@haven_ai/connect 0.0.0-dev.202609231741.b88d644 → 0.0.0-dev.202609241737.2d2b91b

package/README.md

@@ -175,7 +175,12 @@ minutes. Two rules follow:
    and a refusal is `{"tombstoned": false, "error": {"code", "next_action"}}`
    with exit 1 — so check the result rather than assuming silence means success
    (#2175). The `message` field is present only for connector-authored refusals;
-   an unexpected filesystem error keeps its raw text on stderr alone.
+   an unexpected filesystem error keeps its raw text on stderr alone. If only the
+   surviving copy fails — the directory IS tombstoned — the run still succeeds
+   with `"recordPath": null` and `"mirrorError"` set to the errno code (or
+   `mirror_write_failed` when there is none), and `--unwire --json` carries the
+   same as `mirror_error`; `--replace` still removes the old directory's key
+   files and names the failure in `retirement_mirror_errors` (#3259).
 
 ### Unwiring an agent (`--unwire`, #2169)
 
@@ -352,7 +357,8 @@ read-only verification tools, `hosted_mcp_url`, `superseded_agent_ids`,
 `existing_agents_before_write` (#3122 — the other live-keyed directories named
 before the first write, each with the account it spends from), and — on a run
 that replaced existing wiring — `superseded_agents_retired_locally` with
-`retired_agent_ids`; `server_name_rebound_from` (#3122) appears only when the
+`retired_agent_ids`, plus `retirement_mirror_errors` (#3259) only when a retired
+directory's surviving ledger record could not be written; `server_name_rebound_from` (#3122) appears only when the
 run took a server name over from another directory's local binding record. It
 contains no API key, private key, credential
 contents, full credential paths, or full delegate address. The same redacted

package/dist/cli.cjs

@@ -619,9 +619,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202609231741.b88d644",
+      sdkVersion: "0.0.0-dev.202609241737.2d2b91b",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202609231741.b88d644",
+      signerVersion: "0.0.0-dev.202609241737.2d2b91b",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -3098,9 +3098,14 @@ async function writeAgentTombstone(input) {
   const record = JSON.stringify(info, null, 2) + "\n";
   await promises.writeFile(path.join(input.directory, TOMBSTONE_FILENAME), record, "utf8");
   const root = input.tombstonesDir ?? defaultTombstonesDir();
-  await promises.mkdir(root, { recursive: true, mode: 448 });
   const recordPath = path.join(root, `${info.agent_id}.json`);
-  await promises.writeFile(recordPath, record, { mode: MIRROR_MODE });
+  try {
+    await promises.mkdir(root, { recursive: true, mode: 448 });
+    await promises.writeFile(recordPath, record, { mode: MIRROR_MODE });
+  } catch (err) {
+    const code = err?.code;
+    return { ...info, recordPath: null, mirrorError: typeof code === "string" && /^E[A-Z]+$/.test(code) ? code : "mirror_write_failed" };
+  }
   return { ...info, recordPath };
 }
 async function readAgentTombstone(directory) {
@@ -3169,7 +3174,7 @@ async function unwireAgent(input) {
   const slug = input.slug ?? sidecar?.server_name;
   const names = serverNamesFor(slug);
   const runtimes = [];
-  const tombstoned = await tombstoneDirectoryIfAbsent({
+  const { written: tombstoned, mirrorError } = await tombstoneDirectoryIfAbsent({
     directory: input.directory,
     agentId,
     reason: input.reason ?? "unwired via --unwire",
@@ -3263,7 +3268,16 @@ async function unwireAgent(input) {
   const bindingReleased = await clearMcpServerBinding(input.directory);
   const teardown = await decideTeardown(identity, input);
   if (teardown.status !== "retained") await teardownLocalKeyMaterial(input.directory, identity);
-  return { directory: input.directory, agentId, slug, tombstoned, runtimes, teardown, bindingReleased };
+  return {
+    directory: input.directory,
+    agentId,
+    slug,
+    tombstoned,
+    runtimes,
+    teardown,
+    bindingReleased,
+    ...mirrorError === void 0 ? {} : { mirrorError }
+  };
 }
 async function decideTeardown(identity, input) {
   const ended = "Local recovery of a stranded delegate balance ends with it: the sweep-recovery routes accept only this agent's API key and delegate signature, and neither exists on this machine any more.";
@@ -3308,9 +3322,9 @@ async function decideTeardown(identity, input) {
   }
 }
 async function tombstoneDirectoryIfAbsent(input) {
-  if (await readOptionalText(path.join(input.directory, TOMBSTONE_FILENAME)) !== null) return false;
-  await writeAgentTombstone(input);
-  return true;
+  if (await readOptionalText(path.join(input.directory, TOMBSTONE_FILENAME)) !== null) return { written: false };
+  const { mirrorError } = await writeAgentTombstone(input);
+  return mirrorError === void 0 ? { written: true } : { written: true, mirrorError };
 }
 async function teardownLocalKeyMaterial(directory, identity) {
   await Promise.all([
@@ -4845,7 +4859,7 @@ init_unwire();
 init_tombstone();
 init_local_mcp_runtime();
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.0.0-dev.202609231741.b88d644";
+var CONNECTOR_VERSION = "0.0.0-dev.202609241737.2d2b91b";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 var failureOutcomesByError = /* @__PURE__ */ new WeakMap();
 function failureOutcomeFor(runtimeHint, error) {
@@ -5133,6 +5147,7 @@ async function executeConnect(options, deps, trace) {
   }
   let supersededAgentsRetiredLocally;
   const retiredAgentIds = [];
+  const retirementMirrorErrors = {};
   if (replacing) {
     if (runtimeInstall.errorCode) {
       supersededAgentsRetiredLocally = false;
@@ -5143,7 +5158,7 @@ async function executeConnect(options, deps, trace) {
       supersededAgentsRetiredLocally = true;
       for (const entry of replacing.superseded) {
         try {
-          await tombstoneDirectoryIfAbsent({
+          const { mirrorError } = await tombstoneDirectoryIfAbsent({
             directory: entry.directory,
             agentId: entry.agentId,
             reason: "replaced by a new setup (--replace)",
@@ -5152,6 +5167,12 @@ async function executeConnect(options, deps, trace) {
             // root → ~/.haven/tombstones, as before; any other → <root>/.tombstones).
             tombstonesDir: tombstonesDirForCredentialRoot(options.credentialsDir)
           });
+          if (mirrorError !== void 0) {
+            retirementMirrorErrors[entry.agentId] = mirrorError;
+            log(
+              `Warning: the surviving tombstone record for ${entry.agentId} could not be written to ${tombstonesDirForCredentialRoot(options.credentialsDir)} (${mirrorError}). The in-place TOMBSTONE.json stands; --doctor will not list this retirement once the directory is deleted.`
+            );
+          }
           await teardownLocalKeyMaterial(entry.directory, await readIdentityFile(entry.directory));
           await clearMcpServerBinding(entry.directory);
           retiredAgentIds.push(entry.agentId);
@@ -5223,6 +5244,7 @@ async function executeConnect(options, deps, trace) {
     supersededAgentIds,
     supersededAgentsRetiredLocally,
     ...replacing ? { retiredAgentIds } : {},
+    ...Object.keys(retirementMirrorErrors).length > 0 ? { retirementMirrorErrors } : {},
     existingAgentsBeforeWrite: existingAgents.map((a) => ({ agent_id: a.agentId, account_address: a.accountAddress })),
     ...reboundFrom ? { serverNameReboundFrom: reboundFrom } : {},
     setupChallengeExpiresAt: setup.challenge.expires_at,
@@ -5289,6 +5311,7 @@ function completionOutcome(input) {
     superseded_agent_ids: input.supersededAgentIds ?? [],
     ...input.supersededAgentsRetiredLocally !== void 0 ? { superseded_agents_retired_locally: input.supersededAgentsRetiredLocally } : {},
     ...input.retiredAgentIds ? { retired_agent_ids: input.retiredAgentIds } : {},
+    ...input.retirementMirrorErrors ? { retirement_mirror_errors: input.retirementMirrorErrors } : {},
     // #3122: always emitted on a completed run (empty list included), for the
     // same reason as superseded_agent_ids above.
     existing_agents_before_write: input.existingAgentsBeforeWrite ?? [],
@@ -5962,6 +5985,7 @@ async function runCli(argv, io = {
         agentId = identity.agent_id ?? "unknown";
       } catch {
       }
+      const ledgerDir = tombstonesDirForAgentDirectory2(parsed.tombstone.directory);
       const info = await writeAgentTombstone2({
         directory: parsed.tombstone.directory,
         agentId,
@@ -5970,7 +5994,7 @@ async function runCli(argv, io = {
         // #3251: the ledger of the root that holds the retired directory —
         // ~/.haven/agents/<x> → ~/.haven/tombstones, exactly as before; a
         // directory under any other root → <root>/.tombstones.
-        tombstonesDir: tombstonesDirForAgentDirectory2(parsed.tombstone.directory)
+        tombstonesDir: ledgerDir
       });
       if (parsed.json) {
         io.stdout(`${redactSecrets(JSON.stringify({ tombstoned: true, ...info }))}
@@ -5982,11 +6006,18 @@ async function runCli(argv, io = {
           "Key files were NOT touched and nothing was revoked \u2014 revoke the agent on the Haven agent page if you have not already.\n"
         );
         io.stdout(
-          `A surviving tombstone record was mirrored to ${redactSecrets(info.recordPath)}
+          info.recordPath !== null ? `A surviving tombstone record was mirrored to ${redactSecrets(info.recordPath)}
+` : (
+            // #3259: the directory IS tombstoned; only the surviving copy failed.
+            redactSecrets(
+              `! The surviving tombstone record could NOT be written to ${ledgerDir} (${info.mirrorError}). The in-place TOMBSTONE.json stands, but --doctor will not list this retirement once the directory is deleted.
 `
+            )
+          )
         );
         io.stdout(
-          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot from its own start time, and the tombstone only speaks when a stale host next probes the old path. The mirrored record keeps this retirement observable even after the agent directory itself is deleted.\n"
+          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot from its own start time, and the tombstone only speaks when a stale host next probes the old path." + // #3259 review: never claim a copy that the line above says was not written.
+          (info.recordPath !== null ? " The mirrored record keeps this retirement observable even after the agent directory itself is deleted." : "") + "\n"
         );
       }
       return 0;
@@ -6005,6 +6036,7 @@ async function runCli(argv, io = {
     const homeDir = homedir11();
     const root = parsed.options.credentialsDir ?? join13(homeDir, ".haven", "agents");
     const directory = parsed.unwireDir ?? (parsed.options.serverName ? join13(root, parsed.options.serverName) : root);
+    const ledgerDir = tombstonesDirForAgentDirectory2(directory, homeDir);
     try {
       const result = await unwireAgent2({
         directory,
@@ -6019,7 +6051,7 @@ async function runCli(argv, io = {
         // directory itself, not a root. ~/.haven/agents/<slug> →
         // ~/.haven/tombstones, exactly as before; any other root →
         // <root>/.tombstones.
-        tombstonesDir: tombstonesDirForAgentDirectory2(directory, homeDir)
+        tombstonesDir: ledgerDir
       });
       const failures = result.runtimes.filter((r) => r.status === "refused" || r.status === "unreadable");
       const retained = result.teardown.status === "retained";
@@ -6032,6 +6064,8 @@ async function runCli(argv, io = {
               slug: result.slug ?? null,
               directory: result.directory,
               tombstoned: result.tombstoned,
+              // #3259: additive — present only when the surviving ledger record failed.
+              ...result.mirrorError !== void 0 ? { mirror_error: result.mirrorError } : {},
               runtimes: result.runtimes.map((r) => ({
                 runtime: r.runtime,
                 label: r.label,
@@ -6057,6 +6091,12 @@ async function runCli(argv, io = {
         io.stdout(
           result.tombstoned ? "  \xB7 Tombstoned first: any long-lived host still resolving the old wrapper gets the HAVEN-TOMBSTONE diagnosis.\n" : "  \xB7 Directory was already tombstoned.\n"
         );
+        if (result.mirrorError !== void 0) {
+          io.stdout(redactSecrets(
+            `  ! Surviving tombstone record: NOT written to ${ledgerDir} (${result.mirrorError}) \u2014 the in-place tombstone stands; --doctor will not list this retirement once the directory is deleted.
+`
+          ));
+        }
         for (const r of result.runtimes) {
           const mark = r.status === "removed" ? "\u2713" : r.status === "clean" ? "\u2013" : "\u2717";
           io.stdout(redactSecrets(`  ${mark} ${r.label}: ${r.status}${r.detail ? ` \u2014 ${r.detail}` : ""}