---
- name: "🩺 Ask the hub whether the stored token still authenticates"
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - -e
      - "HA_PORT={{ HOMEASSISTANT_PORT_INTERNAL }}"
      - -e
      - "HA_TOKEN={{ homeassistant_mcp_token }}"
      - "{{ HOMEASSISTANT_LOCAL_CID }}" # nocheck: container-exec-resolver
      - python3
      - "-"
    stdin: "{{ lookup('file', 'python/probe_mcp_token.py') }}"
  register: homeassistant_token_probe
  retries: 30
  delay: 10
  until: homeassistant_token_probe.rc == 0 or 'REJECTED' in homeassistant_token_probe.stderr
  failed_when: false
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  delegate_to: "{{ HOMEASSISTANT_HOST_NODE }}"
  run_once: true