@4xeoz/re-entry 0.2.13 → 0.2.15

package/README.md

@@ -2,8 +2,9 @@
 
 > **Cloud Receiver dependency notice — 2026-09-02:** The former `re-entry-weld.vercel.app` Cloud
 > Receiver is deprecated and must not be used for new pairing, credentials, or production traffic.
-> This Connector package remains a reusable/local preview surface, but a new Receiver origin must
-> be supplied explicitly by an accepted replacement service.
+> This Connector package remains a reusable/local preview surface and defaults to the accepted
+> preview origin `https://cloud-receiver-delta.vercel.app`; pass `--receiver` for another accepted
+> Receiver. This preview default is not a production deployment.
 
 Install it once on the Mac where Codex should open; after one dashboard pairing code, a macOS
 LaunchAgent keeps the outbound Connector running at login.
@@ -18,7 +19,7 @@ Requirements: macOS, Node.js 24+, Codex installed and signed in, and an absolute
 Codex may read and write.
 
 ```sh
-npx @4xeoz/re-entry install
+npx --yes --package=@4xeoz/re-entry re-entry install
 ```
 
 `npx` runs a temporary copy, so it does not leave a permanent shell command behind. Install the
@@ -29,23 +30,25 @@ npm install --global @4xeoz/re-entry
 ```
 
 The package installs both `re-entry` and the older `reentry` spelling; `re-entry` is the documented
-command.
+command. If you keep using the temporary `npx` form, run later commands with the same executable
+prefix, for example `npx --yes --package=@4xeoz/re-entry re-entry status`.
 
-The CLI no longer has a default hosted Receiver. For any new or historical test, pass an explicit
-accepted Receiver origin with `--receiver` or `REENTRY_RECEIVER_ORIGIN`; the former
-`https://re-entry-weld.vercel.app` alias is retired.
+The CLI defaults to the current Cloud Receiver v2 preview at
+`https://cloud-receiver-delta.vercel.app`. Override it with `--receiver` or
+`REENTRY_RECEIVER_ORIGIN` when using another accepted Receiver. This preview default is not a
+production deployment.
 
 The interactive CLI first offers Desktop, the current folder, or a small folder browser. Choose
 with ↑/↓ and Enter. If you want to skip the picker, pass the workspace directly:
 
 ```sh
-npx @4xeoz/re-entry install \
+npx --yes --package=@4xeoz/re-entry re-entry install \
   --codex-cd /absolute/path/to/your/project
 ```
 
 The guided screen stays intentionally small: **Workspace → System check → Connect Re-entry**. It
-shows one clear next command when setup finishes; internal Connector IDs, credential paths, and log
-paths stay out of the normal success screen.
+shows one executable next command when setup finishes; internal Connector IDs, credential paths, and
+log paths stay out of the normal success screen.
 
 Run this from the Host project directory, your home directory, or another normal working
 directory—not from a checked-out `runtime/local-connector` package directory. npm can treat that
@@ -56,7 +59,8 @@ installation instead:
 
 ```sh
 npm install --global @4xeoz/re-entry
-re-entry install --codex-cd /absolute/path/to/your/project
+re-entry install \
+  --codex-cd /absolute/path/to/your/project
 ```
 
 Use `--receiver` to select an accepted replacement Receiver, such as a local historical preview:
@@ -86,29 +90,45 @@ preview.
 
 ## Check it
 
+If you installed the package globally:
+
 ```sh
 re-entry status
 re-entry listen
 re-entry --help
+re-entry stop
+re-entry disconnect
+re-entry uninstall
+```
+
+If you used the temporary `npx` invocation:
+
+```sh
+npx --yes --package=@4xeoz/re-entry re-entry status
+npx --yes --package=@4xeoz/re-entry re-entry listen
+npx --yes --package=@4xeoz/re-entry re-entry --help
+npx --yes --package=@4xeoz/re-entry re-entry stop
+npx --yes --package=@4xeoz/re-entry re-entry disconnect
+npx --yes --package=@4xeoz/re-entry re-entry uninstall
 ```
 
 The status view checks the local authorization, background job, Receiver reachability, Node, and
 Codex. If the Receiver rejects a previously saved device credential, the Connector pauses instead
-of retrying forever, and `status`/`listen` tell you to run `re-entry connect` again. `listen` watches
+of retrying forever, and `status`/`listen` tell you to disconnect before reconnecting. `listen` watches
 the already-running background Connector and displays new activity until you press Ctrl+C; it does
 not start a competing second poller. Useful development commands are:
 
 ```sh
-re-entry doctor --codex-cd /absolute/path/to/project
-re-entry connect --receiver http://127.0.0.1:43224
-re-entry claim-once --codex-cd /absolute/path/to/project
-re-entry start --codex-cd /absolute/path/to/project
+npx --yes --package=@4xeoz/re-entry re-entry doctor --codex-cd /absolute/path/to/project
+npx --yes --package=@4xeoz/re-entry re-entry connect --receiver http://127.0.0.1:43224
+npx --yes --package=@4xeoz/re-entry re-entry claim-once --codex-cd /absolute/path/to/project
+npx --yes --package=@4xeoz/re-entry re-entry start --codex-cd /absolute/path/to/project
 ```
 
 Test the local Codex handoff without waiting for Cloud work:
 
 ```sh
-re-entry test "Reply with: Re-entry is working."
+npx --yes --package=@4xeoz/re-entry re-entry test "Reply with: Re-entry is working."
 ```
 
 This starts one fresh local Codex process through the same adapter seam used by real deliveries. It
@@ -117,8 +137,9 @@ does not create a Grant, claim Receiver work, or prove the browser/WebMCP return
 To pause or remove the local Connector:
 
 ```sh
-re-entry stop
-re-entry uninstall
+npx --yes --package=@4xeoz/re-entry re-entry stop
+npx --yes --package=@4xeoz/re-entry re-entry disconnect
+npx --yes --package=@4xeoz/re-entry re-entry uninstall
 ```
 
 `stop` pauses the macOS background service and keeps the account connection. `uninstall` requires
@@ -126,9 +147,23 @@ typing `DELETE`, then removes only the LaunchAgent, saved Connector credential,
 It does not recursively delete folders or uninstall the npm package. To remove a global npm
 installation separately, run `npm uninstall --global @4xeoz/re-entry`.
 
-`connect` repeats only account authorization. `install` is the normal product path because it also
-installs the background job. `claim-once` is the smallest manual delivery test. The legacy
-Host-code `pair` command remains only for compatibility tests.
+`disconnect` is the simple local sign-out: it stops the LaunchAgent, removes the saved Connector
+credential, and leaves the log files in place. It is safe to run again when already disconnected.
+The current CLI does not have a server-side revoke route, so this command does not remove the Mac
+from the account's remote device list; use the account dashboard's revoke/decommission action when
+that Receiver operation is available, or wait for the remote credential to expire. `uninstall` is
+the stronger local cleanup and also removes Connector logs.
+
+Each credential file accepts one connection at a time. Repeating `connect` or `install` with the
+same saved connection returns `already connected`; an expired, rejected, or different-Receiver
+connection is not silently replaced. Run `disconnect`, then `install`, to connect this Mac to a
+different account or Receiver. `connect` repeats only account authorization, while `install` is the
+normal product path because it also installs the background job. `claim-once` is the smallest manual
+delivery test. The legacy Host-code `pair` command follows the same one-connection rule and remains
+only for compatibility tests.
+
+`Ctrl+C` stops a foreground `start` process or closes the `listen` view. It does not remove the
+saved connection; use `stop` to pause the background service or `disconnect` to clear it.
 
 ## Give this to a coding agent
 
@@ -139,8 +174,8 @@ Install the Re-entry Local Connector on this Mac. First read the package README.
 or newer and locate the Connector executable. Run `npx --yes --package=@4xeoz/re-entry re-entry install` with an absolute
 project directory. Let the human create or sign in to a Re-entry account, click Pair this Mac, and
 enter the code in the CLI; never copy browser cookies, organization keys, Connector tokens, or private keys
-into chat, logs, source files, or git. Finish by running `re-entry status` and report the bounded
-results without claiming Browser/WebMCP or production deployment.
+into chat, logs, source files, or git. Finish by running `npx --yes --package=@4xeoz/re-entry re-entry status`
+and report the bounded results without claiming Browser/WebMCP or production deployment.
 ```
 
 ## Package map
@@ -203,20 +238,23 @@ the npm account that owns the `4xeoz` scope, publish from this directory:
 ```sh
 npm login
 npm whoami
+npm view @4xeoz/re-entry version
 npm version patch --no-git-tag-version
 npm run verify
 npm publish --access public
 ```
 
-NPM versions are immutable: if the current version has already been published, bump it before
-publishing (the current published `0.2.11` therefore requires `0.2.12` or another new version).
+NPM versions are immutable: if the target version has already been published, bump it before
+publishing with `npm version patch --no-git-tag-version`.
 
 After publishing, users run `npx --yes --package=@4xeoz/re-entry re-entry install`. The explicit
 `--package` form works across npm versions when the package is scoped; the executable itself is
-still named `re-entry`.
+still named `re-entry`. The command uses the built-in preview Receiver unless `--receiver` or
+`REENTRY_RECEIVER_ORIGIN` overrides it.
 
-On npm installations affected by the temporary-bin `PATH` bug, use `npm install --global
-@4xeoz/re-entry` once and then run `re-entry install` directly.
+A temporary `npx` invocation does not add `re-entry` to your shell `PATH`. If you prefer the shorter
+bare commands, run `npm install --global @4xeoz/re-entry` once and then use `re-entry install`
+directly.
 
 ## Check a Mac before pairing
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@4xeoz/re-entry",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "type": "module",
-  "description": "Outbound Local Connector process for Re-entry Core; new Receiver origins must be explicit.",
+  "description": "Outbound Local Connector process for Re-entry Core; uses the Cloud Receiver v2 preview by default with an explicit override for other accepted origins.",
   "publishConfig": {
     "access": "public"
   },

package/src/macos-service.mjs

@@ -113,6 +113,30 @@ export async function stopMacConnectorService(options = {}) {
   return Object.freeze({ ...status, stopped: true, running: false });
 }
 
+export async function disconnectMacConnectorService(options = {}) {
+  const configuration = requireServiceConfiguration(options, "disconnect");
+  if (process.platform !== "darwin" && configuration.allowNonMacForTest !== true) {
+    return Object.freeze({ supported: false, disconnected: false, removedPaths: [] });
+  }
+  const service = await stopMacConnectorService(configuration);
+  const stateDirectory = configuration.stateDirectory ?? join(homedir(), ".webmcp-connector");
+  const credentialFile = requireAbsolutePath(
+    configuration.credentialFile ?? join(stateDirectory, "credentials.json"),
+    "Credential file",
+  );
+  const removedPaths = await removePaths([
+    service.plistPath,
+    credentialFile,
+    `${credentialFile}.reauthorization-required.json`,
+  ], "disconnect");
+  return Object.freeze({
+    supported: true,
+    disconnected: removedPaths.length > 0,
+    removedPaths,
+    plistPath: service.plistPath,
+  });
+}
+
 export async function uninstallMacConnectorService(options = {}) {
   const configuration = requireServiceConfiguration(options, "uninstall");
   if (process.platform !== "darwin" && configuration.allowNonMacForTest !== true) {
@@ -131,22 +155,28 @@ export async function uninstallMacConnectorService(options = {}) {
     join(stateDirectory, "connector.log"),
     join(stateDirectory, "connector-error.log"),
   ])];
+  const removedPaths = await removePaths(paths, "uninstall");
+  return Object.freeze({
+    supported: true,
+    removedPaths,
+    plistPath: service.plistPath,
+  });
+}
+
+async function removePaths(paths, operation) {
   const removedPaths = [];
-  for (const path of paths) {
+  for (const path of [...new Set(paths)]) {
+    if (typeof path !== "string") continue;
     try {
       await unlink(path);
       removedPaths.push(path);
     } catch (error) {
       if (error?.code !== "ENOENT") {
-        throw serviceFailure("connector_service_remove_failed", "Connector data could not be removed", error);
+        throw serviceFailure("connector_service_remove_failed", `Connector data could not be removed during ${operation}`, error);
       }
     }
   }
-  return Object.freeze({
-    supported: true,
-    removedPaths,
-    plistPath: service.plistPath,
-  });
+  return removedPaths;
 }
 
 export function renderLaunchAgent(options) {

package/src/main.mjs

@@ -28,19 +28,23 @@ import { LocalConnectorPairingClient, openBrowser } from "./pairing-client.mjs";
 import { chooseWorkspaceDirectory } from "./workspace-picker.mjs";
 import {
   inspectMacConnectorService,
+  disconnectMacConnectorService,
   installMacConnectorService,
   stopMacConnectorService,
   uninstallMacConnectorService,
 } from "./macos-service.mjs";
 import { createTerminalUi } from "./terminal-ui.mjs";
 
-// The former hosted Cloud Receiver is retired. New pairing must name an accepted replacement
-// explicitly instead of silently sending credentials to the old deployment alias.
-const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN;
+// This is the current Cloud Receiver v2 preview. A command-line --receiver override remains
+// authoritative, and REENTRY_RECEIVER_ORIGIN can override this built-in preview default.
+const BUILT_IN_RECEIVER_ORIGIN = "https://cloud-receiver-delta.vercel.app";
+const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN?.trim() || BUILT_IN_RECEIVER_ORIGIN;
 const DEFAULT_POLL_INTERVAL_MS = 5_000;
 const DEFAULT_MAX_CONSECUTIVE_ERRORS = 5;
 const DEFAULT_PAIRING_REQUEST_TIMEOUT_MS = 20_000;
 const CONNECTOR_VERSION = readConnectorVersion();
+// The npx form is executable even when this CLI was launched from a temporary npx cache.
+const TEMPORARY_CLI_COMMAND = "npx --yes --package=@4xeoz/re-entry re-entry";
 
 async function main() {
   let ui;
@@ -86,6 +90,10 @@ async function main() {
       await stop(flags, ui);
       return;
     }
+    if (command === "disconnect") {
+      await disconnect(flags, ui);
+      return;
+    }
     if (command === "uninstall") {
       await uninstall(flags, ui);
       return;
@@ -127,14 +135,20 @@ Connect this Mac once, then receive approved work in Codex in the background.
 Usage:
   re-entry install                                      Recommended first run
   re-entry listen                                      Watch live activity
+  re-entry disconnect                                  Sign out this Mac locally
   re-entry test "Reply with hello"                     Test Codex locally
 
+Invocation:
+  Temporary npx: npx --yes --package=@4xeoz/re-entry re-entry <command>
+  Global install: npm install --global @4xeoz/re-entry, then re-entry <command>
+
 Commands:
   install      Check this Mac, connect the Re-entry account, and start at login
   status       Show account, Receiver, service, Node.js, and Codex readiness
   listen       Watch the background Connector until you press Ctrl+C
   test         Start one fresh local Codex session with the supplied prompt
   stop         Stop the background Connector without removing its credential
+  disconnect   Stop the Connector and clear this Mac's saved connection
   uninstall    Stop the Connector and remove its local service data
   connect      Open Re-entry, redeem a dashboard pairing code, and connect this Mac
   start        Poll for approved work until stopped
@@ -143,7 +157,7 @@ Commands:
   pair         Legacy Host-code pairing preview
 
 Common options:
-  --receiver <url>       Accepted Receiver origin (required when pairing a new Mac)
+  --receiver <url>       Accepted Receiver origin (overrides the preview default)
   --codex-cd <path>      Workspace for Codex; interactive mode offers a folder picker if omitted
   --codex-binary <path>  Explicit Codex executable
   --json                 Machine-readable output
@@ -151,11 +165,19 @@ Common options:
   --help                 Show this help
   --version              Show the installed version
 
+Default Receiver:
+  https://cloud-receiver-delta.vercel.app
+  Override with --receiver or REENTRY_RECEIVER_ORIGIN for another accepted Receiver.
+
 Both commands are installed: re-entry and reentry.
 The Connector opens no inbound port. Host keys never belong on this Mac.
 `);
 }
 
+function cliCommand(command) {
+  return `${TEMPORARY_CLI_COMMAND} ${command}`;
+}
+
 function readConnectorVersion() {
   const packageJson = JSON.parse(
     readFileSync(new URL("../package.json", import.meta.url), "utf8"),
@@ -229,6 +251,8 @@ async function pair(flags, ui, options = {}) {
   }
   const receiver = requireFlag(flags, "receiver");
   const credentialFile = flags["credential-file"] ?? defaultCredentialFile();
+  const store = new LocalConnectorCredentialStore({ filename: credentialFile });
+  if (await store.load()) throw cliFailure("connector_account_already_connected");
   if (ui.interactive) {
     ui.step("Receiver", receiver);
   }
@@ -255,7 +279,6 @@ async function pair(flags, ui, options = {}) {
       ui.warning("Browser", "did not open automatically; use the URL above");
     }
   }
-  const store = new LocalConnectorCredentialStore({ filename: credentialFile });
   await store.save({
     version: 1,
     receiver_origin: receiver,
@@ -265,7 +288,7 @@ async function pair(flags, ui, options = {}) {
   });
   if (ui.interactive) {
     ui.complete("Pairing complete", "Re-entry can now deliver approved work to this Mac.");
-    ui.next("re-entry start", "Wait for approved work in this terminal.");
+    ui.next(cliCommand("start"), "Wait for approved work in this terminal.");
   } else {
     process.stdout.write(`${JSON.stringify({ event: "connector_paired", connector_id: credentials.connector_id })}\n`);
   }
@@ -288,7 +311,7 @@ async function connect(flags, ui, options = {}) {
     if (ui.interactive) {
       ui.success("Account", "already connected");
       if (!options.guidedInstall) {
-        ui.next("re-entry start", "Wait for approved work in this terminal.");
+        ui.next(cliCommand("start"), "Wait for approved work in this terminal.");
       }
     } else {
       process.stdout.write(`${JSON.stringify({
@@ -300,9 +323,7 @@ async function connect(flags, ui, options = {}) {
     return current;
   }
 
-  if (currentIsValid && ui.interactive) {
-    ui.warning("Receiver changed", `${current.receiver_origin} → ${receiver}; approve this Mac again`);
-  }
+  if (current) throw cliFailure("connector_account_already_connected");
 
   if (ui.interactive) {
     if (!options.guidedInstall) ui.info("Re-entry", displayReceiver(receiver));
@@ -347,7 +368,7 @@ async function connect(flags, ui, options = {}) {
   if (ui.interactive) {
     if (!options.guidedInstall) {
       ui.complete("This Mac is connected", "Re-entry can now route approved work here.");
-      ui.next("re-entry start", "Wait for approved work in this terminal.");
+      ui.next(cliCommand("start"), "Wait for approved work in this terminal.");
     }
   } else {
     process.stdout.write(`${JSON.stringify({
@@ -371,11 +392,15 @@ async function status(flags, ui) {
     Date.parse(credentials.connector_expires_at) > Date.now() &&
     !reauthorizationRequired,
   );
+  const credentialExpired = Boolean(
+    credentials && Date.parse(credentials.connector_expires_at) <= Date.now(),
+  );
   if (ui.interactive) {
     ui.section("SYSTEM", "This Mac");
     showReadiness(readiness, ui);
     ui.section("CONNECTION", "Re-entry");
-    if (reauthorizationRequired) ui.warning("Account", "reconnect required");
+    if (reauthorizationRequired) ui.warning("Account", "disconnect required before reconnecting");
+    else if (credentialExpired) ui.warning("Account", "connection expired; disconnect before reconnecting");
     else if (connected) ui.success("Account", "connected");
     else ui.warning("Account", "not connected");
     if (reauthorizationRequired && service.running) ui.warning("Background", "paused until this Mac is reconnected");
@@ -385,15 +410,15 @@ async function status(flags, ui) {
     if (receiverReady) ui.success("Cloud", "online");
     else if (credentials) ui.warning("Cloud", "unavailable");
 
-    if (reauthorizationRequired) {
-      ui.next("re-entry connect", "Approve this Mac again in your browser; the old credential was rejected.");
+    if (reauthorizationRequired || credentialExpired) {
+      ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install to connect again.");
     } else if (!connected || !service.running) {
-      ui.next("re-entry install", "Finish setup and start Re-entry in the background.");
+      ui.next(cliCommand("install"), "Finish setup and start Re-entry in the background.");
     } else if (!receiverReady) {
-      ui.next("re-entry status", "Check again when the Re-entry Cloud service is available.");
+      ui.next(cliCommand("status"), "Check again when the Re-entry Cloud service is available.");
     } else {
       ui.complete("Everything looks good", "Re-entry is ready for approved work.");
-      ui.next("re-entry listen", "Watch live activity. Press Ctrl+C when you are done.");
+      ui.next(cliCommand("listen"), "Watch live activity. Press Ctrl+C when you are done.");
     }
   } else {
     process.stdout.write(`${JSON.stringify({
@@ -403,6 +428,7 @@ async function status(flags, ui) {
       connector_id: credentials?.connector_id ?? null,
       receiver_origin: credentials?.receiver_origin ?? null,
       receiver_ready: receiverReady,
+      credential_expired: credentialExpired,
       service_installed: service.installed,
       service_running: service.running,
       codex_binary: readiness.installation.executable,
@@ -421,20 +447,28 @@ async function listen(flags, ui) {
     filename: defaultCredentialFile(),
   }).load();
   const reauthorizationRequired = await hasConnectorReauthorizationRequired(defaultCredentialFile());
-  if (reauthorizationRequired || !service.running || !credentials) {
+  const credentialExpired = Boolean(
+    credentials && Date.parse(credentials.connector_expires_at) <= Date.now(),
+  );
+  if (reauthorizationRequired || credentialExpired || !service.running || !credentials) {
     if (ui.interactive) {
       if (reauthorizationRequired) {
-        ui.warning("Account", "reconnect required; the Cloud Receiver rejected this Mac");
-        ui.next("re-entry connect", "Approve this Mac again in your browser.");
+        ui.warning("Account", "disconnect required; the Cloud Receiver rejected this Mac");
+        ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
+      }
+      if (credentialExpired) {
+        ui.warning("Account", "connection expired");
+        ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
       }
       if (!credentials) ui.warning("Account", "not connected");
       if (!service.running) ui.warning("Background", "not running");
-      ui.next("re-entry install", "Finish setup and start the background Connector.");
+      ui.next(cliCommand("install"), "Finish setup and start the background Connector.");
     } else {
       process.stdout.write(`${JSON.stringify({
         event: "connector_listener_unavailable",
         connected: Boolean(credentials),
         reauthorization_required: reauthorizationRequired,
+        credential_expired: credentialExpired,
         service_running: service.running,
       })}\n`);
     }
@@ -494,7 +528,7 @@ async function testCodex(flags, positionals, ui) {
   if (ui.interactive) {
     ui.stopWait("Codex", "completed the local test");
     ui.complete("Test passed", "The same fresh-session process seam is ready for Re-entry work.");
-    ui.next("re-entry listen", "Watch the background Connector for approved work.");
+    ui.next(cliCommand("listen"), "Watch the background Connector for approved work.");
   } else {
     process.stdout.write('{"event":"connector_codex_test_passed"}\n');
   }
@@ -511,7 +545,7 @@ function reportLiveActivity(event, ui) {
     );
   } else if (event.event === "connector_reauthorization_required" || event.code === "connector_identity_invalid") {
     ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
-    ui.next("re-entry connect", "Approve this Mac again in your browser.");
+    ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
     return;
   } else if (event.event === "connector_poll_failed" || event.event === "local_connector_failed") {
     ui.stopWait("Connection interrupted", "Re-entry is retrying", "warning");
@@ -534,7 +568,7 @@ async function stop(flags, ui) {
     if (!result.supported) ui.warning("Platform", "background service control currently supports macOS only");
     else if (result.stopped) ui.complete("Re-entry is paused", "Your account connection is still saved.");
     else ui.info("Already stopped", "no running background Connector was found");
-    if (result.supported) ui.next("re-entry install", "Start Re-entry in the background again.");
+    if (result.supported) ui.next(cliCommand("install"), "Start Re-entry in the background again.");
   } else {
     process.stdout.write(`${JSON.stringify({
       event: "connector_stopped",
@@ -544,6 +578,32 @@ async function stop(flags, ui) {
   }
 }
 
+async function disconnect(flags, ui) {
+  if (ui.interactive) {
+    ui.begin("Disconnect Re-entry", "Stop background delivery and clear this Mac's saved connection");
+  }
+  const result = await disconnectMacConnectorService({
+    credentialFile: flags["credential-file"] ?? defaultCredentialFile(),
+  });
+  if (ui.interactive) {
+    if (!result.supported) {
+      ui.warning("Platform", "connection lifecycle control currently supports macOS only");
+    } else if (result.disconnected) {
+      ui.complete("This Mac is disconnected", "The LaunchAgent and local Connector credential are cleared.");
+    } else {
+      ui.info("Already disconnected", "No saved local connection or background service was found.");
+    }
+    if (result.supported) ui.next(cliCommand("install"), "Connect this Mac to one Re-entry account again.");
+  } else {
+    process.stdout.write(`${JSON.stringify({
+      event: "connector_disconnected",
+      supported: result.supported,
+      disconnected: result.disconnected,
+      removed_paths: result.removedPaths,
+    })}\n`);
+  }
+}
+
 async function uninstall(flags, ui) {
   if (ui.interactive) {
     ui.begin("Uninstall Re-entry", "Stop the Connector and remove only its local service data");
@@ -557,7 +617,7 @@ async function uninstall(flags, ui) {
   });
   if (ui.interactive) {
     ui.complete("Removed from this Mac", "The local service, connection, and logs are gone.");
-    ui.next("npx @4xeoz/re-entry install", "Connect this Mac again whenever you are ready.");
+    ui.next(cliCommand("install"), "Connect this Mac again whenever you are ready.");
   } else {
     process.stdout.write(`${JSON.stringify({
       event: "connector_uninstalled",
@@ -589,7 +649,7 @@ async function install(flags, ui) {
   if (ui.interactive) {
     ui.stopWait("Background", "running at login");
     ui.complete("You're all set", "Re-entry is connected and waiting for approved work.");
-    ui.next("re-entry listen", "Watch live activity. Press Ctrl+C when you are done.");
+    ui.next(cliCommand("listen"), "Watch live activity. Press Ctrl+C when you are done.");
   } else {
     process.stdout.write(`${JSON.stringify({
       event: "connector_service_installed",
@@ -627,8 +687,8 @@ async function start(flags, ui) {
     credentials = await connect(runtimeFlags, ui, { quietHeader: true });
   } else if (await hasConnectorReauthorizationRequired(credentialFile)) {
     if (ui.interactive) {
-      ui.warning("Account", "this Mac needs to be connected again");
-      ui.next("re-entry connect", "Create a new dashboard pairing code and connect this Mac again.");
+      ui.warning("Account", "this Mac must be disconnected before reconnecting");
+      ui.next(cliCommand("disconnect"), "Clear the saved connection, then run install again.");
     } else {
       process.stdout.write('{"event":"connector_reauthorization_required"}\n');
     }
@@ -674,7 +734,7 @@ async function start(flags, ui) {
           });
           if (ui.interactive) {
             ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
-            ui.next("re-entry connect", "Approve this Mac again in your browser.");
+            ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
           } else {
             process.stdout.write('{"event":"connector_reauthorization_required"}\n');
           }
@@ -866,6 +926,7 @@ function validateCommandFlags(command, flags, positionals) {
     listen: new Set(["json"]),
     test: new Set(["codex-cd", "codex-binary", "activation-timeout", "json"]),
     stop: new Set(["json"]),
+    disconnect: new Set(["credential-file", "json"]),
     uninstall: new Set(["credential-file", "yes", "json"]),
     install: new Set([
       "receiver",
@@ -1038,15 +1099,16 @@ function errorHint(error) {
     connector_codex_cd_missing: "pass --codex-cd /absolute/path/to/your/Host-project",
     connector_codex_not_found: "install Codex, add it to PATH, or pass --codex-binary /path/to/codex",
     connector_codex_binary_not_found: "check --codex-binary or remove it to use automatic discovery",
-    connector_codex_unusable: "open Codex, complete login if needed, then run `npm run doctor` again",
+    connector_codex_unusable: `open Codex, complete login if needed, then run \`${cliCommand("doctor")}\` again`,
     connector_node_unsupported: "use Node.js 24 or newer, then run the command again",
     connector_receiver_missing: "pass --receiver <replacement-receiver-origin> or set REENTRY_RECEIVER_ORIGIN",
-    connector_credentials_missing: "connect this Mac once with `re-entry connect`",
-    connector_credentials_expired: "run `re-entry connect` to authorize this Mac again",
+    connector_credentials_missing: `connect this Mac once with \`${cliCommand("connect")}\``,
+    connector_credentials_expired: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` to authorize this Mac again`,
     connector_credentials_already_exists: "use the existing Connector credential or ask for a new pairing code",
-    connector_identity_invalid: "run `re-entry connect` and approve this Mac again",
-    connector_reauthorization_required: "run `re-entry connect` and approve this Mac again",
-    connector_pairing_code_missing: "ask the Host backend for a new pairing code, then run pair in a terminal",
+    connector_account_already_connected: `run \`${cliCommand("disconnect")}\` before connecting a different account or Receiver`,
+    connector_identity_invalid: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` and approve this Mac again`,
+    connector_reauthorization_required: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` and approve this Mac again`,
+    connector_pairing_code_missing: `ask the Host backend for a new pairing code, then run \`${cliCommand("pair")}\` in a terminal`,
     pairing_code_invalid: "use the 16-character code returned by the Host, for example ABCD-EFGH-IJKL-MNOP",
     host_subject_already_paired: "use the existing Connector credential or revoke/reset the preview pairing",
     pairing_expired: "ask the Host backend for a new pairing code",
@@ -1054,14 +1116,14 @@ function errorHint(error) {
     pairing_network_error: "check your internet connection and the Receiver address, then try again",
     workspace_directory_unavailable: "choose a readable folder or pass --codex-cd /absolute/path",
     workspace_selection_cancelled: "run the command again when you are ready to choose a workspace",
-    device_authorization_expired: "run `re-entry connect` again and approve within ten minutes",
-    device_authorization_denied: "run `re-entry connect` again when you are ready to approve this Mac",
+    device_authorization_expired: `run \`${cliCommand("connect")}\` again and approve within ten minutes`,
+    device_authorization_denied: `run \`${cliCommand("connect")}\` again when you are ready to approve this Mac`,
     connector_poll_interval_invalid: "use a polling interval between 1000 and 60000 milliseconds",
     connector_max_errors_invalid: "use a maximum error count between 1 and 20",
-    connector_service_load_failed: "run `re-entry install` again; if it still fails, inspect the Connector error log",
-    connector_uninstall_confirmation_required: "run uninstall interactively and type DELETE, or pass `--yes` in a deliberate script",
-    connector_service_stop_failed: "check the Connector status and try `re-entry stop` again",
-    connector_test_prompt_missing: "use `re-entry test \"Reply with: Re-entry is working.\"`",
+    connector_service_load_failed: `run \`${cliCommand("install")}\` again; if it still fails, inspect the Connector error log`,
+    connector_uninstall_confirmation_required: `run \`${cliCommand("uninstall")}\` interactively and type DELETE, or pass \`--yes\` in a deliberate script`,
+    connector_service_stop_failed: `check the Connector status and try \`${cliCommand("stop")}\` again`,
+    connector_test_prompt_missing: `use \`${cliCommand('test "Reply with: Re-entry is working."')}\``,
     connector_test_prompt_invalid: "use one short, single-line prompt inside quotes",
     connector_activation_timeout_invalid: "use an activation timeout between 100 and 60000 milliseconds",
   };