aac-cli 0.2.8__tar.gz → 0.2.10__tar.gz

{aac_cli-0.2.8/aac_cli.egg-info → aac_cli-0.2.10}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.8
+Version: 0.2.10
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
-Project-URL: Documentation, https://cascadeauth.github.io/aac-starter-guide/cli/
+Project-URL: Documentation, https://docs.cascadeauth.com/cli/
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -34,12 +34,13 @@ which tenant they belong to and what they were authorised to do. A
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
-New to AAC? [What AAC is for](https://cascadeauth.github.io/aac-starter-guide/#what-aac-is-for)
+New to AAC? [What AAC is for](https://docs.cascadeauth.com/overview/#what-aac-is-for)
 explains what delegated authority between agents buys you, and what it does not.
 
-The [CLI user guide and complete command reference](https://cascadeauth.github.io/aac-starter-guide/cli/)
+The [CLI user guide and complete command reference](https://docs.cascadeauth.com/cli/)
 cover developer and enterprise onboarding, everyday administration and recovery.
-Select documentation matching `aac --version`.
+These pages describe the latest supported release. Upgrade the CLI to use the
+documented commands, and check your installation with `aac --version`.
 
 The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
@@ -77,7 +78,7 @@ Python 3.11 to 3.14 is supported. Release checks test all four versions.
 ## Use `aeg` to view agent execution graphs
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
-Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
+Use the [AEG guide and command reference](https://docs.cascadeauth.com/aeg/)
 for listing local and central observations, rendering evidence, and selecting a profile.
 
 `aeg list --profile PROFILE --since 7d` discovers participant-visible central
@@ -111,7 +112,7 @@ Google developer sign-in. See “Setting up aac-cli on a new computer” below
 for the existing-tenant sign-in and material preparation steps.
 
 Setup uses the tenant's assigned trust domain and writes the files the
-trust-anchor publisher and Docker Compose need, as well as the sidecar
+trust anchor publisher and Docker Compose need, as well as the sidecar
 configuration. By default it generates development keys and certificates;
 the certificate choices below explain how to supply your own instead.
 
@@ -341,7 +342,7 @@ and destination maps allow at most 128 entries each.
 | `destinations.<name>.audience_pattern` | Required exact registered SPIFFE identity; no wildcard. | None |
 | `destinations.<name>.predicates`, `.valid_for` | Same value/duration contract as classes. | Empty predicates; duration required |
 | `destinations.<name>.timeout_ms` | Integer 1–2147483647 without A2A; 1–60000 for every destination when A2A is enabled, matching its generated deadline. | `10000` |
-| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths and a 60-second deadline are generated. No A2A self-route is added. | A2A disabled |
+| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths, a 60-second deadline and retry-state capacity are generated; the capacity holds the acknowledgement of the largest reply, which carries the peer's reply to your agent. No A2A self-route is added. | A2A disabled |
 
 URL hosts are ASCII DNS names or IP addresses; URL fields reject whitespace,
 backslashes, embedded credentials and fragments. Basic replay history
@@ -438,7 +439,7 @@ The laptop case. The CLI creates a certificate authority on this machine and sig
 
 **Renewal.** `aac agent renew --agent <name>` issues fresh certificates from the same CA.
 
-#### I bring my own CA
+#### I bring my own CA certificate
 
 Your own issuer has signed the agent's certificates, and your CA private key never reaches this machine. Certificate source alone does not qualify a production deployment.
 
@@ -507,7 +508,7 @@ name and `<tenant-id>` the tenant id AAC allocated.
 For what each of these proves, who else ever gets a copy, what never leaves you
 and how the pieces fit together — including when your own certificate authority
 signs instead of this tool — see
-[Keys and certificates](https://cascadeauth.github.io/aac-starter-guide/keys-and-certificates.html).
+[Keys and certificates](https://docs.cascadeauth.com/overview/keys-and-certificates/).
 
 <!-- inventory-table:start -->
 | No. | Material | Where | Used for | Lifetime | Back up? |
@@ -740,6 +741,7 @@ aac profile show stage --output table             # stored and effective values,
 aac profile create prod --admin-url https://aac-admin.example.com \
   --data-plane-url https://aac-data.example.com
 aac profile update main                           # edit the built-in baseline
+aac profile update stage --unbind                 # clear the local tenant association
 aac profile delete prod                           # local only; never touches the server
 ```
 
@@ -756,6 +758,41 @@ stored value.
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
 It is your organisation's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
+A binding makes that tenant the profile's stored default; it does not grant
+membership or configure an identity provider. Successful sign-in to an existing
+tenant binds the profile; registration binds a newly created tenant.
+
+A stale tenant binding affects only that profile. `aac profile list` and
+`aac profile show` mark invalid bindings without printing the invalid values;
+other profiles remain usable. Operational commands reject a selected invalid
+profile with exit 3, even if a tenant flag or environment override is supplied.
+File syntax, profile-name and size limits still apply to the entire file.
+
+Use `aac profile update NAME --unbind` to remove the local `tenant_id` and its
+saved hosted-domain metadata. Endpoints, other settings, credentials and the
+server-side tenant are preserved. The flag works without prompts, may accompany
+endpoint flags, and also works on `main` or an already-unbound profile. It
+refuses profiles with unresolved registration or API-key rotation state;
+finish that recovery first. Then bind the profile through registration or
+successful sign-in. Endpoint-only updates and confirmed profile deletion also
+work on stale profiles; reads never rewrite the config file.
+
+For an existing tenant, the repair sequence is:
+
+```bash
+aac profile update stage --unbind
+# Bind profile stage to the correct existing tenant:
+aac sso login --profile stage --tenant-id '<TENANT_ID>'
+```
+
+**`aac sso login --profile stage --tenant-id '<TENANT_ID>'` binds profile
+`stage` to that tenant.** Although the verb is `login`, successful authentication
+also saves the tenant association; there is no separate `--bind` flag. Replace
+`<TENANT_ID>` with the intended tenant's canonical ID. An endpoint correction
+or expired session normally does not need
+unbinding. Unbinding is local and does not log out, revoke access, or change
+existing agent records. See the [profile repair guide](https://docs.cascadeauth.com/cli/guide/#repair-a-stale-profile-binding)
+for the exact config fields removed and recovery constraints.
 
 `AAC_CLI_HOME` relocates the whole `~/.aac` tree. Use it for a throwaway
 test home, or to keep separate accounts hard-walled from each other:
@@ -773,13 +810,39 @@ Two credential files can coexist under `~/.aac/credentials/`:
   (`aac chain`, `aac trust-anchor`) present it. Only a hash of it exists
   on the server, so a lost key is replaced, never recovered.
 * `<tenant-id>.session` holds the short-lived session that `aac sso login`
-  creates. The administration commands (`aac tenant`, `aac sso`) use it
-  automatically. Sessions cannot be refreshed: when one expires, any
-  administration command tells you to sign in again, and there is no
-  refresh token that could be stolen.
+  creates. Authenticated administration commands use it automatically;
+  public reads such as `aac sso describe` do not use credentials.
+  Sessions have no refresh token. You can sign in again before expiry to
+  replace the cached session; after expiry, commands that need it ask you
+  to sign in again.
 
 ## Signing in
 
+Inspect the available sign-in connections before starting a login:
+
+```bash
+aac sso describe --profile stage                        # shared/platform candidates
+aac sso describe --profile stage --tenant-id '<TENANT_ID>' # tenant plus shared candidates
+```
+
+`sso describe` reads public metadata from the profile's admin endpoint and
+prints the complete descriptor as JSON on stdout. No credentials or prior
+sign-in are required, and it does not bind a profile or change cached credentials.
+The output includes `connections`, `count`, and, for the tenant route,
+`tenant_id`; connection fields describe issuers, client IDs and available flow
+endpoints. An empty connection list is a successful read.
+
+Only an explicit `--tenant-id` selects the tenant descriptor. Omitting it
+always reads shared/platform candidates, even when the profile or the
+`AAC_TENANT_ID` environment variable supplies a tenant. Replace `<TENANT_ID>`
+with the intended tenant's canonical ID. The CLI still checks your local
+configuration and selected profile. If it reports an invalid stored tenant
+binding, clear it with `aac profile update stage --unbind`, then retry.
+Output is JSON only (`--output json` is optional); errors go to stderr.
+See the [command reference](https://docs.cascadeauth.com/cli/reference/aac-sso-describe/).
+
+Then sign in using the connection you need:
+
 ```bash
 aac sso login --profile stage --idp github                # developer tenant: GitHub or Google
 aac sso login --profile prod \
@@ -797,6 +860,15 @@ enterprise tenant signs in through its Microsoft Entra ID connection, named
 by the connection's exact URL with `--idp-url`; when several connections
 are registered, the error message lists the exact commands to choose one.
 
+Sessions last **4 hours by default**. Your administrator may configure a
+different lifetime for the deployment or connection. You can run
+`aac sso login` again before expiry: successful authentication replaces the
+cached session with a new one whose lifetime starts at that login. For example,
+with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
+signing in successfully again at 12:00 gives the new session an expiry of 16:00.
+Use `aac sso whoami --profile NAME --output table` to check the current
+expiration. If the session expires, sign in again; no refresh token is issued.
+
 Sign-in uses the device flow by default, so the browser can be on another
 machine and headless hosts work. Google connections use a loopback flow
 instead, because Google's device flow is scope-restricted; `--flow`
@@ -813,11 +885,16 @@ server-returned domain. Existing agents expose read-only identities through
 or `--field workload-spiffe-id`. A successful scalar is one unquoted line;
 an unavailable value or unhealthy agent fails with empty stdout. `--field`
 cannot be combined with explicit `--output`, or with agent `--remote`.
+Scalar profile inspection rejects an invalid stored binding. Structured
+inspection remains available and reports invalid effective IDs as `null` with
+an `error`; invalid list bindings carry `binding_error`, and show bindings carry
+`binding.error`. Their invalid stored tenant IDs are redacted as `null`.
 
 Every command that reports a result prints one JSON document to standard
 output by default, with progress notes and diagnostics on standard error,
-so the JSON stays parseable in scripts; `--output table` prints a readable
-table instead. The three profile writers are the exception: `aac profile
+so the JSON stays parseable in scripts; where supported, `--output table`
+prints a readable table instead. `aac sso describe` supports JSON only.
+The three profile writers are the exception: `aac profile
 create`, `update` and `delete` confirm on standard error, leave standard
 output empty and take no `--output`.
 
@@ -828,6 +905,18 @@ output empty and take no `--output`.
 | `2` | Usage error: an invalid flag, value or flag combination. |
 | `3` | A local configuration or state problem: profile, credential file, cached session or agent. |
 | `4` | Transport failure: an endpoint could not be reached. |
+| `130` | Interrupted by the operator (Ctrl-C). |
+
+Ctrl-C stops `aac` and CLI-owned `aeg` without a traceback, with one concise
+diagnostic on standard error. A remote change may already have committed;
+follow any recovery guidance and retain pending registration or key-operation
+state. The CLI does not roll back or automatically retry a remote change.
+
+Walking away from sign-in retains the existing deadlines: device sign-in waits
+for the identity provider's device-code lifetime (300 seconds if absent), then
+exits `1` with instructions to run login again; a PKCE browser sign-in without
+a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
+`4`. These outcomes are distinct from Ctrl-C; there is no shorter patience cap.
 
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
@@ -902,7 +991,7 @@ are described by their `--help`.
 ### Keys
 
 Replacing the tenant-admin key is immediate and forward-only: the previous
-key stops verifying at once and can never be reinstated. The trust-anchor
+key stops verifying at once and can never be reinstated. The trust anchor
 publisher signs its uploads with this key and loads it once, at start, so
 sequence the change: stop the publisher, register the new public half, put
 the new private key where the publisher's configuration points, start the

{aac_cli-0.2.8 → aac_cli-0.2.10}/README.md

@@ -7,12 +7,13 @@ which tenant they belong to and what they were authorised to do. A
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
-New to AAC? [What AAC is for](https://cascadeauth.github.io/aac-starter-guide/#what-aac-is-for)
+New to AAC? [What AAC is for](https://docs.cascadeauth.com/overview/#what-aac-is-for)
 explains what delegated authority between agents buys you, and what it does not.
 
-The [CLI user guide and complete command reference](https://cascadeauth.github.io/aac-starter-guide/cli/)
+The [CLI user guide and complete command reference](https://docs.cascadeauth.com/cli/)
 cover developer and enterprise onboarding, everyday administration and recovery.
-Select documentation matching `aac --version`.
+These pages describe the latest supported release. Upgrade the CLI to use the
+documented commands, and check your installation with `aac --version`.
 
 The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
@@ -50,7 +51,7 @@ Python 3.11 to 3.14 is supported. Release checks test all four versions.
 ## Use `aeg` to view agent execution graphs
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
-Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
+Use the [AEG guide and command reference](https://docs.cascadeauth.com/aeg/)
 for listing local and central observations, rendering evidence, and selecting a profile.
 
 `aeg list --profile PROFILE --since 7d` discovers participant-visible central
@@ -84,7 +85,7 @@ Google developer sign-in. See “Setting up aac-cli on a new computer” below
 for the existing-tenant sign-in and material preparation steps.
 
 Setup uses the tenant's assigned trust domain and writes the files the
-trust-anchor publisher and Docker Compose need, as well as the sidecar
+trust anchor publisher and Docker Compose need, as well as the sidecar
 configuration. By default it generates development keys and certificates;
 the certificate choices below explain how to supply your own instead.
 
@@ -314,7 +315,7 @@ and destination maps allow at most 128 entries each.
 | `destinations.<name>.audience_pattern` | Required exact registered SPIFFE identity; no wildcard. | None |
 | `destinations.<name>.predicates`, `.valid_for` | Same value/duration contract as classes. | Empty predicates; duration required |
 | `destinations.<name>.timeout_ms` | Integer 1–2147483647 without A2A; 1–60000 for every destination when A2A is enabled, matching its generated deadline. | `10000` |
-| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths and a 60-second deadline are generated. No A2A self-route is added. | A2A disabled |
+| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths, a 60-second deadline and retry-state capacity are generated; the capacity holds the acknowledgement of the largest reply, which carries the peer's reply to your agent. No A2A self-route is added. | A2A disabled |
 
 URL hosts are ASCII DNS names or IP addresses; URL fields reject whitespace,
 backslashes, embedded credentials and fragments. Basic replay history
@@ -411,7 +412,7 @@ The laptop case. The CLI creates a certificate authority on this machine and sig
 
 **Renewal.** `aac agent renew --agent <name>` issues fresh certificates from the same CA.
 
-#### I bring my own CA
+#### I bring my own CA certificate
 
 Your own issuer has signed the agent's certificates, and your CA private key never reaches this machine. Certificate source alone does not qualify a production deployment.
 
@@ -480,7 +481,7 @@ name and `<tenant-id>` the tenant id AAC allocated.
 For what each of these proves, who else ever gets a copy, what never leaves you
 and how the pieces fit together — including when your own certificate authority
 signs instead of this tool — see
-[Keys and certificates](https://cascadeauth.github.io/aac-starter-guide/keys-and-certificates.html).
+[Keys and certificates](https://docs.cascadeauth.com/overview/keys-and-certificates/).
 
 <!-- inventory-table:start -->
 | No. | Material | Where | Used for | Lifetime | Back up? |
@@ -713,6 +714,7 @@ aac profile show stage --output table             # stored and effective values,
 aac profile create prod --admin-url https://aac-admin.example.com \
   --data-plane-url https://aac-data.example.com
 aac profile update main                           # edit the built-in baseline
+aac profile update stage --unbind                 # clear the local tenant association
 aac profile delete prod                           # local only; never touches the server
 ```
 
@@ -729,6 +731,41 @@ stored value.
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
 It is your organisation's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
+A binding makes that tenant the profile's stored default; it does not grant
+membership or configure an identity provider. Successful sign-in to an existing
+tenant binds the profile; registration binds a newly created tenant.
+
+A stale tenant binding affects only that profile. `aac profile list` and
+`aac profile show` mark invalid bindings without printing the invalid values;
+other profiles remain usable. Operational commands reject a selected invalid
+profile with exit 3, even if a tenant flag or environment override is supplied.
+File syntax, profile-name and size limits still apply to the entire file.
+
+Use `aac profile update NAME --unbind` to remove the local `tenant_id` and its
+saved hosted-domain metadata. Endpoints, other settings, credentials and the
+server-side tenant are preserved. The flag works without prompts, may accompany
+endpoint flags, and also works on `main` or an already-unbound profile. It
+refuses profiles with unresolved registration or API-key rotation state;
+finish that recovery first. Then bind the profile through registration or
+successful sign-in. Endpoint-only updates and confirmed profile deletion also
+work on stale profiles; reads never rewrite the config file.
+
+For an existing tenant, the repair sequence is:
+
+```bash
+aac profile update stage --unbind
+# Bind profile stage to the correct existing tenant:
+aac sso login --profile stage --tenant-id '<TENANT_ID>'
+```
+
+**`aac sso login --profile stage --tenant-id '<TENANT_ID>'` binds profile
+`stage` to that tenant.** Although the verb is `login`, successful authentication
+also saves the tenant association; there is no separate `--bind` flag. Replace
+`<TENANT_ID>` with the intended tenant's canonical ID. An endpoint correction
+or expired session normally does not need
+unbinding. Unbinding is local and does not log out, revoke access, or change
+existing agent records. See the [profile repair guide](https://docs.cascadeauth.com/cli/guide/#repair-a-stale-profile-binding)
+for the exact config fields removed and recovery constraints.
 
 `AAC_CLI_HOME` relocates the whole `~/.aac` tree. Use it for a throwaway
 test home, or to keep separate accounts hard-walled from each other:
@@ -746,13 +783,39 @@ Two credential files can coexist under `~/.aac/credentials/`:
   (`aac chain`, `aac trust-anchor`) present it. Only a hash of it exists
   on the server, so a lost key is replaced, never recovered.
 * `<tenant-id>.session` holds the short-lived session that `aac sso login`
-  creates. The administration commands (`aac tenant`, `aac sso`) use it
-  automatically. Sessions cannot be refreshed: when one expires, any
-  administration command tells you to sign in again, and there is no
-  refresh token that could be stolen.
+  creates. Authenticated administration commands use it automatically;
+  public reads such as `aac sso describe` do not use credentials.
+  Sessions have no refresh token. You can sign in again before expiry to
+  replace the cached session; after expiry, commands that need it ask you
+  to sign in again.
 
 ## Signing in
 
+Inspect the available sign-in connections before starting a login:
+
+```bash
+aac sso describe --profile stage                        # shared/platform candidates
+aac sso describe --profile stage --tenant-id '<TENANT_ID>' # tenant plus shared candidates
+```
+
+`sso describe` reads public metadata from the profile's admin endpoint and
+prints the complete descriptor as JSON on stdout. No credentials or prior
+sign-in are required, and it does not bind a profile or change cached credentials.
+The output includes `connections`, `count`, and, for the tenant route,
+`tenant_id`; connection fields describe issuers, client IDs and available flow
+endpoints. An empty connection list is a successful read.
+
+Only an explicit `--tenant-id` selects the tenant descriptor. Omitting it
+always reads shared/platform candidates, even when the profile or the
+`AAC_TENANT_ID` environment variable supplies a tenant. Replace `<TENANT_ID>`
+with the intended tenant's canonical ID. The CLI still checks your local
+configuration and selected profile. If it reports an invalid stored tenant
+binding, clear it with `aac profile update stage --unbind`, then retry.
+Output is JSON only (`--output json` is optional); errors go to stderr.
+See the [command reference](https://docs.cascadeauth.com/cli/reference/aac-sso-describe/).
+
+Then sign in using the connection you need:
+
 ```bash
 aac sso login --profile stage --idp github                # developer tenant: GitHub or Google
 aac sso login --profile prod \
@@ -770,6 +833,15 @@ enterprise tenant signs in through its Microsoft Entra ID connection, named
 by the connection's exact URL with `--idp-url`; when several connections
 are registered, the error message lists the exact commands to choose one.
 
+Sessions last **4 hours by default**. Your administrator may configure a
+different lifetime for the deployment or connection. You can run
+`aac sso login` again before expiry: successful authentication replaces the
+cached session with a new one whose lifetime starts at that login. For example,
+with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
+signing in successfully again at 12:00 gives the new session an expiry of 16:00.
+Use `aac sso whoami --profile NAME --output table` to check the current
+expiration. If the session expires, sign in again; no refresh token is issued.
+
 Sign-in uses the device flow by default, so the browser can be on another
 machine and headless hosts work. Google connections use a loopback flow
 instead, because Google's device flow is scope-restricted; `--flow`
@@ -786,11 +858,16 @@ server-returned domain. Existing agents expose read-only identities through
 or `--field workload-spiffe-id`. A successful scalar is one unquoted line;
 an unavailable value or unhealthy agent fails with empty stdout. `--field`
 cannot be combined with explicit `--output`, or with agent `--remote`.
+Scalar profile inspection rejects an invalid stored binding. Structured
+inspection remains available and reports invalid effective IDs as `null` with
+an `error`; invalid list bindings carry `binding_error`, and show bindings carry
+`binding.error`. Their invalid stored tenant IDs are redacted as `null`.
 
 Every command that reports a result prints one JSON document to standard
 output by default, with progress notes and diagnostics on standard error,
-so the JSON stays parseable in scripts; `--output table` prints a readable
-table instead. The three profile writers are the exception: `aac profile
+so the JSON stays parseable in scripts; where supported, `--output table`
+prints a readable table instead. `aac sso describe` supports JSON only.
+The three profile writers are the exception: `aac profile
 create`, `update` and `delete` confirm on standard error, leave standard
 output empty and take no `--output`.
 
@@ -801,6 +878,18 @@ output empty and take no `--output`.
 | `2` | Usage error: an invalid flag, value or flag combination. |
 | `3` | A local configuration or state problem: profile, credential file, cached session or agent. |
 | `4` | Transport failure: an endpoint could not be reached. |
+| `130` | Interrupted by the operator (Ctrl-C). |
+
+Ctrl-C stops `aac` and CLI-owned `aeg` without a traceback, with one concise
+diagnostic on standard error. A remote change may already have committed;
+follow any recovery guidance and retain pending registration or key-operation
+state. The CLI does not roll back or automatically retry a remote change.
+
+Walking away from sign-in retains the existing deadlines: device sign-in waits
+for the identity provider's device-code lifetime (300 seconds if absent), then
+exits `1` with instructions to run login again; a PKCE browser sign-in without
+a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
+`4`. These outcomes are distinct from Ctrl-C; there is no shorter patience cap.
 
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
@@ -875,7 +964,7 @@ are described by their `--help`.
 ### Keys
 
 Replacing the tenant-admin key is immediate and forward-only: the previous
-key stops verifying at once and can never be reinstated. The trust-anchor
+key stops verifying at once and can never be reinstated. The trust anchor
 publisher signs its uploads with this key and loads it once, at start, so
 sequence the change: stop the publisher, register the new public half, put
 the new private key where the publisher's configuration points, start the

{aac_cli-0.2.8 → aac_cli-0.2.10}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.8"
+__version__ = "0.2.10"

aac_cli-0.2.10/aac_cli/__main__.py

@@ -0,0 +1,13 @@
+"""`python -m aac_cli` — same entrypoint as the `aac` console script."""
+
+import sys
+
+try:
+    from aac_cli.cli import entrypoint
+
+    if __name__ == "__main__":
+        entrypoint()
+except KeyboardInterrupt:
+    # The shared command boundary is not loaded during early imports.
+    sys.stderr.write("aac: interrupted\n")
+    raise SystemExit(130) from None

{aac_cli-0.2.8 → aac_cli-0.2.10}/aac_cli/aeg_cli.py

@@ -7,6 +7,7 @@ import sys
 from importlib.resources import files
 
 from . import __version__
+from .interrupts import run_command
 
 
 def version_text() -> str:
@@ -15,6 +16,10 @@ def version_text() -> str:
 
 
 def main(argv: list[str] | None = None) -> int:
+    return run_command(lambda: _main(argv), prog="aeg")
+
+
+def _main(argv: list[str] | None = None) -> int:
     argv = list(sys.argv[1:] if argv is None else argv)
     if argv == ["--version"]:
         print(version_text())

{aac_cli-0.2.8 → aac_cli-0.2.10}/aac_cli/agent_cli.py

@@ -10,7 +10,7 @@ tenants:
   public trust endpoints.
 * ``renew`` — in "The CLI creates a development CA" mode, reissues the one-day
   workload, receipt and HTTPS certificates with fresh keys, and the CA only
-  when it is expired or inside its renewal window. In "I bring my own CA" mode
+  when it is expired or inside its renewal window. With supplied certificates
   it cannot reissue what it did not sign: it takes replacements from your
   issuer through the same flags `aac init` accepts. Retired material is
   archived, never deleted.
@@ -64,7 +64,7 @@ from aac_cli.init_cli import (
     check_settings_can_be_written,
     write_settings_files,
 )
-from aac_cli.material_cases import MATERIAL_SUPPLIED, case_for
+from aac_cli.material_cases import MATERIAL_ISSUED_HERE, MATERIAL_SUPPLIED, case_for
 from aac_cli.secure_files import ensure_managed_directory, managed_path_problem, write_private_file
 from aac_cli.supplied_material import resolve_supplied_replacement
 
@@ -619,13 +619,21 @@ def cmd_agent_list(args: argparse.Namespace) -> int:
         row["certificates"] = case_for(record.material_source).name
         tenant = tenant_paths(record.tenant_id) if record.tenant_id else None
         health = assess(agent, tenant, record)
+        row["profile_binding_consistent"] = health.profile_binding_consistent
         row["next_command"] = next_step(agent, tenant, record, health)
         rows.append(row)
     if args.output == "table":
         if not rows:
             print(f"no agents under {directory}")
         for row in rows:
-            print(f"{row['agent']:<16}: {row.get('certificates', row.get('state', '-'))}")
+            binding_note = (
+                " (profile binding inconsistent)"
+                if row.get("profile_binding_consistent") is False
+                else ""
+            )
+            print(
+                f"{row['agent']:<16}: {row.get('certificates', row.get('state', '-'))}{binding_note}"
+            )
         return 0
     print(json.dumps({"agents": rows}, indent=2))
     return 0
@@ -692,10 +700,10 @@ def add_agent_parser(nouns: argparse._SubParsersAction) -> None:
         "renew",
         help="Replace the short-lived certificates; archive the old material.",
         description=(
-            'In "The CLI creates a development CA" mode, reissues the workload, receipt and '
+            f'In "{case_for(MATERIAL_ISSUED_HERE).name}" mode, reissues the workload, receipt and '
             "HTTPS certificates with new keys; the development CA is reissued only when "
             "expired or within one day of expiry, or with --ca, and a new CA needs the "
-            'publisher to publish the new anchor. In "I bring my own CA" mode nothing is '
+            f'publisher to publish the new anchor. In "{case_for(MATERIAL_SUPPLIED).name}" mode nothing is '
             "reissued: pass the replacement certificates your issuer produced, each with its "
             "key file, and --ca-cert-file if your CA certificate changed too."
         ),
@@ -708,7 +716,12 @@ def add_agent_parser(nouns: argparse._SubParsersAction) -> None:
     listing = verbs.add_parser(
         "list",
         help="List every agent under the CLI home with its tenant, case and state.",
-        description="List every agent; an unreadable or unsupported record is reported in that agent's state without hiding the other agents.",
+        description=(
+            "List every agent; an unreadable or unsupported record is reported in that "
+            "agent's state without hiding the other agents. Invalid profile bindings "
+            "are reported per agent: JSON includes profile_binding_consistent and the "
+            "repair next_command; table output marks inconsistent bindings."
+        ),
     )
     listing.add_argument(
         "--output", choices=("json", "table"), default="json", help="Output mode (JSON by default)."

{aac_cli-0.2.8 → aac_cli-0.2.10}/aac_cli/agent_health.py

@@ -22,7 +22,13 @@ from aac_cli.agent_layout import (
     material_inventory,
 )
 from aac_cli.agent_record import STEP_MATERIAL, AgentRecord
-from aac_cli.config import CliConfigError, cli_home, credentials_path, read_profile_section
+from aac_cli.config import (
+    CliConfigError,
+    cli_home,
+    credentials_path,
+    profile_binding_error,
+    read_profile_section,
+)
 from aac_cli.material_cases import MATERIAL_ISSUED_HERE, MATERIAL_SUPPLIED, ca_report_label
 from aac_cli.secure_files import managed_path_problem
 
@@ -40,6 +46,7 @@ class CertificateReport:
 class AgentHealth:
     setup_complete: bool
     profile_binding_consistent: bool
+    invalid_profile_binding: bool = False
     missing_files: list[str] = field(default_factory=list)
     permission_problems: list[str] = field(default_factory=list)
     certificates: dict[str, CertificateReport] = field(default_factory=dict)
@@ -74,7 +81,9 @@ class AgentHealth:
         reasons: list[str] = []
         if not self.setup_complete:
             reasons.append("setup is incomplete")
-        if not self.profile_binding_consistent:
+        if self.invalid_profile_binding:
+            reasons.append("the profile has an invalid stored tenant binding")
+        elif not self.profile_binding_consistent:
             reasons.append("the profile is bound to a different tenant than this agent")
         reasons.extend(f"missing: {name}" for name in self.missing_files)
         reasons.extend(self.permission_problems)
@@ -111,10 +120,16 @@ def _certificate_reports(
 
 def assess(agent: AgentPaths, tenant: TenantPaths | None, record: AgentRecord) -> AgentHealth:
     """The offline health assessment both `status` and a completed `init` report."""
-    profile_tenant = read_profile_section(record.profile).get("tenant_id")
+    # Offline inventory diagnoses this agent's profile without allowing one
+    # stale association to abort every other agent's inventory. Operational
+    # profile resolution stays strict; material paths use the validated record.
+    stored = read_profile_section(record.profile, validate_binding=False)
+    invalid_binding = profile_binding_error(stored) is not None
     health = AgentHealth(
         setup_complete=record.next_step() is None,
-        profile_binding_consistent=profile_tenant == record.tenant_id,
+        profile_binding_consistent=not invalid_binding
+        and stored.get("tenant_id") == record.tenant_id,
+        invalid_profile_binding=invalid_binding,
     )
     if tenant is None:
         return health
@@ -387,6 +402,8 @@ def next_step(
 ) -> str | None:
     """The one next step `status` reports and a refused `init` names; None when there is none."""
     agent_flag = f"--agent {_quote(agent.name)}"
+    if health.invalid_profile_binding:
+        return f"aac profile update {_quote(record.profile)} --unbind"
     if not health.setup_complete:
         return f"aac init --profile {_quote(record.profile)} {agent_flag}"
     if tenant is not None: