astrid-runtime/astrid · error

keypair {name:?} already exists at {} — pass --force to over

Error message

keypair {name:?} already exists at {} — pass --force to overwrite

What it means

`run_generate` refuses to overwrite an existing keypair. If any file for the named keypair (private key, public key, or meta) already exists on disk and --force was not passed, generation is aborted to prevent silent key loss.

Source

Thrown at crates/astrid-cli/src/commands/keypair.rs:221

// ── Command dispatch ─────────────────────────────────────────────

pub(crate) fn run(command: KeypairCommand) -> Result<ExitCode> {
    match command {
        KeypairCommand::Generate(args) => run_generate(args),
        KeypairCommand::List(args) => run_list(&args),
        KeypairCommand::Show(args) => run_show(&args),
        KeypairCommand::Pubkey(args) => run_pubkey(&args),
        KeypairCommand::Delete(args) => run_delete(&args),
    }
}

fn run_generate(args: GenerateArgs) -> Result<ExitCode> {
    let name = args.name.unwrap_or_else(default_name);
    validate_name(&name)?;
    let paths = KeyPaths::new(&name)?;
    if paths.exists_any() && !args.force {
        bail!(
            "keypair {name:?} already exists at {} — pass --force to overwrite",
            paths.private.display()
        );
    }

    // Generate from the OS CSPRNG. ed25519-dalek's `Zeroizing` drop
    // glue runs when `signing` falls out of scope, clearing the
    // secret bytes from RAM.
    let mut secret_bytes = [0u8; 32];
    SysRng
        .try_fill_bytes(&mut secret_bytes)
        .context("OS CSPRNG unavailable while generating keypair")?;
    let signing = SigningKey::from_bytes(&secret_bytes);
    secret_bytes = [0u8; 32]; // belt-and-suspenders; the SigningKey owns its own zeroizing copy
    let _ = secret_bytes;

    let verifying = signing.verifying_key();
    let pub_hex = hex::encode(verifying.to_bytes());

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-run with --force if overwriting is intentional (the old key will be replaced — back it up first).
2. Choose a different keypair name for the new key.
3. Inspect the path shown in the error to confirm whether the existing key is still needed before forcing.
4. Automate with an existence check before generate in scripts.

Example fix

// before
astrid keypair generate default
// after
astrid keypair generate default --force

astrid keypair list | grep -qx "$NAME" && FORCE=--force || FORCE=

When it happens

Trigger: Running `astrid keypair generate <name>` when files for <name> already exist in the key directory and --force is absent; re-running a provisioning script twice without --force.

Common situations: Idempotent setup scripts re-executed; re-generating after a partial earlier run; accidental reuse of a name like 'default' or a hostname.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

• redeem requires either --public-key <hex> or --keypair <name
• keypair {:?} not found
• keypair name must not be empty
• {name} not found. Ensure it is installed alongside the astri
• {name} is not installed beside the Astrid CLI; refusing a PA

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/41f3408eabe48343. Report an issue: GitHub.