@haven_ai/signer 0.0.0-dev.202610071535.a5affd7 → 0.0.0-dev.202610071600.91b951e

package/README.md

@@ -206,6 +206,26 @@ relays ("Connection closed" plus this process's exit message) names the same
 command. The consent hash covers identity, tool names and the surface version —
 not the block's prose — so neither change re-prompts an acknowledged install.
 
+## Several Haven pairs on one machine (#3738)
+
+One harness can carry several Haven pairs — `haven-research` +
+`haven-signer-research`, `haven-ops` + `haven-signer-ops`, alongside a bare
+`haven` + `haven-signer` (Codex: `haven` + `haven_signer`). A model must act as
+one agent per task and keep hosted and signer calls inside that pair. Server
+names are easy to cross, so the signer's `initialize` instructions state what
+it is bound to:
+
+```
+This signer is bound to agent id <agent_id> and delegate address <0x…>.
+```
+
+The agent id comes from the credential file's `agent_id` (or `HAVEN_AGENT_ID`
+alongside `HAVEN_DELEGATE_KEY`); when neither is set the line says "no recorded
+agent id" and still gives the delegate address, which is then compared alone.
+The model compares it with `haven_get_agent`'s `id` and `delegateAddress` from
+the hosted server it called, and signs nothing on a mismatch. Neither value is secret (the consent screen prints both), and
+the line is advisory: what the signer refuses to sign is unchanged.
+
 ## Orchestration
 
 Direct payment:
@@ -333,7 +353,7 @@ refusal class — `fallback`, `retry_with_new_quote`, `http_status`,
 `SIGN_CONTEXT_REFUSED` (other) row names the hosted status read
 (`next_tool_server_role: hosted`, `next_tool_name: haven_get_payment_status`,
 `next_arguments: { payment_id }` — resolve the role against your own server
-names); every other row carries `next_tool_omitted_reason` with the exact
+names, and with several Haven pairs against this signer's own pair); every other row carries `next_tool_omitted_reason` with the exact
 remedy. `message` is unchanged.
 
 **#3271: `haven_sign` (never `haven_sign_x402`) has one escape from this

package/dist/cli.cjs

@@ -909,7 +909,7 @@ function encodeSiwxHeader(payload) {
 
 // src/tools.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.0.0-dev.202610071535.a5affd7";
+var SIGNER_VERSION = "0.0.0-dev.202610071600.91b951e";
 var UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
 var USEROP_BINDING_MISMATCH = "USEROP_BINDING_MISMATCH";
 var HavenUserOpBindingRefusedError = class extends edge.HavenSigningError {
@@ -2349,7 +2349,13 @@ function signerCompatibility() {
 function signerCapabilityAdvertisement() {
   return { experimental: { [SIGNER_CAPABILITY_KEY]: signerCompatibility() } };
 }
-function signerInstructions() {
+function signerIdentityLines(identity) {
+  if (!identity?.agentId && !identity?.delegateAddress) return [];
+  const agent = identity.agentId ? `agent id ${identity.agentId}` : "no recorded agent id";
+  const delegate = identity.delegateAddress ? ` and delegate address ${identity.delegateAddress}` : "";
+  return [`This signer is bound to ${agent}${delegate}.`];
+}
+function signerInstructions(identity) {
   const compatibility = signerCompatibility();
   return [
     "Haven edge signer: sign-only tools bound to the local delegate key. It never emits the",
@@ -2358,12 +2364,15 @@ function signerInstructions() {
     "#3271, and delegation-rail x402) or haven_sign_x402 (x402 only) instead of relaying bulky",
     "typed-data payloads yourself.",
     "",
-    "Sign-In-With-X (#3728): when a merchant 402 carries a sign-in-with-x extension (or the",
-    "merchant documents a CAIP-122 sign-in route), call haven_sign_siwx with { url, challenge }.",
-    "The signer composes the EIP-4361 message itself from the validated challenge and signs it with",
-    "the delegate key \u2014 it returns { sign_in_with_x_header }; retry the merchant with the",
-    "SIGN-IN-WITH-X header set to that value. This proves the delegate wallet paid the merchant; it",
-    "moves no funds and cannot approve any payment.",
+    ...signerIdentityLines(identity),
+    "When more than one Haven pair is configured, you act as ONE agent per task: if the",
+    "user has not said which (in the request, or a project-level choice they stated), ask",
+    "before any payment tool. Sign only through the signer of the hosted server you called:",
+    "haven-<slug> with haven-signer-<slug>, bare haven with haven-signer, Codex haven with",
+    "haven_signer. Before signing, compare the identity this signer states with",
+    "haven_get_agent (its id and delegateAddress) from that hosted server \u2014 the delegate",
+    "address alone when this signer has no recorded agent id. If they differ, stop and sign",
+    "nothing \u2014 switch to the signer whose identity matches.",
     "",
     "Version compatibility (check this BEFORE signing, not after):",
     `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
@@ -2383,14 +2392,22 @@ function signerInstructions() {
     "machine-readable, not just prose: it carries code, supported_versions, received_version, and",
     "fallback fields alongside the message, so you can branch on it directly. Every signer",
     "refusal also carries the next-step family: next_tool_name + next_tool_server_role when a",
-    "hosted tool follows (resolve the role against your own server names), else",
+    "hosted tool follows (resolve the role against your own server names \u2014 with several",
+    "Haven pairs, the hosted server of THIS signer's pair), else",
     "next_tool_omitted_reason saying why not.",
     "",
     "An undeclared top-level argument is refused, not stripped: haven_sign answers",
     "UNSUPPORTED_ARGUMENT with unknown_arguments, signer_version and fallback (the update",
     "command) instead of dropping the key and answering the generic signing error \u2014 if you see",
     "that refusal, this signer predates the argument form you sent. Update the signer; nothing",
-    "was signed, fetched or audited."
+    "was signed, fetched or audited.",
+    "",
+    "Sign-In-With-X (#3728): when a merchant 402 carries a sign-in-with-x extension (or the",
+    "merchant documents a CAIP-122 sign-in route), call haven_sign_siwx with { url, challenge }.",
+    "The signer composes the EIP-4361 message itself from the validated challenge and signs it with",
+    "the delegate key \u2014 it returns { sign_in_with_x_header }; retry the merchant with the",
+    "SIGN-IN-WITH-X header set to that value. This proves the delegate wallet paid the merchant; it",
+    "moves no funds and cannot approve any payment."
   ].join("\n");
 }
 async function loadSignerCredentials(path = process.env.HAVEN_CREDENTIALS) {
@@ -2519,7 +2536,12 @@ function buildSignerMcpServer(signer, options = {}) {
     { name: SIGNER_NAME, version: SIGNER_VERSION },
     {
       capabilities: signerCapabilityAdvertisement(),
-      instructions: signerInstructions()
+      // #3738: the identity line lets a model holding several Haven pairs
+      // confirm this signer belongs to the hosted server it called.
+      instructions: signerInstructions({
+        agentId: options.credentials?.agentId,
+        delegateAddress: signer.delegateAddress
+      })
     }
   );
   const credentialsPath = options.credentials?.sourcePath;