@haven_ai/connect 0.1.28-alpha.0 → 0.1.29-alpha.0

package/dist/index.js

@@ -1,14 +1,15 @@
 import { ensureConsent, computeConsentHash, loadCredentials, consentInputFromClient, registeredToolNames, MCP_VERSION } from '@haven_ai/mcp';
 import { ensureSignerConsent, computeSignerConsentHash, loadSignerCredentials, createEdgeSigner, toolSchemas } from '@haven_ai/signer';
 import { isSupportedNodeVersion, unsupportedNodeVersionMessage, SKILL_FOLDER_NAME, resolveTokenFromAddress, HAVEN_SKILL_MD, HAVEN_SKILL_BODY_MD, HAVEN_MINIMUM_NODE_VERSION } from '@haven_ai/sdk';
-import { mkdir, rm, chmod, access, writeFile, readFile, unlink, readdir, stat } from 'fs/promises';
+import { mkdir, rm, stat, readdir, readFile, chmod, access, writeFile, unlink } from 'fs/promises';
 import { homedir, platform } from 'os';
-import { join, resolve, dirname } from 'path';
+import { join, resolve, dirname, basename } from 'path';
 import { parseDocument, isMap, stringify } from 'yaml';
 import { execFile, spawn } from 'child_process';
 import { promisify } from 'util';
 import crypto from 'crypto';
 import { Wallet } from 'ethers';
+import { createInterface } from 'readline';
 import { realpathSync } from 'fs';
 import { fileURLToPath, pathToFileURL } from 'url';
 
@@ -21,6 +22,69 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+
+// src/redact.ts
+function redactSecrets(value) {
+  return value.replace(API_KEY_RE, "sk_agent_[redacted]").replace(PRIVATE_KEY_RE, "0x[redacted-private-key]");
+}
+function shortAddress(address) {
+  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) return address;
+  return `${address.slice(0, 6)}...${address.slice(-4)}`;
+}
+var API_KEY_RE, PRIVATE_KEY_RE;
+var init_redact = __esm({
+  "src/redact.ts"() {
+    API_KEY_RE = /sk_agent_[A-Za-z0-9]+/g;
+    PRIVATE_KEY_RE = /0x[0-9a-fA-F]{64}/g;
+  }
+});
+
+// src/server-names.ts
+function assertValidServerSlug(slug) {
+  if (slug.length === 0 || slug.length > 32 || !SLUG_RE.test(slug)) {
+    throw new Error(
+      `Invalid server name ${JSON.stringify(slug)}: use 1-32 lowercase letters, digits, and single hyphens (e.g. "research").`
+    );
+  }
+  if (slug === "haven" || slug === "haven-signer") {
+    throw new Error(
+      `Invalid server name ${JSON.stringify(slug)}: "haven" and "haven-signer" are the unnamed pair's own names \u2014 omit --name for the bare pair.`
+    );
+  }
+  if (slug === "signer" || slug.startsWith("signer-")) {
+    throw new Error(
+      `Invalid server name ${JSON.stringify(slug)}: "signer" and "signer-*" are reserved \u2014 they would collide with another pair's haven-signer-* entry.`
+    );
+  }
+}
+function serverNamesFor(slug) {
+  if (slug === void 0) {
+    return {
+      hosted: "haven",
+      signer: "haven-signer",
+      // Historical Codex table names — every wired Codex host has these.
+      codexHosted: "haven",
+      codexSigner: "haven_signer",
+      hermesEnvKey: "MCP_HAVEN_API_KEY"
+    };
+  }
+  assertValidServerSlug(slug);
+  return {
+    hosted: `haven-${slug}`,
+    signer: `haven-signer-${slug}`,
+    // Hyphens are valid TOML bare keys, so named Codex tables match the
+    // JSON/YAML names instead of inheriting the legacy underscore.
+    codexHosted: `haven-${slug}`,
+    codexSigner: `haven-signer-${slug}`,
+    hermesEnvKey: `MCP_HAVEN_${slug.toUpperCase().replace(/-/g, "_")}_API_KEY`
+  };
+}
+var SLUG_RE;
+var init_server_names = __esm({
+  "src/server-names.ts"() {
+    SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+  }
+});
 function mcpPackageSpec() {
   return `${MCP_RUNTIME_MANIFEST.mcpPackage}@${MCP_RUNTIME_MANIFEST.mcpVersion}`;
 }
@@ -37,9 +101,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.1.28-alpha.0",
+      sdkVersion: "0.1.29-alpha.0",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.1.28-alpha.0",
+      signerVersion: "0.1.29-alpha.0",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -115,31 +179,33 @@ function buildSignerServer(spec, runtime) {
   if (runtime === "vscode" || runtime === "vscode-insiders") return { type: "stdio", ...server };
   return server;
 }
-function mergeJsonMcpConfig(existingJson, serverRoot, hostedServer, signerServer) {
-  const config = existingJson?.trim() ? parseJsonObject(existingJson) : {};
+function mergeJsonMcpConfig(existingJson, serverRoot, hostedServer, signerServer, names = serverNamesFor(), configPath) {
+  const config = existingJson?.trim() ? parseJsonObject(existingJson, configPath) : {};
   const existingRoot = config[serverRoot];
   const servers = existingRoot && typeof existingRoot === "object" && !Array.isArray(existingRoot) ? existingRoot : {};
   config[serverRoot] = {
     ...servers,
-    haven: hostedServer,
-    "haven-signer": signerServer
+    [names.hosted]: hostedServer,
+    [names.signer]: signerServer
   };
   return `${JSON.stringify(config, null, 2)}
 `;
 }
-function mergeHermesYaml(existingYaml, hostedServer, signerServer) {
-  if (!existingYaml?.trim()) return renderHermesYaml({ haven: hostedServer, "haven-signer": signerServer });
+function mergeHermesYaml(existingYaml, hostedServer, signerServer, names = serverNamesFor(), configPath) {
+  if (!existingYaml?.trim()) {
+    return renderHermesYaml({ [names.hosted]: hostedServer, [names.signer]: signerServer });
+  }
   const doc = parseDocument(existingYaml, { keepSourceTokens: true });
   if (doc.errors.length > 0 || !isMap(doc.contents)) {
-    throw new Error("Hermes config must be a YAML object");
+    throw new UnreadableRuntimeConfigError(configPath ?? "the Hermes config", "it is not a YAML object");
   }
   const mcpPair = doc.contents.items.find((item) => item.key?.toString() === "mcp_servers");
   const existingServers = mcpPair && isMap(mcpPair.value) ? mcpPair.value.toJSON() : {};
   const servers = isRecord(existingServers) ? existingServers : {};
   const mergedServers = {
     ...servers,
-    haven: hostedServer,
-    "haven-signer": signerServer
+    [names.hosted]: hostedServer,
+    [names.signer]: signerServer
   };
   if (!mcpPair) {
     return appendHermesMcpServers(existingYaml, mergedServers);
@@ -147,9 +213,9 @@ function mergeHermesYaml(existingYaml, hostedServer, signerServer) {
   if (!mcpPair.value?.range) return replaceEmptyHermesMcpServers(existingYaml, mcpPair.key?.range, mergedServers);
   return replaceHermesMcpServers(existingYaml, mcpPair.key?.range, mcpPair.value.range, mergedServers);
 }
-function mergeHermesEnv(existingEnv, apiKey) {
+function mergeHermesEnv(existingEnv, apiKey, envKey = HERMES_API_KEY_ENV) {
   if (/[\r\n]/.test(apiKey)) throw new Error("Hermes API key must be a single line");
-  const assignment = `${HERMES_API_KEY_ENV}=${apiKey}`;
+  const assignment = `${envKey}=${apiKey}`;
   if (!existingEnv) return `${assignment}
 `;
   const lineEnding = existingEnv.includes("\r\n") ? "\r\n" : "\n";
@@ -158,12 +224,12 @@ function mergeHermesEnv(existingEnv, apiKey) {
   if (hasTrailingNewline) lines.pop();
   let found = false;
   const merged = lines.flatMap((line) => {
-    if (isHermesEnvAssignment(line)) {
+    if (isHermesEnvAssignment(line, envKey)) {
       if (found) return [];
       found = true;
       return [assignment];
     }
-    if (isAmbiguousHermesEnvLine(line)) {
+    if (isAmbiguousHermesEnvLine(line, envKey)) {
       throw new Error("Hermes environment contains an ambiguous managed key");
     }
     return [line];
@@ -173,11 +239,11 @@ function mergeHermesEnv(existingEnv, apiKey) {
   }
   return `${merged.join(lineEnding)}${hasTrailingNewline ? lineEnding : ""}`;
 }
-function isHermesEnvAssignment(line) {
-  return /^\s*(?:export[ \t]+)?MCP_HAVEN_API_KEY[ \t]*=/.test(line);
+function isHermesEnvAssignment(line, envKey) {
+  return new RegExp(`^\\s*(?:export[ \\t]+)?${envKey}[ \\t]*=`).test(line);
 }
-function isAmbiguousHermesEnvLine(line) {
-  return /^\s*(?:export[ \t]+)?MCP_HAVEN_API_KEY\b/.test(line);
+function isAmbiguousHermesEnvLine(line, envKey) {
+  return new RegExp(`^\\s*(?:export[ \\t]+)?${envKey}\\b`).test(line);
 }
 function appendHermesMcpServers(source, servers) {
   const documentEnd = /(?:^|\n)[ \t]*\.\.\.[ \t]*(?:#[^\n]*)?\r?\n?$/.exec(source);
@@ -236,11 +302,14 @@ function renderHermesMcpServerEntries(servers, indent) {
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function mergeCodexToml(existingToml, localMcpCommand) {
-  let next = removeTomlTableTree(removeTomlTableTree(existingToml, "mcp_servers.haven"), "mcp_servers.haven_signer");
+function mergeCodexToml(existingToml, localMcpCommand, names = serverNamesFor()) {
+  let next = removeTomlTableTree(
+    removeTomlTableTree(existingToml, `mcp_servers.${names.codexHosted}`),
+    `mcp_servers.${names.codexSigner}`
+  );
   next = next.trimEnd();
   const block = [
-    "[mcp_servers.haven]",
+    `[mcp_servers.${names.codexHosted}]`,
     `command = ${tomlString(localMcpCommand)}`,
     "args = []",
     "startup_timeout_sec = 120"
@@ -252,15 +321,18 @@ function mergeCodexToml(existingToml, localMcpCommand) {
 `;
   return merged;
 }
-function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerSpec) {
-  let next = removeTomlTableTree(removeTomlTableTree(existingToml, "mcp_servers.haven"), "mcp_servers.haven_signer");
+function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerSpec, names = serverNamesFor()) {
+  let next = removeTomlTableTree(
+    removeTomlTableTree(existingToml, `mcp_servers.${names.codexHosted}`),
+    `mcp_servers.${names.codexSigner}`
+  );
   next = next.trimEnd();
   const block = [
-    "[mcp_servers.haven]",
+    `[mcp_servers.${names.codexHosted}]`,
     `url = ${tomlString(hostedMcpUrl)}`,
     `http_headers = { "Authorization" = ${tomlString(`Bearer ${apiKey}`)} }`,
     "",
-    "[mcp_servers.haven_signer]",
+    `[mcp_servers.${names.codexSigner}]`,
     `command = ${tomlString(signerSpec.command)}`,
     `args = [${signerSpec.args.map((arg) => tomlString(arg)).join(", ")}]`,
     "startup_timeout_sec = 120"
@@ -279,7 +351,9 @@ async function writeJsonRuntimeConfig(input, target, serverRoot) {
       existing,
       serverRoot,
       buildHostedServer(input.hostedMcpUrl, input.apiKey, input.runtime),
-      buildSignerServer(resolveSignerLaunchSpec(input), input.runtime)
+      buildSignerServer(resolveSignerLaunchSpec(input), input.runtime),
+      serverNamesFor(input.serverName),
+      target
     );
     await writeOwnerOnlyText(target, merged);
     return {
@@ -293,6 +367,7 @@ async function writeJsonRuntimeConfig(input, target, serverRoot) {
       messages: [`Updated Haven MCP entries in ${configTargetLabel(input.runtime)}.`]
     };
   } catch (err) {
+    const unreadable = err instanceof UnreadableRuntimeConfigError;
     return {
       hostedConfigured: false,
       signerConfigured: false,
@@ -301,8 +376,11 @@ async function writeJsonRuntimeConfig(input, target, serverRoot) {
       target: configTargetLabel(input.runtime),
       changed: false,
       restartRequired: true,
-      messages: [`Could not update ${configTargetLabel(input.runtime)}: ${err instanceof Error ? err.message : String(err)}`],
-      errorCode: "runtime_config_write_failed"
+      messages: unreadable ? [
+        `Could not update ${configTargetLabel(input.runtime)}: ${err.message}.`,
+        `Nothing was written to ${err.configPath}. Fix the JSON there (or move the file aside), then run \`${REPAIR_COMMAND_PREFIX} ${input.runtime}\` to write the Haven entries from the credentials already stored on this machine. Do not re-run the setup command: its token is already used.`
+      ] : [`Could not update ${configTargetLabel(input.runtime)}: ${err instanceof Error ? err.message : String(err)}`],
+      errorCode: unreadable ? "runtime_config_unreadable" : "runtime_config_write_failed"
     };
   }
 }
@@ -311,8 +389,9 @@ async function writeHermesConfig(input, deps) {
   const envTarget = hermesEnvPath(input.homeDir);
   try {
     const [existing, existingEnv] = await Promise.all([readOptional(target), readOptional(envTarget)]);
+    const names = serverNamesFor(input.serverName);
     const hostedServer = {
-      ...buildHostedServer(input.hostedMcpUrl, `\${${HERMES_API_KEY_ENV}}`, input.runtime),
+      ...buildHostedServer(input.hostedMcpUrl, `\${${names.hermesEnvKey}}`, input.runtime),
       enabled: true
     };
     const signerServer = {
@@ -322,9 +401,11 @@ async function writeHermesConfig(input, deps) {
     const merged = mergeHermesYaml(
       existing,
       hostedServer,
-      signerServer
+      signerServer,
+      names,
+      target
     );
-    const mergedEnv = mergeHermesEnv(existingEnv, input.apiKey);
+    const mergedEnv = mergeHermesEnv(existingEnv, input.apiKey, names.hermesEnvKey);
     const writeText = deps.writeOwnerOnlyText ?? writeOwnerOnlyText;
     await writeText(envTarget, mergedEnv);
     try {
@@ -345,11 +426,13 @@ async function writeHermesConfig(input, deps) {
       messages: [
         `Updated Haven MCP entries in ${target}; stored the hosted MCP identity in ${envTarget}.`,
         "Restart Hermes (start a new session; gateway users: /restart), then verify with `hermes mcp list`, `hermes mcp test haven`, and `hermes mcp test haven-signer`.",
+        "If several long-lived Hermes processes are running (a gateway plus TUI workers), restart EVERY one: each loads its MCP wiring at startup, so a process started before this setup keeps using its old snapshot.",
         "If no mcp_* tools appear after restart, ensure the MCP SDK is installed in Hermes: pip install mcp"
       ]
     };
   } catch (err) {
     const recoveryIncomplete = err instanceof HermesConfigRecoveryError;
+    const unreadable = err instanceof UnreadableRuntimeConfigError;
     return {
       hostedConfigured: false,
       signerConfigured: false,
@@ -358,8 +441,11 @@ async function writeHermesConfig(input, deps) {
       target: "Hermes Agent config",
       changed: false,
       restartRequired: true,
-      messages: [recoveryIncomplete ? "Could not update Hermes Agent config. Recovery did not complete; inspect the Hermes configuration before retrying." : "Could not update Hermes Agent config. Existing configuration was left unchanged."],
-      errorCode: "runtime_config_write_failed"
+      messages: unreadable ? [
+        `Could not update Hermes Agent config: ${err.message}.`,
+        `Nothing was written to ${err.configPath}. Fix the YAML there (or move the file aside), then run \`${REPAIR_COMMAND_PREFIX} hermes\` to write the Haven entries from the credentials already stored on this machine. Do not re-run the setup command: its token is already used.`
+      ] : [recoveryIncomplete ? "Could not update Hermes Agent config. Recovery did not complete; inspect the Hermes configuration before retrying." : "Could not update Hermes Agent config. Existing configuration was left unchanged."],
+      errorCode: unreadable ? "runtime_config_unreadable" : "runtime_config_write_failed"
     };
   }
 }
@@ -391,7 +477,7 @@ async function writeCodexConfig(input) {
       if (!input.localMcpCommand) {
         throw new Error("local MCP wrapper command is required");
       }
-      const merged2 = mergeCodexToml(existing ?? "", input.localMcpCommand);
+      const merged2 = mergeCodexToml(existing ?? "", input.localMcpCommand, serverNamesFor(input.serverName));
       await writeOwnerOnlyText(target, merged2);
       return {
         hostedConfigured: false,
@@ -406,7 +492,13 @@ async function writeCodexConfig(input) {
         ]
       };
     }
-    const merged = mergeCodexTomlHosted(existing ?? "", input.hostedMcpUrl, input.apiKey, resolveSignerLaunchSpec(input));
+    const merged = mergeCodexTomlHosted(
+      existing ?? "",
+      input.hostedMcpUrl,
+      input.apiKey,
+      resolveSignerLaunchSpec(input),
+      serverNamesFor(input.serverName)
+    );
     await writeOwnerOnlyText(target, merged);
     return {
       hostedConfigured: true,
@@ -448,10 +540,15 @@ async function writeOwnerOnlyText(path, value) {
   await writeFile(path, value, { mode: 384 });
   await chmod(path, 384).catch(() => void 0);
 }
-function parseJsonObject(value) {
-  const parsed = JSON.parse(value);
+function parseJsonObject(value, configPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new UnreadableRuntimeConfigError(configPath ?? "the runtime config", "it is not valid JSON");
+  }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("runtime config must be a JSON object");
+    throw new UnreadableRuntimeConfigError(configPath ?? "the runtime config", "the top level is not a JSON object");
   }
   return parsed;
 }
@@ -718,10 +815,11 @@ function configTargetLabel(runtime) {
       return "runtime MCP config";
   }
 }
-var HERMES_API_KEY_ENV, HermesConfigRecoveryError, InvalidCodexTomlError;
+var HERMES_API_KEY_ENV, HermesConfigRecoveryError, InvalidCodexTomlError, REPAIR_COMMAND_PREFIX, UnreadableRuntimeConfigError;
 var init_config_writers = __esm({
   "src/config-writers.ts"() {
     init_runtime_manifest();
+    init_server_names();
     HERMES_API_KEY_ENV = "MCP_HAVEN_API_KEY";
     HermesConfigRecoveryError = class extends Error {
       constructor() {
@@ -735,8 +833,37 @@ var init_config_writers = __esm({
         this.name = "InvalidCodexTomlError";
       }
     };
+    REPAIR_COMMAND_PREFIX = "npx @haven_ai/connect@alpha --doctor --repair --runtime";
+    UnreadableRuntimeConfigError = class extends Error {
+      configPath;
+      constructor(configPath, detail) {
+        super(`${configPath} is not a config Haven can merge into (${detail})`);
+        this.name = "UnreadableRuntimeConfigError";
+        this.configPath = configPath;
+      }
+    };
   }
 });
+async function probeHostedAgentIdentity(apiKey, apiUrl, fetchImpl = fetch) {
+  let response;
+  try {
+    response = await fetchWithTimeout(fetchImpl, `${apiUrl.replace(/\/+$/, "")}/machine-payments/agent`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" }
+    });
+  } catch {
+    return { status: "network_error" };
+  }
+  if (response.status === 401 || response.status === 403) return { status: "unauthorized" };
+  if (!response.ok) return { status: "bad_response" };
+  try {
+    const payload = JSON.parse(await response.text());
+    if (typeof payload?.delegate_address !== "string") return { status: "bad_response" };
+    return { status: "ok", agentId: payload.id, delegateAddress: payload.delegate_address };
+  } catch {
+    return { status: "bad_response" };
+  }
+}
 async function probeHostedMcpTools(apiKey, hostedMcpUrl, fetchImpl = fetch) {
   let response;
   try {
@@ -774,7 +901,7 @@ async function probeLocalSignerCredential(signerPath) {
   }
 }
 async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn(command, args, { stdio: ["pipe", "pipe", "ignore"] });
     let stdout = "";
     let settled = false;
@@ -786,7 +913,7 @@ async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4)
       settled = true;
       clearTimeout(timeout);
       child.kill();
-      resolve8(result);
+      resolve9(result);
     };
     const timeout = setTimeout(() => finish({ status: "timeout" }), timeoutMs);
     child.on("error", () => finish({ status: "process_error" }));
@@ -900,7 +1027,8 @@ async function prepareSignerRuntime(input, deps = {}) {
     wrapperPath,
     runtimeDirectory,
     npmCacheDirectory,
-    cliPath
+    cliPath,
+    serverName: input.serverName
   });
   messages.push(`Prepared stable local Haven signer wrapper: ${wrapperPath}`);
   return {
@@ -1001,6 +1129,7 @@ async function readRuntimeSidecar(credentialDirectory) {
 }
 async function writeRuntimeSidecar(input) {
   const value = {
+    ...input.serverName ? { server_name: input.serverName } : {},
     signer_package: MCP_RUNTIME_MANIFEST.signerPackage,
     signer_version: MCP_RUNTIME_MANIFEST.signerVersion,
     sdk_package: MCP_RUNTIME_MANIFEST.sdkPackage,
@@ -1031,6 +1160,26 @@ var init_signer_runtime = __esm({
   }
 });
 
+// src/connect-error.ts
+function isConnectError(err) {
+  return err instanceof ConnectError;
+}
+var ConnectError;
+var init_connect_error = __esm({
+  "src/connect-error.ts"() {
+    ConnectError = class extends Error {
+      code;
+      nextAction;
+      constructor(code, message, nextAction2) {
+        super(message);
+        this.name = "ConnectError";
+        this.code = code;
+        this.nextAction = nextAction2;
+      }
+    };
+  }
+});
+
 // src/runtime-registry.ts
 function runtimeProfile(runtime, env = process.env) {
   return RUNTIME_PROFILES[normalizeRuntime(runtime, env)];
@@ -1040,6 +1189,42 @@ function normalizeRuntime(runtime, env = process.env) {
   if (explicit) return explicit;
   return detectRuntime(env) ?? "other";
 }
+async function resolveRuntimeSelection(explicit, force, options = {}) {
+  const env = options.env ?? process.env;
+  if (force !== void 0) {
+    const forced = normalizeRuntimeName(force);
+    if (!forced) {
+      throw new ConnectError(
+        "runtime_force_unrecognized",
+        `Unknown --runtime-force value "${force}". Valid values: ${RUNTIME_FLAG_VALUES}.`,
+        "rerun_connect_with_a_valid_runtime_name"
+      );
+    }
+    return { runtime: forced, source: "force" };
+  }
+  const detected = detectRuntime(env);
+  const supplied = explicit?.trim() || options.selfReported?.trim() || void 0;
+  const hint = normalizeRuntimeName(supplied);
+  if (supplied && !hint) {
+    if (!detected) {
+      throw new ConnectError(
+        "runtime_unrecognized",
+        `"${supplied}" is not an agent runtime Haven knows. Valid values: ${RUNTIME_FLAG_VALUES} (the aliases cowork, codex and openclaw are accepted too). Re-run with one of those, or --runtime other to store credentials and finish the MCP setup by hand. Nothing was written and the Haven setup token is still unused.`,
+        "rerun_connect_with_a_valid_runtime_name"
+      );
+    }
+    return { runtime: detected, source: "detected", discardedHint: supplied };
+  }
+  if (detected && hint && detected !== hint) {
+    return { runtime: detected, source: "detected", overrodeHint: hint };
+  }
+  if (hint) return { runtime: hint, source: "explicit" };
+  if (detected) return { runtime: detected, source: "detected" };
+  if (options.promptForRuntime) {
+    return { runtime: await options.promptForRuntime(), source: "prompted" };
+  }
+  return { runtime: null, source: "none" };
+}
 function restartRequiredForRuntime(runtime, env = process.env) {
   const mode = runtimeProfile(runtime, env).restartMode;
   return mode === "restart-session" || mode === "restart-app";
@@ -1060,9 +1245,10 @@ function detectRuntime(env) {
   if (env.HERMES_HOME || env.HERMES_AGENT) return "hermes";
   return null;
 }
-var RUNTIME_PROFILES, RUNTIME_ALIASES;
+var RUNTIME_PROFILES, RUNTIME_ALIASES, RUNTIME_FLAG_VALUES;
 var init_runtime_registry = __esm({
   "src/runtime-registry.ts"() {
+    init_connect_error();
     RUNTIME_PROFILES = {
       "claude-code": {
         id: "claude-code",
@@ -1133,6 +1319,11 @@ var init_runtime_registry = __esm({
       "claude-code": "claude-code",
       claudecode: "claude-code",
       "claude_code": "claude-code",
+      // #1682: Cowork runs Claude Code's config, so it resolves to the same
+      // profile. The dashboard's command carries no --runtime for it (it is a
+      // detected, command-path runtime), but an explicit `--runtime cowork` typed
+      // by hand must not fall through to the no-runtime refusal.
+      cowork: "claude-code",
       codex: "codex-cli",
       "codex-cli": "codex-cli",
       codexcli: "codex-cli",
@@ -1162,9 +1353,18 @@ var init_runtime_registry = __esm({
       "hermes-agent": "hermes",
       hermes_agent: "hermes",
       hermesagent: "hermes",
+      // #1682: OpenClaw is a SNIPPET target — the user pastes an mcpServers entry
+      // into ~/.openclaw/openclaw.json and restarts the gateway. That is exactly
+      // the 'other' profile's behaviour (credentials written to disk, no config
+      // auto-written, manual finish), so it resolves there rather than earning a
+      // profile whose only distinguishing feature would be its label.
+      openclaw: "other",
+      "open-claw": "other",
+      "open_claw": "other",
       other: "other",
       manual: "other"
     };
+    RUNTIME_FLAG_VALUES = "claude-code, codex-cli, codex-desktop, cursor, vscode, vscode-insiders, claude-desktop, hermes, other";
   }
 });
 async function acknowledgeLocalSignerConsent(signerPath, log) {
@@ -1241,6 +1441,82 @@ var init_signer_consent = __esm({
   }
 });
 
+// src/tombstone.ts
+var tombstone_exports = {};
+__export(tombstone_exports, {
+  TOMBSTONE_FILENAME: () => TOMBSTONE_FILENAME,
+  TOMBSTONE_MARKER: () => TOMBSTONE_MARKER,
+  readAgentTombstone: () => readAgentTombstone,
+  writeAgentTombstone: () => writeAgentTombstone
+});
+function tombstoneScript(info) {
+  const lines = [
+    `${TOMBSTONE_MARKER}: this Haven agent was retired.`,
+    "",
+    `  agent:      ${info.agent_id}`,
+    `  retired at: ${info.retired_at}`,
+    `  reason:     ${info.reason}`,
+    ...info.replaced_by ? [`  replaced by: ${info.replaced_by}`] : [],
+    "",
+    "This process is running with a wiring snapshot that predates the",
+    "retirement \u2014 it loaded its MCP config at startup and has kept it since.",
+    "Restart THIS host to pick up the current wiring. If several long-lived",
+    "hosts are running (a gateway, a TUI worker, an editor), restart EVERY",
+    "one of them: each holds the snapshot from its own start time, so after",
+    "a chain of recreations each can be parked on a DIFFERENT old agent.",
+    "",
+    "Then verify with: npx @haven_ai/connect@alpha --doctor --runtime <runtime>"
+  ];
+  return [
+    "#!/usr/bin/env node",
+    `// ${TOMBSTONE_MARKER} \u2014 written by @haven_ai/connect (#1681). Safe to delete`,
+    "// once every long-lived MCP host on this machine has been restarted.",
+    `process.stderr.write(${JSON.stringify(lines.join("\n") + "\n")})`,
+    "process.exit(1)",
+    ""
+  ].join("\n");
+}
+async function writeAgentTombstone(input) {
+  const dirStat = await stat(input.directory).catch(() => null);
+  if (!dirStat?.isDirectory()) {
+    throw new Error(`Not a directory: ${input.directory} \u2014 nothing to tombstone.`);
+  }
+  const info = {
+    // reason / replaced_by are persisted to disk and re-emitted to the host's
+    // MCP stderr log on EVERY stale probe, potentially for months — redact
+    // like every other output path, at the write layer so any future caller
+    // inherits it. (#1681 review, finding 1)
+    agent_id: input.agentId,
+    retired_at: input.retiredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    reason: redactSecrets(input.reason),
+    ...input.replacedBy ? { replaced_by: redactSecrets(input.replacedBy) } : {}
+  };
+  const binDir = join(input.directory, "bin");
+  await mkdir(binDir, { recursive: true });
+  const wrapperPath = join(binDir, "haven-signer.mjs");
+  await writeFile(wrapperPath, tombstoneScript(info), "utf8");
+  await chmod(wrapperPath, 493);
+  await writeFile(join(input.directory, TOMBSTONE_FILENAME), JSON.stringify(info, null, 2) + "\n", "utf8");
+  return info;
+}
+async function readAgentTombstone(directory) {
+  try {
+    const parsed = JSON.parse(await readFile(join(directory, TOMBSTONE_FILENAME), "utf8"));
+    if (typeof parsed?.agent_id !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+var TOMBSTONE_FILENAME, TOMBSTONE_MARKER;
+var init_tombstone = __esm({
+  "src/tombstone.ts"() {
+    init_redact();
+    TOMBSTONE_FILENAME = "TOMBSTONE.json";
+    TOMBSTONE_MARKER = "HAVEN-TOMBSTONE";
+  }
+});
+
 // src/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
@@ -1248,129 +1524,101 @@ __export(doctor_exports, {
   runRepair: () => runRepair
 });
 async function discoverCredentialDirectory(homeDir, explicit) {
-  if (explicit) return { directory: explicit };
-  const root = join(homeDir, ".haven", "agents");
+  const root = explicit ? dirname(explicit) : join(homeDir, ".haven", "agents");
   let entries = [];
   try {
     entries = await readdir(root);
   } catch {
-    return {};
+    return explicit ? { directory: explicit, others: [] } : { others: [] };
   }
   const candidates = [];
+  const tombstonedOnly = [];
   for (const entry of entries) {
     const directory = join(root, entry);
     try {
       const s = await stat(join(directory, "identity.json"));
       candidates.push({ directory, mtimeMs: s.mtimeMs });
     } catch {
+      try {
+        await stat(join(directory, TOMBSTONE_FILENAME));
+        tombstonedOnly.push(directory);
+      } catch {
+      }
     }
   }
-  if (candidates.length === 0) return {};
   candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  if (explicit) {
+    return {
+      directory: explicit,
+      others: [...candidates.map((c) => c.directory), ...tombstonedOnly].filter((d) => d !== explicit)
+    };
+  }
+  if (candidates.length === 0 && tombstonedOnly.length === 0) return { others: [] };
   return {
-    directory: candidates[0].directory,
-    note: candidates.length > 1 ? `${candidates.length} agent credential dirs found; examining the newest.` : void 0
+    directory: candidates[0]?.directory,
+    others: [...candidates.slice(1).map((c) => c.directory), ...tombstonedOnly]
   };
 }
-async function runDoctor(input, deps = {}) {
-  const homeDir = deps.homeDir ?? homedir();
+function agentIsWired(configText, names, slug, identity, sidecar, isPrimary, bareOwnerExists) {
+  if (configText === null) return isPrimary;
+  if (slug) {
+    for (const name of [names.hosted, names.codexHosted, names.signer, names.codexSigner]) {
+      if (new RegExp(`(^|[."'\\s\\[])${name}(["'\\]:\\s]|$)`, "m").test(configText)) return true;
+    }
+    return false;
+  }
+  if (sidecar?.wrapper_path && configText.includes(sidecar.wrapper_path)) return true;
+  if (bareOwnerExists) return false;
+  return isPrimary && Boolean(identity?.hosted_mcp_url && configText.includes(identity.hosted_mcp_url));
+}
+async function readIdentity(directory) {
+  try {
+    return JSON.parse(await readFile(join(directory, "identity.json"), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function checksForAgent(entry, input, deps) {
+  const { directory, identity, sidecar } = entry;
   const checks = [];
   let signerCapabilities;
-  const { directory, note } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
-  let identity;
-  let signerParses = false;
-  if (!directory) {
+  let signerFile;
+  try {
+    const parsed = JSON.parse(await readFile(join(directory, "signer.json"), "utf8"));
+    signerFile = typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    signerFile = void 0;
+  }
+  const credentialsOk = Boolean(identity?.api_key) && signerFile !== void 0;
+  checks.push({
+    id: "credentials",
+    label: "Agent credentials",
+    ok: credentialsOk,
+    detail: credentialsOk ? `identity.json and signer.json parse (agent ${identity?.agent_id ?? "unknown"})` : "identity.json or signer.json is missing or unparseable.",
+    ...credentialsOk ? {} : { repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` }
+  });
+  if (!sidecar) {
     checks.push({
-      id: "credentials",
-      label: "Agent credentials",
+      id: "signer_runtime",
+      label: "Signer runtime (preinstalled wrapper)",
       ok: false,
-      detail: "No agent credential directory with an identity.json under ~/.haven/agents.",
-      repair: `Run the full setup once: ${RERUN} --setup <token from the Haven dashboard>.`
+      detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
+      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
     });
   } else {
-    try {
-      identity = JSON.parse(await readFile(join(directory, "identity.json"), "utf8"));
-    } catch {
-      identity = void 0;
-    }
-    try {
-      const signer = JSON.parse(await readFile(join(directory, "signer.json"), "utf8"));
-      signerParses = typeof signer === "object" && signer !== null;
-    } catch {
-      signerParses = false;
-    }
-    const ok = Boolean(identity?.api_key) && signerParses;
+    const matches = await installedRuntimeMatches(sidecar.runtime_directory, sidecar.cli_path);
+    const versionOk = sidecar.signer_version === MCP_RUNTIME_MANIFEST.signerVersion;
+    const ok = matches && versionOk;
     checks.push({
-      id: "credentials",
-      label: "Agent credentials",
+      id: "signer_runtime",
+      label: "Signer runtime (preinstalled wrapper)",
       ok,
-      detail: ok ? `identity.json and signer.json parse (agent ${identity?.agent_id ?? "unknown"})${note ? ` \u2014 ${note}` : ""}` : "identity.json or signer.json is missing or unparseable.",
-      ...ok ? {} : { repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` }
+      detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : matches ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion}.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
     });
   }
-  let sidecar = null;
-  if (directory) {
-    sidecar = await readRuntimeSidecar(directory);
-    if (!sidecar) {
-      checks.push({
-        id: "signer_runtime",
-        label: "Signer runtime (preinstalled wrapper)",
-        ok: false,
-        detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-        repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
-      });
-    } else {
-      const matches = await installedRuntimeMatches(sidecar.runtime_directory, sidecar.cli_path);
-      const versionOk = sidecar.signer_version === MCP_RUNTIME_MANIFEST.signerVersion;
-      const ok = matches && versionOk;
-      checks.push({
-        id: "signer_runtime",
-        label: "Signer runtime (preinstalled wrapper)",
-        ok,
-        detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : matches ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion}.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-        ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
-      });
-    }
-  }
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
-  if (configPath === null) {
-    checks.push({
-      id: "runtime_config",
-      label: "Runtime MCP config",
-      ok: true,
-      detail: `Runtime '${input.runtime}' has no file-based config the connector owns (CLI-managed) \u2014 skipping the file check.`
-    });
-  } else {
-    let configText = null;
-    try {
-      configText = await readFile(configPath, "utf8");
-    } catch {
-      configText = null;
-    }
-    if (configText === null) {
-      checks.push({
-        id: "runtime_config",
-        label: "Runtime MCP config",
-        ok: false,
-        detail: `No runtime config at ${configPath}.`,
-        repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
-      });
-    } else {
-      const hasHaven = identity?.hosted_mcp_url ? configText.includes(identity.hosted_mcp_url) : configText.includes("haven");
-      const signerViaNpx = configText.includes("@haven_ai/signer");
-      const wrapperReferenced = sidecar ? configText.includes(sidecar.wrapper_path) : false;
-      const ok = hasHaven && !signerViaNpx && (sidecar ? wrapperReferenced : true);
-      checks.push({
-        id: "runtime_config",
-        label: "Runtime MCP config",
-        ok,
-        detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${sidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-        ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
-      });
-    }
-  }
-  if (identity?.api_key && (identity.hosted_mcp_url || identity.api_url)) {
-    const hostedUrl = identity.hosted_mcp_url ?? `${identity.api_url}/mcp`;
+  const hostedUrl = identity?.hosted_mcp_url ?? (identity?.api_url ? `${identity.api_url}/mcp` : void 0);
+  if (identity?.api_key && hostedUrl) {
     const probe = await (deps.probeHosted ?? probeHostedMcpTools)(identity.api_key, hostedUrl, deps.fetch);
     checks.push({
       id: "hosted_mcp",
@@ -1390,7 +1638,43 @@ async function runDoctor(input, deps = {}) {
       repair: `Re-run the full setup: ${RERUN} --setup <token>.`
     });
   }
-  if (sidecar && directory) {
+  const localDelegate = typeof signerFile?.delegate_address === "string" ? signerFile.delegate_address : void 0;
+  if (identity?.api_key && identity.api_url) {
+    const probe = await (deps.probeHostedIdentity ?? probeHostedAgentIdentity)(
+      identity.api_key,
+      identity.api_url,
+      deps.fetch
+    );
+    if (probe.status !== "ok") {
+      checks.push({
+        id: "identity_match",
+        label: "Hosted identity matches the local signing key",
+        ok: false,
+        detail: probe.status === "unauthorized" ? "The stored API key was rejected, so the agent it authenticates as cannot be compared with the local signing key." : `Could not read the hosted identity (${probe.status}) \u2014 the comparison did not happen, so it cannot be reported as a match.`,
+        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor --runtime ${input.runtime}`
+      });
+    } else if (!localDelegate) {
+      checks.push({
+        id: "identity_match",
+        label: "Hosted identity matches the local signing key",
+        ok: false,
+        detail: "signer.json holds no delegate_address to compare against the hosted identity.",
+        repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.`
+      });
+    } else {
+      const same = probe.delegateAddress?.toLowerCase() === localDelegate.toLowerCase();
+      checks.push({
+        id: "identity_match",
+        label: "Hosted identity matches the local signing key",
+        ok: same,
+        detail: same ? `The stored API key authenticates as the agent whose signing key is in this directory (${shortAddress(localDelegate)}).` : `MISMATCH: the stored API key authenticates as agent ${probe.agentId ?? "unknown"} with delegate ${shortAddress(probe.delegateAddress ?? "unknown")}, but signer.json here holds ${shortAddress(localDelegate)}. This runtime would quote as one agent and sign as another.`,
+        ...same ? {} : {
+          repair: `Re-run setup for this agent so its API key and signing key come from one run: ${RERUN} --setup <token>. Do not hand-edit either file.`
+        }
+      });
+    }
+  }
+  if (sidecar) {
     const consent = await getLocalSignerConsentStatus(join(directory, "signer.json"));
     if (!consent.acknowledged) {
       checks.push({
@@ -1418,7 +1702,7 @@ async function runDoctor(input, deps = {}) {
         ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
       });
     }
-  } else if (directory) {
+  } else {
     checks.push({
       id: "signer_process",
       label: "Signer stdio handshake",
@@ -1427,6 +1711,171 @@ async function runDoctor(input, deps = {}) {
       repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
     });
   }
+  return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
+}
+async function runDoctor(input, deps = {}) {
+  const homeDir = deps.homeDir ?? homedir();
+  const checks = [];
+  let signerCapabilities;
+  const { directory, others } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  let configText = null;
+  if (configPath !== null) {
+    try {
+      configText = await readFile(configPath, "utf8");
+    } catch {
+      configText = null;
+    }
+  }
+  const allDirectories = directory ? [directory, ...others] : others;
+  let bareOwnerExists = false;
+  for (const dir of allDirectories) {
+    const sidecar = await readRuntimeSidecar(dir);
+    if (!sidecar?.server_name && sidecar?.wrapper_path && configText?.includes(sidecar.wrapper_path)) {
+      bareOwnerExists = true;
+      break;
+    }
+  }
+  const inventory = [];
+  const capabilitiesByDirectory = /* @__PURE__ */ new Map();
+  const primaryChecksById = /* @__PURE__ */ new Map();
+  for (const dir of allDirectories) {
+    const identity = await readIdentity(dir);
+    const sidecar = await readRuntimeSidecar(dir);
+    const tombstone = await readAgentTombstone(dir);
+    const slug = sidecar?.server_name;
+    const names = serverNamesFor(slug);
+    if (!identity?.api_key) {
+      inventory.push({
+        ...slug ? { slug } : {},
+        ...tombstone?.agent_id ? { agentId: tombstone.agent_id } : {},
+        directory: dir,
+        classification: tombstone ? "retired" : "orphaned",
+        checks: []
+      });
+      continue;
+    }
+    const wired = agentIsWired(configText, names, slug, identity, sidecar, dir === directory, bareOwnerExists);
+    const entry = {
+      ...slug ? { slug } : {},
+      ...identity.agent_id ? { agentId: identity.agent_id } : {},
+      directory: dir,
+      classification: wired ? "wired" : "superseded",
+      checks: []
+    };
+    if (wired) {
+      const result = await checksForAgent({ directory: dir, identity, sidecar }, input, deps);
+      entry.checks = result.checks;
+      capabilitiesByDirectory.set(dir, result.signerCapabilities);
+    }
+    inventory.push(entry);
+  }
+  const wiredDirectories = inventory.filter((entry) => entry.classification === "wired").map((entry) => entry.directory);
+  const primaryDirectory = input.credentialsDir ? directory : wiredDirectories.includes(directory ?? "") ? directory : wiredDirectories[0] ?? directory;
+  if (primaryDirectory) {
+    const primaryEntry = inventory.find((entry) => entry.directory === primaryDirectory);
+    signerCapabilities = capabilitiesByDirectory.get(primaryDirectory);
+    for (const check of primaryEntry?.checks ?? []) primaryChecksById.set(check.id, check);
+  }
+  if (!primaryDirectory) {
+    checks.push({
+      id: "credentials",
+      label: "Agent credentials",
+      ok: false,
+      detail: "No agent credential directory with an identity.json under ~/.haven/agents.",
+      repair: `Run the full setup once: ${RERUN} --setup <token from the Haven dashboard>.`
+    });
+  } else {
+    const primaryIdentity = await readIdentity(primaryDirectory);
+    const primarySidecar = await readRuntimeSidecar(primaryDirectory);
+    if (primaryChecksById.size === 0) {
+      const result = await checksForAgent(
+        { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
+        input,
+        deps
+      );
+      signerCapabilities = result.signerCapabilities;
+      for (const check of result.checks) primaryChecksById.set(check.id, check);
+    }
+    for (const id of ["credentials", "signer_runtime"]) {
+      const check = primaryChecksById.get(id);
+      if (check) checks.push(check);
+    }
+  }
+  if (configPath === null) {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      ok: true,
+      detail: `Runtime '${input.runtime}' has no file-based config the connector owns (CLI-managed) \u2014 skipping the file check.`
+    });
+  } else if (configText === null) {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      ok: false,
+      detail: `No runtime config at ${configPath}.`,
+      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+    });
+  } else {
+    const primaryIdentity = await readIdentity(primaryDirectory ?? "");
+    const primarySidecar = primaryDirectory ? await readRuntimeSidecar(primaryDirectory) : null;
+    const hasHaven = primaryIdentity?.hosted_mcp_url ? configText.includes(primaryIdentity.hosted_mcp_url) : configText.includes("haven");
+    const signerViaNpx = configText.includes("@haven_ai/signer");
+    const wrapperReferenced = primarySidecar ? configText.includes(primarySidecar.wrapper_path) : false;
+    const ok = hasHaven && !signerViaNpx && (primarySidecar ? wrapperReferenced : true);
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      ok,
+      detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+    });
+  }
+  for (const id of ["hosted_mcp", "identity_match"]) {
+    const check = primaryChecksById.get(id);
+    if (check) checks.push(check);
+  }
+  const otherEntries = inventory.filter((entry) => entry.directory !== primaryDirectory);
+  if (otherEntries.length > 0) {
+    const live = [];
+    const revoked = [];
+    const unverifiable = [];
+    const retired = [];
+    for (const entry of otherEntries) {
+      const identity = await readIdentity(entry.directory);
+      const tombstone = await readAgentTombstone(entry.directory);
+      const otherAgent = identity?.agent_id ?? tombstone?.agent_id ?? basename(entry.directory);
+      const otherUrl = identity?.hosted_mcp_url ?? (identity?.api_url ? `${identity.api_url}/mcp` : void 0);
+      if (!identity?.api_key || !otherUrl) {
+        if (tombstone) retired.push(`${otherAgent} (retired ${tombstone.retired_at})`);
+        else unverifiable.push(`${otherAgent} (no stored key/URL to probe)`);
+        continue;
+      }
+      const suffix = tombstone ? " [tombstoned \u2014 key material still present]" : "";
+      const probe = await (deps.probeHosted ?? probeHostedMcpTools)(identity.api_key, otherUrl, deps.fetch);
+      if (probe.status === "ok") live.push({ label: `${otherAgent}${suffix}`, entry });
+      else if (probe.status === "unauthorized") revoked.push(`${otherAgent}${suffix}`);
+      else unverifiable.push(`${otherAgent} (${probe.status})${suffix}`);
+    }
+    const parts = [];
+    if (live.length > 0) parts.push(`STILL SPEND-CAPABLE: ${live.map((item) => item.label).join(", ")}`);
+    if (revoked.length > 0) parts.push(`already revoked: ${revoked.join(", ")}`);
+    if (retired.length > 0) parts.push(`tombstoned (keys removed): ${retired.join(", ")}`);
+    if (unverifiable.length > 0) parts.push(`could not verify: ${unverifiable.join(", ")}`);
+    const supersededLive = live.filter((item) => item.entry.classification !== "wired").map((item) => item.label);
+    checks.push({
+      id: "superseded_agents",
+      label: "Superseded agent credentials",
+      ok: supersededLive.length === 0,
+      detail: supersededLive.length > 0 ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
+      ...supersededLive.length > 0 ? {
+        repair: `Revoke ${supersededLive.join(", ")} on the Haven agent page, then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+      } : {}
+    });
+  }
+  const signerProcess = primaryChecksById.get("signer_process");
+  if (signerProcess) checks.push(signerProcess);
   const restart = restartRequiredForRuntime(input.runtime, deps.env);
   checks.push({
     id: "restart",
@@ -1434,20 +1883,24 @@ async function runDoctor(input, deps = {}) {
     ok: true,
     detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : "No restart requirement known for this runtime."
   });
+  const wiredOk = inventory.filter((entry) => entry.classification === "wired").every((entry) => entry.checks.every((check) => check.ok));
   return {
     version: 1,
-    ok: checks.every((check) => check.ok),
+    ok: checks.every((check) => check.ok) && wiredOk,
     runtime: input.runtime,
-    credentialDirectory: directory,
+    credentialDirectory: primaryDirectory,
     checks,
+    agents: inventory,
     ...signerCapabilities ? { signerCapabilities } : {}
   };
 }
 async function runRepair(input, deps = {}) {
   const homeDir = deps.homeDir ?? homedir();
   const messages = [];
-  const { directory, note } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
-  if (note) messages.push(`Note: ${note}`);
+  const { directory, others } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  if (others.length > 0) {
+    messages.push(`Note: ${others.length} other agent credential dir(s) exist \u2014 run --doctor for their status.`);
+  }
   if (!directory) {
     return {
       ok: false,
@@ -1509,6 +1962,9 @@ var init_doctor = __esm({
     init_config_writers();
     init_runtime_registry();
     init_signer_consent();
+    init_tombstone();
+    init_server_names();
+    init_redact();
     RERUN = "npx @haven_ai/connect@alpha";
   }
 });
@@ -1618,16 +2074,9 @@ function agentApiKeyPrefix(apiKey) {
   return apiKey.slice(0, 12);
 }
 
-// src/redact.ts
-var API_KEY_RE = /sk_agent_[A-Za-z0-9]+/g;
-var PRIVATE_KEY_RE = /0x[0-9a-fA-F]{64}/g;
-function redactSecrets(value) {
-  return value.replace(API_KEY_RE, "sk_agent_[redacted]").replace(PRIVATE_KEY_RE, "0x[redacted-private-key]");
-}
-function shortAddress(address) {
-  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) return address;
-  return `${address.slice(0, 6)}...${address.slice(-4)}`;
-}
+// src/runtime.ts
+init_redact();
+init_server_names();
 async function preflightCredentialStorage(input = {}) {
   const directory = defaultCredentialRoot(input.baseDir);
   await mkdir(directory, { recursive: true, mode: 448 });
@@ -1641,7 +2090,7 @@ async function preflightCredentialStorage(input = {}) {
   return directory;
 }
 async function writeCredentialFiles(input) {
-  const directory = defaultAgentDirectory(input.agentId, input.baseDir);
+  const directory = defaultAgentDirectory(input.serverName ?? input.agentId, input.baseDir);
   await mkdir(directory, { recursive: true, mode: 448 });
   await restrictPermissions(directory, 448, input.warn);
   const identityPath = join(directory, "identity.json");
@@ -1706,6 +2155,17 @@ async function writeCredentialFiles(input) {
   }
   return { directory, identityPath, signerPath, agentPath };
 }
+async function assertServerSlugAvailable(serverName, baseDir) {
+  const directory = defaultAgentDirectory(serverName, baseDir);
+  try {
+    await stat(join(directory, "identity.json"));
+  } catch {
+    return;
+  }
+  throw new Error(
+    `The name "${serverName}" is already wired on this machine (${directory} holds credentials). Pick a different --name, or revoke and remove that agent first \u2014 connect never overwrites credentials.`
+  );
+}
 function defaultAgentDirectory(agentId, baseDir = join(homedir(), ".haven", "agents")) {
   return resolve(defaultCredentialRoot(baseDir), safePathPart(agentId));
 }
@@ -1745,6 +2205,7 @@ async function restrictPermissions(path, mode, warn) {
 
 // src/runtime-install.ts
 init_config_writers();
+init_server_names();
 async function acknowledgeLocalMcpConsent(identityPath, signerPath, log) {
   try {
     const input = await buildLocalMcpConsentInput(identityPath, signerPath);
@@ -1870,7 +2331,8 @@ async function prepareLocalMcpRuntime(input, deps = {}) {
     wrapperPath,
     runtimeDirectory,
     npmCacheDirectory,
-    cliPath
+    cliPath,
+    serverName: input.serverName
   });
   messages.push(`Prepared stable local Haven MCP wrapper: ${wrapperPath}`);
   return {
@@ -1966,6 +2428,7 @@ async function writeWrapper2(input) {
 }
 async function writeRuntimeSidecar2(input) {
   const value = {
+    ...input.serverName ? { server_name: input.serverName } : {},
     mcp_package: MCP_RUNTIME_MANIFEST.mcpPackage,
     mcp_version: MCP_RUNTIME_MANIFEST.mcpVersion,
     sdk_package: MCP_RUNTIME_MANIFEST.sdkPackage,
@@ -2199,12 +2662,13 @@ async function installRuntime(input, deps = {}) {
   }
   const signerRuntimePrepared = localRuntime ? void 0 : signerCommand !== void 0;
   progress("Setting up your Haven tools\u2026");
-  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "") : await configureClaudeCodeHosted(deps, input, signerCommand) : await writeRuntimeConfig({
+  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "", input.serverName) : await configureClaudeCodeHosted(deps, input, signerCommand) : await writeRuntimeConfig({
     runtime,
     hostedMcpUrl: input.hostedMcpUrl,
     apiKey: input.apiKey,
     identityPath: input.identityPath,
     signerPath: input.signerPath,
+    serverName: input.serverName,
     credentialDirectory: input.credentialDirectory,
     localMcpCommand: localRuntimeInstall?.command,
     signerCommand,
@@ -2284,7 +2748,7 @@ function runtimeInstallCapabilities(runtime, env = process.env) {
     restartRequired: restartRequiredForRuntime(runtime, env)
   };
 }
-async function configureClaudeCode(deps, localMcpCommand) {
+async function configureClaudeCode(deps, localMcpCommand, serverName) {
   const runCommand = deps.runCommand ?? defaultRunCommand;
   const serverJson = JSON.stringify({
     type: "stdio",
@@ -2294,12 +2758,13 @@ async function configureClaudeCode(deps, localMcpCommand) {
   });
   try {
     if (!localMcpCommand) throw new Error("local MCP wrapper command is required");
-    await runCommand("claude", ["mcp", "remove", "haven"]).catch(() => void 0);
-    await runCommand("claude", ["mcp", "remove", "haven-signer"]).catch(() => void 0);
-    await runCommand("claude", ["mcp", "add-json", "haven", serverJson, "--scope", "user"]).catch(async () => {
-      await runCommand("claude", ["mcp", "add", "haven", "--scope", "user", "--", localMcpCommand]);
+    const names = serverNamesFor(serverName);
+    await runCommand("claude", ["mcp", "remove", names.hosted]).catch(() => void 0);
+    await runCommand("claude", ["mcp", "remove", names.signer]).catch(() => void 0);
+    await runCommand("claude", ["mcp", "add-json", names.hosted, serverJson, "--scope", "user"]).catch(async () => {
+      await runCommand("claude", ["mcp", "add", names.hosted, "--scope", "user", "--", localMcpCommand]);
     });
-    const verified = await runCommand("claude", ["mcp", "get", "haven"]).then(() => true).catch(() => false);
+    const verified = await runCommand("claude", ["mcp", "get", names.hosted]).then(() => true).catch(() => false);
     return {
       hostedConfigured: false,
       signerConfigured: true,
@@ -2344,11 +2809,12 @@ async function configureClaudeCodeHosted(deps, input, signerCommand) {
     env: {}
   });
   try {
-    await runCommand("claude", ["mcp", "remove", "haven"]).catch(() => void 0);
-    await runCommand("claude", ["mcp", "remove", "haven-signer"]).catch(() => void 0);
-    await runCommand("claude", ["mcp", "add-json", "haven", hostedJson, "--scope", "user"]);
-    await runCommand("claude", ["mcp", "add-json", "haven-signer", signerJson, "--scope", "user"]);
-    const verified = await runCommand("claude", ["mcp", "get", "haven"]).then(() => true).catch(() => false);
+    const names = serverNamesFor(input.serverName);
+    await runCommand("claude", ["mcp", "remove", names.hosted]).catch(() => void 0);
+    await runCommand("claude", ["mcp", "remove", names.signer]).catch(() => void 0);
+    await runCommand("claude", ["mcp", "add-json", names.hosted, hostedJson, "--scope", "user"]);
+    await runCommand("claude", ["mcp", "add-json", names.signer, signerJson, "--scope", "user"]);
+    const verified = await runCommand("claude", ["mcp", "get", names.hosted]).then(() => true).catch(() => false);
     return {
       hostedConfigured: true,
       signerConfigured: true,
@@ -2452,7 +2918,8 @@ async function prepareRuntimeForLocalMcp(input, deps) {
     credentialDirectory: input.credentialDirectory,
     identityPath: input.identityPath,
     signerPath: input.signerPath,
-    homeDir: deps.homeDir
+    homeDir: deps.homeDir,
+    serverName: input.serverName
   });
 }
 async function prepareSignerForRuntime(input, deps) {
@@ -2466,7 +2933,8 @@ async function prepareSignerForRuntime(input, deps) {
   return prepare({
     credentialDirectory: input.credentialDirectory,
     signerPath: input.signerPath,
-    homeDir: deps.homeDir
+    homeDir: deps.homeDir,
+    serverName: input.serverName
   });
 }
 async function runLocalMcpProbe(runtimeInstall, deps) {
@@ -2486,8 +2954,179 @@ function localRuntimePrepareErrorCode(err) {
 
 // src/runtime.ts
 init_runtime_registry();
+init_connect_error();
+
+// src/installed-clients.ts
+init_connect_error();
+init_config_writers();
+init_runtime_registry();
+var SCAN_ORDER = [
+  "claude-code",
+  "codex-cli",
+  "cursor",
+  "vscode",
+  "vscode-insiders",
+  "claude-desktop",
+  "hermes"
+];
+function installedClientTargets(homeDir = homedir(), cwd = process.cwd(), env = process.env) {
+  const targets = [
+    {
+      runtime: "claude-code",
+      label: "Claude Code",
+      // Claude Code is configured through its own CLI (`claude mcp add-json`),
+      // not by writing a file this module owns — so its evidence is the
+      // client directory, never a config path.
+      configPath: null,
+      markers: [join(homeDir, ".claude"), join(homeDir, ".claude.json")]
+    },
+    {
+      runtime: "codex-cli",
+      // Both Codex surfaces write the same ~/.codex/config.toml, so they are
+      // ONE candidate. Splitting them would ask the user to answer a question
+      // whose answers are the same write.
+      label: "Codex (CLI or Desktop)",
+      configPath: runtimeConfigPathFor("codex-cli", homeDir),
+      markers: [join(homeDir, ".codex")]
+    },
+    {
+      runtime: "cursor",
+      label: "Cursor",
+      configPath: runtimeConfigPathFor("cursor", homeDir),
+      markers: [join(homeDir, ".cursor")]
+    },
+    {
+      runtime: "vscode",
+      label: "VS Code",
+      configPath: runtimeConfigPathFor("vscode", homeDir),
+      markers: [resolve(cwd, ".vscode")]
+    },
+    {
+      runtime: "vscode-insiders",
+      label: "VS Code Insiders",
+      configPath: runtimeConfigPathFor("vscode-insiders", homeDir),
+      markers: []
+    },
+    {
+      runtime: "claude-desktop",
+      label: "Claude Desktop",
+      configPath: runtimeConfigPathFor("claude-desktop", homeDir),
+      markers: []
+    },
+    {
+      runtime: "hermes",
+      label: "Hermes Agent",
+      configPath: runtimeConfigPathFor("hermes", homeDir),
+      markers: [env.HERMES_HOME ?? join(homeDir, ".hermes")]
+    }
+  ];
+  return targets.filter((target) => runtimeProfile(target.runtime, {}).canWriteRuntimeConfig);
+}
+async function scanInstalledClients(options = {}) {
+  const exists = options.exists ?? pathExists;
+  const targets = installedClientTargets(options.homeDir, options.cwd, options.env ?? process.env);
+  const found = [];
+  for (const target of targets) {
+    if (target.configPath && await exists(target.configPath)) {
+      found.push({
+        runtime: target.runtime,
+        label: target.label,
+        detail: `MCP config found at ${target.configPath}`,
+        configPath: target.configPath,
+        evidence: "config-file"
+      });
+      continue;
+    }
+    for (const marker of target.markers) {
+      if (!await exists(marker)) continue;
+      found.push({
+        runtime: target.runtime,
+        label: target.label,
+        detail: `installed (${marker})`,
+        configPath: target.configPath,
+        evidence: "client-directory"
+      });
+      break;
+    }
+  }
+  return found.sort((a, b) => {
+    if (a.evidence !== b.evidence) return a.evidence === "config-file" ? -1 : 1;
+    return SCAN_ORDER.indexOf(a.runtime) - SCAN_ORDER.indexOf(b.runtime);
+  });
+}
+var MAX_PROMPT_ATTEMPTS = 3;
+async function promptForInstalledClient(candidates, io = defaultPromptIo()) {
+  if (candidates.length === 0) throw noInstalledClientsError();
+  io.write("Haven could not detect which agent runtime this is.\n");
+  io.write("These agent clients are installed on this machine:\n");
+  candidates.forEach((candidate, index) => {
+    io.write(`  ${index + 1}) ${candidate.label} \u2014 ${candidate.detail}
+`);
+  });
+  io.write("Haven writes an API key and a signing key into the client you pick, so pick the one your agent actually runs in.\n");
+  for (let attempt = 0; attempt < MAX_PROMPT_ATTEMPTS; attempt += 1) {
+    const answer = await io.question(`Which one? [1-${candidates.length}] (default 1 \u2014 ${candidates[0].label}): `);
+    if (answer === null) throw promptAbortedError("the prompt was cancelled");
+    const trimmed = answer.trim();
+    if (trimmed === "") return candidates[0].runtime;
+    const picked = Number.parseInt(trimmed, 10);
+    if (Number.isInteger(picked) && picked >= 1 && picked <= candidates.length) {
+      return candidates[picked - 1].runtime;
+    }
+    io.write(`"${trimmed}" is not one of 1-${candidates.length}.
+`);
+  }
+  throw promptAbortedError(`no valid choice after ${MAX_PROMPT_ATTEMPTS} attempts`);
+}
+async function resolveRuntimeByInstalledClientPrompt(options = {}) {
+  const candidates = await scanInstalledClients(options);
+  if (candidates.length === 0) throw noInstalledClientsError();
+  return promptForInstalledClient(candidates, options.io ?? defaultPromptIo());
+}
+function noInstalledClientsError() {
+  return new ConnectError(
+    "runtime_no_installed_clients",
+    "Could not determine the agent runtime: nothing was detected in this environment, and no agent client Haven can configure is installed on this machine. Re-run with --runtime <name> naming the client you want configured, or --runtime other to store credentials and finish the MCP setup by hand.",
+    "rerun_connect_with_explicit_runtime"
+  );
+}
+function promptAbortedError(reason) {
+  return new ConnectError(
+    "runtime_prompt_aborted",
+    `Runtime not chosen (${reason}). Nothing was written: no agent was created, no credentials were stored, and the Haven setup token is still unused. Run the setup command again, or pass --runtime <name> to skip the prompt.`,
+    "rerun_connect_and_choose_a_runtime"
+  );
+}
+async function pathExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function defaultPromptIo() {
+  return {
+    write: (text) => process.stdout.write(text),
+    question: (query) => new Promise((resolvePromise) => {
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      let settled = false;
+      const settle = (value) => {
+        if (settled) return;
+        settled = true;
+        rl.close();
+        resolvePromise(value);
+      };
+      rl.once("SIGINT", () => settle(null));
+      rl.once("close", () => settle(null));
+      rl.question(query, (answer) => settle(answer));
+    })
+  };
+}
+
+// src/runtime.ts
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.1.28-alpha.0";
+var CONNECTOR_VERSION = "0.1.29-alpha.0";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 async function runConnect(options, deps = {}) {
   assertSupportedNodeVersion(deps.nodeVersion, MCP_RUNTIME_MANIFEST.minimumNodeVersion);
@@ -2503,24 +3142,49 @@ async function runConnect(options, deps = {}) {
   const runRuntimeInstall = deps.installRuntime ?? installRuntime;
   const generateKey = deps.generateKey ?? generateDelegateKey;
   const generateLocalApiKey = deps.generateApiKey ?? generateAgentApiKey;
-  const installCapabilities = runtimeInstallCapabilities(options.runtime);
+  const selection = await resolveRuntimeSelection(options.runtime, options.runtimeForce, {
+    env: deps.env ?? process.env,
+    selfReported: options.runtimeSelfReport,
+    promptForRuntime: runtimeSelectionPrompt(options, deps)
+  });
+  if (!selection.runtime) {
+    throw new ConnectError(
+      "runtime_undetermined",
+      `Could not determine the agent runtime: nothing was detected in this environment and no --runtime was given. If you are an AI agent running this command: re-run it once, unchanged except for adding --runtime <name>, naming the harness you are running in \u2014 one of: ${RUNTIME_FLAG_VALUES} (the aliases cowork, codex and openclaw are accepted too). Do not guess: if your harness is not one of those, use --runtime other, which stores the credentials and prints the manual MCP steps. Nothing was written and the Haven setup token is still unused.`,
+      "rerun_connect_with_explicit_runtime"
+    );
+  }
+  const runtime = selection.runtime;
+  const installCapabilities = runtimeInstallCapabilities(runtime);
   if (options.localMcp) {
-    const resolvedRuntime = normalizeRuntime(options.runtime);
-    if (!supportsLocalMcp(resolvedRuntime)) {
+    if (!supportsLocalMcp(runtime)) {
       throw new Error(
-        `--local (fully-local Haven MCP) is only available for Claude Code and Codex. The detected runtime is ${runtimeProfile(resolvedRuntime).label}. Re-run without --local to use the default hosted MCP + local signer setup.`
+        `--local (fully-local Haven MCP) is only available for Claude Code and Codex. The detected runtime is ${runtimeProfile(runtime).label}. Re-run without --local to use the default hosted MCP + local signer setup.`
       );
     }
   }
+  if (selection.overrodeHint) {
+    log(`runtime: ${runtime} (detected; ignoring the ${selection.overrodeHint} hint \u2014 pass --runtime-force ${selection.overrodeHint} to override)`);
+  }
+  if (selection.discardedHint) {
+    log(`runtime: ${runtime} (detected; "${selection.discardedHint}" is not a runtime Haven knows \u2014 valid values: ${RUNTIME_FLAG_VALUES})`);
+  }
+  if (selection.source === "prompted") {
+    log(`runtime: ${runtime} (chosen at the prompt \u2014 nothing was detected in this environment)`);
+  }
   log("Warming up your connection to Haven\u2026");
   const setup = await api.resolveSetup({
     setupToken: options.setupToken,
     connectorVersion,
-    runtime: options.runtime
+    runtime
   });
   assertSetupChallengeIsUsable(setup.challenge.expires_at);
   printSetupSummary(setup, log);
   await preflightStorage({ baseDir: options.credentialsDir, warn: log });
+  if (options.serverName) {
+    assertValidServerSlug(options.serverName);
+    await assertServerSlugAvailable(options.serverName, options.credentialsDir);
+  }
   log("Checked local credential storage \u2014 all clear.");
   const localKey = generateKey();
   const localApiKey = generateLocalApiKey();
@@ -2532,7 +3196,7 @@ async function runConnect(options, deps = {}) {
     registration = await api.registerSetup({
       setupToken: options.setupToken,
       connectorVersion,
-      runtime: options.runtime,
+      runtime,
       challengeId: setup.challenge.id,
       delegateAddress: localKey.address,
       proofSignature,
@@ -2557,6 +3221,7 @@ async function runConnect(options, deps = {}) {
   const credentialPaths = await writeCredentials({
     baseDir: options.credentialsDir,
     agentId: registration.agent_id,
+    serverName: options.serverName,
     apiKey: localApiKey,
     delegateKey: localKey.privateKey,
     delegateAddress: localKey.address,
@@ -2584,7 +3249,7 @@ async function runConnect(options, deps = {}) {
     );
   }
   const runtimeInstall = await runRuntimeInstall({
-    runtime: options.runtime,
+    runtime,
     hostedMcpUrl: registration.hosted_mcp_url,
     apiKey: localApiKey,
     signerPath: credentialPaths.signerPath,
@@ -2593,7 +3258,8 @@ async function runConnect(options, deps = {}) {
     environmentLabel: options.environmentLabel ?? "Local workspace",
     ackSigner: options.ackSigner,
     ackLocalTools: options.ackLocalTools,
-    localMcp: options.localMcp
+    localMcp: options.localMcp,
+    serverName: options.serverName
   }, {
     onProgress: log,
     // #1543: report "runtime configured" the moment the config write settles,
@@ -2629,6 +3295,19 @@ async function runConnect(options, deps = {}) {
   } else {
     log("Haven setup on this machine is complete.");
   }
+  try {
+    const supersededIds = await listOtherAgentIds(options.credentialsDir, credentialPaths.directory);
+    if (supersededIds.length > 0) {
+      log("");
+      log(
+        `Heads-up: this setup created a NEW agent. Your previous agent(s) \u2014 ${supersededIds.join(", ")} \u2014 still exist with their own keys, and any host that was already running keeps acting as them.`
+      );
+      log(
+        `If you meant to replace them: revoke them on the Haven agent page, then restart EVERY long-lived host (gateways, TUI workers, editors) \u2014 each holds the MCP wiring snapshot from its own start time, so after repeated setups each can be stuck on a DIFFERENT old agent. Then remove their directories under ~/.haven/agents (or ${RERUN_HINT} --tombstone <dir> to leave a diagnostic in their place). Run ${RERUN_HINT} --doctor to check whether their keys are still live.`
+      );
+    }
+  } catch {
+  }
   try {
     await api.updateInstallStatus(registration.setup_id, localApiKey, {
       runtime: runtimeInstall.runtime,
@@ -2703,11 +3382,16 @@ function completionOutcome(input) {
   };
   return outcome;
 }
+function runtimeSelectionPrompt(options, deps) {
+  if (options.interactive !== true) return void 0;
+  if (!(deps.isTty ?? Boolean(process.stdin.isTTY))) return void 0;
+  return deps.promptRuntime ?? (() => resolveRuntimeByInstalledClientPrompt());
+}
 function failedConnectOutcome(runtimeHint, error) {
   const message = error instanceof Error ? error.message : "";
-  const code = /Node\.js >=/i.test(message) ? "unsupported_node_version" : /setup challenge.*expired|expired or invalid/i.test(message) ? "setup_challenge_expired_or_invalid" : /only available for Claude Code and Codex/i.test(message) ? "local_mcp_unsupported_runtime" : "connect_failed";
+  const code = error instanceof ConnectError ? error.code : /Node\.js >=/i.test(message) ? "unsupported_node_version" : /setup challenge.*expired|expired or invalid/i.test(message) ? "setup_challenge_expired_or_invalid" : /only available for Claude Code and Codex/i.test(message) ? "local_mcp_unsupported_runtime" : "connect_failed";
   const runtime = normalizeRuntime(runtimeHint);
-  const nextAction2 = code === "setup_challenge_expired_or_invalid" ? "return_to_haven_for_fresh_setup" : code === "unsupported_node_version" ? "install_supported_node_and_rerun_connect" : code === "local_mcp_unsupported_runtime" ? "rerun_without_local_mcp" : "review_the_safe_error_output_and_start_a_fresh_haven_setup_if_needed";
+  const nextAction2 = error instanceof ConnectError ? error.nextAction : code === "setup_challenge_expired_or_invalid" ? "return_to_haven_for_fresh_setup" : code === "unsupported_node_version" ? "install_supported_node_and_rerun_connect" : code === "local_mcp_unsupported_runtime" ? "rerun_without_local_mcp" : "review_the_safe_error_output_and_start_a_fresh_haven_setup_if_needed";
   return {
     schema_version: CONNECT_OUTCOME_SCHEMA_VERSION,
     outcome: "failed",
@@ -2793,7 +3477,7 @@ function describeApprovedBudget(budget) {
 async function waitForBudgetApproval(api, setupId, apiKey, log, options = {}) {
   const intervalMs = options.intervalMs ?? 5e3;
   const timeoutMs = options.timeoutMs ?? 18e4;
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve9) => setTimeout(resolve9, ms)));
   const maxPolls = Math.max(1, Math.floor(timeoutMs / intervalMs));
   const remindEvery = Math.max(1, Math.floor(3e4 / intervalMs));
   let waitingAnnounced = false;
@@ -2879,11 +3563,39 @@ function activationInstructionWithWhy(profile) {
   }
   return profile.activationInstruction;
 }
+var RERUN_HINT = "npx @haven_ai/connect@alpha";
+async function listOtherAgentIds(baseDir, currentDirectory) {
+  const root = defaultCredentialRoot(baseDir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch {
+    return [];
+  }
+  const ids = [];
+  for (const entry of entries) {
+    if (join(root, entry) === currentDirectory) continue;
+    const identityPath = join(root, entry, "identity.json");
+    try {
+      await stat(identityPath);
+    } catch {
+      continue;
+    }
+    try {
+      const identity = JSON.parse(await readFile(identityPath, "utf8"));
+      ids.push(identity.agent_id ?? entry);
+    } catch {
+      ids.push(entry);
+    }
+  }
+  return ids;
+}
 function printNextSteps(result, log, approval) {
   for (const line of completionHandoffLines(result, approval)) log(line);
 }
 
 // src/args.ts
+init_server_names();
 function parseArgs(argv, env = process.env) {
   const options = {
     apiBaseUrl: env.HAVEN_API_URL ?? "http://localhost:3001",
@@ -2893,6 +3605,9 @@ function parseArgs(argv, env = process.env) {
   let json = false;
   let doctor = false;
   let repair = false;
+  let tombstoneDir;
+  let tombstoneReason;
+  let tombstoneReplacedBy;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--help" || arg === "-h") {
@@ -2903,14 +3618,25 @@ function parseArgs(argv, env = process.env) {
       doctor = true;
     } else if (arg === "--repair") {
       repair = true;
+    } else if (arg === "--tombstone") {
+      tombstoneDir = requireValue(argv, ++i, arg);
+    } else if (arg === "--reason") {
+      tombstoneReason = requireValue(argv, ++i, arg);
+    } else if (arg === "--replaced-by") {
+      tombstoneReplacedBy = requireValue(argv, ++i, arg);
     } else if (arg === "--setup" || arg === "--setup-token") {
       options.setupToken = requireValue(argv, ++i, arg);
     } else if (arg === "--api" || arg === "--api-url") {
       options.apiBaseUrl = requireValue(argv, ++i, arg);
     } else if (arg === "--runtime") {
       options.runtime = requireValue(argv, ++i, arg);
+    } else if (arg === "--runtime-force") {
+      options.runtimeForce = requireValue(argv, ++i, arg);
     } else if (arg === "--credentials-dir") {
       options.credentialsDir = requireValue(argv, ++i, arg);
+    } else if (arg === "--name") {
+      options.serverName = requireValue(argv, ++i, arg);
+      assertValidServerSlug(options.serverName);
     } else if (arg === "--environment-label") {
       options.environmentLabel = requireValue(argv, ++i, arg);
     } else if (arg === "--ack-local-tools") {
@@ -2928,14 +3654,21 @@ function parseArgs(argv, env = process.env) {
       throw new Error(`Unknown option: ${arg}`);
     }
   }
+  const tombstone = tombstoneDir ? { directory: tombstoneDir, reason: tombstoneReason, replacedBy: tombstoneReplacedBy } : void 0;
   if (help) {
-    return { options, help, json, doctor, repair };
+    return { options, help, json, doctor, repair, tombstone };
+  }
+  if (!tombstoneDir && (tombstoneReason !== void 0 || tombstoneReplacedBy !== void 0)) {
+    throw new Error("--reason and --replaced-by require --tombstone <dir>.");
+  }
+  if (tombstone) {
+    return { options, help, json, doctor, repair, tombstone };
   }
   if (doctor || repair) {
     if (!options.runtime) {
       throw new Error("--doctor/--repair need --runtime <runtime> (which config to examine).");
     }
-    return { options, help, json, doctor, repair };
+    return { options, help, json, doctor, repair, tombstone };
   }
   if (!options.setupToken) {
     throw new Error("Missing --setup <hv_setup_...> setup token.");
@@ -2944,7 +3677,7 @@ function parseArgs(argv, env = process.env) {
     throw new Error("Missing --api <Haven API URL>.");
   }
   options.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
-  return { options, help, json, doctor, repair };
+  return { options, help, json, doctor, repair, tombstone };
 }
 function helpText() {
   return [
@@ -2954,14 +3687,23 @@ function helpText() {
     "sends Haven only the public signing address plus a proof signature.",
     "",
     "Usage:",
-    "  npx -y @haven_ai/connect --setup hv_setup_... --api https://api.haven.example --ack-local-tools --runtime claude-code",
+    "  npx -y @haven_ai/connect --setup hv_setup_... --api https://api.haven.example --ack-local-tools",
     "",
     "Options:",
     "  --setup <token>            Short-lived setup token from Haven.",
     "  --api <url>                Haven backend API URL. Defaults to HAVEN_API_URL or http://localhost:3001.",
     "  --runtime <name>           Agent runtime hint, such as claude-code, codex-cli, codex-desktop, cursor, vscode, claude-desktop, or hermes.",
+    "                             Usually unnecessary: the connector detects the runtime it runs inside, and a detection",
+    "                             that contradicts this hint wins (with a printed notice). When nothing is detected, an",
+    "                             interactive terminal is offered the agent clients installed on this machine; this flag is",
+    "                             how an agent, or a non-interactive run, answers instead. An unknown name is refused, never guessed.",
+    "  --runtime-force <name>     Escape hatch: use exactly this runtime, ignoring environment detection.",
     "  --credentials-dir <path>   Credential directory fallback. Defaults to ~/.haven/agents.",
     "  --environment-label <text> Non-sensitive label shown in Haven setup review.",
+    "  --name <slug>              Wiring slug for a NAMED agent: writes haven-<slug> / haven-signer-<slug>",
+    "                             MCP entries and stores credentials at ~/.haven/agents/<slug>/, so several",
+    "                             agents can run side by side in one runtime. 1-32 lowercase letters, digits,",
+    "                             single hyphens; immutable once wired. Omit for the bare haven / haven-signer pair.",
     "  --ack-local-tools          Write the one-time local Haven tools acknowledgement during setup.",
     "  --ack-signer               Backward-compatible alias for --ack-local-tools.",
     "  --local                    Advanced: install the fully-local Haven MCP (no hosted dependency).",
@@ -2972,6 +3714,11 @@ function helpText() {
     "  --repair                   Repair, then re-diagnose (implies --doctor): reinstall the pinned signer",
     "                             runtime, rewrite the wrapper and runtime config from stored credentials.",
     "                             Hosted topology only (refuses to touch a --local config). No keys, no token.",
+    "  --tombstone <dir>          Retire an agent credential directory in place (no token): replaces its signer",
+    "                             wrapper with a diagnostic that names the retirement in MCP stderr logs, and",
+    "                             writes TOMBSTONE.json. Touches NO key material and revokes nothing.",
+    "  --reason <text>            Reason recorded in the tombstone (with --tombstone).",
+    "  --replaced-by <agent-id>   Successor agent recorded in the tombstone (with --tombstone).",
     "  --help                     Show this help.",
     "",
     "The connector never prints the private key and never sends it to Haven. JSON output never includes credential contents or full credential paths."
@@ -2984,6 +3731,10 @@ function requireValue(argv, index, option) {
   }
   return value;
 }
+
+// src/index.ts
+init_redact();
+init_redact();
 async function runCli(argv, io = {
   stdout: (message) => process.stdout.write(message),
   stderr: (message) => process.stderr.write(message)
@@ -3007,6 +3758,45 @@ async function runCli(argv, io = {
 `);
     return 0;
   }
+  if (parsed.tombstone) {
+    const { writeAgentTombstone: writeAgentTombstone2 } = await Promise.resolve().then(() => (init_tombstone(), tombstone_exports));
+    const { readFile: readFile11 } = await import('fs/promises');
+    const { join: join10 } = await import('path');
+    try {
+      let agentId = "unknown";
+      try {
+        const identity = JSON.parse(
+          await readFile11(join10(parsed.tombstone.directory, "identity.json"), "utf8")
+        );
+        agentId = identity.agent_id ?? "unknown";
+      } catch {
+      }
+      const info = await writeAgentTombstone2({
+        directory: parsed.tombstone.directory,
+        agentId,
+        reason: parsed.tombstone.reason ?? "retired by operator via --tombstone",
+        replacedBy: parsed.tombstone.replacedBy
+      });
+      if (parsed.json) {
+        io.stdout(`${redactSecrets(JSON.stringify({ tombstoned: true, ...info }))}
+`);
+      } else {
+        io.stdout(redactSecrets(`Tombstoned agent ${info.agent_id} at ${parsed.tombstone.directory}.
+`));
+        io.stdout(
+          "Key files were NOT touched and nothing was revoked \u2014 revoke the agent on the Haven agent page if you have not already.\n"
+        );
+        io.stdout(
+          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot from its own start time, and the tombstone only speaks when a stale host next probes the old path.\n"
+        );
+      }
+      return 0;
+    } catch (err) {
+      io.stderr(`${redactSecrets(err instanceof Error ? err.message : String(err))}
+`);
+      return 1;
+    }
+  }
   if (parsed.doctor || parsed.repair) {
     const { runDoctor: runDoctor2, runRepair: runRepair2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
     const runtime = parsed.options.runtime ?? "";
@@ -3029,6 +3819,23 @@ async function runCli(argv, io = {
           if (check.repair) io.stdout(redactSecrets(`    \u21B3 repair: ${check.repair}
 `));
         }
+        const otherAgents = report.agents.filter((agent) => agent.directory !== report.credentialDirectory);
+        if (otherAgents.length > 0) {
+          io.stdout("\nOther agents on this machine:\n");
+          for (const agent of otherAgents) {
+            const name = agent.slug ? `${agent.slug} (${agent.agentId ?? "unknown"})` : agent.agentId ?? "unknown";
+            const failed = agent.checks.filter((check) => !check.ok);
+            const verdict = agent.classification === "wired" ? failed.length === 0 ? "wired, all checks passed" : `wired, ${failed.length} check(s) FAILED` : agent.classification;
+            io.stdout(redactSecrets(`  ${failed.length > 0 ? "\u2717" : "\u2022"} ${name}: ${verdict}
+`));
+            for (const check of failed) {
+              io.stdout(redactSecrets(`      \u2717 ${check.label}: ${check.detail}
+`));
+              if (check.repair) io.stdout(redactSecrets(`        \u21B3 repair: ${check.repair}
+`));
+            }
+          }
+        }
         io.stdout(report.ok ? "All checks passed.\n" : "One or more checks FAILED \u2014 see repairs above.\n");
       }
       return report.ok ? 0 : 1;
@@ -3040,7 +3847,15 @@ async function runCli(argv, io = {
   }
   try {
     const result = await runConnect(
-      { ...parsed.options, waitForApproval: !parsed.json },
+      {
+        ...parsed.options,
+        waitForApproval: !parsed.json,
+        // #1719: only a human-facing run may be asked which installed client to
+        // configure. --json is the automation contract — it must fail with a
+        // machine-readable code, never block on stdin. runConnect additionally
+        // requires a real TTY before it prompts.
+        interactive: !parsed.json
+      },
       {
         log: (message) => (parsed.json ? io.stderr : io.stdout)(`${message}
 `),
@@ -3078,8 +3893,9 @@ if (isCliEntrypoint()) void main();
 // src/index.ts
 init_signer_runtime();
 init_runtime_registry();
+init_connect_error();
 init_runtime_manifest();
 
-export { CONNECTOR_VERSION, CONNECT_OUTCOME_SCHEMA_VERSION, MCP_RUNTIME_MANIFEST, completionOutcome, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, failedConnectOutcome, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, prepareSignerRuntime, redactSecrets, runCli, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
+export { CONNECTOR_VERSION, CONNECT_OUTCOME_SCHEMA_VERSION, ConnectError, MCP_RUNTIME_MANIFEST, RUNTIME_FLAG_VALUES, completionOutcome, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, failedConnectOutcome, generateDelegateKey, helpText, installRuntime, isConnectError, mcpPackageSpec, normalizeRuntime, parseArgs, prepareSignerRuntime, promptForInstalledClient, redactSecrets, resolveRuntimeByInstalledClientPrompt, resolveRuntimeSelection, runCli, runConnect, runtimeInstallCapabilities, runtimeProfile, scanInstalledClients, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map