@haven_ai/connect 0.8.1-alpha.0 → 0.9.0-alpha.0

package/dist/index.js

@@ -317,6 +317,19 @@ async function readStoredCredentials(serverName, agentIdOrSlug, baseDir) {
       `No Haven credentials at ${directory}. Nothing to re-key \u2014 connect this agent first, or pass the --name you wired it under.`
     );
   }
+  let discoveredSlug;
+  if (!key) {
+    const binding = await readJsonFile(join(directory, "mcp-server-binding.json"));
+    const hostedName = binding && typeof binding === "object" ? asString(binding.server_name) : void 0;
+    if (hostedName && hostedName.startsWith("haven-")) {
+      const slug = hostedName.slice("haven-".length);
+      try {
+        assertValidServerSlug(slug);
+        discoveredSlug = slug;
+      } catch {
+      }
+    }
+  }
   const agent = await readJsonFile(join(directory, "agent.json")) ?? {};
   const signer = await readJsonFile(join(directory, "signer.json")) ?? {};
   const agentId = asString(identity.agent_id);
@@ -332,6 +345,7 @@ async function readStoredCredentials(serverName, agentIdOrSlug, baseDir) {
     directory,
     agentId,
     apiKey,
+    ...discoveredSlug ? { discoveredSlug } : {},
     apiUrl,
     hostedMcpUrl,
     delegateAddress: asString(agent.delegate_address) ?? asString(signer.delegate_address),
@@ -360,7 +374,9 @@ async function discoverSoleAgentDirectory(baseDir) {
   const candidates = [];
   for (const entry of entries) {
     const directory = join(root, entry);
-    if (!await readJsonFile(join(directory, "identity.json"))) continue;
+    const identity = await readJsonFile(join(directory, "identity.json"));
+    if (!identity) continue;
+    if (!asString(identity.api_key)) continue;
     if (await readJsonFile(join(directory, "TOMBSTONE.json"))) continue;
     candidates.push(directory);
   }
@@ -590,6 +606,7 @@ async function listMcpServerBindings(baseDir, excludeDirectory) {
 var REKEY_PENDING_FILENAME, REKEY_PENDING_TTL_MS, CONNECT_OUTCOME_FILENAME, MCP_SERVER_BINDING_FILENAME;
 var init_storage = __esm({
   "src/storage.ts"() {
+    init_server_names();
     REKEY_PENDING_FILENAME = "rekey-pending.json";
     REKEY_PENDING_TTL_MS = 24 * 60 * 60 * 1e3;
     CONNECT_OUTCOME_FILENAME = "last-connect-outcome.json";
@@ -612,9 +629,9 @@ var init_runtime_manifest = __esm({
       mcpPackage: "@haven_ai/mcp",
       mcpVersion: MCP_VERSION,
       sdkPackage: "@haven_ai/sdk",
-      sdkVersion: "0.8.1-alpha.0",
+      sdkVersion: "0.9.0-alpha.0",
       signerPackage: "@haven_ai/signer",
-      signerVersion: "0.8.1-alpha.0",
+      signerVersion: "0.9.0-alpha.0",
       // Sourced from the SDK, never a literal (#1161). This field read '20.0.0'
       // while every package's `engines` said `>=24` and the docs said `>=24.0.0`,
       // so the guard that was supposed to enforce the floor waved Node v23 through
@@ -1027,7 +1044,9 @@ async function writeHermesConfig(input, deps) {
       restartRequired: true,
       messages: [
         `Updated Haven MCP entries in ${target}; stored the hosted MCP identity in ${envTarget}.`,
-        "Restart Hermes (start a new session; gateway users: /restart), then verify with `hermes mcp list`, `hermes mcp test haven`, and `hermes mcp test haven-signer`.",
+        // #3737: name the pair actually written — a bare run prints exactly the
+        // historical sentence; a named run names its own pair.
+        `Restart Hermes (start a new session; gateway users: /restart), then verify with \`hermes mcp list\`, \`hermes mcp test ${names.hosted}\`, and \`hermes mcp test ${names.signer}\`.`,
         "If several long-lived Hermes processes are running (a gateway plus TUI workers), restart EVERY one: each loads its MCP wiring at startup, so a process started before this setup keeps using its old snapshot.",
         "If no mcp_* tools appear after restart, ensure the MCP SDK is installed in Hermes: pip install mcp"
       ]
@@ -2995,9 +3014,23 @@ function installedClientTargets(homeDir = homedir(), cwd = process.cwd(), env =
       runtime: "claude-code",
       label: "Claude Code",
       // Claude Code is configured through its own CLI (`claude mcp add-json`),
-      // not by writing a file this module owns — so its evidence is the
-      // client directory, never a config path.
+      // not by writing a file this module owns — so `configPath` stays null
+      // and the write still goes through the CLI. But a user-scope
+      // `~/.claude.json` carrying an `mcpServers` key IS config-file
+      // evidence: the user has already pointed Claude Code at some MCP
+      // server. It is not the file the connector would write, hence the
+      // separate evidence path (#3732): without it, a Codex config won by
+      // construction on any machine where the user runs Claude Code.
       configPath: null,
+      evidencePath: join(homeDir, ".claude.json"),
+      evidenceMatches: (contents) => {
+        try {
+          const parsed = JSON.parse(contents);
+          return typeof parsed === "object" && parsed !== null && "mcpServers" in parsed;
+        } catch {
+          return false;
+        }
+      },
       markers: [join(homeDir, ".claude"), join(homeDir, ".claude.json")]
     },
     {
@@ -3029,7 +3062,10 @@ function installedClientTargets(homeDir = homedir(), cwd = process.cwd(), env =
     },
     {
       runtime: "claude-desktop",
-      label: "Claude Desktop",
+      // The chat app, a separate runtime from Claude Code. Named so a user in
+      // the desktop app's Code tab cannot read this row as "where I am" —
+      // it sorted above Claude Code whenever both had config (#3732).
+      label: "Claude Desktop (chat app)",
       configPath: runtimeConfigPathFor("claude-desktop", homeDir),
       markers: []
     },
@@ -3044,6 +3080,7 @@ function installedClientTargets(homeDir = homedir(), cwd = process.cwd(), env =
 }
 async function scanInstalledClients(options = {}) {
   const exists = options.exists ?? pathExists;
+  const readFile15 = options.readFile ?? ((path) => readFile(path, "utf8"));
   const targets = installedClientTargets(options.homeDir, options.cwd, options.env ?? process.env);
   const found = [];
   for (const target of targets) {
@@ -3053,6 +3090,18 @@ async function scanInstalledClients(options = {}) {
         label: target.label,
         detail: `MCP config found at ${target.configPath}`,
         configPath: target.configPath,
+        evidencePath: target.configPath,
+        evidence: "config-file"
+      });
+      continue;
+    }
+    if (target.evidencePath && await hasConfigEvidence(target, exists, readFile15)) {
+      found.push({
+        runtime: target.runtime,
+        label: target.label,
+        detail: `MCP config found at ${target.evidencePath}`,
+        configPath: target.configPath,
+        evidencePath: target.evidencePath,
         evidence: "config-file"
       });
       continue;
@@ -3064,6 +3113,7 @@ async function scanInstalledClients(options = {}) {
         label: target.label,
         detail: `installed (${marker})`,
         configPath: target.configPath,
+        evidencePath: null,
         evidence: "client-directory"
       });
       break;
@@ -3074,6 +3124,16 @@ async function scanInstalledClients(options = {}) {
     return SCAN_ORDER.indexOf(a.runtime) - SCAN_ORDER.indexOf(b.runtime);
   });
 }
+async function hasConfigEvidence(target, exists, readFile15) {
+  const path = target.evidencePath;
+  if (!await exists(path)) return false;
+  if (!target.evidenceMatches) return true;
+  try {
+    return target.evidenceMatches(await readFile15(path));
+  } catch {
+    return false;
+  }
+}
 function installedClientHint(candidates) {
   const installedClients = candidates.map((candidate) => candidate.runtime);
   if (candidates.length === 1) {
@@ -3084,18 +3144,24 @@ function installedClientHint(candidates) {
 }
 async function promptForInstalledClient(candidates, io = defaultPromptIo()) {
   if (candidates.length === 0) throw noInstalledClientsError();
+  const hint = installedClientHint(candidates);
   io.write("Haven could not detect which agent runtime this is.\n");
   io.write("These agent clients are installed on this machine:\n");
   candidates.forEach((candidate, index) => {
-    io.write(`  ${index + 1}) ${candidate.label} \u2014 ${candidate.detail}
+    const suggested = hint.suggestedRuntime === candidate.runtime ? " (suggested)" : "";
+    io.write(`  ${index + 1}) ${candidate.label}${suggested} \u2014 ${candidate.detail}
 `);
   });
   io.write("Haven writes an API key and a signing key into the client you pick, so pick the one your agent actually runs in.\n");
   for (let attempt = 0; attempt < MAX_PROMPT_ATTEMPTS; attempt += 1) {
-    const answer = await io.question(`Which one? [1-${candidates.length}] (default 1 \u2014 ${candidates[0].label}): `);
+    const answer = await io.question(`Which one? [1-${candidates.length}]: `);
     if (answer === null) throw promptAbortedError("the prompt was cancelled");
     const trimmed = answer.trim();
-    if (trimmed === "") return candidates[0].runtime;
+    if (trimmed === "") {
+      io.write(`Type the number of the client to configure (1-${candidates.length}).
+`);
+      continue;
+    }
     const picked = Number.parseInt(trimmed, 10);
     if (Number.isInteger(picked) && picked >= 1 && picked <= candidates.length) {
       return candidates[picked - 1].runtime;
@@ -3337,17 +3403,45 @@ async function detectWiringCollision(input) {
     suggestedServerName: proposeServerSlug(input.agentName, taken)
   };
 }
-function proposeServerSlug(agentName, taken) {
-  let base = agentName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 32).replace(/-+$/g, "");
+function proposeServerSlug(agentName, taken, maxBaseLength = 32) {
+  let base = agentName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, maxBaseLength).replace(/-+$/g, "");
   if (!slugIsValid(base)) base = "agent";
   if (!taken.has(base)) return base;
   for (let n = 2; n < 1e3; n += 1) {
     const suffix = `-${n}`;
-    const candidate = `${base.slice(0, 32 - suffix.length).replace(/-+$/g, "")}${suffix}`;
+    const candidate = `${base.slice(0, maxBaseLength - suffix.length).replace(/-+$/g, "")}${suffix}`;
     if (slugIsValid(candidate) && !taken.has(candidate)) return candidate;
   }
   throw new Error(`Could not propose an unused server name for ${JSON.stringify(agentName)}.`);
 }
+function deriveServerSlug(agentName, taken, markNonProduction) {
+  const mark = "-dev";
+  if (!markNonProduction) return proposeServerSlug(agentName, taken);
+  const base = proposeServerSlug(agentName, taken, 32 - mark.length);
+  if (base.endsWith(mark)) return base;
+  const marked = `${base}${mark}`;
+  if (!taken.has(marked)) return marked;
+  return proposeServerSlug(marked, taken);
+}
+async function listTakenDirectoryNames(credentialsDir) {
+  const root = defaultCredentialRoot(credentialsDir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  const taken = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    try {
+      if (!(await stat(join(root, entry))).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    taken.add(entry);
+  }
+  return taken;
+}
 function slugIsValid(slug) {
   try {
     assertValidServerSlug(slug);
@@ -3363,7 +3457,7 @@ async function promptWiringCollisionResolution(collision, agentName, io) {
   io.write(`Setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring.
 `);
   io.write("  r) replace \u2014 re-point haven / haven-signer at the new agent and retire the previous directory locally\n");
-  io.write("     (tombstoned, local key files removed; you still revoke it on the Haven agent page)\n");
+  io.write("     (tombstoned, local key files removed; you still use Remove agent\u2026 on the Haven agent page)\n");
   io.write(`  a) alongside \u2014 install as a named agent (suggested: ${collision.suggestedServerName}) with its own
 `);
   io.write(`     haven-<name> / haven-signer-<name> pair, leaving the current wiring untouched
@@ -3586,7 +3680,7 @@ async function decideTeardown(identity, input) {
         status: "retained",
         probe: "ok",
         detail: "This agent is still ACTIVE on the backend: its API key and delegate key still carry spend authority, so destroying them would be a live spend-authority change. Key material kept in this directory (0o600); its MCP wiring above is gone.",
-        remedy: `Revoke the agent on the Haven agent page (connect never revokes), then re-run --unwire; or, to delete the key anyway, re-run with ${DESTROY_FLAG}.`
+        remedy: `Use Remove agent\u2026 on the Haven agent page (connect never revokes), then re-run --unwire; or, to delete the key anyway, re-run with ${DESTROY_FLAG}.`
       };
     case "unauthorized":
       return {
@@ -3747,7 +3841,16 @@ async function executeConnect(options, deps, trace) {
   log("Checked local credential storage \u2014 all clear.");
   let serverName = options.serverName;
   let replacing;
-  if (!serverName) {
+  if (!serverName && options.deriveServerName) {
+    const taken = await listTakenDirectoryNames(options.credentialsDir);
+    const nonProduction = setup.haven_wallet.chain_id !== PRODUCTION_CHAIN_ID;
+    serverName = deriveServerSlug(setup.agent.name, taken, nonProduction);
+    await assertServerSlugAvailable(serverName, options.credentialsDir);
+    const derivedNames = serverNamesFor(serverName);
+    log(
+      `Naming this agent's MCP pair from its display name: ${derivedNames.hosted} / ${derivedNames.signer}. Nothing was displaced; to wire the bare haven / haven-signer pair instead, re-run with --bare, or choose the name yourself with --name <slug>.`
+    );
+  } else if (!serverName) {
     const collision = await detectWiringCollision({
       credentialsDir: options.credentialsDir,
       agentName: setup.agent.name
@@ -3973,7 +4076,7 @@ async function executeConnect(options, deps, trace) {
     if (supersededAgentsRetiredLocally === true) {
       log("");
       log(
-        `Replaced: previous agent(s) ${supersededIds(replacing)} are retired on this machine but NOT revoked \u2014 revoke them on the Haven agent page, then restart EVERY long-lived host (gateways, TUI workers, editors): each holds the MCP wiring snapshot from its own start time, and the tombstone speaks only when a stale host next probes the old path.`
+        `Replaced: previous agent(s) ${supersededIds(replacing)} are retired on this machine but NOT revoked \u2014 use Remove agent\u2026 on the Haven agent page for each (it ends their live budgets), then restart EVERY long-lived host (gateways, TUI workers, editors): each holds the MCP wiring snapshot from its own start time, and the tombstone speaks only when a stale host next probes the old path.`
       );
     } else if (supersededAgentIds.length > 0) {
       log("");
@@ -3981,7 +4084,7 @@ async function executeConnect(options, deps, trace) {
         `Heads-up: this setup created a NEW agent. Your previous agent(s) \u2014 ${supersededAgentIds.join(", ")} \u2014 still exist with their own keys, and any host that was already running keeps acting as them.`
       );
       log(
-        `If you meant to replace them: revoke them on the Haven agent page, then restart EVERY long-lived host (gateways, TUI workers, editors) \u2014 each holds the MCP wiring snapshot from its own start time, so after repeated setups each can be stuck on a DIFFERENT old agent. Then remove their directories under ~/.haven/agents (or ${RERUN_HINT} --tombstone <dir> to leave a diagnostic in their place). Run ${RERUN_HINT} --doctor to check whether their keys are still live.`
+        `If you meant to replace them: use Remove agent\u2026 on the Haven agent page for each (it ends their live budgets), then restart EVERY long-lived host (gateways, TUI workers, editors) \u2014 each holds the MCP wiring snapshot from its own start time, so after repeated setups each can be stuck on a DIFFERENT old agent. Then remove their directories under ~/.haven/agents (or ${RERUN_HINT} --tombstone <dir> to leave a diagnostic in their place). Run ${RERUN_HINT} --doctor to check whether their keys are still live.`
       );
     }
   } catch {
@@ -4022,12 +4125,29 @@ async function executeConnect(options, deps, trace) {
     runtimeInstall,
     delegateAddress: registration.delegate_address,
     hostedMcpUrl: registration.hosted_mcp_url,
+    // #3737: the resolved name — derived, explicit, or the bare pair — rides
+    // the machine-readable outcome alongside the prose completion text.
+    serverName,
     supersededAgentIds,
     supersededAgentsRetiredLocally,
     ...replacing ? { retiredAgentIds } : {},
     ...Object.keys(retirementMirrorErrors).length > 0 ? { retirementMirrorErrors } : {},
     existingAgentsBeforeWrite: existingAgents.map((a) => ({ agent_id: a.agentId, account_address: a.accountAddress })),
     ...reboundFrom ? { serverNameReboundFrom: reboundFrom } : {},
+    // #3772: only when the install completed. An install that ended with an
+    // error code may not have written the wiring, and on --replace it leaves the
+    // old agent's wiring as possibly the only working one (retirement is skipped
+    // on the same condition) — so it gets no such sentence. That includes
+    // manual_runtime_setup_required, deliberately: the connector wrote nothing
+    // and the manual instruction already says to start a fresh session. A
+    // --replace names every displaced agent even when no binding record exists
+    // (pre-0.4.0 wiring, or a failed best-effort write).
+    ...!runtimeInstall.errorCode && (replacing || reboundFrom) ? {
+      staleSession: {
+        agentIds: [.../* @__PURE__ */ new Set([...replacing?.superseded.map((entry) => entry.agentId) ?? [], ...reboundFrom ? [reboundFrom.agent_id] : []])],
+        ...reboundFrom?.backend_changed ? { otherBackendAgentId: reboundFrom.agent_id } : {}
+      }
+    } : {},
     setupChallengeExpiresAt: setup.challenge.expires_at,
     approvalRequired: registration.agent_status === "pending_approval",
     approvalUrl: registration.approval_url
@@ -4043,6 +4163,10 @@ async function executeConnect(options, deps, trace) {
     outcome
   };
 }
+function staleSessionNotice(previousAgentIds, otherBackendAgentId) {
+  const one = previousAgentIds.length === 1;
+  return `Any session that was already running keeps acting as the previous agent${one ? "" : "s"} (${previousAgentIds.join(", ")}) until it is restarted, and ${one ? "that agent" : "they"} may still be active in Haven` + (otherBackendAgentId ? ` (${otherBackendAgentId} is on the backend it was created on, not this one)` : "") + `: if ${one ? "it" : "they"} should no longer spend, use Remove agent\u2026 on the Haven agent page (it ends ${one ? "its" : "their"} live budgets).`;
+}
 function completionOutcome(input) {
   const { runtimeInstall } = input;
   const manualSetup = runtimeInstall.errorCode === "manual_runtime_setup_required";
@@ -4060,7 +4184,10 @@ function completionOutcome(input) {
     probe: { result: runtimeInstall.probeResult },
     activation: {
       restart_required: runtimeInstall.restartRequired,
-      instruction: manualSetup ? "Finish the manual MCP setup using the secret-free references shown in normal Connect output, then start a fresh session." : runtimeProfile(runtimeInstall.runtime).activationInstruction
+      instruction: (manualSetup ? "Finish the manual MCP setup using the secret-free references shown in normal Connect output, then start a fresh session." : runtimeProfile(runtimeInstall.runtime).activationInstruction) + // #3772: a rebind changes which agent the server name means, but a
+      // session that is already running keeps the config it loaded — it
+      // goes on acting as the previous agent, which Connect never revokes.
+      (input.staleSession && input.staleSession.agentIds.length > 0 ? ` ${staleSessionNotice(input.staleSession.agentIds, input.staleSession.otherBackendAgentId)}` : "")
     },
     next_action: nextAction2,
     approval: {
@@ -4096,6 +4223,9 @@ function completionOutcome(input) {
     // #3122: always emitted on a completed run (empty list included), for the
     // same reason as superseded_agent_ids above.
     existing_agents_before_write: input.existingAgentsBeforeWrite ?? [],
+    // #3737: the resolved hosted server name — always present on a completed
+    // run, bare pair included, so a caller never has to parse the prose.
+    server_name: serverNamesFor(input.serverName).hosted,
     ...input.serverNameReboundFrom ? { server_name_rebound_from: input.serverNameReboundFrom } : {},
     ...input.setupChallengeExpiresAt ? { setup_challenge_expires_at: input.setupChallengeExpiresAt } : {},
     ...runtimeInstall.errorCode ? { error: { code: runtimeInstall.errorCode, next_action: nextAction2 } } : {}
@@ -4119,7 +4249,8 @@ function installedClientProse(hint) {
 }
 function runtimeSelectionPrompt(options, deps) {
   if (!interactivePromptAllowed(options, deps)) return void 0;
-  return deps.promptRuntime ?? (() => resolveRuntimeByInstalledClientPrompt());
+  if (deps.promptRuntime) return deps.promptRuntime;
+  return () => (deps.promptRuntimeByInstalledClient ?? resolveRuntimeByInstalledClientPrompt)({ env: deps.env });
 }
 function interactivePromptAllowed(options, deps) {
   if (options.interactive !== true) return false;
@@ -4145,7 +4276,7 @@ async function resolveWiringCollision(collision, agentName, options, deps) {
   }
   throw new ConnectError(
     "wiring_collision",
-    `This machine is already wired to a Haven agent with a live key (${supersededIds(collision)}), and setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring. Nothing was written and the Haven setup token is still unused. If you are an AI agent running this command: do NOT add a flag yourself \u2014 relay this to your user and stop. Your user decides: REPLACE the existing wiring (re-run the same command with --replace added, which re-points the pair at the new agent and retires the previous directory locally \u2014 they still revoke the old agent on the Haven agent page), or install ALONGSIDE it (re-run with --name <slug> added, e.g. --name ${collision.suggestedServerName}, which gives the new agent its own haven-<slug> / haven-signer-<slug> pair). Re-run only with the flag your user chooses.`,
+    `This machine is already wired to a Haven agent with a live key (${supersededIds(collision)}), and setting up "${agentName}" on the bare haven / haven-signer pair would replace that wiring. Nothing was written and the Haven setup token is still unused. If you are an AI agent running this command: do NOT add a flag yourself \u2014 relay this to your user and stop. Your user decides: REPLACE the existing wiring (re-run the same command with --replace added, which re-points the pair at the new agent and retires the previous directory locally \u2014 they still use Remove agent\u2026 on the Haven agent page to end the old agent\u2019s budgets), or install ALONGSIDE it (re-run with --name <slug> added, e.g. --name ${collision.suggestedServerName}, which gives the new agent its own haven-<slug> / haven-signer-<slug> pair). Re-run only with the flag your user chooses.`,
     "relay_wiring_collision_to_user",
     { supersededAgentIds: collision.superseded.map((e) => e.agentId), suggestedServerName: collision.suggestedServerName }
   );
@@ -4426,7 +4557,7 @@ async function listOtherAgentIds(baseDir, currentDirectory) {
 function printNextSteps(result, log, approval, approvalUrl) {
   for (const line of completionHandoffLines(result, approval, approvalUrl)) log(line);
 }
-var CONNECTOR_VERSION, CONNECTOR_CLIENT_IDENTITY, CONNECT_OUTCOME_SCHEMA_VERSION, failureOutcomesByError, RERUN_HINT;
+var CONNECTOR_VERSION, PRODUCTION_CHAIN_ID, CONNECTOR_CLIENT_IDENTITY, CONNECT_OUTCOME_SCHEMA_VERSION, failureOutcomesByError, RERUN_HINT;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     init_api();
@@ -4443,7 +4574,8 @@ var init_runtime = __esm({
     init_tombstone();
     init_local_mcp_runtime();
     init_runtime_manifest();
-    CONNECTOR_VERSION = "0.8.1-alpha.0";
+    CONNECTOR_VERSION = "0.9.0-alpha.0";
+    PRODUCTION_CHAIN_ID = 8453;
     CONNECTOR_CLIENT_IDENTITY = `@haven_ai/connect/${CONNECTOR_VERSION}`;
     CONNECT_OUTCOME_SCHEMA_VERSION = 1;
     failureOutcomesByError = /* @__PURE__ */ new WeakMap();
@@ -4653,9 +4785,10 @@ async function startRekey(options, deps = {}) {
     started_at: startedAt,
     expires_at: expiresAt
   });
+  const finishName = options.serverName ?? stored.discoveredSlug;
   const finishCommand = [
     connectorRerunCommand("--rekey-finish"),
-    options.serverName ? `--name ${options.serverName}` : void 0,
+    finishName ? `--name ${finishName}` : void 0,
     "--api-key <the key the dashboard showed you>",
     options.runtime ? `--runtime ${options.runtime}` : "--runtime <your runtime>"
   ].filter(Boolean).join(" ");
@@ -5487,9 +5620,9 @@ async function runDoctor(input, deps = {}) {
       level: supersededLevel,
       detail: supersededLevel === "failed" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. A host started before your latest setup keeps authenticating (and spending) as the old agent.` : supersededLevel === "advisory" ? `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}. Runtime '${input2.runtime}' has no config file the connector can read, so which of these agents are wired cannot be verified from this machine: a live key here may be an agent you use deliberately, or one a host started before your latest setup is still spending as.` : `${otherEntries.length} other credential dir(s) found \u2014 ${parts.join("; ")}.`,
       ...supersededLevel === "failed" ? {
-        repair: `Revoke ${supersededLive.join(", ")} on the Haven agent page, then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+        repair: `Use Remove agent\u2026 on the Haven agent page for ${supersededLive.join(", ")} (it ends each one\u2019s live budgets), then remove the old director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : supersededLevel === "advisory" ? {
-        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: revoke the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
+        repair: `Check ${supersededLive.join(", ")} on the Haven agent page: use Remove agent\u2026 on the ones you no longer use, then remove their director(y/ies) under ~/.haven/agents. Connect never revokes or deletes for you.`
       } : {}
     });
   }
@@ -5714,6 +5847,7 @@ function parseArgs(argv, env = process.env) {
   let dryRun = false;
   let unwireDir;
   let replace = false;
+  let bare = false;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--help" || arg === "-h") {
@@ -5761,6 +5895,8 @@ function parseArgs(argv, env = process.env) {
       options.credentialsDir = requireValue(argv, ++i, arg);
     } else if (arg === "--replace") {
       replace = true;
+    } else if (arg === "--bare") {
+      bare = true;
     } else if (arg === "--name") {
       options.serverName = requireValue(argv, ++i, arg);
       assertValidServerSlug(options.serverName);
@@ -5786,16 +5922,23 @@ function parseArgs(argv, env = process.env) {
   if (help) {
     return { options, help, json, doctor, repair, tombstone, rekey };
   }
-  if (replace) {
+  if (replace || bare) {
     if (rekeyPhase || tombstoneDir || unwire || doctor || repair || pruneSignerRuntimes2) {
-      throw new Error("--replace belongs to a --setup run: it says what to do when the bare haven / haven-signer pair is already wired to another agent.");
+      throw new Error(`${replace ? "--replace" : "--bare"} belongs to a --setup run: it says what to do when the bare haven / haven-signer pair is already wired to another agent.`);
     }
-    if (options.serverName) {
+    if (bare && options.serverName) {
       throw new Error(
-        "--replace and --name contradict each other: --replace overwrites the bare haven / haven-signer wiring, --name installs alongside it under its own pair. Pass one of them."
+        "--bare and --name contradict each other: --bare wires the bare haven / haven-signer pair, --name installs a named haven-<slug> pair. Pass one of them."
       );
     }
-    options.replaceExistingWiring = true;
+    if (replace) {
+      if (options.serverName) {
+        throw new Error(
+          "--replace and --name contradict each other: --replace overwrites the bare haven / haven-signer wiring, --name installs alongside it under its own pair. Pass one of them."
+        );
+      }
+      options.replaceExistingWiring = true;
+    }
   }
   if (destroyKeyMaterial && !unwire) {
     throw new Error("--destroy-key-material only applies to --unwire.");
@@ -5869,6 +6012,9 @@ function parseArgs(argv, env = process.env) {
   if (!options.apiBaseUrl) {
     throw new Error("Missing --api <Haven API URL>.");
   }
+  if (!options.serverName && !bare && !replace) {
+    options.deriveServerName = true;
+  }
   options.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
   return { options, help, json, doctor, repair, tombstone, rekey };
 }
@@ -5896,13 +6042,19 @@ function helpText() {
     "  --replace                  When this machine is already wired to a different Haven agent on the bare",
     "                             haven / haven-signer pair, re-point that pair at the new agent and retire the",
     "                             previous agent directory locally (tombstoned, local key files removed).",
-    "                             Nothing is revoked \u2014 revoke the old agent on the Haven agent page. Without",
-    "                             this flag a non-interactive run REFUSES such a collision (wiring_collision)",
-    "                             and an interactive terminal is asked; --name installs alongside instead.",
+    "                             Nothing is revoked \u2014 use Remove agent\u2026 on the Haven agent page. Implies",
+    "                             the bare pair. Without it (or --bare) a non-interactive run REFUSES such a",
+    "                             collision (wiring_collision) and an interactive terminal is asked.",
+    "  --bare                     Wire the bare haven / haven-signer pair. Without --name a setup now names",
+    "                             its pair from the agent's display name (haven-<slug> /",
+    "                             haven-signer-<slug>, de-collided against this machine, ending -dev on a",
+    "                             non-production backend), so adding an agent never has to displace anyone;",
+    "                             --bare is the explicit opt-in to the unnamed pair. --name overrides it.",
     "  --name <slug>              Wiring slug for a NAMED agent: writes haven-<slug> / haven-signer-<slug>",
     "                             MCP entries and stores credentials at ~/.haven/agents/<slug>/, so several",
     "                             agents can run side by side in one runtime. 1-32 lowercase letters, digits,",
-    "                             single hyphens; immutable once wired. Omit for the bare haven / haven-signer pair.",
+    "                             single hyphens; immutable once wired. Without it the pair is named from the",
+    "                             agent's display name; --bare wires the bare haven / haven-signer pair.",
     "  --ack-local-tools          Write the one-time local Haven tools acknowledgement during setup.",
     "  --ack-signer               Backward-compatible alias for --ack-local-tools.",
     "  --local                    Advanced: install the fully-local Haven MCP (no hosted dependency).",
@@ -6052,7 +6204,7 @@ async function runCli(argv, io = {
         io.stdout(redactSecrets(`Tombstoned agent ${info.agent_id} at ${parsed.tombstone.directory}.
 `));
         io.stdout(
-          "Key files were NOT touched and nothing was revoked \u2014 revoke the agent on the Haven agent page if you have not already.\n"
+          "Key files were NOT touched and nothing was revoked \u2014 on the Haven agent page, use Remove agent\u2026 (or Stop budget) if you have not already.\n"
         );
         io.stdout(
           info.recordPath !== null ? `A surviving tombstone record was mirrored to ${redactSecrets(info.recordPath)}
@@ -6161,7 +6313,7 @@ async function runCli(argv, io = {
           failures.length > 0 ? "  Some entries were NOT removed (\u2717 above). Re-run `--unwire` after resolving each refusal \u2014\n  it is idempotent.\n" : retained ? "  The wiring is gone; the key material is not (\u2717 above). `--doctor` will keep reporting this directory\n  as `superseded` until the key is revoked or destroyed \u2014 that is the honest state.\n" : "  Verify: `--doctor --runtime <runtime>` per host should report this agent as `retired` with a\n  clean runtime-config check.\n"
         );
         io.stdout(
-          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. " + (retained ? "This directory\u2019s local key material was KEPT (see above); the tombstone\n" : "This directory\u2019s local key material was removed and the tombstone\n") + "record + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, revoke the agent on the Haven agent page to stop it spending entirely.\n"
+          "Restart EVERY long-lived MCP host (gateway, TUI workers, editors): each holds the wiring snapshot\nfrom its own start time. " + (retained ? "This directory\u2019s local key material was KEPT (see above); the tombstone\n" : "This directory\u2019s local key material was removed and the tombstone\n") + "record + #2155 mirror survive \u2014 but nothing was REVOKED on the backend. If you have not\nalready, use Remove agent\u2026 on the Haven agent page to end its budgets on-chain and stop it spending.\n"
         );
       }
       return failures.length > 0 || retained ? 1 : 0;