@haven_ai/connect 0.6.0-alpha.0 → 0.8.0-alpha.0

package/README.md

@@ -392,7 +392,8 @@ also yields one rather than failing a completed setup.
 
 **The dashboard offers the revoke, never the connector (#2561).** The same ids
 now ride the install-status report, so the Haven dashboard can put a
-one-click revoke next to the setup that displaced them. The connector does not
+revoke next to the setup that displaced them; it also ends the agent's budget
+with one owner signature (#3542). The connector does not
 and must not do it: `POST /agents/:id/revoke` is owner-authenticated, and an
 agent credential retiring a sibling agent is the "agent editing its own
 authority" the re-key routes refuse. Nothing is revoked automatically — the
@@ -703,6 +704,18 @@ which.
 runtime, rewrite the wrapper + sidecar, and re-write the runtime config from
 the STORED credentials. It never touches keys and never needs a new token.
 
+**Several agents on one machine (#3412).** A repair rewrites the runtime config
+from ONE agent's stored credentials. With more than one agent credential
+directory under `~/.haven/agents` — or when `--doctor` was itself given
+`--credentials-dir` — every repair line the doctor prints names the agent it is
+about with `--credentials-dir <dir>`, and a `--repair` without
+`--credentials-dir` is refused — nothing is changed — with one exact command
+per live agent (its agent id beside it); a retired directory is listed as
+"retired — not a repair target" and never offered. Without that, "the newest directory" was a
+guess, and it re-wired a different agent than the one the doctor described.
+Every "update your signer" hint Haven emits names the flagless
+`npx -y @haven_ai/connect@<channel> --doctor`, which then prints that line.
+
 ## Installing an unpublished signer / SDK / MCP build (`HAVEN_SIGNER_SPEC`, #2424)
 
 Setup installs the connector's **pinned** siblings — `@haven_ai/signer@<pin>`

package/dist/cli.cjs

@@ -620,9 +620,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: mcp.MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.6.0-alpha.0",
+      sdkVersion: "0.8.0-alpha.0",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.6.0-alpha.0",
+      signerVersion: "0.8.0-alpha.0",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -4451,7 +4451,7 @@ var init_runtime = __esm({
     init_tombstone();
     init_local_mcp_runtime();
     init_runtime_manifest();
-    CONNECTOR_VERSION = "0.6.0-alpha.0";
+    CONNECTOR_VERSION = "0.8.0-alpha.0";
     CONNECTOR_CLIENT_IDENTITY = `@haven_ai/connect/${CONNECTOR_VERSION}`;
     CONNECT_OUTCOME_SCHEMA_VERSION = 1;
     failureOutcomesByError = /* @__PURE__ */ new WeakMap();
@@ -4934,9 +4934,23 @@ function rollUpLevel(checks) {
 function runtimeFlagFor(runtime) {
   return normalizeRuntimeName(runtime) ? ` --runtime ${runtime}` : "";
 }
-function repairCommandFor(runtime, suffix = "") {
-  if (normalizeRuntimeName(runtime)) return `Run: ${RERUN} --doctor --repair --runtime ${runtime}${suffix}`;
-  return `Run: ${RERUN} --doctor --repair --runtime <runtime>${suffix.replace(/\.$/, "")} \u2014 --repair needs the runtime named; one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`;
+async function pathExists3(path) {
+  try {
+    await promises.stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function credentialsDirFlagFor(credentialsDir) {
+  if (!credentialsDir) return "";
+  const quoted = /^[\w@%+=:,./~-]+$/.test(credentialsDir) ? credentialsDir : `'${credentialsDir.replace(/'/g, `'\\''`)}'`;
+  return ` --credentials-dir ${quoted}`;
+}
+function repairCommandFor(runtime, suffix = "", credentialsDir) {
+  const dirFlag = credentialsDirFlagFor(credentialsDir);
+  if (normalizeRuntimeName(runtime)) return `Run: ${RERUN} --doctor --repair --runtime ${runtime}${dirFlag}${suffix}`;
+  return `Run: ${RERUN} --doctor --repair --runtime <runtime>${dirFlag}${suffix.replace(/\.$/, "")} \u2014 --repair needs the runtime named; one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`;
 }
 async function resolveDoctorRuntime(input, directory) {
   const explicit = input.runtime.trim();
@@ -4955,45 +4969,47 @@ async function discoverCredentialDirectory(homeDir, explicit) {
   try {
     entries = await promises.readdir(root);
   } catch {
-    return explicit ? { directory: explicit, others: [], parkedOnly: /* @__PURE__ */ new Set() } : { others: [], parkedOnly: /* @__PURE__ */ new Set() };
+    return explicit ? { directory: explicit, others: [], parkedOnly: /* @__PURE__ */ new Set(), identityDirectories: [explicit] } : { others: [], parkedOnly: /* @__PURE__ */ new Set(), identityDirectories: [] };
   }
   const candidates = [];
   const tombstonedOnly = [];
   const parkedOnly = [];
   for (const entry of entries) {
     const directory = path.join(root, entry);
+    if (await pathExists3(path.join(directory, TOMBSTONE_FILENAME))) {
+      tombstonedOnly.push(directory);
+      continue;
+    }
     try {
       const s = await promises.stat(path.join(directory, "identity.json"));
       candidates.push({ directory, mtimeMs: s.mtimeMs });
     } catch {
       try {
-        await promises.stat(path.join(directory, TOMBSTONE_FILENAME));
-        tombstonedOnly.push(directory);
+        await promises.stat(path.join(directory, REKEY_PENDING_FILENAME));
+        parkedOnly.push(directory);
       } catch {
-        try {
-          await promises.stat(path.join(directory, REKEY_PENDING_FILENAME));
-          parkedOnly.push(directory);
-        } catch {
-        }
       }
     }
   }
   const parkedOnlySet = new Set(parkedOnly);
   candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const identityDirectories = candidates.map((c) => c.directory);
   if (explicit) {
     return {
       directory: explicit,
       others: [...candidates.map((c) => c.directory), ...tombstonedOnly, ...parkedOnly].filter((d) => d !== explicit),
-      parkedOnly: parkedOnlySet
+      parkedOnly: parkedOnlySet,
+      identityDirectories: [explicit, ...identityDirectories.filter((d) => d !== explicit)]
     };
   }
   if (candidates.length === 0 && tombstonedOnly.length === 0 && parkedOnly.length === 0) {
-    return { others: [], parkedOnly: parkedOnlySet };
+    return { others: [], parkedOnly: parkedOnlySet, identityDirectories };
   }
   return {
     directory: candidates[0]?.directory,
     others: [...candidates.slice(1).map((c) => c.directory), ...tombstonedOnly, ...parkedOnly],
-    parkedOnly: parkedOnlySet
+    parkedOnly: parkedOnlySet,
+    identityDirectories
   };
 }
 function agentIsWired(configText, names, slug, identity, sidecar, isPrimary, bareOwnerExists) {
@@ -5052,7 +5068,7 @@ function rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug) {
     detail: `A re-key started ${started} is still open (expires ${status.expiresAt ?? "unknown"}). Paste this address into "Replace signing key" on the Haven agent page: ${address}. Parked at ${status.path}. ` + wedgeNote
   };
 }
-async function runtimeSpecOverrideCheck(directory, sidecar, env) {
+async function runtimeSpecOverrideCheck(directory, sidecar, env, repairDir) {
   const facts = [];
   const installed = sidecar?.runtime_spec_override;
   if (installed) {
@@ -5081,7 +5097,7 @@ async function runtimeSpecOverrideCheck(directory, sidecar, env) {
     label: "Runtime spec override",
     level: "failed",
     detail: `runtime spec overridden \u2014 not the pinned manifest (${MCP_RUNTIME_MANIFEST.signerPackage}@${MCP_RUNTIME_MANIFEST.signerVersion}, ${MCP_RUNTIME_MANIFEST.sdkPackage}@${MCP_RUNTIME_MANIFEST.sdkVersion}). ${facts.join(". ")}.`,
-    repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>. If the override is intentional, this finding is the record of it.`
+    repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>${credentialsDirFlagFor(repairDir)}. If the override is intentional, this finding is the record of it.`
   });
 }
 async function readMcpSidecarOverride(directory) {
@@ -5140,7 +5156,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: "failed",
       detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-      repair: repairCommandFor(input.runtime)
+      repair: repairCommandFor(input.runtime, "", input.repairDir)
     });
   } else if (sidecar.runtime_spec_override) {
     const matches = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -5152,7 +5168,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: matches ? "ok" : "failed",
       detail: matches ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory} (override install \u2014 see runtime_spec_override)` : `Override runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...matches ? {} : { repair: repairCommandFor(input.runtime, " with the same HAVEN_*_SPEC variables set.") }
+      ...matches ? {} : { repair: repairCommandFor(input.runtime, " with the same HAVEN_*_SPEC variables set.", input.repairDir) }
     });
   } else {
     const intact = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -5166,10 +5182,10 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: ok ? "ok" : intact ? "advisory" : "failed",
       detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : intact ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion} \u2014 intact, but outdated.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...ok ? {} : { repair: repairCommandFor(input.runtime) }
+      ...ok ? {} : { repair: repairCommandFor(input.runtime, "", input.repairDir) }
     });
   }
-  const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env);
+  const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env, input.repairDir);
   if (overrideCheck) checks.push(overrideCheck);
   const hostedUrl = identity?.hosted_mcp_url ?? (identity?.api_url ? `${identity.api_url}/mcp` : void 0);
   if (identity?.api_key && hostedUrl) {
@@ -5259,7 +5275,7 @@ async function verdictsForAgent(entry, input, deps) {
         label: "Signer stdio handshake",
         level: probe.status === "ok" ? "ok" : "failed",
         detail: probe.status === "ok" ? `Signer started, listed ${probe.toolNames?.length ?? 0} tools${probe.serverInfo?.version ? ` (v${probe.serverInfo.version})` : ""}.${compatDetail}` : `Handshake failed: ${probe.status}.`,
-        ...probe.status === "ok" ? {} : { repair: repairCommandFor(input.runtime) }
+        ...probe.status === "ok" ? {} : { repair: repairCommandFor(input.runtime, "", input.repairDir) }
       });
     }
   } else {
@@ -5268,7 +5284,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer stdio handshake",
       level: "failed",
       detail: "Skipped \u2014 no prepared signer runtime to probe.",
-      repair: repairCommandFor(input.runtime)
+      repair: repairCommandFor(input.runtime, "", input.repairDir)
     });
   }
   return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
@@ -5277,7 +5293,8 @@ async function runDoctor(input, deps = {}) {
   const homeDir = deps.homeDir ?? os.homedir();
   const checks = [];
   let signerCapabilities;
-  const { directory, others, parkedOnly } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const { directory, others, parkedOnly, identityDirectories } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const nameRepairDir = identityDirectories.length > 1 || Boolean(input.credentialsDir);
   const resolution = await resolveDoctorRuntime(input, directory);
   const runtime = resolution.runtime;
   const input2 = { ...input, runtime };
@@ -5334,7 +5351,11 @@ async function runDoctor(input, deps = {}) {
       ...rekeyPending ? { rekeyPending } : {}
     };
     if (wired) {
-      const result = await checksForAgent({ directory: dir, identity, sidecar }, input2, deps);
+      const result = await checksForAgent(
+        { directory: dir, identity, sidecar },
+        { ...input2, ...nameRepairDir ? { repairDir: dir } : {} },
+        deps
+      );
       entry.checks = result.checks;
       capabilitiesByDirectory.set(dir, result.signerCapabilities);
     } else if (rekeyPending) {
@@ -5363,7 +5384,7 @@ async function runDoctor(input, deps = {}) {
     if (!primaryChecksById.has("credentials")) {
       const result = await checksForAgent(
         { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
-        input2,
+        { ...input2, ...nameRepairDir ? { repairDir: primaryDirectory } : {} },
         deps
       );
       signerCapabilities = result.signerCapabilities;
@@ -5404,7 +5425,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       level: "failed",
       detail: `No runtime config at ${configPath}.`,
-      repair: repairCommandFor(input2.runtime)
+      repair: repairCommandFor(input2.runtime, "", nameRepairDir ? primaryDirectory : void 0)
     });
   } else {
     const primaryIdentity = await readIdentity(primaryDirectory ?? "");
@@ -5418,7 +5439,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       level: ok ? "ok" : "failed",
       detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-      ...ok ? {} : { repair: repairCommandFor(input2.runtime) }
+      ...ok ? {} : { repair: repairCommandFor(input2.runtime, "", nameRepairDir ? primaryDirectory : void 0) }
     });
   }
   for (const id of ["hosted_mcp", "identity_match", "rekey_pending"]) {
@@ -5561,7 +5582,25 @@ async function runDoctor(input, deps = {}) {
 async function runRepair(input, deps = {}) {
   const homeDir = deps.homeDir ?? os.homedir();
   const messages = [];
-  const { directory, others } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const { directory, others, identityDirectories } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  if (!input.credentialsDir && identityDirectories.length > 1) {
+    const lines = await Promise.all(
+      identityDirectories.map(async (dir) => {
+        const identity2 = await readIdentity(dir);
+        const who = identity2?.agent_id ? `agent ${identity2.agent_id}` : "agent (no agent_id recorded)";
+        const retired = !identity2?.api_key || await pathExists3(path.join(dir, TOMBSTONE_FILENAME));
+        return retired ? `  \u2022 ${who} (${dir}): retired \u2014 not a repair target` : `  \u2022 ${who}: ${repairCommandFor(input.runtime, "", dir).replace(/^Run: /, "")}`;
+      })
+    );
+    return {
+      ok: false,
+      messages: [
+        `${identityDirectories.length} agent credential directories exist on this machine, and a repair rewrites the runtime config from ONE of them. Name the agent to repair with --credentials-dir \u2014 nothing was changed:`,
+        ...lines,
+        "Not sure which agent is which? Compare the agent ids against the Haven agent page, or run --doctor first."
+      ]
+    };
+  }
   if (others.length > 0) {
     messages.push(`Note: ${others.length} other agent credential dir(s) exist \u2014 run --doctor for their status.`);
   }