@haven_ai/connect 0.0.0-dev.202610071649.8f72409 → 0.0.0-dev.202610071831.a279c0e

package/README.md

@@ -385,8 +385,8 @@ and the API key travels beside it in a header.
 
 `superseded_agent_ids` lists the other agent directories on this machine. A
 re-run mints a NEW agent, and without `--replace` retires nothing, so those
-older agents still hold live API and signing keys — revoke them on the Haven
-agent page if you meant to replace them. Empty on a clean first run; an empty
+older agents still hold live API and signing keys — use **Remove agent…** on the
+Haven agent page for each if you meant to replace them. Empty on a clean first run; an empty
 list here is not a guarantee, since a scan that cannot read the credential root
 also yields one rather than failing a completed setup.
 
@@ -499,12 +499,24 @@ already-configured machine behaves as follows (characterized in
   consumed setup when Connect resolves it (or, in a rare concurrent-run race,
   at registration). The key pair minted for the attempt exists only in memory
   and is discarded. Start a fresh connection from the Haven dashboard instead.
-- **Running a fresh setup on a configured machine** writes the new agent's
-  credentials into its own directory under `~/.haven/agents/<agent-id>/`,
+- **Running a fresh setup on a configured machine writes the new agent's
+  credentials into its own directory under `~/.haven/agents/<slug-or-id>/`,
   alongside the previous agent's directory, which stays byte-identical.
-  Nothing is rotated, revoked, or deleted locally.
+  Nothing is rotated, revoked, or deleted locally.**
+- **A default setup names its pair from the agent's display name
+  ([#3737](https://github.com/d-hinders/Haven-AI/issues/3737)) and never
+  collides.** Without `--name`, `--bare` or `--replace`, the connector derives
+  the slug itself (`proposeServerSlug`: slugified display name, `agent`
+  fallback, numeric suffix when taken) and wires `haven-<slug>` /
+  `haven-signer-<slug>` — de-collided against **every** directory under the
+  credential root (retired and key-removed ones included, so a slug freed by
+  `--unwire` is never reused), and marked `-dev` on a non-production backend
+  (Base Sepolia or any chain that is not Base mainnet 8453; an explicit
+  `--name` is used verbatim and never altered). Nothing is displaced, so
+  nothing is asked. `--bare` opts back into the unnamed pair.
 - **A bare re-run over a live previous agent is a decision, not a default
-  ([#2551](https://github.com/d-hinders/Haven-AI/issues/2551)).** Before
+  ([#2551](https://github.com/d-hinders/Haven-AI/issues/2551)).** Only a run
+  that targets the bare pair — `--bare`, or `--replace` — can collide; before
   minting a key or registering, Connect scans the credential root for a
   bare-pair directory that still holds a usable key — the same reading
   `--doctor` classifies as `wired` or `superseded`; `retired`, `orphaned`,
@@ -521,7 +533,9 @@ already-configured machine behaves as follows (characterized in
     flag itself. The setup prompt then permits one re-run with the flag the
     user picks (#3689), on top of `--json` and a `--runtime` retry.
   - **`--replace`** is the unattended answer "yes, replace". `--name <slug>`
-    installs alongside. Passing both is a usage error — they contradict.
+    installs alongside. `--bare` is the human opt-in to the unnamed pair and
+    refuses with `--name`. Passing `--replace --name` is a usage error — they
+    contradict.
 - **Replacing re-points the bare pair, then retires the previous directory
   locally.** Connect owns the `haven` and `haven-signer` entries (and the
   managed Codex/Hermes equivalents) and re-points them at the new agent's
@@ -539,8 +553,9 @@ already-configured machine behaves as follows (characterized in
   [Running several agents in one runtime](#running-several-agents-in-one-runtime).
 - **The previous agent is not revoked by a re-run — with or without
   `--replace`.** Local retirement is local: its authority remains whatever
-  its on-chain rules and the Haven agent page say. Revoke agents you no
-  longer use from the Haven dashboard. Connect never calls revoke — that
+  its on-chain rules and the Haven agent page say. Use **Remove agent…** on
+  the Haven agent page for agents you no longer use (or the superseded-agents
+  revoke on the setup screen). Connect never calls revoke — that
   route is owner-authenticated, and an agent credential revoking a sibling
   agent would be an agent editing its own authority.
 - **A re-run never overwrites an existing credential file.** A write that would
@@ -567,15 +582,17 @@ As above, `<channel>` is a placeholder like the rest of this line: take the
 package from the setup response's `connector_package`
 and add `--name` to the command the dashboard gave you.
 
-| | Without `--name` | With `--name research` |
-|---|---|---|
-| MCP entries | `haven`, `haven-signer` | `haven-research`, `haven-signer-research` |
-| Credentials | `~/.haven/agents/<agent-id>/` | `~/.haven/agents/research/` |
+| | Default (no `--name`) | `--name research` | `--bare` |
+|---|---|---|---|
+| MCP entries | `haven-<slug>`, `haven-signer-<slug>` (slug from the agent's display name, `-dev`-marked on a non-production backend) | `haven-research`, `haven-signer-research` | `haven`, `haven-signer` |
+| Credentials | `~/.haven/agents/<slug>/` | `~/.haven/agents/research/` | `~/.haven/agents/<agent-id>/` |
 
 A writer only ever touches the pair it owns, so adding a named agent cannot
-disturb the bare pair or another named one. Omitting `--name` is byte-identical
-to how the connector behaved before named pairs existed, so nothing already
-wired needs changing.
+disturb the bare pair or another named one. **`--bare` wires the bare pair
+byte-identically to how the connector behaved before named pairs existed**, so
+nothing already wired needs changing — it is the one flag (besides
+`--replace`) that reaches the unnamed pair, and it cannot be combined with
+`--name`.
 
 The slug is **1–32 lowercase letters, digits and single hyphens**, validated
 before anything is written, and **immutable once wired** — it is the server name
@@ -615,6 +632,14 @@ npx -y @haven_ai/connect@<channel> --rekey-finish --api-key sk_agent_... \
   --runtime claude-code [--name research]
 ```
 
+**No `--name` needed when exactly one live agent is on the machine.** Since
+[#3737](https://github.com/d-hinders/Haven-AI/issues/3737), `--rekey` without
+`--name` selects the sole agent directory that still holds a stored API key —
+tombstoned and key-removed directories left by `--unwire` do not count — and
+the printed phase-two command carries that agent's exact `--name` when it has
+one. With **several** live agents it refuses and lists them, so you must pass
+`--name <slug>`; a bare agent needs no `--name`, exactly as before.
+
 **Phase one prints the exact phase-two command — prefer it over the line above.**
 Since [#2423](https://github.com/d-hinders/Haven-AI/issues/2423) the connector
 builds that command from the npm dist-tag **it** was published under, so a build
@@ -689,8 +714,8 @@ terminal and refuses everywhere else, so a `superseded` directory now means
 someone chose it — a `--replace` whose install failed, an older connector, or
 a directory this scan could not classify. A superseded directory
 whose key is still live is a FAILING check naming the agent id, with the
-repair spelled out: revoke it on the Haven agent page, then remove the
-directory. An already-revoked one reports as informational; an unreachable
+repair spelled out: use **Remove agent…** on the Haven agent page, then remove
+the directory. An already-revoked one reports as informational; an unreachable
 probe is a note, never a verdict. Connect never revokes or deletes
 credentials itself — it reports, you decide. The setup completion output
 names superseded agents the moment they are created, for the same reason.

package/dist/cli.cjs

@@ -325,6 +325,19 @@ async function readStoredCredentials(serverName, agentIdOrSlug, baseDir) {
       `No Haven credentials at ${directory}. Nothing to re-key \u2014 connect this agent first, or pass the --name you wired it under.`
     );
   }
+  let discoveredSlug;
+  if (!key) {
+    const binding = await readJsonFile(path.join(directory, "mcp-server-binding.json"));
+    const hostedName = binding && typeof binding === "object" ? asString(binding.server_name) : void 0;
+    if (hostedName && hostedName.startsWith("haven-")) {
+      const slug = hostedName.slice("haven-".length);
+      try {
+        assertValidServerSlug(slug);
+        discoveredSlug = slug;
+      } catch {
+      }
+    }
+  }
   const agent = await readJsonFile(path.join(directory, "agent.json")) ?? {};
   const signer = await readJsonFile(path.join(directory, "signer.json")) ?? {};
   const agentId = asString(identity.agent_id);
@@ -340,6 +353,7 @@ async function readStoredCredentials(serverName, agentIdOrSlug, baseDir) {
     directory,
     agentId,
     apiKey,
+    ...discoveredSlug ? { discoveredSlug } : {},
     apiUrl,
     hostedMcpUrl,
     delegateAddress: asString(agent.delegate_address) ?? asString(signer.delegate_address),
@@ -368,7 +382,9 @@ async function discoverSoleAgentDirectory(baseDir) {
   const candidates = [];
   for (const entry of entries) {
     const directory = path.join(root, entry);
-    if (!await readJsonFile(path.join(directory, "identity.json"))) continue;
+    const identity = await readJsonFile(path.join(directory, "identity.json"));
+    if (!identity) continue;
+    if (!asString(identity.api_key)) continue;
     if (await readJsonFile(path.join(directory, "TOMBSTONE.json"))) continue;
     candidates.push(directory);
   }
@@ -598,6 +614,7 @@ async function listMcpServerBindings(baseDir, excludeDirectory) {
 var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME, MCP_SERVER_BINDING_FILENAME;
 var init_storage = __esm({
   "src/storage.ts"() {
+    init_server_names();
     REKEY_PENDING_FILENAME = "rekey-pending.json";
     REKEY_PENDING_TTL_MS = 24 * 60 * 60 * 1e3;
     CONNECT_OUTCOME_FILENAME = "last-connect-outcome.json";
@@ -620,9 +637,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.0.0-dev.202610071649.8f72409",
+      sdkVersion: "0.0.0-dev.202610071831.a279c0e",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.0.0-dev.202610071649.8f72409",
+      signerVersion: "0.0.0-dev.202610071831.a279c0e",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -1035,7 +1052,9 @@ async function writeHermesConfig(input, deps) {
       restartRequired: true,
       messages: [
         `Updated Haven MCP entries in ${target}; stored the hosted MCP identity in ${envTarget}.`,
-        "Restart Hermes (start a new session; gateway users: /restart), then verify with `hermes mcp list`, `hermes mcp test haven`, and `hermes mcp test haven-signer`.",
+        // #3737: name the pair actually written — a bare run prints exactly the
+        // historical sentence; a named run names its own pair.
+        `Restart Hermes (start a new session; gateway users: /restart), then verify with \`hermes mcp list\`, \`hermes mcp test ${names.hosted}\`, and \`hermes mcp test ${names.signer}\`.`,
         "If several long-lived Hermes processes are running (a gateway plus TUI workers), restart EVERY one: each loads its MCP wiring at startup, so a process started before this setup keeps using its old snapshot.",
         "If no mcp_* tools appear after restart, ensure the MCP SDK is installed in Hermes: pip install mcp"
       ]
@@ -3392,17 +3411,45 @@ async function detectWiringCollision(input) {
     suggestedServerName: proposeServerSlug(input.agentName, taken)
   };
 }
-function proposeServerSlug(agentName, taken) {
-  let base = agentName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 32).replace(/-+$/g, "");
+function proposeServerSlug(agentName, taken, maxBaseLength = 32) {
+  let base = agentName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, maxBaseLength).replace(/-+$/g, "");
   if (!slugIsValid(base)) base = "agent";
   if (!taken.has(base)) return base;
   for (let n = 2; n < 1e3; n += 1) {
     const suffix = `-${n}`;
-    const candidate = `${base.slice(0, 32 - suffix.length).replace(/-+$/g, "")}${suffix}`;
+    const candidate = `${base.slice(0, maxBaseLength - suffix.length).replace(/-+$/g, "")}${suffix}`;
     if (slugIsValid(candidate) && !taken.has(candidate)) return candidate;
   }
   throw new Error(`Could not propose an unused server name for ${JSON.stringify(agentName)}.`);
 }
+function deriveServerSlug(agentName, taken, markNonProduction) {
+  const mark = "-dev";
+  if (!markNonProduction) return proposeServerSlug(agentName, taken);
+  const base = proposeServerSlug(agentName, taken, 32 - mark.length);
+  if (base.endsWith(mark)) return base;
+  const marked = `${base}${mark}`;
+  if (!taken.has(marked)) return marked;
+  return proposeServerSlug(marked, taken);
+}
+async function listTakenDirectoryNames(credentialsDir) {
+  const root = defaultCredentialRoot(credentialsDir);
+  let entries = [];
+  try {
+    entries = await promises.readdir(root);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  const taken = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    try {
+      if (!(await promises.stat(path.join(root, entry))).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    taken.add(entry);
+  }
+  return taken;
+}
 function slugIsValid(slug) {
   try {
     assertValidServerSlug(slug);
@@ -3418,7 +3465,7 @@ async function promptWiringCollisionResolution(collision, agentName, io) {
   io.write(`Setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring.
 `);
   io.write("  r) replace \u2014 re-point haven / haven-signer at the new agent and retire the previous directory locally\n");
-  io.write("     (tombstoned, local key files removed; you still revoke it on the Haven agent page)\n");
+  io.write("     (tombstoned, local key files removed; you still use Remove agent\u2026 on the Haven agent page)\n");
   io.write(`  a) alongside \u2014 install as a named agent (suggested: ${collision.suggestedServerName}) with its own
 `);
   io.write(`     haven-<name> / haven-signer-<name> pair, leaving the current wiring untouched
@@ -3802,7 +3849,16 @@ async function executeConnect(options, deps, trace) {
   log("Checked local credential storage \u2014 all clear.");
   let serverName = options.serverName;
   let replacing;
-  if (!serverName) {
+  if (!serverName && options.deriveServerName) {
+    const taken = await listTakenDirectoryNames(options.credentialsDir);
+    const nonProduction = setup.haven_wallet.chain_id !== PRODUCTION_CHAIN_ID;
+    serverName = deriveServerSlug(setup.agent.name, taken, nonProduction);
+    await assertServerSlugAvailable(serverName, options.credentialsDir);
+    const derivedNames = serverNamesFor(serverName);
+    log(
+      `Naming this agent's MCP pair from its display name: ${derivedNames.hosted} / ${derivedNames.signer}. Nothing was displaced; to wire the bare haven / haven-signer pair instead, re-run with --bare, or choose the name yourself with --name <slug>.`
+    );
+  } else if (!serverName) {
     const collision = await detectWiringCollision({
       credentialsDir: options.credentialsDir,
       agentName: setup.agent.name
@@ -4028,7 +4084,7 @@ async function executeConnect(options, deps, trace) {
     if (supersededAgentsRetiredLocally === true) {
       log("");
       log(
-        `Replaced: previous agent(s) ${supersededIds(replacing)} are retired on this machine but NOT revoked \u2014 revoke them on the Haven agent page, then restart EVERY long-lived host (gateways, TUI workers, editors): each holds the MCP wiring snapshot from its own start time, and the tombstone speaks only when a stale host next probes the old path.`
+        `Replaced: previous agent(s) ${supersededIds(replacing)} are retired on this machine but NOT revoked \u2014 use Remove agent\u2026 on the Haven agent page for each (it ends their live budgets), then restart EVERY long-lived host (gateways, TUI workers, editors): each holds the MCP wiring snapshot from its own start time, and the tombstone speaks only when a stale host next probes the old path.`
       );
     } else if (supersededAgentIds.length > 0) {
       log("");
@@ -4036,7 +4092,7 @@ async function executeConnect(options, deps, trace) {
         `Heads-up: this setup created a NEW agent. Your previous agent(s) \u2014 ${supersededAgentIds.join(", ")} \u2014 still exist with their own keys, and any host that was already running keeps acting as them.`
       );
       log(
-        `If you meant to replace them: revoke them on the Haven agent page, then restart EVERY long-lived host (gateways, TUI workers, editors) \u2014 each holds the MCP wiring snapshot from its own start time, so after repeated setups each can be stuck on a DIFFERENT old agent. Then remove their directories under ~/.haven/agents (or ${RERUN_HINT} --tombstone <dir> to leave a diagnostic in their place). Run ${RERUN_HINT} --doctor to check whether their keys are still live.`
+        `If you meant to replace them: use Remove agent\u2026 on the Haven agent page for each (it ends their live budgets), then restart EVERY long-lived host (gateways, TUI workers, editors) \u2014 each holds the MCP wiring snapshot from its own start time, so after repeated setups each can be stuck on a DIFFERENT old agent. Then remove their directories under ~/.haven/agents (or ${RERUN_HINT} --tombstone <dir> to leave a diagnostic in their place). Run ${RERUN_HINT} --doctor to check whether their keys are still live.`
       );
     }
   } catch {
@@ -4077,6 +4133,9 @@ async function executeConnect(options, deps, trace) {
     runtimeInstall,
     delegateAddress: registration.delegate_address,
     hostedMcpUrl: registration.hosted_mcp_url,
+    // #3737: the resolved name — derived, explicit, or the bare pair — rides
+    // the machine-readable outcome alongside the prose completion text.
+    serverName,
     supersededAgentIds,
     supersededAgentsRetiredLocally,
     ...replacing ? { retiredAgentIds } : {},
@@ -4151,6 +4210,9 @@ function completionOutcome(input) {
     // #3122: always emitted on a completed run (empty list included), for the
     // same reason as superseded_agent_ids above.
     existing_agents_before_write: input.existingAgentsBeforeWrite ?? [],
+    // #3737: the resolved hosted server name — always present on a completed
+    // run, bare pair included, so a caller never has to parse the prose.
+    server_name: serverNamesFor(input.serverName).hosted,
     ...input.serverNameReboundFrom ? { server_name_rebound_from: input.serverNameReboundFrom } : {},
     ...input.setupChallengeExpiresAt ? { setup_challenge_expires_at: input.setupChallengeExpiresAt } : {},
     ...runtimeInstall.errorCode ? { error: { code: runtimeInstall.errorCode, next_action: nextAction2 } } : {}
@@ -4201,7 +4263,7 @@ async function resolveWiringCollision(collision, agentName, options, deps) {
   }
   throw new ConnectError(
     "wiring_collision",
-    `This machine is already wired to a Haven agent with a live key (${supersededIds(collision)}), and setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring. Nothing was written and the Haven setup token is still unused. If you are an AI agent running this command: do NOT add a flag yourself \u2014 relay this to your user and stop. Your user decides: REPLACE the existing wiring (re-run the same command with --replace added, which re-points the pair at the new agent and retires the previous directory locally \u2014 they still revoke the old agent on the Haven agent page), or install ALONGSIDE it (re-run with --name <slug> added, e.g. --name ${collision.suggestedServerName}, which gives the new agent its own haven-<slug> / haven-signer-<slug> pair). Re-run only with the flag your user chooses.`,
+    `This machine is already wired to a Haven agent with a live key (${supersededIds(collision)}), and setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring. Nothing was written and the Haven setup token is still unused. If you are an AI agent running this command: do NOT add a flag yourself \u2014 relay this to your user and stop. Your user decides: REPLACE the existing wiring (re-run the same command with --replace added, which re-points the pair at the new agent and retires the previous directory locally \u2014 they still use Remove agent\u2026 on the Haven agent page to end the old agent\u2019s budgets), or install ALONGSIDE it (re-run with --name <slug> added, e.g. --name ${collision.suggestedServerName}, which gives the new agent its own haven-<slug> / haven-signer-<slug> pair). Re-run only with the flag your user chooses.`,
     "relay_wiring_collision_to_user",
     { supersededAgentIds: collision.superseded.map((e) => e.agentId), suggestedServerName: collision.suggestedServerName }
   );
@@ -4482,7 +4544,7 @@ async function listOtherAgentIds(baseDir, currentDirectory) {
 function printNextSteps(result, log, approval, approvalUrl) {
   for (const line of completionHandoffLines(result, approval, approvalUrl)) log(line);
 }
-var CONNECTOR_VERSION, CONNECTOR_CLIENT_IDENTITY, CONNECT_OUTCOME_SCHEMA_VERSION, failureOutcomesByError, RERUN_HINT;
+var CONNECTOR_VERSION, PRODUCTION_CHAIN_ID, CONNECTOR_CLIENT_IDENTITY, CONNECT_OUTCOME_SCHEMA_VERSION, failureOutcomesByError, RERUN_HINT;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     init_api();
@@ -4499,7 +4561,8 @@ var init_runtime = __esm({
     init_tombstone();
     init_local_mcp_runtime();
     init_runtime_manifest();
-    CONNECTOR_VERSION = "0.0.0-dev.202610071649.8f72409";
+    CONNECTOR_VERSION = "0.0.0-dev.202610071831.a279c0e";
+    PRODUCTION_CHAIN_ID = 8453;
     CONNECTOR_CLIENT_IDENTITY = `@haven_ai/connect/${CONNECTOR_VERSION}`;
     CONNECT_OUTCOME_SCHEMA_VERSION = 1;
     failureOutcomesByError = /* @__PURE__ */ new WeakMap();
@@ -4709,9 +4772,10 @@ async function startRekey(options, deps = {}) {
     started_at: startedAt,
     expires_at: expiresAt
   });
+  const finishName = options.serverName ?? stored.discoveredSlug;
   const finishCommand = [
     sdk.connectorRerunCommand("--rekey-finish"),
-    options.serverName ? `--name ${options.serverName}` : void 0,
+    finishName ? `--name ${finishName}` : void 0,
     "--api-key <the key the dashboard showed you>",
     options.runtime ? `--runtime ${options.runtime}` : "--runtime <your runtime>"
   ].filter(Boolean).join(" ");
@@ -5543,9 +5607,9 @@ async function runDoctor(input, deps = {}) {
       level: supersededLevel,
       detail: supersededLevel === "failed" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : supersededLevel === "advisory" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. Runtime '${input2.runtime}' has no config file the connector can read, so which of these agents are wired cannot be verified from this machine: a live key here may be an agent you use deliberately, or one a host started before your latest setup is still spending as.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
       ...supersededLevel === "failed" ? {
-        repair: `Revoke ${supersededLive.join(", ")} on the Haven agent page, then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+        repair: `Use Remove agent\u2026 on the Haven agent page for ${supersededLive.join(", ")} (it ends each one\u2019s live budgets), then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : supersededLevel === "advisory" ? {
-        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: revoke the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: use Remove agent\u2026 on the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : {}
     });
   }
@@ -5770,6 +5834,7 @@ function parseArgs(argv, env = process.env) {
   let dryRun = false;
   let unwireDir;
   let replace = false;
+  let bare = false;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--help" || arg === "-h") {
@@ -5817,6 +5882,8 @@ function parseArgs(argv, env = process.env) {
       options.credentialsDir = requireValue(argv, ++i, arg);
     } else if (arg === "--replace") {
       replace = true;
+    } else if (arg === "--bare") {
+      bare = true;
     } else if (arg === "--name") {
       options.serverName = requireValue(argv, ++i, arg);
       assertValidServerSlug(options.serverName);
@@ -5842,16 +5909,23 @@ function parseArgs(argv, env = process.env) {
   if (help) {
     return { options, help, json, doctor, repair, tombstone, rekey };
   }
-  if (replace) {
+  if (replace || bare) {
     if (rekeyPhase || tombstoneDir || unwire || doctor || repair || pruneSignerRuntimes2) {
-      throw new Error("--replace belongs to a --setup run: it says what to do when the bare haven / haven-signer pair is already wired to another agent.");
+      throw new Error(`${replace ? "--replace" : "--bare"} belongs to a --setup run: it says what to do when the bare haven / haven-signer pair is already wired to another agent.`);
     }
-    if (options.serverName) {
+    if (bare && options.serverName) {
       throw new Error(
-        "--replace and --name contradict each other: --replace overwrites the bare haven / haven-signer wiring, --name installs alongside it under its own pair. Pass one of them."
+        "--bare and --name contradict each other: --bare wires the bare haven / haven-signer pair, --name installs a named haven-<slug> pair. Pass one of them."
       );
     }
-    options.replaceExistingWiring = true;
+    if (replace) {
+      if (options.serverName) {
+        throw new Error(
+          "--replace and --name contradict each other: --replace overwrites the bare haven / haven-signer wiring, --name installs alongside it under its own pair. Pass one of them."
+        );
+      }
+      options.replaceExistingWiring = true;
+    }
   }
   if (destroyKeyMaterial && !unwire) {
     throw new Error("--destroy-key-material only applies to --unwire.");
@@ -5925,6 +5999,9 @@ function parseArgs(argv, env = process.env) {
   if (!options.apiBaseUrl) {
     throw new Error("Missing --api <Haven API URL>.");
   }
+  if (!options.serverName && !bare && !replace) {
+    options.deriveServerName = true;
+  }
   options.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
   return { options, help, json, doctor, repair, tombstone, rekey };
 }
@@ -5952,13 +6029,19 @@ function helpText() {
     "  --replace                  When this machine is already wired to a different Haven agent on the bare",
     "                             haven / haven-signer pair, re-point that pair at the new agent and retire the",
     "                             previous agent directory locally (tombstoned, local key files removed).",
-    "                             Nothing is revoked \u2014 revoke the old agent on the Haven agent page. Without",
-    "                             this flag a non-interactive run REFUSES such a collision (wiring_collision)",
-    "                             and an interactive terminal is asked; --name installs alongside instead.",
+    "                             Nothing is revoked \u2014 use Remove agent\u2026 on the Haven agent page. Implies",
+    "                             the bare pair. Without it (or --bare) a non-interactive run REFUSES such a",
+    "                             collision (wiring_collision) and an interactive terminal is asked.",
+    "  --bare                     Wire the bare haven / haven-signer pair. Without --name a setup now names",
+    "                             its pair from the agent's display name (haven-<slug> /",
+    "                             haven-signer-<slug>, de-collided against this machine, ending -dev on a",
+    "                             non-production backend), so adding an agent never has to displace anyone;",
+    "                             --bare is the explicit opt-in to the unnamed pair. --name overrides it.",
     "  --name <slug>              Wiring slug for a NAMED agent: writes haven-<slug> / haven-signer-<slug>",
     "                             MCP entries and stores credentials at ~/.haven/agents/<slug>/, so several",
     "                             agents can run side by side in one runtime. 1-32 lowercase letters, digits,",
-    "                             single hyphens; immutable once wired. Omit for the bare haven / haven-signer pair.",
+    "                             single hyphens; immutable once wired. Without it the pair is named from the",
+    "                             agent's display name; --bare wires the bare haven / haven-signer pair.",
     "  --ack-local-tools          Write the one-time local Haven tools acknowledgement during setup.",
     "  --ack-signer               Backward-compatible alias for --ack-local-tools.",
     "  --local                    Advanced: install the fully-local Haven MCP (no hosted dependency).",