@haven_ai/connect 0.0.0-dev.202609181713.990ba70 → 0.0.0-dev.202609181807.87b28b1

package/dist/cli.cjs

@@ -533,6 +533,16 @@ async function writeConnectOutcomeRecord(directory, outcome, warn) {
   await restrictPermissions(path$1, 384, warn);
   return path$1;
 }
+async function readConnectOutcomeRuntime(directory) {
+  try {
+    const parsed = JSON.parse(await promises.readFile(path.join(directory, CONNECT_OUTCOME_FILENAME), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const runtime = parsed.runtime;
+    return typeof runtime === "string" && runtime.length > 0 ? runtime : null;
+  } catch {
+    return null;
+  }
+}
 var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME;
 var init_storage = __esm({
   "src/storage.ts"() {
@@ -557,9 +567,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202609181713.990ba70",
+      sdkVersion: "0.0.0-dev.202609181807.87b28b1",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202609181713.990ba70",
+      signerVersion: "0.0.0-dev.202609181807.87b28b1",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -3520,6 +3530,20 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   runRepair: () => runRepair
 });
+function runtimeFlagFor(runtime) {
+  return normalizeRuntimeName(runtime) ? ` --runtime ${runtime}` : "";
+}
+async function resolveDoctorRuntime(input, directory) {
+  const explicit = input.runtime.trim();
+  if (explicit) return { runtime: explicit, origin: "flag" };
+  if (directory) {
+    const recorded = await readConnectOutcomeRuntime(directory);
+    if (recorded !== null && normalizeRuntimeName(recorded)) {
+      return { runtime: recorded, origin: "record" };
+    }
+  }
+  return { runtime: "", origin: "unknown" };
+}
 async function discoverCredentialDirectory(homeDir, explicit) {
   const root = explicit ? path.dirname(explicit) : path.join(homeDir, ".haven", "agents");
   let entries = [];
@@ -3600,7 +3624,7 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
       label,
       ok: false,
       detail: `A re-key started ${started} has COMPLETED on Haven \u2014 the agent's signing address is already ${address}, the one this machine generated \u2014 but the local half was never finished, so the credential files here still hold the old key. Parked at ${status.path}.` + (status.state === "expired" ? " The local file is also past its 24h TTL, which --rekey-finish refuses, so the finish command below will not accept it any more." : ""),
-      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you> --runtime ${runtime}`
+      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you>${runtimeFlagFor(runtime)}`
     };
   }
   const wedgeNote = "Haven is NOT yet on this address, so the re-key did not complete. This machine cannot tell whether the on-chain revoke on the agent page already ran: if it did not, closing this costs nothing; if it did, the agent's old delegations are revoked, no new ones were issued, and only an owner re-grant restores its spend authority (#1868). Check the agent page before assuming the harmless case.";
@@ -3701,7 +3725,7 @@ async function checksForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       ok: false,
       detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   } else if (sidecar.runtime_spec_override) {
     const matches = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3713,7 +3737,7 @@ async function checksForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       ok: matches,
       detail: matches ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory} (override install \u2014 see runtime_spec_override)` : `Override runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime} with the same HAVEN_*_SPEC variables set.` }
+      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)} with the same HAVEN_*_SPEC variables set.` }
     });
   } else {
     const intact = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3727,7 +3751,7 @@ async function checksForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       ok,
       detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : intact ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion} \u2014 intact, but outdated.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
     });
   }
   const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env);
@@ -3768,7 +3792,7 @@ async function checksForAgent(entry, input, deps) {
         label: "Hosted identity matches the local signing key",
         ok: false,
         detail: probe.status === "unauthorized" ? "The stored API key was rejected, so the agent it authenticates as cannot be compared with the local signing key." : `Could not read the hosted identity (${probe.status}) \u2014 the comparison did not happen, so it cannot be reported as a match.`,
-        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor --runtime ${input.runtime}`
+        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor${runtimeFlagFor(input.runtime)}`
       });
     } else if (!localDelegate) {
       checks.push({
@@ -3820,7 +3844,7 @@ async function checksForAgent(entry, input, deps) {
         label: "Signer stdio handshake",
         ok: probe.status === "ok",
         detail: probe.status === "ok" ? `Signer started, listed ${probe.toolNames?.length ?? 0} tools${probe.serverInfo?.version ? ` (v${probe.serverInfo.version})` : ""}.${compatDetail}` : `Handshake failed: ${probe.status}.`,
-        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
       });
     }
   } else {
@@ -3829,7 +3853,7 @@ async function checksForAgent(entry, input, deps) {
       label: "Signer stdio handshake",
       ok: false,
       detail: "Skipped \u2014 no prepared signer runtime to probe.",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   }
   return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
@@ -3839,7 +3863,10 @@ async function runDoctor(input, deps = {}) {
   const checks = [];
   let signerCapabilities;
   const { directory, others, parkedOnly } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const resolution = await resolveDoctorRuntime(input, directory);
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  const configPath = runtimeConfigPathFor(input2.runtime, homeDir);
   let configText = null;
   if (configPath !== null) {
     try {
@@ -3876,7 +3903,7 @@ async function runDoctor(input, deps = {}) {
         // A tombstone is a deliberate record and outranks the discovery tell:
         // a retired directory that also holds a parked key stays `retired`.
         classification: tombstone ? "retired" : parkedOnly.has(dir) ? "parked" : "orphaned",
-        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)] : [],
+        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)] : [],
         ...rekeyPending ? { rekeyPending } : {}
       });
       continue;
@@ -3891,11 +3918,11 @@ async function runDoctor(input, deps = {}) {
       ...rekeyPending ? { rekeyPending } : {}
     };
     if (wired) {
-      const result = await checksForAgent({ directory: dir, identity, sidecar }, input, deps);
+      const result = await checksForAgent({ directory: dir, identity, sidecar }, input2, deps);
       entry.checks = result.checks;
       capabilitiesByDirectory.set(dir, result.signerCapabilities);
     } else if (rekeyPending) {
-      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)];
+      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)];
     }
     inventory.push(entry);
   }
@@ -3920,7 +3947,7 @@ async function runDoctor(input, deps = {}) {
     if (!primaryChecksById.has("credentials")) {
       const result = await checksForAgent(
         { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
-        input,
+        input2,
         deps
       );
       signerCapabilities = result.signerCapabilities;
@@ -3931,12 +3958,20 @@ async function runDoctor(input, deps = {}) {
       if (check) checks.push(check);
     }
   }
-  if (configPath === null) {
+  if (configPath === null && input2.runtime === "") {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      ok: false,
+      detail: `Runtime is unknown \u2014 no runtime flag was given and the connector's record in ${primaryDirectory ?? input.credentialsDir ?? "~/.haven/agents"} carries no resolvable ${CONNECT_OUTCOME_FILENAME} runtime. The runtime config was NOT checked. Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`,
+      repair: `Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+    });
+  } else if (configPath === null) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
       ok: true,
-      detail: `Runtime '${input.runtime}' has no file-based config the connector owns (CLI-managed) \u2014 skipping the file check.`
+      detail: `Runtime '${input2.runtime}' is configured through its own CLI or by hand (${input2.runtime === "other" ? "manual runtime" : "CLI-managed"}) and has no file-based config the connector owns \u2014 skipping the file check.`
     });
   } else if (configText === null) {
     checks.push({
@@ -3944,7 +3979,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       ok: false,
       detail: `No runtime config at ${configPath}.`,
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}`
     });
   } else {
     const primaryIdentity = await readIdentity(primaryDirectory ?? "");
@@ -3958,7 +3993,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       ok,
       detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}` }
     });
   }
   for (const id of ["hosted_mcp", "identity_match", "rekey_pending"]) {
@@ -4031,18 +4066,18 @@ async function runDoctor(input, deps = {}) {
   }
   const signerProcess = primaryChecksById.get("signer_process");
   if (signerProcess) checks.push(signerProcess);
-  const restart = restartRequiredForRuntime(input.runtime, deps.env);
+  const restart = restartRequiredForRuntime(input2.runtime, deps.env);
   checks.push({
     id: "restart",
     label: "Runtime restart",
     ok: true,
-    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : "No restart requirement known for this runtime."
+    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : input2.runtime === "" ? "Runtime is unknown \u2014 whether a restart is needed cannot be determined. Re-run the doctor naming the runtime for a definitive answer." : "No restart requirement known for this runtime."
   });
   const wiredOk = inventory.filter((entry) => entry.classification === "wired").every((entry) => entry.checks.every((check) => check.ok));
   return {
     version: 1,
     ok: checks.every((check) => check.ok) && wiredOk,
-    runtime: input.runtime,
+    runtime: input2.runtime,
     credentialDirectory: primaryDirectory,
     checks,
     agents: inventory,
@@ -4062,6 +4097,21 @@ async function runRepair(input, deps = {}) {
       messages: [`No agent credentials found to repair \u2014 run the full setup: ${RERUN} --setup <token>.`]
     };
   }
+  const resolution = await resolveDoctorRuntime(input, directory);
+  if (resolution.origin === "record") {
+    messages.push(`Runtime not given \u2014 resolved '${resolution.runtime}' from ${path.join(directory, CONNECT_OUTCOME_FILENAME)}.`);
+  }
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  if (runtime === "") {
+    return {
+      ok: false,
+      messages: [
+        "Runtime is unknown \u2014 no runtime flag was given and the connector record carries no resolvable runtime.",
+        `Repair rewrites the runtime config, so it will not guess. Re-run repair naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+      ]
+    };
+  }
   let identity;
   try {
     identity = JSON.parse(await promises.readFile(path.join(directory, "identity.json"), "utf8"));
@@ -4071,7 +4121,7 @@ async function runRepair(input, deps = {}) {
   if (!identity.api_key || !(identity.hosted_mcp_url || identity.api_url)) {
     return { ok: false, messages: ["identity.json lacks the stored API key / hosted URL \u2014 re-run the full setup."] };
   }
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const configPath = runtimeConfigPathFor(input2.runtime, homeDir);
   if (configPath) {
     try {
       const existing = await promises.readFile(configPath, "utf8");
@@ -4098,7 +4148,7 @@ async function runRepair(input, deps = {}) {
   const names = serverNamesFor(serverName);
   messages.push(`Rewriting MCP entries ${names.hosted} / ${names.signer}${serverName ? ` (agent "${serverName}")` : " (unnamed pair)"} \u2014 no other pair is touched.`);
   const configResult = await writeRuntimeConfig({
-    runtime: input.runtime,
+    runtime: input2.runtime,
     hostedMcpUrl: identity.hosted_mcp_url ?? `${identity.api_url}/mcp`,
     apiKey: identity.api_key,
     identityPath: path.join(directory, "identity.json"),
@@ -4429,7 +4479,7 @@ async function pathExists2(path) {
 init_unwire();
 init_local_mcp_runtime();
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.0.0-dev.202609181713.990ba70";
+var CONNECTOR_VERSION = "0.0.0-dev.202609181807.87b28b1";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 var failureOutcomesByError = /* @__PURE__ */ new WeakMap();
 function failureOutcomeFor(runtimeHint, error) {