@haven_ai/connect 0.3.0-alpha.0 → 0.4.0-alpha.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import crypto, { createHash } from 'crypto';
 import { Wallet } from 'ethers';
-import { mkdir, rm, stat, readdir, readFile, writeFile, chmod, access, unlink, rename } from 'fs/promises';
+import { mkdir, rm, stat, readdir, readFile, writeFile, chmod, access, unlink, realpath, rename } from 'fs/promises';
 import { homedir, platform } from 'os';
 import { join, resolve, dirname, basename } from 'path';
 import { ensureConsent, computeConsentHash, loadCredentials, consentInputFromClient, registeredToolNames, MCP_VERSION } from '@haven_ai/mcp';
@@ -164,6 +164,16 @@ function redactSecrets(value) {
 function redactForAutomation(value) {
   return redactSecrets(value).replace(/(?:~|\/)[^\s`"']*\/(?:identity|signer|agent)\.json\b/g, "[credential-file-redacted]").replace(/(?:~|\/)[^\s`"']*\/\.env\b/g, "[credential-env-redacted]");
 }
+function withoutUserinfo(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString().replace(/\/+$/, "");
+  } catch {
+    return url;
+  }
+}
 function shortAddress(address) {
   if (!/^0x[0-9a-fA-F]{40}$/.test(address)) return address;
   return `${address.slice(0, 6)}...${address.slice(-4)}`;
@@ -525,12 +535,64 @@ async function writeConnectOutcomeRecord(directory, outcome, warn) {
   await restrictPermissions(path, 384, warn);
   return path;
 }
-var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME;
+async function readConnectOutcomeRuntime(directory) {
+  try {
+    const parsed = JSON.parse(await readFile(join(directory, CONNECT_OUTCOME_FILENAME), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const runtime = parsed.runtime;
+    return typeof runtime === "string" && runtime.length > 0 ? runtime : null;
+  } catch {
+    return null;
+  }
+}
+async function writeMcpServerBinding(directory, binding) {
+  const path = join(directory, MCP_SERVER_BINDING_FILENAME);
+  await writeFile(path, `${JSON.stringify(binding, null, 2)}
+`, { mode: 384 });
+  return path;
+}
+async function readMcpServerBinding(directory) {
+  try {
+    const parsed = JSON.parse(await readFile(join(directory, MCP_SERVER_BINDING_FILENAME), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const record = parsed;
+    if (record.version !== 1 || typeof record.server_name !== "string" || typeof record.agent_id !== "string" || typeof record.api_url !== "string" || typeof record.bound_at !== "string") return null;
+    return record;
+  } catch {
+    return null;
+  }
+}
+async function clearMcpServerBinding(directory) {
+  try {
+    await rm(join(directory, MCP_SERVER_BINDING_FILENAME));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function listMcpServerBindings(baseDir, excludeDirectory) {
+  const root = defaultCredentialRoot(baseDir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const directory = join(root, entry);
+    const binding = await readMcpServerBinding(directory);
+    if (binding) out.push({ directory, binding });
+  }
+  return out;
+}
+var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME, MCP_SERVER_BINDING_FILENAME;
 var init_storage = __esm({
   "src/storage.ts"() {
     REKEY_PENDING_FILENAME = "rekey-pending.json";
     REKEY_PENDING_TTL_MS = 24 * 60 * 60 * 1e3;
     CONNECT_OUTCOME_FILENAME = "last-connect-outcome.json";
+    MCP_SERVER_BINDING_FILENAME = "mcp-server-binding.json";
   }
 });
 function mcpPackageSpec() {
@@ -549,9 +611,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.3.0-alpha.0",
+      sdkVersion: "0.4.0-alpha.0",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.3.0-alpha.0",
+      signerVersion: "0.4.0-alpha.0",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -1520,7 +1582,7 @@ async function probeLocalSignerCredential(signerPath) {
   }
 }
 async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const child = spawn(command, args, { stdio: ["pipe", "pipe", "ignore"] });
     let stdout = "";
     let settled = false;
@@ -1532,7 +1594,7 @@ async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4)
       settled = true;
       clearTimeout(timeout);
       child.kill();
-      resolve9(result);
+      resolve10(result);
     };
     const timeout = setTimeout(() => finish({ status: "timeout" }), timeoutMs);
     child.on("error", () => finish({ status: "process_error" }));
@@ -3177,8 +3239,52 @@ async function unwireAgent(input) {
       }
     }
   }
-  await teardownLocalKeyMaterial(input.directory, identity);
-  return { directory: input.directory, agentId, slug, tombstoned, runtimes };
+  const bindingReleased = await clearMcpServerBinding(input.directory);
+  const teardown = await decideTeardown(identity, input);
+  if (teardown.status !== "retained") await teardownLocalKeyMaterial(input.directory, identity);
+  return { directory: input.directory, agentId, slug, tombstoned, runtimes, teardown, bindingReleased };
+}
+async function decideTeardown(identity, input) {
+  const ended = "Local recovery of a stranded delegate balance ends with it: the sweep-recovery routes accept only this agent's API key and delegate signature, and neither exists on this machine any more.";
+  if (!identity?.api_key || !identity.api_url) {
+    return {
+      status: input.destroyKeyMaterial ? "forced" : "destroyed",
+      probe: "not_probed",
+      detail: "No stored API key + API URL to probe with \u2014 nothing the sweep-recovery routes would accept, so nothing to preserve."
+    };
+  }
+  const probe = await (input.probeHostedIdentity ?? probeHostedAgentIdentity)(identity.api_key, identity.api_url, input.fetch);
+  if (input.destroyKeyMaterial) {
+    return {
+      status: "forced",
+      probe: probe.status,
+      detail: `Key material destroyed under ${DESTROY_FLAG} (probe: ${probe.status}): signer.json, any parked re-key, and the API key in identity.json.`,
+      remedy: ended
+    };
+  }
+  switch (probe.status) {
+    case "ok":
+      return {
+        status: "retained",
+        probe: "ok",
+        detail: "This agent is still ACTIVE on the backend: its API key and delegate key still carry spend authority, so destroying them would be a live spend-authority change. Key material kept in this directory (0o600); its MCP wiring above is gone.",
+        remedy: `Revoke the agent on the Haven agent page (connect never revokes), then re-run --unwire; or, to delete the key anyway, re-run with ${DESTROY_FLAG}.`
+      };
+    case "unauthorized":
+      return {
+        status: "retained",
+        probe: "unauthorized",
+        detail: "This key no longer authenticates on normal routes (revoked, archived, paused, pending approval, rotated, or not a key the backend knows \u2014 it does not say which). A stranded delegate balance MAY still exist and the connector CANNOT check: this directory may hold the only local credential the sweep-recovery routes would still accept. Key material kept.",
+        remedy: `Recover any stranded balance first (haven_sweep_delegate from a runtime still wired to this agent, or the Haven agent page), then re-run with ${DESTROY_FLAG} to remove the key material.`
+      };
+    default:
+      return {
+        status: "retained",
+        probe: probe.status,
+        detail: `Could not verify what this key is still good for (${probe.status}). Unknown is not "safe to delete": destroying it on a failed check would erase the evidence of a live key. Key material kept.`,
+        remedy: `Retry when the backend is reachable, or re-run with ${DESTROY_FLAG} to remove the key material regardless.`
+      };
+  }
 }
 async function tombstoneDirectoryIfAbsent(input) {
   if (await readOptionalText(join(input.directory, TOMBSTONE_FILENAME)) !== null) return false;
@@ -3199,9 +3305,10 @@ async function teardownLocalKeyMaterial(directory, identity) {
 async function readIdentityFile(directory) {
   return identityAt(directory);
 }
-var RUNTIMES;
+var RUNTIMES, DESTROY_FLAG;
 var init_unwire = __esm({
   "src/unwire.ts"() {
+    init_probes();
     init_config_writers();
     init_server_names();
     init_signer_runtime();
@@ -3215,6 +3322,7 @@ var init_unwire = __esm({
       { runtime: "vscode-insiders", label: "VS Code Insiders MCP config", kind: "json", serverRoot: "servers" },
       { runtime: "claude-desktop", label: "Claude Desktop config", kind: "json", serverRoot: "mcpServers" }
     ];
+    DESTROY_FLAG = "--destroy-key-material";
   }
 });
 
@@ -3226,6 +3334,174 @@ var init_rekey_messages = __esm({
   }
 });
 
+// src/prune-runtimes.ts
+var prune_runtimes_exports = {};
+__export(prune_runtimes_exports, {
+  normalizeRuntimePath: () => normalizeRuntimePath,
+  pruneSignerRuntimes: () => pruneSignerRuntimes,
+  referencedRuntimeDirectories: () => referencedRuntimeDirectories,
+  rollUpPruneLevel: () => rollUpPruneLevel,
+  signerRuntimeRoot: () => signerRuntimeRoot
+});
+function signerRuntimeRoot(homeDir) {
+  return join(homeDir, ".haven", "signer-runtime");
+}
+function classifyKey(key) {
+  if (key.startsWith("override-")) return "override";
+  if (key === MCP_RUNTIME_MANIFEST.signerVersion || /^\d+\.\d+\.\d+/.test(key)) return "version";
+  return "unknown";
+}
+async function directoryBytes(directory) {
+  let total = 0;
+  const walk = async (dir) => {
+    let entries = [];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile()) {
+        try {
+          total += (await stat(path)).size;
+        } catch {
+        }
+      }
+    }
+  };
+  await walk(directory);
+  return total;
+}
+async function normalizeRuntimePath(path) {
+  const resolved = resolve(path).replace(/[\\/]+$/, "");
+  try {
+    return await realpath(resolved);
+  } catch {
+    return resolved;
+  }
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function referencedRuntimeDirectories(homeDir, credentialsDir) {
+  const roots = /* @__PURE__ */ new Set([join(homeDir, ".haven", "agents")]);
+  if (credentialsDir) roots.add(dirname(resolve(credentialsDir)));
+  const referenced = /* @__PURE__ */ new Map();
+  const runtimeRoot = await normalizeRuntimePath(signerRuntimeRoot(homeDir));
+  const rootSpellings = [.../* @__PURE__ */ new Set([resolve(signerRuntimeRoot(homeDir)), runtimeRoot])];
+  const wrapperRe = new RegExp(`(?:${rootSpellings.map(escapeRegExp).join("|")})[\\/]+([^\\/'"\\s]+)`, "g");
+  const add = async (runtimeDirectory, by) => {
+    const key = await normalizeRuntimePath(runtimeDirectory);
+    const list = referenced.get(key) ?? [];
+    if (!list.includes(by)) list.push(by);
+    referenced.set(key, list);
+  };
+  for (const root of roots) {
+    let entries = [];
+    try {
+      entries = await readdir(root);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const directory = join(root, entry);
+      try {
+        const sidecar = JSON.parse(await readFile(join(directory, "signer-runtime.json"), "utf8"));
+        if (typeof sidecar.runtime_directory === "string" && sidecar.runtime_directory.length > 0) {
+          await add(sidecar.runtime_directory, directory);
+        }
+      } catch {
+      }
+      try {
+        const wrapper = await readFile(join(directory, "bin", "haven-signer.mjs"), "utf8");
+        for (const match of wrapper.matchAll(wrapperRe)) await add(join(runtimeRoot, match[1]), directory);
+      } catch {
+      }
+    }
+  }
+  return referenced;
+}
+function rollUpPruneLevel(entries) {
+  if (entries.some((e) => e.level === "failed")) return "failed";
+  if (entries.some((e) => e.level === "advisory")) return "advisory";
+  return "ok";
+}
+async function pruneSignerRuntimes(input, deps = {}) {
+  const homeDir = deps.homeDir ?? homedir();
+  const root = signerRuntimeRoot(homeDir);
+  const measure = input.measure ?? true;
+  const referenced = await referencedRuntimeDirectories(homeDir, deps.credentialsDir);
+  const pin = await normalizeRuntimePath(join(root, MCP_RUNTIME_MANIFEST.signerVersion));
+  const remove = deps.rm ?? (async (directory) => rm(directory, { recursive: true, force: false }));
+  const entries = [];
+  let keys = [];
+  try {
+    keys = (await readdir(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch {
+    return { version: 1, root, dryRun: input.dryRun, entries, removed: 0, reclaimedBytes: 0, level: "ok" };
+  }
+  let removed = 0;
+  let reclaimedBytes = 0;
+  for (const key of keys) {
+    const directory = join(root, key);
+    const normalized = await normalizeRuntimePath(directory);
+    const referencedBy = referenced.get(normalized) ?? [];
+    const kind = classifyKey(key);
+    if (referencedBy.length > 0 || normalized === pin) {
+      entries.push({
+        directory,
+        key,
+        kind,
+        bytes: 0,
+        referencedBy,
+        action: "kept",
+        level: "ok",
+        detail: referencedBy.length > 0 ? `kept \u2014 named by ${referencedBy.length} credential director${referencedBy.length === 1 ? "y" : "ies"} (sidecar or wrapper)` : "kept \u2014 the connector's current pinned version (what --repair installs)"
+      });
+      continue;
+    }
+    const bytes = measure ? await directoryBytes(directory) : 0;
+    if (input.dryRun) {
+      entries.push({
+        directory,
+        key,
+        kind,
+        bytes,
+        referencedBy,
+        action: "would_remove",
+        level: "advisory",
+        detail: `would remove \u2014 no credential directory names it (${kind}-keyed)`
+      });
+      continue;
+    }
+    try {
+      await remove(directory);
+      removed += 1;
+      reclaimedBytes += bytes;
+      entries.push({ directory, key, kind, bytes, referencedBy, action: "removed", level: "ok", detail: `removed \u2014 no credential directory named it (${kind}-keyed)` });
+    } catch (err) {
+      entries.push({
+        directory,
+        key,
+        kind,
+        bytes,
+        referencedBy,
+        action: "failed",
+        level: "failed",
+        detail: `removal failed: ${err instanceof Error ? err.message : String(err)} \u2014 a signer process may still hold it open; stop it and re-run`
+      });
+    }
+  }
+  return { version: 1, root, dryRun: input.dryRun, entries, removed, reclaimedBytes, level: rollUpPruneLevel(entries) };
+}
+var init_prune_runtimes = __esm({
+  "src/prune-runtimes.ts"() {
+    init_runtime_manifest();
+  }
+});
+
 // src/rekey.ts
 var rekey_exports = {};
 __export(rekey_exports, {
@@ -3509,9 +3785,32 @@ var init_rekey_restart = __esm({
 var doctor_exports = {};
 __export(doctor_exports, {
   describeAccountAddressKey: () => describeAccountAddressKey,
+  rollUpLevel: () => rollUpLevel,
   runDoctor: () => runDoctor,
   runRepair: () => runRepair
 });
+function finalizeCheck(check) {
+  return { ...check, ok: check.level !== "failed" };
+}
+function rollUpLevel(checks) {
+  if (checks.some((check) => check.level === "failed")) return "failed";
+  if (checks.some((check) => check.level === "advisory")) return "advisory";
+  return "ok";
+}
+function runtimeFlagFor(runtime) {
+  return normalizeRuntimeName(runtime) ? ` --runtime ${runtime}` : "";
+}
+async function resolveDoctorRuntime(input, directory) {
+  const explicit = input.runtime.trim();
+  if (explicit) return { runtime: explicit, origin: "flag" };
+  if (directory) {
+    const recorded = await readConnectOutcomeRuntime(directory);
+    if (recorded !== null && normalizeRuntimeName(recorded)) {
+      return { runtime: recorded, origin: "record" };
+    }
+  }
+  return { runtime: "", origin: "unknown" };
+}
 async function discoverCredentialDirectory(homeDir, explicit) {
   const root = explicit ? dirname(explicit) : join(homeDir, ".haven", "agents");
   let entries = [];
@@ -3572,13 +3871,16 @@ function agentIsWired(configText, names, slug, identity, sidecar, isPrimary, bar
   return isPrimary && Boolean(identity?.hosted_mcp_url && configText.includes(identity.hosted_mcp_url));
 }
 function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
+  return finalizeCheck(rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug));
+}
+function rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug) {
   const label = "Pending re-key";
   const nameFlag = slug ? ` --name ${slug}` : "";
   if (status.state === "unreadable") {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key was started here but ${status.path} does not parse, so neither the address it generated nor when it started can be read. The file still holds what was a private key.`,
       repair: `Delete ${status.path}, then start again: ${RERUN} --rekey${nameFlag}`
     };
@@ -3590,9 +3892,9 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key started ${started} has COMPLETED on Haven \u2014 the agent's signing address is already ${address}, the one this machine generated \u2014 but the local half was never finished, so the credential files here still hold the old key. Parked at ${status.path}.` + (status.state === "expired" ? " The local file is also past its 24h TTL, which --rekey-finish refuses, so the finish command below will not accept it any more." : ""),
-      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you> --runtime ${runtime}`
+      repair: status.state === "expired" ? `The parked key expired. Start again \u2014 ${RERUN} --rekey${nameFlag} \u2014 and re-run "Replace signing key" on the Haven agent page with the new address it prints.` : `Run: ${RERUN} --rekey-finish${nameFlag} --api-key <the key the agent page showed you>${runtimeFlagFor(runtime)}`
     };
   }
   const wedgeNote = "Haven is NOT yet on this address, so the re-key did not complete. This machine cannot tell whether the on-chain revoke on the agent page already ran: if it did not, closing this costs nothing; if it did, the agent's old delegations are revoked, no new ones were issued, and only an owner re-grant restores its spend authority (#1868). Check the agent page before assuming the harmless case.";
@@ -3600,7 +3902,7 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
     return {
       id: "rekey_pending",
       label,
-      ok: false,
+      level: "failed",
       detail: `A re-key started ${started} EXPIRED ${status.expiresAt ?? ""} without being finished. Its address was ${address}; the private half it generated is still on disk at ${status.path}. ` + wedgeNote,
       repair: `Either delete ${status.path} to drop the parked key, or start over: ${RERUN} --rekey${nameFlag}. Connect never deletes it for you \u2014 an expired TTL is a refusal to USE the key, not a licence to destroy key material you may still be mid-flow on.`
     };
@@ -3608,7 +3910,7 @@ function rekeyPendingCheck(status, hostedDelegateAddress, runtime, slug) {
   return {
     id: "rekey_pending",
     label,
-    ok: true,
+    level: "ok",
     detail: `A re-key started ${started} is still open (expires ${status.expiresAt ?? "unknown"}). Paste this address into "Replace signing key" on the Haven agent page: ${address}. Parked at ${status.path}. ` + wedgeNote
   };
 }
@@ -3636,13 +3938,13 @@ async function runtimeSpecOverrideCheck(directory, sidecar, env) {
   if (shell) facts.push(shell);
   if (facts.length === 0) return void 0;
   const variables = Object.values(RUNTIME_SPEC_ENV).join(" / ");
-  return {
+  return finalizeCheck({
     id: "runtime_spec_override",
     label: "Runtime spec override",
-    ok: false,
+    level: "failed",
     detail: `runtime spec overridden \u2014 not the pinned manifest (${MCP_RUNTIME_MANIFEST.signerPackage}@${MCP_RUNTIME_MANIFEST.signerVersion}, ${MCP_RUNTIME_MANIFEST.sdkPackage}@${MCP_RUNTIME_MANIFEST.sdkVersion}). ${facts.join(". ")}.`,
     repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>. If the override is intentional, this finding is the record of it.`
-  };
+  });
 }
 async function readMcpSidecarOverride(directory) {
   try {
@@ -3669,6 +3971,13 @@ function describeAccountAddressKey(identity, signerFile) {
   return "no account address stored";
 }
 async function checksForAgent(entry, input, deps) {
+  const verdicts = await verdictsForAgent(entry, input, deps);
+  return {
+    checks: verdicts.checks.map(finalizeCheck),
+    ...verdicts.signerCapabilities ? { signerCapabilities: verdicts.signerCapabilities } : {}
+  };
+}
+async function verdictsForAgent(entry, input, deps) {
   const { directory, identity, sidecar } = entry;
   const checks = [];
   let signerCapabilities;
@@ -3683,7 +3992,7 @@ async function checksForAgent(entry, input, deps) {
   checks.push({
     id: "credentials",
     label: "Agent credentials",
-    ok: credentialsOk,
+    level: credentialsOk ? "ok" : "failed",
     detail: credentialsOk ? `identity.json and signer.json parse (agent ${identity?.agent_id ?? "unknown"}; ${describeAccountAddressKey(identity, signerFile)})` : "identity.json or signer.json is missing or unparseable.",
     ...credentialsOk ? {} : { repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` }
   });
@@ -3691,9 +4000,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok: false,
+      level: "failed",
       detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   } else if (sidecar.runtime_spec_override) {
     const matches = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3703,9 +4012,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok: matches,
+      level: matches ? "ok" : "failed",
       detail: matches ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory} (override install \u2014 see runtime_spec_override)` : `Override runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime} with the same HAVEN_*_SPEC variables set.` }
+      ...matches ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)} with the same HAVEN_*_SPEC variables set.` }
     });
   } else {
     const intact = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -3717,9 +4026,9 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "signer_runtime",
       label: "Signer runtime (preinstalled wrapper)",
-      ok,
+      level: ok ? "ok" : intact ? "advisory" : "failed",
       detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : intact ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion} \u2014 intact, but outdated.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
     });
   }
   const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env);
@@ -3730,7 +4039,7 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "hosted_mcp",
       label: "Hosted Haven MCP",
-      ok: probe.status === "ok",
+      level: probe.status === "ok" ? "ok" : "failed",
       detail: probe.status === "ok" ? `MCP tools endpoint is reachable (${hostedUrl}).` : `MCP tools endpoint probe failed: ${probe.status} (${hostedUrl}).`,
       ...probe.status === "ok" ? {} : {
         repair: "Check network access and runtime configuration for the hosted MCP URL, then re-run --doctor."
@@ -3740,7 +4049,7 @@ async function checksForAgent(entry, input, deps) {
     checks.push({
       id: "hosted_mcp",
       label: "Hosted Haven MCP",
-      ok: false,
+      level: "failed",
       detail: "No stored API key / hosted MCP URL to probe with.",
       repair: `Re-run the full setup: ${RERUN} --setup <token>.`
     });
@@ -3758,15 +4067,15 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: false,
+        level: "failed",
         detail: probe.status === "unauthorized" ? "The stored API key was rejected, so the agent it authenticates as cannot be compared with the local signing key." : `Could not read the hosted identity (${probe.status}) \u2014 the comparison did not happen, so it cannot be reported as a match.`,
-        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor --runtime ${input.runtime}`
+        repair: probe.status === "unauthorized" ? `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.` : `Restore network access to the Haven API, then re-run: ${RERUN} --doctor${runtimeFlagFor(input.runtime)}`
       });
     } else if (!localDelegate) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: false,
+        level: "failed",
         detail: "signer.json holds no delegate_address to compare against the hosted identity.",
         repair: `Re-run the full setup with a fresh token: ${RERUN} --setup <token>.`
       });
@@ -3775,7 +4084,7 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "identity_match",
         label: "Hosted identity matches the local signing key",
-        ok: same,
+        level: same ? "ok" : "failed",
         detail: same ? `The stored API key authenticates as the agent whose signing key is in this directory (${shortAddress(localDelegate)}).` : `MISMATCH: the stored API key authenticates as agent ${probe.agentId ?? "unknown"} with delegate ${shortAddress(probe.delegateAddress ?? "unknown")}, but signer.json here holds ${shortAddress(localDelegate)}. This runtime would quote as one agent and sign as another.`,
         ...same ? {} : {
           repair: `Re-run setup for this agent so its API key and signing key come from one run: ${RERUN} --setup <token>. Do not hand-edit either file.`
@@ -3793,7 +4102,7 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "signer_process",
         label: "Signer stdio handshake",
-        ok: false,
+        level: "failed",
         detail: "The local-tools consent is not acknowledged, so the signer refuses to start (by design).",
         repair: `Run: ${RERUN} --ack-local-tools --setup <token>  (or re-run your original connector command with --ack-local-tools).`
       });
@@ -3810,18 +4119,18 @@ async function checksForAgent(entry, input, deps) {
       checks.push({
         id: "signer_process",
         label: "Signer stdio handshake",
-        ok: probe.status === "ok",
+        level: probe.status === "ok" ? "ok" : "failed",
         detail: probe.status === "ok" ? `Signer started, listed ${probe.toolNames?.length ?? 0} tools${probe.serverInfo?.version ? ` (v${probe.serverInfo.version})` : ""}.${compatDetail}` : `Handshake failed: ${probe.status}.`,
-        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+        ...probe.status === "ok" ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}` }
       });
     }
   } else {
     checks.push({
       id: "signer_process",
       label: "Signer stdio handshake",
-      ok: false,
+      level: "failed",
       detail: "Skipped \u2014 no prepared signer runtime to probe.",
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input.runtime)}`
     });
   }
   return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
@@ -3831,7 +4140,11 @@ async function runDoctor(input, deps = {}) {
   const checks = [];
   let signerCapabilities;
   const { directory, others, parkedOnly } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const resolution = await resolveDoctorRuntime(input, directory);
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  const normalizedRuntime = normalizeRuntimeName(input2.runtime);
+  const configPath = runtimeConfigPathFor(normalizedRuntime ?? input2.runtime, homeDir);
   let configText = null;
   if (configPath !== null) {
     try {
@@ -3868,7 +4181,7 @@ async function runDoctor(input, deps = {}) {
         // A tombstone is a deliberate record and outranks the discovery tell:
         // a retired directory that also holds a parked key stays `retired`.
         classification: tombstone ? "retired" : parkedOnly.has(dir) ? "parked" : "orphaned",
-        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)] : [],
+        checks: rekeyPending ? [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)] : [],
         ...rekeyPending ? { rekeyPending } : {}
       });
       continue;
@@ -3883,11 +4196,11 @@ async function runDoctor(input, deps = {}) {
       ...rekeyPending ? { rekeyPending } : {}
     };
     if (wired) {
-      const result = await checksForAgent({ directory: dir, identity, sidecar }, input, deps);
+      const result = await checksForAgent({ directory: dir, identity, sidecar }, input2, deps);
       entry.checks = result.checks;
       capabilitiesByDirectory.set(dir, result.signerCapabilities);
     } else if (rekeyPending) {
-      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input.runtime, slug)];
+      entry.checks = [rekeyPendingCheck(rekeyPending, void 0, input2.runtime, slug)];
     }
     inventory.push(entry);
   }
@@ -3902,7 +4215,7 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "credentials",
       label: "Agent credentials",
-      ok: false,
+      level: "failed",
       detail: "No agent credential directory with an identity.json under ~/.haven/agents.",
       repair: `Run the full setup once: ${RERUN} --setup <token from the Haven dashboard>.`
     });
@@ -3912,7 +4225,7 @@ async function runDoctor(input, deps = {}) {
     if (!primaryChecksById.has("credentials")) {
       const result = await checksForAgent(
         { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
-        input,
+        input2,
         deps
       );
       signerCapabilities = result.signerCapabilities;
@@ -3923,20 +4236,37 @@ async function runDoctor(input, deps = {}) {
       if (check) checks.push(check);
     }
   }
-  if (configPath === null) {
+  const runtimeOwnsNoConfig = normalizedRuntime !== null && configPath === null;
+  if (configPath === null && input2.runtime !== "" && normalizedRuntime === null) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok: true,
-      detail: `Runtime '${input.runtime}' has no file-based config the connector owns (CLI-managed) \u2014 skipping the file check.`
+      level: "failed",
+      detail: `Runtime '${input2.runtime}' is not one the connector recognises. The runtime config was NOT checked. Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`,
+      repair: `Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+    });
+  } else if (configPath === null && input2.runtime === "") {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      level: "failed",
+      detail: `Runtime is unknown \u2014 no runtime flag was given and the connector's record in ${primaryDirectory ?? input.credentialsDir ?? "~/.haven/agents"} carries no resolvable ${CONNECT_OUTCOME_FILENAME} runtime. The runtime config was NOT checked. Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`,
+      repair: `Re-run the doctor naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+    });
+  } else if (configPath === null) {
+    checks.push({
+      id: "runtime_config",
+      label: "Runtime MCP config",
+      level: "ok",
+      detail: `Runtime '${input2.runtime}' is configured through its own CLI or by hand (${input2.runtime === "other" ? "manual runtime" : "CLI-managed"}) and has no file-based config the connector owns \u2014 skipping the file check.`
     });
   } else if (configText === null) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok: false,
+      level: "failed",
       detail: `No runtime config at ${configPath}.`,
-      repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}`
+      repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}`
     });
   } else {
     const primaryIdentity = await readIdentity(primaryDirectory ?? "");
@@ -3948,9 +4278,9 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "runtime_config",
       label: "Runtime MCP config",
-      ok,
+      level: ok ? "ok" : "failed",
       detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair --runtime ${input.runtime}` }
+      ...ok ? {} : { repair: `Run: ${RERUN} --doctor --repair${runtimeFlagFor(input2.runtime)}` }
     });
   }
   for (const id of ["hosted_mcp", "identity_match", "rekey_pending"]) {
@@ -3997,16 +4327,44 @@ async function runDoctor(input, deps = {}) {
       );
     }
     const supersededLive = live.filter((item) => item.entry.classification !== "wired").map((item) => item.label);
+    const classificationUnreliable = configText === null && runtimeOwnsNoConfig;
+    const supersededLevel = supersededLive.length === 0 ? "ok" : classificationUnreliable ? "advisory" : "failed";
     checks.push({
       id: "superseded_agents",
       label: "Superseded agent credentials",
-      ok: supersededLive.length === 0,
-      detail: supersededLive.length > 0 ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
-      ...supersededLive.length > 0 ? {
+      level: supersededLevel,
+      detail: supersededLevel === "failed" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : supersededLevel === "advisory" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. Runtime '${input2.runtime}' has no config file the connector can read, so which of these agents are wired cannot be verified from this machine: a live key here may be an agent you use deliberately, or one a host started before your latest setup is still spending as.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
+      ...supersededLevel === "failed" ? {
         repair: `Revoke ${supersededLive.join(", ")} on the Haven agent page, then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+      } : supersededLevel === "advisory" ? {
+        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: revoke the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : {}
     });
   }
+  const bindings = (await Promise.all(
+    inventory.filter((entry) => entry.classification !== "retired").map(async (entry) => ({ entry, binding: await readMcpServerBinding(entry.directory) }))
+  )).filter((item) => item.binding !== null);
+  const byName = /* @__PURE__ */ new Map();
+  for (const item of bindings) {
+    const list = byName.get(item.binding.server_name) ?? [];
+    list.push(item);
+    byName.set(item.binding.server_name, list);
+  }
+  const rebound = [...byName.entries()].filter(([, items]) => items.length > 1);
+  if (rebound.length > 0) {
+    const parts = rebound.map(([name, items]) => {
+      const ordered = [...items].sort((a, b) => a.binding.bound_at < b.binding.bound_at ? -1 : a.binding.bound_at > b.binding.bound_at ? 1 : 0);
+      const backends = new Set(ordered.map((i) => withoutUserinfo(i.binding.api_url)));
+      return `'${name}': ` + ordered.map((i) => `${i.binding.agent_id} on ${withoutUserinfo(i.binding.api_url)} at ${i.binding.bound_at} [${i.entry.classification}]`).join(" \u2192 ") + (backends.size > 1 ? " (BACKEND CHANGED)" : "");
+    });
+    checks.push({
+      id: "mcp_server_name_rebound",
+      label: "MCP server names bound more than once",
+      level: "advisory",
+      detail: `${rebound.length} MCP server name${rebound.length === 1 ? "" : "s"} changed hands on this machine (locally recorded bindings; the backend's own record is the authority for the same backend): ${parts.join("; ")}. A saved session, script or document naming the server may still mean the earlier agent.`,
+      repair: `Retire the earlier director(y/ies) with ${RERUN} --unwire <dir> to release the name, or keep both and address them by --name.`
+    });
+  }
   const parkedElsewhere = inventory.filter((entry) => entry.directory !== primaryDirectory && entry.rekeyPending).map((entry) => ({ entry, pending: entry.rekeyPending }));
   if (parkedElsewhere.length > 0) {
     const abandoned = parkedElsewhere.filter((item) => item.pending.state !== "pending");
@@ -4014,7 +4372,7 @@ async function runDoctor(input, deps = {}) {
     checks.push({
       id: "rekey_pending_elsewhere",
       label: "Parked re-keys in other credential directories",
-      ok: abandoned.length === 0,
+      level: abandoned.length === 0 ? "ok" : "failed",
       detail: abandoned.length > 0 ? `ABANDONED re-key key material outside the agent this report describes: ${abandoned.map(describe).join(", ")}. Each holds a private key that was generated for a re-key nobody finished.` : `${parkedElsewhere.length} other director(y/ies) hold an open pending re-key: ${parkedElsewhere.map(describe).join(", ")}.`,
       ...abandoned.length > 0 ? {
         repair: "Check the Haven agent page for each before deleting: if its on-chain revoke already ran, the agent has no spend authority until you re-grant it (#1868), and that is not visible from this machine. Connect never deletes key material for you."
@@ -4023,20 +4381,34 @@ async function runDoctor(input, deps = {}) {
   }
   const signerProcess = primaryChecksById.get("signer_process");
   if (signerProcess) checks.push(signerProcess);
-  const restart = restartRequiredForRuntime(input.runtime, deps.env);
+  const prune = await (deps.pruneSignerRuntimes ?? pruneSignerRuntimes)({ dryRun: true, measure: false }, { homeDir, credentialsDir: input.credentialsDir });
+  const unused = prune.entries.filter((entry) => entry.action === "would_remove");
+  if (unused.length > 0) {
+    checks.push({
+      id: "signer_runtime_unused",
+      label: "Unused signer-runtime directories",
+      level: "advisory",
+      detail: `${unused.length} signer-runtime director${unused.length === 1 ? "y" : "ies"} under ${prune.root} that no credential directory names: ${unused.map((entry) => entry.key).join(", ")}. Nothing is broken; they are left over from earlier pins or overrides (sizes: --prune-signer-runtimes --dry-run).`,
+      repair: `Run: ${RERUN} --prune-signer-runtimes (add --dry-run to list only).`
+    });
+  }
+  const restart = restartRequiredForRuntime(input2.runtime, deps.env);
   checks.push({
     id: "restart",
     label: "Runtime restart",
-    ok: true,
-    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : "No restart requirement known for this runtime."
+    level: "ok",
+    detail: restart ? "This runtime loads MCP config at startup \u2014 restart it after any repair before expecting the tools to appear." : input2.runtime === "" ? "Runtime is unknown \u2014 whether a restart is needed cannot be determined. Re-run the doctor naming the runtime for a definitive answer." : "No restart requirement known for this runtime."
   });
-  const wiredOk = inventory.filter((entry) => entry.classification === "wired").every((entry) => entry.checks.every((check) => check.ok));
+  const wiredChecks = inventory.filter((entry) => entry.classification === "wired").flatMap((entry) => entry.checks);
+  const finalChecks = checks.map(finalizeCheck);
+  const level = rollUpLevel([...finalChecks, ...wiredChecks]);
   return {
     version: 1,
-    ok: checks.every((check) => check.ok) && wiredOk,
-    runtime: input.runtime,
+    ok: level !== "failed",
+    level,
+    runtime: input2.runtime,
     credentialDirectory: primaryDirectory,
-    checks,
+    checks: finalChecks,
     agents: inventory,
     ...signerCapabilities ? { signerCapabilities } : {}
   };
@@ -4054,6 +4426,21 @@ async function runRepair(input, deps = {}) {
       messages: [`No agent credentials found to repair \u2014 run the full setup: ${RERUN} --setup <token>.`]
     };
   }
+  const resolution = await resolveDoctorRuntime(input, directory);
+  if (resolution.origin === "record") {
+    messages.push(`Runtime not given \u2014 resolved '${resolution.runtime}' from ${join(directory, CONNECT_OUTCOME_FILENAME)}.`);
+  }
+  const runtime = resolution.runtime;
+  const input2 = { ...input, runtime };
+  if (runtime === "") {
+    return {
+      ok: false,
+      messages: [
+        "Runtime is unknown \u2014 no runtime flag was given and the connector record carries no resolvable runtime.",
+        `Repair rewrites the runtime config, so it will not guess. Re-run repair naming the runtime \u2014 one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`
+      ]
+    };
+  }
   let identity;
   try {
     identity = JSON.parse(await readFile(join(directory, "identity.json"), "utf8"));
@@ -4063,7 +4450,7 @@ async function runRepair(input, deps = {}) {
   if (!identity.api_key || !(identity.hosted_mcp_url || identity.api_url)) {
     return { ok: false, messages: ["identity.json lacks the stored API key / hosted URL \u2014 re-run the full setup."] };
   }
-  const configPath = runtimeConfigPathFor(input.runtime, homeDir);
+  const configPath = runtimeConfigPathFor(normalizeRuntimeName(input2.runtime) ?? input2.runtime, homeDir);
   if (configPath) {
     try {
       const existing = await readFile(configPath, "utf8");
@@ -4090,7 +4477,10 @@ async function runRepair(input, deps = {}) {
   const names = serverNamesFor(serverName);
   messages.push(`Rewriting MCP entries ${names.hosted} / ${names.signer}${serverName ? ` (agent "${serverName}")` : " (unnamed pair)"} \u2014 no other pair is touched.`);
   const configResult = await writeRuntimeConfig({
-    runtime: input.runtime,
+    // Normalized for the WRITE too (#3145 review round 3): `writeRuntimeConfig`
+    // switches on the id, and the raw alias fell to its "manual runtime" arm
+    // — a repair that reported success while writing nothing.
+    runtime: normalizeRuntimeName(input2.runtime) ?? input2.runtime,
     hostedMcpUrl: identity.hosted_mcp_url ?? `${identity.api_url}/mcp`,
     apiKey: identity.api_key,
     identityPath: join(directory, "identity.json"),
@@ -4108,6 +4498,7 @@ async function runRepair(input, deps = {}) {
 var RERUN;
 var init_doctor = __esm({
   "src/doctor.ts"() {
+    init_prune_runtimes();
     init_runtime_manifest();
     init_probes();
     init_signer_runtime();
@@ -4421,7 +4812,7 @@ async function pathExists2(path) {
 init_unwire();
 init_local_mcp_runtime();
 init_runtime_manifest();
-var CONNECTOR_VERSION = "0.3.0-alpha.0";
+var CONNECTOR_VERSION = "0.4.0-alpha.0";
 var CONNECT_OUTCOME_SCHEMA_VERSION = 1;
 var failureOutcomesByError = /* @__PURE__ */ new WeakMap();
 function failureOutcomeFor(runtimeHint, error) {
@@ -4548,6 +4939,27 @@ async function executeConnect(options, deps, trace) {
       }
     }
   }
+  const existingAgents = await listExistingKeyedAgents(options.credentialsDir);
+  if (existingAgents.length > 0) {
+    log("");
+    log(
+      `Heads-up (before anything is written to this machine): it already carries ${existingAgents.length} agent director${existingAgents.length === 1 ? "y" : "ies"} with stored keys \u2014 ` + existingAgents.map((a) => `${a.agentId}${a.accountAddress ? ` (spends from ${shortAddress(a.accountAddress)})` : ""}`).join(", ") + ". This setup creates a NEW agent alongside them and revokes nothing."
+    );
+  }
+  const hostedNameForRun = serverNamesFor(serverName).hosted;
+  let reboundFrom;
+  const holders = (await listMcpServerBindings(options.credentialsDir)).filter(({ binding }) => binding.server_name === hostedNameForRun).sort((a, b) => a.binding.bound_at < b.binding.bound_at ? 1 : a.binding.bound_at > b.binding.bound_at ? -1 : 0);
+  const newest = holders[0];
+  if (newest) {
+    const { binding, directory } = newest;
+    const backendChanged = withoutUserinfo(binding.api_url) !== withoutUserinfo(options.apiBaseUrl);
+    const previousApiUrl = withoutUserinfo(binding.api_url);
+    reboundFrom = { server_name: binding.server_name, agent_id: binding.agent_id, api_url: previousApiUrl, bound_at: binding.bound_at, backend_changed: backendChanged };
+    const beingReplaced = replacing?.superseded.some((entry) => entry.directory === directory) ?? false;
+    log(
+      `Heads-up: the MCP server name '${binding.server_name}' was bound to agent ${binding.agent_id} on ${previousApiUrl} at ${binding.bound_at} (locally recorded${holders.length > 1 ? `; ${holders.length - 1} older record${holders.length > 2 ? "s" : ""} also claim${holders.length > 2 ? "" : "s"} it` : ""}). ` + (beingReplaced ? `This run replaces that wiring, as you chose, with a new agent on ${withoutUserinfo(options.apiBaseUrl)}` : `This run rebinds it to a new agent on ${withoutUserinfo(options.apiBaseUrl)}`) + (backendChanged ? " \u2014 a DIFFERENT backend: any saved session, script or document naming this MCP server now resolves to a different backend and agent." : ".")
+    );
+  }
   const localKey = generateKey();
   const localApiKey = generateLocalApiKey();
   log("Minting a fresh signing key and API key \u2014 both stay on this machine.");
@@ -4611,6 +5023,21 @@ async function executeConnect(options, deps, trace) {
     warn: log
   });
   trace.directory = credentialPaths.directory;
+  try {
+    const bindingRecord = {
+      version: 1,
+      server_name: hostedNameForRun,
+      signer_name: serverNamesFor(serverName).signer,
+      agent_id: registration.agent_id,
+      api_url: withoutUserinfo(options.apiBaseUrl),
+      // never persist `user:pass@` (#3154 doc review r2)
+      ...registration.hosted_mcp_url ? { hosted_mcp_url: registration.hosted_mcp_url } : {},
+      bound_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeMcpServerBinding(credentialPaths.directory, bindingRecord);
+  } catch {
+    log("Could not record the MCP server-name binding locally (non-fatal; the next setup cannot see this binding).");
+  }
   log(`Stored Haven identity credential locally: ${credentialPaths.identityPath}`);
   log(`Stored local signer credential locally: ${credentialPaths.signerPath}`);
   log(`Stored non-secret agent orientation locally: ${credentialPaths.agentPath}`);
@@ -4690,6 +5117,7 @@ async function executeConnect(options, deps, trace) {
             replacedBy: registration.agent_id
           });
           await teardownLocalKeyMaterial(entry.directory, await readIdentityFile(entry.directory));
+          await clearMcpServerBinding(entry.directory);
           retiredAgentIds.push(entry.agentId);
           log(`Retired previous agent ${entry.agentId} locally: tombstoned, local key files removed.`);
         } catch (err) {
@@ -4759,6 +5187,8 @@ async function executeConnect(options, deps, trace) {
     supersededAgentIds,
     supersededAgentsRetiredLocally,
     ...replacing ? { retiredAgentIds } : {},
+    existingAgentsBeforeWrite: existingAgents.map((a) => ({ agent_id: a.agentId, account_address: a.accountAddress })),
+    ...reboundFrom ? { serverNameReboundFrom: reboundFrom } : {},
     setupChallengeExpiresAt: setup.challenge.expires_at,
     approvalRequired: registration.agent_status === "pending_approval",
     approvalUrl: registration.approval_url
@@ -4823,6 +5253,10 @@ function completionOutcome(input) {
     superseded_agent_ids: input.supersededAgentIds ?? [],
     ...input.supersededAgentsRetiredLocally !== void 0 ? { superseded_agents_retired_locally: input.supersededAgentsRetiredLocally } : {},
     ...input.retiredAgentIds ? { retired_agent_ids: input.retiredAgentIds } : {},
+    // #3122: always emitted on a completed run (empty list included), for the
+    // same reason as superseded_agent_ids above.
+    existing_agents_before_write: input.existingAgentsBeforeWrite ?? [],
+    ...input.serverNameReboundFrom ? { server_name_rebound_from: input.serverNameReboundFrom } : {},
     ...input.setupChallengeExpiresAt ? { setup_challenge_expires_at: input.setupChallengeExpiresAt } : {},
     ...runtimeInstall.errorCode ? { error: { code: runtimeInstall.errorCode, next_action: nextAction2 } } : {}
   };
@@ -5007,7 +5441,7 @@ function describeWaitBound(timeoutMs) {
 async function waitForBudgetApproval(api, setupId, apiKey, log, options = {}) {
   const intervalMs = options.intervalMs ?? 5e3;
   const timeoutMs = options.timeoutMs ?? 18e4;
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve9) => setTimeout(resolve9, ms)));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
   const maxPolls = Math.max(1, Math.floor(timeoutMs / intervalMs));
   const remindEvery = Math.max(1, Math.floor(3e4 / intervalMs));
   let waitingAnnounced = false;
@@ -5098,6 +5532,32 @@ function activationInstructionWithWhy(profile) {
   return profile.activationInstruction;
 }
 var RERUN_HINT = connectorRerunCommand();
+async function listExistingKeyedAgents(baseDir) {
+  const root = defaultCredentialRoot(baseDir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const directory = join(root, entry);
+    try {
+      const identity = JSON.parse(await readFile(join(directory, "identity.json"), "utf8"));
+      if (typeof identity.api_key !== "string" || identity.api_key.length === 0) continue;
+      let agent = {};
+      try {
+        agent = JSON.parse(await readFile(join(directory, "agent.json"), "utf8"));
+      } catch {
+      }
+      const { accountAddress } = readStoredAccountAddress(identity, agent);
+      out.push({ agentId: typeof identity.agent_id === "string" ? identity.agent_id : entry, directory, accountAddress: accountAddress ?? null });
+    } catch {
+    }
+  }
+  return out;
+}
 async function listOtherAgentIds(baseDir, currentDirectory) {
   const root = defaultCredentialRoot(baseDir);
   let entries = [];
@@ -5146,6 +5606,9 @@ function parseArgs(argv, env = process.env) {
   let tombstoneReason;
   let tombstoneReplacedBy;
   let unwire;
+  let destroyKeyMaterial = false;
+  let pruneSignerRuntimes2 = false;
+  let dryRun = false;
   let unwireDir;
   let replace = false;
   for (let i = 0; i < argv.length; i += 1) {
@@ -5173,6 +5636,12 @@ function parseArgs(argv, env = process.env) {
         unwireDir = next;
         i += 1;
       }
+    } else if (arg === "--destroy-key-material") {
+      destroyKeyMaterial = true;
+    } else if (arg === "--prune-signer-runtimes") {
+      pruneSignerRuntimes2 = true;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
     } else if (arg === "--reason") {
       tombstoneReason = requireValue(argv, ++i, arg);
     } else if (arg === "--replaced-by") {
@@ -5215,7 +5684,7 @@ function parseArgs(argv, env = process.env) {
     return { options, help, json, doctor, repair, tombstone, rekey };
   }
   if (replace) {
-    if (rekeyPhase || tombstoneDir || unwire || doctor || repair) {
+    if (rekeyPhase || tombstoneDir || unwire || doctor || repair || pruneSignerRuntimes2) {
       throw new Error("--replace belongs to a --setup run: it says what to do when the bare haven / haven-signer pair is already wired to another agent.");
     }
     if (options.serverName) {
@@ -5225,6 +5694,22 @@ function parseArgs(argv, env = process.env) {
     }
     options.replaceExistingWiring = true;
   }
+  if (destroyKeyMaterial && !unwire) {
+    throw new Error("--destroy-key-material only applies to --unwire.");
+  }
+  if (destroyKeyMaterial && unwire) unwire = { ...unwire, destroyKeyMaterial: true };
+  if (dryRun && !pruneSignerRuntimes2) {
+    throw new Error("--dry-run only applies to --prune-signer-runtimes.");
+  }
+  if (pruneSignerRuntimes2) {
+    if (unwire || tombstoneDir || rekeyPhase || doctor || repair) {
+      throw new Error("--prune-signer-runtimes is its own operation; run it alone.");
+    }
+    if (options.setupToken) {
+      throw new Error("--prune-signer-runtimes takes no --setup token; it reads stored state only.");
+    }
+    return { options, help, json, doctor, repair, tombstone, rekey, unwire, unwireDir, pruneSignerRuntimes: { dryRun } };
+  }
   if (rekey) {
     if (options.setupToken) {
       throw new Error("--rekey replaces an existing agent's key; it does not take --setup. Drop one of them.");
@@ -5319,7 +5804,7 @@ function helpText() {
     "                             Only available for Claude Code and Codex. Default is hosted MCP + local signer.",
     "  --json                     Emit one versioned, secret-free result object on stdout; progress stays on stderr.",
     "  --doctor                   Diagnose an existing setup (read-only, no token): config, credentials,",
-    "                             signer runtime, hosted MCP, and a live signer handshake. Exits non-zero on any failure.",
+    "                             signer runtime, hosted MCP, and a live signer handshake. Exits non-zero only on a failed check; an advisory (!) exits 0.",
     "  --repair                   Repair, then re-diagnose (implies --doctor): reinstall the pinned signer",
     "                             runtime, rewrite the wrapper and runtime config from stored credentials.",
     "                             Hosted topology only (refuses to touch a --local config). No keys, no token.",
@@ -5346,6 +5831,12 @@ function helpText() {
     "                             API key are removed locally (record kept via the #2155 tombstone mirror) and",
     "                             nothing is ever revoked on the backend \u2014 that stays an owner action on the",
     "                             Haven agent page.",
+    "  --destroy-key-material     With --unwire: destroy the signer key + stored API key even when the agent",
+    "                             is still active or cannot be verified (#3123). Local sweep recovery ends.",
+    "  --prune-signer-runtimes    Remove ~/.haven/signer-runtime directories no credential directory references",
+    "                             (version- and override-keyed alike); --dry-run lists them. Exits 1 only on a",
+    "                             removal that failed (#3123).",
+    "  --dry-run                  With --prune-signer-runtimes: report, remove nothing.",
     "  --reason <text>            Reason recorded in the tombstone (with --tombstone or --unwire).",
     "  --replaced-by <agent-id>   Successor agent recorded in the tombstone (with --tombstone or --unwire).",
     "  --help                     Show this help.",
@@ -5388,6 +5879,13 @@ function failSubcommand(io, json, err, envelope, fallback) {
   }
   return 1;
 }
+function levelMarker(level) {
+  return level === "ok" ? "\u2713" : level === "advisory" ? "!" : "\u2717";
+}
+function advisoryCount(report) {
+  const others = report.agents.filter((agent) => agent.classification === "wired" && agent.directory !== report.credentialDirectory).flatMap((agent) => agent.checks);
+  return [...report.checks, ...others].filter((check) => check.level === "advisory").length;
+}
 async function runCli(argv, io = {
   stdout: (message) => process.stdout.write(message),
   stderr: (message) => process.stderr.write(message)
@@ -5415,13 +5913,13 @@ async function runCli(argv, io = {
   }
   if (parsed.tombstone) {
     const { writeAgentTombstone: writeAgentTombstone2 } = await Promise.resolve().then(() => (init_tombstone(), tombstone_exports));
-    const { readFile: readFile14 } = await import('fs/promises');
-    const { join: join12 } = await import('path');
+    const { readFile: readFile15 } = await import('fs/promises');
+    const { join: join13 } = await import('path');
     try {
       let agentId = "unknown";
       try {
         const identity = JSON.parse(
-          await readFile14(join12(parsed.tombstone.directory, "identity.json"), "utf8")
+          await readFile15(join13(parsed.tombstone.directory, "identity.json"), "utf8")
         );
         agentId = identity.agent_id ?? "unknown";
       } catch {
@@ -5459,20 +5957,22 @@ async function runCli(argv, io = {
   }
   if (parsed.unwire) {
     const { unwireAgent: unwireAgent2 } = await Promise.resolve().then(() => (init_unwire(), unwire_exports));
-    const { homedir: homedir10 } = await import('os');
-    const { join: join12 } = await import('path');
-    const homeDir = homedir10();
-    const root = parsed.options.credentialsDir ?? join12(homeDir, ".haven", "agents");
-    const directory = parsed.unwireDir ?? (parsed.options.serverName ? join12(root, parsed.options.serverName) : root);
+    const { homedir: homedir11 } = await import('os');
+    const { join: join13 } = await import('path');
+    const homeDir = homedir11();
+    const root = parsed.options.credentialsDir ?? join13(homeDir, ".haven", "agents");
+    const directory = parsed.unwireDir ?? (parsed.options.serverName ? join13(root, parsed.options.serverName) : root);
     try {
       const result = await unwireAgent2({
         directory,
         slug: parsed.options.serverName,
         reason: parsed.unwire.reason,
         replacedBy: parsed.unwire.replacedBy,
+        destroyKeyMaterial: parsed.unwire.destroyKeyMaterial,
         homeDir
       });
       const failures = result.runtimes.filter((r) => r.status === "refused" || r.status === "unreadable");
+      const retained = result.teardown.status === "retained";
       if (parsed.json) {
         io.stdout(
           `${redactSecrets(
@@ -5487,7 +5987,16 @@ async function runCli(argv, io = {
                 label: r.label,
                 status: r.status,
                 ...r.detail ? { detail: r.detail } : {}
-              }))
+              })),
+              // #3122: additive — whether the local server-name binding record was released.
+              binding_released: result.bindingReleased,
+              // #3123: additive — what happened to the key material and why.
+              teardown: {
+                status: result.teardown.status,
+                probe: result.teardown.probe,
+                detail: result.teardown.detail,
+                ...result.teardown.remedy ? { remedy: result.teardown.remedy } : {}
+              }
             })
           )}
 `
@@ -5503,14 +6012,20 @@ async function runCli(argv, io = {
           io.stdout(redactSecrets(`  ${mark} ${r.label}: ${r.status}${r.detail ? ` \u2014 ${r.detail}` : ""}
 `));
         }
+        io.stdout(result.bindingReleased ? "  \u2713 MCP server-name binding: released (the name is free for the next setup).\n" : "  \u2013 MCP server-name binding: none recorded for this directory.\n");
+        const t = result.teardown;
+        io.stdout(redactSecrets(`  ${t.status === "retained" ? "\u2717" : t.status === "forced" ? "!" : "\u2713"} Key material: ${t.status} (probe: ${t.probe}) \u2014 ${t.detail}
+`));
+        if (t.remedy) io.stdout(redactSecrets(`    \u21B3 ${t.remedy}
+`));
         io.stdout(
-          failures.length > 0 ? "  Some entries were NOT removed (\u2717 above). Re-run `--unwire` after resolving each refusal \u2014\n  it is idempotent.\n" : "  Verify: `--doctor --runtime <runtime>` per host should report this agent as `retired` with a\n  clean runtime-config check.\n"
+          failures.length > 0 ? "  Some entries were NOT removed (\u2717 above). Re-run `--unwire` after resolving each refusal \u2014\n  it is idempotent.\n" : retained ? "  The wiring is gone; the key material is not (\u2717 above). `--doctor` will keep reporting this directory\n  as `superseded` until the key is revoked or destroyed \u2014 that is the honest state.\n" : "  Verify: `--doctor --runtime <runtime>` per host should report this agent as `retired` with a\n  clean runtime-config check.\n"
         );
         io.stdout(
-          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. This directory\u2019s local key material was removed and the tombstone\nrecord + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, revoke the agent on the Haven agent page to stop it spending entirely.\n"
+          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. " + (retained ? "This directory\u2019s local key material was KEPT (see above); the tombstone\n" : "This directory\u2019s local key material was removed and the tombstone\n") + "record + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, revoke the agent on the Haven agent page to stop it spending entirely.\n"
         );
       }
-      return failures.length > 0 ? 1 : 0;
+      return failures.length > 0 || retained ? 1 : 0;
     } catch (err) {
       return failSubcommand(io, parsed.json, err, { unwired: false }, {
         code: "unwire_failed",
@@ -5518,6 +6033,57 @@ async function runCli(argv, io = {
       });
     }
   }
+  if (parsed.pruneSignerRuntimes) {
+    const { pruneSignerRuntimes: pruneSignerRuntimes2 } = await Promise.resolve().then(() => (init_prune_runtimes(), prune_runtimes_exports));
+    try {
+      const report = await pruneSignerRuntimes2(
+        { dryRun: parsed.pruneSignerRuntimes.dryRun },
+        { credentialsDir: parsed.options.credentialsDir }
+      );
+      if (parsed.json) {
+        io.stdout(`${redactSecrets(JSON.stringify({
+          pruned: true,
+          version: report.version,
+          dry_run: report.dryRun,
+          level: report.level,
+          root: report.root,
+          removed: report.removed,
+          reclaimed_bytes: report.reclaimedBytes,
+          entries: report.entries.map((e) => ({
+            key: e.key,
+            kind: e.kind,
+            bytes: e.bytes,
+            action: e.action,
+            level: e.level,
+            referenced_by: e.referencedBy,
+            detail: e.detail
+          }))
+        }))}
+`);
+      } else {
+        io.stdout(`Signer runtimes under ${report.root}${report.dryRun ? " (dry run \u2014 nothing removed)" : ""}:
+`);
+        if (report.entries.length === 0) io.stdout("  (none)\n");
+        for (const e of report.entries) {
+          const mark = e.level === "failed" ? "\u2717" : e.level === "advisory" ? "!" : e.action === "removed" ? "\u2713" : "\u2022";
+          const size = e.bytes > 0 ? `${Math.round(e.bytes / 1024 / 1024)} MB` : e.action === "kept" ? "not sized" : "0 MB";
+          io.stdout(redactSecrets(`  ${mark} ${e.key} (${e.kind}, ${size}): ${e.detail}
+`));
+        }
+        io.stdout(
+          report.dryRun ? `Would remove ${report.entries.filter((e) => e.action === "would_remove").length} director(y/ies); re-run without --dry-run to reclaim.
+` : `Removed ${report.removed} director(y/ies), reclaimed ${Math.round(report.reclaimedBytes / 1024 / 1024)} MB.
+`
+        );
+      }
+      return report.level === "failed" ? 1 : 0;
+    } catch (err) {
+      return failSubcommand(io, parsed.json, err, { pruned: false }, {
+        code: "prune_failed",
+        nextAction: "review_the_error_and_rerun_prune_which_is_idempotent"
+      });
+    }
+  }
   if (parsed.rekey) {
     const { startRekey: startRekey2, finishRekey: finishRekey2 } = await Promise.resolve().then(() => (init_rekey(), rekey_exports));
     const { restartGuidance: restartGuidance2 } = await Promise.resolve().then(() => (init_rekey_restart(), rekey_restart_exports));
@@ -5594,7 +6160,7 @@ async function runCli(argv, io = {
 `);
       } else {
         for (const check of report.checks) {
-          io.stdout(redactSecrets(`${check.ok ? "\u2713" : "\u2717"} ${check.label}: ${check.detail}
+          io.stdout(redactSecrets(`${levelMarker(check.level)} ${check.label}: ${check.detail}
 `));
           if (check.repair) io.stdout(redactSecrets(`    \u21B3 repair: ${check.repair}
 `));
@@ -5604,21 +6170,25 @@ async function runCli(argv, io = {
           io.stdout("\nOther agents on this machine:\n");
           for (const agent of otherAgents) {
             const name = agent.slug ? `${agent.slug} (${agent.agentId ?? "unknown"})` : agent.agentId ?? "unknown";
-            const failed = agent.checks.filter((check) => !check.ok);
-            const verdict = agent.classification === "wired" ? failed.length === 0 ? "wired, all checks passed" : `wired, ${failed.length} check(s) FAILED` : agent.classification === "parked" ? "parked re-key only \u2014 no identity.json in this directory, but key material is still there" : agent.classification;
-            io.stdout(redactSecrets(`  ${failed.length > 0 ? "\u2717" : "\u2022"} ${name}: ${verdict}
+            const failed = agent.checks.filter((check) => check.level === "failed");
+            const advised = agent.checks.filter((check) => check.level === "advisory");
+            const verdict = agent.classification === "wired" ? failed.length > 0 ? `wired, ${failed.length} check(s) FAILED` : advised.length > 0 ? `wired, ${advised.length} advisory finding(s)` : "wired, all checks passed" : agent.classification === "parked" ? "parked re-key only \u2014 no identity.json in this directory, but key material is still there" : agent.classification;
+            io.stdout(redactSecrets(`  ${failed.length > 0 ? "\u2717" : advised.length > 0 ? "!" : "\u2022"} ${name}: ${verdict}
 `));
-            for (const check of failed) {
-              io.stdout(redactSecrets(`      \u2717 ${check.label}: ${check.detail}
+            for (const check of [...failed, ...advised]) {
+              io.stdout(redactSecrets(`      ${levelMarker(check.level)} ${check.label}: ${check.detail}
 `));
               if (check.repair) io.stdout(redactSecrets(`        \u21B3 repair: ${check.repair}
 `));
             }
           }
         }
-        io.stdout(report.ok ? "All checks passed.\n" : "One or more checks FAILED \u2014 see repairs above.\n");
+        io.stdout(
+          report.level === "failed" ? "One or more checks FAILED \u2014 see repairs above.\n" : report.level === "advisory" ? `No failures. ${advisoryCount(report)} advisory finding(s) \u2014 see the ! line(s) above.
+` : "All checks passed.\n"
+        );
       }
-      return report.ok ? 0 : 1;
+      return report.level === "failed" ? 1 : 0;
     } catch (err) {
       return failSubcommand(io, parsed.json, err, { doctor: "failed" }, {
         code: "doctor_failed",