firekeep-client 1.8.2__tar.gz → 1.8.3__tar.gz

{firekeep_client-1.8.2/firekeep_client.egg-info → firekeep_client-1.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.8.2
+Version: 1.8.3
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai

{firekeep_client-1.8.2 → firekeep_client-1.8.3}/firekeep_client/__init__.py

@@ -9,4 +9,4 @@ versions without a verdict (`_check_versions`) and judges staleness against the
 release manifest instead (`_check_client_version`).
 """
 
-__version__ = "1.8.2"
+__version__ = "1.8.3"

{firekeep_client-1.8.2 → firekeep_client-1.8.3}/firekeep_client/join.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import base64
+import configparser
 import hashlib
 import json
 import os
@@ -91,6 +92,19 @@ def _new_pending(code: JoinCode) -> dict:
 def _prepare_pending(code: JoinCode, *, resume: bool, config_path: Path) -> dict:
     path = pending_path(config_path)
     sweep_pending(config_path)
+    if not resume and path.exists():
+        # Re-running the SAME code after a crash or a lost response is the
+        # documented shape of "it failed, run it again" -- and reusing the
+        # pending secret is exactly the safe thing to do: the server answers
+        # `replay` if that secret was already registered, and spends nothing
+        # twice. Only a pending enrollment for a DIFFERENT code still refuses.
+        try:
+            existing = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            existing = {}
+        if existing.get("ticket_id") == code.tid:
+            print("resuming the pending enrollment for this join code")
+            resume = True
     if resume:
         try:
             pending = json.loads(path.read_text(encoding="utf-8"))
@@ -230,6 +244,10 @@ def _server_values(
     expires = response.get("credential_expires_at")
     if expires:
         server["credential_expires_at"] = str(expires)
+    # Which code produced this credential. Lets a re-run of the same install
+    # command recognise "already joined" locally instead of spending a second
+    # attempt on a single-use ticket and failing with "already redeemed".
+    server["join_ticket"] = code.tid
     if response["kind"] == "ports":
         server["host"] = "127.0.0.1" if code.transport == "tunnel" else str(response["host"])
     else:
@@ -239,6 +257,46 @@ def _server_values(
     return server
 
 
+_USED_CREDENTIAL = re.compile(r"issuing credential ([0-9a-f]{16})")
+
+
+def _joined_credential(config_path: Path) -> tuple[str, str]:
+    """(credential_id, join_ticket) of the connection this machine already holds.
+
+    Empty strings when there is no usable connection (no api_key). A RAW read,
+    never resolver.load_config(): that migrates and rewrites the file, and a
+    join that ends up refused must leave the config exactly as it found it."""
+    cfg = configparser.ConfigParser(interpolation=None)
+    try:
+        cfg.read_string(config_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, configparser.Error):
+        return "", ""
+    if not cfg.get("server", "api_key", fallback="").strip():
+        return "", ""
+    return (
+        cfg.get("server", "credential_id", fallback="").strip(),
+        cfg.get("server", "join_ticket", fallback="").strip(),
+    )
+
+
+def _already_joined(config_path: Path, credential_id: str) -> int:
+    """Report an install re-run against a code this machine already redeemed."""
+    try:
+        pending_path(config_path).unlink()
+    except OSError:
+        pass
+    print(
+        f"this machine already joined with this code (credential {credential_id}); "
+        "nothing to do."
+    )
+    from firekeep_client.cli import run_doctor
+
+    rows = run_doctor()
+    for name, status, detail in rows:
+        print(f"[{status.upper()}] {name}: {detail}")
+    return 1 if any(status == "fail" for _, status, _ in rows) else 0
+
+
 def join(
     pasted_code: str,
     *,
@@ -260,6 +318,14 @@ def join(
         raise JoinError(str(exc), exit_code=2) from exc
 
     config_path = resolver._config_path()
+    joined_credential, joined_ticket = _joined_credential(config_path)
+    if (
+        code.purpose == "device"
+        and not force
+        and joined_credential
+        and joined_ticket == code.tid
+    ):
+        return _already_joined(config_path, joined_credential)
     pending = (
         _prepare_pending(code, resume=resume, config_path=config_path)
         if code.purpose == "device"
@@ -333,6 +399,23 @@ def join(
                 pending = _new_pending(code)
                 _write_private_json(pending_path(config_path), pending)
                 continue
+            # A config written before `join_ticket` existed cannot be matched
+            # locally; the server's "already redeemed" names the credential the
+            # code issued, and if that is the one this machine holds, the
+            # earlier run succeeded -- this is a re-run, not a stolen code.
+            used = _USED_CREDENTIAL.search(str(exc)) if exc.status == 409 else None
+            if used and joined_credential and used.group(1) == joined_credential:
+                return _already_joined(config_path, joined_credential)
+            # A JSON 4xx is a definitive refusal: the enrollment script registers
+            # the credential only on success, so the pending secret was never
+            # stored and keeping it would only block the next join for 24h.
+            # Transport failures and 5xx keep it -- the response may have been
+            # lost after the server registered it, which is what --resume is for.
+            if exc.status is not None and 400 <= exc.status < 500 and exc.response_is_json:
+                try:
+                    pending_path(config_path).unlink()
+                except OSError:
+                    pass
             if exc.status == 404 and not exc.response_is_json:
                 raise JoinError(
                     "this server predates client enrollment (no POST /enroll). On "

{firekeep_client-1.8.2 → firekeep_client-1.8.3/firekeep_client.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.8.2
+Version: 1.8.3
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai

{firekeep_client-1.8.2 → firekeep_client-1.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "firekeep-client"
-version = "1.8.2"
+version = "1.8.3"
 description = "Client for Firekeep, the self-hosted operating layer for connected AI agents."
 readme = "README.md"
 requires-python = ">=3.10"

{firekeep_client-1.8.2 → firekeep_client-1.8.3}/tests/test_join.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import base64
 import json
 import os
 import stat
@@ -189,6 +190,108 @@ def test_enrollment_error_exit_codes(
         assert "predates client enrollment" in str(error.value)
 
 
+def _throw(exc):
+    def raiser(*a, **k):
+        raise exc
+    return raiser
+
+
+def test_rerun_of_the_same_code_is_a_local_no_op(home, monkeypatch, capsys):
+    """The install one-liner re-run on a machine it already joined must succeed
+    without spending a second attempt on the single-use ticket."""
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: {"ok": True})
+    monkeypatch.setattr(J, "post_json", lambda *a, **k: response())
+    code = encode(payload())
+    assert J.join(code) == 0
+    assert "join_ticket" in home.read_text(encoding="utf-8")
+    before = home.read_text(encoding="utf-8")
+
+    posts = []
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: posts.append(a))
+    monkeypatch.setattr(J, "post_json", lambda *a, **k: posts.append(a))
+    capsys.readouterr()
+    assert J.join(code) == 0
+    assert posts == []
+    assert "already joined with this code" in capsys.readouterr().out
+    assert home.read_text(encoding="utf-8") == before
+    assert not J.pending_path(home).exists()
+
+
+def test_rerun_against_a_legacy_config_recognises_its_own_credential(home, monkeypatch, capsys):
+    """A config written before join_ticket existed: the server's 'already
+    redeemed' names the credential, and it is the one this machine holds."""
+    home.parent.mkdir(parents=True)
+    home.write_text(
+        "[identity]\nagent_id = bob\n\n[server]\nkind = ports\nhost = firekeep.example\n"
+        f"api_key = nxs_{'a' * 64}\ncredential_id = {'1' * 16}\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: {"ok": True})
+    monkeypatch.setattr(J, "post_json", _throw(TransportError(
+        '409 {"detail":"this join code was already redeemed at 2026-11-09T00:09:30 by a '
+        f'different device, issuing credential {"1" * 16}. Join codes are single-use."}}',
+        status=409, response_is_json=True,
+    )))
+    assert J.join(encode(payload())) == 0
+    assert "already joined with this code" in capsys.readouterr().out
+    assert not J.pending_path(home).exists()
+
+
+def test_code_redeemed_by_another_credential_still_fails_and_cleans_up(home, monkeypatch):
+    home.parent.mkdir(parents=True)
+    home.write_text(
+        f"[server]\nkind = ports\napi_key = nxs_{'a' * 64}\ncredential_id = {'9' * 16}\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: {"ok": True})
+    monkeypatch.setattr(J, "post_json", _throw(TransportError(
+        f'409 {{"detail":"already redeemed ... issuing credential {"1" * 16}."}}',
+        status=409, response_is_json=True,
+    )))
+    with pytest.raises(J.JoinError, match="already redeemed") as error:
+        J.join(encode(payload()))
+    assert error.value.exit_code == 3
+    # Refused outright: the secret was never registered, so nothing to resume.
+    assert not J.pending_path(home).exists()
+
+
+def test_transport_failure_keeps_pending_and_a_plain_rerun_resumes_it(home, monkeypatch, capsys):
+    """A lost response may mean the server DID register the secret, so the
+    pending file stays -- and re-running the same command (no --resume) reuses
+    it instead of refusing with 'a pending enrollment already exists'."""
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: {"ok": True})
+    hashes = []
+
+    def lost(url, body, **kwargs):
+        hashes.append(body["credential_hash"])
+        raise TransportError("response lost")
+
+    monkeypatch.setattr(J, "post_json", lost)
+    with pytest.raises(J.JoinError):
+        J.join(encode(payload()))
+    assert J.pending_path(home).exists()
+
+    def replay(url, body, **kwargs):
+        hashes.append(body["credential_hash"])
+        return {**response(), "replay": True}
+
+    monkeypatch.setattr(J, "post_json", replay)
+    assert J.join(encode(payload())) == 0
+    assert hashes[0] == hashes[1]
+    assert "resuming the pending enrollment" in capsys.readouterr().out
+    assert not J.pending_path(home).exists()
+
+
+def test_pending_for_a_different_code_still_refuses(home, monkeypatch):
+    monkeypatch.setattr(J, "get_json", lambda *a, **k: {"ok": True})
+    monkeypatch.setattr(J, "post_json", _throw(TransportError("response lost")))
+    with pytest.raises(J.JoinError):
+        J.join(encode(payload()))
+    other = encode(payload(q=base64.urlsafe_b64encode(bytes(range(1, 33))).decode().rstrip("=")))
+    with pytest.raises(J.JoinError, match="pending enrollment already exists"):
+        J.join(other)
+
+
 def test_tunnel_setup_failure_is_actionable_exit_7(home, monkeypatch):
     from firekeep_client import connect
 

{firekeep_client-1.8.2 → firekeep_client-1.8.3}/tests/test_package.py

@@ -7,7 +7,7 @@ from pathlib import Path
 def test_package_imports_and_exposes_frozen_version():
     import firekeep_client
 
-    assert firekeep_client.__version__ == "1.8.2"
+    assert firekeep_client.__version__ == "1.8.3"
 
 
 def test_the_version_pins_agree():