{"record":{"id":"2267b87b955d4819","repo":"astrid-runtime/astrid","slug":"redeem-requires-either-public-key-hex-or-key","errorCode":null,"errorMessage":"redeem requires either --public-key <hex> or --keypair <name>. Generate one with `astrid keypair generate`.","messagePattern":"redeem requires either --public-key <hex> or --keypair <name>\\. Generate one with `astrid keypair generate`\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/invite.rs","lineNumber":152,"sourceCode":"            }\n            Ok(ExitCode::SUCCESS)\n        },\n        other => anyhow::bail!(\"unexpected response shape: {other:?}\"),\n    }\n}\n\nasync fn run_redeem(args: RedeemArgs) -> Result<ExitCode> {\n    // Resolve the public key source: either an explicit `--public-key`\n    // hex string or a local `--keypair` reference. Exactly one is\n    // required (clap enforces mutual exclusion; this enforces presence).\n    let (public_key_hex, keypair_name) = match (args.public_key, args.keypair) {\n        (Some(hex), None) => (hex, None),\n        (None, Some(name)) => {\n            let hex = crate::commands::keypair::load_public_key_hex(&name)\n                .with_context(|| format!(\"load public key for --keypair {name:?}\"))?;\n            (hex, Some(name))\n        },\n        (None, None) => anyhow::bail!(\n            \"redeem requires either --public-key <hex> or --keypair <name>. \\\n             Generate one with `astrid keypair generate`.\"\n        ),\n        (Some(_), Some(_)) => unreachable!(\"clap conflicts_with prevents this\"),\n    };\n\n    // Redemption is intentionally unauthenticated kernel-side — the\n    // token IS the auth. A fresh-machine redeemer typically has no\n    // `cli-context.toml` yet, so don't require an active-agent context\n    // here; stamp the IPC message as `default` and let the kernel's\n    // `InviteRedeem` dispatch path verify the token internally.\n    let mut client = connect_for_workspace_as(PrincipalId::default())\n        .await\n        .context(\"connect to daemon for invite redeem\")?;\n    let resp = client\n        .request(AdminRequestKind::InviteRedeem {\n            token: args.token,\n            public_key: public_key_hex,","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/invite.rs#L134-L170","documentation":"`astrid invite redeem` needs the recipient's ed25519 public key, supplied either inline via --public-key <hex> or by naming a stored keypair via --keypair <name>. If both are omitted the command cannot construct the redeem request and bails with this message, which also points the user at `astrid keypair generate` to create a keypair first.","triggerScenarios":"Running `astrid invite redeem` (with an invite code) but passing neither --public-key nor --keypair; e.g. forgetting the flag entirely or assuming the active agent's key is used automatically.","commonSituations":"First-time users redeeming an invite before generating any keypair; scripts that dropped the --keypair flag; renaming a keypair and forgetting to update the script.","solutions":["Re-run with --public-key <64-char hex> supplying the recipient public key directly.","Or re-run with --keypair <name> referencing an existing keypair.","If no keypair exists yet, run `astrid keypair generate` first, then redeem with --keypair <name>.","If the flag was intended, check for typos/CLI arg quoting in the invoking script."],"exampleFix":"// before\nastrid invite redeem --code <code>\n// after\nastrid invite redeem --code <code> --keypair default","handlingStrategy":"validation","validationCode":"if [ -z \"$PUBKEY\" ] && [ -z \"$KEYPAIR\" ]; then echo \"need --public-key or --keypair\" >&2; exit 2; fi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass --keypair in scripts; generate the keypair in provisioning before redeeming","Use clap default or wrapper script that injects the active keypair","Never rely on implicit key selection — redeem has none"],"tags":["cli","missing-argument","keypair"],"backgroundTag":"missing-required-option","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}