@kortix/agent-tunnel 0.13.46 → 0.13.48

package/dist/agent-cli.js

@@ -2971,7 +2971,7 @@ if (typeof globalThis.WebSocket === "undefined") {
 }
 
 // src/agent/cli.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync11, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
 import { hostname as hostname4 } from "os";
 import { join as join12 } from "path";
 
@@ -4036,6 +4036,8 @@ var LIVENESS_TIMEOUT_MS = 75000;
 var WATCHDOG_INTERVAL_MS = 5000;
 var CLOCK_JUMP_MS = 30000;
 var REJECTED_RETRY_MS = 5 * 60000;
+var PAIR_AGAIN_COMMAND = "npx @kortix/agent-tunnel@latest connect --reauth";
+var NO_LONGER_CONNECTED = "This computer is no longer connected to Kortix (disconnected, or removed after 30 days offline).";
 var STANDBY_RETRY_MS = 60000;
 var MAX_STANDBY_RETRY_MS = 30 * 60000;
 var CONNECT_DEADLINE_MS = 20000;
@@ -4196,7 +4198,7 @@ class TunnelAgent {
           this.setStatus("rejected");
           if (this.now() - this.lastRejectedLogAt >= REJECTED_LOG_EVERY_MS) {
             this.lastRejectedLogAt = this.now();
-            log(`${c.red}✗${c.reset}`, `Credential rejected — waiting for this computer to be paired again (retrying every 5 min)`);
+            log(`${c.red}✗${c.reset}`, `${NO_LONGER_CONNECTED} Connect it again from the Kortix desktop app, or run \`${PAIR_AGAIN_COMMAND}\`. Checking again every 5 min.`);
           }
           this.retryAfter(this.options.rejectedRetryMs ?? REJECTED_RETRY_MS);
           return;
@@ -4210,13 +4212,13 @@ class TunnelAgent {
         }
         if (event.code === 4001 && isCredentialRejection(event.code, event.reason)) {
           this.isShuttingDown = true;
-          log(`${c.red}✗${c.reset}`, `Credential rejected — run \`agent-tunnel connect --reauth\` to pair again`);
+          log(`${c.red}✗${c.reset}`, `${NO_LONGER_CONNECTED} Connect it again: \`${PAIR_AGAIN_COMMAND}\``);
           this.hooks.onTerminalClose?.({ code: event.code, reason: "credential-rejected" });
           return;
         }
         if (event.code === 4003) {
           this.isShuttingDown = true;
-          log(`${c.red}✗${c.reset}`, `Device credential was revoked — run \`agent-tunnel connect --reauth\` to pair again`);
+          log(`${c.red}✗${c.reset}`, `${NO_LONGER_CONNECTED} Connect it again: \`${PAIR_AGAIN_COMMAND}\``);
           this.hooks.onTerminalClose?.({ code: event.code, reason: "credential-rejected" });
           return;
         }
@@ -4256,7 +4258,7 @@ class TunnelAgent {
       this.signingKey = msg.signingKey;
       const capabilityNames = this.registry.getCapabilityNames();
       if (capabilityNames.length === 0) {
-        log(`${c.yellow}!${c.reset}`, `Connected, but no capabilities are enabled — this tunnel cannot do anything. Run \`agent-tunnel connect --reauth\` to pair again.`);
+        log(`${c.yellow}!${c.reset}`, `Connected, but no capabilities are enabled — this tunnel cannot do anything. Run \`${PAIR_AGAIN_COMMAND}\` to pair again.`);
       } else {
         log(`${c.green}●${c.reset}`, `Connected ${c.reset}${c.gray}(${capabilityNames.join(", ")})${c.reset}`);
       }
@@ -4669,9 +4671,9 @@ class CapabilityRegistry {
 
 // src/agent/capabilities/desktop/cua-driver.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync3, realpathSync, statSync as statSync2 } from "fs";
-import { homedir as homedir3, platform as platform4 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync6, realpathSync, statSync as statSync2 } from "fs";
+import { homedir as homedir3, platform as platform4, tmpdir } from "os";
+import { basename as basename2, dirname as dirname3, join as join5 } from "path";
 var MAX_DRIVER_OUTPUT_BYTES = 5 * 1024 * 1024;
 var DRIVER_ENV_KEYS = [
   "PATH",
@@ -4687,9 +4689,25 @@ var DRIVER_ENV_KEYS = [
   "XAUTHORITY",
   "DBUS_SESSION_BUS_ADDRESS"
 ];
+function driverEnvironment(extra = {}) {
+  const env = { CUA_DRIVER_RS_TELEMETRY_ENABLED: "0" };
+  for (const key of DRIVER_ENV_KEYS) {
+    if (process.env[key] !== undefined)
+      env[key] = process.env[key];
+  }
+  return { ...env, ...extra };
+}
+function bundledCuaDriverPath(agentEntry = process.argv[1]) {
+  if (!agentEntry || basename2(dirname3(agentEntry)) !== "agent-tunnel")
+    return null;
+  const exe = process.platform === "win32" ? "cua-driver.exe" : "cua-driver";
+  const candidate = join5(dirname3(dirname3(agentEntry)), "cua-driver", exe);
+  return existsSync3(candidate) ? candidate : null;
+}
 function candidateBins() {
   const candidates = [
     process.env.CUA_DRIVER_BIN,
+    bundledCuaDriverPath(),
     join5(homedir3(), ".local", "bin", process.platform === "win32" ? "cua-driver.exe" : "cua-driver"),
     "/usr/local/bin/cua-driver",
     "/opt/homebrew/bin/cua-driver"
@@ -4720,19 +4738,19 @@ function findCuaDriverBinary() {
   }
   return null;
 }
-function driverEnvironment() {
-  const env = {};
-  for (const key of DRIVER_ENV_KEYS) {
-    if (process.env[key] !== undefined)
-      env[key] = process.env[key];
+function hostBundleId() {
+  try {
+    const plist = readFileSync6(join5(dirname3(dirname3(process.execPath)), "Info.plist"), "utf8");
+    return /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/.exec(plist)?.[1] ?? "";
+  } catch {
+    return "";
   }
-  return env;
 }
-function execFile(cmd, args, timeoutMs = 30000) {
+function execFile(cmd, args, timeoutMs = 30000, env = driverEnvironment()) {
   return new Promise((resolve, reject) => {
     const proc = spawn4(cmd, args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: driverEnvironment()
+      env
     });
     let stdout = "";
     let stderr = "";
@@ -4810,8 +4828,33 @@ function sanitizeArgs(args) {
 }
 
 class CuaDriver {
-  binary = null;
+  binary;
+  embedded;
+  socketPath;
+  hostBundleId;
   daemonReady = false;
+  daemon = null;
+  constructor(options = {}) {
+    this.binary = options.binary ?? null;
+    this.embedded = options.embedded;
+    const uid = typeof process.getuid === "function" ? process.getuid() : "user";
+    this.socketPath = options.socketPath ?? join5(tmpdir(), `kortix-cua-${uid}.sock`);
+    this.hostBundleId = options.hostBundleId;
+  }
+  isEmbedded(binary) {
+    return this.embedded ?? binary === bundledCuaDriverPath();
+  }
+  mode(binary) {
+    if (!this.isEmbedded(binary))
+      return { env: driverEnvironment(), socket: [] };
+    return {
+      env: driverEnvironment({
+        CUA_DRIVER_EMBEDDED: "1",
+        CUA_DRIVER_HOST_BUNDLE_ID: this.hostBundleId ?? hostBundleId()
+      }),
+      socket: ["--socket", this.socketPath]
+    };
+  }
   async ensureInstalled() {
     if (this.binary && existsSync3(this.binary))
       return this.binary;
@@ -4824,22 +4867,23 @@ class CuaDriver {
   }
   async version() {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ["--version"], 1e4);
+    const { stdout } = await execFile(bin, ["--version"], 1e4, this.mode(bin).env);
     return stdout.trim();
   }
   async listTools() {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ["list-tools"], 1e4);
+    const { stdout } = await execFile(bin, ["list-tools"], 1e4, this.mode(bin).env);
     return stdout.trim();
   }
   async describe(tool) {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ["describe", tool], 1e4);
+    const { stdout } = await execFile(bin, ["describe", tool], 1e4, this.mode(bin).env);
     return stdout.trim();
   }
   async status() {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ["status"], 1e4);
+    const { env, socket } = this.mode(bin);
+    const { stdout } = await execFile(bin, ["status", ...socket], 1e4, env);
     return stdout.trim();
   }
   async call(tool, args = {}) {
@@ -4847,11 +4891,12 @@ class CuaDriver {
       throw new Error("CUA tool name is required");
     await this.ensureDaemonReady();
     const bin = await this.ensureInstalled();
+    const { env, socket } = this.mode(bin);
     const payload = JSON.stringify(sanitizeArgs(args));
     let lastError;
     for (let attempt = 0;attempt < 4; attempt++) {
       try {
-        const { stdout, stderr } = await execFile(bin, ["call", tool, payload], 60000);
+        const { stdout, stderr } = await execFile(bin, ["call", tool, payload, ...socket], 60000, env);
         if (isDaemonProxyFallback(stderr)) {
           lastError = new Error(stderr.trim());
           await sleep2(150 * (attempt + 1));
@@ -4871,13 +4916,16 @@ class CuaDriver {
   }
   async startDaemon() {
     const bin = await this.ensureInstalled();
-    if (platform4() === "darwin") {
+    if (this.isEmbedded(bin)) {
+      await this.startEmbeddedDaemon(bin);
+    } else if (platform4() === "darwin") {
       const child = spawn4("open", ["-n", "-g", "-a", "CuaDriver", "--args", "serve"], {
         detached: true,
         stdio: "ignore",
         env: driverEnvironment()
       });
       child.unref();
+      await sleep2(750);
     } else {
       const child = spawn4(bin, ["serve"], {
         detached: true,
@@ -4885,8 +4933,8 @@ class CuaDriver {
         env: driverEnvironment()
       });
       child.unref();
+      await sleep2(750);
     }
-    await new Promise((resolve) => setTimeout(resolve, 750));
     try {
       const status = await this.status();
       this.daemonReady = true;
@@ -4895,6 +4943,38 @@ class CuaDriver {
       return { ok: true };
     }
   }
+  async startEmbeddedDaemon(bin) {
+    if (this.daemon && this.daemon.exitCode === null)
+      return;
+    const { env, socket } = this.mode(bin);
+    const child = spawn4(bin, ["serve", "--embedded", "--no-permissions-gate", ...socket], {
+      stdio: "ignore",
+      env
+    });
+    child.unref();
+    child.on("exit", () => {
+      if (this.daemon === child) {
+        this.daemon = null;
+        this.daemonReady = false;
+      }
+    });
+    this.daemon = child;
+    process.once("exit", () => child.kill());
+    for (let waited = 0;waited < 1e4 && !existsSync3(this.socketPath); waited += 50) {
+      if (child.exitCode !== null)
+        break;
+      await sleep2(50);
+    }
+    if (!existsSync3(this.socketPath)) {
+      child.kill();
+      throw new Error("cua-driver did not start (no socket after 10 s)");
+    }
+  }
+  stop() {
+    this.daemon?.kill();
+    this.daemon = null;
+    this.daemonReady = false;
+  }
   async ensureDaemonReady() {
     if (this.daemonReady)
       return;
@@ -5025,7 +5105,7 @@ function createDesktopCapability() {
 }
 
 // src/agent/capabilities/filesystem.ts
-import { open, writeFile, readdir, stat, unlink, mkdir } from "fs/promises";
+import { open, writeFile, readdir, stat, lstat, unlink, rmdir, mkdir } from "fs/promises";
 import { createHash as createHash4 } from "node:crypto";
 
 // src/shared/filesystem-validation.ts
@@ -5059,10 +5139,10 @@ function validateFilesystemParams(method, params) {
 }
 
 // src/agent/capabilities/filesystem.ts
-import { join as join7, dirname as dirname4 } from "path";
+import { join as join7, dirname as dirname5 } from "path";
 
 // src/agent/security/path-validator.ts
-import { dirname as dirname3, basename as basename2, join as join6, resolve as resolve2, normalize, relative, isAbsolute as isAbsolute2 } from "path";
+import { dirname as dirname4, basename as basename3, join as join6, resolve as resolve2, normalize, relative, isAbsolute as isAbsolute2 } from "path";
 import { realpathSync as realpathSync2 } from "fs";
 function resolveExistingRoot(path) {
   const normalized = normalize(resolve2(path));
@@ -5081,10 +5161,10 @@ function resolvePathForValidation(path) {
     if (code !== "ENOENT") {
       throw new Error(`Access denied: cannot resolve path "${path}" (${code})`);
     }
-    const parent = dirname3(normalized);
+    const parent = dirname4(normalized);
     if (parent === normalized)
       return normalized;
-    return join6(resolvePathForValidation(parent), basename2(normalized));
+    return join6(resolvePathForValidation(parent), basename3(normalized));
   }
 }
 function assertAllowedResolvedPath(originalPath, resolved, allowedPaths, blockedPaths = []) {
@@ -5217,7 +5297,7 @@ function createFilesystemCapability(config) {
     if (params.sha256 !== undefined && params.sha256.toLowerCase() !== expectedHash) {
       throw new Error("SHA-256 mismatch: content differs from the source; destination was not modified");
     }
-    await mkdir(dirname4(path), { recursive: true });
+    await mkdir(dirname5(path), { recursive: true });
     validateFilesystemPath(path, config, params, true);
     await writeFile(path, bytes);
     validateFilesystemPath(path, config, params);
@@ -5288,7 +5368,11 @@ function createFilesystemCapability(config) {
     assertFilesystemOperation(params, "fs.delete");
     const path = params.path;
     validateFilesystemPath(path, config, params);
-    await unlink(path);
+    if ((await lstat(path)).isDirectory()) {
+      await rmdir(path);
+    } else {
+      await unlink(path);
+    }
     return { deleted: true, path };
   });
   return {
@@ -5437,14 +5521,14 @@ function createEnabledCapabilityRegistry(config, findDesktopDriver = findCuaDriv
 }
 
 // src/agent/credential-store.ts
-import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { join as join8 } from "path";
 var CONFIG_DIR2 = agentTunnelHome();
 var CONFIG_FILE2 = join8(CONFIG_DIR2, "config.json");
 var PAIRING_FIELDS = ["token", "tunnelId", "enabledCapabilities"];
 function readConfigFile() {
   try {
-    const parsed = JSON.parse(readFileSync6(CONFIG_FILE2, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(CONFIG_FILE2, "utf-8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -5479,7 +5563,7 @@ function clearSavedCredentials() {
     return false;
   let existing;
   try {
-    existing = JSON.parse(readFileSync6(CONFIG_FILE2, "utf-8"));
+    existing = JSON.parse(readFileSync7(CONFIG_FILE2, "utf-8"));
   } catch {
     rmSync2(CONFIG_FILE2, { force: true });
     return true;
@@ -5599,15 +5683,15 @@ async function promptYesNo(question, defaultValue) {
 }
 
 // src/agent/service.ts
-import { chmodSync as chmodSync4, copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync8, realpathSync as realpathSync3, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync4, copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync9, realpathSync as realpathSync3, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 import { platform as platform6 } from "os";
 import { join as join10 } from "path";
 
 // src/agent/service-drivers.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync8, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir4, platform as platform5, userInfo } from "os";
-import { dirname as dirname5, join as join9 } from "path";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/agent/service-quoting.ts
 function shellQuote(value) {
@@ -5734,7 +5818,7 @@ var launchd = {
   unitPath: (paths) => paths.launchdPlist,
   render: (paths, runner) => renderLaunchdPlist(posixShellCommand(runner), paths),
   install(paths, runner) {
-    mkdirSync3(dirname5(paths.launchdPlist), { recursive: true });
+    mkdirSync3(dirname6(paths.launchdPlist), { recursive: true });
     writeFileSync4(paths.launchdPlist, launchd.render(paths, runner), { mode: 384 });
     run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]);
     run("launchctl", ["enable", `${launchdTarget()}/${paths.label}`]);
@@ -5785,7 +5869,7 @@ var launchd = {
     return {
       active: status.ok,
       enabled,
-      detail: status.detail || (installed ? readFileSync7(paths.launchdPlist, "utf8") : undefined)
+      detail: status.detail || (installed ? readFileSync8(paths.launchdPlist, "utf8") : undefined)
     };
   }
 };
@@ -5793,7 +5877,7 @@ var systemd = {
   unitPath: (paths) => paths.systemdUnit,
   render: (paths, runner) => renderSystemdUnit(posixShellCommand(runner), paths),
   install(paths, runner) {
-    mkdirSync3(dirname5(paths.systemdUnit), { recursive: true });
+    mkdirSync3(dirname6(paths.systemdUnit), { recursive: true });
     writeFileSync4(paths.systemdUnit, systemd.render(paths, runner), { mode: 384 });
     const reload = run("systemctl", ["--user", "daemon-reload"]);
     const enable = run("systemctl", ["--user", "enable", `${paths.label}.service`]);
@@ -5916,7 +6000,7 @@ var scheduledTask = {
     return {
       active: state === "Running",
       enabled: state !== "Disabled",
-      detail: state || (installed ? readFileSync7(paths.windowsScript, "utf8") : undefined)
+      detail: state || (installed ? readFileSync8(paths.windowsScript, "utf8") : undefined)
     };
   }
 };
@@ -6037,7 +6121,7 @@ function getServiceStatus() {
   return withDriver((driver, paths, installed) => {
     let upToDate = false;
     try {
-      upToDate = installed && readFileSync8(driver.unitPath(paths), "utf8") === driver.render(paths, currentRunnerParts(plannedRunner));
+      upToDate = installed && readFileSync9(driver.unitPath(paths), "utf8") === driver.render(paths, currentRunnerParts(plannedRunner));
     } catch {}
     return { ...driver.status(paths, installed), upToDate };
   }, { installed: false, active: null });
@@ -6086,7 +6170,7 @@ function renderServiceAction(action, status) {
 }
 
 // src/agent/state-file.ts
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync9, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync as chmodSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync10, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "fs";
 import { join as join11 } from "path";
 function stateFilePath(home = agentTunnelHome()) {
   return join11(home, "state.json");
@@ -6113,7 +6197,7 @@ function writeAgentState(status, tunnel, home = agentTunnelHome()) {
 }
 function readAgentState(home = agentTunnelHome()) {
   try {
-    const parsed = JSON.parse(readFileSync9(stateFilePath(home), "utf8"));
+    const parsed = JSON.parse(readFileSync10(stateFilePath(home), "utf8"));
     return parsed && typeof parsed === "object" && typeof parsed.status === "string" ? parsed : null;
   } catch {
     return null;
@@ -6393,7 +6477,7 @@ function commandRun(flags) {
 }
 function lastServiceActivity() {
   try {
-    const lines = readFileSync10(join12(getServicePaths().logDir, "agent-tunnel.out.log"), "utf8").split(/\r?\n/).map((line) => stripAnsi(line).trim()).filter((line) => line.length > 0);
+    const lines = readFileSync11(join12(getServicePaths().logDir, "agent-tunnel.out.log"), "utf8").split(/\r?\n/).map((line) => stripAnsi(line).trim()).filter((line) => line.length > 0);
     return lines.at(-1) ?? null;
   } catch {
     return null;
@@ -6443,7 +6527,7 @@ function commandStatus(flags) {
   blankLine();
   if (approved.size === 0) {
     console.log(`  ${glyph.warn} ${c.dim}No capabilities approved — this tunnel cannot act.${c.reset}`);
-    console.log(`  ${c.dim}Pair again with${c.reset} ${c.white}agent-tunnel connect --reauth${c.reset}`);
+    console.log(`  ${c.dim}Pair again with${c.reset} ${c.white}${PAIR_AGAIN_COMMAND}${c.reset}`);
     blankLine();
   }
   console.log(`  ${c.dim}Recent logs:${c.reset} ${c.white}agent-tunnel logs${c.reset}`);
@@ -6515,7 +6599,7 @@ function commandLogs(flags) {
       console.log(`  ${c.dim}not created yet${c.reset}`);
       continue;
     }
-    const kept = readFileSync10(file, "utf8").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim().length > 0).filter((line) => showAll || !isShellStartupNoise(line));
+    const kept = readFileSync11(file, "utf8").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim().length > 0).filter((line) => showAll || !isShellStartupNoise(line));
     const lines = collapseRepeatedLines(kept).slice(-limit);
     if (lines.length === 0) {
       console.log(`  ${c.dim}empty${c.reset}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kortix/agent-tunnel",
-  "version": "0.13.46",
+  "version": "0.13.48",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kortix-ai/suna.git",

package/src/agent/agent.test.ts

@@ -246,6 +246,30 @@ describe('service mode never gives up (R2)', () => {
     expect(statuses).toContain('rejected');
   });
 
+  test('a removed computer says so, and names the one command that pairs it again', async () => {
+    FakeRelay.sockets = [];
+    globalThis.WebSocket = closingWebSocket(4001, 'authentication failed') as unknown as typeof WebSocket;
+    const Socket = globalThis.WebSocket as unknown as { created: number };
+    Socket.created = 0;
+    const agent = new TunnelAgent(loadConfig(TEST_CONFIG), new CapabilityRegistry(), {}, { persistent: true, rejectedRetryMs: 60 });
+    const output: string[] = [];
+    const originalWrite = process.stdout.write;
+    process.stdout.write = ((chunk: string | Uint8Array) => {
+      output.push(String(chunk));
+      return true;
+    }) as typeof process.stdout.write;
+    try {
+      agent.connect();
+      await until(() => Socket.created >= 2);
+    } finally {
+      agent.disconnect();
+      process.stdout.write = originalWrite;
+    }
+    const text = output.join('');
+    expect(text).toContain('This computer is no longer connected to Kortix');
+    expect(text).toContain('npx @kortix/agent-tunnel@latest connect --reauth');
+  });
+
   test('a re-pair while `rejected` reconnects at once, without waiting out the re-probe', async () => {
     globalThis.WebSocket = closingWebSocket(4001, 'authentication failed') as unknown as typeof WebSocket;
     const Socket = globalThis.WebSocket as unknown as { created: number };

package/src/agent/agent.ts

@@ -103,6 +103,14 @@ const WATCHDOG_INTERVAL_MS = 5_000;
 /** A tick that arrives this much later than scheduled means the machine slept. */
 const CLOCK_JUMP_MS = 30_000;
 const REJECTED_RETRY_MS = 5 * 60_000;
+/**
+ * The one command that pairs this computer again. An npx user has no
+ * `agent-tunnel` on PATH, so the hint names the package. The relay removes a
+ * computer when its owner disconnects it, and a registration without a
+ * hardware id after 30 days without a sign of life.
+ */
+export const PAIR_AGAIN_COMMAND = 'npx @kortix/agent-tunnel@latest connect --reauth';
+const NO_LONGER_CONNECTED = 'This computer is no longer connected to Kortix (disconnected, or removed after 30 days offline).';
 /** Standby backs off from this, doubling, so two holders of one credential stop trading the socket. */
 const STANDBY_RETRY_MS = 60_000;
 const MAX_STANDBY_RETRY_MS = 30 * 60_000;
@@ -301,7 +309,10 @@ export class TunnelAgent {
           this.setStatus('rejected');
           if (this.now() - this.lastRejectedLogAt >= REJECTED_LOG_EVERY_MS) {
             this.lastRejectedLogAt = this.now();
-            log(`${c.red}✗${c.reset}`, `Credential rejected — waiting for this computer to be paired again (retrying every 5 min)`);
+            log(
+              `${c.red}✗${c.reset}`,
+              `${NO_LONGER_CONNECTED} Connect it again from the Kortix desktop app, or run \`${PAIR_AGAIN_COMMAND}\`. Checking again every 5 min.`,
+            );
           }
           this.retryAfter(this.options.rejectedRetryMs ?? REJECTED_RETRY_MS);
           return;
@@ -315,13 +326,13 @@ export class TunnelAgent {
         }
         if (event.code === 4001 && isCredentialRejection(event.code, event.reason)) {
           this.isShuttingDown = true;
-          log(`${c.red}✗${c.reset}`, `Credential rejected — run \`agent-tunnel connect --reauth\` to pair again`);
+          log(`${c.red}✗${c.reset}`, `${NO_LONGER_CONNECTED} Connect it again: \`${PAIR_AGAIN_COMMAND}\``);
           this.hooks.onTerminalClose?.({ code: event.code, reason: 'credential-rejected' });
           return; // Don't reconnect on auth failure
         }
         if (event.code === 4003) {
           this.isShuttingDown = true;
-          log(`${c.red}✗${c.reset}`, `Device credential was revoked — run \`agent-tunnel connect --reauth\` to pair again`);
+          log(`${c.red}✗${c.reset}`, `${NO_LONGER_CONNECTED} Connect it again: \`${PAIR_AGAIN_COMMAND}\``);
           this.hooks.onTerminalClose?.({ code: event.code, reason: 'credential-rejected' });
           return;
         }
@@ -374,7 +385,7 @@ export class TunnelAgent {
         // Reporting a bare "Connected ()" hides that this tunnel is inert.
         log(
           `${c.yellow}!${c.reset}`,
-          `Connected, but no capabilities are enabled — this tunnel cannot do anything. Run \`agent-tunnel connect --reauth\` to pair again.`,
+          `Connected, but no capabilities are enabled — this tunnel cannot do anything. Run \`${PAIR_AGAIN_COMMAND}\` to pair again.`,
         );
       } else {
         log(`${c.green}●${c.reset}`, `Connected ${c.reset}${c.gray}(${capabilityNames.join(', ')})${c.reset}`);

package/src/agent/capabilities/desktop/cua-driver.test.ts

@@ -0,0 +1,88 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+import { bundledCuaDriverPath, CuaDriver } from './cua-driver';
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+function tempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), 'cua-driver-test-'));
+  dirs.push(dir);
+  return dir;
+}
+
+/** A stand-in driver: logs each invocation, and `serve` creates its socket. */
+function fakeDriver(dir: string): { binary: string; log: string } {
+  const binary = join(dir, 'cua-driver');
+  const log = join(dir, 'calls.log');
+  writeFileSync(
+    binary,
+    `#!/bin/sh
+echo "$* | embedded=$CUA_DRIVER_EMBEDDED telemetry=$CUA_DRIVER_RS_TELEMETRY_ENABLED host=$CUA_DRIVER_HOST_BUNDLE_ID" >> "${log}"
+case "$1" in
+  serve)
+    while [ "$#" -gt 0 ]; do [ "$1" = "--socket" ] && touch "$2"; shift; done
+    sleep 30 ;;
+  status)
+    # Like the real driver: running only while a daemon listens on the socket.
+    if [ "$2" = "--socket" ] && [ ! -e "$3" ]; then echo "not running"; else echo "running"; fi ;;
+  call) echo '{"ok":true}' ;;
+esac
+`,
+  );
+  chmodSync(binary, 0o755);
+  return { binary, log };
+}
+
+describe('bundledCuaDriverPath', () => {
+  test('finds the driver the desktop app ships beside the agent bundle', () => {
+    const resources = join(tempDir(), 'Kortix.app', 'Contents', 'Resources');
+    mkdirSync(join(resources, 'agent-tunnel'), { recursive: true });
+    mkdirSync(join(resources, 'cua-driver'), { recursive: true });
+    const agent = join(resources, 'agent-tunnel', 'agent-cli.js');
+    writeFileSync(agent, '');
+    expect(bundledCuaDriverPath(agent)).toBeNull();
+    writeFileSync(join(resources, 'cua-driver', 'cua-driver'), '');
+    expect(bundledCuaDriverPath(agent)).toBe(join(resources, 'cua-driver', 'cua-driver'));
+  });
+
+  test('an npm install has no bundled driver', () => {
+    expect(bundledCuaDriverPath('/usr/local/lib/node_modules/@kortix/agent-tunnel/dist/agent-cli.js')).toBeNull();
+    expect(bundledCuaDriverPath(undefined)).toBeNull();
+  });
+});
+
+describe('embedded driver', () => {
+  test('starts its own private daemon as a child, never through LaunchServices, and calls through it', async () => {
+    const dir = tempDir();
+    const { binary, log } = fakeDriver(dir);
+    const socketPath = join(dir, 'cua.sock');
+    const driver = new CuaDriver({ binary, embedded: true, socketPath, hostBundleId: 'com.kortix.desktop' });
+    try {
+      expect(await driver.call('click', { pid: 1 })).toEqual({ ok: true });
+      const calls = readFileSync(log, 'utf8').trim().split('\n');
+      const serve = calls.find((line) => line.startsWith('serve '));
+      expect(serve).toBe(
+        `serve --embedded --no-permissions-gate --socket ${socketPath} | embedded=1 telemetry=0 host=com.kortix.desktop`,
+      );
+      expect(calls.at(-1)).toBe(
+        `call click {"pid":1} --socket ${socketPath} | embedded=1 telemetry=0 host=com.kortix.desktop`,
+      );
+    } finally {
+      driver.stop();
+    }
+  });
+
+  test('a separately installed driver keeps its standalone mode, without telemetry', async () => {
+    const dir = tempDir();
+    const { binary, log } = fakeDriver(dir);
+    const driver = new CuaDriver({ binary });
+    expect(await driver.status()).toBe('running');
+    expect(readFileSync(log, 'utf8').trim()).toBe('status | embedded= telemetry=0 host=');
+  });
+});

package/src/agent/capabilities/desktop/cua-driver.ts

@@ -1,7 +1,7 @@
-import { spawn } from 'child_process';
-import { existsSync, realpathSync, statSync } from 'fs';
-import { homedir, platform } from 'os';
-import { join } from 'path';
+import { spawn, type ChildProcess } from 'child_process';
+import { existsSync, readFileSync, realpathSync, statSync } from 'fs';
+import { homedir, platform, tmpdir } from 'os';
+import { basename, dirname, join } from 'path';
 
 interface ExecResult {
   stdout: string;
@@ -24,14 +24,37 @@ const DRIVER_ENV_KEYS = [
   'DBUS_SESSION_BUS_ADDRESS',
 ] as const;
 
+/** The driver's own product telemetry stays off on a customer's machine. */
+function driverEnvironment(extra: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { CUA_DRIVER_RS_TELEMETRY_ENABLED: '0' };
+  for (const key of DRIVER_ENV_KEYS) {
+    if (process.env[key] !== undefined) env[key] = process.env[key];
+  }
+  return { ...env, ...extra };
+}
+
 export interface CuaToolCall {
   tool: string;
   args?: Record<string, unknown>;
 }
 
+/**
+ * The driver the desktop app ships in its own bundle, beside the agent:
+ * `Resources/agent-tunnel/agent-cli.js` → `Resources/cua-driver/cua-driver`.
+ * Running it embedded keeps every macOS permission prompt and grant on the
+ * Kortix app, not on a separate CuaDriver app. `null` for an npm install.
+ */
+export function bundledCuaDriverPath(agentEntry: string | undefined = process.argv[1]): string | null {
+  if (!agentEntry || basename(dirname(agentEntry)) !== 'agent-tunnel') return null;
+  const exe = process.platform === 'win32' ? 'cua-driver.exe' : 'cua-driver';
+  const candidate = join(dirname(dirname(agentEntry)), 'cua-driver', exe);
+  return existsSync(candidate) ? candidate : null;
+}
+
 function candidateBins(): string[] {
   const candidates = [
     process.env.CUA_DRIVER_BIN,
+    bundledCuaDriverPath(),
     join(
       homedir(),
       '.local',
@@ -67,19 +90,26 @@ export function findCuaDriverBinary(): string | null {
   return null;
 }
 
-function driverEnvironment(): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = {};
-  for (const key of DRIVER_ENV_KEYS) {
-    if (process.env[key] !== undefined) env[key] = process.env[key];
+/** The `CFBundleIdentifier` of the app whose binary runs this agent, if any. */
+function hostBundleId(): string {
+  try {
+    const plist = readFileSync(join(dirname(dirname(process.execPath)), 'Info.plist'), 'utf8');
+    return /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/.exec(plist)?.[1] ?? '';
+  } catch {
+    return '';
   }
-  return env;
 }
 
-function execFile(cmd: string, args: string[], timeoutMs = 30_000): Promise<ExecResult> {
+function execFile(
+  cmd: string,
+  args: string[],
+  timeoutMs = 30_000,
+  env: NodeJS.ProcessEnv = driverEnvironment(),
+): Promise<ExecResult> {
   return new Promise((resolve, reject) => {
     const proc = spawn(cmd, args, {
       stdio: ['ignore', 'pipe', 'pipe'],
-      env: driverEnvironment(),
+      env,
     });
     let stdout = '';
     let stderr = '';
@@ -168,9 +198,59 @@ function sanitizeArgs(args: Record<string, unknown>): Record<string, unknown> {
   return sanitized;
 }
 
+export interface CuaDriverOptions {
+  /** A resolved driver binary. Default: the bundled one, else an installed one. */
+  binary?: string;
+  /** Run the driver inside this app's macOS permissions. Default: the bundled driver. */
+  embedded?: boolean;
+  socketPath?: string;
+  hostBundleId?: string;
+}
+
+/**
+ * The local computer-use driver (trycua `cua-driver`).
+ *
+ * - Embedded (the driver the desktop app bundles): this agent spawns
+ *   `serve --embedded` as its own child on a private socket. The agent runs as
+ *   the Kortix app's binary, so macOS attributes Accessibility and Screen
+ *   Recording to Kortix: one grant, one entry in System Settings, no CuaDriver
+ *   app. The driver never shows its own permission UI (`--no-permissions-gate`);
+ *   the desktop app asks for the grants.
+ * - Standalone (a separately installed CuaDriver.app): unchanged, it starts
+ *   through LaunchServices and owns its own grants.
+ */
 export class CuaDriver {
-  private binary: string | null = null;
+  private binary: string | null;
+  private readonly embedded: boolean | undefined;
+  private readonly socketPath: string;
+  private readonly hostBundleId: string | undefined;
   private daemonReady = false;
+  private daemon: ChildProcess | null = null;
+
+  constructor(options: CuaDriverOptions = {}) {
+    this.binary = options.binary ?? null;
+    this.embedded = options.embedded;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+    // Under $TMPDIR: a unix socket path is capped at 104 bytes on macOS.
+    this.socketPath = options.socketPath ?? join(tmpdir(), `kortix-cua-${uid}.sock`);
+    this.hostBundleId = options.hostBundleId;
+  }
+
+  private isEmbedded(binary: string): boolean {
+    return this.embedded ?? binary === bundledCuaDriverPath();
+  }
+
+  /** Environment and trailing arguments every driver command needs in this mode. */
+  private mode(binary: string): { env: NodeJS.ProcessEnv; socket: string[] } {
+    if (!this.isEmbedded(binary)) return { env: driverEnvironment(), socket: [] };
+    return {
+      env: driverEnvironment({
+        CUA_DRIVER_EMBEDDED: '1',
+        CUA_DRIVER_HOST_BUNDLE_ID: this.hostBundleId ?? hostBundleId(),
+      }),
+      socket: ['--socket', this.socketPath],
+    };
+  }
 
   async ensureInstalled(): Promise<string> {
     if (this.binary && existsSync(this.binary)) return this.binary;
@@ -188,25 +268,26 @@ export class CuaDriver {
 
   async version(): Promise<string> {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ['--version'], 10_000);
+    const { stdout } = await execFile(bin, ['--version'], 10_000, this.mode(bin).env);
     return stdout.trim();
   }
 
   async listTools(): Promise<string> {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ['list-tools'], 10_000);
+    const { stdout } = await execFile(bin, ['list-tools'], 10_000, this.mode(bin).env);
     return stdout.trim();
   }
 
   async describe(tool: string): Promise<string> {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ['describe', tool], 10_000);
+    const { stdout } = await execFile(bin, ['describe', tool], 10_000, this.mode(bin).env);
     return stdout.trim();
   }
 
   async status(): Promise<string> {
     const bin = await this.ensureInstalled();
-    const { stdout } = await execFile(bin, ['status'], 10_000);
+    const { env, socket } = this.mode(bin);
+    const { stdout } = await execFile(bin, ['status', ...socket], 10_000, env);
     return stdout.trim();
   }
 
@@ -214,12 +295,13 @@ export class CuaDriver {
     if (!tool || typeof tool !== 'string') throw new Error('CUA tool name is required');
     await this.ensureDaemonReady();
     const bin = await this.ensureInstalled();
+    const { env, socket } = this.mode(bin);
     const payload = JSON.stringify(sanitizeArgs(args));
     let lastError: unknown;
 
     for (let attempt = 0; attempt < 4; attempt++) {
       try {
-        const { stdout, stderr } = await execFile(bin, ['call', tool, payload], 60_000);
+        const { stdout, stderr } = await execFile(bin, ['call', tool, payload, ...socket], 60_000, env);
         if (isDaemonProxyFallback(stderr)) {
           lastError = new Error(stderr.trim());
           await sleep(150 * (attempt + 1));
@@ -242,13 +324,16 @@ export class CuaDriver {
   async startDaemon(): Promise<{ ok: true; status?: string }> {
     const bin = await this.ensureInstalled();
 
-    if (platform() === 'darwin') {
+    if (this.isEmbedded(bin)) {
+      await this.startEmbeddedDaemon(bin);
+    } else if (platform() === 'darwin') {
       const child = spawn('open', ['-n', '-g', '-a', 'CuaDriver', '--args', 'serve'], {
         detached: true,
         stdio: 'ignore',
         env: driverEnvironment(),
       });
       child.unref();
+      await sleep(750);
     } else {
       const child = spawn(bin, ['serve'], {
         detached: true,
@@ -256,9 +341,9 @@ export class CuaDriver {
         env: driverEnvironment(),
       });
       child.unref();
+      await sleep(750);
     }
 
-    await new Promise((resolve) => setTimeout(resolve, 750));
     try {
       const status = await this.status();
       this.daemonReady = true;
@@ -268,6 +353,43 @@ export class CuaDriver {
     }
   }
 
+  /**
+   * A direct child (never `open`, which would hand it to LaunchServices and
+   * out of this app's permission chain). It exits with the agent.
+   */
+  private async startEmbeddedDaemon(bin: string): Promise<void> {
+    if (this.daemon && this.daemon.exitCode === null) return;
+    const { env, socket } = this.mode(bin);
+    const child = spawn(bin, ['serve', '--embedded', '--no-permissions-gate', ...socket], {
+      stdio: 'ignore',
+      env,
+    });
+    child.unref();
+    child.on('exit', () => {
+      if (this.daemon === child) {
+        this.daemon = null;
+        this.daemonReady = false;
+      }
+    });
+    this.daemon = child;
+    process.once('exit', () => child.kill());
+    for (let waited = 0; waited < 10_000 && !existsSync(this.socketPath); waited += 50) {
+      if (child.exitCode !== null) break;
+      await sleep(50);
+    }
+    if (!existsSync(this.socketPath)) {
+      child.kill();
+      throw new Error('cua-driver did not start (no socket after 10 s)');
+    }
+  }
+
+  /** Stops an embedded daemon this agent started. Restarting picks up new grants. */
+  stop(): void {
+    this.daemon?.kill();
+    this.daemon = null;
+    this.daemonReady = false;
+  }
+
   private async ensureDaemonReady(): Promise<void> {
     if (this.daemonReady) return;
     try {

package/src/agent/capabilities/filesystem-delete.test.ts

@@ -0,0 +1,109 @@
+import { afterEach, expect, test } from 'bun:test';
+import { lstat, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createFilesystemCapability } from './filesystem';
+import type { TunnelConfig } from '../config';
+
+const roots: string[] = [];
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map(root => rm(root, { recursive: true, force: true })));
+});
+
+async function fixture() {
+  const root = await mkdtemp(join(tmpdir(), 'tunnel-delete-'));
+  roots.push(root);
+  const config: TunnelConfig = {
+    token: '', tunnelId: '', apiUrl: 'http://localhost', wsPath: '/ws',
+    maxFileSize: 1024, allowedPaths: [root], blockedPaths: [],
+    allowedCommands: [], blockedCommands: [], workingDir: root,
+    shellTimeout: 1000, shellMaxTimeout: 1000, shellMaxOutputSize: 1024, shellEnvPassthrough: [],
+  };
+  const handler = createFilesystemCapability(config).methods.get('fs.delete');
+  if (!handler) throw new Error('fs.delete handler missing');
+  const permission = { permissionId: 'test', capability: 'filesystem', scope: { paths: [root], operations: ['delete'] } };
+  return { root, config, permission, deletePath: (path: string) => handler({ path, __permission: permission }) };
+}
+
+test('deletes an empty allowed directory and rejects a second deletion', async () => {
+  const { root, deletePath } = await fixture();
+  const path = join(root, 'empty');
+  await mkdir(path);
+  expect(await deletePath(path)).toEqual({ deleted: true, path });
+  await expect(lstat(path)).rejects.toMatchObject({ code: 'ENOENT' });
+  await expect(deletePath(path)).rejects.toMatchObject({ code: 'ENOENT' });
+});
+
+test('deletes an allowed file', async () => {
+  const { root, deletePath } = await fixture();
+  const path = join(root, 'file');
+  await writeFile(path, 'fixture');
+  expect(await deletePath(path)).toEqual({ deleted: true, path });
+  await expect(lstat(path)).rejects.toMatchObject({ code: 'ENOENT' });
+});
+
+test('rejects a non-empty directory without modifying its contents', async () => {
+  const { root, deletePath } = await fixture();
+  const path = join(root, 'non-empty');
+  await mkdir(path);
+  const child = join(path, 'keep');
+  await writeFile(child, 'preserve');
+  await expect(deletePath(path)).rejects.toThrow();
+  expect((await lstat(path)).isDirectory()).toBe(true);
+  expect(await readFile(child, 'utf8')).toBe('preserve');
+});
+
+test('rejects a missing path', async () => {
+  const { root, deletePath } = await fixture();
+  await expect(deletePath(join(root, 'missing'))).rejects.toMatchObject({ code: 'ENOENT' });
+});
+
+test('preserves directories outside the local ceiling and permission scope', async () => {
+  const fixtureA = await fixture();
+  const fixtureB = await fixture();
+  await expect(fixtureA.deletePath(fixtureB.root)).rejects.toThrow('outside allowed directories');
+  expect((await lstat(fixtureB.root)).isDirectory()).toBe(true);
+  const sibling = join(fixtureA.root, 'sibling');
+  await mkdir(sibling);
+  fixtureA.permission.scope.paths = [join(fixtureA.root, 'approved')];
+  await expect(fixtureA.deletePath(sibling)).rejects.toThrow('outside allowed directories');
+  expect((await lstat(sibling)).isDirectory()).toBe(true);
+});
+
+test('preserves blocked directories and directories without delete permission', async () => {
+  const { root, config, permission, deletePath } = await fixture();
+  const path = join(root, 'keep');
+  await mkdir(path);
+  config.blockedPaths.push(path);
+  await expect(deletePath(path)).rejects.toThrow('blocked path');
+  config.blockedPaths = [];
+  permission.scope.operations = ['read'];
+  await expect(deletePath(path)).rejects.toThrow('operation "delete" is not allowed');
+  expect((await lstat(path)).isDirectory()).toBe(true);
+});
+
+for (const kind of ['file', 'directory', 'missing']) {
+  test(`deletes an allowed ${kind} symlink without deleting its target`, async () => {
+    const { root, deletePath } = await fixture();
+    const target = join(root, 'target');
+    if (kind === 'file') await writeFile(target, 'preserve');
+    if (kind === 'directory') await mkdir(target);
+    const path = join(root, 'link');
+    await symlink(target, path);
+    expect(await deletePath(path)).toEqual({ deleted: true, path });
+    await expect(lstat(path)).rejects.toMatchObject({ code: 'ENOENT' });
+    if (kind === 'file') expect(await readFile(target, 'utf8')).toBe('preserve');
+    if (kind === 'directory') expect((await lstat(target)).isDirectory()).toBe(true);
+    if (kind === 'missing') await expect(lstat(target)).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+}
+
+test('rejects an outside-target symlink and preserves both link and target', async () => {
+  const { root, deletePath } = await fixture();
+  const outside = await fixture();
+  const path = join(root, 'escape');
+  await symlink(outside.root, path);
+  await expect(deletePath(path)).rejects.toThrow('outside allowed directories');
+  expect((await lstat(path)).isSymbolicLink()).toBe(true);
+  expect((await lstat(outside.root)).isDirectory()).toBe(true);
+});

package/src/agent/capabilities/filesystem.ts

@@ -5,7 +5,7 @@
  * even though the server already validates permissions.
  */
 
-import { open, writeFile, readdir, stat, unlink, mkdir } from 'fs/promises';
+import { open, writeFile, readdir, stat, lstat, unlink, rmdir, mkdir } from 'fs/promises';
 import { createHash } from 'node:crypto';
 import { validateFilesystemParams } from '../../shared/filesystem-validation';
 import { join, dirname } from 'path';
@@ -243,7 +243,11 @@ export function createFilesystemCapability(config: TunnelConfig): Capability {
 
     validateFilesystemPath(path, config, params);
 
-    await unlink(path);
+    if ((await lstat(path)).isDirectory()) {
+      await rmdir(path);
+    } else {
+      await unlink(path);
+    }
 
     return { deleted: true, path };
   });

package/src/agent/capabilities/security.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { chmod, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { protectedAgentPaths, type TunnelConfig } from '../config';
@@ -169,6 +169,47 @@ describe('local capability permission enforcement', () => {
     ).rejects.toThrow('desktop feature "mouse" is not allowed');
   });
 
+  test('desktop discovery dispatches to driver metadata commands and preserves unsupported output', async () => {
+    const binary = join(root, 'fake-discovery-driver');
+    const log = join(root, 'discovery-args.jsonl');
+    await writeFile(binary, [
+      '#!/usr/bin/env node',
+      `const fs = require('node:fs');`,
+      `fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify(process.argv.slice(2)) + '\\n');`,
+      'const [command, tool] = process.argv.slice(2);',
+      `if (command === 'list-tools') process.stdout.write('double_click\\n');`,
+      `else if (command === 'describe' && tool === 'double_click') process.stdout.write('Double click coordinates\\n');`,
+      `else if (command === 'describe') { process.stderr.write('Unsupported tool: ' + tool); process.exitCode = 2; }`,
+      `else { process.stderr.write('Unexpected command'); process.exitCode = 3; }`,
+    ].join('\n'));
+    await chmod(binary, 0o700);
+    const previousBinary = process.env.CUA_DRIVER_BIN;
+    process.env.CUA_DRIVER_BIN = binary;
+    try {
+      const capability = createDesktopCapability();
+      const list = capability.methods.get('desktop.cua.list_tools');
+      const describeTool = capability.methods.get('desktop.cua.describe');
+      if (!list || !describeTool) throw new Error('Discovery handlers missing');
+      const __permission = {
+        permissionId: 'permission-discovery', capability: 'desktop',
+        scope: { features: ['computer_use'] },
+      };
+      await expect(list({})).rejects.toThrow('desktop permission required');
+      await expect(list({ __permission: { ...__permission, scope: { features: ['screenshot'] } } }))
+        .rejects.toThrow('not allowed');
+      expect(await list({ __permission })).toEqual({ tools: 'double_click' });
+      expect(await describeTool({ tool: 'double_click', __permission }))
+        .toEqual({ description: 'Double click coordinates' });
+      await expect(describeTool({ tool: 'unsupported_tool', __permission }))
+        .rejects.toThrow('Unsupported tool: unsupported_tool');
+      expect((await readFile(log, 'utf8')).trim().split('\n').map((line) => JSON.parse(line)))
+        .toEqual([['list-tools'], ['describe', 'double_click'], ['describe', 'unsupported_tool']]);
+    } finally {
+      if (previousBinary === undefined) delete process.env.CUA_DRIVER_BIN;
+      else process.env.CUA_DRIVER_BIN = previousBinary;
+    }
+  });
+
   test('remote desktop calls cannot trigger mutable installer or update tools', async () => {
     const capability = createDesktopCapability();
     expect(capability.methods.has('desktop.cua.check_for_update')).toBe(false);

package/src/agent/cli.ts

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
 
-import { TunnelAgent } from './agent';
+import { PAIR_AGAIN_COMMAND, TunnelAgent } from './agent';
 import { accessFilePath, accessRequestPath, desktopAppPath, readAccess, writeAccess } from './access';
 import { printStartupBanner } from './banner';
 import { createEnabledCapabilityRegistry } from './capabilities/enabled-registry';
@@ -441,7 +441,7 @@ function commandStatus(flags: Flags): void {
 
   if (approved.size === 0) {
     console.log(`  ${glyph.warn} ${c.dim}No capabilities approved — this tunnel cannot act.${c.reset}`);
-    console.log(`  ${c.dim}Pair again with${c.reset} ${c.white}agent-tunnel connect --reauth${c.reset}`);
+    console.log(`  ${c.dim}Pair again with${c.reset} ${c.white}${PAIR_AGAIN_COMMAND}${c.reset}`);
     blankLine();
   }
   console.log(`  ${c.dim}Recent logs:${c.reset} ${c.white}agent-tunnel logs${c.reset}`);