@haven_ai/connect 0.0.0-dev.202609181713.990ba70 → 0.0.0-dev.202609181927.cd4620a

package/README.md

@@ -87,13 +87,39 @@ every credential directory on the machine and classifies each one:
 | `retired` | Tombstoned (see below); key material removed. |
 | `orphaned` | No usable identity and no tombstone. |
 
-The exit code is non-zero if **any** wired agent fails **any** check — not
+The exit code is non-zero if **any** wired agent fails **any** check
+(`level: failed` — see the next section; an advisory does not count) — not
 only the one the report's main section describes. In `--json`, the same
 information is on `agents[]`, each entry carrying `slug`, `agentId`,
 `directory`, `classification` and its own `checks[]`; the flat `checks` array
 is retained and still describes one agent, so a single-agent install reads as
 it always did.
 
+### Three verdicts, not two (#3121)
+
+Every check carries a `level` — `ok`, `advisory` or `failed` — and the report
+carries the rolled-up `level` over the flat checks and every wired agent's
+checks. Only `failed` reaches the exit code; an advisory is printed with a `!`
+marker, gets its own summary line ("No failures. N advisory finding(s)") and
+exits 0. `ok` on a check and on the report is kept for `--json` consumers and
+means "nothing is broken": it is `true` for `ok` and `advisory`, `false` only
+for `failed`, so `report.ok` is always the exit code's predicate. The doctor
+report stays `version: 1`; `level` is additive.
+
+| Level | Meaning | Example |
+| --- | --- | --- |
+| `ok` | Nothing to say. | The installed signer matches the connector's pin. |
+| `advisory` | Worth reading; nothing is broken. Exit 0. | `signer_runtime`: the install is intact but behind the pinned version ("intact, but outdated" — both versions named, `--repair` offered). `superseded_agents` on a recognised runtime with no config file the connector can read (Claude Code, `other`): a second live key is reported, and the check says why "wired" cannot be verified from this machine. |
+| `failed` | A real failure with one repair action. Exit 1. | A stale or empty runtime directory; a live key in a directory the runtime's config demonstrably does not use. |
+
+What stays blocking is live spend authority: a directory whose stored key
+still authenticates and whose classification is not `wired` fails the run, for
+every non-wired classification, whenever the runtime config could be read. The
+classification itself does not change on Claude Code — only the severity of
+the check that reads it — so `agents[]` reads as before. A runtime string the
+connector does not recognise (`--runtime codex-clii`) is not "no config": it
+fails `runtime_config` naming the allowed values, and demotes nothing.
+
 One check is worth calling out: **`identity_match`** compares the agent the
 stored API key actually authenticates as against the `delegate_address` in
 that directory's `signer.json`. A mismatch means the runtime would quote as
@@ -496,9 +522,9 @@ the agent credential files, the pinned signer runtime install (and, since
 see the last section of this file), the hosted MCP
 (authorized `tools/list`), and starts the local signer for a real stdio
 handshake — reporting its advertised compat versions. Every failing check
-prints one concrete repair action; the exit code is non-zero on any failure.
-Add `--json` for a machine-readable report. No secret material is ever
-printed.
+prints one concrete repair action; the exit code is non-zero on any failure
+and zero on an advisory (see "Three verdicts, not two" above). Add `--json`
+for a machine-readable report. No secret material is ever printed.
 
 `--doctor` also probes every OTHER agent credential directory it did not
 select (#1688). A re-run of setup mints a NEW agent and, unless it ran with

package/dist/cli.cjs

@@ -533,6 +533,16 @@ async function writeConnectOutcomeRecord(directory, outcome, warn) {
   await restrictPermissions(path$1, 384, warn);
   return path$1;
 }
+async function readConnectOutcomeRuntime(directory) {
+  try {
+    const parsed = JSON.parse(await promises.readFile(path.join(directory, CONNECT_OUTCOME_FILENAME), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const runtime = parsed.runtime;
+    return typeof runtime === "string" && runtime.length > 0 ? runtime : null;
+  } catch {
+    return null;
+  }
+}
 var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME;
 var init_storage = __esm({
   "src/storage.ts"() {
@@ -557,9 +567,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202609181713.990ba70",
+      sdkVersion: "0.0.0-dev.202609181927.cd4620a",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202609181713.990ba70",
+      signerVersion: "0.0.0-dev.202609181927.cd4620a",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -3517,9 +3527,32 @@ var init_rekey_restart = __esm({
 var doctor_exports = {};
 __export(doctor_exports, {
   describeAccountAddressKey: () => describeAccountAddressKey,
+  rollUpLevel: () => rollUpLevel,
   runDoctor: () => runDoctor,
   runRepair: () => runRepair
 });
+function finalizeCheck(check) {
+  return { ...check, ok: check.level !== "failed" };
+}
+function rollUpLevel(checks) {
+  if (checks.some((check) => check.level === "failed")) return "failed";
+  if (checks.some((check) => check.level === "advisory")) return "advisory";
+  return "ok";
+}
+function runtimeFlagFor(runtime) {
+  return normalizeRuntimeName(runtime) ? ` --runtime ${runtime}` : "";
+}
+async function resolveDoctorRuntime(input, directory) {
+  const explicit = input.runtime.trim();
+  if (explicit) return { runtime: explicit, origin: "flag" };
+  if (directory) {
+    const recorded = await readConnectOutcomeRuntime(directory);
+    if (recorded !== null && normalizeRuntimeName(recorded)) {
+      return { runtime: recorded, origin: "record" };
+    }
+  }
+  return { runtime: "", origin: "unknown" };
+}
 async function discoverCredentialDirectory(homeDir, explicit) {
   const root = explicit ? path.dirname(explicit) : path.join(homeDir, ".haven", "agents");
   let entries = [];
@@ -3580,13 +3613,16 @@ function agentIsWired(configText, names, slug, identity, sidecar, isPrimary, bar
   return isPrimary && Boolean(identity?.hosted_mcp_url && configText.includes(identity.hosted_mcp_url));
 }
 function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
+  return finalizeCheck(rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug));
+}
+function rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug) {
   const label = "Pending re-key";
   const nameFlag = slug ? ` --name ${slug}` : "";
   if (status.state === "unreadable") {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key was started here but ${status.path} does not parse, so neither the address it generated nor when it started can be read. The file still holds what was a private key.`,
       repair: `Delete ${status.path}, then start again: ${RERUN} --rekey${nameFlag}`
     };
@@ -3598,9 +3634,9 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key started ${started} has COMPLETED on Haven \u2014 the agent's signing address is already ${address}, the one this machine generated \u2014 but the local half was never finished, so the credential files here still hold the old key. Parked at ${status.path}.` + (status.state === "expired" ? " The local file is also past its 24h TTL, which --rekey-finish refuses, so the finish command below will not accept it any more." : ""),
-      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you> --runtime ${runtime}`
+      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you>${runtimeFlagFor(runtime)}`
     };
   }
   const wedgeNote = "Haven is NOT yet on this address, so the re-key did not complete. This machine cannot tell whether the on-chain revoke on the agent page already ran: if it did not, closing this costs nothing; if it did, the agent's old delegations are revoked, no new ones were issued, and only an owner re-grant restores its spend authority (#1868). Check the agent page before assuming the harmless case.";
@@ -3608,7 +3644,7 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key started ${started} EXPIRED ${status.expiresAt ?? ""} without being finished. Its address was ${address}; the private half it generated is still on disk at ${status.path}. ` + wedgeNote,
       repair: `Either delete ${status.path} to drop the parked key, or start over: ${RERUN} --rekey${nameFlag}. Connect never deletes it for you \u2014 an expired TTL is a refusal to USE the key, not a licence to destroy key material you may still be mid-flow on.`
     };
@@ -3616,7 +3652,7 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
   return {
     id: "rekey_pending",
     label,
-    ok: true,
+    level: "ok",
     detail: `A re-key started ${started} is still open (expires ${status.expiresAt ?? "unknown"}). Paste this address into "Replace signing key" on the Haven agent page: ${address}. Parked at ${status.path}. ` + wedgeNote
   };
 }
@@ -3644,13 +3680,13 @@ async function runtimeSpecOverrideCheck(directory, sidecar, env) {
   if (shell) facts.push(shell);
   if (facts.length === 0) return void 0;
   const variables = Object.values(RUNTIME_SPEC_ENV).join(" / ");
-  return {
+  return finalizeCheck({
     id: "runtime_spec_override",
     label: "Runtime spec override",
-    ok: false,
+    level: "failed",
     detail: `runtime spec overridden \u2014 not the pinned manifest (${MCP_RUNTIME_MANIFEST.signerPackage}@${MCP_RUNTIME_MANIFEST.signerVersion}, ${MCP_RUNTIME_MANIFEST.sdkPackage}@${MCP_RUNTIME_MANIFEST.sdkVersion}). ${facts.join(". ")}.`,
     repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>. If the override is intentional, this finding is the record of it.`
-  };
+  });
 }
 async function readMcpSidecarOverride(directory) {
   try {
@@ -3677,6 +3713,13 @@ function describeAccountAddressKey(identity, signerFile) {
   return "no account address stored";
 }
 async function checksForAgent(entry, input, deps) {
+  const verdicts = await verdictsForAgent(entry, input, deps);
+  return {
+    checks: verdicts.checks.map(finalizeCheck),
+    ...verdicts.signerCapabilities ? { signerCapabilities: verdicts.signerCapabilities } : {}
+  };
+}
+async function verdictsForAgent(entry, input, deps) {
   const { directory, identity, sidecar } = entry;
   const checks = [];
   let signerCapabilities;
@@ -3691,7 +3734,7 @@ async function checksForAgent(entry, input, deps) {
   checks.push({
     id: "credentials",
     label: "Agent credentials",
-    ok: credentialsOk,
+    level: credentialsOk ? "ok" : "failed",
     detail: credentialsOk ? `identity.json and signer.json parse (agent ${identity?.agent_id ?? "unknown"}; ${describeAccountAddressKey(identity, signerFile)})` : "identity.json or signer.json is missing or unparseable.",
     ...credentialsOk ? {} : { repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` }
   });
@@ -3699,9 +3742,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok: false,
+      level: "failed",
       detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   } else if (sidecar.runtime_spec_override) {
     const matches = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3711,9 +3754,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok: matches,
+      level: matches ? "ok" : "failed",
       detail: matches ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory} (override install \u2014 see runtime_spec_override)` : `Override runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime} with the same HAVEN_*_SPEC variables set.` }
+      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)} with the same HAVEN_*_SPEC variables set.` }
     });
   } else {
     const intact = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3725,9 +3768,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok,
+      level: ok ? "ok" : intact ? "advisory" : "failed",
       detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : intact ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion} \u2014 intact, but outdated.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
     });
   }
   const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env);
@@ -3738,7 +3781,7 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "hosted_mcp",
       label: "Hosted Haven MCP",
-      ok: probe.status === "ok",
+      level: probe.status === "ok" ? "ok" : "failed",
       detail: probe.status === "ok" ? `MCP tools endpoint is reachable (${hostedUrl}).` : `MCP tools endpoint probe failed: ${probe.status} (${hostedUrl}).`,
       ...probe.status === "ok" ? {} : {
         repair: "Check network access and runtime configuration for the hosted MCP URL, then re-run --doctor."
@@ -3748,7 +3791,7 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "hosted_mcp",
       label: "Hosted Haven MCP",
-      ok: false,
+      level: "failed",
       detail: "No stored API key / hosted MCP URL to probe with.",
       repair: `Re-run the full setup: ${RERUN} --setup <token>.`
     });
@@ -3766,15 +3809,15 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: false,
+        level: "failed",
         detail: probe.status === "unauthorized" ? "The stored API key was rejected, so the agent it authenticates as cannot be compared with the local signing key." : `Could not read the hosted identity (${probe.status}) \u2014 the comparison did not happen, so it cannot be reported as a match.`,
-        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor --runtime ${input.runtime}`
+        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor${runtimeFlagFor(input.runtime)}`
       });
     } else if (!localDelegate) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: false,
+        level: "failed",
         detail: "signer.json holds no delegate_address to compare against the hosted identity.",
         repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.`
       });
@@ -3783,7 +3826,7 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: same,
+        level: same ? "ok" : "failed",
         detail: same ? `The stored API key authenticates as the agent whose signing key is in this directory (${shortAddress(localDelegate)}).` : `MISMATCH: the stored API key authenticates as agent ${probe.agentId ?? "unknown"} with delegate ${shortAddress(probe.delegateAddress ?? "unknown")}, but signer.json here holds ${shortAddress(localDelegate)}. This runtime would quote as one agent and sign as another.`,
         ...same ? {} : {
           repair: `Re-run setup for this agent so its API key and signing key come from one run: ${RERUN} --setup <token>. Do not hand-edit either file.`
@@ -3801,7 +3844,7 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "signer_process",
         label: "Signer stdio handshake",
-        ok: false,
+        level: "failed",
         detail: "The local-tools consent is not acknowledged, so the signer refuses to start (by design).",
         repair: `Run: ${RERUN} --ack-local-tools --setup <token>  (or re-run your original connector command with --ack-local-tools).`
       });
@@ -3818,18 +3861,18 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "signer_process",
         label: "Signer stdio handshake",
-        ok: probe.status === "ok",
+        level: probe.status === "ok" ? "ok" : "failed",
         detail: probe.status === "ok" ? `Signer started, listed ${probe.toolNames?.length ?? 0} tools${probe.serverInfo?.version ? ` (v${probe.serverInfo.version})` : ""}.${compatDetail}` : `Handshake failed: ${probe.status}.`,
-        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
       });
     }
   } else {
     checks.push({
       id: "signer_process",
       label: "Signer stdio handshake",
-      ok: false,
+      level: "failed",
       detail: "Skipped \u2014 no prepared signer runtime to probe.",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   }
   return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
@@ -3839,7 +3882,11 @@ async function runDoctor(input, deps = {}) {
   const checks = [];
   let signerCapabilities;
   const { directory, others, parkedOnly } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const resolution = await resolveDoctorRuntime(input, directory);
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  const normalizedRuntime = normalizeRuntimeName(input2.runtime);
+  const configPath = runtimeConfigPathFor(normalizedRuntime ?? input2.runtime, homeDir);
   let configText = null;
   if (configPath !== null) {
     try {
@@ -3876,7 +3923,7 @@ async function runDoctor(input, deps = {}) {
         // A tombstone is a deliberate record and outranks the discovery tell:
         // a retired directory that also holds a parked key stays `retired`.
         classification: tombstone ? "retired" : parkedOnly.has(dir) ? "parked" : "orphaned",
-        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)] : [],
+        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)] : [],
         ...rekeyPending ? { rekeyPending } : {}
       });
       continue;
@@ -3891,11 +3938,11 @@ async function runDoctor(input, deps = {}) {
       ...rekeyPending ? { rekeyPending } : {}
     };
     if (wired) {
-      const result = await checksForAgent({ directory: dir, identity, sidecar }, input, deps);
+      const result = await checksForAgent({ directory: dir, identity, sidecar }, input2, deps);
       entry.checks = result.checks;
       capabilitiesByDirectory.set(dir, result.signerCapabilities);
     } else if (rekeyPending) {
-      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)];
+      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)];
     }
     inventory.push(entry);
   }
@@ -3910,7 +3957,7 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "credentials",
       label: "Agent credentials",
-      ok: false,
+      level: "failed",
       detail: "No agent credential directory with an identity.json under ~/.haven/agents.",
       repair: `Run the full setup once: ${RERUN} --setup <token from the Haven dashboard>.`
     });
@@ -3920,7 +3967,7 @@ async function runDoctor(input, deps = {}) {
     if (!primaryChecksById.has("credentials")) {
       const result = await checksForAgent(
         { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
-        input,
+        input2,
         deps
       );
       signerCapabilities = result.signerCapabilities;
@@ -3931,20 +3978,37 @@ async function runDoctor(input, deps = {}) {
       if (check) checks.push(check);
     }
   }
-  if (configPath === null) {
+  const runtimeOwnsNoConfig = normalizedRuntime !== null && configPath === null;
+  if (configPath === null && input2.runtime !== "" && normalizedRuntime === null) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok: true,
-      detail: `Runtime '${input.runtime}' has no file-based config the connector owns (CLI-managed) \u2014 skipping the file check.`
+      level: "failed",
+      detail: `Runtime '${input2.runtime}' is not one the connector recognises. The runtime config was NOT checked. Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`,
+      repair: `Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+    });
+  } else if (configPath === null && input2.runtime === "") {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      level: "failed",
+      detail: `Runtime is unknown \u2014 no runtime flag was given and the connector's record in ${primaryDirectory ?? input.credentialsDir ?? "~/.haven/agents"} carries no resolvable ${CONNECT_OUTCOME_FILENAME} runtime. The runtime config was NOT checked. Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`,
+      repair: `Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+    });
+  } else if (configPath === null) {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      level: "ok",
+      detail: `Runtime '${input2.runtime}' is configured through its own CLI or by hand (${input2.runtime === "other" ? "manual runtime" : "CLI-managed"}) and has no file-based config the connector owns \u2014 skipping the file check.`
     });
   } else if (configText === null) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok: false,
+      level: "failed",
       detail: `No runtime config at ${configPath}.`,
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}`
     });
   } else {
     const primaryIdentity = await readIdentity(primaryDirectory ?? "");
@@ -3956,9 +4020,9 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok,
+      level: ok ? "ok" : "failed",
       detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}` }
     });
   }
   for (const id of ["hosted_mcp", "identity_match", "rekey_pending"]) {
@@ -4005,13 +4069,17 @@ async function runDoctor(input, deps = {}) {
       );
     }
     const supersededLive = live.filter((item) => item.entry.classification !== "wired").map((item) => item.label);
+    const classificationUnreliable = configText === null && runtimeOwnsNoConfig;
+    const supersededLevel = supersededLive.length === 0 ? "ok" : classificationUnreliable ? "advisory" : "failed";
     checks.push({
       id: "superseded_agents",
       label: "Superseded agent credentials",
-      ok: supersededLive.length === 0,
-      detail: supersededLive.length > 0 ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
-      ...supersededLive.length > 0 ? {
+      level: supersededLevel,
+      detail: supersededLevel === "failed" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : supersededLevel === "advisory" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. Runtime '${input2.runtime}' has no config file the connector can read, so which of these agents are wired cannot be verified from this machine: a live key here may be an agent you use deliberately, or one a host started before your latest setup is still spending as.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
+      ...supersededLevel === "failed" ? {
         repair: `Revoke ${supersededLive.join(", ")} on the Haven agent page, then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+      } : supersededLevel === "advisory" ? {
+        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: revoke the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : {}
     });
   }
@@ -4022,7 +4090,7 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "rekey_pending_elsewhere",
       label: "Parked re-keys in other credential directories",
-      ok: abandoned.length === 0,
+      level: abandoned.length === 0 ? "ok" : "failed",
       detail: abandoned.length > 0 ? `ABANDONED re-key key material outside the agent this report describes: ${abandoned.map(describe).join(", ")}. Each holds a private key that was generated for a re-key nobody finished.` : `${parkedElsewhere.length} other director(y/ies) hold an open pending re-key: ${parkedElsewhere.map(describe).join(", ")}.`,
       ...abandoned.length > 0 ? {
         repair: "Check the Haven agent page for each before deleting: if its on-chain revoke already ran, the agent has no spend authority until you re-grant it (#1868), and that is not visible from this machine. Connect never deletes key material for you."
@@ -4031,20 +4099,23 @@ async function runDoctor(input, deps = {}) {
   }
   const signerProcess = primaryChecksById.get("signer_process");
   if (signerProcess) checks.push(signerProcess);
-  const restart = restartRequiredForRuntime(input.runtime, deps.env);
+  const restart = restartRequiredForRuntime(input2.runtime, deps.env);
   checks.push({
     id: "restart",
     label: "Runtime restart",
-    ok: true,
-    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : "No restart requirement known for this runtime."
+    level: "ok",
+    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : input2.runtime === "" ? "Runtime is unknown \u2014 whether a restart is needed cannot be determined. Re-run the doctor naming the runtime for a definitive answer." : "No restart requirement known for this runtime."
   });
-  const wiredOk = inventory.filter((entry) => entry.classification === "wired").every((entry) => entry.checks.every((check) => check.ok));
+  const wiredChecks = inventory.filter((entry) => entry.classification === "wired").flatMap((entry) => entry.checks);
+  const finalChecks = checks.map(finalizeCheck);
+  const level = rollUpLevel([...finalChecks, ...wiredChecks]);
   return {
     version: 1,
-    ok: checks.every((check) => check.ok) && wiredOk,
-    runtime: input.runtime,
+    ok: level !== "failed",
+    level,
+    runtime: input2.runtime,
     credentialDirectory: primaryDirectory,
-    checks,
+    checks: finalChecks,
     agents: inventory,
     ...signerCapabilities ? { signerCapabilities } : {}
   };
@@ -4062,6 +4133,21 @@ async function runRepair(input, deps = {}) {
       messages: [`No agent credentials found to repair \u2014 run the full setup: ${RERUN} --setup <token>.`]
     };
   }
+  const resolution = await resolveDoctorRuntime(input, directory);
+  if (resolution.origin === "record") {
+    messages.push(`Runtime not given \u2014 resolved '${resolution.runtime}' from ${path.join(directory, CONNECT_OUTCOME_FILENAME)}.`);
+  }
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  if (runtime === "") {
+    return {
+      ok: false,
+      messages: [
+        "Runtime is unknown \u2014 no runtime flag was given and the connector record carries no resolvable runtime.",
+        `Repair rewrites the runtime config, so it will not guess. Re-run repair naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+      ]
+    };
+  }
   let identity;
   try {
     identity = JSON.parse(await promises.readFile(path.join(directory, "identity.json"), "utf8"));
@@ -4071,7 +4157,7 @@ async function runRepair(input, deps = {}) {
   if (!identity.api_key || !(identity.hosted_mcp_url || identity.api_url)) {
     return { ok: false, messages: ["identity.json lacks the stored API key / hosted URL \u2014 re-run the full setup."] };
   }
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const configPath = runtimeConfigPathFor(normalizeRuntimeName(input2.runtime) ?? input2.runtime, homeDir);
   if (configPath) {
     try {
       const existing = await promises.readFile(configPath, "utf8");
@@ -4098,7 +4184,10 @@ async function runRepair(input, deps = {}) {
   const names = serverNamesFor(serverName);
   messages.push(`Rewriting MCP entries ${names.hosted} / ${names.signer}${serverName ? ` (agent "${serverName}")` : " (unnamed pair)"} \u2014 no other pair is touched.`);
   const configResult = await writeRuntimeConfig({
-    runtime: input.runtime,
+    // Normalized for the WRITE too (#3145 review round 3): `writeRuntimeConfig`
+    // switches on the id, and the raw alias fell to its "manual runtime" arm
+    // — a repair that reported success while writing nothing.
+    runtime: normalizeRuntimeName(input2.runtime) ?? input2.runtime,
     hostedMcpUrl: identity.hosted_mcp_url ?? `${identity.api_url}/mcp`,
     apiKey: identity.api_key,
     identityPath: path.join(directory, "identity.json"),
@@ -4429,7 +4518,7 @@ async function pathExists2(path) {
 init_unwire();
 init_local_mcp_runtime();
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.0.0-dev.202609181713.990ba70";
+var CONNECTOR_VERSION = "0.0.0-dev.202609181927.cd4620a";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 var failureOutcomesByError = /* @__PURE__ */ new WeakMap();
 function failureOutcomeFor(runtimeHint, error) {
@@ -5327,7 +5416,7 @@ function helpText() {
     "                             Only available for Claude Code and Codex. Default is hosted MCP + local signer.",
     "  --json                     Emit one versioned, secret-free result object on stdout; progress stays on stderr.",
     "  --doctor                   Diagnose an existing setup (read-only, no token): config, credentials,",
-    "                             signer runtime, hosted MCP, and a live signer handshake. Exits non-zero on any failure.",
+    "                             signer runtime, hosted MCP, and a live signer handshake. Exits non-zero only on a failed check; an advisory (!) exits 0.",
     "  --repair                   Repair, then re-diagnose (implies --doctor): reinstall the pinned signer",
     "                             runtime, rewrite the wrapper and runtime config from stored credentials.",
     "                             Hosted topology only (refuses to touch a --local config). No keys, no token.",
@@ -5393,6 +5482,13 @@ function failSubcommand(io, json, err, envelope, fallback) {
   }
   return 1;
 }
+function levelMarker(level) {
+  return level === "ok" ? "\u2713" : level === "advisory" ? "!" : "\u2717";
+}
+function advisoryCount(report) {
+  const others = report.agents.filter((agent) => agent.classification === "wired" && agent.directory !== report.credentialDirectory).flatMap((agent) => agent.checks);
+  return [...report.checks, ...others].filter((check) => check.level === "advisory").length;
+}
 async function runCli(argv, io = {
   stdout: (message) => process.stdout.write(message),
   stderr: (message) => process.stderr.write(message)
@@ -5599,7 +5695,7 @@ async function runCli(argv, io = {
 `);
       } else {
         for (const check of report.checks) {
-          io.stdout(redactSecrets(`${check.ok ? "\u2713" : "\u2717"} ${check.label}: ${check.detail}
+          io.stdout(redactSecrets(`${levelMarker(check.level)} ${check.label}: ${check.detail}
 `));
           if (check.repair) io.stdout(redactSecrets(`    \u21B3 repair: ${check.repair}
 `));
@@ -5609,21 +5705,25 @@ async function runCli(argv, io = {
           io.stdout("\nOther agents on this machine:\n");
           for (const agent of otherAgents) {
             const name = agent.slug ? `${agent.slug} (${agent.agentId ?? "unknown"})` : agent.agentId ?? "unknown";
-            const failed = agent.checks.filter((check) => !check.ok);
-            const verdict = agent.classification === "wired" ? failed.length === 0 ? "wired, all checks passed" : `wired, ${failed.length} check(s) FAILED` : agent.classification === "parked" ? "parked re-key only \u2014 no identity.json in this directory, but key material is still there" : agent.classification;
-            io.stdout(redactSecrets(`  ${failed.length > 0 ? "\u2717" : "\u2022"} ${name}: ${verdict}
+            const failed = agent.checks.filter((check) => check.level === "failed");
+            const advised = agent.checks.filter((check) => check.level === "advisory");
+            const verdict = agent.classification === "wired" ? failed.length > 0 ? `wired, ${failed.length} check(s) FAILED` : advised.length > 0 ? `wired, ${advised.length} advisory finding(s)` : "wired, all checks passed" : agent.classification === "parked" ? "parked re-key only \u2014 no identity.json in this directory, but key material is still there" : agent.classification;
+            io.stdout(redactSecrets(`  ${failed.length > 0 ? "\u2717" : advised.length > 0 ? "!" : "\u2022"} ${name}: ${verdict}
 `));
-            for (const check of failed) {
-              io.stdout(redactSecrets(`      \u2717 ${check.label}: ${check.detail}
+            for (const check of [...failed, ...advised]) {
+              io.stdout(redactSecrets(`      ${levelMarker(check.level)} ${check.label}: ${check.detail}
 `));
               if (check.repair) io.stdout(redactSecrets(`        \u21B3 repair: ${check.repair}
 `));
             }
           }
         }
-        io.stdout(report.ok ? "All checks passed.\n" : "One or more checks FAILED \u2014 see repairs above.\n");
+        io.stdout(
+          report.level === "failed" ? "One or more checks FAILED \u2014 see repairs above.\n" : report.level === "advisory" ? `No failures. ${advisoryCount(report)} advisory finding(s) \u2014 see the ! line(s) above.
+` : "All checks passed.\n"
+        );
       }
-      return report.ok ? 0 : 1;
+      return report.level === "failed" ? 1 : 0;
     } catch (err) {
       return failSubcommand(io, parsed.json, err, { doctor: "failed" }, {
         code: "doctor_failed",