fix: reprovision workflow bugs — SSH host key warnings, log following, status priority

- Add UserKnownHostsFile=/dev/null to SSH in debug and reprovision commands
- Track install state in log follower so it doesn't exit prematurely on "installed"
- Reorder bastion status check to prioritize active queue over stale installed state
- Update .gitignore with task file entries

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/cli/src/commands/debug.ts

@@ -103,6 +103,7 @@ export function registerDebugCommand(parent: Command): void {
 
           const sshArgs = [
             "-o", "StrictHostKeyChecking=no",
+            "-o", "UserKnownHostsFile=/dev/null",
             "-o", "ConnectTimeout=10",
             ...(sshKey !== undefined ? ["-i", sshKey] : []),
             `${effectiveUser}@${ip}`,

bastion/src/cli/src/commands/logs.ts

@@ -103,6 +103,7 @@ async function followLogs(
 
   let lastStageCount = 0;
   let lastStatus = "";
+  let sawInstalling = false;
 
   while (true) {
     try {
@@ -118,6 +119,10 @@ async function followLogs(
         lastStatus = status;
       }
 
+      if (status === "installing" || status === "queued") {
+        sawInstalling = true;
+      }
+
       // Print new stages
       if (log && log.length > lastStageCount) {
         for (let i = lastStageCount; i < log.length; i++) {
@@ -130,8 +135,9 @@ async function followLogs(
         lastStageCount = log.length;
       }
 
-      // Done
-      if (status === "installed") {
+      // Only exit on "installed" if we actually saw the install happen
+      // (avoids exiting immediately when following a reprovision that hasn't started yet)
+      if (status === "installed" && sawInstalling) {
         const ip = data["ip"] ?? "";
         console.log("");
         console.log(`  ${GREEN}${BOLD}Install complete!${RESET}${ip ? ` ${DIM}ssh lab@${ip}${RESET}` : ""}`);

bastion/src/cli/src/commands/reprovision.ts

@@ -144,6 +144,7 @@ export function registerReprovisionCommand(parent: Command): void {
 
       const sshArgs = [
         "-o", "StrictHostKeyChecking=no",
+        "-o", "UserKnownHostsFile=/dev/null",
         "-o", "ConnectTimeout=10",
         ...(sshKey !== undefined ? ["-i", sshKey] : []),
         `${effectiveUser}@${ip}`,

bastion/src/labd/src/routes/bastions.ts

@@ -257,17 +257,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     const queued = bastion.state.install_queue[mac];
     const installed = bastion.state.installed[mac];
 
-    if (installed) {
-      return {
-        mac,
-        hostname: installed.hostname,
-        status: "installed",
-        role: installed.role,
-        ip: installed.ip,
-        installed_at: installed.installed_at,
-      };
-    }
-
+    // Active install takes priority over old installed state (reprovision case)
     if (queued) {
       return {
         mac,
@@ -282,6 +272,17 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
       };
     }
 
+    if (installed) {
+      return {
+        mac,
+        hostname: installed.hostname,
+        status: "installed",
+        role: installed.role,
+        ip: installed.ip,
+        installed_at: installed.installed_at,
+      };
+    }
+
     return reply.code(404).send({ error: `MAC ${mac} not found in install queue or installed` });
   });
 }