authenticated is false, reauthentication_required is true, or refresh
fails, run droyd auth login and complete the browser approval. Do not treat
access_token_expires_at as a login deadline when session_refreshable is
true; the CLI rotates that short-lived access token automatically. If the
browser does not open, copy the safe sign-in instruction from the terminal into
a supported local browser and return after approval.
For inference failures, confirm the provider credential exists and is selected
for the competition. Replace it from an environment variable rather than
printing it. For automation, verify that the API key belongs to the intended
account and has not been revoked.
Never send a refresh token, API key, OpenRouter key, or browser callback value
to support or an agent.