agent-relay agent rotate fails with "already exists" instead of rotating an existing identity's token #1704

What happened

agent-relay agent rotate <name> does not do what its own --help text says. Its description is "Rotate the token for an existing agent name," but calling it on a name that already exists in the workspace fails instead of rotating:

$ agent-relay agent rotate connor-agent --workspace-key rk_live_...
Agent "connor-agent" already exists in this workspace

This is reproducible on demand (not a one-off transient failure — retried multiple times, same result every time).

agent-relay agent register <name> has the same underlying problem. Its own --help says it registers, "rotating an existing identity token when needed." Calling it on an existing name sometimes surfaces the same "already exists" error, and sometimes times out with a message that itself suggests running rotate as the fix:

$ agent-relay agent register connor-agent --workspace-key rk_live_...
Agent registration or token rotation for "connor-agent" did not complete within 15000ms. The request outcome is unknown. Retry with `agent-relay agent rotate 'connor-agent'`; if rotation continues to time out, run `agent-relay agent remove 'connor-agent' --reason "recover stale token"` and then register again.

...but retrying rotate per that exact suggested command just goes back to "already exists". The only thing that actually worked was the fallback in that same error message: agent remove <name> followed by a fresh register. That works, but it mints a brand-new agent identity (new id) rather than actually rotating the existing one's token, which loses continuity for anything that was addressed to the old identity (e.g. a DM conversation, since the recipient token now belongs to a different underlying id).

Why this matters

This surfaced during a real end-to-end test of the "two coding agents on Agent Relay" onboarding flow (npm install → workspace create → node up --workspace-key → skills add → tell your agent to register and DM). A real Codex agent process registered as connor-agent, sent its first message attempt (correctly failed, recipient didn't exist yet), and then in a second, separate codex exec process (representing the same human's agent in a new session — e.g. closing and reopening their coding agent) tried to recover its own identity to check its inbox. It could not: neither register nor rotate let it reclaim connor-agent's token. It's a realistic scenario — anyone whose agent process restarts and needs to resume its Relay identity hits this.

Repro

agent-relay workspace create some-workspace
KEY=$(agent-relay workspace key some-workspace --reveal-secrets | tail -1)
agent-relay node up --background --no-spawn --workspace-key "$KEY"
agent-relay agent register connor-agent --workspace-key "$KEY"   # succeeds, mints a token
# ...token is lost (process exited without persisting it)...
agent-relay agent rotate connor-agent --workspace-key "$KEY"     # fails: "already exists"
agent-relay agent register connor-agent --workspace-key "$KEY"   # also fails or times out

Environment

• agent-relay --version: 11.10.3
• Reproduced on a clean Ubuntu Daytona sandbox with a freshly-created workspace (agent-relay workspace create), not an existing/shared workspace with unusual state.

Expected

agent-relay agent rotate <name> should rotate the token for an existing agent name and return a usable token, per its own --help description — not fail with "already exists."