cetrix-connect 0.3.0 → 0.3.1

package/README.md

@@ -9,14 +9,15 @@ khi kết nối được cấp quyền.
 Cài **Node.js 24 trở lên**, mở PowerShell hoặc terminal trên máy cần ghép, rồi chạy:
 
 ```sh
-npx --yes cetrix-connect@0.3.0 remote
+npx --yes cetrix-connect@0.3.1 remote
 ```
 
-Lệnh tải agent từ npm; không cần tải ZIP, giải nén hay tìm thư mục cài đặt. Làm
-theo lời nhắc để chọn tên máy và thư mục dữ liệu đang tồn tại. Trình duyệt mở
-trang CetriX Connect để đăng nhập, đối chiếu mã ghép và xác nhận.
+Lệnh tự tải agent, lấy tên PC và tạo thư mục **CetriX Workspace** trong thư mục
+người dùng (ví dụ `C:\Users\Admin\CetriX Workspace`). Không phải nhập tên hay
+đường dẫn trong terminal. Lần đầu, trình duyệt mở CetriX Connect để đăng nhập,
+đối chiếu mã ghép và xác nhận tên máy, thư mục, quyền truy cập.
 
-Chỉ chọn thư mục muốn cấp quyền. Mặc định chỉ được đọc file. Quyền ghi file và
+Mặc định chỉ được đọc file trong thư mục này. Quyền ghi file và
 chạy lệnh cần được bật rõ ràng. Khi bật chạy lệnh, tiến trình sử dụng quyền của
 tài khoản hệ điều hành hiện tại và không bị cách ly trong thư mục dữ liệu.
 
@@ -25,11 +26,10 @@ cài dịch vụ chạy nền hoặc tự khởi động cùng máy tính.
 
 ## Chạy lại máy đã ghép
 
-Sau khi ghép, agent in đường dẫn danh tính và lệnh chạy lại. Sao chép chính lệnh
-đó để kết nối lại cùng máy, ví dụ:
+Chạy lại chính lệnh ban đầu để dùng danh tính đã lưu, không cần ghép lại:
 
 ```sh
-npx --yes cetrix-connect@0.3.0 run --config "duong-dan-danh-tinh.json"
+npx --yes cetrix-connect@0.3.1 remote
 ```
 
 Danh tính được lưu ngoài thư mục tải tạm của npm. Trên Windows, khóa được bảo
@@ -37,10 +37,21 @@ vệ bằng DPAPI của người dùng hiện tại; trên macOS/Linux, file ch
 sở hữu truy cập. Không gửi file danh tính cho người khác và không chuyển nó
 sang tài khoản Windows khác. Xóa cache npm không xóa danh tính đã lưu.
 
+Để dùng thư mục có sẵn khác, mở **Tùy chọn kết nối** trên dashboard rồi sao chép
+lệnh mới, hoặc thêm `--root "D:\DuAn"`. Có thể đổi tên bằng `--name "PC 01"`.
+Thay đổi cấu hình kết nối cần xác nhận lại trên trình duyệt; không tự mở rộng
+quyền của máy đã ghép. Khi dùng cấu hình tùy chỉnh, chạy lại cùng lệnh đó.
+
+Danh tính cũ từ bộ ZIP hoặc agent 0.3.0 vẫn dùng được bằng lệnh chỉ định rõ:
+
+```sh
+npx --yes cetrix-connect@0.3.1 run --config "duong-dan-danh-tinh.json"
+```
+
 Nếu dùng máy chủ CetriX khác, xem các tùy chọn:
 
 ```sh
-npx --yes cetrix-connect@0.3.0 --help
+npx --yes cetrix-connect@0.3.1 --help
 ```
 
 Máy dùng kết nối HTTPS/WebSocket đi ra, không cần mở cổng đi vào. Agent Linux

package/dist/agent.mjs

@@ -134,14 +134,13 @@ var init_files = __esm({
 });
 
 // src/agent/entry.mjs
-import fs7 from "node:fs/promises";
-import path9 from "node:path";
-import os2 from "node:os";
-import { generateKeyPairSync, randomUUID as randomUUID5 } from "node:crypto";
+import fs8 from "node:fs/promises";
+import path10 from "node:path";
+import os3 from "node:os";
+import { generateKeyPairSync, randomUUID as randomUUID6 } from "node:crypto";
 import { parseArgs } from "node:util";
 import { spawn as spawn4 } from "node:child_process";
 import { setTimeout as sleep } from "node:timers/promises";
-import { createInterface } from "node:readline/promises";
 
 // src/agent/identity.mjs
 import fs from "node:fs/promises";
@@ -2069,7 +2068,7 @@ var TOOL_DEFS = [
 var TOOL_NAMES = TOOL_DEFS.map((t) => t.name);
 
 // src/agent/version.mjs
-var AGENT_VERSION = "0.3.0";
+var AGENT_VERSION = "0.3.1";
 
 // src/agent/runtime.mjs
 var states3 = /* @__PURE__ */ new WeakMap();
@@ -2331,8 +2330,9 @@ async function cleanupRuntime(config, filter = {}) {
 function connectAgent(config, { onReady = () => {
 }, onStatus = () => {
 }, onShutdown = () => {
+}, onInitialAuthorizationRejected = () => {
 }, reconnect = true, execute = executeRuntimeTool } = {}) {
-  let socket, timer, closed = false, retry = 0, generation = 0;
+  let socket, timer, closed = false, retry = 0, generation = 0, everReady = false, authorizationReported = false;
   const revoked = /* @__PURE__ */ new Set();
   const stop = () => {
     closed = true;
@@ -2346,7 +2346,7 @@ function connectAgent(config, { onReady = () => {
     const url = new URL("/agent", config.server);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     socket = new WebSocket2(url, { maxPayload: 1024 * 1024 });
-    let ready = false, active2 = 0;
+    let ready = false, active2 = 0, authSent = false, locallyRejected = false;
     const seen = /* @__PURE__ */ new Set();
     const authTimer = setTimeout(() => {
       if (!ready) socket.close();
@@ -2359,10 +2359,12 @@ function connectAgent(config, { onReady = () => {
           const signature = sign(null, Buffer.from(proofMessage(config.deviceId, msg.nonce)), config.privateKey).toString("base64url");
           const tools = TOOL_DEFS.filter((d) => (d.scope !== "files:write" || config.allowWrite) && (d.scope !== "terminal:execute" || config.allowShell)).map((d) => d.name);
           socket.send(JSON.stringify({ type: "auth", deviceId: config.deviceId, signature, version: AGENT_VERSION, tools }));
+          authSent = true;
           return;
         }
         if (msg.type === "ready" && msg.deviceId === config.deviceId) {
           ready = true;
+          everReady = true;
           retry = 0;
           clearTimeout(authTimer);
           onStatus("online");
@@ -2399,16 +2401,23 @@ function connectAgent(config, { onReady = () => {
           }
         }
       } catch {
+        locallyRejected = true;
         socket.close(1008, "Invalid relay message");
       }
     });
     socket.on("error", () => onStatus("connection-error"));
-    socket.on("close", (code) => {
+    socket.on("close", (code, reasonBytes) => {
       generation++;
       void cleanupRuntime(config);
+      const reason = reasonBytes.toString(), replaced = code === 1e3 && reason === "Replaced by a new authenticated connection";
       clearTimeout(authTimer);
-      onStatus(code === 1008 ? "authorization-rejected" : "offline");
-      if (!closed && reconnect && code !== 1008) {
+      onStatus(replaced ? "replaced-by-another-connection" : code === 1008 ? "authorization-rejected" : "offline");
+      const initialRejection = !closed && !everReady && !locallyRejected && !authorizationReported && authSent && code === 1008 && ["Device authentication or message rejected", "Device authorization revoked"].includes(reason);
+      if (initialRejection) {
+        authorizationReported = true;
+        onInitialAuthorizationRejected();
+      }
+      if (!closed && reconnect && code !== 1008 && !replaced) {
         timer = setTimeout(connect, Math.min(3e4, 1e3 * 2 ** Math.min(retry++, 5)) + Math.random() * 500);
       }
     });
@@ -2419,9 +2428,77 @@ function connectAgent(config, { onReady = () => {
   } };
 }
 
+// src/agent/local-session.mjs
+import fs7 from "node:fs/promises";
+import path9 from "node:path";
+import os2 from "node:os";
+import { createHash as createHash2, randomUUID as randomUUID5 } from "node:crypto";
+function agentStateDirectory() {
+  return process.platform === "win32" ? path9.join(process.env.LOCALAPPDATA || os2.homedir(), "CetriX", "Connect", "agents") : path9.join(os2.homedir(), ".local", "share", "cetrix-connect", "agents");
+}
+async function defaultWorkspace(home = os2.homedir()) {
+  const parent = await fs7.realpath(home), root = path9.join(parent, "CetriX Workspace");
+  try {
+    await fs7.mkdir(root, { mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = await fs7.lstat(root);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || await fs7.realpath(root) !== root) throw new Error("CetriX Workspace must be a real directory, not a symlink or junction. Choose another folder with --root.");
+  return root;
+}
+function remoteProfile(values) {
+  return { server: values.server, root: values.root, name: values.name, allowWrite: !!values["allow-write"], allowShell: !!values["allow-shell"] };
+}
+function profileMatches(actual, expected) {
+  return actual && Object.keys(expected).every((key) => actual[key] === expected[key]);
+}
+function sessionFile(stateDir, profile) {
+  const hash = createHash2("sha256").update(JSON.stringify(remoteProfile({ server: profile.server, root: profile.root, name: profile.name, "allow-write": profile.allowWrite, "allow-shell": profile.allowShell }))).digest("hex");
+  return path9.join(stateDir, "sessions", hash + ".json");
+}
+async function loadRemoteSession(stateDir, profile, loadIdentity2) {
+  const pointer = sessionFile(stateDir, profile);
+  let record;
+  try {
+    if ((await fs7.lstat(pointer)).isSymbolicLink()) throw new Error("Session pointer cannot be a symlink");
+    record = JSON.parse(await fs7.readFile(pointer, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new Error("Unable to read saved connection: " + error.message);
+  }
+  if (record?.version !== 1 || !profileMatches(record.profile, profile) || typeof record.identity !== "string" || !/^[0-9a-f-]{36}\.json$/i.test(record.identity)) throw new Error("Saved connection does not match the requested profile");
+  const filename = path9.join(stateDir, record.identity);
+  try {
+    if ((await fs7.lstat(filename)).isSymbolicLink()) throw new Error("Saved identity cannot be a symlink");
+    const config = await loadIdentity2(filename);
+    if (!profileMatches(config, profile) || typeof config.deviceId !== "string" || !config.deviceId || typeof config.privateKey !== "string" || !config.privateKey || typeof config.publicKey !== "string" || !config.publicKey) throw new Error("Saved identity does not match the requested profile");
+    return { filename, config };
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error("The saved connection identity is missing. Repeat the same remote command with --logout to forget this profile, then run it again without --logout.");
+    throw error;
+  }
+}
+async function saveRemoteSession(stateDir, profile, filename) {
+  if (path9.dirname(filename) !== path9.resolve(stateDir) || !/^[0-9a-f-]{36}\.json$/i.test(path9.basename(filename))) throw new Error("Cannot persist an identity outside the agent state directory");
+  const pointer = sessionFile(stateDir, profile), temporary = pointer + "." + randomUUID5() + ".tmp";
+  await fs7.mkdir(path9.dirname(pointer), { recursive: true, mode: 448 });
+  try {
+    await fs7.writeFile(temporary, JSON.stringify({ version: 1, profile, identity: path9.basename(filename) }), { mode: 384, flag: "wx" });
+    await fs7.rename(temporary, pointer);
+  } finally {
+    await fs7.unlink(temporary).catch(() => {
+    });
+  }
+}
+async function forgetRemoteSession(stateDir, profile) {
+  await fs7.unlink(sessionFile(stateDir, profile)).catch((error) => {
+    if (error.code !== "ENOENT") throw error;
+  });
+}
+
 // src/agent/entry.mjs
 var shellQuote = (value) => "'" + value.replaceAll("'", process.platform === "win32" ? "''" : "'\\''") + "'";
-var version = "0.3.0";
 var remoteServer = "https://connect.cetrix.app";
 var controlCharacters = /[\u0000-\u001f\u007f]/;
 function serverOrigin(value) {
@@ -2448,8 +2525,8 @@ function decodeOptions(value) {
   }
   return decoded;
 }
-async function prepareAgentOptions(args, { npmMode = false, input = process.stdin, output = process.stdout, isTTY = !!(input.isTTY && output.isTTY), question } = {}) {
-  const { values: v, positionals: p } = parseArgs({ args, allowPositionals: true, options: { server: { type: "string" }, root: { type: "string" }, name: { type: "string" }, config: { type: "string" }, options: { type: "string" }, "allow-write": { type: "boolean" }, "allow-shell": { type: "boolean" }, "no-browser": { type: "boolean" }, help: { type: "boolean" } } });
+async function prepareAgentOptions(args, { npmMode = false, home = os3.homedir() } = {}) {
+  const { values: v, positionals: p } = parseArgs({ args, allowPositionals: true, options: { server: { type: "string" }, root: { type: "string" }, name: { type: "string" }, config: { type: "string" }, options: { type: "string" }, "allow-write": { type: "boolean" }, "allow-shell": { type: "boolean" }, "no-browser": { type: "boolean" }, logout: { type: "boolean" }, help: { type: "boolean" } } });
   if (v.help || !p.length && !npmMode) return { help: true };
   if (p.length > 1) throw new Error("Choose one command: remote, setup, or run. Use --help.");
   const command = p[0] || (npmMode ? "remote" : void 0);
@@ -2463,35 +2540,32 @@ async function prepareAgentOptions(args, { npmMode = false, input = process.stdi
       v[target] = decoded[source];
     }
   }
-  if (command !== "remote") return { command, values: v };
-  v.server = serverOrigin(v.server || remoteServer);
-  if (!v.root && !isTTY) throw new Error('A data folder is required. Run remote in an interactive terminal, or add --root "C:\\Work" (an existing folder). No folder is granted automatically.');
-  let prompts2;
-  const ask = question || ((prompt) => {
-    prompts2 ||= createInterface({ input, output });
-    return prompts2.question(prompt);
-  });
-  try {
-    if (v.name === void 0 && isTTY) v.name = (await ask("Ten may [" + os2.hostname() + "]: ")).trim() || os2.hostname();
-    if (!v.root) v.root = (await ask("Thu muc du lieu (duong dan day du): ")).trim();
-  } finally {
-    prompts2?.close();
+  if (command !== "remote") {
+    if (v.logout) throw new Error("--logout is only supported by remote");
+    return { command, values: v };
+  }
+  if (v.config !== void 0) {
+    if (v.logout || ["root", "name", "allow-write", "allow-shell"].some((key) => v[key] !== void 0)) throw new Error("remote --config uses exactly the saved identity; do not combine it with root, name, permission, or logout options");
+    if (v.server !== void 0) v.server = serverOrigin(v.server);
+    return { command: "remote", values: v };
   }
-  v.name = (v.name ?? os2.hostname()).trim();
+  v.server = serverOrigin(v.server || remoteServer);
+  v.name = (v.name ?? os3.hostname()).trim();
   if (!v.name || v.name.length > 100 || controlCharacters.test(v.name)) throw new Error("Machine name must contain 1\u2013100 characters without control characters");
+  if (v.root === void 0) v.root = await defaultWorkspace(home);
   v.root = v.root.trim();
   if (v.root.startsWith('"') && v.root.endsWith('"')) v.root = v.root.slice(1, -1);
-  if (v.root.length > 1024 || controlCharacters.test(v.root) || !path9.isAbsolute(v.root)) throw new Error("Select an existing data folder using its full absolute path");
+  if (v.root.length > 1024 || controlCharacters.test(v.root) || !path10.isAbsolute(v.root)) throw new Error("Select an existing data folder using its full absolute path");
   let root;
   try {
-    root = await fs7.realpath(v.root);
-    if (!(await fs7.stat(root)).isDirectory()) throw new Error("Not a directory");
+    root = await fs8.realpath(v.root);
+    if (!(await fs8.stat(root)).isDirectory()) throw new Error("Not a directory");
   } catch {
     throw new Error("Data folder does not exist or cannot be opened: " + v.root);
   }
-  if (root === path9.parse(root).root) throw new Error("Select a specific work folder, not a drive root");
+  if (root === path10.parse(root).root) throw new Error("Select a specific work folder, not a drive root");
   v.root = root;
-  return { command: "setup", values: v };
+  return { command: "remote", values: v };
 }
 function openBrowser(url) {
   const child = process.platform === "win32" ? spawn4("rundll32.exe", ["url.dll,FileProtocolHandler", url], { windowsHide: true, stdio: "ignore" }) : spawn4(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" });
@@ -2507,24 +2581,31 @@ async function post(server, route, body) {
 async function runAgent(args = process.argv.slice(2), options = {}) {
   const { help, command, values: v } = await prepareAgentOptions(args, options);
   if (help) {
-    console.log("CetriX Connect agent " + version + "\n\nQuick connect: npx --yes cetrix-connect@" + version + ' remote\nRemote options: --name "PC 01" --root "C:\\Work" --server https://your-host\nSetup: node dist/agent.mjs setup --server https://your-host --root "C:\\Work" --name "PC 01"\nOptional explicit permissions: --allow-write --allow-shell\nRun: ' + (options.npmMode ? "npx --yes cetrix-connect@" + version : "node dist/agent.mjs") + ' run --config "path-to-device.json"\n\nDefault: read-only. Keep the agent open; Ctrl+C disconnects.');
+    console.log("CetriX Connect agent " + AGENT_VERSION + "\n\nQuick connect: npx --yes cetrix-connect@" + AGENT_VERSION + ' remote\nAutomatically uses this PC name and creates ~/CetriX Workspace. Approve once in your browser; repeat the same command to reconnect.\nRemote options: --name "PC 01" --root "C:\\Work" --server https://your-host\nLocal logout: remote --logout (forgets this profile; does not revoke it on the server)\nSetup: node dist/agent.mjs setup --server https://your-host --root "C:\\Work" --name "PC 01"\nOptional explicit permissions: --allow-write --allow-shell\nRun: ' + (options.npmMode ? "npx --yes cetrix-connect@" + AGENT_VERSION : "node dist/agent.mjs") + ' run --config "path-to-device.json"\n\nDefault: read-only. Keep the agent open; Ctrl+C disconnects.');
     return;
   }
-  let config, filename;
-  if (command === "setup") {
+  const stateDir = options.stateDir || agentStateDirectory();
+  const profile = command === "remote" && !v.config ? remoteProfile(v) : void 0;
+  if (v.logout) {
+    await forgetRemoteSession(stateDir, profile);
+    console.log("Local connection forgotten. Server device and grants are unchanged. Run the same remote command without --logout to pair again.");
+    return;
+  }
+  let config, filename, wasResumed = false;
+  const enroll = async () => {
     if (!v.server || !v.root) throw new Error("--server and --root are required. No home-directory access is granted by default.");
-    const server = serverOrigin(v.server), root = await fs7.realpath(v.root);
-    if (!(await fs7.stat(root)).isDirectory() || root === path9.parse(root).root) throw new Error("Select a specific work folder, not a drive root");
-    const stateDir = process.platform === "win32" ? path9.join(process.env.LOCALAPPDATA || os2.homedir(), "CetriX", "Connect", "agents") : path9.join(os2.homedir(), ".local", "share", "cetrix-connect", "agents");
-    filename = path9.resolve(v.config || path9.join(stateDir, randomUUID5() + ".json"));
+    const server = serverOrigin(v.server), root = await fs8.realpath(v.root);
+    if (!(await fs8.stat(root)).isDirectory() || root === path10.parse(root).root) throw new Error("Select a specific work folder, not a drive root");
+    if (profile && root !== profile.root) throw new Error("Data folder changed while preparing the connection; run remote again.");
+    filename = path10.resolve(v.config || path10.join(stateDir, randomUUID6() + ".json"));
     try {
-      await fs7.access(filename);
+      await fs8.access(filename);
       throw new Error("Config already exists; use run or choose a new config path");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
     const { publicKey, privateKey } = generateKeyPairSync("ed25519", { publicKeyEncoding: { type: "spki", format: "pem" }, privateKeyEncoding: { type: "pkcs8", format: "pem" } });
-    const name = v.name || os2.hostname(), allowWrite = !!v["allow-write"], allowShell = !!v["allow-shell"];
+    const name = v.name || os3.hostname(), allowWrite = !!v["allow-write"], allowShell = !!v["allow-shell"];
     console.log("CetriX Connect - " + name + "\nApproved root: " + root + "\nWrite: " + allowWrite + " | Shell: " + allowShell);
     if (allowShell) console.log("WARNING: Shell runs with this OS account privileges. It is NOT sandboxed to the root folder.");
     const begun = await post(server, "/api/enrollment/start", { name, root, publicKey, allowWrite, allowShell });
@@ -2544,22 +2625,66 @@ async function runAgent(args = process.argv.slice(2), options = {}) {
       if (!["authorization_pending", "slow_down"].includes(polled.data.error)) throw new Error(polled.data.error_description || "Enrollment failed");
     }
     if (!paired) throw new Error("Pairing expired. Run setup again.");
-    config = { server, root, name, allowWrite, allowShell, deviceId: paired.device_id, privateKey, publicKey, deniedPaths: [stateDir, path9.dirname(filename), path9.join(projectDir, "data"), path9.resolve("data")] };
+    if (typeof paired.device_id !== "string" || !paired.device_id || paired.device_id.length > 128 || controlCharacters.test(paired.device_id)) throw new Error("Server returned an invalid paired device");
+    config = { server, root, name, allowWrite, allowShell, deviceId: paired.device_id, privateKey, publicKey, deniedPaths: [stateDir, path10.dirname(filename), path10.join(projectDir, "data"), path10.resolve("data")] };
     await saveIdentity(filename, config);
-    const restart = options.npmMode ? "npx --yes cetrix-connect@" + version : "node " + shellQuote(path9.resolve(process.argv[1]));
-    console.log("\nMCP endpoint: " + paired.endpoint + "\nIdentity saved to: " + filename + "\nNext run: " + restart + " run --config " + shellQuote(filename));
-  } else if (command === "run") {
+    if (profile) await saveRemoteSession(stateDir, profile, filename);
+    const restart = options.npmMode ? "npx --yes cetrix-connect@" + AGENT_VERSION : "node " + shellQuote(path10.resolve(process.argv[1]));
+    console.log("\nMCP endpoint: " + paired.endpoint + "\nIdentity saved to: " + filename);
+    if (profile) console.log("Next run: repeat the same remote command. This connection is saved; no pairing is needed again.");
+    else console.log("Next run: " + restart + " run --config " + shellQuote(filename));
+  };
+  if (command === "remote" && v.config) {
+    filename = path10.resolve(v.config);
+    config = await loadIdentity(filename);
+    config.server = serverOrigin(config.server);
+    if (v.server !== void 0 && v.server !== config.server) throw new Error("Saved identity belongs to another server");
+    console.log("Restoring selected device: " + config.deviceId);
+  } else if (profile) {
+    const saved = await loadRemoteSession(stateDir, profile, loadIdentity);
+    if (saved) {
+      ({ filename, config } = saved);
+      wasResumed = true;
+      console.log("Restoring saved device: " + config.deviceId + "\nApproved root: " + config.root);
+    } else await enroll();
+  } else if (command === "setup") await enroll();
+  else if (command === "run") {
     if (!v.config) throw new Error("--config is required");
-    filename = path9.resolve(v.config);
+    filename = path10.resolve(v.config);
     config = await loadIdentity(filename);
     config.server = serverOrigin(config.server);
-    config.deniedPaths = [...config.deniedPaths || [], path9.dirname(filename), path9.join(projectDir, "data"), path9.resolve("data")];
-  } else throw new Error("Expected setup or run. Use --help.");
+  } else throw new Error("Expected remote, setup, or run. Use --help.");
+  let agent;
+  const start2 = async (allowRepair) => {
+    config.deniedPaths = [...config.deniedPaths || [], stateDir, path10.dirname(filename), path10.join(projectDir, "data"), path10.resolve("data")];
+    await loadPreferences(config, filename);
+    agent = connectAgent(config, {
+      onStatus: (status) => console.log((/* @__PURE__ */ new Date()).toISOString() + " " + status),
+      onShutdown: () => process.exit(0),
+      onInitialAuthorizationRejected: allowRepair ? async () => {
+        try {
+          await agent.close();
+          console.log("The saved device was rejected or revoked. Confirm a NEW pairing in your browser. Existing device permissions are not restored.");
+          await enroll();
+          await start2(false);
+        } catch (error) {
+          console.error("CetriX Connect:", error.message);
+          process.exitCode = 1;
+        }
+      } : void 0
+    });
+  };
+  await start2(wasResumed);
+  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
+    Promise.resolve(agent.close()).finally(() => process.exit(0));
+  });
+}
+async function loadPreferences(config, filename) {
   const settingsFile = filename + ".settings.json";
   try {
-    const settings = JSON.parse(await fs7.readFile(settingsFile, "utf8"));
+    const settings = JSON.parse(await fs8.readFile(settingsFile, "utf8"));
     if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new Error("Invalid preferences object");
-    if (settings.allowedDirectories !== void 0 && (!Array.isArray(settings.allowedDirectories) || !settings.allowedDirectories.length || settings.allowedDirectories.length > 20 || settings.allowedDirectories.some((p) => typeof p !== "string" || !path9.isAbsolute(p) || p.includes("\0")))) throw new Error("Invalid allowed directories");
+    if (settings.allowedDirectories !== void 0 && (!Array.isArray(settings.allowedDirectories) || !settings.allowedDirectories.length || settings.allowedDirectories.length > 20 || settings.allowedDirectories.some((p) => typeof p !== "string" || !path10.isAbsolute(p) || p.includes("\0")))) throw new Error("Invalid allowed directories");
     if (settings.blockedCommands !== void 0 && (!Array.isArray(settings.blockedCommands) || settings.blockedCommands.length > 100 || settings.blockedCommands.some((p) => typeof p !== "string" || !p.trim() || p.length > 200))) throw new Error("Invalid blocked commands");
     for (const key of ["fileReadLineLimit", "fileWriteLineLimit"]) if (settings[key] !== void 0 && (!Number.isInteger(settings[key]) || settings[key] < 1 || settings[key] > 2e3)) throw new Error("Invalid line limit");
     if (settings.defaultShell !== void 0 && !(process.platform === "win32" ? ["powershell.exe", "pwsh.exe", "cmd.exe"] : ["/bin/sh", "/bin/bash", "/bin/zsh"]).includes(settings.defaultShell)) throw new Error("Invalid default shell");
@@ -2569,19 +2694,15 @@ async function runAgent(args = process.argv.slice(2), options = {}) {
     if (error.code !== "ENOENT") throw new Error("Unable to load agent settings: " + error.message);
   }
   config.savePreferences = async (preferences) => {
-    const temporary = settingsFile + "." + randomUUID5() + ".tmp";
+    const temporary = settingsFile + "." + randomUUID6() + ".tmp";
     try {
-      await fs7.writeFile(temporary, JSON.stringify(preferences, null, 2), { mode: 384, flag: "wx" });
-      await fs7.rename(temporary, settingsFile);
+      await fs8.writeFile(temporary, JSON.stringify(preferences, null, 2), { mode: 384, flag: "wx" });
+      await fs8.rename(temporary, settingsFile);
     } finally {
-      await fs7.unlink(temporary).catch(() => {
+      await fs8.unlink(temporary).catch(() => {
       });
     }
   };
-  const agent = connectAgent(config, { onStatus: (status) => console.log((/* @__PURE__ */ new Date()).toISOString() + " " + status), onShutdown: () => process.exit(0) });
-  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
-    Promise.resolve(agent.close()).finally(() => process.exit(0));
-  });
 }
 
 // src/agent/remote.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cetrix-connect",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Connect one approved computer to your CetriX Connect account",
   "type": "module",
   "license": "UNLICENSED",