@haven_ai/connect 0.1.0-alpha

package/dist/index.js

@@ -0,0 +1,863 @@
+import crypto from 'crypto';
+import { Wallet } from 'ethers';
+import { mkdir, rm, writeFile, access, chmod, readFile } from 'fs/promises';
+import { homedir, platform } from 'os';
+import { join, resolve, dirname } from 'path';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+
+// src/api.ts
+function createConnectApiClient(baseUrl, fetchImpl = fetch) {
+  const root = baseUrl.replace(/\/+$/, "");
+  return {
+    resolveSetup: (input) => request(fetchImpl, `${root}/agent-connection-setups/resolve`, {
+      method: "POST",
+      body: JSON.stringify({
+        setup_token: input.setupToken,
+        connector_version: input.connectorVersion,
+        runtime: input.runtime
+      })
+    }),
+    registerSetup: (input) => request(fetchImpl, `${root}/agent-connection-setups/register`, {
+      method: "POST",
+      body: JSON.stringify({
+        setup_token: input.setupToken,
+        challenge_id: input.challengeId,
+        delegate_address: input.delegateAddress,
+        proof_signature: input.proofSignature,
+        api_key_hash: input.apiKeyHash,
+        api_key_prefix: input.apiKeyPrefix,
+        runtime: input.runtime,
+        connector_version: input.connectorVersion,
+        connector_context: input.connectorContext,
+        install_capabilities: input.installCapabilities && {
+          can_write_runtime_config: input.installCapabilities.canWriteRuntimeConfig,
+          restart_required: input.installCapabilities.restartRequired
+        }
+      })
+    }),
+    updateInstallStatus: async (setupId, apiKey, input) => {
+      await request(fetchImpl, `${root}/agent-connection-setups/${encodeURIComponent(setupId)}/install-status`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({
+          runtime: input.runtime,
+          connector_version: input.connectorVersion,
+          hosted_mcp_configured: input.hostedMcpConfigured,
+          local_signer_configured: input.localSignerConfigured,
+          credential_files_written: input.credentialFilesWritten,
+          probe_result: input.probeResult,
+          restart_required: input.restartRequired,
+          next_user_action: input.nextUserAction,
+          error_code: input.errorCode ?? null,
+          environment_label: input.environmentLabel
+        })
+      });
+    }
+  };
+}
+async function request(fetchImpl, url, init) {
+  const response = await fetchImpl(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...init.headers ?? {}
+    }
+  });
+  const text = await response.text();
+  const body = text ? JSON.parse(text) : null;
+  if (!response.ok) {
+    const message = body?.error ?? body?.message ?? `${response.status} ${response.statusText}`;
+    throw new Error(`Haven setup request failed: ${message}`);
+  }
+  return body;
+}
+function generateDelegateKey() {
+  return delegateKeyFromPrivateKey(Wallet.createRandom().privateKey);
+}
+function delegateKeyFromPrivateKey(privateKey) {
+  const wallet = new Wallet(privateKey);
+  return {
+    privateKey: wallet.privateKey,
+    address: wallet.address,
+    signChallenge: (message) => wallet.signMessage(message)
+  };
+}
+function generateAgentApiKey() {
+  return `sk_agent_${crypto.randomBytes(24).toString("hex")}`;
+}
+function hashAgentApiKey(apiKey) {
+  return crypto.createHash("sha256").update(apiKey).digest("hex");
+}
+function agentApiKeyPrefix(apiKey) {
+  return apiKey.slice(0, 12);
+}
+
+// src/redact.ts
+var API_KEY_RE = /sk_agent_[A-Za-z0-9]+/g;
+var PRIVATE_KEY_RE = /0x[0-9a-fA-F]{64}/g;
+function redactSecrets(value) {
+  return value.replace(API_KEY_RE, "sk_agent_[redacted]").replace(PRIVATE_KEY_RE, "0x[redacted-private-key]");
+}
+function shortAddress(address) {
+  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) return address;
+  return `${address.slice(0, 6)}...${address.slice(-4)}`;
+}
+async function preflightCredentialStorage(input = {}) {
+  const directory = defaultCredentialRoot(input.baseDir);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await restrictPermissions(directory, 448, input.warn);
+  const probePath = join(directory, `.haven-connect-preflight-${crypto.randomBytes(8).toString("hex")}`);
+  try {
+    await writeOwnerOnlyJson(probePath, { ok: true }, input.warn);
+  } finally {
+    await rm(probePath, { force: true }).catch(() => void 0);
+  }
+  return directory;
+}
+async function writeCredentialFiles(input) {
+  const directory = defaultAgentDirectory(input.agentId, input.baseDir);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await restrictPermissions(directory, 448, input.warn);
+  const identityPath = join(directory, "identity.json");
+  const signerPath = join(directory, "signer.json");
+  await assertDoesNotExist(identityPath);
+  await assertDoesNotExist(signerPath);
+  await writeOwnerOnlyJson(
+    signerPath,
+    {
+      delegate_key: input.delegateKey,
+      agent_id: input.agentId,
+      safe_address: input.safeAddress,
+      chain_id: input.chainId,
+      network: input.network,
+      note: "Local signer credential. Haven backend never receives this private key."
+    },
+    input.warn
+  );
+  try {
+    await writeOwnerOnlyJson(
+      identityPath,
+      {
+        api_key: input.apiKey,
+        agent_id: input.agentId,
+        safe_address: input.safeAddress,
+        chain_id: input.chainId,
+        network: input.network,
+        api_url: input.apiUrl,
+        hosted_mcp_url: input.hostedMcpUrl,
+        note: "Haven API key identifies the agent only. It cannot spend without the local signer key and on-chain Haven wallet rules."
+      },
+      input.warn
+    );
+  } catch (err) {
+    await rm(signerPath, { force: true }).catch(() => void 0);
+    throw err;
+  }
+  return { directory, identityPath, signerPath };
+}
+function defaultAgentDirectory(agentId, baseDir = join(homedir(), ".haven", "agents")) {
+  return resolve(defaultCredentialRoot(baseDir), safePathPart(agentId));
+}
+function defaultCredentialRoot(baseDir = join(homedir(), ".haven", "agents")) {
+  return resolve(baseDir);
+}
+async function writeOwnerOnlyJson(path, value, warn) {
+  const json = JSON.stringify(dropUndefined(value), null, 2);
+  await writeFile(path, `${json}
+`, { mode: 384, flag: "wx" });
+  await restrictPermissions(path, 384, warn);
+}
+function safePathPart(value) {
+  return value.replace(/[^A-Za-z0-9_.-]/g, "_");
+}
+function dropUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== void 0));
+}
+async function assertDoesNotExist(path) {
+  try {
+    await access(path);
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") return;
+    throw err;
+  }
+  throw new Error(`Refusing to overwrite existing Haven credential file: ${path}`);
+}
+async function restrictPermissions(path, mode, warn) {
+  try {
+    await chmod(path, mode);
+  } catch (err) {
+    warn?.(
+      `Warning: could not restrict permissions on ${path} to ${mode.toString(8)}. Move this credential to a private location or run chmod ${mode.toString(8)} ${path}. ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function writeRuntimeConfig(input) {
+  switch (input.runtime) {
+    case "codex-cli":
+      return writeCodexConfig(input);
+    case "cursor":
+      return writeJsonRuntimeConfig(input, cursorConfigPath(input.homeDir), "mcpServers");
+    case "vscode":
+      return writeJsonRuntimeConfig(input, vscodeConfigPath(input.homeDir), "servers");
+    case "claude-desktop":
+      return writeJsonRuntimeConfig(input, claudeDesktopConfigPath(input.homeDir), "mcpServers");
+    default:
+      return {
+        hostedConfigured: false,
+        signerConfigured: false,
+        target: "manual runtime setup",
+        changed: false,
+        restartRequired: true,
+        messages: ["Runtime config needs to be added manually for this agent environment."],
+        errorCode: "manual_runtime_setup_required"
+      };
+  }
+}
+function buildHostedServer(hostedMcpUrl, apiKey, runtime) {
+  if (runtime === "vscode") {
+    return {
+      type: "http",
+      url: hostedMcpUrl,
+      headers: { Authorization: `Bearer ${apiKey}` }
+    };
+  }
+  return {
+    url: hostedMcpUrl,
+    headers: { Authorization: `Bearer ${apiKey}` }
+  };
+}
+function buildSignerServer(signerPath, runtime) {
+  const server = {
+    command: "npx",
+    args: ["-y", "@haven_ai/signer", "--credentials", signerPath]
+  };
+  if (runtime === "vscode") return { type: "stdio", ...server };
+  return server;
+}
+function mergeJsonMcpConfig(existingJson, serverRoot, hostedServer, signerServer) {
+  const config = existingJson?.trim() ? parseJsonObject(existingJson) : {};
+  const existingRoot = config[serverRoot];
+  const servers = existingRoot && typeof existingRoot === "object" && !Array.isArray(existingRoot) ? existingRoot : {};
+  config[serverRoot] = {
+    ...servers,
+    haven: hostedServer,
+    "haven-signer": signerServer
+  };
+  return `${JSON.stringify(config, null, 2)}
+`;
+}
+function mergeCodexToml(existingToml, hostedMcpUrl, signerPath) {
+  let next = removeTomlTable(removeTomlTable(existingToml, "mcp_servers.haven"), "mcp_servers.haven_signer");
+  next = next.trimEnd();
+  const block = [
+    "[mcp_servers.haven]",
+    `url = ${tomlString(hostedMcpUrl)}`,
+    'bearer_token_env_var = "HAVEN_TOKEN"',
+    "",
+    "[mcp_servers.haven_signer]",
+    'command = "npx"',
+    `args = ["-y", "@haven_ai/signer", "--credentials", ${tomlString(signerPath)}]`
+  ].join("\n");
+  return `${next ? `${next}
+
+` : ""}${block}
+`;
+}
+async function writeJsonRuntimeConfig(input, target, serverRoot) {
+  try {
+    const existing = await readOptional(target);
+    const merged = mergeJsonMcpConfig(
+      existing,
+      serverRoot,
+      buildHostedServer(input.hostedMcpUrl, input.apiKey, input.runtime),
+      buildSignerServer(input.signerPath, input.runtime)
+    );
+    await writeOwnerOnlyText(target, merged);
+    return {
+      hostedConfigured: true,
+      signerConfigured: true,
+      target: configTargetLabel(input.runtime),
+      changed: existing !== merged,
+      restartRequired: input.runtime === "claude-desktop",
+      messages: [`Updated Haven MCP entries in ${configTargetLabel(input.runtime)}.`]
+    };
+  } catch (err) {
+    return {
+      hostedConfigured: false,
+      signerConfigured: false,
+      target: configTargetLabel(input.runtime),
+      changed: false,
+      restartRequired: true,
+      messages: [`Could not update ${configTargetLabel(input.runtime)}: ${err instanceof Error ? err.message : String(err)}`],
+      errorCode: "runtime_config_write_failed"
+    };
+  }
+}
+async function writeCodexConfig(input) {
+  const target = codexConfigPath(input.homeDir);
+  const envTarget = join(input.credentialDirectory, "identity.env");
+  try {
+    const existing = await readOptional(target);
+    const merged = mergeCodexToml(existing ?? "", input.hostedMcpUrl, input.signerPath);
+    await writeOwnerOnlyText(target, merged);
+    await writeOwnerOnlyText(envTarget, `HAVEN_TOKEN=${shellToken(input.apiKey)}
+`);
+    return {
+      hostedConfigured: false,
+      signerConfigured: true,
+      target: "Codex CLI config",
+      changed: existing !== merged,
+      restartRequired: true,
+      messages: [
+        "Updated Haven MCP entries in Codex CLI config.",
+        "Wrote the hosted MCP token to a private env file. Launch Codex with that env file before using Haven tools."
+      ],
+      errorCode: "codex_env_activation_required"
+    };
+  } catch (err) {
+    return {
+      hostedConfigured: false,
+      signerConfigured: false,
+      target: "Codex CLI config",
+      changed: false,
+      restartRequired: true,
+      messages: [`Could not update Codex CLI config: ${err instanceof Error ? err.message : String(err)}`],
+      errorCode: "runtime_config_write_failed"
+    };
+  }
+}
+async function readOptional(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function writeOwnerOnlyText(path, value) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, value, { mode: 384 });
+  await chmod(path, 384).catch(() => void 0);
+}
+function parseJsonObject(value) {
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("runtime config must be a JSON object");
+  }
+  return parsed;
+}
+function removeTomlTable(toml, table) {
+  const lines = toml.split(/\r?\n/);
+  const start = `[${table}]`;
+  const kept = [];
+  let skipping = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === start) {
+      skipping = true;
+      continue;
+    }
+    if (skipping && trimmed.startsWith("[") && trimmed.endsWith("]")) {
+      skipping = false;
+    }
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n");
+}
+function tomlString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function shellToken(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function cursorConfigPath(homeDir = homedir()) {
+  return resolve(homeDir, ".cursor", "mcp.json");
+}
+function codexConfigPath(homeDir = homedir()) {
+  return resolve(homeDir, ".codex", "config.toml");
+}
+function vscodeConfigPath(homeDir = homedir()) {
+  if (platform() === "darwin") return resolve(homeDir, "Library", "Application Support", "Code", "User", "mcp.json");
+  if (platform() === "win32") {
+    return resolve(process.env.APPDATA ?? join(homeDir, "AppData", "Roaming"), "Code", "User", "mcp.json");
+  }
+  return resolve(homeDir, ".config", "Code", "User", "mcp.json");
+}
+function claudeDesktopConfigPath(homeDir = homedir()) {
+  if (platform() === "darwin") {
+    return resolve(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  if (platform() === "win32") {
+    return resolve(process.env.APPDATA ?? join(homeDir, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+  }
+  return resolve(homeDir, ".config", "Claude", "claude_desktop_config.json");
+}
+function configTargetLabel(runtime) {
+  switch (runtime) {
+    case "cursor":
+      return "Cursor MCP config";
+    case "vscode":
+      return "VS Code MCP config";
+    case "claude-desktop":
+      return "Claude Desktop config";
+    default:
+      return "runtime MCP config";
+  }
+}
+async function probeHostedMcpTools(apiKey, hostedMcpUrl, fetchImpl = fetch) {
+  let response;
+  try {
+    response = await fetchWithTimeout(fetchImpl, hostedMcpUrl, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream"
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" })
+    });
+  } catch {
+    return { status: "network_error" };
+  }
+  if (response.status === 401 || response.status === 403) return { status: "unauthorized" };
+  if (!response.ok) return { status: "bad_response" };
+  try {
+    const payload = parseJsonRpcPayload(await response.text());
+    if (!payload || payload.error) return { status: "bad_response" };
+    const tools = payload.result?.tools;
+    return { status: "ok", toolCount: Array.isArray(tools) ? tools.length : void 0 };
+  } catch {
+    return { status: "bad_response" };
+  }
+}
+async function probeLocalSignerCredential(signerPath) {
+  try {
+    const parsed = JSON.parse(await readFile(signerPath, "utf8"));
+    return Boolean(
+      parsed && typeof parsed === "object" && "delegate_key" in parsed && typeof parsed.delegate_key === "string"
+    );
+  } catch {
+    return false;
+  }
+}
+function parseJsonRpcPayload(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("{")) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+      return null;
+    }
+  }
+  const dataLines = trimmed.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim());
+  for (let i = dataLines.length - 1; i >= 0; i -= 1) {
+    try {
+      return JSON.parse(dataLines[i]);
+    } catch {
+    }
+  }
+  return null;
+}
+async function fetchWithTimeout(fetchImpl, url, init) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e3);
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// src/runtime-registry.ts
+var RUNTIME_PROFILES = {
+  "claude-code": {
+    id: "claude-code",
+    label: "Claude Code",
+    restartMode: "restart-session",
+    canWriteRuntimeConfig: true
+  },
+  "codex-cli": {
+    id: "codex-cli",
+    label: "Codex CLI",
+    restartMode: "restart-session",
+    canWriteRuntimeConfig: true
+  },
+  cursor: {
+    id: "cursor",
+    label: "Cursor",
+    restartMode: "hot-reload",
+    canWriteRuntimeConfig: true
+  },
+  vscode: {
+    id: "vscode",
+    label: "VS Code",
+    restartMode: "hot-reload",
+    canWriteRuntimeConfig: true
+  },
+  "claude-desktop": {
+    id: "claude-desktop",
+    label: "Claude Desktop",
+    restartMode: "restart-app",
+    canWriteRuntimeConfig: true
+  },
+  other: {
+    id: "other",
+    label: "Other agent runtime",
+    restartMode: "manual",
+    canWriteRuntimeConfig: false
+  }
+};
+var RUNTIME_ALIASES = {
+  claude: "claude-code",
+  "claude-code": "claude-code",
+  claudecode: "claude-code",
+  "claude_code": "claude-code",
+  codex: "codex-cli",
+  "codex-cli": "codex-cli",
+  codexcli: "codex-cli",
+  "codex_cli": "codex-cli",
+  cursor: "cursor",
+  vscode: "vscode",
+  "vs-code": "vscode",
+  "vs_code": "vscode",
+  code: "vscode",
+  "claude-desktop": "claude-desktop",
+  "claude_desktop": "claude-desktop",
+  claudesktop: "claude-desktop",
+  desktop: "claude-desktop",
+  other: "other",
+  manual: "other"
+};
+function runtimeProfile(runtime, env = process.env) {
+  return RUNTIME_PROFILES[normalizeRuntime(runtime, env)];
+}
+function normalizeRuntime(runtime, env = process.env) {
+  const explicit = normalizeRuntimeName(runtime);
+  if (explicit) return explicit;
+  return detectRuntime(env) ?? "other";
+}
+function restartRequiredForRuntime(runtime, env = process.env) {
+  const mode = runtimeProfile(runtime, env).restartMode;
+  return mode === "restart-session" || mode === "restart-app";
+}
+function normalizeRuntimeName(runtime) {
+  const key = runtime?.trim().toLowerCase();
+  if (!key) return null;
+  return RUNTIME_ALIASES[key.replace(/\s+/g, "-")] ?? null;
+}
+function detectRuntime(env) {
+  if (env.CLAUDECODE || env.CLAUDE_CODE || env.CLAUDECODE_CWD) return "claude-code";
+  if (env.CODEX_SANDBOX || env.CODEX_HOME || env.CODEX_CWD) return "codex-cli";
+  if (env.VSCODE_CWD || env.VSCODE_IPC_HOOK_CLI || env.TERM_PROGRAM === "vscode") return "vscode";
+  return null;
+}
+
+// src/runtime-install.ts
+var execFileAsync = promisify(execFile);
+async function installRuntime(input, deps = {}) {
+  const runtime = normalizeRuntime(input.runtime, deps.env);
+  const profile = runtimeProfile(runtime, deps.env);
+  if (runtime === "other") {
+    const signerReady2 = await probeLocalSignerCredential(input.signerPath);
+    return {
+      runtime,
+      hostedMcpConfigured: false,
+      localSignerConfigured: false,
+      probeResult: signerReady2 ? "manual_runtime_setup_required_local_signer_ready" : "manual_runtime_setup_required_local_signer_unavailable",
+      restartRequired: true,
+      nextUserAction: "return_to_haven_for_wallet_approval_then_configure_runtime",
+      errorCode: "manual_runtime_setup_required",
+      configTarget: "manual runtime setup",
+      messages: ["Runtime was not recognized. Keep the local credentials and add Haven MCP entries manually after wallet approval."]
+    };
+  }
+  const configResult = runtime === "claude-code" ? await configureClaudeCode(input, deps) : await writeRuntimeConfig({
+    runtime,
+    hostedMcpUrl: input.hostedMcpUrl,
+    apiKey: input.apiKey,
+    signerPath: input.signerPath,
+    credentialDirectory: input.credentialDirectory,
+    homeDir: deps.homeDir
+  });
+  const [hostedProbe, signerReady] = await Promise.all([
+    configResult.hostedConfigured ? probeHostedMcpTools(input.apiKey, input.hostedMcpUrl, deps.fetch) : Promise.resolve({ status: "bad_response" }),
+    probeLocalSignerCredential(input.signerPath)
+  ]);
+  const hostedOk = configResult.hostedConfigured && hostedProbe.status !== "unauthorized";
+  const signerOk = configResult.signerConfigured && signerReady;
+  const restartRequired = configResult.restartRequired || restartRequiredForRuntime(runtime, deps.env);
+  return {
+    runtime,
+    hostedMcpConfigured: hostedOk,
+    localSignerConfigured: signerOk,
+    probeResult: buildProbeResult(configResult.hostedConfigured, hostedProbe.status, signerOk),
+    restartRequired,
+    nextUserAction: nextAction(profile.restartMode, configResult.errorCode),
+    errorCode: configResult.errorCode,
+    configTarget: configResult.target,
+    messages: configResult.messages
+  };
+}
+function runtimeInstallCapabilities(runtime, env = process.env) {
+  const profile = runtimeProfile(runtime, env);
+  return {
+    canWriteRuntimeConfig: profile.canWriteRuntimeConfig,
+    restartRequired: restartRequiredForRuntime(runtime, env)
+  };
+}
+async function configureClaudeCode(input, deps) {
+  const runCommand = deps.runCommand ?? defaultRunCommand;
+  try {
+    await runCommand("claude", [
+      "mcp",
+      "add",
+      "--transport",
+      "http",
+      "haven",
+      input.hostedMcpUrl,
+      "--header",
+      `Authorization: Bearer ${input.apiKey}`
+    ]);
+    await runCommand("claude", [
+      "mcp",
+      "add",
+      "haven-signer",
+      "npx",
+      "-y",
+      "@haven_ai/signer",
+      "--credentials",
+      input.signerPath
+    ]);
+    return {
+      hostedConfigured: true,
+      signerConfigured: true,
+      target: "Claude Code MCP config",
+      changed: true,
+      restartRequired: true,
+      messages: ["Updated Haven MCP entries with Claude Code."]
+    };
+  } catch (err) {
+    return {
+      hostedConfigured: false,
+      signerConfigured: false,
+      target: "Claude Code MCP config",
+      changed: false,
+      restartRequired: true,
+      messages: [`Could not update Claude Code MCP config: ${err instanceof Error ? err.message : String(err)}`],
+      errorCode: "claude_code_config_failed"
+    };
+  }
+}
+async function defaultRunCommand(command, args) {
+  await execFileAsync(command, args, { timeout: 1e4 });
+}
+function buildProbeResult(hostedConfigured, hostedStatus, signerReady) {
+  const hostedPart = hostedConfigured ? `hosted_${hostedStatus}` : "hosted_not_configured";
+  const signerPart = signerReady ? "local_signer_ready" : "local_signer_unavailable";
+  return `${hostedPart}_${signerPart}`.slice(0, 120);
+}
+function nextAction(restartMode, errorCode) {
+  if (errorCode) return "return_to_haven_for_wallet_approval_then_finish_runtime_setup";
+  if (restartMode === "hot-reload") return "return_to_haven_for_wallet_approval";
+  if (restartMode === "restart-app") return "return_to_haven_for_wallet_approval_then_restart_app";
+  if (restartMode === "restart-session") return "return_to_haven_for_wallet_approval_then_restart_agent_session";
+  return "return_to_haven_for_wallet_approval_then_configure_runtime";
+}
+
+// src/runtime.ts
+var CONNECTOR_VERSION = "0.1.0";
+async function runConnect(options, deps = {}) {
+  const connectorVersion = options.connectorVersion ?? CONNECTOR_VERSION;
+  const api = deps.api ?? createConnectApiClient(options.apiBaseUrl);
+  const log = secureLogger(deps.log ?? ((message) => process.stdout.write(`${message}
+`)));
+  const writeCredentials = deps.writeCredentials ?? writeCredentialFiles;
+  const preflightStorage = deps.preflightStorage ?? preflightCredentialStorage;
+  const runRuntimeInstall = deps.installRuntime ?? installRuntime;
+  const generateKey = deps.generateKey ?? generateDelegateKey;
+  const generateLocalApiKey = deps.generateApiKey ?? generateAgentApiKey;
+  const installCapabilities = runtimeInstallCapabilities(options.runtime);
+  const setup = await api.resolveSetup({
+    setupToken: options.setupToken,
+    connectorVersion,
+    runtime: options.runtime
+  });
+  printSetupSummary(setup, log);
+  await preflightStorage({ baseDir: options.credentialsDir, warn: log });
+  log("Checked local credential storage.");
+  const localKey = generateKey();
+  const localApiKey = generateLocalApiKey();
+  log("Generated local signing key.");
+  log("Generated local Haven API key.");
+  const proofSignature = await localKey.signChallenge(setup.challenge.message);
+  const registration = await api.registerSetup({
+    setupToken: options.setupToken,
+    connectorVersion,
+    runtime: options.runtime,
+    challengeId: setup.challenge.id,
+    delegateAddress: localKey.address,
+    proofSignature,
+    apiKeyHash: hashAgentApiKey(localApiKey),
+    apiKeyPrefix: agentApiKeyPrefix(localApiKey),
+    connectorContext: {
+      environment_label: options.environmentLabel ?? "Local workspace",
+      config_target: installCapabilities.canWriteRuntimeConfig ? "agent runtime MCP config" : "local credential files"
+    },
+    installCapabilities
+  });
+  log(`Registered signing address with Haven: ${shortAddress(registration.delegate_address)}.`);
+  const credentialPaths = await writeCredentials({
+    baseDir: options.credentialsDir,
+    agentId: registration.agent_id,
+    apiKey: localApiKey,
+    delegateKey: localKey.privateKey,
+    safeAddress: setup.haven_wallet.address,
+    chainId: setup.haven_wallet.chain_id,
+    network: setup.haven_wallet.network,
+    apiUrl: options.apiBaseUrl,
+    hostedMcpUrl: registration.hosted_mcp_url,
+    warn: log
+  });
+  log(`Stored Haven identity credential locally: ${credentialPaths.identityPath}`);
+  log(`Stored local signer credential locally: ${credentialPaths.signerPath}`);
+  const runtimeInstall = await runRuntimeInstall({
+    runtime: options.runtime,
+    hostedMcpUrl: registration.hosted_mcp_url,
+    apiKey: localApiKey,
+    signerPath: credentialPaths.signerPath,
+    identityPath: credentialPaths.identityPath,
+    credentialDirectory: credentialPaths.directory,
+    environmentLabel: options.environmentLabel ?? "Local workspace"
+  });
+  printRuntimeInstall(runtimeInstall, log);
+  try {
+    await api.updateInstallStatus(registration.setup_id, localApiKey, {
+      runtime: runtimeInstall.runtime,
+      connectorVersion,
+      hostedMcpConfigured: runtimeInstall.hostedMcpConfigured,
+      localSignerConfigured: runtimeInstall.localSignerConfigured,
+      credentialFilesWritten: true,
+      probeResult: runtimeInstall.probeResult,
+      restartRequired: runtimeInstall.restartRequired,
+      nextUserAction: runtimeInstall.nextUserAction,
+      errorCode: runtimeInstall.errorCode,
+      environmentLabel: options.environmentLabel ?? "Local workspace"
+    });
+  } catch (err) {
+    log(`Could not report install status to Haven: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  log("Return to Haven to approve the agent rules.");
+  if (runtimeInstall.restartRequired) {
+    log("Restart this agent session after approval if your runtime loads MCP tools at startup.");
+  }
+  return {
+    setupId: registration.setup_id,
+    agentId: registration.agent_id,
+    delegateAddress: registration.delegate_address,
+    credentialPaths
+  };
+}
+function printSetupSummary(setup, log) {
+  log(`Fetched Haven setup for ${setup.agent.name}.`);
+  log(`Haven wallet: ${setup.haven_wallet.name} on ${setup.haven_wallet.network}.`);
+  if (setup.agent_budget.length > 0) {
+    for (const budget of setup.agent_budget) {
+      log(
+        `Agent budget: ${budget.allowance_amount} atomic ${budget.token_symbol} / ${budget.reset_period_min} minute reset.`
+      );
+    }
+  }
+  log(`Setup challenge expires at ${setup.challenge.expires_at}.`);
+}
+function secureLogger(log) {
+  return (message) => log(redactSecrets(message));
+}
+function printRuntimeInstall(result, log) {
+  for (const message of result.messages) log(message);
+  if (result.hostedMcpConfigured) {
+    log("Configured hosted Haven MCP identity.");
+  } else {
+    log("Hosted Haven MCP identity still needs runtime setup.");
+  }
+  if (result.localSignerConfigured) {
+    log("Configured local Haven signer.");
+  } else {
+    log("Local Haven signer still needs runtime setup.");
+  }
+}
+
+// src/args.ts
+function parseArgs(argv, env = process.env) {
+  const options = {
+    apiBaseUrl: env.HAVEN_API_URL ?? "http://localhost:3001",
+    connectorVersion: CONNECTOR_VERSION
+  };
+  let help = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") {
+      help = true;
+    } else if (arg === "--setup" || arg === "--setup-token") {
+      options.setupToken = requireValue(argv, ++i, arg);
+    } else if (arg === "--api" || arg === "--api-url") {
+      options.apiBaseUrl = requireValue(argv, ++i, arg);
+    } else if (arg === "--runtime") {
+      options.runtime = requireValue(argv, ++i, arg);
+    } else if (arg === "--credentials-dir") {
+      options.credentialsDir = requireValue(argv, ++i, arg);
+    } else if (arg === "--environment-label") {
+      options.environmentLabel = requireValue(argv, ++i, arg);
+    } else if (arg === "--version") {
+      process.stdout.write(`${CONNECTOR_VERSION}
+`);
+      process.exit(0);
+    } else {
+      throw new Error(`Unknown option: ${arg}`);
+    }
+  }
+  if (help) {
+    return { options, help };
+  }
+  if (!options.setupToken) {
+    throw new Error("Missing --setup <hv_setup_...> setup token.");
+  }
+  if (!options.apiBaseUrl) {
+    throw new Error("Missing --api <Haven API URL>.");
+  }
+  options.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
+  return { options, help };
+}
+function helpText() {
+  return [
+    "Haven Connect Agent 2 local connector",
+    "",
+    "Generates the agent signing key locally, stores it on this machine, and",
+    "sends Haven only the public signing address plus a proof signature.",
+    "",
+    "Usage:",
+    "  npx -y @haven_ai/connect --setup hv_setup_... --api https://api.haven.example --runtime claude-code",
+    "",
+    "Options:",
+    "  --setup <token>            Short-lived setup token from Haven.",
+    "  --api <url>                Haven backend API URL. Defaults to HAVEN_API_URL or http://localhost:3001.",
+    "  --runtime <name>           Agent runtime hint, such as claude-code, codex-cli, cursor, vscode, or claude-desktop.",
+    "  --credentials-dir <path>   Credential directory fallback. Defaults to ~/.haven/agents.",
+    "  --environment-label <text> Non-sensitive label shown in Haven setup review.",
+    "  --help                     Show this help.",
+    "",
+    "The connector never prints the private key and never sends it to Haven."
+  ].join("\n");
+}
+function requireValue(argv, index, option) {
+  const value = argv[index];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`Missing value for ${option}.`);
+  }
+  return value;
+}
+
+export { CONNECTOR_VERSION, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, normalizeRuntime, parseArgs, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, shortAddress, writeCredentialFiles };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map