@addai/node 0.11.3 → 0.13.0

package/dist/auto-update.d.ts

@@ -0,0 +1,139 @@
+import { type HarnessId } from './harness-registry';
+import { type LaunchMode } from './self-update';
+/**
+ * A stable per-node offset into the hour, derived from the daemon token.
+ *
+ * The fleet has to be spread across the hour rather than converging on :00 —
+ * with no soak window, the stagger is the ONLY thing limiting how fast a bad
+ * publish reaches everyone. Deriving it from the token (rather than random)
+ * means a node keeps its slot across restarts, including the restart an
+ * auto-roll itself causes, which would otherwise re-converge every rolled
+ * node onto the same minute.
+ */
+export declare function tickOffsetMs(token: string): number;
+/**
+ * Milliseconds until this node's next slot, measured against the wall clock
+ * rather than against boot time — so a daemon that restarts twice an hour
+ * keeps firing on its own slot instead of drifting to a new one each time.
+ */
+export declare function msUntilNextTick(nowMs: number, offsetMs: number): number;
+export type SkipReason = 'disabled' | 'busy' | 'breaker';
+/**
+ * The guards, in the order they are cheapest to check.
+ *
+ * `busy` is a skip, NOT a drain: an auto-update is elective and there is
+ * always another hour, whereas draining would take the node out of rotation
+ * for up to ten minutes every time the tick happened to land mid-turn. A node
+ * that is never idle never auto-updates, and gets rolled by hand.
+ */
+export declare function shouldRun(s: {
+    enabled: boolean;
+    busy: boolean;
+    breakerOpen: boolean;
+}): SkipReason | null;
+export interface HarnessUpgrade {
+    id: HarnessId;
+    npmPackage: string;
+}
+/**
+ * Which harnesses this tick will `npm i -g …@latest`.
+ *
+ * Two rules, both deliberate:
+ *  - npm-able only. grok's `npmPackage` is null (xAI ships its own installer),
+ *    so it is never touched here — a truthful skip beats a fake upgrade.
+ *  - installed only. The tick upgrades; it does not provision. Installing a
+ *    harness nobody asked for is a different feature, and one with a cost
+ *    (disk, a login prompt that never comes) the user never opted into.
+ */
+export declare function planHarnessUpgrades(installed: HarnessId[]): HarnessUpgrade[];
+export interface RollDecision {
+    roll: boolean;
+    /** Why not, when roll is false. Logged, and surfaced in capabilities. */
+    reason?: string;
+}
+/**
+ * Whether to roll the daemon itself.
+ *
+ * A source checkout is refused for the same reason a remote version bump is
+ * (see planRoll): its version comes from the working tree, so installing and
+ * restarting would come back up on exactly the same bits — a no-op wearing a
+ * success. Harnesses on such a node are still upgraded; only this half is off.
+ */
+export declare function planAutoRoll(current: string, latest: string | null, mode: LaunchMode): RollDecision;
+export interface HarnessOutcome {
+    from?: string;
+    to?: string;
+    /** Where the binary resolves NOW. You chose npm-for-every-npm-able-harness,
+     *  so on a machine whose Claude Code came from Anthropic's native installer
+     *  npm has just put a second copy somewhere else — possibly shadowing the
+     *  first. The path is what makes that visible instead of silent. */
+    path?: string;
+    error?: string;
+}
+export interface AutoUpdateState {
+    enabled: boolean;
+    last_checked_at?: string;
+    last_result?: 'ok' | 'skipped' | 'failed';
+    skipped_reason?: SkipReason;
+    /** Set when a roll actually happened — written by the daemon that came up
+     *  after it, from the restart handoff. */
+    runtime?: {
+        from: string;
+        to: string;
+        wanted?: string;
+    } | null;
+    harnesses?: Record<string, HarnessOutcome>;
+    error?: string;
+}
+/** Read by capabilities.ts so the whole picture rides the heartbeat the AiNode
+ *  page already reads — no new RPC, no new column, no polling. */
+export declare function autoUpdateState(): AutoUpdateState;
+/** Called by index.ts on boot when the handoff it consumed had no command id,
+ *  i.e. the roll was ours rather than a button press. */
+export declare function recordAutoRoll(r: {
+    from: string;
+    to: string;
+    wanted?: string;
+}): void;
+/** Only the part of a capabilities probe this module reads. Kept structural
+ *  rather than importing CapabilitiesShape, which would put capabilities.ts on
+ *  both ends of an import cycle (it reads autoUpdateState from here). */
+type ProbeShape = Partial<Record<HarnessId, {
+    version?: string;
+    available?: boolean;
+}>>;
+export interface AutoUpdateDeps {
+    /** The daemon token — only used to derive this node's slot. */
+    token: () => string | null;
+    /** True while this node holds a child process for a live run. */
+    isBusy: () => boolean;
+    /** The daemon-wide Supabase circuit breaker. */
+    breakerOpen: () => boolean;
+    /** Whether the server says auto-update is on for this node. */
+    enabled: () => boolean;
+    /** Full capabilities probe — used for before/after harness versions. */
+    probe: () => Promise<ProbeShape>;
+    /** Push a heartbeat so Studio sees the new versions without waiting. */
+    beat: () => Promise<void>;
+    /** The same closure `update_runtime` uses. No command id: nobody asked. */
+    roll: (opts: {
+        version: string;
+    }) => Promise<void>;
+    /** This daemon's own version. */
+    version: string;
+    /** `npm i -g <spec>`; null on success. Injectable so the orchestration below
+     *  — the before/after diff, the busy re-check — can be tested without
+     *  actually installing anything. */
+    install?: (spec: string) => Promise<string | null>;
+    /** What npm calls latest for a package, or null if we couldn't ask. */
+    latest?: (pkg: string) => Promise<string | null>;
+    /** How this daemon was launched. Injectable because under a test runner
+     *  argv[1] is the runner, which would read as `source` and mask the roll. */
+    mode?: () => LaunchMode;
+}
+/** One pass. Exported so `ainode` can be made to do it on demand later, and
+ *  so a test can drive it without waiting an hour. */
+export declare function runOnce(d: AutoUpdateDeps): Promise<void>;
+export declare function start(d: AutoUpdateDeps): void;
+export declare function stop(): void;
+export {};

package/dist/auto-update.js

@@ -0,0 +1,261 @@
+"use strict";
+// Hourly auto-update — this node keeps itself, and its harnesses, current.
+//
+// Until now a node only moved when somebody clicked. `update_runtime` issued
+// by hand from Entity Studio was the ONLY thing that ever rolled a daemon,
+// which is how the fleet came to sit on 0.2.51/0.2.52/0.2.53 for days after
+// 0.2.55 shipped. Harnesses were worse: Studio offers Install only while a
+// harness reads `missing`, so once Claude Code was on a node it could never
+// be upgraded from anywhere.
+//
+// The schedule lives here rather than in a server-side cron because a node
+// asleep, behind NAT, or between pairings then needs no special case — the
+// daemon already wakes on its own for reclaim, diskguard and sleep detection.
+//
+// Everything the tick needs from the rest of the daemon is INJECTED by
+// index.ts (roll, probe, beat, isBusy, isEnabled). That keeps this module's
+// imports down to the registry and the npm helpers, so the decisions below
+// are testable without booting a daemon — and avoids the
+// auto-update → heartbeat → capabilities → auto-update cycle that importing
+// them directly would create.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tickOffsetMs = tickOffsetMs;
+exports.msUntilNextTick = msUntilNextTick;
+exports.shouldRun = shouldRun;
+exports.planHarnessUpgrades = planHarnessUpgrades;
+exports.planAutoRoll = planAutoRoll;
+exports.autoUpdateState = autoUpdateState;
+exports.recordAutoRoll = recordAutoRoll;
+exports.runOnce = runOnce;
+exports.start = start;
+exports.stop = stop;
+const harness_registry_1 = require("./harness-registry");
+const self_update_1 = require("./self-update");
+const HOUR_MS = 60 * 60 * 1000;
+/** Nothing auto-rolls in the first few minutes of a boot. A node that just
+ *  came up may BE the result of a roll (or of one that went badly), and
+ *  rolling again immediately would turn a bad publish into a restart loop. */
+const BOOT_GRACE_MS = 5 * 60 * 1000;
+/* ── when ─────────────────────────────────────────────────────────────── */
+/**
+ * A stable per-node offset into the hour, derived from the daemon token.
+ *
+ * The fleet has to be spread across the hour rather than converging on :00 —
+ * with no soak window, the stagger is the ONLY thing limiting how fast a bad
+ * publish reaches everyone. Deriving it from the token (rather than random)
+ * means a node keeps its slot across restarts, including the restart an
+ * auto-roll itself causes, which would otherwise re-converge every rolled
+ * node onto the same minute.
+ */
+function tickOffsetMs(token) {
+    // FNV-1a. Not cryptographic — it only has to spread evenly and be stable.
+    let h = 0x811c9dc5;
+    for (let i = 0; i < token.length; i++) {
+        h ^= token.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h % HOUR_MS;
+}
+/**
+ * Milliseconds until this node's next slot, measured against the wall clock
+ * rather than against boot time — so a daemon that restarts twice an hour
+ * keeps firing on its own slot instead of drifting to a new one each time.
+ */
+function msUntilNextTick(nowMs, offsetMs) {
+    const since = (((nowMs - offsetMs) % HOUR_MS) + HOUR_MS) % HOUR_MS;
+    const wait = HOUR_MS - since;
+    // since === 0 lands exactly on the slot; wait a full hour rather than
+    // firing twice for the same slot.
+    return wait === 0 ? HOUR_MS : wait;
+}
+/**
+ * The guards, in the order they are cheapest to check.
+ *
+ * `busy` is a skip, NOT a drain: an auto-update is elective and there is
+ * always another hour, whereas draining would take the node out of rotation
+ * for up to ten minutes every time the tick happened to land mid-turn. A node
+ * that is never idle never auto-updates, and gets rolled by hand.
+ */
+function shouldRun(s) {
+    if (!s.enabled)
+        return 'disabled';
+    if (s.breakerOpen)
+        return 'breaker';
+    if (s.busy)
+        return 'busy';
+    return null;
+}
+/**
+ * Which harnesses this tick will `npm i -g …@latest`.
+ *
+ * Two rules, both deliberate:
+ *  - npm-able only. grok's `npmPackage` is null (xAI ships its own installer),
+ *    so it is never touched here — a truthful skip beats a fake upgrade.
+ *  - installed only. The tick upgrades; it does not provision. Installing a
+ *    harness nobody asked for is a different feature, and one with a cost
+ *    (disk, a login prompt that never comes) the user never opted into.
+ */
+function planHarnessUpgrades(installed) {
+    const present = new Set(installed);
+    return harness_registry_1.HARNESS_IDS
+        .filter(id => present.has(id) && harness_registry_1.HARNESSES[id].npmPackage !== null)
+        .map(id => ({ id, npmPackage: harness_registry_1.HARNESSES[id].npmPackage }));
+}
+/**
+ * Whether to roll the daemon itself.
+ *
+ * A source checkout is refused for the same reason a remote version bump is
+ * (see planRoll): its version comes from the working tree, so installing and
+ * restarting would come back up on exactly the same bits — a no-op wearing a
+ * success. Harnesses on such a node are still upgraded; only this half is off.
+ */
+function planAutoRoll(current, latest, mode) {
+    if (mode === 'source')
+        return { roll: false, reason: 'source checkout — pull and rebuild it there' };
+    if (!latest)
+        return { roll: false, reason: 'could not read the latest published version' };
+    if (latest === current)
+        return { roll: false, reason: 'already latest' };
+    return { roll: true };
+}
+let state = { enabled: true };
+let isEnabled = () => true;
+/** Read by capabilities.ts so the whole picture rides the heartbeat the AiNode
+ *  page already reads — no new RPC, no new column, no polling. */
+function autoUpdateState() {
+    return { ...state, enabled: isEnabled() };
+}
+/** Called by index.ts on boot when the handoff it consumed had no command id,
+ *  i.e. the roll was ours rather than a button press. */
+function recordAutoRoll(r) {
+    state = { ...state, runtime: r, last_result: 'ok', last_checked_at: new Date().toISOString() };
+}
+let timer = null;
+let stopped = false;
+let deps = null;
+function harnessVersion(probe, id) {
+    const p = probe[id];
+    return p?.available ? p.version : undefined;
+}
+function installedHarnesses(probe) {
+    return harness_registry_1.HARNESS_IDS.filter(id => probe[id]?.available === true);
+}
+/** One pass. Exported so `ainode` can be made to do it on demand later, and
+ *  so a test can drive it without waiting an hour. */
+async function runOnce(d) {
+    const skip = shouldRun({ enabled: d.enabled(), busy: d.isBusy(), breakerOpen: d.breakerOpen() });
+    if (skip) {
+        state = { ...state, last_checked_at: new Date().toISOString(), last_result: 'skipped', skipped_reason: skip };
+        if (skip !== 'breaker')
+            console.log(`[auto-update] skipped — ${skip === 'busy' ? 'the node is mid-run' : 'turned off for this node'}`);
+        return;
+    }
+    const checkedAt = new Date().toISOString();
+    const harnesses = {};
+    let failed;
+    const install = d.install ?? self_update_1.npmInstallGlobal;
+    const latestOf = d.latest ?? self_update_1.npmLatestVersion;
+    /* ── harnesses first — nothing restarts, so this half always lands ──── */
+    try {
+        const before = await d.probe();
+        const upgrades = planHarnessUpgrades(installedHarnesses(before));
+        for (const u of upgrades) {
+            const from = harnessVersion(before, u.id);
+            const err = await install(`${u.npmPackage}@latest`);
+            harnesses[u.id] = { from, ...(err ? { error: err } : {}) };
+            if (err)
+                console.error(`[auto-update] ${u.id}: ${err}`);
+        }
+        if (upgrades.length > 0) {
+            // The finders cached their pre-upgrade lookups; a probe through stale
+            // caches would report the OLD version and hide the upgrade entirely.
+            (0, harness_registry_1.resetBinaryCaches)();
+            const after = await d.probe();
+            for (const u of upgrades) {
+                const to = harnessVersion(after, u.id);
+                const path = harness_registry_1.HARNESSES[u.id].findBinary() ?? undefined;
+                harnesses[u.id] = { ...harnesses[u.id], to, path };
+                if (harnesses[u.id].from !== to) {
+                    console.log(`[auto-update] ${u.id} ${harnesses[u.id].from ?? '?'} → ${to ?? '?'} (${path ?? 'not resolvable'})`);
+                }
+            }
+            await d.beat();
+        }
+    }
+    catch (err) {
+        failed = `harness upgrade: ${err.message}`;
+        console.error(`[auto-update] ${failed}`);
+    }
+    state = {
+        ...state,
+        last_checked_at: checkedAt,
+        last_result: failed ? 'failed' : 'ok',
+        skipped_reason: undefined,
+        harnesses,
+        error: failed,
+    };
+    /* ── then the daemon itself ─────────────────────────────────────────── */
+    const mode = d.mode ? d.mode() : (0, self_update_1.detectLaunchMode)(process.argv[1] ?? '');
+    const latest = mode === 'source' ? null : await latestOf(self_update_1.PACKAGE_NAME);
+    const decision = planAutoRoll(d.version, latest, mode);
+    if (!decision.roll) {
+        if (decision.reason !== 'already latest')
+            console.log(`[auto-update] not rolling — ${decision.reason}`);
+        return;
+    }
+    // Re-check busy: the harness upgrades above can take minutes, and a run may
+    // well have arrived while npm was working. Rolling now would guillotine it
+    // at the drain ceiling for no reason — there is another hour.
+    if (d.isBusy()) {
+        state = { ...state, last_result: 'skipped', skipped_reason: 'busy' };
+        console.log('[auto-update] a run arrived during the harness pass — leaving the roll for next hour');
+        return;
+    }
+    console.log(`[auto-update] rolling ${d.version} → ${latest}`);
+    try {
+        // This does not return: the roll drains, hands over, and exits. The
+        // daemon that comes up completes the story from the handoff file.
+        await d.roll({ version: latest });
+    }
+    catch (err) {
+        state = { ...state, last_result: 'failed', error: `roll: ${err.message}` };
+        console.error(`[auto-update] roll failed — staying on ${d.version}:`, err.message);
+    }
+}
+function schedule(firstRun) {
+    if (stopped || !deps)
+        return;
+    const token = deps.token() ?? '';
+    const offset = tickOffsetMs(token);
+    let wait = msUntilNextTick(Date.now(), offset);
+    if (firstRun)
+        wait = Math.max(wait, BOOT_GRACE_MS);
+    timer = setTimeout(() => {
+        void (async () => {
+            try {
+                await runOnce(deps);
+            }
+            catch (err) {
+                console.error('[auto-update] tick crashed:', err.message);
+            }
+            schedule(false);
+        })();
+    }, wait);
+    // Never keep the process alive just to auto-update.
+    timer.unref?.();
+}
+function start(d) {
+    if (timer || stopped)
+        return;
+    deps = d;
+    isEnabled = d.enabled;
+    state = { ...state, enabled: d.enabled() };
+    schedule(true);
+}
+function stop() {
+    stopped = true;
+    if (timer) {
+        clearTimeout(timer);
+        timer = null;
+    }
+}

package/dist/capabilities.d.ts

@@ -1,4 +1,7 @@
+import type { EngineInfo } from './desktop/provider';
 import { type AutostartState } from './autostart';
+import { type AutoUpdateState } from './auto-update';
+import { type MachineSample } from './machine-metrics';
 interface AuthShape {
     authed: boolean;
     account?: string;
@@ -42,6 +45,17 @@ interface CapabilitiesShape {
      *  rather than a column of its own — same channel Studio already reads the
      *  harness grid from. */
     autostart?: AutostartState;
+    /** Container engine backing Entity Desktops, or null when none is
+     *  installed. Studio renders an install card in place of the create
+     *  button when this is null. */
+    container_engine?: EngineInfo | null;
+    /** CPU / memory / disk / runs at the moment of this probe. The AiNode page
+     *  has read this key since it was written; nothing produced it until now. */
+    machine?: MachineSample;
+    /** What the hourly auto-update last did — versions moved, skips, failures.
+     *  Same channel, same reason: without it the AiNode page is somewhere the
+     *  version silently changes with no explanation. */
+    auto_update?: AutoUpdateState;
 }
 /** Codex's credential store: $CODEX_HOME (or ~/.codex) + /auth.json. */
 export declare function codexHome(): string;

package/dist/capabilities.js

@@ -41,6 +41,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexHome = codexHome;
 exports.codexAuthFromStore = codexAuthFromStore;
 exports.probeCapabilities = probeCapabilities;
+const engine_1 = require("./desktop/engine");
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -53,6 +54,8 @@ const codex_binary_1 = require("./codex-binary");
 const win_1 = require("./win");
 const harness_registry_1 = require("./harness-registry");
 const autostart_1 = require("./autostart");
+const auto_update_1 = require("./auto-update");
+const machine_metrics_1 = require("./machine-metrics");
 function readDaemonVersion() {
     try {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -375,13 +378,14 @@ async function probeCapabilities() {
     // heartbeat — that would report the runtime permanently offline.
     const shield = (p, fallback) => p.catch(() => fallback);
     const unavailable = { available: false, authed: false };
-    const [claude, codex, kimi, gemini, grok, git] = await Promise.all([
+    const [claude, codex, kimi, gemini, grok, git, containerEngine] = await Promise.all([
         shield(probeClaude(), unavailable),
         shield(probeCodex(), unavailable),
         shield(probeKimi(), unavailable),
         shield(probeGemini(), unavailable),
         shield(probeGrok(), unavailable),
         shield(probeGit(), unavailable),
+        shield((0, engine_1.detectEngine)(), null),
     ]);
     // Decorate each harness with its registry facts (efforts, installability,
     // login strategy) so Studio and the TUI render from one source of truth.
@@ -398,6 +402,9 @@ async function probeCapabilities() {
     return {
         daemon_version: readDaemonVersion(),
         autostart: (0, autostart_1.status)(),
+        container_engine: containerEngine,
+        auto_update: (0, auto_update_1.autoUpdateState)(),
+        machine: (0, machine_metrics_1.sampleMachine)(),
         claude: deco('claude', claude),
         codex: deco('codex', codex),
         kimi: deco('kimi', kimi),

package/dist/codex-spawn.d.ts

@@ -25,6 +25,14 @@ export interface CodexInput {
      *  Mirrors the claude --strict-mcp-config behavior. */
     mcpServers?: CodexMcpServer[];
 }
+/** Build a config.toml that declares only the supplied MCP servers and
+ *  return the CODEX_HOME directory plus any env vars the child needs
+ *  (bearer tokens for remote servers). Caller is responsible for cleanup
+ *  (we drop it under os.tmpdir() so it gets reaped). */
+export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string): {
+    home: string;
+    extraEnv: Record<string, string>;
+};
 export interface CodexHandle {
     pid: number | undefined;
     threadId: string | null;

package/dist/codex-spawn.js

@@ -40,6 +40,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCodexHome = writeCodexHome;
 exports.codexEffort = codexEffort;
 exports.spawnCodex = spawnCodex;
 const child_process_1 = require("child_process");
@@ -54,15 +55,58 @@ const events_1 = require("./events");
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
 }
+/** Env var name carrying an HTTP MCP's bearer token into the codex process.
+ *  Only the NAME goes in config.toml — the value rides on the child env, so
+ *  the token never lands on disk. */
+const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
 /** Build a config.toml that declares only the supplied MCP servers and
- *  return the directory path to use as CODEX_HOME. Caller is responsible
- *  for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+ *  return the CODEX_HOME directory plus any env vars the child needs
+ *  (bearer tokens for remote servers). Caller is responsible for cleanup
+ *  (we drop it under os.tmpdir() so it gets reaped). */
 function writeCodexHome(servers, workingDirectory) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'entities-codex-'));
+    const extraEnv = {};
     let toml = '# Generated by ainode — sandboxes codex against host config\n\n';
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. Registry rows store command='http'|'sse' with
+        // args=[url]; codex spells that `url = "..."`, NOT command/args. Writing
+        // the row verbatim made codex try to exec a binary called `http`, so the
+        // server never started and its tools silently vanished — which is how a
+        // provider-ladder hop to codex dropped an entity's GitHub access without
+        // any error anywhere. The claude path (install.ts) always handled this;
+        // codex and grok did not.
+        if (s.command === 'http' || s.command === 'sse') {
+            const url = Array.isArray(s.args) && typeof s.args[0] === 'string' ? s.args[0] : null;
+            if (!url) {
+                console.error(`[codex] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const name = tomlString(s.slug).slice(1, -1);
+            toml += `[mcp_servers.${name}]\n`;
+            toml += `url = ${tomlString(url)}\n`;
+            // codex reads the bearer from its OWN environment (--env is stdio-only),
+            // so the value goes on the child env and only the var name in the file.
+            const creds = Object.entries(s.env || {})
+                .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
+            const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
+            if (bearer) {
+                const varName = bearerEnvVar(s.slug);
+                extraEnv[varName] = String(bearer[1]);
+                toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
+                if (creds.length > 1) {
+                    // codex carries one bearer and no arbitrary headers. Anything that
+                    // authenticates with several custom headers is only partly wired,
+                    // and saying so beats a server that 401s for no visible reason.
+                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
+                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
+                        `field(s) were dropped`);
+                }
+            }
+            toml += '\n';
+            continue;
+        }
         // On native Windows, registry commands like `npx` are .cmd shims that
         // codex can't CreateProcess directly — wrap with `cmd /c` (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
@@ -109,7 +153,7 @@ function writeCodexHome(servers, workingDirectory) {
     if (fs.existsSync(sessionSkillsDir)) {
         (0, win_1.linkDir)(sessionSkillsDir, path.join(dir, 'skills'));
     }
-    return dir;
+    return { home: dir, extraEnv };
 }
 function lineToEvents(line) {
     const type = typeof line.type === 'string' ? line.type : '';
@@ -194,7 +238,7 @@ function spawnCodex(input) {
     // Sandbox codex against an isolated CODEX_HOME so the host's
     // ~/.codex/config.toml mcp_servers don't leak in. TERM=dumb keeps
     // codex's TTY heuristics happy (no fancy terminal output).
-    const codexHome = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
+    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
     // Register the scratch dir with DiskGuard: marks it active (so a
     // concurrent sweep won't evict a live run) and writes a PID lock so a
     // different runtime process can tell it's still owned. dispose(true)
@@ -205,6 +249,9 @@ function spawnCodex(input) {
         ...process.env,
         TERM: 'dumb',
         CODEX_HOME: codexHome,
+        // Bearer tokens for remote (http/sse) MCP servers. config.toml names these
+        // vars via bearer_token_env_var; the values only ever live here.
+        ...mcpBearerEnv,
     };
     // Resolve binary path before spawn. Previously called spawn('codex', ...)
     // bare, which threw ENOENT under launchd / desktop-app PATH inheritance

package/dist/command-runner.d.ts

@@ -1,5 +1,7 @@
 export type RestartHook = (opts: {
-    commandId: string;
+    /** Absent when the hourly auto-update is the one rolling: nobody issued a
+     *  command, so there is nothing to close on the other side. */
+    commandId?: string;
     version: string;
     /** Bounce this daemon on the version it is already running: no npm
      *  install, no version change. See runUpdateRuntime. */