gcloud-authlisted

Re-auth is usually `gcloud auth login` — it opens Chrome automatically, the user approves, and the credentials are valid for ~1 day. **But that alone is NOT enough for anything that reads Application Default Credentials (ADC)** — most notably Pulumi's GCS state backend (`gs://sunsay-pulumi-state` and siblings like `gs://sunsay-app-pulumi-state`). ADC is a fully separate credential store from the regular user login; `gcloud auth login` does not populate it. Missing ADC does not fail with an obvious auth message — it surfaces as a confusing `invalid_grant` / `invalid_rapt` error from `pulumi` commands, which gives no hint that ADC is the missing piece. ## Process ### Step 1: Ping the user Invoke the `/notify-waiting` skill FIRST. Step 2 blocks waiting for browser approval, so the user must be at their machine before it starts. ### Step 2: Decide which login(s) are needed - Failing command was `gcloud`/`gsutil`/`bq`, and the error is a plain reauth/expired-token message with no `pulumi`/ADC signal → `gcloud auth login` only. - Failing command was `pulumi` (or anything else reading ADC), OR the error text contains `invalid_grant` / `invalid_rapt` / mentions Application Default Credentials → run **both** logins below. `gcloud auth login` alone will NOT fix this. - Unsure which applies? Run both — it's cheap and avoids a second round-trip. ### Step 3: Log in Run directly via a **subagent Bash call**, one at a time (each opens its own Chrome tab): ```bash gcloud auth l