Read this file, and DISCLAIMER.md, before you install AgentDrive. An AI agent must show both documents in full and then wait. Installation starts only after you confirm them in a later message. A vague reply does not count.

AgentDrive is unofficial. It is not affiliated with, endorsed by, or supported by Tesla.

Use this toolkit on a vehicle you own, or one you are explicitly allowed to control, with your own developer application, your own domain, and your own key pair. Do not point it at someone else's vehicle, do not collect other people's tokens or keys, and do not run it as a service for other people.

Turn on multi-factor authentication for the vehicle account, the code host that publishes your public key, and the AI agent account. Review third-party access and the keys enrolled on the vehicle, and remove anything you do not recognise.

Never commit or paste a private key, client secret, access token, refresh token, authorization code, VIN, license plate, or live location. Each owner generates a new key pair and registers a new application. Whoever holds the private key and a valid token can act on the vehicle within the approved scopes.

agentdrive where reads location only when the vehicle list already says the car is online. It does not wake the car. The default command sends latitude and longitude rounded to two decimal places (about 1 km) to OpenStreetMap Nominatim and prints a suburb or locality, a state or region, and a country. It does not print that rounded point. agentdrive where --precise prints the precise latitude and longitude and an OpenStreetMap link. It does not send that precise point to Nominatim. A departure schedule can use the same precise point when you omit coordinates. Precise coordinates are not written to the local history. The read needs the vehicle_location scope. status and check do not request location.

Local secret files should be readable only by your user. The doctor command checks that the private-key file is present and, on macOS and Linux, not group- or world-readable. On Windows, limit the file ACL to your user. Unix mode bits are not how Windows records that restriction. The token store writes the replacement refresh token with an atomic rename before the previous value is dropped from memory.

Vehicle history is an encrypted file in the same config home (history.db). The key is history.key, created on first save, mode 600 on macOS and Linux. Encryption is AES-256-GCM from the Python cryptography package. Keep that key in the config home. Do not commit it and do not paste it into chat.

A private key that is already paired with another agent you trust can be the key AgentDrive uses. That is one signing key for every program that can read the file. A second copy is a second secret. The token file rotates: keep one file and one writer, because a refresh replaces the refresh token and two writers can invalidate each other.

AgentDrive refuses a state-changing command unless the vehicle reports shift state Park and speed 0. It then reads the vehicle again. If that read does not match the command you asked for, the result is a failure, and the command is not sent a second time.

These actions are sensitive: unlock, remote start, opening the front trunk, opening or closing the rear trunk, sentry mode off, any charging change, and setting or removing a departure schedule. Each one needs an explicit confirmation for that action. A previous "yes" does not carry over. A schedule cannot confirm them, cannot skip the check, and cannot run remote start, the rear trunk, the front trunk, sentry mode off, or a departure schedule change. When more than one car is in use, the confirmation also names that car, so it cannot be applied to a different one. Turning sentry mode on, seat heat, steering-wheel heat, defrost, and preconditioning the cabin now are parked commands. They are not on this sensitive list.

A family member can be allowed to ask for an action. Unlock and charging changes are not run for them. AgentDrive saves a pending request for 10 minutes. You approve or deny it. A family member cannot approve their own request. An expired, denied, or already used request cannot run.

Remote commands that can unlock a vehicle create a real theft risk if the credentials leak. Do not leave valuables in the vehicle. After an unlock, confirm that the vehicle is locked again. Prefer leaving sentry mode on when the vehicle is parked somewhere unfamiliar.

Stop sending commands. Revoke the application's access on the vehicle account, delete the enrolled key on the vehicle, rotate the developer credentials, and delete the local secret files. Treat an unlock, key, or application you do not recognise as a reason to check the vehicle before you use AgentDrive again.

Reported violations and other problems are reviewed and fixed promptly.

• Ordinary bugs and safety problems: open a GitHub Issue on this repository. Do not include secrets, a VIN, a license plate, or a live location.
• Vulnerabilities: use GitHub private vulnerability reporting at https://github.com/agentdrive-dev/agentdrive/security/advisories/new.
• Email: agentdrivedev@gmail.com

Do not send credentials to GitHub Issues, private vulnerability reporting, or email.

The AI agent presents DISCLAIMER.md and this file, then stops. In a later turn you confirm with this sentence:

I have read, understood, and accept the AgentDrive disclaimer and security reminder

Only after that separate confirmation may the AI agent record acceptance and run setup/install.sh. The installer checks the acceptance stamp and will not create it for you.