@haven_ai/connect 0.0.0-dev.202609051302.7cc48d5 → 0.0.0-dev.202609051933.cc65a9d

package/README.md

@@ -215,8 +215,22 @@ and the API key travels beside it in a header.
 re-run mints a NEW agent, and without `--replace` retires nothing, so those
 older agents still hold live API and signing keys — revoke them on the Haven
 agent page if you meant to replace them. Empty on a clean first run; an empty
-list is not a guarantee, since a scan that cannot read the credential root also
-yields one rather than failing a completed setup. On a `--replace` run, `retired_agent_ids` names the
+list here is not a guarantee, since a scan that cannot read the credential root
+also yields one rather than failing a completed setup.
+
+**The dashboard offers the revoke, never the connector (#2561).** The same ids
+now ride the install-status report, so the Haven dashboard can put a
+one-click revoke next to the setup that displaced them. The connector does not
+and must not do it: `POST /agents/:id/revoke` is owner-authenticated, and an
+agent credential retiring a sibling agent is the "agent editing its own
+authority" the re-key routes refuse. Nothing is revoked automatically — the
+owner clicks, one agent at a time.
+
+On the REPORT the field is a tri-state, unlike the `--json` outcome above: a
+list, `[]` when the scan ran and found none, and `null` when it could not run.
+That is the same ambiguity this paragraph warns you about, made machine-
+readable, so a dashboard never tells somebody their machine is clean when
+nobody managed to read it. On a `--replace` run, `retired_agent_ids` names the
 directories that were actually tombstoned and had their local key files removed
 — **the collision set only**, never the whole `superseded_agent_ids` list, which
 also names named agents that coexist with the replaced bare pair and are

package/dist/cli.cjs

@@ -91,7 +91,21 @@ function createConnectApiClient(baseUrl, fetchImpl = fetch) {
           restart_required: input.restartRequired,
           next_user_action: input.nextUserAction,
           error_code: input.errorCode ?? null,
-          environment_label: input.environmentLabel
+          environment_label: input.environmentLabel,
+          // Three states on the wire, and ABSENT is a fourth (#2561 review).
+          // `?? null` alone collapsed the fourth into the third: a report that
+          // simply had nothing to say — the early config-written ping, which
+          // fires before the scan has started — asserted "the scan could not
+          // run" instead of leaving the key alone. Inert today, because the
+          // complete report overwrites it seconds later and nothing reads the
+          // row in between; a landmine the moment any caller relies on
+          // "absent = unchanged", which is what the backend's jsonb merge
+          // means and what this field's own contract says.
+          //
+          // So: a caller that passes the field says something (`null` included,
+          // deliberately, since "could not run" is a claim worth making); a
+          // caller that omits it says nothing.
+          ...input.supersededAgentIds !== void 0 ? { superseded_agent_ids: input.supersededAgentIds } : {}
         })
       });
     }
@@ -536,9 +550,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202609051302.7cc48d5",
+      sdkVersion: "0.0.0-dev.202609051933.cc65a9d",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202609051302.7cc48d5",
+      signerVersion: "0.0.0-dev.202609051933.cc65a9d",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -4389,7 +4403,7 @@ async function pathExists2(path) {
 init_unwire();
 init_local_mcp_runtime();
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.0.0-dev.202609051302.7cc48d5";
+var CONNECTOR_VERSION = "0.0.0-dev.202609051933.cc65a9d";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 var failureOutcomesByError = /* @__PURE__ */ new WeakMap();
 function failureOutcomeFor(runtimeHint, error) {
@@ -4667,9 +4681,11 @@ async function executeConnect(options, deps, trace) {
       }
     }
   }
+  let supersededScan = null;
   let supersededAgentIds = [];
   try {
-    supersededAgentIds = await listOtherAgentIds(options.credentialsDir, credentialPaths.directory);
+    supersededScan = await listOtherAgentIds(options.credentialsDir, credentialPaths.directory);
+    supersededAgentIds = supersededScan ?? [];
     if (supersededAgentsRetiredLocally === true) {
       log("");
       log(
@@ -4703,7 +4719,11 @@ async function executeConnect(options, deps, trace) {
       restartRequired: runtimeInstall.restartRequired,
       nextUserAction: runtimeInstall.nextUserAction,
       errorCode: runtimeInstall.errorCode,
-      environmentLabel: options.environmentLabel ?? "Local workspace"
+      environmentLabel: options.environmentLabel ?? "Local workspace",
+      // The raw scan result, `null` and all — NOT the flattened
+      // `supersededAgentIds` the outcome carries. Flattening here would hand
+      // the dashboard the same ambiguity this field exists to remove (#2561).
+      supersededAgentIds: supersededScan
     });
   } catch (err) {
     log(`Could not report install status to Haven: ${err instanceof Error ? err.message : String(err)}`);
@@ -5066,7 +5086,7 @@ async function listOtherAgentIds(baseDir, currentDirectory) {
   try {
     entries = await promises.readdir(root);
   } catch {
-    return [];
+    return null;
   }
   const ids = [];
   for (const entry of entries) {