@addai/node 0.21.0 → 0.23.0

package/dist/codex-spawn.js

@@ -47,10 +47,12 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const think_split_1 = require("./think-split");
 const codex_binary_1 = require("./codex-binary");
 const diskguard_1 = require("./diskguard");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const mcp_headers_1 = require("./mcp-headers");
 /** Quote a string as a TOML basic string (double-quoted, escape backslash + quote). */
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
@@ -59,6 +61,11 @@ function tomlString(s) {
  *  Only the NAME goes in config.toml — the value rides on the child env, so
  *  the token never lands on disk. */
 const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
+/** Env var name carrying one HTTP header's value into the codex process.
+ *  config.toml references it by name via env_http_headers, so the value
+ *  itself never lands on disk. */
+const headerEnvVar = (slug, header) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}` +
+    `_H_${header.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}`;
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
  *  (bearer tokens for remote servers). Caller is responsible for cleanup
@@ -73,12 +80,16 @@ function writeCodexHome(servers, workingDirectory) {
         // Remote MCP servers. Registry rows store command='http'|'sse' with
         // args=[url]; codex spells that `url = "..."`, NOT command/args. Writing
         // the row verbatim made codex try to exec a binary called `http`, so the
-        // server never started and its tools silently vanished — which is how a
-        // provider-ladder hop to codex dropped an entity's GitHub access without
-        // any error anywhere. The claude path (install.ts) always handled this;
-        // codex and grok did not.
-        if (s.command === 'http' || s.command === 'sse') {
-            const url = Array.isArray(s.args) && typeof s.args[0] === 'string' ? s.args[0] : null;
+        // server never started and its tools silently vanished.
+        //
+        // Credentials go through env_http_headers, which maps a header name to the
+        // NAME of an env var holding its value — so the whole credential set is
+        // forwarded and config.toml still never contains a secret. This adapter
+        // used to send only ONE credential as a bearer token, on the belief that
+        // codex could not send custom headers; it can, and a server needing more
+        // than one header (addai-drive carries three) was arriving half-authorised.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
             if (!url) {
                 console.error(`[codex] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
                 continue;
@@ -86,22 +97,24 @@ function writeCodexHome(servers, workingDirectory) {
             const name = tomlString(s.slug).slice(1, -1);
             toml += `[mcp_servers.${name}]\n`;
             toml += `url = ${tomlString(url)}\n`;
-            // codex reads the bearer from its OWN environment (--env is stdio-only),
-            // so the value goes on the child env and only the var name in the file.
-            const creds = Object.entries(s.env || {})
-                .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
-            const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            // An OAuth access token is spelled as codex's native bearer rather than
+            // a hand-rolled Authorization header, so its OAuth handling still applies.
+            const bearer = headers.Authorization;
             if (bearer) {
+                delete headers.Authorization;
                 const varName = bearerEnvVar(s.slug);
-                extraEnv[varName] = String(bearer[1]);
+                extraEnv[varName] = bearer.replace(/^Bearer\s+/i, '');
                 toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
-                if (creds.length > 1) {
-                    // codex carries one bearer and no arbitrary headers. Anything that
-                    // authenticates with several custom headers is only partly wired,
-                    // and saying so beats a server that 401s for no visible reason.
-                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
-                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
-                        `field(s) were dropped`);
+            }
+            const entries = Object.entries(headers);
+            if (entries.length > 0) {
+                // Sub-table must follow the parent table's scalar keys.
+                toml += `[mcp_servers.${name}.env_http_headers]\n`;
+                for (const [header, value] of entries) {
+                    const varName = headerEnvVar(s.slug, header);
+                    extraEnv[varName] = value;
+                    toml += `${tomlString(header)} = ${tomlString(varName)}\n`;
                 }
             }
             toml += '\n';
@@ -318,6 +331,10 @@ function spawnCodex(input) {
             kill() { },
         };
     }
+    // Models do not reliably keep reasoning on their own stream — they drop
+    // back to ordinary text mid-run and carry on thinking inside a <think>
+    // tag. Split it back out before it reaches the room. See think-split.ts.
+    const emitSplit = (0, think_split_1.splittingEmitter)(emit);
     proc.stdout?.on('data', (chunk) => {
         touchActivity();
         buffer += chunk.toString('utf8');
@@ -338,7 +355,7 @@ function spawnCodex(input) {
                 threadId = parsed.thread_id;
             }
             for (const ev of lineToEvents(parsed))
-                emit(ev);
+                emitSplit(ev);
         }
     });
     proc.stderr?.on('data', (chunk) => {
@@ -354,7 +371,13 @@ function spawnCodex(input) {
         // SIGINT from kill()/timeout, or async spawn error). DiskGuard is the
         // backstop for the paths this can't cover — SIGKILL and crashes.
         proc.once('error', (err) => { void guardSession.dispose(true); reject(err); });
-        proc.once('exit', (code) => { void guardSession.dispose(true); resolve(code ?? -1); });
+        proc.once('exit', (code) => {
+            // Release anything the splitter is still holding — a run that ends
+            // mid-tag must not lose the tail of its answer.
+            emitSplit.flush();
+            void guardSession.dispose(true);
+            resolve(code ?? -1);
+        });
     });
     return {
         pid: proc.pid,

package/dist/desktop/relay-client.d.ts

@@ -1,2 +1,7 @@
+/** What to run when the server says there is work. Injected by index.ts so
+ *  this module stays ignorant of the pumps it is nudging. */
+type WakeKind = 'command' | 'request';
+export declare function onWake(kind: WakeKind, fn: () => void): void;
 export declare function startRelayClient(): void;
 export declare function stopRelayClient(): void;
+export {};

package/dist/desktop/relay-client.js

@@ -36,16 +36,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.onWake = onWake;
 exports.startRelayClient = startRelayClient;
 exports.stopRelayClient = stopRelayClient;
-// Dial-out socket to the desktop relay.
+// Dial-out socket to the relay — this node's live link to the server.
 //
-// The daemon connects OUT whenever it has a running desktop, so there is no
-// inbound port and no NAT problem - and because the socket is already open,
-// attaching a viewer is instant rather than waiting on the 30s heartbeat.
+// The daemon connects OUT, so there is no inbound port and no NAT problem.
+// It is held open ALWAYS, not only while a desktop is running, because it is
+// how the server reaches this machine without being asked: work queued in
+// Studio is pushed down here the moment it exists instead of waiting for the
+// 30s heartbeat to notice it. That heartbeat remains the fallback for a node
+// whose socket is down; this is the fast path, not the only path.
 //
-// It carries RAW RFB bytes. The container serves RFB directly (no websockify),
-// so noVNC in the browser speaks RFB across this pipe unchanged.
+// Two kinds of traffic share it:
+//   - RAW RFB bytes for desktop viewers. The container serves RFB directly
+//     (no websockify), so noVNC in the browser speaks RFB across it unchanged.
+//   - `wake` control frames, which cost nothing when idle and turn a ten
+//     second wait into a round trip.
 const ws_1 = __importDefault(require("ws"));
 const net = __importStar(require("net"));
 const store_1 = require("../store");
@@ -55,7 +62,7 @@ const RELAY_URL = process.env.AINODE_RELAY_URL
     ?? 'wss://desktop-relay-29522465016.europe-west2.run.app';
 const RECONNECT_MIN_MS = 2_000;
 const RECONNECT_MAX_MS = 60_000;
-/** Re-check whether any desktop is running this often while idle. */
+/** Re-check for a pairing token this often when there is not one yet. */
 const IDLE_CHECK_MS = 60_000;
 /** How often to prove the socket is still alive. A machine that suspends
  *  leaves a half-open socket that never fires 'close', so without this the
@@ -73,6 +80,10 @@ let missedPongs = 0;
  *  people watching the same screen each need their own connection and their
  *  own handshake. x11vnc runs with -shared precisely so it will serve them. */
 const bridges = new Map();
+const wakeHooks = new Map();
+function onWake(kind, fn) {
+    wakeHooks.set(kind, fn);
+}
 function dropBridges() {
     for (const s of bridges.values()) {
         try {
@@ -82,18 +93,28 @@ function dropBridges() {
     }
     bridges.clear();
 }
-async function anyDesktopRunning() {
-    try {
-        return (await (0, manager_1.listDesktops)()).some(d => d.status === 'running');
-    }
-    catch {
-        return false;
-    }
+/**
+ * Start a connection attempt that CANNOT take the daemon down with it.
+ *
+ * `connect` is fire-and-forget. While the socket was gated on having a
+ * running desktop, most nodes returned early and never reached the pairing
+ * read or the WebSocket construction — so a throw there was unreachable in
+ * practice. Making the socket unconditional put every node on that path, and
+ * an unhandled rejection in Node terminates the process. At boot. In a loop.
+ * A relay that cannot connect must cost this node its push channel, nothing
+ * more.
+ */
+function connectSafely() {
+    connect().catch(err => {
+        ws = null;
+        console.error('[relay] connect failed:', err?.message ?? String(err));
+        scheduleReconnect();
+    });
 }
 function scheduleReconnect() {
     if (stopped)
         return;
-    setTimeout(() => { void connect(); }, backoff);
+    setTimeout(connectSafely, backoff);
     backoff = Math.min(backoff * 2, RECONNECT_MAX_MS);
 }
 async function connect() {
@@ -104,11 +125,6 @@ async function connect() {
         scheduleReconnect();
         return;
     }
-    // No point holding a socket open for a machine with nothing to show.
-    if (!(await anyDesktopRunning())) {
-        idleTimer = setTimeout(() => { void connect(); }, IDLE_CHECK_MS);
-        return;
-    }
     const sock = new ws_1.default(`${RELAY_URL}/node?token=${encodeURIComponent(token)}`);
     ws = sock;
     sock.on('open', () => {
@@ -173,6 +189,26 @@ async function connect() {
             bridges.get(msg.viewerId)?.write(Buffer.from(msg.b64, 'base64'));
             return;
         }
+        if (msg.type === 'wake') {
+            // The whole point of the socket. Costs one function call; saves the
+            // wait for the next heartbeat.
+            const kind = msg.what;
+            const hook = kind ? wakeHooks.get(kind) : undefined;
+            if (hook) {
+                try {
+                    hook();
+                }
+                catch { /* a pump must never kill the link */ }
+            }
+            else
+                for (const h of wakeHooks.values()) {
+                    try {
+                        h();
+                    }
+                    catch { /* as above */ }
+                }
+            return;
+        }
         if (msg.type === 'detach') {
             bridges.get(msg.viewerId)?.destroy();
             bridges.delete(msg.viewerId);
@@ -197,7 +233,7 @@ function startRelayClient() {
         return;
     stopped = false;
     backoff = RECONNECT_MIN_MS;
-    void connect();
+    connectSafely();
 }
 function stopRelayClient() {
     stopped = true;

package/dist/gemini-spawn.d.ts

@@ -26,6 +26,21 @@ export interface GeminiHandle {
     onEvent(cb: (e: RuntimeEvent) => void): void;
     done: Promise<number>;
 }
+/**
+ * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
+ *
+ * gemini-cli's settings hierarchy is workspace > user — a workspace
+ * settings file wins over `~/.gemini/settings.json` field-by-field, so
+ * we can override `mcpServers` (the field we care about) without
+ * touching the user's home dir.
+ *
+ * The OLD approach pointed HOME at a temp dir to suppress the host's
+ * `~/.gemini/settings.json`. That was destructive: gemini-cli shells out
+ * to git, npm, node, and those tools read `~/.gitconfig`, `~/.npmrc`,
+ * `~/.netrc` from HOME. Pointing HOME at an empty dir blew them all
+ * away → silent tool failures (git push without creds, etc.).
+ */
+export declare function writeGeminiWorkspaceSettings(cwd: string, servers: GeminiMcpServer[]): string;
 /** gemini-cli session ids are v4 UUIDs (createSessionId → node randomUUID).
  *  Only pass a plausibly-gemini id to `--resume`; a foreign id would just be
  *  reported "Invalid session identifier" and the run degrades to fresh via the

package/dist/gemini-spawn.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeGeminiWorkspaceSettings = writeGeminiWorkspaceSettings;
 exports.isGeminiSessionId = isGeminiSessionId;
 exports.lineToEvents = lineToEvents;
 exports.spawnGemini = spawnGemini;
@@ -54,6 +55,8 @@ const path = __importStar(require("path"));
 const gemini_binary_1 = require("./gemini-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /**
  * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
  *
@@ -75,6 +78,24 @@ function writeGeminiWorkspaceSettings(cwd, servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. gemini's settings schema spells streamable HTTP as
+        // `httpUrl` and SSE as `url` + `type: "sse"`, both with a `headers` map.
+        // Writing the registry row verbatim made gemini try to exec a binary
+        // called `http`, so the server never started and its tools were simply
+        // absent from the run — no error, nothing in the DB.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[gemini] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            const hasHeaders = Object.keys(headers).length > 0;
+            mcpServers[s.slug] = s.command === 'sse'
+                ? { url, type: 'sse', ...(hasHeaders ? { headers } : {}) }
+                : { httpUrl: url, ...(hasHeaders ? { headers } : {}) };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpServers[s.slug] = {
@@ -300,6 +321,10 @@ function spawnGemini(input) {
             done: Promise.resolve(-1),
         };
     }
+    // Models do not reliably keep reasoning on their own stream — they drop
+    // back to ordinary text mid-run and carry on thinking inside a <think>
+    // tag. Split it back out before it reaches the room. See think-split.ts.
+    const emitSplit = (0, think_split_1.splittingEmitter)(emit);
     proc.stdout?.on('data', (chunk) => {
         buffer += chunk.toString('utf8');
         let nl;
@@ -318,7 +343,7 @@ function spawnGemini(input) {
             if (typeof parsed.session_id === 'string' && !sessionId)
                 sessionId = parsed.session_id;
             for (const ev of lineToEvents(parsed))
-                emit(ev);
+                emitSplit(ev);
         }
     });
     proc.stderr?.on('data', (chunk) => {
@@ -349,10 +374,13 @@ function spawnGemini(input) {
                     if (typeof parsed.session_id === 'string' && !sessionId)
                         sessionId = parsed.session_id;
                     for (const ev of lineToEvents(parsed))
-                        emit(ev);
+                        emitSplit(ev);
                 }
                 catch { /* ignore a partial/non-JSON tail */ }
             }
+            // Release anything the splitter is still holding — a run that ends
+            // mid-tag must not lose the tail of its answer.
+            emitSplit.flush();
             // No HOME-temp-dir to clean up anymore. The workspace settings file in
             // <cwd>/.gemini/settings.json sits with the rest of the ephemeral cwd
             // and is cleaned by the session dispose path.

package/dist/grok-spawn.js

@@ -73,6 +73,8 @@ const path = __importStar(require("path"));
 const grok_binary_1 = require("./grok-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Real config dir for the logged-in account. GROK_HOME points here so the
  *  entity uses the same account and token refresh works. */
 function realGrokHome() {
@@ -159,16 +161,30 @@ function writeProjectMcpConfig(workingDirectory, servers) {
     }
     const lines = [];
     for (const s of usable) {
-        // Remote MCP servers (registry command='http'|'sse', args=[url]) have no
-        // verified grok config spelling, and writing the row verbatim is worse
-        // than skipping: grok would try to exec a binary called `http`, the
-        // server would never start, and its tools would vanish with no error —
-        // the exact silent failure that cost an entity its GitHub access after a
-        // provider-ladder hop. Skip it, and say so loudly enough to be findable.
-        if (s.command === 'http' || s.command === 'sse') {
-            console.error(`[grok] MCP ${s.slug}: remote ${s.command} servers are not supported by the grok ` +
-                `adapter — skipping. Its tools will be ABSENT from this run. Use claude (or codex, ` +
-                `which supports url + bearer_token_env_var) for entities that depend on it.`);
+        // Remote MCP servers. xAI documents [mcp_servers.<name>] with `url` and a
+        // `headers` inline table, so grok now gets them properly instead of the
+        // skip this used to do — a skip that was safe (better than emitting
+        // `command = "http"`, which grok would try to exec) but meant an entity
+        // running on grok silently had none of its remote servers.
+        //
+        // Folder trust still gates repo-local config.toml servers, so the --trust
+        // launch flag remains load-bearing for these entries to start at all.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[grok] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            lines.push(`[mcp_servers.${tomlStr(s.slug)}]`);
+            lines.push(`url = ${tomlStr(url)}`);
+            const headers = Object.entries((0, mcp_headers_1.remoteMcpHeaders)(s.env));
+            if (headers.length > 0) {
+                const kv = headers.map(([k, v]) => `${tomlStr(k)} = ${tomlStr(v)}`).join(', ');
+                lines.push(`headers = { ${kv} }`);
+            }
+            lines.push('enabled = true');
+            lines.push('startup_timeout_sec = 30');
+            lines.push('');
             continue;
         }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
@@ -415,25 +431,52 @@ function spawnGrok(input) {
             emit({ type: 'assistant_text', delta });
         }
     };
+    // grok does not always keep reasoning on the `thought` stream: mid-run it
+    // will drop back to ordinary text and carry on thinking inside a <think>
+    // tag. Everything visible therefore goes through the splitter first, so
+    // private working never lands in the room. See think-split.ts.
+    const splitter = (0, think_split_1.createThinkSplitter)();
+    /** Visible answer text, already known not to be reasoning. */
+    const appendText = (delta) => {
+        // Thoughts precede the text they produced — flush them first.
+        flushThinking();
+        textBuf += delta;
+        if (textBuf.length >= MAX_BUF)
+            flushText();
+        else if (!flushTimer)
+            flushTimer = setTimeout(flushText, FLUSH_MS);
+    };
+    const appendThinking = (delta) => {
+        thinkBuf += delta;
+        if (thinkBuf.length >= THINK_MAX_BUF)
+            flushThinking();
+        else if (!thinkTimer)
+            thinkTimer = setTimeout(flushThinking, THINK_FLUSH_MS);
+    };
     const emitCoalesced = (e) => {
         if (e.type === 'assistant_text') {
-            // Thoughts precede the text they produced — flush them first.
-            flushThinking();
-            textBuf += e.delta;
-            if (textBuf.length >= MAX_BUF)
-                flushText();
-            else if (!flushTimer)
-                flushTimer = setTimeout(flushText, FLUSH_MS);
+            // A delta may be part answer and part reasoning, or may end halfway
+            // through a tag — the splitter holds back whatever is still ambiguous.
+            for (const part of splitter.push(e.delta)) {
+                if (part.type === 'thinking')
+                    appendThinking(part.delta);
+                else if (part.type === 'assistant_text')
+                    appendText(part.delta);
+            }
         }
         else if (e.type === 'thinking') {
-            thinkBuf += e.delta;
-            if (thinkBuf.length >= THINK_MAX_BUF)
-                flushThinking();
-            else if (!thinkTimer)
-                thinkTimer = setTimeout(flushThinking, THINK_FLUSH_MS);
+            appendThinking(e.delta);
         }
         else {
-            // Any other event must appear AFTER the stream so far — flush both.
+            // Any other event must appear AFTER the stream so far. Release whatever
+            // the splitter is still holding: a run that ends mid-tag must not eat
+            // the tail of the answer.
+            for (const part of splitter.flush()) {
+                if (part.type === 'thinking')
+                    appendThinking(part.delta);
+                else if (part.type === 'assistant_text')
+                    appendText(part.delta);
+            }
             flushThinking();
             flushText();
             emit(e);

package/dist/index.js

@@ -210,7 +210,12 @@ async function start(argv = []) {
     (0, projects_1.start)();
     // …and to keep desktops and the containers behind them in agreement.
     (0, manager_1.startDesktopManager)();
-    // …and dial out to the relay so a running desktop is watchable from Studio.
+    // …and dial out to the relay. That socket is this node's live link: the
+    // server pushes work down it the instant it exists, so a command no longer
+    // waits up to 30s for the next heartbeat to notice it. The heartbeat and
+    // the request pump still run — this makes them the fallback, not the clock.
+    (0, relay_client_1.onWake)('command', command_runner_1.wake);
+    (0, relay_client_1.onWake)('request', request_pump_1.pumpNow);
     (0, relay_client_1.startRelayClient)();
     let stopped = false;
     // Outcome of the last drain, so a remote roll can report whether it left

package/dist/install.d.ts

@@ -42,6 +42,7 @@ export interface InstallResult {
     /** Cleanup callback — removes everything this install wrote. */
     dispose: () => Promise<void>;
 }
+export declare function writeMcpConfig(cwd: string, mcps: ResolvedMcp[]): string | null;
 /**
  * Run install side-effects against `cwd` and return paths to clean up
  * later. Safe to call with an empty set — returns a no-op result.

package/dist/install.js

@@ -47,12 +47,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_MCP_CONFIG_FILENAME = exports.MCP_CONFIG_FILENAME = void 0;
+exports.writeMcpConfig = writeMcpConfig;
 exports.install = install;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const supabase_client_1 = require("./supabase-client");
 const store_1 = require("./store");
 const win_1 = require("./win");
+const mcp_headers_1 = require("./mcp-headers");
 /** Hidden per-session MCP config written next to the agent's working dir. */
 exports.MCP_CONFIG_FILENAME = '.ainode.mcp.json';
 /** Pre-rename filename; removed when found so agents don't read a stale copy. */
@@ -111,27 +113,19 @@ function writeMcpConfig(cwd, mcps) {
         if (!m.slug || !m.command)
             continue;
         // Remote MCP servers: registry rows use command='http' (or 'sse') with
-        // args=[url]. An OAuth bearer token rides in the credential as
-        // OAUTH_ACCESS_TOKEN and becomes the Authorization header — this is how
-        // headless sessions use account-authenticated remote MCPs (e.g. the
-        // official Higgsfield server) without an interactive OAuth dance.
-        if (m.command === 'http' || m.command === 'sse') {
-            const url = Array.isArray(m.args) && typeof m.args[0] === 'string' ? m.args[0] : null;
-            if (!url)
+        // args=[url]. Credentials ride as request headers — see mcp-headers.ts for
+        // the naming rule and why OAUTH_* keys other than the access token are
+        // withheld. This is how headless sessions use account-authenticated remote
+        // MCPs (e.g. the official Higgsfield server) without an interactive OAuth
+        // dance.
+        if ((0, mcp_headers_1.isRemoteMcp)(m.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(m.args);
+            if (!url) {
+                console.error(`[install] MCP ${m.slug}: ${m.command} server has no URL — skipped`);
                 continue;
-            const entry = { type: m.command, url };
-            const headers = {};
-            const token = m.env?.OAUTH_ACCESS_TOKEN;
-            if (token)
-                headers.Authorization = `Bearer ${token}`;
-            // Other env keys become literal headers (so remote MCPs with custom
-            // header auth work), but OAUTH_* keys are token bookkeeping (refresh
-            // token, expiry) — never send them as request headers.
-            for (const [k, v] of Object.entries(m.env || {})) {
-                if (!v || k.startsWith('OAUTH_'))
-                    continue;
-                headers[k.replace(/_/g, '-')] = v;
             }
+            const entry = { type: m.command, url };
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(m.env);
             if (Object.keys(headers).length > 0)
                 entry.headers = headers;
             servers[m.slug] = entry;

package/dist/kimi-spawn.d.ts

@@ -39,6 +39,13 @@ export interface KimiHandle {
     onActivity(cb: () => void): void;
     done: Promise<number>;
 }
+/** Write a sandbox $HOME with an empty .kimi dir so kimi's default
+ *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
+ *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
+export declare function writeKimiSandboxHome(servers: KimiMcpServer[]): {
+    homeDir: string;
+    mcpConfigPath: string;
+};
 /** Parse one stream-json line into 0+ RuntimeEvents. Kimi's shapes are
  *  similar in spirit to claude's: assistant text deltas, tool calls,
  *  turn completion, and session metadata. Anything we don't recognise

package/dist/kimi-spawn.js

@@ -42,6 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeKimiSandboxHome = writeKimiSandboxHome;
 exports.lineToEvents = lineToEvents;
 exports.spawnKimi = spawnKimi;
 const child_process_1 = require("child_process");
@@ -51,6 +52,8 @@ const path = __importStar(require("path"));
 const kimi_binary_1 = require("./kimi-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Write a sandbox $HOME with an empty .kimi dir so kimi's default
  *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
  *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
@@ -61,6 +64,24 @@ function writeKimiSandboxHome(servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. kimi's mcp.json takes `url` and infers the transport
+        // from url-vs-command, so no `transport` key is needed for streamable HTTP;
+        // SSE is stated explicitly. Headers carry the credential set. Writing the
+        // registry row verbatim made kimi try to exec a binary called `http`.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[kimi] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            mcpConfig.mcpServers[s.slug] = {
+                url,
+                ...(s.command === 'sse' ? { transport: 'sse' } : {}),
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpConfig.mcpServers[s.slug] = {
@@ -269,6 +290,10 @@ function spawnKimi(input) {
             done: Promise.resolve(-1),
         };
     }
+    // Models do not reliably keep reasoning on their own stream — they drop
+    // back to ordinary text mid-run and carry on thinking inside a <think>
+    // tag. Split it back out before it reaches the room. See think-split.ts.
+    const emitSplit = (0, think_split_1.splittingEmitter)(emit);
     proc.stdout?.on('data', (chunk) => {
         touchActivity();
         buffer += chunk.toString('utf8');
@@ -288,7 +313,7 @@ function spawnKimi(input) {
             if (typeof parsed.session_id === 'string' && !sessionId)
                 sessionId = parsed.session_id;
             for (const ev of lineToEvents(parsed))
-                emit(ev);
+                emitSplit(ev);
         }
     });
     proc.stderr?.on('data', (chunk) => {
@@ -300,6 +325,9 @@ function spawnKimi(input) {
     const done = new Promise((resolve, reject) => {
         proc.once('error', reject);
         proc.once('exit', (code) => {
+            // Release anything the splitter is still holding — a run that ends
+            // mid-tag must not lose the tail of its answer.
+            emitSplit.flush();
             // Best-effort cleanup of sandbox tmp dir
             try {
                 fs.rmSync(kimiSandboxDir, { recursive: true, force: true });

package/dist/mcp-headers.d.ts

@@ -0,0 +1,15 @@
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+export declare function isRemoteMcp(command: string): boolean;
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+export declare function remoteMcpUrl(args?: string[] | null): string | null;
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+export declare function remoteMcpHeaders(env?: Record<string, string> | null): Record<string, string>;

package/dist/mcp-headers.js

@@ -0,0 +1,49 @@
+"use strict";
+// Shared handling for remote (http/sse) MCP registry rows.
+//
+// Registry rows store remote servers as command='http'|'sse' with args=[url]
+// and the credential set in env. Each agent CLI spells the config differently,
+// but all five make the same three decisions first — is this row remote, what
+// URL does it point at, and what headers does its env map become. That lived
+// inline in install.ts (the claude path) and the other four adapters each got
+// it wrong in their own way, so it lives here now and they all call it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRemoteMcp = isRemoteMcp;
+exports.remoteMcpUrl = remoteMcpUrl;
+exports.remoteMcpHeaders = remoteMcpHeaders;
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+function isRemoteMcp(command) {
+    return command === 'http' || command === 'sse';
+}
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+function remoteMcpUrl(args) {
+    if (!Array.isArray(args))
+        return null;
+    const first = args[0];
+    return typeof first === 'string' && first.length > 0 ? first : null;
+}
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+function remoteMcpHeaders(env) {
+    const headers = {};
+    for (const [key, value] of Object.entries(env || {})) {
+        if (typeof value !== 'string' || value.length === 0)
+            continue;
+        if (key === 'OAUTH_ACCESS_TOKEN') {
+            headers.Authorization = `Bearer ${value}`;
+            continue;
+        }
+        if (key.startsWith('OAUTH_'))
+            continue;
+        headers[key.replace(/_/g, '-')] = value;
+    }
+    return headers;
+}

package/dist/request-pump.d.ts

@@ -2,6 +2,16 @@ export declare function inflightCount(): number;
 export declare function activeRequestIdList(): string[];
 export declare function start(): void;
 export declare function stop(): void;
+/**
+ * Pick up work right now, because the server said there is some.
+ *
+ * Called from the relay socket's `wake`. Deliberately does NOT clear
+ * `nextPickAllowedAt`: if the pump is backing off because Supabase is
+ * unhealthy, a push is no reason to start hammering it again — the backoff
+ * exists to protect the connection pool, and a wake that ignored it would
+ * reintroduce exactly the pile-up it was added to stop.
+ */
+export declare function pumpNow(): void;
 /**
  * Wait for all in-flight requests to finish, with a hard ceiling so a
  * hung spawn can't block daemon shutdown forever. Resolves when either

package/dist/request-pump.js

@@ -8,6 +8,7 @@ exports.inflightCount = inflightCount;
 exports.activeRequestIdList = activeRequestIdList;
 exports.start = start;
 exports.stop = stop;
+exports.pumpNow = pumpNow;
 exports.drain = drain;
 const supabase_client_1 = require("./supabase-client");
 const store_1 = require("./store");
@@ -236,6 +237,20 @@ function stop() {
         timer = null;
     }
 }
+/**
+ * Pick up work right now, because the server said there is some.
+ *
+ * Called from the relay socket's `wake`. Deliberately does NOT clear
+ * `nextPickAllowedAt`: if the pump is backing off because Supabase is
+ * unhealthy, a push is no reason to start hammering it again — the backoff
+ * exists to protect the connection pool, and a wake that ignored it would
+ * reintroduce exactly the pile-up it was added to stop.
+ */
+function pumpNow() {
+    if (stopped)
+        return;
+    void tick();
+}
 /**
  * Wait for all in-flight requests to finish, with a hard ceiling so a
  * hung spawn can't block daemon shutdown forever. Resolves when either

package/dist/think-split.d.ts

@@ -0,0 +1,24 @@
+import type { RuntimeEvent } from './types';
+export interface ThinkSplitter {
+    /** Feed one visible-text delta; get back correctly-typed events. */
+    push(delta: string): RuntimeEvent[];
+    /** End of stream: release anything held back. */
+    flush(): RuntimeEvent[];
+    /** True while inside a reasoning region — the run ended mid-thought. */
+    get open(): boolean;
+}
+export declare function createThinkSplitter(): ThinkSplitter;
+/**
+ * Wrap a harness's `emit` so visible text is split before it leaves.
+ *
+ * Harnesses map one JSON line to events with a pure function and emit them in
+ * a loop, so there is no natural place to keep splitter state. This holds it,
+ * and releases anything held back as soon as a non-text event arrives — the
+ * tail of an answer must never sit hostage behind a tool call.
+ */
+export interface SplittingEmit {
+    (e: RuntimeEvent): void;
+    /** End of stream: release whatever is still held. */
+    flush(): void;
+}
+export declare function splittingEmitter(emit: (e: RuntimeEvent) => void): SplittingEmit;

package/dist/think-split.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createThinkSplitter = createThinkSplitter;
+exports.splittingEmitter = splittingEmitter;
+/** Openers seen in the wild across grok, qwen, deepseek-style outputs. The
+ *  closer is the same word, so one list drives both. */
+const TAGS = ['think', 'thinking', 'thought', 'reason', 'reasoning', 'antml'];
+/** Longest string we might have to hold back: `</reasoning>` plus slack. */
+const MAX_HOLD = 14;
+function openerAt(buf, i) {
+    if (buf[i] !== '<')
+        return null;
+    for (const tag of TAGS) {
+        const open = `<${tag}>`;
+        if (buf.slice(i, i + open.length).toLowerCase() === open)
+            return { tag, len: open.length };
+    }
+    return null;
+}
+function closerAt(buf, i, tag) {
+    const close = `</${tag}>`;
+    return buf.slice(i, i + close.length).toLowerCase() === close ? close.length : null;
+}
+/** True when the tail of `buf` from `i` could still grow into a tag. */
+function couldBecomeTag(buf, i) {
+    const tail = buf.slice(i).toLowerCase();
+    if (!tail.startsWith('<'))
+        return false;
+    const body = tail.startsWith('</') ? tail.slice(2) : tail.slice(1);
+    return TAGS.some(t => t.startsWith(body)) || body.length === 0;
+}
+function createThinkSplitter() {
+    let buf = '';
+    let inside = null;
+    function drain(final) {
+        const out = [];
+        let text = '';
+        let think = '';
+        let i = 0;
+        while (i < buf.length) {
+            if (inside === null) {
+                const open = openerAt(buf, i);
+                if (open) {
+                    inside = open.tag;
+                    i += open.len;
+                    continue;
+                }
+                if (!final && couldBecomeTag(buf, i) && buf.length - i < MAX_HOLD)
+                    break;
+                text += buf[i];
+                i += 1;
+            }
+            else {
+                const close = closerAt(buf, i, inside);
+                if (close !== null) {
+                    inside = null;
+                    i += close;
+                    continue;
+                }
+                if (!final && couldBecomeTag(buf, i) && buf.length - i < MAX_HOLD)
+                    break;
+                think += buf[i];
+                i += 1;
+            }
+        }
+        buf = buf.slice(i);
+        if (think)
+            out.push({ type: 'thinking', delta: think });
+        if (text)
+            out.push({ type: 'assistant_text', delta: text });
+        return out;
+    }
+    return {
+        push(delta) {
+            if (!delta)
+                return [];
+            buf += delta;
+            return drain(false);
+        },
+        flush() {
+            // Whatever is left is real output, tag or not — never silently swallow
+            // the tail of an answer because it happened to look like markup.
+            return drain(true);
+        },
+        get open() { return inside !== null; },
+    };
+}
+function splittingEmitter(emit) {
+    const splitter = createThinkSplitter();
+    const release = () => { for (const part of splitter.flush())
+        emit(part); };
+    const out = ((e) => {
+        if (e.type === 'assistant_text') {
+            for (const part of splitter.push(e.delta))
+                emit(part);
+            return;
+        }
+        release();
+        emit(e);
+    });
+    out.flush = release;
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [