@4xeoz/re-entry 0.2.14 → 0.2.16

package/README.md

@@ -2,8 +2,9 @@
 
 > **Cloud Receiver dependency notice — 2026-09-02:** The former `re-entry-weld.vercel.app` Cloud
 > Receiver is deprecated and must not be used for new pairing, credentials, or production traffic.
-> This Connector package remains a reusable/local preview surface, but a new Receiver origin must
-> be supplied explicitly by an accepted replacement service.
+> This Connector package remains a reusable/local preview surface and defaults to the accepted
+> preview origin `https://cloud-receiver-delta.vercel.app`; pass `--receiver` for another accepted
+> Receiver. This preview default is not a production deployment.
 
 Install it once on the Mac where Codex should open; after one dashboard pairing code, a macOS
 LaunchAgent keeps the outbound Connector running at login.
@@ -18,8 +19,7 @@ Requirements: macOS, Node.js 24+, Codex installed and signed in, and an absolute
 Codex may read and write.
 
 ```sh
-npx --yes --package=@4xeoz/re-entry re-entry install \
-  --receiver https://your-accepted-receiver.example
+npx --yes --package=@4xeoz/re-entry re-entry install
 ```
 
 `npx` runs a temporary copy, so it does not leave a permanent shell command behind. Install the
@@ -33,16 +33,16 @@ The package installs both `re-entry` and the older `reentry` spelling; `re-entry
 command. If you keep using the temporary `npx` form, run later commands with the same executable
 prefix, for example `npx --yes --package=@4xeoz/re-entry re-entry status`.
 
-The CLI no longer has a default hosted Receiver. For any new or historical test, pass an explicit
-accepted Receiver origin with `--receiver` or `REENTRY_RECEIVER_ORIGIN`; the former
-`https://re-entry-weld.vercel.app` alias is retired.
+The CLI defaults to the current Cloud Receiver v2 preview at
+`https://cloud-receiver-delta.vercel.app`. Override it with `--receiver` or
+`REENTRY_RECEIVER_ORIGIN` when using another accepted Receiver. This preview default is not a
+production deployment.
 
 The interactive CLI first offers Desktop, the current folder, or a small folder browser. Choose
 with ↑/↓ and Enter. If you want to skip the picker, pass the workspace directly:
 
 ```sh
 npx --yes --package=@4xeoz/re-entry re-entry install \
-  --receiver https://your-accepted-receiver.example \
   --codex-cd /absolute/path/to/your/project
 ```
 
@@ -60,7 +60,6 @@ installation instead:
 ```sh
 npm install --global @4xeoz/re-entry
 re-entry install \
-  --receiver https://your-accepted-receiver.example \
   --codex-cd /absolute/path/to/your/project
 ```
 
@@ -98,6 +97,7 @@ re-entry status
 re-entry listen
 re-entry --help
 re-entry stop
+re-entry disconnect
 re-entry uninstall
 ```
 
@@ -108,14 +108,15 @@ npx --yes --package=@4xeoz/re-entry re-entry status
 npx --yes --package=@4xeoz/re-entry re-entry listen
 npx --yes --package=@4xeoz/re-entry re-entry --help
 npx --yes --package=@4xeoz/re-entry re-entry stop
+npx --yes --package=@4xeoz/re-entry re-entry disconnect
 npx --yes --package=@4xeoz/re-entry re-entry uninstall
 ```
 
 The status view checks the local authorization, background job, Receiver reachability, Node, and
 Codex. If the Receiver rejects a previously saved device credential, the Connector pauses instead
-of retrying forever, and `status`/`listen` print an executable `connect` command. `listen` watches the
-already-running background Connector and displays new activity until you press Ctrl+C; it does not
-start a competing second poller. Useful development commands are:
+of retrying forever, and `status`/`listen` tell you to disconnect before reconnecting. `listen` watches
+the already-running background Connector and displays new activity until you press Ctrl+C; it does
+not start a competing second poller. Useful development commands are:
 
 ```sh
 npx --yes --package=@4xeoz/re-entry re-entry doctor --codex-cd /absolute/path/to/project
@@ -137,6 +138,7 @@ To pause or remove the local Connector:
 
 ```sh
 npx --yes --package=@4xeoz/re-entry re-entry stop
+npx --yes --package=@4xeoz/re-entry re-entry disconnect
 npx --yes --package=@4xeoz/re-entry re-entry uninstall
 ```
 
@@ -145,9 +147,23 @@ typing `DELETE`, then removes only the LaunchAgent, saved Connector credential,
 It does not recursively delete folders or uninstall the npm package. To remove a global npm
 installation separately, run `npm uninstall --global @4xeoz/re-entry`.
 
-`connect` repeats only account authorization. `install` is the normal product path because it also
-installs the background job. `claim-once` is the smallest manual delivery test. The legacy
-Host-code `pair` command remains only for compatibility tests.
+`disconnect` is the simple local sign-out: it stops the LaunchAgent, removes the saved Connector
+credential, and leaves the log files in place. It is safe to run again when already disconnected.
+The current CLI does not have a server-side revoke route, so this command does not remove the Mac
+from the account's remote device list; use the account dashboard's revoke/decommission action when
+that Receiver operation is available, or wait for the remote credential to expire. `uninstall` is
+the stronger local cleanup and also removes Connector logs.
+
+Each credential file accepts one connection at a time. Repeating `connect` or `install` with the
+same saved connection returns `already connected`; an expired, rejected, or different-Receiver
+connection is not silently replaced. Run `disconnect`, then `install`, to connect this Mac to a
+different account or Receiver. `connect` repeats only account authorization, while `install` is the
+normal product path because it also installs the background job. `claim-once` is the smallest manual
+delivery test. The legacy Host-code `pair` command follows the same one-connection rule and remains
+only for compatibility tests.
+
+`Ctrl+C` stops a foreground `start` process or closes the `listen` view. It does not remove the
+saved connection; use `stop` to pause the background service or `disconnect` to clear it.
 
 ## Give this to a coding agent
 
@@ -222,6 +238,7 @@ the npm account that owns the `4xeoz` scope, publish from this directory:
 ```sh
 npm login
 npm whoami
+npm view @4xeoz/re-entry version
 npm version patch --no-git-tag-version
 npm run verify
 npm publish --access public
@@ -232,7 +249,8 @@ publishing with `npm version patch --no-git-tag-version`.
 
 After publishing, users run `npx --yes --package=@4xeoz/re-entry re-entry install`. The explicit
 `--package` form works across npm versions when the package is scoped; the executable itself is
-still named `re-entry`.
+still named `re-entry`. The command uses the built-in preview Receiver unless `--receiver` or
+`REENTRY_RECEIVER_ORIGIN` overrides it.
 
 A temporary `npx` invocation does not add `re-entry` to your shell `PATH`. If you prefer the shorter
 bare commands, run `npm install --global @4xeoz/re-entry` once and then use `re-entry install`

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@4xeoz/re-entry",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "type": "module",
-  "description": "Outbound Local Connector process for Re-entry Core; new Receiver origins must be explicit.",
+  "description": "Outbound Local Connector process for Re-entry Core; uses the Cloud Receiver v2 preview by default with an explicit override for other accepted origins.",
   "publishConfig": {
     "access": "public"
   },

package/src/macos-service.mjs

@@ -113,6 +113,30 @@ export async function stopMacConnectorService(options = {}) {
   return Object.freeze({ ...status, stopped: true, running: false });
 }
 
+export async function disconnectMacConnectorService(options = {}) {
+  const configuration = requireServiceConfiguration(options, "disconnect");
+  if (process.platform !== "darwin" && configuration.allowNonMacForTest !== true) {
+    return Object.freeze({ supported: false, disconnected: false, removedPaths: [] });
+  }
+  const service = await stopMacConnectorService(configuration);
+  const stateDirectory = configuration.stateDirectory ?? join(homedir(), ".webmcp-connector");
+  const credentialFile = requireAbsolutePath(
+    configuration.credentialFile ?? join(stateDirectory, "credentials.json"),
+    "Credential file",
+  );
+  const removedPaths = await removePaths([
+    service.plistPath,
+    credentialFile,
+    `${credentialFile}.reauthorization-required.json`,
+  ], "disconnect");
+  return Object.freeze({
+    supported: true,
+    disconnected: removedPaths.length > 0,
+    removedPaths,
+    plistPath: service.plistPath,
+  });
+}
+
 export async function uninstallMacConnectorService(options = {}) {
   const configuration = requireServiceConfiguration(options, "uninstall");
   if (process.platform !== "darwin" && configuration.allowNonMacForTest !== true) {
@@ -131,22 +155,28 @@ export async function uninstallMacConnectorService(options = {}) {
     join(stateDirectory, "connector.log"),
     join(stateDirectory, "connector-error.log"),
   ])];
+  const removedPaths = await removePaths(paths, "uninstall");
+  return Object.freeze({
+    supported: true,
+    removedPaths,
+    plistPath: service.plistPath,
+  });
+}
+
+async function removePaths(paths, operation) {
   const removedPaths = [];
-  for (const path of paths) {
+  for (const path of [...new Set(paths)]) {
+    if (typeof path !== "string") continue;
     try {
       await unlink(path);
       removedPaths.push(path);
     } catch (error) {
       if (error?.code !== "ENOENT") {
-        throw serviceFailure("connector_service_remove_failed", "Connector data could not be removed", error);
+        throw serviceFailure("connector_service_remove_failed", `Connector data could not be removed during ${operation}`, error);
       }
     }
   }
-  return Object.freeze({
-    supported: true,
-    removedPaths,
-    plistPath: service.plistPath,
-  });
+  return removedPaths;
 }
 
 export function renderLaunchAgent(options) {

package/src/main.mjs

@@ -28,15 +28,17 @@ import { LocalConnectorPairingClient, openBrowser } from "./pairing-client.mjs";
 import { chooseWorkspaceDirectory } from "./workspace-picker.mjs";
 import {
   inspectMacConnectorService,
+  disconnectMacConnectorService,
   installMacConnectorService,
   stopMacConnectorService,
   uninstallMacConnectorService,
 } from "./macos-service.mjs";
 import { createTerminalUi } from "./terminal-ui.mjs";
 
-// The former hosted Cloud Receiver is retired. New pairing must name an accepted replacement
-// explicitly instead of silently sending credentials to the old deployment alias.
-const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN;
+// This is the current Cloud Receiver v2 preview. A command-line --receiver override remains
+// authoritative, and REENTRY_RECEIVER_ORIGIN can override this built-in preview default.
+const BUILT_IN_RECEIVER_ORIGIN = "https://cloud-receiver-delta.vercel.app";
+const DEFAULT_RECEIVER_ORIGIN = process.env.REENTRY_RECEIVER_ORIGIN?.trim() || BUILT_IN_RECEIVER_ORIGIN;
 const DEFAULT_POLL_INTERVAL_MS = 5_000;
 const DEFAULT_MAX_CONSECUTIVE_ERRORS = 5;
 const DEFAULT_PAIRING_REQUEST_TIMEOUT_MS = 20_000;
@@ -88,6 +90,10 @@ async function main() {
       await stop(flags, ui);
       return;
     }
+    if (command === "disconnect") {
+      await disconnect(flags, ui);
+      return;
+    }
     if (command === "uninstall") {
       await uninstall(flags, ui);
       return;
@@ -129,6 +135,7 @@ Connect this Mac once, then receive approved work in Codex in the background.
 Usage:
   re-entry install                                      Recommended first run
   re-entry listen                                      Watch live activity
+  re-entry disconnect                                  Sign out this Mac locally
   re-entry test "Reply with hello"                     Test Codex locally
 
 Invocation:
@@ -141,6 +148,7 @@ Commands:
   listen       Watch the background Connector until you press Ctrl+C
   test         Start one fresh local Codex session with the supplied prompt
   stop         Stop the background Connector without removing its credential
+  disconnect   Stop the Connector and clear this Mac's saved connection
   uninstall    Stop the Connector and remove its local service data
   connect      Open Re-entry, redeem a dashboard pairing code, and connect this Mac
   start        Poll for approved work until stopped
@@ -149,7 +157,7 @@ Commands:
   pair         Legacy Host-code pairing preview
 
 Common options:
-  --receiver <url>       Accepted Receiver origin (required when pairing a new Mac)
+  --receiver <url>       Accepted Receiver origin (overrides the preview default)
   --codex-cd <path>      Workspace for Codex; interactive mode offers a folder picker if omitted
   --codex-binary <path>  Explicit Codex executable
   --json                 Machine-readable output
@@ -157,6 +165,10 @@ Common options:
   --help                 Show this help
   --version              Show the installed version
 
+Default Receiver:
+  https://cloud-receiver-delta.vercel.app
+  Override with --receiver or REENTRY_RECEIVER_ORIGIN for another accepted Receiver.
+
 Both commands are installed: re-entry and reentry.
 The Connector opens no inbound port. Host keys never belong on this Mac.
 `);
@@ -239,6 +251,8 @@ async function pair(flags, ui, options = {}) {
   }
   const receiver = requireFlag(flags, "receiver");
   const credentialFile = flags["credential-file"] ?? defaultCredentialFile();
+  const store = new LocalConnectorCredentialStore({ filename: credentialFile });
+  if (await store.load()) throw cliFailure("connector_account_already_connected");
   if (ui.interactive) {
     ui.step("Receiver", receiver);
   }
@@ -265,7 +279,6 @@ async function pair(flags, ui, options = {}) {
       ui.warning("Browser", "did not open automatically; use the URL above");
     }
   }
-  const store = new LocalConnectorCredentialStore({ filename: credentialFile });
   await store.save({
     version: 1,
     receiver_origin: receiver,
@@ -310,9 +323,7 @@ async function connect(flags, ui, options = {}) {
     return current;
   }
 
-  if (currentIsValid && ui.interactive) {
-    ui.warning("Receiver changed", `${current.receiver_origin} → ${receiver}; approve this Mac again`);
-  }
+  if (current) throw cliFailure("connector_account_already_connected");
 
   if (ui.interactive) {
     if (!options.guidedInstall) ui.info("Re-entry", displayReceiver(receiver));
@@ -381,11 +392,15 @@ async function status(flags, ui) {
     Date.parse(credentials.connector_expires_at) > Date.now() &&
     !reauthorizationRequired,
   );
+  const credentialExpired = Boolean(
+    credentials && Date.parse(credentials.connector_expires_at) <= Date.now(),
+  );
   if (ui.interactive) {
     ui.section("SYSTEM", "This Mac");
     showReadiness(readiness, ui);
     ui.section("CONNECTION", "Re-entry");
-    if (reauthorizationRequired) ui.warning("Account", "reconnect required");
+    if (reauthorizationRequired) ui.warning("Account", "disconnect required before reconnecting");
+    else if (credentialExpired) ui.warning("Account", "connection expired; disconnect before reconnecting");
     else if (connected) ui.success("Account", "connected");
     else ui.warning("Account", "not connected");
     if (reauthorizationRequired && service.running) ui.warning("Background", "paused until this Mac is reconnected");
@@ -395,8 +410,8 @@ async function status(flags, ui) {
     if (receiverReady) ui.success("Cloud", "online");
     else if (credentials) ui.warning("Cloud", "unavailable");
 
-    if (reauthorizationRequired) {
-      ui.next(cliCommand("connect"), "Approve this Mac again in your browser; the old credential was rejected.");
+    if (reauthorizationRequired || credentialExpired) {
+      ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install to connect again.");
     } else if (!connected || !service.running) {
       ui.next(cliCommand("install"), "Finish setup and start Re-entry in the background.");
     } else if (!receiverReady) {
@@ -413,6 +428,7 @@ async function status(flags, ui) {
       connector_id: credentials?.connector_id ?? null,
       receiver_origin: credentials?.receiver_origin ?? null,
       receiver_ready: receiverReady,
+      credential_expired: credentialExpired,
       service_installed: service.installed,
       service_running: service.running,
       codex_binary: readiness.installation.executable,
@@ -431,11 +447,18 @@ async function listen(flags, ui) {
     filename: defaultCredentialFile(),
   }).load();
   const reauthorizationRequired = await hasConnectorReauthorizationRequired(defaultCredentialFile());
-  if (reauthorizationRequired || !service.running || !credentials) {
+  const credentialExpired = Boolean(
+    credentials && Date.parse(credentials.connector_expires_at) <= Date.now(),
+  );
+  if (reauthorizationRequired || credentialExpired || !service.running || !credentials) {
     if (ui.interactive) {
       if (reauthorizationRequired) {
-        ui.warning("Account", "reconnect required; the Cloud Receiver rejected this Mac");
-        ui.next(cliCommand("connect"), "Approve this Mac again in your browser.");
+        ui.warning("Account", "disconnect required; the Cloud Receiver rejected this Mac");
+        ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
+      }
+      if (credentialExpired) {
+        ui.warning("Account", "connection expired");
+        ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
       }
       if (!credentials) ui.warning("Account", "not connected");
       if (!service.running) ui.warning("Background", "not running");
@@ -445,6 +468,7 @@ async function listen(flags, ui) {
         event: "connector_listener_unavailable",
         connected: Boolean(credentials),
         reauthorization_required: reauthorizationRequired,
+        credential_expired: credentialExpired,
         service_running: service.running,
       })}\n`);
     }
@@ -521,7 +545,7 @@ function reportLiveActivity(event, ui) {
     );
   } else if (event.event === "connector_reauthorization_required" || event.code === "connector_identity_invalid") {
     ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
-    ui.next(cliCommand("connect"), "Approve this Mac again in your browser.");
+    ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
     return;
   } else if (event.event === "connector_poll_failed" || event.event === "local_connector_failed") {
     ui.stopWait("Connection interrupted", "Re-entry is retrying", "warning");
@@ -554,6 +578,32 @@ async function stop(flags, ui) {
   }
 }
 
+async function disconnect(flags, ui) {
+  if (ui.interactive) {
+    ui.begin("Disconnect Re-entry", "Stop background delivery and clear this Mac's saved connection");
+  }
+  const result = await disconnectMacConnectorService({
+    credentialFile: flags["credential-file"] ?? defaultCredentialFile(),
+  });
+  if (ui.interactive) {
+    if (!result.supported) {
+      ui.warning("Platform", "connection lifecycle control currently supports macOS only");
+    } else if (result.disconnected) {
+      ui.complete("This Mac is disconnected", "The LaunchAgent and local Connector credential are cleared.");
+    } else {
+      ui.info("Already disconnected", "No saved local connection or background service was found.");
+    }
+    if (result.supported) ui.next(cliCommand("install"), "Connect this Mac to one Re-entry account again.");
+  } else {
+    process.stdout.write(`${JSON.stringify({
+      event: "connector_disconnected",
+      supported: result.supported,
+      disconnected: result.disconnected,
+      removed_paths: result.removedPaths,
+    })}\n`);
+  }
+}
+
 async function uninstall(flags, ui) {
   if (ui.interactive) {
     ui.begin("Uninstall Re-entry", "Stop the Connector and remove only its local service data");
@@ -637,8 +687,8 @@ async function start(flags, ui) {
     credentials = await connect(runtimeFlags, ui, { quietHeader: true });
   } else if (await hasConnectorReauthorizationRequired(credentialFile)) {
     if (ui.interactive) {
-      ui.warning("Account", "this Mac needs to be connected again");
-      ui.next(cliCommand("connect"), "Create a new dashboard pairing code and connect this Mac again.");
+      ui.warning("Account", "this Mac must be disconnected before reconnecting");
+      ui.next(cliCommand("disconnect"), "Clear the saved connection, then run install again.");
     } else {
       process.stdout.write('{"event":"connector_reauthorization_required"}\n');
     }
@@ -684,7 +734,7 @@ async function start(flags, ui) {
           });
           if (ui.interactive) {
             ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
-            ui.next(cliCommand("connect"), "Approve this Mac again in your browser.");
+            ui.next(cliCommand("disconnect"), "Clear this Mac's saved connection, then run install again.");
           } else {
             process.stdout.write('{"event":"connector_reauthorization_required"}\n');
           }
@@ -876,6 +926,7 @@ function validateCommandFlags(command, flags, positionals) {
     listen: new Set(["json"]),
     test: new Set(["codex-cd", "codex-binary", "activation-timeout", "json"]),
     stop: new Set(["json"]),
+    disconnect: new Set(["credential-file", "json"]),
     uninstall: new Set(["credential-file", "yes", "json"]),
     install: new Set([
       "receiver",
@@ -1052,10 +1103,11 @@ function errorHint(error) {
     connector_node_unsupported: "use Node.js 24 or newer, then run the command again",
     connector_receiver_missing: "pass --receiver <replacement-receiver-origin> or set REENTRY_RECEIVER_ORIGIN",
     connector_credentials_missing: `connect this Mac once with \`${cliCommand("connect")}\``,
-    connector_credentials_expired: `run \`${cliCommand("connect")}\` to authorize this Mac again`,
+    connector_credentials_expired: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` to authorize this Mac again`,
     connector_credentials_already_exists: "use the existing Connector credential or ask for a new pairing code",
-    connector_identity_invalid: `run \`${cliCommand("connect")}\` and approve this Mac again`,
-    connector_reauthorization_required: `run \`${cliCommand("connect")}\` and approve this Mac again`,
+    connector_account_already_connected: `run \`${cliCommand("disconnect")}\` before connecting a different account or Receiver`,
+    connector_identity_invalid: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` and approve this Mac again`,
+    connector_reauthorization_required: `run \`${cliCommand("disconnect")}\`, then \`${cliCommand("install")}\` and approve this Mac again`,
     connector_pairing_code_missing: `ask the Host backend for a new pairing code, then run \`${cliCommand("pair")}\` in a terminal`,
     pairing_code_invalid: "use the 16-character code returned by the Host, for example ABCD-EFGH-IJKL-MNOP",
     host_subject_already_paired: "use the existing Connector credential or revoke/reset the preview pairing",