@4xeoz/re-entry 0.2.6 → 0.2.7

package/README.md

@@ -89,8 +89,10 @@ re-entry --help
 ```
 
 The status view checks the local authorization, background job, Receiver reachability, Node, and
-Codex. `listen` watches the already-running background Connector and displays new activity until
-you press Ctrl+C; it does not start a competing second poller. Useful development commands are:
+Codex. If the Receiver rejects a previously saved device credential, the Connector pauses instead
+of retrying forever, and `status`/`listen` tell you to run `re-entry connect` again. `listen` watches
+the already-running background Connector and displays new activity until you press Ctrl+C; it does
+not start a competing second poller. Useful development commands are:
 
 ```sh
 re-entry doctor --codex-cd /absolute/path/to/project

package/node_modules/@webmcp-challenge/reentry-core/src/cloud-receiver-http.mjs

@@ -42,7 +42,7 @@ export function createCloudReceiverHttpHandler(options) {
   requireReceiver(options.receiver);
 
   return function cloudReceiverHttpHandler(request, response) {
-    handleRequest(options.receiver, request, response).catch((error) => {
+    return handleRequest(options.receiver, request, response).catch((error) => {
       if (response.destroyed) return;
       if (response.headersSent) {
         response.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4xeoz/re-entry",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "type": "module",
   "description": "Outbound Local Connector process for the Re-entry Core local preview.",
   "publishConfig": {

package/src/credentials.mjs

@@ -49,6 +49,48 @@ export class LocalConnectorCredentialStore {
   }
 }
 
+export function reauthorizationMarkerPath(filename) {
+  if (typeof filename !== "string" || filename.length === 0) {
+    throw new TypeError("Credential filename is required");
+  }
+  return `${filename}.reauthorization-required.json`;
+}
+
+export async function markConnectorReauthorizationRequired(filename, value = {}) {
+  const marker = reauthorizationMarkerPath(filename);
+  await mkdir(dirname(marker), { recursive: true, mode: 0o700 });
+  await writeFile(marker, `${JSON.stringify({
+    receiver_origin: value.receiver_origin ?? null,
+    reason: "connector_identity_invalid",
+    observed_at: new Date().toISOString(),
+  })}\n`, { encoding: "utf8", mode: 0o600 });
+  await chmod(marker, 0o600);
+}
+
+export async function hasConnectorReauthorizationRequired(filename) {
+  try {
+    await readFile(reauthorizationMarkerPath(filename), "utf8");
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw credentialFailure(
+      "connector_status_unreadable",
+      "Connector authorization status could not be read",
+      error,
+    );
+  }
+}
+
+export async function clearConnectorReauthorizationRequired(filename) {
+  await unlink(reauthorizationMarkerPath(filename)).catch((error) => {
+    if (error?.code !== "ENOENT") throw credentialFailure(
+      "connector_status_unwritable",
+      "Connector authorization status could not be cleared",
+      error,
+    );
+  });
+}
+
 function normalizeCredentials(value) {
   requireExactRecord(value, CREDENTIAL_FIELDS, CREDENTIAL_FIELDS, "Connector credentials");
   if (value.version !== 1) throw credentialFailure("connector_credentials_invalid", "Connector credential version is unsupported");

package/src/macos-service.mjs

@@ -91,7 +91,7 @@ export async function inspectMacConnectorService(options = {}) {
   return Object.freeze({
     supported: true,
     installed: true,
-    running: result.code === 0,
+    running: result.code === 0 && isLoadedAndRunning(result.stdout),
     plistPath,
   });
 }
@@ -127,6 +127,7 @@ export async function uninstallMacConnectorService(options = {}) {
   const paths = [...new Set([
     service.plistPath,
     credentialFile,
+    `${credentialFile}.reauthorization-required.json`,
     join(stateDirectory, "connector.log"),
     join(stateDirectory, "connector-error.log"),
   ])];
@@ -192,6 +193,7 @@ ${argumentsXml}
 function runLaunchctl(argumentsList) {
   return new Promise((resolve) => {
     const child = spawn("launchctl", argumentsList, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
     let stderr = "";
     let settled = false;
     const finish = (result) => {
@@ -199,15 +201,29 @@ function runLaunchctl(argumentsList) {
       settled = true;
       resolve(result);
     };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (stdout.length < 16_384) stdout += chunk;
+    });
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (chunk) => {
       if (stderr.length < 4_096) stderr += chunk;
     });
-    child.once("error", (error) => finish({ code: -1, stderr: error.message }));
-    child.once("close", (code) => finish({ code: code ?? -1, stderr }));
+    child.once("error", (error) => finish({ code: -1, stdout, stderr: error.message }));
+    child.once("close", (code) => finish({ code: code ?? -1, stdout, stderr }));
   });
 }
 
+function isLoadedAndRunning(stdout) {
+  // Test doubles historically return only { code: 0 }; preserve that contract while
+  // treating launchctl's explicit not-running state as stopped in production.
+  if (stdout === undefined) return true;
+  const state = stdout.match(/^[\t ]*state\s*=\s*([^\r\n]+)$/m)?.[1]?.trim();
+  if (state) return state === "running";
+  const activeCount = stdout.match(/^[\t ]*active count\s*=\s*(\d+)$/m)?.[1];
+  return activeCount !== undefined && Number(activeCount) > 0;
+}
+
 function requireServiceConfiguration(options, operation) {
   if (!options || typeof options !== "object" || Array.isArray(options)) {
     throw serviceFailure("connector_service_input_invalid", `Service ${operation} options are invalid`);

package/src/main.mjs

@@ -18,7 +18,12 @@ import {
   verifyCodexExecutable,
 } from "./codex-discovery.mjs";
 import { LocalConnector } from "./local-connector.mjs";
-import { LocalConnectorCredentialStore } from "./credentials.mjs";
+import {
+  LocalConnectorCredentialStore,
+  clearConnectorReauthorizationRequired,
+  hasConnectorReauthorizationRequired,
+  markConnectorReauthorizationRequired,
+} from "./credentials.mjs";
 import { LocalConnectorPairingClient } from "./pairing-client.mjs";
 import { waitForEnterToOpenBrowser } from "./browser-prompt.mjs";
 import { chooseWorkspaceDirectory } from "./workspace-picker.mjs";
@@ -273,8 +278,9 @@ async function connect(flags, ui, options = {}) {
   const credentialFile = flags["credential-file"] ?? defaultCredentialFile();
   const store = new LocalConnectorCredentialStore({ filename: credentialFile });
   const current = await store.load();
+  const reauthorizationRequired = await hasConnectorReauthorizationRequired(credentialFile);
   const currentIsValid = current && Date.parse(current.connector_expires_at) > Date.now();
-  if (currentIsValid && current.receiver_origin === receiver) {
+  if (currentIsValid && current.receiver_origin === receiver && !reauthorizationRequired) {
     if (ui.interactive) {
       ui.success("Account", "already connected");
       if (!options.guidedInstall) {
@@ -333,6 +339,7 @@ async function connect(flags, ui, options = {}) {
     connector_expires_at: credentials.connector_expires_at,
   };
   await store.save(saved);
+  await clearConnectorReauthorizationRequired(credentialFile);
   if (ui.interactive) {
     if (!options.guidedInstall) {
       ui.complete("This Mac is connected", "Re-entry can now route approved work here.");
@@ -351,23 +358,32 @@ async function status(flags, ui) {
   if (ui.interactive) ui.begin("Status", "A quick check of this Mac and Re-entry.");
   const credentialFile = flags["credential-file"] ?? defaultCredentialFile();
   const credentials = await new LocalConnectorCredentialStore({ filename: credentialFile }).load();
+  const reauthorizationRequired = await hasConnectorReauthorizationRequired(credentialFile);
   const readiness = inspectReadiness(flags);
   const service = await inspectMacConnectorService();
   const receiverReady = credentials ? await inspectReceiver(credentials.receiver_origin) : false;
-  const connected = Boolean(credentials && Date.parse(credentials.connector_expires_at) > Date.now());
+  const connected = Boolean(
+    credentials &&
+    Date.parse(credentials.connector_expires_at) > Date.now() &&
+    !reauthorizationRequired,
+  );
   if (ui.interactive) {
     ui.section("SYSTEM", "This Mac");
     showReadiness(readiness, ui);
     ui.section("CONNECTION", "Re-entry");
-    if (connected) ui.success("Account", "connected");
+    if (reauthorizationRequired) ui.warning("Account", "reconnect required");
+    else if (connected) ui.success("Account", "connected");
     else ui.warning("Account", "not connected");
-    if (service.running) ui.success("Background", "running");
+    if (reauthorizationRequired && service.running) ui.warning("Background", "paused until this Mac is reconnected");
+    else if (service.running) ui.success("Background", "running");
     else if (service.installed) ui.warning("Background", "stopped");
     else ui.warning("Background", "not installed");
-    if (connected && receiverReady) ui.success("Cloud", "online");
-    else if (connected) ui.warning("Cloud", "unavailable");
+    if (receiverReady) ui.success("Cloud", "online");
+    else if (credentials) ui.warning("Cloud", "unavailable");
 
-    if (!connected || !service.running) {
+    if (reauthorizationRequired) {
+      ui.next("re-entry connect", "Approve this Mac again in your browser; the old credential was rejected.");
+    } else if (!connected || !service.running) {
       ui.next("re-entry install", "Finish setup and start Re-entry in the background.");
     } else if (!receiverReady) {
       ui.next("re-entry status", "Check again when the Re-entry Cloud service is available.");
@@ -379,6 +395,7 @@ async function status(flags, ui) {
     process.stdout.write(`${JSON.stringify({
       event: "connector_status",
       connected,
+      reauthorization_required: reauthorizationRequired,
       connector_id: credentials?.connector_id ?? null,
       receiver_origin: credentials?.receiver_origin ?? null,
       receiver_ready: receiverReady,
@@ -399,8 +416,13 @@ async function listen(flags, ui) {
   const credentials = await new LocalConnectorCredentialStore({
     filename: defaultCredentialFile(),
   }).load();
-  if (!service.running || !credentials) {
+  const reauthorizationRequired = await hasConnectorReauthorizationRequired(defaultCredentialFile());
+  if (reauthorizationRequired || !service.running || !credentials) {
     if (ui.interactive) {
+      if (reauthorizationRequired) {
+        ui.warning("Account", "reconnect required; the Cloud Receiver rejected this Mac");
+        ui.next("re-entry connect", "Approve this Mac again in your browser.");
+      }
       if (!credentials) ui.warning("Account", "not connected");
       if (!service.running) ui.warning("Background", "not running");
       ui.next("re-entry install", "Finish setup and start the background Connector.");
@@ -408,6 +430,7 @@ async function listen(flags, ui) {
       process.stdout.write(`${JSON.stringify({
         event: "connector_listener_unavailable",
         connected: Boolean(credentials),
+        reauthorization_required: reauthorizationRequired,
         service_running: service.running,
       })}\n`);
     }
@@ -482,6 +505,10 @@ function reportLiveActivity(event, ui) {
       accepted ? "a fresh Codex session was started" : String(event.outcome ?? "unknown"),
       accepted ? "success" : "warning",
     );
+  } else if (event.event === "connector_reauthorization_required" || event.code === "connector_identity_invalid") {
+    ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
+    ui.next("re-entry connect", "Approve this Mac again in your browser.");
+    return;
   } else if (event.event === "connector_poll_failed" || event.event === "local_connector_failed") {
     ui.stopWait("Connection interrupted", "Re-entry is retrying", "warning");
   } else if (event.event === "connector_ready") {
@@ -594,6 +621,14 @@ async function start(flags, ui) {
   if (!credentials) {
     if (ui.interactive) ui.info("Re-entry", "first run — browser approval is required once");
     credentials = await connect(runtimeFlags, ui, { quietHeader: true });
+  } else if (await hasConnectorReauthorizationRequired(credentialFile)) {
+    if (ui.interactive) {
+      ui.warning("Account", "this Mac needs to be connected again");
+      ui.next("re-entry connect", "Approve this Mac in your browser, then start the Connector again.");
+    } else {
+      process.stdout.write('{"event":"connector_reauthorization_required"}\n');
+    }
+    return;
   } else if (ui.interactive) {
     ui.success("Re-entry", "existing account connection loaded");
   }
@@ -629,6 +664,18 @@ async function start(flags, ui) {
           if (ui.interactive) ui.wait("Connected. Waiting for approved work…");
         }
       } catch (error) {
+        if (error?.code === "connector_identity_invalid") {
+          await markConnectorReauthorizationRequired(credentialFile, {
+            receiver_origin: credentials.receiver_origin,
+          });
+          if (ui.interactive) {
+            ui.stopWait("Reconnect required", "the Cloud Receiver rejected this Mac's saved connection", "warning");
+            ui.next("re-entry connect", "Approve this Mac again in your browser.");
+          } else {
+            process.stdout.write('{"event":"connector_reauthorization_required"}\n');
+          }
+          return;
+        }
         consecutiveErrors += 1;
         if (ui.interactive) {
           ui.stopWait("Receiver unavailable", `${safeErrorMessage(error)} · ${consecutiveErrors}/${maximumErrors}`, "warning");
@@ -990,6 +1037,8 @@ function errorHint(error) {
     connector_node_unsupported: "use Node.js 24 or newer, then run the command again",
     connector_credentials_missing: "connect this Mac once with `re-entry connect`",
     connector_credentials_expired: "run `re-entry connect` to authorize this Mac again",
+    connector_identity_invalid: "run `re-entry connect` and approve this Mac again",
+    connector_reauthorization_required: "run `re-entry connect` and approve this Mac again",
     connector_pairing_code_missing: "ask the Host backend for a new pairing code, then run pair in a terminal",
     pairing_code_invalid: "use the 16-character code returned by the Host, for example ABCD-EFGH-IJKL-MNOP",
     host_subject_already_paired: "use the existing Connector credential or revoke/reset the preview pairing",