@haven_ai/connect 0.0.0-dev.202610071600.91b951e → 0.0.0-dev.202610071649.8f72409

package/README.md

@@ -161,8 +161,8 @@ minutes. Two rules follow:
    stderr log on every probe, and records it in `TOMBSTONE.json` for
    `--doctor` — with a copy in `~/.haven/tombstones/` (or `.tombstones/` inside
    a custom credentials root), so the retirement stays visible after the
-   directory is deleted. It touches no key material and revokes nothing — revoke the
-   agent on the Haven agent page yourself. Delete the tombstone only once every
+   directory is deleted. It touches no key material and revokes nothing — use **Remove
+   agent…** (or **Stop budget**) on the Haven agent page yourself. Delete the tombstone only once every
    long-lived host has been restarted.
 
    **Pass a real DIRECTORY, not an agent id.** A named agent lives at its wiring
@@ -219,7 +219,7 @@ backend change) and **refuses to destroy the key material on every answer**:
 
 | Probe | What it means | What `--unwire` does |
 | --- | --- | --- |
-| `ok` | The agent is still active: its key still spends. | Refuses; tells you to revoke on the Haven agent page (connect never revokes), then re-run. |
+| `ok` | The agent is still active: its key still spends. | Refuses; tells you to use **Remove agent…** on the Haven agent page (connect never revokes), then re-run. |
 | `unauthorized` | The key no longer authenticates on normal routes (revoked, archived, paused, pending approval, rotated, or not a key the backend knows — it does not say which). | Refuses; says plainly that a stranded balance **may** exist and the connector **cannot check**; recover first (`haven_sweep_delegate`, or the agent page). |
 | `network_error` / `bad_response` | Could not verify. | Refuses: unknown is not "safe to delete". Retry. |
 | *(no stored API key + URL)* | Nothing the recovery routes would accept. | Proceeds, unprobed — the pre-#3123 shape. |

package/dist/cli.cjs

@@ -620,9 +620,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202610071600.91b951e",
+      sdkVersion: "0.0.0-dev.202610071649.8f72409",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202610071600.91b951e",
+      signerVersion: "0.0.0-dev.202610071649.8f72409",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -3641,7 +3641,7 @@ async function decideTeardown(identity, input) {
         status: "retained",
         probe: "ok",
         detail: "This agent is still ACTIVE on the backend: its API key and delegate key still carry spend authority, so destroying them would be a live spend-authority change. Key material kept in this directory (0o600); its MCP wiring above is gone.",
-        remedy: `Revoke the agent on the Haven agent page (connect never revokes), then re-run --unwire; or, to delete the key anyway, re-run with ${DESTROY_FLAG}.`
+        remedy: `Use Remove agent\u2026 on the Haven agent page (connect never revokes), then re-run --unwire; or, to delete the key anyway, re-run with ${DESTROY_FLAG}.`
       };
     case "unauthorized":
       return {
@@ -4499,7 +4499,7 @@ var init_runtime = __esm({
     init_tombstone();
     init_local_mcp_runtime();
     init_runtime_manifest();
-    CONNECTOR_VERSION = "0.0.0-dev.202610071600.91b951e";
+    CONNECTOR_VERSION = "0.0.0-dev.202610071649.8f72409";
     CONNECTOR_CLIENT_IDENTITY = `@haven_ai/connect/${CONNECTOR_VERSION}`;
     CONNECT_OUTCOME_SCHEMA_VERSION = 1;
     failureOutcomesByError = /* @__PURE__ */ new WeakMap();
@@ -6104,7 +6104,7 @@ async function runCli(argv, io = {
         io.stdout(redactSecrets(`Tombstoned agent ${info.agent_id} at ${parsed.tombstone.directory}.
 `));
         io.stdout(
-          "Key files were NOT touched and nothing was revoked \u2014 revoke the agent on the Haven agent page if you have not already.\n"
+          "Key files were NOT touched and nothing was revoked \u2014 on the Haven agent page, use Remove agent\u2026 (or Stop budget) if you have not already.\n"
         );
         io.stdout(
           info.recordPath !== null ? `A surviving tombstone record was mirrored to ${redactSecrets(info.recordPath)}
@@ -6213,7 +6213,7 @@ async function runCli(argv, io = {
           failures.length > 0 ? "  Some entries were NOT removed (\u2717 above). Re-run `--unwire` after resolving each refusal \u2014\n  it is idempotent.\n" : retained ? "  The wiring is gone; the key material is not (\u2717 above). `--doctor` will keep reporting this directory\n  as `superseded` until the key is revoked or destroyed \u2014 that is the honest state.\n" : "  Verify: `--doctor --runtime <runtime>` per host should report this agent as `retired` with a\n  clean runtime-config check.\n"
         );
         io.stdout(
-          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. " + (retained ? "This directory\u2019s local key material was KEPT (see above); the tombstone\n" : "This directory\u2019s local key material was removed and the tombstone\n") + "record + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, revoke the agent on the Haven agent page to stop it spending entirely.\n"
+          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. " + (retained ? "This directory\u2019s local key material was KEPT (see above); the tombstone\n" : "This directory\u2019s local key material was removed and the tombstone\n") + "record + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, use Remove agent\u2026 on the Haven agent page to end its budgets on-chain and stop it spending.\n"
         );
       }
       return failures.length > 0 || retained ? 1 : 0;