fix(cli-auth): retry a failed mint, port container/port fixes to Redis + k8s

Review findings from #5911:
- poll now reserves the mint with an atomic NX lock instead of deleting the
  approval up front, so a failed mint (e.g. mothership blip) is retried by the
  next poll instead of forcing a fresh browser approval; the lock still prevents
  a double-mint and its TTL frees the slot if the caller dies
- setup reuses/recreates an unhealthy managed sim-redis instead of colliding on
  the name (Redis has no data volume, so it removes and recreates without a prompt)
- k8s failure-path hints carry --context, matching the success-path hints, so a
  changed ambient context can't send diagnostics to the wrong cluster
- compose port-free waits for a killed port to actually release before
  re-checking; SIGKILL is async, so the immediate re-check re-saw the port

Author: TheodoreSpeaks

apps/sim/app/api/cli/auth/poll/route.test.ts

@@ -4,14 +4,24 @@
 import { createMockRequest } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockPollApproval, mockGenerateCopilotApiKey, mockEnforceIpRateLimit } = vi.hoisted(() => ({
+const {
+  mockPollApproval,
+  mockCompleteApproval,
+  mockReleaseMint,
+  mockGenerateCopilotApiKey,
+  mockEnforceIpRateLimit,
+} = vi.hoisted(() => ({
   mockPollApproval: vi.fn(),
+  mockCompleteApproval: vi.fn(),
+  mockReleaseMint: vi.fn(),
   mockGenerateCopilotApiKey: vi.fn(),
   mockEnforceIpRateLimit: vi.fn(),
 }))
 
 vi.mock('@/lib/cli-auth/approval-store', () => ({
   pollApproval: mockPollApproval,
+  completeApproval: mockCompleteApproval,
+  releaseMint: mockReleaseMint,
 }))
 
 vi.mock('@/lib/copilot/server/api-keys', () => ({
@@ -37,6 +47,8 @@ describe('POST /api/cli/auth/poll', () => {
     vi.clearAllMocks()
     mockEnforceIpRateLimit.mockResolvedValue(null)
     mockGenerateCopilotApiKey.mockResolvedValue({ id: 'key-1', apiKey: 'sk-test' })
+    mockCompleteApproval.mockResolvedValue(undefined)
+    mockReleaseMint.mockResolvedValue(undefined)
   })
 
   it('returns pending without minting while unapproved', async () => {
@@ -47,7 +59,7 @@ describe('POST /api/cli/auth/poll', () => {
     expect(mockGenerateCopilotApiKey).not.toHaveBeenCalled()
   })
 
-  it('mints for the approving user once approved', async () => {
+  it('mints, then consumes the approval, once approved', async () => {
     mockPollApproval.mockResolvedValue({ status: 'approved', userId: 'user-1' })
     const response = await POST(pollRequest({ request: REQUEST, verifier: VERIFIER }))
     expect(response.status).toBe(200)
@@ -56,6 +68,17 @@ describe('POST /api/cli/auth/poll', () => {
       key: { id: 'key-1', apiKey: 'sk-test' },
     })
     expect(mockGenerateCopilotApiKey).toHaveBeenCalledWith('user-1', expect.stringMatching(/^CLI /))
+    expect(mockCompleteApproval).toHaveBeenCalledWith(REQUEST)
+    expect(mockReleaseMint).not.toHaveBeenCalled()
+  })
+
+  it('releases the reservation (keeps the approval) when minting fails', async () => {
+    mockPollApproval.mockResolvedValue({ status: 'approved', userId: 'user-1' })
+    mockGenerateCopilotApiKey.mockRejectedValue(new Error('mothership down'))
+    const response = await POST(pollRequest({ request: REQUEST, verifier: VERIFIER }))
+    expect(response.status).toBe(500)
+    expect(mockReleaseMint).toHaveBeenCalledWith(REQUEST)
+    expect(mockCompleteApproval).not.toHaveBeenCalled()
   })
 
   it('rejects a malformed verifier before touching the store', async () => {

apps/sim/app/api/cli/auth/poll/route.ts

@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
-import { pollApproval } from '@/lib/cli-auth/approval-store'
+import { completeApproval, pollApproval, releaseMint } from '@/lib/cli-auth/approval-store'
 import { CopilotApiKeyError, generateCopilotApiKey } from '@/lib/copilot/server/api-keys'
 import { enforceIpRateLimit } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -18,7 +18,8 @@ function cliKeyName(): string {
  * The CLI's poll endpoint. Unauthenticated by necessity — the CLI has no
  * session — but the request id is only a rendezvous handle and minting requires
  * the poll secret, which never leaves the CLI. Returns `pending` until the user
- * approves; on the first authorized poll it consumes the approval and mints.
+ * approves; on an authorized poll it mints, then consumes the approval — a
+ * failed mint releases the reservation so a later poll can retry.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const rateLimited = await enforceIpRateLimit('cli-auth-poll', request)
@@ -36,9 +37,11 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
   try {
     const key = await generateCopilotApiKey(result.userId, cliKeyName())
+    await completeApproval(requestId)
     logger.info('Minted CLI key on approved poll', { userId: result.userId })
     return NextResponse.json({ status: 'complete', key })
   } catch (error) {
+    await releaseMint(requestId)
     const status = error instanceof CopilotApiKeyError ? error.upstreamStatus : undefined
     return NextResponse.json(
       { error: 'Failed to generate copilot API key' },

apps/sim/lib/cli-auth/approval-store.test.ts

@@ -15,7 +15,12 @@ vi.mock('@/lib/core/config/redis', () => ({
   getRedisClient: mockGetRedisClient,
 }))
 
-import { createApproval, pollApproval } from '@/lib/cli-auth/approval-store'
+import {
+  completeApproval,
+  createApproval,
+  pollApproval,
+  releaseMint,
+} from '@/lib/cli-auth/approval-store'
 
 const REQUEST = 'a'.repeat(43)
 const SECRET = 'b'.repeat(43)
@@ -48,41 +53,60 @@ describe('cli-auth approval store', () => {
   })
 
   describe('pollApproval', () => {
+    const storedApproval = () =>
+      JSON.stringify({ challenge: CHALLENGE, userId: 'user-1', createdAt: Date.now() })
+
     it('returns pending when no approval exists yet', async () => {
       mockGet.mockResolvedValue(null)
       await expect(pollApproval(REQUEST, SECRET)).resolves.toEqual({ status: 'pending' })
-      expect(mockDel).not.toHaveBeenCalled()
+      expect(mockSet).not.toHaveBeenCalled()
     })
 
-    it('returns the user for a matching secret and consumes the approval', async () => {
-      mockGet.mockResolvedValue(
-        JSON.stringify({ challenge: CHALLENGE, userId: 'user-1', createdAt: Date.now() })
-      )
-      mockDel.mockResolvedValue(1)
+    it('reserves the mint (does not consume) for a matching secret', async () => {
+      mockGet.mockResolvedValue(storedApproval())
+      mockSet.mockResolvedValue('OK')
       await expect(pollApproval(REQUEST, SECRET)).resolves.toEqual({
         status: 'approved',
         userId: 'user-1',
       })
-      expect(mockDel).toHaveBeenCalledTimes(1)
+      // NX lock on the mint key with a TTL; the approval itself is NOT deleted here.
+      const [key, val, px, ttl, nx] = mockSet.mock.calls[0]
+      expect(key).toContain('cli:auth:mint:')
+      expect([val, px, ttl, nx]).toEqual(['1', 'PX', 30_000, 'NX'])
+      expect(mockDel).not.toHaveBeenCalled()
     })
 
-    it('does NOT delete the approval when the secret is wrong', async () => {
-      mockGet.mockResolvedValue(
-        JSON.stringify({ challenge: CHALLENGE, userId: 'user-1', createdAt: Date.now() })
-      )
+    it('does NOT touch the record when the secret is wrong', async () => {
+      mockGet.mockResolvedValue(storedApproval())
       await expect(pollApproval(REQUEST, 'c'.repeat(43))).resolves.toEqual({ status: 'pending' })
-      expect(mockDel).not.toHaveBeenCalled()
+      expect(mockSet).not.toHaveBeenCalled()
     })
 
-    it('yields to a concurrent poll that already claimed it', async () => {
-      mockGet.mockResolvedValue(
-        JSON.stringify({ challenge: CHALLENGE, userId: 'user-1', createdAt: Date.now() })
-      )
-      mockDel.mockResolvedValue(0)
+    it('yields to a concurrent poll already holding the mint lock', async () => {
+      mockGet.mockResolvedValue(storedApproval())
+      mockSet.mockResolvedValue(null) // NX lost — someone else is minting
       await expect(pollApproval(REQUEST, SECRET)).resolves.toEqual({ status: 'pending' })
     })
   })
 
+  describe('completeApproval / releaseMint', () => {
+    it('completeApproval deletes both the approval and the mint lock', async () => {
+      mockDel.mockResolvedValue(2)
+      await completeApproval(REQUEST)
+      const keys = mockDel.mock.calls[0]
+      expect(keys.some((k: string) => k.includes('cli:auth:req:'))).toBe(true)
+      expect(keys.some((k: string) => k.includes('cli:auth:mint:'))).toBe(true)
+    })
+
+    it('releaseMint drops only the mint lock, leaving the approval for a retry', async () => {
+      mockDel.mockResolvedValue(1)
+      await releaseMint(REQUEST)
+      expect(mockDel).toHaveBeenCalledTimes(1)
+      expect(mockDel.mock.calls[0][0]).toContain('cli:auth:mint:')
+      expect(mockDel.mock.calls[0].join(' ')).not.toContain('cli:auth:req:')
+    })
+  })
+
   describe('without Redis', () => {
     beforeEach(() => mockGetRedisClient.mockReturnValue(null))
 

apps/sim/lib/cli-auth/approval-store.ts

@@ -17,6 +17,7 @@ import { getRedisClient } from '@/lib/core/config/redis'
  */
 
 const APPROVAL_TTL_MS = 120_000
+const MINT_LOCK_TTL_MS = 30_000
 
 interface ApprovalRecord {
   /** BASE64URL(SHA256(pollSecret)) — the CLI proves possession of the secret at poll time. */
@@ -46,6 +47,11 @@ function approvalKey(requestId: string): string {
   return `cli:auth:req:${sha256Hex(requestId)}`
 }
 
+/** Guards the mint step so two concurrent valid polls can't both mint a key. */
+function mintLockKey(requestId: string): string {
+  return `cli:auth:mint:${sha256Hex(requestId)}`
+}
+
 /** Records a signed-in user's approval. Overwrites any prior approval for the same request. */
 export async function createApproval(
   userId: string,
@@ -58,30 +64,45 @@ export async function createApproval(
 }
 
 /**
- * Polls for an approval, consuming it exactly once.
+ * Polls for an approval and reserves the mint slot, without consuming the
+ * approval itself.
  *
- * `pending` covers every non-terminal state — not yet approved, expired, or a
- * wrong `pollSecret` — so the endpoint is not an oracle for which requests
- * exist or whether a secret is close. The approving user is returned only to a
- * caller that proves possession of the secret.
+ * `pending` covers every non-terminal state — not yet approved, expired, a wrong
+ * `pollSecret`, or another poll already minting — so the endpoint is not an
+ * oracle for which requests exist or whether a secret is close. The approving
+ * user is returned only to a caller that proves possession of the secret.
  *
- * Verifies *before* deleting: an attacker who knows the semi-public `requestId`
- * but not the secret can never trigger the delete, so they cannot cancel a
- * pending approval. The atomic `del` (returns the count removed) then makes the
- * claim single-use — two concurrent valid polls can't both mint.
+ * Verifies *before* reserving: an attacker who knows the semi-public `requestId`
+ * but not the secret can never touch the record. The reservation is an atomic
+ * `SET NX` lock (not a delete) so two concurrent valid polls can't both mint,
+ * while the approval survives a *failed* mint — the caller releases the lock and
+ * a later poll retries, instead of forcing a fresh browser approval. Its short
+ * TTL frees the slot if the minting caller dies. Callers MUST finish with
+ * {@link completeApproval} on success or {@link releaseMint} on failure.
  */
 export async function pollApproval(requestId: string, pollSecret: string): Promise<PollResult> {
   const redis = requireRedis()
-  const key = approvalKey(requestId)
 
-  const raw = await redis.get(key)
+  const raw = await redis.get(approvalKey(requestId))
   if (!raw) return { status: 'pending' }
 
   const record = JSON.parse(raw) as ApprovalRecord
   if (!safeCompare(sha256Base64Url(pollSecret), record.challenge)) return { status: 'pending' }
 
-  const claimed = await redis.del(key)
-  if (claimed !== 1) return { status: 'pending' }
+  const reserved = await redis.set(mintLockKey(requestId), '1', 'PX', MINT_LOCK_TTL_MS, 'NX')
+  if (reserved !== 'OK') return { status: 'pending' }
 
   return { status: 'approved', userId: record.userId }
 }
+
+/** Consumes the approval after a successful mint — single-use from here on. */
+export async function completeApproval(requestId: string): Promise<void> {
+  const redis = requireRedis()
+  await redis.del(approvalKey(requestId), mintLockKey(requestId))
+}
+
+/** Releases the mint reservation after a failed mint so a later poll can retry. */
+export async function releaseMint(requestId: string): Promise<void> {
+  const redis = requireRedis()
+  await redis.del(mintLockKey(requestId))
+}

scripts/setup/modes/compose.ts

@@ -70,6 +70,19 @@ async function ensurePortsFree(composeFile: string): Promise<void> {
       p.log.step(
         `Killed ${killable.map((b) => `${b.owner?.command} (pid ${b.owner?.pid})`).join(', ')}`
       )
+      // SIGKILL is async — the kernel releases the listening socket a beat after
+      // the process dies, so re-checking immediately would still see the port
+      // held. Wait for the killed ports to actually free before looping.
+      await waitFor(
+        async () => {
+          for (const b of killable) {
+            if (await portOpen(b.port)) return false
+          }
+          return true
+        },
+        5000,
+        250
+      )
     } else if (choice === 'abort') {
       throw new SetupError(
         'ports 3000/3002 are in use',

scripts/setup/modes/k8s.ts

@@ -155,8 +155,8 @@ export async function runK8sMode(detection: Detection): Promise<void> {
   } catch (error) {
     spin.stop(`${glyph.fail} helm install failed`)
     throw new SetupError(getErrorMessage(error), [
-      `pod status: ${theme.command(`kubectl -n ${NAMESPACE} get pods`)}`,
-      `stuck pods: ${theme.command(`kubectl -n ${NAMESPACE} describe pod <name> | tail -20`)}`,
+      `pod status: ${theme.command(`kubectl --context ${context} -n ${NAMESPACE} get pods`)}`,
+      `stuck pods: ${theme.command(`kubectl --context ${context} -n ${NAMESPACE} describe pod <name> | tail -20`)}`,
       'ImagePullBackOff on ghcr.io/simstudioai/* usually means the chart appVersion tag was never published — check Chart.yaml against ghcr',
     ])
   }
@@ -171,8 +171,8 @@ export async function runK8sMode(detection: Detection): Promise<void> {
   if (test.status !== 0) {
     testSpin.stop(`${glyph.fail} helm test failed`)
     throw new SetupError(`helm test failed:\n${test.stdout}${test.stderr}`, [
-      `pod status: ${theme.command(`kubectl -n ${NAMESPACE} get pods`)}`,
-      `app logs: ${theme.command(`kubectl -n ${NAMESPACE} logs deploy/${RELEASE}-app --tail 50`)}`,
+      `pod status: ${theme.command(`kubectl --context ${context} -n ${NAMESPACE} get pods`)}`,
+      `app logs: ${theme.command(`kubectl --context ${context} -n ${NAMESPACE} logs deploy/${RELEASE}-app --tail 50`)}`,
     ])
   }
   testSpin.stop('helm test passed')

scripts/setup/redis.ts

@@ -32,6 +32,10 @@ async function pingWithSpinner(url: string, label: string): Promise<boolean> {
 async function startManagedRedis(detection: Detection): Promise<string> {
   const hostPort = detection.redisPortOpen ? 6380 : 6379
   const url = `redis://localhost:${hostPort}`
+  // A prior sim-redis (unhealthy, or bound to a stale port) would collide on the
+  // name. Unlike Postgres this container has no data volume, so removing it
+  // loses nothing — no prompt needed. `rm -f` is a no-op when none exists.
+  spawnSync('docker', ['rm', '-f', REDIS_CONTAINER], { stdio: 'ignore' })
   docker([
     'run',
     '-d',
@@ -113,7 +117,7 @@ export async function resolveRedis(detection: Detection, existing?: string): Pro
       return managedUrl
     }
     p.log.warn(
-      `${REDIS_CONTAINER} exists but is not answering — remove it with ${theme.command(`docker rm -f ${REDIS_CONTAINER}`)} before starting a new one.`
+      `${REDIS_CONTAINER} exists but is not answering — starting a fresh one will replace it (it holds no data).`
     )
   }