@4xeoz/re-entry 0.2.11 → 0.2.13

package/README.md

@@ -1,5 +1,10 @@
 # Re-entry Local Connector
 
+> **Cloud Receiver dependency notice — 2026-09-02:** The former `re-entry-weld.vercel.app` Cloud
+> Receiver is deprecated and must not be used for new pairing, credentials, or production traffic.
+> This Connector package remains a reusable/local preview surface, but a new Receiver origin must
+> be supplied explicitly by an accepted replacement service.
+
 Install it once on the Mac where Codex should open; after one dashboard pairing code, a macOS
 LaunchAgent keeps the outbound Connector running at login.
 
@@ -26,11 +31,9 @@ npm install --global @4xeoz/re-entry
 The package installs both `re-entry` and the older `reentry` spelling; `re-entry` is the documented
 command.
 
-For the retained hosted preview, pass the deployment alias explicitly:
-`https://re-entry-weld.vercel.app`.
-
-The currently published CLI source still has its previous hosted default. Until a new package
-release repoints that default, use `--receiver https://re-entry-weld.vercel.app` for hosted tests.
+The CLI no longer has a default hosted Receiver. For any new or historical test, pass an explicit
+accepted Receiver origin with `--receiver` or `REENTRY_RECEIVER_ORIGIN`; the former
+`https://re-entry-weld.vercel.app` alias is retired.
 
 The interactive CLI first offers Desktop, the current folder, or a small folder browser. Choose
 with ↑/↓ and Enter. If you want to skip the picker, pass the workspace directly:
@@ -56,8 +59,7 @@ npm install --global @4xeoz/re-entry
 re-entry install --codex-cd /absolute/path/to/your/project
 ```
 
-Use `--receiver` to select the retained hosted preview or a different Receiver, such as the local
-preview:
+Use `--receiver` to select an accepted replacement Receiver, such as a local historical preview:
 
 ```sh
 npx --yes --package=@4xeoz/re-entry re-entry install \
@@ -72,7 +74,7 @@ choose Desktop, the current folder, or another Codex workspace
   -> check Node + find Codex + validate the selected directory
   -> open the dedicated Re-entry user account page in the default browser
   -> sign in or create a user account
-  -> click Pair this Mac in the dashboard
+  -> land on the user dashboard and click Pair this Mac
   -> enter the short pairing code in the CLI
   -> save the device credential with mode 0600
   -> install and start a per-user macOS LaunchAgent
@@ -200,9 +202,15 @@ the npm account that owns the `4xeoz` scope, publish from this directory:
 
 ```sh
 npm login
+npm whoami
+npm version patch --no-git-tag-version
+npm run verify
 npm publish --access public
 ```
 
+NPM versions are immutable: if the current version has already been published, bump it before
+publishing (the current published `0.2.11` therefore requires `0.2.12` or another new version).
+
 After publishing, users run `npx --yes --package=@4xeoz/re-entry re-entry install`. The explicit
 `--package` form works across npm versions when the package is scoped; the executable itself is
 still named `re-entry`.
@@ -254,9 +262,9 @@ npm start -- \
 ```
 
 On the first run, the Connector checks the Mac, opens the dedicated Re-entry user account page,
-waits for you to create or sign in to an account and click Pair this Mac, then asks for the
-dashboard code and stores the credential. On later runs it reuses the saved credential and skips
-pairing:
+waits for you to create or sign in to an account, lands on the user dashboard, and asks for the
+pairing code. It then stores the credential. On later runs it reuses the saved credential and
+skips pairing:
 
 ```sh
 npm start -- --codex-cd "$HOME/Code/my-host-project"

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@4xeoz/re-entry",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "type": "module",
-  "description": "Outbound Local Connector process for the Re-entry Core local preview.",
+  "description": "Outbound Local Connector process for Re-entry Core; new Receiver origins must be explicit.",
   "publishConfig": {
     "access": "public"
   },
@@ -11,8 +11,8 @@
     "src"
   ],
   "bin": {
-    "re-entry": "./src/main.mjs",
-    "reentry": "./src/main.mjs"
+    "re-entry": "src/main.mjs",
+    "reentry": "src/main.mjs"
   },
   "exports": {
     ".": "./src/index.mjs",

package/src/main.mjs

@@ -34,7 +34,9 @@ import {
 } from "./macos-service.mjs";
 import { createTerminalUi } from "./terminal-ui.mjs";
 
-const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN ?? "https://re-entry-weld.vercel.app";
+// The former hosted Cloud Receiver is retired. New pairing must name an accepted replacement
+// explicitly instead of silently sending credentials to the old deployment alias.
+const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN;
 const DEFAULT_POLL_INTERVAL_MS = 5_000;
 const DEFAULT_MAX_CONSECUTIVE_ERRORS = 5;
 const DEFAULT_PAIRING_REQUEST_TIMEOUT_MS = 20_000;
@@ -141,7 +143,7 @@ Commands:
   pair         Legacy Host-code pairing preview
 
 Common options:
-  --receiver <url>       Re-entry Receiver origin
+  --receiver <url>       Accepted Receiver origin (required when pairing a new Mac)
   --codex-cd <path>      Workspace for Codex; interactive mode offers a folder picker if omitted
   --codex-binary <path>  Explicit Codex executable
   --json                 Machine-readable output
@@ -274,6 +276,9 @@ async function connect(flags, ui, options = {}) {
     ui.begin("Connect this Mac", "Create a Re-entry account, pair this Mac, then leave it running");
   }
   const receiver = flags.receiver ?? DEFAULT_RECEIVER_ORIGIN;
+  if (typeof receiver !== "string" || receiver.trim().length === 0) {
+    throw cliFailure("connector_receiver_missing");
+  }
   const credentialFile = flags["credential-file"] ?? defaultCredentialFile();
   const store = new LocalConnectorCredentialStore({ filename: credentialFile });
   const current = await store.load();
@@ -307,7 +312,7 @@ async function connect(flags, ui, options = {}) {
     baseUrl: receiver,
     requestTimeoutMs: DEFAULT_PAIRING_REQUEST_TIMEOUT_MS,
   });
-  const portalUrl = `${receiver}/user-register?next=${encodeURIComponent("/dashboard")}`;
+  const portalUrl = `${receiver}/user-register?next=${encodeURIComponent("/user-dashboard")}`;
   if (ui.interactive) {
     ui.stopWait("Secure link", "ready");
     ui.info("Re-entry", portalUrl);
@@ -1035,8 +1040,10 @@ function errorHint(error) {
     connector_codex_binary_not_found: "check --codex-binary or remove it to use automatic discovery",
     connector_codex_unusable: "open Codex, complete login if needed, then run `npm run doctor` again",
     connector_node_unsupported: "use Node.js 24 or newer, then run the command again",
+    connector_receiver_missing: "pass --receiver <replacement-receiver-origin> or set REENTRY_RECEIVER_ORIGIN",
     connector_credentials_missing: "connect this Mac once with `re-entry connect`",
     connector_credentials_expired: "run `re-entry connect` to authorize this Mac again",
+    connector_credentials_already_exists: "use the existing Connector credential or ask for a new pairing code",
     connector_identity_invalid: "run `re-entry connect` and approve this Mac again",
     connector_reauthorization_required: "run `re-entry connect` and approve this Mac again",
     connector_pairing_code_missing: "ask the Host backend for a new pairing code, then run pair in a terminal",

package/src/pairing-client.mjs

@@ -69,6 +69,14 @@ const CREDENTIAL_FIELDS = Object.freeze([
   "connector_expires_at",
   "duplicate",
 ]);
+const TOKENLESS_CREDENTIAL_FIELDS = Object.freeze([
+  "type",
+  "protocol_version",
+  "pairing_id",
+  "connector_id",
+  "connector_expires_at",
+  "duplicate",
+]);
 const ERROR_FIELDS = Object.freeze(["error"]);
 const ERROR_BODY_FIELDS = Object.freeze(["code"]);
 const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
@@ -218,8 +226,16 @@ export class LocalConnectorPairingClient {
       device_name: deviceName,
     });
     if (response.status !== 200) throw await parseHttpFailure(response);
+    const credentials = normalizeAccountCredentials(await parseJsonResponse(response));
+    if (credentials.duplicate && !Object.hasOwn(credentials, "connector_token")) {
+      throw pairingFailure(
+        "connector_credentials_already_exists",
+        "Pairing is already complete; use the existing Connector credential or create a new pairing",
+        { statusCode: response.status },
+      );
+    }
     return Object.freeze({
-      ...normalizeCredentials(await parseJsonResponse(response)),
+      ...credentials,
       browserOpened: false,
     });
   }
@@ -358,6 +374,33 @@ function normalizeCredentials(value) {
   };
 }
 
+function normalizeAccountCredentials(value) {
+  const fields = value?.duplicate === true ? TOKENLESS_CREDENTIAL_FIELDS : CREDENTIAL_FIELDS;
+  requireExactRecord(
+    value,
+    fields,
+    fields,
+    "Account Connector credential response",
+    "pairing_response_invalid",
+  );
+  if (value.type !== "webmcp.connector_credentials" || value.protocol_version !== "0.1") {
+    throw pairingFailure("pairing_response_invalid", "Account Connector credential response is unsupported");
+  }
+  if (typeof value.duplicate !== "boolean") {
+    throw pairingFailure("pairing_response_invalid", "Account Connector credential duplicate flag is invalid");
+  }
+  const normalized = {
+    pairing_id: requireIdentifier(value.pairing_id, "pairing_id"),
+    connector_id: requireIdentifier(value.connector_id, "connector_id"),
+    connector_expires_at: requireTimestamp(value.connector_expires_at, "connector_expires_at"),
+    duplicate: value.duplicate,
+  };
+  if (!value.duplicate) {
+    normalized.connector_token = requireToken(value.connector_token, "connector_token");
+  }
+  return normalized;
+}
+
 function normalizeAccountPairingCode(value) {
   if (typeof value !== "string") {
     throw pairingFailure("account_pairing_code_invalid", "Pairing code is invalid");
@@ -547,17 +590,17 @@ function pairingFailure(code, message, options = {}) {
   return new PairingClientError(code, message, options);
 }
 
-function requireExactRecord(value, allowedFields, requiredFields, label) {
+function requireExactRecord(value, allowedFields, requiredFields, label, failureCode = "pairing_input_invalid") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw pairingFailure("pairing_input_invalid", `${label} must be an object`);
+    throw pairingFailure(failureCode, `${label} must be an object`);
   }
   const prototype = Object.getPrototypeOf(value);
   if (prototype !== Object.prototype && prototype !== null) {
-    throw pairingFailure("pairing_input_invalid", `${label} must be a plain object`);
+    throw pairingFailure(failureCode, `${label} must be a plain object`);
   }
   const fields = Object.keys(value);
   if (fields.some((field) => !allowedFields.includes(field)) || requiredFields.some((field) => !fields.includes(field))) {
-    throw pairingFailure("pairing_input_invalid", `${label} fields are invalid`);
+    throw pairingFailure(failureCode, `${label} fields are invalid`);
   }
 }