@haven_ai/connect 0.6.0-alpha.0 → 0.8.0-alpha.0

package/dist/cli.js

@@ -613,9 +613,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.6.0-alpha.0",
+      sdkVersion: "0.8.0-alpha.0",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.6.0-alpha.0",
+      signerVersion: "0.8.0-alpha.0",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -4444,7 +4444,7 @@ var init_runtime = __esm({
     init_tombstone();
     init_local_mcp_runtime();
     init_runtime_manifest();
-    CONNECTOR_VERSION = "0.6.0-alpha.0";
+    CONNECTOR_VERSION = "0.8.0-alpha.0";
     CONNECTOR_CLIENT_IDENTITY = `@haven_ai/connect/${CONNECTOR_VERSION}`;
     CONNECT_OUTCOME_SCHEMA_VERSION = 1;
     failureOutcomesByError = /* @__PURE__ */ new WeakMap();
@@ -4927,9 +4927,23 @@ function rollUpLevel(checks) {
 function runtimeFlagFor(runtime) {
   return normalizeRuntimeName(runtime) ? ` --runtime ${runtime}` : "";
 }
-function repairCommandFor(runtime, suffix = "") {
-  if (normalizeRuntimeName(runtime)) return `Run: ${RERUN} --doctor --repair --runtime ${runtime}${suffix}`;
-  return `Run: ${RERUN} --doctor --repair --runtime <runtime>${suffix.replace(/\.$/, "")} \u2014 --repair needs the runtime named; one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`;
+async function pathExists3(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function credentialsDirFlagFor(credentialsDir) {
+  if (!credentialsDir) return "";
+  const quoted = /^[\w@%+=:,./~-]+$/.test(credentialsDir) ? credentialsDir : `'${credentialsDir.replace(/'/g, `'\\''`)}'`;
+  return ` --credentials-dir ${quoted}`;
+}
+function repairCommandFor(runtime, suffix = "", credentialsDir) {
+  const dirFlag = credentialsDirFlagFor(credentialsDir);
+  if (normalizeRuntimeName(runtime)) return `Run: ${RERUN} --doctor --repair --runtime ${runtime}${dirFlag}${suffix}`;
+  return `Run: ${RERUN} --doctor --repair --runtime <runtime>${dirFlag}${suffix.replace(/\.$/, "")} \u2014 --repair needs the runtime named; one of: ${RUNTIME_FLAG_VALUE_LIST.join(", ")}.`;
 }
 async function resolveDoctorRuntime(input, directory) {
   const explicit = input.runtime.trim();
@@ -4948,45 +4962,47 @@ async function discoverCredentialDirectory(homeDir, explicit) {
   try {
     entries = await readdir(root);
   } catch {
-    return explicit ? { directory: explicit, others: [], parkedOnly: /* @__PURE__ */ new Set() } : { others: [], parkedOnly: /* @__PURE__ */ new Set() };
+    return explicit ? { directory: explicit, others: [], parkedOnly: /* @__PURE__ */ new Set(), identityDirectories: [explicit] } : { others: [], parkedOnly: /* @__PURE__ */ new Set(), identityDirectories: [] };
   }
   const candidates = [];
   const tombstonedOnly = [];
   const parkedOnly = [];
   for (const entry of entries) {
     const directory = join(root, entry);
+    if (await pathExists3(join(directory, TOMBSTONE_FILENAME))) {
+      tombstonedOnly.push(directory);
+      continue;
+    }
     try {
       const s = await stat(join(directory, "identity.json"));
       candidates.push({ directory, mtimeMs: s.mtimeMs });
     } catch {
       try {
-        await stat(join(directory, TOMBSTONE_FILENAME));
-        tombstonedOnly.push(directory);
+        await stat(join(directory, REKEY_PENDING_FILENAME));
+        parkedOnly.push(directory);
       } catch {
-        try {
-          await stat(join(directory, REKEY_PENDING_FILENAME));
-          parkedOnly.push(directory);
-        } catch {
-        }
       }
     }
   }
   const parkedOnlySet = new Set(parkedOnly);
   candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const identityDirectories = candidates.map((c) => c.directory);
   if (explicit) {
     return {
       directory: explicit,
       others: [...candidates.map((c) => c.directory), ...tombstonedOnly, ...parkedOnly].filter((d) => d !== explicit),
-      parkedOnly: parkedOnlySet
+      parkedOnly: parkedOnlySet,
+      identityDirectories: [explicit, ...identityDirectories.filter((d) => d !== explicit)]
     };
   }
   if (candidates.length === 0 && tombstonedOnly.length === 0 && parkedOnly.length === 0) {
-    return { others: [], parkedOnly: parkedOnlySet };
+    return { others: [], parkedOnly: parkedOnlySet, identityDirectories };
   }
   return {
     directory: candidates[0]?.directory,
     others: [...candidates.slice(1).map((c) => c.directory), ...tombstonedOnly, ...parkedOnly],
-    parkedOnly: parkedOnlySet
+    parkedOnly: parkedOnlySet,
+    identityDirectories
   };
 }
 function agentIsWired(configText, names, slug, identity, sidecar, isPrimary, bareOwnerExists) {
@@ -5045,7 +5061,7 @@ function rekeyPendingVerdict(status, hostedDelegateAddress, runtime, slug) {
     detail: `A re-key started ${started} is still open (expires ${status.expiresAt ?? "unknown"}). Paste this address into "Replace signing key" on the Haven agent page: ${address}. Parked at ${status.path}. ` + wedgeNote
   };
 }
-async function runtimeSpecOverrideCheck(directory, sidecar, env) {
+async function runtimeSpecOverrideCheck(directory, sidecar, env, repairDir) {
   const facts = [];
   const installed = sidecar?.runtime_spec_override;
   if (installed) {
@@ -5074,7 +5090,7 @@ async function runtimeSpecOverrideCheck(directory, sidecar, env) {
     label: "Runtime spec override",
     level: "failed",
     detail: `runtime spec overridden \u2014 not the pinned manifest (${MCP_RUNTIME_MANIFEST.signerPackage}@${MCP_RUNTIME_MANIFEST.signerVersion}, ${MCP_RUNTIME_MANIFEST.sdkPackage}@${MCP_RUNTIME_MANIFEST.sdkVersion}). ${facts.join(". ")}.`,
-    repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>. If the override is intentional, this finding is the record of it.`
+    repair: `Developer override (#2424). To return to the pinned manifest: unset ${variables}, then run ${RERUN} --doctor --repair --runtime <runtime>${credentialsDirFlagFor(repairDir)}. If the override is intentional, this finding is the record of it.`
   });
 }
 async function readMcpSidecarOverride(directory) {
@@ -5133,7 +5149,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: "failed",
       detail: "No signer-runtime.json sidecar \u2014 the pinned signer runtime was never prepared (or a pre-#1586 npx config).",
-      repair: repairCommandFor(input.runtime)
+      repair: repairCommandFor(input.runtime, "", input.repairDir)
     });
   } else if (sidecar.runtime_spec_override) {
     const matches = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -5145,7 +5161,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: matches ? "ok" : "failed",
       detail: matches ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory} (override install \u2014 see runtime_spec_override)` : `Override runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...matches ? {} : { repair: repairCommandFor(input.runtime, " with the same HAVEN_*_SPEC variables set.") }
+      ...matches ? {} : { repair: repairCommandFor(input.runtime, " with the same HAVEN_*_SPEC variables set.", input.repairDir) }
     });
   } else {
     const intact = await installedRuntimeMatchesVersions(sidecar.runtime_directory, sidecar.cli_path, {
@@ -5159,10 +5175,10 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer runtime (preinstalled wrapper)",
       level: ok ? "ok" : intact ? "advisory" : "failed",
       detail: ok ? `Installed ${sidecar.signer_package}@${sidecar.signer_version} at ${sidecar.runtime_directory}` : intact ? `Installed version ${sidecar.signer_version} does not match the connector's pinned ${MCP_RUNTIME_MANIFEST.signerVersion} \u2014 intact, but outdated.` : `Runtime directory is stale or empty (${sidecar.runtime_directory}) \u2014 the CLI or package versions are missing.`,
-      ...ok ? {} : { repair: repairCommandFor(input.runtime) }
+      ...ok ? {} : { repair: repairCommandFor(input.runtime, "", input.repairDir) }
     });
   }
-  const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env);
+  const overrideCheck = await runtimeSpecOverrideCheck(directory, sidecar, deps.env ?? process.env, input.repairDir);
   if (overrideCheck) checks.push(overrideCheck);
   const hostedUrl = identity?.hosted_mcp_url ?? (identity?.api_url ? `${identity.api_url}/mcp` : void 0);
   if (identity?.api_key && hostedUrl) {
@@ -5252,7 +5268,7 @@ async function verdictsForAgent(entry, input, deps) {
         label: "Signer stdio handshake",
         level: probe.status === "ok" ? "ok" : "failed",
         detail: probe.status === "ok" ? `Signer started, listed ${probe.toolNames?.length ?? 0} tools${probe.serverInfo?.version ? ` (v${probe.serverInfo.version})` : ""}.${compatDetail}` : `Handshake failed: ${probe.status}.`,
-        ...probe.status === "ok" ? {} : { repair: repairCommandFor(input.runtime) }
+        ...probe.status === "ok" ? {} : { repair: repairCommandFor(input.runtime, "", input.repairDir) }
       });
     }
   } else {
@@ -5261,7 +5277,7 @@ async function verdictsForAgent(entry, input, deps) {
       label: "Signer stdio handshake",
       level: "failed",
       detail: "Skipped \u2014 no prepared signer runtime to probe.",
-      repair: repairCommandFor(input.runtime)
+      repair: repairCommandFor(input.runtime, "", input.repairDir)
     });
   }
   return { checks, ...signerCapabilities ? { signerCapabilities } : {} };
@@ -5270,7 +5286,8 @@ async function runDoctor(input, deps = {}) {
   const homeDir = deps.homeDir ?? homedir();
   const checks = [];
   let signerCapabilities;
-  const { directory, others, parkedOnly } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const { directory, others, parkedOnly, identityDirectories } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const nameRepairDir = identityDirectories.length > 1 || Boolean(input.credentialsDir);
   const resolution = await resolveDoctorRuntime(input, directory);
   const runtime = resolution.runtime;
   const input2 = { ...input, runtime };
@@ -5327,7 +5344,11 @@ async function runDoctor(input, deps = {}) {
       ...rekeyPending ? { rekeyPending } : {}
     };
     if (wired) {
-      const result = await checksForAgent({ directory: dir, identity, sidecar }, input2, deps);
+      const result = await checksForAgent(
+        { directory: dir, identity, sidecar },
+        { ...input2, ...nameRepairDir ? { repairDir: dir } : {} },
+        deps
+      );
       entry.checks = result.checks;
       capabilitiesByDirectory.set(dir, result.signerCapabilities);
     } else if (rekeyPending) {
@@ -5356,7 +5377,7 @@ async function runDoctor(input, deps = {}) {
     if (!primaryChecksById.has("credentials")) {
       const result = await checksForAgent(
         { directory: primaryDirectory, identity: primaryIdentity, sidecar: primarySidecar },
-        input2,
+        { ...input2, ...nameRepairDir ? { repairDir: primaryDirectory } : {} },
         deps
       );
       signerCapabilities = result.signerCapabilities;
@@ -5397,7 +5418,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       level: "failed",
       detail: `No runtime config at ${configPath}.`,
-      repair: repairCommandFor(input2.runtime)
+      repair: repairCommandFor(input2.runtime, "", nameRepairDir ? primaryDirectory : void 0)
     });
   } else {
     const primaryIdentity = await readIdentity(primaryDirectory ?? "");
@@ -5411,7 +5432,7 @@ async function runDoctor(input, deps = {}) {
       label: "Runtime MCP config",
       level: ok ? "ok" : "failed",
       detail: ok ? `Config at ${configPath} references the hosted server and the prepared signer wrapper.` : signerViaNpx ? `Config at ${configPath} still launches the signer via npx \u2014 the pre-#1586 shape that cannot start under a 120s startup timeout.` : `Config at ${configPath} is missing the Haven entries${primarySidecar && !wrapperReferenced ? " (or references a different signer wrapper)" : ""}.`,
-      ...ok ? {} : { repair: repairCommandFor(input2.runtime) }
+      ...ok ? {} : { repair: repairCommandFor(input2.runtime, "", nameRepairDir ? primaryDirectory : void 0) }
     });
   }
   for (const id of ["hosted_mcp", "identity_match", "rekey_pending"]) {
@@ -5554,7 +5575,25 @@ async function runDoctor(input, deps = {}) {
 async function runRepair(input, deps = {}) {
   const homeDir = deps.homeDir ?? homedir();
   const messages = [];
-  const { directory, others } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  const { directory, others, identityDirectories } = await discoverCredentialDirectory(homeDir, input.credentialsDir);
+  if (!input.credentialsDir && identityDirectories.length > 1) {
+    const lines = await Promise.all(
+      identityDirectories.map(async (dir) => {
+        const identity2 = await readIdentity(dir);
+        const who = identity2?.agent_id ? `agent ${identity2.agent_id}` : "agent (no agent_id recorded)";
+        const retired = !identity2?.api_key || await pathExists3(join(dir, TOMBSTONE_FILENAME));
+        return retired ? `  \u2022 ${who} (${dir}): retired \u2014 not a repair target` : `  \u2022 ${who}: ${repairCommandFor(input.runtime, "", dir).replace(/^Run: /, "")}`;
+      })
+    );
+    return {
+      ok: false,
+      messages: [
+        `${identityDirectories.length} agent credential directories exist on this machine, and a repair rewrites the runtime config from ONE of them. Name the agent to repair with --credentials-dir \u2014 nothing was changed:`,
+        ...lines,
+        "Not sure which agent is which? Compare the agent ids against the Haven agent page, or run --doctor first."
+      ]
+    };
+  }
   if (others.length > 0) {
     messages.push(`Note: ${others.length} other agent credential dir(s) exist \u2014 run --doctor for their status.`);
   }