agmsg-cloud 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/src/api.js

@@ -324,7 +324,26 @@ export class CourierClient {
     // machine resolves the name here and pulls by id, rather than handing a
     // name to the data plane.
     async resolveTeamByName(name) {
-        const out = await this.call('GET', `/v1/edge/teams?name=${encodeURIComponent(name)}`);
+        return this.teams(`/v1/edge/teams?name=${encodeURIComponent(name)}`);
+    }
+    /**
+     * Every team in the caller's organization.
+     *
+     * The same endpoint without the `name` filter, so it discloses nothing the
+     * lookup above does not: the control plane scopes both to the caller's org
+     * (`WHERE org_id = $1`), which is the property that lets the name lookup live
+     * here instead of on the data plane.
+     *
+     * It exists so a failed lookup can tell two situations apart. "No team by
+     * that name" is the same answer whether nothing has ever been connected to
+     * this organization or the operator is signed in to the wrong one, and those
+     * need opposite next steps.
+     */
+    async listTeams() {
+        return this.teams('/v1/edge/teams');
+    }
+    async teams(path) {
+        const out = await this.call('GET', path);
         // A response this cannot read is not an answer about which teams exist,
         // and it must not be turned into one. `teams` must be PRESENT and an
         // array, with an empty array the only way to say "none" — the same rule

package/dist/src/commands/connect.js

@@ -6,7 +6,10 @@ import { originOf, readCredential } from '../credentials.js';
 import { generateDeviceIdentity, publicKeyOf, remoteTeamId } from '../oss.js';
 import { deviceIdentityPath } from '../paths.js';
 import { NEEDS, ensurePreflight, formatPreflight, preflight } from '../preflight.js';
+import { adviseOnSlotForSilentFiling, renderSlotAdvice } from '../slot-advice.js';
+import { setupCommand } from '../recovery-key.js';
 import { shellArg } from '../shell-arg.js';
+import { fileTeamInVaultSilently } from '../vault-filing.js';
 function runInherit(command, args) {
     return new Promise((resolve, reject) => {
         // stdio inherited: `remote.sh connect` prints its own progress, and
@@ -120,9 +123,45 @@ export async function cmdConnect(config, opts) {
     // opening it — which needs the recovery key nobody has typed here. A
     // sentence about where the only copy is would be a guess whichever way it
     // went. The condition is named instead, and it is true in every case.
-    process.stdout.write(`\nBack these keys up: \`agmsg-cloud recovery setup ${shellArg(opts.team)}\`.\n` +
-        'Until a team is in your recovery vault, the only copies of its keys are on\n' +
-        'the machines that hold them; once it is there, the recovery key opens it again.\n' +
+    // Filed here rather than left to an instruction. The key was made moments
+    // ago by the step above, and until it is in the vault the only copies are on
+    // the machines holding them — a window that used to last until someone acted
+    // on a line that had already scrolled away (#181).
+    //
+    // Silently or not at all. `connect` does not ask for a recovery key: a
+    // command that stopped to collect one would be a ceremony, and the person
+    // running it did not come here for that. Both ways of being unable — no
+    // vault, no slot on this machine — fall back to naming the route, which is
+    // what this printed before.
+    //
+    // And the two are told apart, because "nothing happened, silently" is the
+    // outcome that leaves someone believing they are backed up.
+    const filing = await fileTeamInVaultSilently(config, new CourierClient(config), opts.team);
+    const teams = `${filing.filed ? filing.teamCount : 0} team${(filing.filed ? filing.teamCount : 0) === 1 ? '' : 's'}`;
+    const backup = filing.filed
+        ? filing.wrote
+            ? `Backed up: revision ${filing.revision}, ${teams} in this account's vault.\n` +
+                'Losing this machine no longer loses this team — the recovery key opens it again.'
+            : // Already there, with the same keys. Said as its own sentence rather
+                // than as a write, because claiming a revision this run did not produce
+                // is the same kind of false as claiming a backup that never happened —
+                // and a re-run of `connect` reaches here every time.
+                `Already backed up: this team's keys were already in the vault at revision ${filing.revision},\n` +
+                    `unchanged, so nothing new was stored. ${teams} in this account's vault.`
+        : filing.reason === 'no-vault'
+            ? // NAMED, for the same reason as the four below: creating the vault and
+                // backing up THIS team is what the sentence above promises, and the
+                // broad form can refuse over a team that has nothing to do with it.
+                `Not backed up: this account has no recovery vault yet.\n` +
+                    `Run \`${setupCommand(opts.team)}\` to make one — it shows a recovery key\n` +
+                    "once. Until then the only copies of this team's keys are on the machines\n" +
+                    'that hold them.'
+            : // Four ways of having no slot, four routes, and only one of them is
+                // "type the key once and this stops happening". Asked rather than
+                // written here, so a machine with no secure store is not sent after a
+                // fix that does not exist for it.
+                renderSlotAdvice(adviseOnSlotForSilentFiling(filing.slot, { team: opts.team })).trimEnd();
+    process.stdout.write(`${backup}\n` +
         `\nTo add a second machine, run \`agmsg-cloud sync ${shellArg(opts.team)}\` there and answer here.\n` +
         // The subject is the operator, and it has to be. Something IS carried
         // between the machines after the yes — the sealed bundle, which is what
@@ -132,11 +171,33 @@ export async function cmdConnect(config, opts) {
         'You do not carry any value between the machines yourself: both screens show\n' +
         'eight digits and you check they are the same.\n');
     if (code !== 0) {
-        // Now that it is true, the operator can be told the failure needs nothing
-        // further — but only about the case where that is so. The error itself is
-        // still theirs to read; this does not summarise it.
-        process.stdout.write('Read the error above: if it was a uniqueness conflict, the team was already connected\n' +
-            'and there is nothing else to do.\n');
+        // THE CASE THIS USED TO NAME NO LONGER REACHES HERE.
+        //
+        // It said: "if it was a uniqueness conflict, the team was already connected
+        // and there is nothing else to do". That conflict was the OSS step refusing
+        // a second connect — `a team_id registers once ... not a transient error to
+        // retry` — and it is gone. Searched at the pin this repo carries
+        // (`92ddbe5`): no match in `scripts/`. It was removed by `8c2bd4b`, "a
+        // connect that already registered resumes instead of dead-ending", which is
+        // an ancestor of that pin. The script now adopts the registration and
+        // carries on, so a duplicate does not end non-zero at all.
+        //
+        // Leaving the sentence would have been worse than saying nothing: it asks
+        // the reader to look for a message that cannot appear, and the one it
+        // describes was the reassuring case, so a real failure would be read as the
+        // harmless one.
+        //
+        // Said as a property of this command rather than as a diagnosis of an error
+        // this side has not read — and only the part that was checked. Re-running
+        // adds nothing: the OSS step adopts a registration that is already there,
+        // and `bootstrapDevice` returns the existing device when the key matches
+        // (`devices.ts:309`). It is NOT "it will work": this same machine can be
+        // refused for reasons a second run cannot change, and the key having
+        // changed is refused rather than registered twice — which is why the
+        // sentence stops at "adds nothing".
+        process.stdout.write('Read the error above. Running connect again adds nothing that is already\n' +
+            'there: a registered team is adopted rather than refused, and this machine\n' +
+            'is registered once. It is worth doing if the error looks transient.\n');
     }
 }
 async function registerThisMachine(config, opts, machineName) {
@@ -192,7 +253,12 @@ async function registerThisMachine(config, opts, machineName) {
         // that is not the claimant never becomes one. Connect from here returns to
         // this same 403 forever.
         if (err instanceof CourierError && err.status === 403) {
-            throw new Error(await forbiddenAdvice(client, opts.team, pubkey));
+            // The id goes in, so the message can PRINT it. The release is asked for
+            // by team id, and the console shows teams by slug (`Connections.tsx:154`)
+            // — telling someone to go and find it is the placeholder problem this
+            // file already refuses elsewhere. It is in hand here; it is the value
+            // `bootstrapDevice` was just called with.
+            throw new Error(await forbiddenAdvice(client, opts.team, teamId, pubkey));
         }
         throw err;
     }
@@ -205,19 +271,30 @@ async function registerThisMachine(config, opts, machineName) {
  * account have a machine that could approve? Enrollment needs an approver, and
  * an approver is a registered device.
  *
- * The case with no approver is a real one and it has no way out today. That is
- * written plainly instead of offering a command that will wait forever, because
- * a person who is told there is no recovery stops spending time looking for one.
+ * The case with no approver has no way out THIS MACHINE CAN TAKE, which is not
+ * the same as no way out — and the message used to say the second one.
+ *
+ * There is a route: releasing the team's claim (`app/scripts/release-claim.ts`)
+ * frees the id, and a later connect claims it again. It is run by whoever
+ * operates the service, not by the person holding this terminal, and that is
+ * the decision rather than an omission — releases are rare enough to be worth a
+ * human checkpoint each time, and a self-service release would need an
+ * owner-authenticated mutation surface that does not exist. Both are recorded
+ * on #71, with the condition that would reopen the question.
+ *
+ * So the sentence to print is what to ASK FOR, not a command to run. A person
+ * told there is no recovery stops looking for one — which is right when there
+ * is none and expensive when there is, and #143 is the case where there was.
  *
- * WHY NOT BUILD A WAY BACK. Reassigning a team's claim to a live capability
- * would fix it, and it is a change nobody should make inside a bug fix: it
- * decides who may take over a team whose first machine is gone, and the obvious
- * answer — any live capability in the org — turns a revoked machine into "any
- * machine may become device-0 for that team", which is part of what revoking
- * was for. Named here so the next person who finds this message unhelpful
- * reaches the same question rather than the same guess.
+ * WHY NOT BUILD A WAY BACK HERE. Reassigning a team's claim to a live
+ * capability would also fix it, and it is a change nobody should make inside a
+ * bug fix: it decides who may take over a team whose first machine is gone, and
+ * the obvious answer — any live capability in the org — turns a revoked machine
+ * into "any machine may become device-0 for that team", which is part of what
+ * revoking was for. Named here so the next person who finds this message
+ * unhelpful reaches the same question rather than the same guess.
  */
-async function forbiddenAdvice(client, team, ownPubkey) {
+async function forbiddenAdvice(client, team, teamId, ownPubkey) {
     const head = `the server would not register this machine for '${team}'.\n\n` +
         'It is not the machine that first connected this team, and only that one can register\n' +
         'without an approver. That is recorded once and never moves, so running connect again\n' +
@@ -253,10 +330,19 @@ async function forbiddenAdvice(client, team, ownPubkey) {
     if (approvers === 0) {
         return (head +
             'There is also no OTHER machine on this account that could approve a request — and a\n' +
-            'machine cannot approve its own — so joining is not open either. THERE IS NO WAY TO\n' +
-            'RECOVER THIS TEAM FROM THIS ACCOUNT TODAY: the machine that claimed it can no longer\n' +
-            'register, and enrollment needs an approver that does not exist. Reported rather than\n' +
-            'dressed up as a command, so you do not spend the evening on one that cannot work.');
+            'machine cannot approve its own — so joining is not open either. NOTHING YOU CAN RUN\n' +
+            'FROM HERE RECOVERS THIS TEAM: the machine that claimed it can no longer register, and\n' +
+            'enrollment needs an approver that does not exist.\n\n' +
+            'What does recover it is releasing the team, which frees the id so a connect can claim\n' +
+            'it again. That is run by whoever operates this service, not from this terminal. Ask\n' +
+            'them to release this team, and say why:\n\n' +
+            `    team ${team}\n` +
+            `    id   ${teamId}\n\n` +
+            'Releasing DELETES EVERYTHING THIS SERVICE HOLDS FOR THE TEAM — its messages, its\n' +
+            'member list and their agent registrations, and its policy and identity history. That\n' +
+            'is the point of it: the id is freed for a fresh start, not handed over with its past.\n' +
+            'Your machines stay signed in and nothing on them is touched; it is this team on the\n' +
+            'service that goes. If any of it matters, say so before asking.');
     }
     return (head +
         'Join it from here instead — this account has another machine that can approve the\n' +

package/dist/src/commands/fetch.js

@@ -222,7 +222,25 @@ env = process.env) {
         // The choice is made from the VERIFIED matching set, never from the raw
         // queue: picking an unverified blob by position would not be identification.
         const { blob, file } = matches[0];
-        await unlockBundle(config.scriptsDir, args.team, file, expected);
+        const unlockSaid = await unlockBundle(config.scriptsDir, args.team, file, expected);
+        // Relayed HERE, before the ack, because it is already true here.
+        //
+        // The script has finished: the team is unlocked on this machine and its
+        // sync engine is running under a pid the script verified. Printing it after
+        // `ackBlob` meant a failed ack threw that away — the local half had
+        // succeeded, the operator was shown only the error, and the machine they
+        // were about to debug was already working. That is this issue's own defect
+        // one step later (raised in review).
+        //
+        // NOT verbatim, and the difference is worth naming rather than glossing:
+        // `trimEnd()` drops trailing whitespace and a single '\n' is re-appended.
+        // The body is untouched; only the tail is normalised. A script that says
+        // nothing prints nothing, because a blank line would read as an empty
+        // answer (raised in review — the comment said "verbatim", which is wider
+        // than what this does).
+        const said = (unlockSaid ?? '').trimEnd();
+        if (said !== '')
+            process.stdout.write(said + '\n');
         await client.ackBlob(blob.id);
         // Consumed only now, and the order is load-bearing.
         //
@@ -238,7 +256,23 @@ env = process.env) {
         clearAuthenticatedDigest(originOf(config.baseUrl), consumed.requestId, config.secret, devicePubkey, env);
         const others = blobs.length - 1;
         const duplicates = matches.length - 1;
-        process.stdout.write(`unlocked and acked the confirmed bundle` +
+        // What `remote.sh unlock` said — its body, with the trailing newline
+        // normalised to exactly one — and then what THIS command did.
+        //
+        // The script's line is the stronger one and it was being thrown away: it
+        // waits for the sync engine to report ready, checks the pidfile it recorded
+        // matches the process it started, checks that process is alive, and exits
+        // non-zero otherwise — so `engine running (pid N)` is a claim about a live
+        // pid, and it names the team.
+        //
+        // In its place this printed `unlocked and acked the confirmed bundle`,
+        // which names no object at all. Four lines later the operator was told to
+        // "unlock" — a DIFFERENT object, the team's history — with the same verb.
+        // Two objects, one word, and nothing on screen to tell them apart (#147).
+        //
+        // The ack is reported separately because it is this command's own act
+        // against the server, not something the script did.
+        process.stdout.write(`acked the confirmed bundle` +
             (others > 0 ? `; ${others} other bundle(s) left queued` : '') +
             (duplicates > 0 ? ` (${duplicates} of them carry the same digest)` : '') +
             '\n');

package/dist/src/commands/login.js

@@ -1,3 +1,4 @@
+import { SECRET_RE } from '../machine-id.js';
 import { DEFAULT_ENDPOINT, armEnterToOpen, verificationUrlIsSafe, } from '../browser.js';
 import { isOrgAddress, originOf, readCredential, writeCredential } from '../credentials.js';
 import { settleMachineName, validateMachineName } from '../machine-name.js';
@@ -13,7 +14,11 @@ import { settleMachineName, validateMachineName } from '../machine-name.js';
 // out of the capability URL's last path segment, so a response that does not
 // carry the expected shape is refused rather than stored: a wrong value here
 // would be sent as this machine's Bearer credential on every later command.
-const SECRET_RE = /^agsy_[a-f0-9]{8}_[A-Za-z0-9_-]{43}$/;
+//
+// Imported, not restated. `machine-id.ts` reads the prefix out of the same
+// shape, and a second copy here would let the two drift: changing the mint in
+// one place would leave the other answering about a format that no longer
+// exists (raised in review).
 // The binary is `agmsg-cloud`, and the approval screen shows the name the
 // SERVER holds for this client id — so the id the CLI sends is what decides
 // whether the person sees "agmsg CLI" (a different program, which never does

package/dist/src/commands/pull.js

@@ -58,6 +58,57 @@ export async function cmdPull(config, opts) {
             'it asks a machine that already has the team, and the two of you compare eight digits.\n');
     }
 }
+/**
+ * The advice that follows "no team named X", chosen from what this
+ * organization actually holds.
+ *
+ * The observation and the advice are separated, because only the observation
+ * differs. **No answer this command can get establishes whether the team was
+ * connected anywhere** — the lookup is scoped to the caller's organization, so
+ * it cannot see the rest of the world at all:
+ *
+ *  - A populated organization does not mean the team was connected elsewhere.
+ *    An org holding `billing` and not `ops` is equally consistent with `ops`
+ *    never having been connected.
+ *  - An empty organization does not mean it was not. The case in #224 had it
+ *    connected into a different org, and that leaves this one empty.
+ *  - A list that could not be fetched says nothing in either direction.
+ *
+ * So the advice is one block, the same in all three, and names both
+ * possibilities as conditions. The original defect was a remedy stated as an
+ * instruction — "connect it from the machine that runs it" — which asserted the
+ * connect had not happened. Stating it unconditionally in ANY branch brings the
+ * defect back, which is why the regression pins the conditional form rather
+ * than the presence of new words.
+ *
+ * The list is printed in full. A "…and N more" would make the interesting case
+ * — the team IS here under a spelling the operator did not expect — the one
+ * most likely to be cut off, and an operator who cannot see it reads the
+ * message as saying it is not there. That is a deliberate trade against very
+ * large organizations, not an oversight.
+ */
+const WHERE_TO_LOOK = 'Where the team stands outside this organization is not visible from here.\n' +
+    'Check which account and organization this machine is signed in to, then:\n' +
+    '  - if another machine already connected it, sign in to the organization it\n' +
+    '    was connected into, or pass --team-id if you know the id;\n' +
+    '  - if it has not been connected anywhere yet, connect it from the machine\n' +
+    '    that runs it.';
+async function whyNot(client, team) {
+    let teams;
+    try {
+        teams = await client.listTeams();
+    }
+    catch {
+        return `This machine could not list the organization's teams, so what it holds is unknown.\n\n${WHERE_TO_LOOK}`;
+    }
+    if (teams.length === 0) {
+        return `This organization holds no teams, so nothing has been connected into it.\n\n${WHERE_TO_LOOK}`;
+    }
+    const named = teams.map((t) => `  ${t.teamName ?? '(unnamed)'}  ${t.teamId}`).join('\n');
+    return (`This organization holds ${teams.length === 1 ? '1 team' : `${teams.length} teams`}, and none of them is "${team}":\n\n` +
+        `${named}\n\n` +
+        `Check the spelling against that list.\n\n${WHERE_TO_LOOK}`);
+}
 async function resolveTeamId(config, opts) {
     const client = opts.client ?? new CourierClient(config);
     const matches = await client.resolveTeamByName(opts.team);
@@ -65,8 +116,15 @@ async function resolveTeamId(config, opts) {
         // Named as what it is: this org has no such team. The alternative reading
         // — that the team exists under someone else — is not ours to confirm or
         // deny, and the answer is the same either way.
-        throw new Error(`no team named "${opts.team}" in this organization.\n\n` +
-            'Connect it from the machine that runs it first, or pass --team-id if you have it.');
+        //
+        // What is ours to say is whether this organization holds ANY team, and the
+        // two cases need opposite moves. An empty organization means the connect
+        // has not happened; a populated one means it happened somewhere else, and
+        // "connect it from the machine that runs it" then points at work that is
+        // already done — which is what #224 reported. Asking the org for its own
+        // list adds no disclosure: it is the same org-scoped endpoint, without the
+        // filter.
+        throw new Error(`no team named "${opts.team}" in this organization.\n\n${await whyNot(client, opts.team)}`);
     }
     if (matches.length > 1) {
         // A name is not unique by construction, so this stops rather than picking.

package/dist/src/commands/request.js

@@ -9,22 +9,6 @@ import { originOf } from '../credentials.js';
 import { deviceIdentityPath } from '../paths.js';
 import { closeAttempt, consumeAttempt, readBudget, renderBudgetExhausted, renderBudgetWarning, requesterLedgerScope, } from '../ledger.js';
 import { attachRequestId, clearRecord, listResumableRequesterRecords, reserveRequesterNonce, } from '../pending.js';
-// (c, part 1) B asks to be added.
-//
-// The order below is the protocol, not a style choice:
-//
-//   1. commit to (device key, nonce) and PERSIST the nonce
-//   2. post only the commitment digest
-//   3. wait for the approver's commitment to be fixed
-//   4. only then reveal the key and the nonce
-//   5. wait for the approver to open, and derive the code locally
-//
-// Steps 3 and 4 are what stop the other side choosing its contribution after
-// learning ours. Doing 4 before 3 would leave a request whose code the server
-// could steer, and the human comparison would confirm nothing.
-//
-// The private key never leaves this machine; only the public recipient is sent,
-// and not until step 4.
 export async function cmdRequest(config, args, deps = {}) {
     const out = deps.out ?? ((text) => void process.stdout.write(text));
     const writeErr = deps.err ?? ((text) => void process.stderr.write(text));
@@ -47,11 +31,39 @@ export async function cmdRequest(config, args, deps = {}) {
     // paid for would charge the same guess twice and let a crash loop exhaust the
     // budget without a single comparison.
     const scope = requesterLedgerScope(config.baseUrl, pubkey);
-    // A record without an id may still have landed: the row can exist on the
-    // server while the response was lost. Ask, using the only handle available —
-    // the commitment. Dropping these was what left the ledger's open attempt
-    // blocking every retry with nothing able to clear it.
-    if (record && !requestId) {
+    // ASKED FOR EVERY STORED RECORD, INCLUDING ONE THAT ALREADY HAS AN ID.
+    //
+    // Two different questions, one answer:
+    //
+    //   no id    did it land at all? The row can exist while the response was
+    //            lost, and the commitment is the only handle left.
+    //   with id  is it still live? Nothing about the id says so.
+    //
+    // This used to run only for the first. A record with an id was trusted
+    // however old it was, and the first thing the run did with it was
+    // `waitForStatus`, which polls for PROGRESS — so a long-dead enrollment was
+    // resumed, waited on, and then reported expired. That is the walkthrough
+    // sequence in #143: `resuming enrollment <id>` followed by `<id> is expired`.
+    //
+    // One list answers both, because `GET /v1/enrollments` is scoped to
+    // `status = ANY(NONTERMINAL) AND expires_at > now()`
+    // (`app/src/handoff/enrollment.ts:306`) — an expired row is absent from it
+    // even while its status still reads non-terminal. So "not in the list" already
+    // means "cannot be resumed", and the branch below already does the right
+    // thing with that: it closes the attempt, drops the record, and falls through
+    // to starting a fresh ceremony in this same run.
+    //
+    // AND THE LIST IS THE ONLY PLACE THAT ANSWERS IT. Reading the id instead would
+    // not do: `expireStale` rolls a stale row over on touch, and its callers are
+    // the create and claim paths, so a read returns the status the ceremony left
+    // behind and says nothing about the deadline. (That the walkthrough saw `<id>
+    // is expired` at all means something else had already touched it.) Pinned on
+    // the server side in `app/test/handoff-enrollment.test.ts`, because a change
+    // there would otherwise leave every test here green.
+    //
+    // The cost is one extra request per resume. What it buys is that the run
+    // either resumes something that can still finish, or starts one that can.
+    if (record) {
         // The list must SUCCEED before its emptiness means anything.
         //
         // Swallowing the error and treating it as "no live requests" turned a
@@ -64,12 +76,20 @@ export async function cmdRequest(config, args, deps = {}) {
             mine = await client.listEnrollments();
         }
         catch (err) {
-            writeErr('cannot tell whether the earlier request reached the server: ' +
+            // The two cases have different unknowns and the sentence says which one
+            // it is. With no id, whether the request ever landed is open; with an id
+            // it landed and what is open is whether it can still finish. Saying "did
+            // it reach the server" to someone holding an id describes a doubt they do
+            // not have, and the remedy is the same either way — which is what makes
+            // the wrong half safe to notice and cheap to fix.
+            writeErr((requestId
+                ? `cannot tell whether enrollment ${requestId} is still live: `
+                : 'cannot tell whether the earlier request reached the server: ') +
                 `${err instanceof Error ? err.message : String(err)}\n` +
                 '  Nothing has been changed — the attempt and its nonce are kept so a\n' +
                 '  later run can finish it. Try again when the server is reachable.\n');
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         const match = mine.filter((e) => e.commitment === record.commitmentHex);
         if (match.length === 1) {
@@ -90,7 +110,7 @@ export async function cmdRequest(config, args, deps = {}) {
             writeErr('the server reports more than one live request for this commitment; ' +
                 'refusing to guess which one is yours\n');
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
     }
     if (!record || !requestId) {
@@ -116,13 +136,13 @@ export async function cmdRequest(config, args, deps = {}) {
         if (before.remaining === 0) {
             writeErr(renderBudgetExhausted(before));
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         const blocked = await keyAlreadySpokenFor(client, pubkey);
         if (blocked) {
             writeErr(blocked);
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         const { commitmentHex: plannedCommitment, openingNonce: plannedNonce } = createSasCommitment(pubkey);
         const charged = consumeAttempt(scope, plannedCommitment, env);
@@ -135,7 +155,7 @@ export async function cmdRequest(config, args, deps = {}) {
                     '  command again to resume it rather than starting a second one.\n\n');
             }
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         out(renderBudgetWarning(charged.budget));
         // Persisted BEFORE the digest is posted. A crash after the post but before
@@ -220,6 +240,7 @@ export async function cmdRequest(config, args, deps = {}) {
         // the production walkthrough).
         out(`  Added.${nextStepsAreOurs ? ' Fetch the bundle with `agmsg-cloud fetch <team>`.' : ''} (${settled.status})\n`);
         done();
+        return 'enrolled';
     }
     catch (err) {
         if (err instanceof CeremonyError) {
@@ -227,19 +248,31 @@ export async function cmdRequest(config, args, deps = {}) {
             // A timeout leaves it, so the next run resumes instead of spending another
             // attempt on a request that is still live.
             if (err.reason === 'timed_out') {
-                // The ceremony may still be live; the next run resumes the same one and
-                // is not charged again.
+                // "May still be live" was printed as though it were "is still live".
+                //
+                // The wait has a five-minute deadline and an enrollment's window can
+                // close inside it — and expiry alone does not move the status, so the
+                // poll ends as "did not reach … in time" for a row that is expired and
+                // untouched. Both halves of the old sentence were then false: the next
+                // run does not resume it, and the new ceremony it starts does cost an
+                // attempt. Someone following the remedy spent one having been told it
+                // was free (#258).
+                //
+                // Asked of the same list the resume path asks, which is scoped to
+                // `status = ANY(NONTERMINAL) AND expires_at > now()` — so presence
+                // there IS resumability, and there is no second definition to keep in
+                // step.
                 writeErr(`enrollment did not complete: ${err.message}\n`);
-                writeErr('  Run the same command again to resume it; this costs no further attempt.\n');
+                writeErr(await resumeAdvice(client, record.commitmentHex));
                 process.exitCode = 1;
-                return;
+                return 'not_enrolled';
             }
             done();
             closeAttempt(scope, record.commitmentHex, 'failed', err.reason, env);
             writeErr(renderBudgetWarning(readBudget(scope, env)));
             writeErr(`enrollment did not complete: ${err.message}\n`);
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         // The two ways this machine's key cannot become a device on this account.
         //
@@ -257,7 +290,7 @@ export async function cmdRequest(config, args, deps = {}) {
             writeErr(renderBudgetWarning(readBudget(scope, env)));
             writeErr(await renderKeyRefusal(err.code, client, pubkey));
             process.exitCode = 1;
-            return;
+            return 'not_enrolled';
         }
         throw err;
     }
@@ -287,6 +320,37 @@ const NOTHING_COMPARED = '  No digits were shown and no bundle was sent.\n';
  * about ownership, and reading silence as "none of these are yours" would
  * refuse every ordinary rejoin.
  */
+/**
+ * What to tell someone whose wait ran out — after asking whether the thing they
+ * would be resuming still exists.
+ *
+ * Three answers, because there are three states and only one of them is the one
+ * the message used to assume. Saying nothing about the cost is not an option
+ * either: the whole defect was a person spending an attempt they had been told
+ * was free, and a sentence that simply omits the price leaves them guessing at
+ * the same moment.
+ */
+export async function resumeAdvice(client, commitmentHex) {
+    let live;
+    try {
+        live = await client.listEnrollments();
+    }
+    catch (err) {
+        // Unknown, said as unknown. Guessing "still live" is the bug being fixed;
+        // guessing "gone" would tell someone their attempt is spent when it may
+        // not be.
+        return (`  Could not check whether it is still live: ${err instanceof Error ? err.message : String(err)}\n` +
+            '  Nothing has been changed. Run the command again when the server is reachable:\n' +
+            '  if the enrollment is still live it resumes at no further cost, and if it is\n' +
+            '  not, that run starts a new ceremony and costs another attempt.\n');
+    }
+    if (live.some((e) => e.commitment === commitmentHex)) {
+        return '  Run the same command again to resume it; this costs no further attempt.\n';
+    }
+    return ('  This attempt is over: the enrollment is no longer live on the server, so it\n' +
+        '  cannot be resumed. Running the command again starts a NEW ceremony, which\n' +
+        '  costs another attempt.\n');
+}
 async function keyAlreadySpokenFor(client, pubkey) {
     let devices;
     try {

package/dist/src/commands/sync.js

@@ -101,7 +101,27 @@ export async function cmdSync(config, opts) {
     // one that knows there is nothing to do: fetch and pull follow immediately
     // below. The decision is made HERE, once, rather than inferred inside each
     // step (raised in review).
-    await request(config, { label }, { nextStepsFromCaller: true });
+    const enrolled = await request(config, { label }, { nextStepsFromCaller: true });
+    // NOTHING BELOW CAN SUCCEED WITHOUT IT, so a failed ceremony ends the run
+    // here.
+    //
+    // It used to continue. `cmdRequest` reports failure by setting
+    // `process.exitCode` and returning normally — it does not throw — and this
+    // line ignored the return value, so `pull` ran next and resolved the team by
+    // name against an account this machine had not joined. What the operator was
+    // left holding was `no team named "<team>" in this organization`: true, and
+    // not the reason anything failed. The enrollment message had scrolled past
+    // two steps earlier.
+    //
+    // Nothing is printed here. `request` has already said what happened and what
+    // to do about it, in the words that fit the case it hit; a summary from this
+    // side would either repeat it or, worse, generalise over cases it cannot
+    // tell apart.
+    //
+    // Compared against the success value rather than the failure one, so a
+    // future outcome that is neither stops the run as well.
+    if (enrolled !== 'enrolled')
+        return;
     // PULL BEFORE FETCH, and the old order was the wrong way round.
     //
     // The comment that used to sit below said the messages "needed the key that