins and an agent could not make one at all
+ * (OSK-290).
  */
-let _activeProfile = DEFAULT_PROFILE;
+let _activeProfile = exports.DEFAULT_PROFILE;
+/** True once a caller has chosen, so a writer can tell "default" from "unset". */
+let _profileResolved = false;
 function setActiveProfile(profile) {
+    _profileResolved = true;
     if (profile && profile.length > 0)
         _activeProfile = profile;
 }
+/**
+ * Whether the profile has been chosen for this process.
+ *
+ * Borrowed from `daemon/src/config.ts`, which warns when a writer runs before
+ * `setActiveProfile()` and says why: such a caller "is a bug — they're writing
+ * to the legacy single-tenant root instead of the active profile's dir". The
+ * failure is silent and permanent, so it needs to be noisy once.
+ */
+function isProfileResolved() {
+    return _profileResolved;
+}
 function getActiveProfile() {
     return _activeProfile;
 }
@@ -307,6 +333,88 @@ function deleteRefreshToken() {
     deleteSlot(ACCOUNT_REFRESH);
     deleteSlot(ACCOUNT_REFRESH_EXPIRES);
 }
+/**
+ * Every Keychain service this product wrote under its PREVIOUS brand.
+ *
+ * Discovered rather than enumerated, because the daemon's services carry a
+ * per-profile hash (`ai.oversky.daemon.dev-f00ad7c1`) that cannot be
+ * reconstructed from a name. Metadata only — `dump-keychain` without `-d`
+ * prints service names and does not prompt for or reveal any secret.
+ *
+ * Filtered to `LEGACY_NATIVE_ID_PREFIXES` followed by a dot, so a third-party
+ * item that merely starts with the same letters is never in scope.
+ */
+function discoverLegacyBrandServices() {
+    let dump;
+    try {
+        dump = (0, node_child_process_1.execFileSync)('security', ['dump-keychain'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        return [];
+    }
+    const found = new Set();
+    for (const match of dump.matchAll(/"svce"<blob>="([^"]*)"/g)) {
+        const service = match[1];
+        if (auth_core_1.LEGACY_NATIVE_ID_PREFIXES.some((prefix) => service.startsWith(`${prefix}.`))) {
+            found.add(service);
+        }
+    }
+    return [...found].sort();
+}
+/**
+ * Delete every item under one service, without needing its account names.
+ *
+ * `delete-generic-password -s <svc>` removes ONE matching item, so a service
+ * holding a token, its expiry and a refresh pair needs several passes. Bounded,
+ * because a delete that never reports "not found" would otherwise spin.
+ */
+function deleteEntireService(service) {
+    let removedAny = false;
+    for (let i = 0; i < 32; i += 1) {
+        try {
+            (0, node_child_process_1.execFileSync)('security', ['delete-generic-password', '-s', service], {
+                stdio: ['ignore', 'ignore', 'ignore'],
+            });
+            removedAny = true;
+        }
+        catch (err) {
+            const status = err.status;
+            if (status === SECURITY_ITEM_NOT_FOUND)
+                return removedAny;
+            if (process.env.DEBUG) {
+                console.error(`[cli/keychain] legacy sweep failed for ${service} (status=${status ?? 'unknown'})`);
+            }
+            return removedAny;
+        }
+    }
+    return removedAny;
+}
+/**
+ * Remove the credentials this product wrote under its previous brand.
+ *
+ * `logout` used to delete only the CURRENT service and report an unqualified
+ * "Signed out." On a machine carried through the rename that left the
+ * pre-rename CLI credential, the pre-rename daemon credentials, and BOTH KEKs
+ * in place — so the sealed envelope and the key that unwraps it were still
+ * sitting there after the product said you were signed out. `logout --help`
+ * offers `--all-devices` for "a stolen-laptop incident", which is the one
+ * situation where that is exactly wrong.
+ *
+ * Returns the services it actually removed something from, so the caller can
+ * say what happened instead of destroying credentials silently.
+ *
+ * NOTE this also signs out the retired `oversky` binary, if one is still
+ * installed. That is the intent — same account, same machine — and the cutover
+ * runbook already lists these items for removal.
+ */
+function deleteLegacyBrandEntries() {
+    if (!isAvailable())
+        return [];
+    return discoverLegacyBrandServices().filter((service) => deleteEntireService(service));
+}
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.
@@ -316,3 +424,36 @@ function deleteAll() {
     deleteRefreshToken();
     deleteServerOrigin();
 }
+/**
+ * Pull `--profile` out of raw argv.
+ *
+ * Deliberately minimal: it recognises `--profile x` and `--profile=x` and
+ * nothing else. This runs before any validation, so it must not throw, must not
+ * consume anything it does not own, and must not care about flag ordering —
+ * anything it gets wrong is corrected microseconds later when oclif parses the
+ * same argv properly and rejects a malformed invocation.
+ *
+ * Returns null rather than the default, so the caller can fall through to
+ * `OVERSKY_PROFILE` without a flag having to out-rank an env var it never saw.
+ */
+function resolveProfileFromArgv(argv) {
+    // `undefined` is a real input, not a defensive flourish: a command
+    // constructed directly — as several suites do — has no argv yet when `init()`
+    // runs. The contract above says this must not throw, and it did.
+    if (!Array.isArray(argv))
+        return null;
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i];
+        if (token === '--')
+            break;
+        if (token === '--profile') {
+            const value = argv[i + 1];
+            return value && !value.startsWith('-') ? value : null;
+        }
+        if (token.startsWith('--profile=')) {
+            const value = token.slice('--profile='.length);
+            return value.length > 0 ? value : null;
+        }
+    }
+    return null;
+}

package/dist/lib/login.js

@@ -82,7 +82,7 @@ async function cliLogin(opts = {}) {
         });
         if (brokerResult.ok) {
             console.log('');
-            console.log('  Authorized via the local oversky daemon (no browser needed).');
+            console.log('  Authorized via the local skrr runtime (no browser needed).');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -105,7 +105,7 @@ async function cliLogin(opts = {}) {
         // broker failures — missing bootstrap, network blip, server 5xx —
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
-            throw new Error('The local oversky daemon is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
+            throw new Error('The local skrr runtime is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
                 'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
                 'or run `skrr login` on a machine where the daemon was authenticated interactively.');
         }
@@ -116,7 +116,7 @@ async function cliLogin(opts = {}) {
         // "I'm logging into a different server than the daemon".
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The local oversky daemon is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
+            console.log(`  The local skrr runtime is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
             console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
         }
     }