Agent Wiki 0.9.2 — sign out after MFA enrollment

Fixes “Could not sign out. Please try again.” when signing out immediately after adding a passkey or authenticator app. MFA enrollment rotates the session, and the account menu now retrieves the current session’s CSRF token before signing out. Origin and CSRF enforcement remain unchanged.

Regression tests first reproduced HTTP 403 with the old code, then verified immediate logout and subsequent MFA sign-in after TOTP, first and second passkey enrollment, and OIDC enrollment. No database migration, dependency change or MFA recovery-policy change is included.

Exact-source validation passed 238 core and 75 browser tests on macOS and Linux, managed package checks, 19 native upgrade checks and seven synthetic container adoption/recovery checks. The first managed Linux attempt had startup and preview timeouts under host load; the full unchanged retry passed. The initial native qualifier needed its locked test dependencies installed; the successful retry and original setup-failure evidence are retained.

The signed Linux amd64 OCI archive and qualification, SBOM and security records are attached. The current npm audit retains six low and four moderate affected-package entries, with no high or critical findings. The installed dependencies and 132 runtime artifacts are unchanged; earlier runtime findings remain unpatched and no fresh runtime-feed scan or clean-dependency claim is made.

Verify signatures against the repository’s established release key. Existing MFA database/key backup and minimum-version requirements remain in effect.