@addai/node 0.22.0 → 0.24.0

package/dist/codex-spawn.js

@@ -52,6 +52,7 @@ const codex_binary_1 = require("./codex-binary");
 const diskguard_1 = require("./diskguard");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const mcp_headers_1 = require("./mcp-headers");
 /** Quote a string as a TOML basic string (double-quoted, escape backslash + quote). */
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
@@ -60,6 +61,11 @@ function tomlString(s) {
  *  Only the NAME goes in config.toml — the value rides on the child env, so
  *  the token never lands on disk. */
 const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
+/** Env var name carrying one HTTP header's value into the codex process.
+ *  config.toml references it by name via env_http_headers, so the value
+ *  itself never lands on disk. */
+const headerEnvVar = (slug, header) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}` +
+    `_H_${header.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}`;
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
  *  (bearer tokens for remote servers). Caller is responsible for cleanup
@@ -74,12 +80,16 @@ function writeCodexHome(servers, workingDirectory) {
         // Remote MCP servers. Registry rows store command='http'|'sse' with
         // args=[url]; codex spells that `url = "..."`, NOT command/args. Writing
         // the row verbatim made codex try to exec a binary called `http`, so the
-        // server never started and its tools silently vanished — which is how a
-        // provider-ladder hop to codex dropped an entity's GitHub access without
-        // any error anywhere. The claude path (install.ts) always handled this;
-        // codex and grok did not.
-        if (s.command === 'http' || s.command === 'sse') {
-            const url = Array.isArray(s.args) && typeof s.args[0] === 'string' ? s.args[0] : null;
+        // server never started and its tools silently vanished.
+        //
+        // Credentials go through env_http_headers, which maps a header name to the
+        // NAME of an env var holding its value — so the whole credential set is
+        // forwarded and config.toml still never contains a secret. This adapter
+        // used to send only ONE credential as a bearer token, on the belief that
+        // codex could not send custom headers; it can, and a server needing more
+        // than one header (addai-drive carries three) was arriving half-authorised.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
             if (!url) {
                 console.error(`[codex] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
                 continue;
@@ -87,22 +97,24 @@ function writeCodexHome(servers, workingDirectory) {
             const name = tomlString(s.slug).slice(1, -1);
             toml += `[mcp_servers.${name}]\n`;
             toml += `url = ${tomlString(url)}\n`;
-            // codex reads the bearer from its OWN environment (--env is stdio-only),
-            // so the value goes on the child env and only the var name in the file.
-            const creds = Object.entries(s.env || {})
-                .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
-            const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            // An OAuth access token is spelled as codex's native bearer rather than
+            // a hand-rolled Authorization header, so its OAuth handling still applies.
+            const bearer = headers.Authorization;
             if (bearer) {
+                delete headers.Authorization;
                 const varName = bearerEnvVar(s.slug);
-                extraEnv[varName] = String(bearer[1]);
+                extraEnv[varName] = bearer.replace(/^Bearer\s+/i, '');
                 toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
-                if (creds.length > 1) {
-                    // codex carries one bearer and no arbitrary headers. Anything that
-                    // authenticates with several custom headers is only partly wired,
-                    // and saying so beats a server that 401s for no visible reason.
-                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
-                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
-                        `field(s) were dropped`);
+            }
+            const entries = Object.entries(headers);
+            if (entries.length > 0) {
+                // Sub-table must follow the parent table's scalar keys.
+                toml += `[mcp_servers.${name}.env_http_headers]\n`;
+                for (const [header, value] of entries) {
+                    const varName = headerEnvVar(s.slug, header);
+                    extraEnv[varName] = value;
+                    toml += `${tomlString(header)} = ${tomlString(varName)}\n`;
                 }
             }
             toml += '\n';

package/dist/control-server.js

@@ -114,7 +114,12 @@ async function handleRequest(req, res) {
         if (data == null)
             return;
         const inflight = (0, request_pump_1.inflightCount)();
-        return send(res, 200, { ...data, inflight });
+        // The ceiling next to the count: "3 inflight" means nothing without it.
+        return send(res, 200, {
+            ...data,
+            inflight,
+            max_concurrent: (0, request_pump_1.maxConcurrentRuns)(),
+        });
     }
     // Recent requests (most recent first). ?limit=20 caps the count.
     if (path === '/requests' && method === 'GET') {

package/dist/desktop/relay-client.js

@@ -93,10 +93,28 @@ function dropBridges() {
     }
     bridges.clear();
 }
+/**
+ * Start a connection attempt that CANNOT take the daemon down with it.
+ *
+ * `connect` is fire-and-forget. While the socket was gated on having a
+ * running desktop, most nodes returned early and never reached the pairing
+ * read or the WebSocket construction — so a throw there was unreachable in
+ * practice. Making the socket unconditional put every node on that path, and
+ * an unhandled rejection in Node terminates the process. At boot. In a loop.
+ * A relay that cannot connect must cost this node its push channel, nothing
+ * more.
+ */
+function connectSafely() {
+    connect().catch(err => {
+        ws = null;
+        console.error('[relay] connect failed:', err?.message ?? String(err));
+        scheduleReconnect();
+    });
+}
 function scheduleReconnect() {
     if (stopped)
         return;
-    setTimeout(() => { void connect(); }, backoff);
+    setTimeout(connectSafely, backoff);
     backoff = Math.min(backoff * 2, RECONNECT_MAX_MS);
 }
 async function connect() {
@@ -215,7 +233,7 @@ function startRelayClient() {
         return;
     stopped = false;
     backoff = RECONNECT_MIN_MS;
-    void connect();
+    connectSafely();
 }
 function stopRelayClient() {
     stopped = true;

package/dist/gemini-spawn.d.ts

@@ -26,6 +26,21 @@ export interface GeminiHandle {
     onEvent(cb: (e: RuntimeEvent) => void): void;
     done: Promise<number>;
 }
+/**
+ * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
+ *
+ * gemini-cli's settings hierarchy is workspace > user — a workspace
+ * settings file wins over `~/.gemini/settings.json` field-by-field, so
+ * we can override `mcpServers` (the field we care about) without
+ * touching the user's home dir.
+ *
+ * The OLD approach pointed HOME at a temp dir to suppress the host's
+ * `~/.gemini/settings.json`. That was destructive: gemini-cli shells out
+ * to git, npm, node, and those tools read `~/.gitconfig`, `~/.npmrc`,
+ * `~/.netrc` from HOME. Pointing HOME at an empty dir blew them all
+ * away → silent tool failures (git push without creds, etc.).
+ */
+export declare function writeGeminiWorkspaceSettings(cwd: string, servers: GeminiMcpServer[]): string;
 /** gemini-cli session ids are v4 UUIDs (createSessionId → node randomUUID).
  *  Only pass a plausibly-gemini id to `--resume`; a foreign id would just be
  *  reported "Invalid session identifier" and the run degrades to fresh via the

package/dist/gemini-spawn.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeGeminiWorkspaceSettings = writeGeminiWorkspaceSettings;
 exports.isGeminiSessionId = isGeminiSessionId;
 exports.lineToEvents = lineToEvents;
 exports.spawnGemini = spawnGemini;
@@ -55,6 +56,7 @@ const gemini_binary_1 = require("./gemini-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /**
  * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
  *
@@ -76,6 +78,24 @@ function writeGeminiWorkspaceSettings(cwd, servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. gemini's settings schema spells streamable HTTP as
+        // `httpUrl` and SSE as `url` + `type: "sse"`, both with a `headers` map.
+        // Writing the registry row verbatim made gemini try to exec a binary
+        // called `http`, so the server never started and its tools were simply
+        // absent from the run — no error, nothing in the DB.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[gemini] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            const hasHeaders = Object.keys(headers).length > 0;
+            mcpServers[s.slug] = s.command === 'sse'
+                ? { url, type: 'sse', ...(hasHeaders ? { headers } : {}) }
+                : { httpUrl: url, ...(hasHeaders ? { headers } : {}) };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpServers[s.slug] = {

package/dist/grok-spawn.js

@@ -74,6 +74,7 @@ const grok_binary_1 = require("./grok-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Real config dir for the logged-in account. GROK_HOME points here so the
  *  entity uses the same account and token refresh works. */
 function realGrokHome() {
@@ -160,16 +161,30 @@ function writeProjectMcpConfig(workingDirectory, servers) {
     }
     const lines = [];
     for (const s of usable) {
-        // Remote MCP servers (registry command='http'|'sse', args=[url]) have no
-        // verified grok config spelling, and writing the row verbatim is worse
-        // than skipping: grok would try to exec a binary called `http`, the
-        // server would never start, and its tools would vanish with no error —
-        // the exact silent failure that cost an entity its GitHub access after a
-        // provider-ladder hop. Skip it, and say so loudly enough to be findable.
-        if (s.command === 'http' || s.command === 'sse') {
-            console.error(`[grok] MCP ${s.slug}: remote ${s.command} servers are not supported by the grok ` +
-                `adapter — skipping. Its tools will be ABSENT from this run. Use claude (or codex, ` +
-                `which supports url + bearer_token_env_var) for entities that depend on it.`);
+        // Remote MCP servers. xAI documents [mcp_servers.<name>] with `url` and a
+        // `headers` inline table, so grok now gets them properly instead of the
+        // skip this used to do — a skip that was safe (better than emitting
+        // `command = "http"`, which grok would try to exec) but meant an entity
+        // running on grok silently had none of its remote servers.
+        //
+        // Folder trust still gates repo-local config.toml servers, so the --trust
+        // launch flag remains load-bearing for these entries to start at all.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[grok] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            lines.push(`[mcp_servers.${tomlStr(s.slug)}]`);
+            lines.push(`url = ${tomlStr(url)}`);
+            const headers = Object.entries((0, mcp_headers_1.remoteMcpHeaders)(s.env));
+            if (headers.length > 0) {
+                const kv = headers.map(([k, v]) => `${tomlStr(k)} = ${tomlStr(v)}`).join(', ');
+                lines.push(`headers = { ${kv} }`);
+            }
+            lines.push('enabled = true');
+            lines.push('startup_timeout_sec = 30');
+            lines.push('');
             continue;
         }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).

package/dist/heartbeat.js

@@ -53,6 +53,12 @@ async function tick() {
         }
         if (res && typeof res.auto_update === 'boolean')
             autoUpdateArmed = res.auto_update;
+        // How many runs this node may hold at once. Same rationale as auto_update:
+        // one number on the node's own row, and the daemon is already talking to
+        // the server every 30s. Absent field = older server = leave the pump on
+        // whatever it already had (its own default of 4).
+        if (res && res.max_concurrent_runs != null)
+            (0, request_pump_1.setMaxConcurrent)(res.max_concurrent_runs);
     }
     catch (err) {
         if (err instanceof supabase_client_1.RpcError && err.status === 401) {

package/dist/install.d.ts

@@ -42,6 +42,7 @@ export interface InstallResult {
     /** Cleanup callback — removes everything this install wrote. */
     dispose: () => Promise<void>;
 }
+export declare function writeMcpConfig(cwd: string, mcps: ResolvedMcp[]): string | null;
 /**
  * Run install side-effects against `cwd` and return paths to clean up
  * later. Safe to call with an empty set — returns a no-op result.

package/dist/install.js

@@ -47,12 +47,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_MCP_CONFIG_FILENAME = exports.MCP_CONFIG_FILENAME = void 0;
+exports.writeMcpConfig = writeMcpConfig;
 exports.install = install;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const supabase_client_1 = require("./supabase-client");
 const store_1 = require("./store");
 const win_1 = require("./win");
+const mcp_headers_1 = require("./mcp-headers");
 /** Hidden per-session MCP config written next to the agent's working dir. */
 exports.MCP_CONFIG_FILENAME = '.ainode.mcp.json';
 /** Pre-rename filename; removed when found so agents don't read a stale copy. */
@@ -111,27 +113,19 @@ function writeMcpConfig(cwd, mcps) {
         if (!m.slug || !m.command)
             continue;
         // Remote MCP servers: registry rows use command='http' (or 'sse') with
-        // args=[url]. An OAuth bearer token rides in the credential as
-        // OAUTH_ACCESS_TOKEN and becomes the Authorization header — this is how
-        // headless sessions use account-authenticated remote MCPs (e.g. the
-        // official Higgsfield server) without an interactive OAuth dance.
-        if (m.command === 'http' || m.command === 'sse') {
-            const url = Array.isArray(m.args) && typeof m.args[0] === 'string' ? m.args[0] : null;
-            if (!url)
+        // args=[url]. Credentials ride as request headers — see mcp-headers.ts for
+        // the naming rule and why OAUTH_* keys other than the access token are
+        // withheld. This is how headless sessions use account-authenticated remote
+        // MCPs (e.g. the official Higgsfield server) without an interactive OAuth
+        // dance.
+        if ((0, mcp_headers_1.isRemoteMcp)(m.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(m.args);
+            if (!url) {
+                console.error(`[install] MCP ${m.slug}: ${m.command} server has no URL — skipped`);
                 continue;
-            const entry = { type: m.command, url };
-            const headers = {};
-            const token = m.env?.OAUTH_ACCESS_TOKEN;
-            if (token)
-                headers.Authorization = `Bearer ${token}`;
-            // Other env keys become literal headers (so remote MCPs with custom
-            // header auth work), but OAUTH_* keys are token bookkeeping (refresh
-            // token, expiry) — never send them as request headers.
-            for (const [k, v] of Object.entries(m.env || {})) {
-                if (!v || k.startsWith('OAUTH_'))
-                    continue;
-                headers[k.replace(/_/g, '-')] = v;
             }
+            const entry = { type: m.command, url };
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(m.env);
             if (Object.keys(headers).length > 0)
                 entry.headers = headers;
             servers[m.slug] = entry;

package/dist/kimi-spawn.d.ts

@@ -39,6 +39,13 @@ export interface KimiHandle {
     onActivity(cb: () => void): void;
     done: Promise<number>;
 }
+/** Write a sandbox $HOME with an empty .kimi dir so kimi's default
+ *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
+ *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
+export declare function writeKimiSandboxHome(servers: KimiMcpServer[]): {
+    homeDir: string;
+    mcpConfigPath: string;
+};
 /** Parse one stream-json line into 0+ RuntimeEvents. Kimi's shapes are
  *  similar in spirit to claude's: assistant text deltas, tool calls,
  *  turn completion, and session metadata. Anything we don't recognise

package/dist/kimi-spawn.js

@@ -42,6 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeKimiSandboxHome = writeKimiSandboxHome;
 exports.lineToEvents = lineToEvents;
 exports.spawnKimi = spawnKimi;
 const child_process_1 = require("child_process");
@@ -52,6 +53,7 @@ const kimi_binary_1 = require("./kimi-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Write a sandbox $HOME with an empty .kimi dir so kimi's default
  *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
  *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
@@ -62,6 +64,24 @@ function writeKimiSandboxHome(servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. kimi's mcp.json takes `url` and infers the transport
+        // from url-vs-command, so no `transport` key is needed for streamable HTTP;
+        // SSE is stated explicitly. Headers carry the credential set. Writing the
+        // registry row verbatim made kimi try to exec a binary called `http`.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[kimi] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            mcpConfig.mcpServers[s.slug] = {
+                url,
+                ...(s.command === 'sse' ? { transport: 'sse' } : {}),
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpConfig.mcpServers[s.slug] = {

package/dist/mcp-headers.d.ts

@@ -0,0 +1,15 @@
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+export declare function isRemoteMcp(command: string): boolean;
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+export declare function remoteMcpUrl(args?: string[] | null): string | null;
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+export declare function remoteMcpHeaders(env?: Record<string, string> | null): Record<string, string>;

package/dist/mcp-headers.js

@@ -0,0 +1,49 @@
+"use strict";
+// Shared handling for remote (http/sse) MCP registry rows.
+//
+// Registry rows store remote servers as command='http'|'sse' with args=[url]
+// and the credential set in env. Each agent CLI spells the config differently,
+// but all five make the same three decisions first — is this row remote, what
+// URL does it point at, and what headers does its env map become. That lived
+// inline in install.ts (the claude path) and the other four adapters each got
+// it wrong in their own way, so it lives here now and they all call it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRemoteMcp = isRemoteMcp;
+exports.remoteMcpUrl = remoteMcpUrl;
+exports.remoteMcpHeaders = remoteMcpHeaders;
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+function isRemoteMcp(command) {
+    return command === 'http' || command === 'sse';
+}
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+function remoteMcpUrl(args) {
+    if (!Array.isArray(args))
+        return null;
+    const first = args[0];
+    return typeof first === 'string' && first.length > 0 ? first : null;
+}
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+function remoteMcpHeaders(env) {
+    const headers = {};
+    for (const [key, value] of Object.entries(env || {})) {
+        if (typeof value !== 'string' || value.length === 0)
+            continue;
+        if (key === 'OAUTH_ACCESS_TOKEN') {
+            headers.Authorization = `Bearer ${value}`;
+            continue;
+        }
+        if (key.startsWith('OAUTH_'))
+            continue;
+        headers[key.replace(/_/g, '-')] = value;
+    }
+    return headers;
+}

package/dist/request-pump.d.ts

@@ -1,3 +1,14 @@
+export declare const DEFAULT_MAX_CONCURRENT = 4;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+export declare function clampMaxConcurrent(value: unknown): number;
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+export declare function setMaxConcurrent(value: unknown): void;
+/** The node's current ceiling. Exported for /stats and the TUI. */
+export declare function maxConcurrentRuns(): number;
 export declare function inflightCount(): number;
 export declare function activeRequestIdList(): string[];
 export declare function start(): void;

package/dist/request-pump.js

@@ -4,6 +4,10 @@
 // from spawning unlimited Claude processes when a burst of requests
 // arrives.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_CONCURRENT = void 0;
+exports.clampMaxConcurrent = clampMaxConcurrent;
+exports.setMaxConcurrent = setMaxConcurrent;
+exports.maxConcurrentRuns = maxConcurrentRuns;
 exports.inflightCount = inflightCount;
 exports.activeRequestIdList = activeRequestIdList;
 exports.start = start;
@@ -25,7 +29,51 @@ const diskguard_1 = require("./diskguard");
 // ~16x cheaper at steady state. Successful pickups still re-tick
 // immediately so bursts drain fast.
 const POLL_INTERVAL_MS = 2_000;
-const MAX_CONCURRENT = 4;
+// How many runs this node holds at once. This used to be `const MAX_CONCURRENT
+// = 4` — one number, compiled in, the same for a 64-core box and a Mac mini.
+// It is now the node's own setting (entity_runtimes.max_concurrent_runs),
+// pushed in by the heartbeat that already talks to the server every 30s.
+//
+// The default is still 4, and specifically 4 when the server says NOTHING: a
+// server without the migration must read as "the behaviour you had yesterday",
+// never as 0 (a node that accepts no work at all) or unbounded.
+exports.DEFAULT_MAX_CONCURRENT = 4;
+const MAX_MAX_CONCURRENT = 32;
+let maxConcurrent = exports.DEFAULT_MAX_CONCURRENT;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+function clampMaxConcurrent(value) {
+    // Absent is NOT zero. `Number(null)` and `Number('')` are both 0, which the
+    // clamp below would happily read as "one slot" — so a server that said
+    // nothing would quietly throttle the node to a single run. Anything that
+    // isn't a real number-shaped value means "no answer", which means: keep
+    // doing what you were doing.
+    if (typeof value !== 'number' && typeof value !== 'string')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    if (typeof value === 'string' && value.trim() === '')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n))
+        return exports.DEFAULT_MAX_CONCURRENT;
+    return Math.min(MAX_MAX_CONCURRENT, Math.max(1, Math.floor(n)));
+}
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+function setMaxConcurrent(value) {
+    const next = clampMaxConcurrent(value);
+    if (next === maxConcurrent)
+        return;
+    console.log(`[request-pump] runs at once: ${maxConcurrent} -> ${next}`);
+    maxConcurrent = next;
+    // Raising the cap should take effect NOW, not at the next 2s poll — the
+    // usual reason someone raises it is that work is queued up behind it.
+    if (!stopped && inflight < maxConcurrent)
+        queueMicrotask(() => { void tick(); });
+}
+/** The node's current ceiling. Exported for /stats and the TUI. */
+function maxConcurrentRuns() { return maxConcurrent; }
 // Anti-leak backstop ONLY — how long the pump will hold a concurrency slot
 // for a run whose promise never resolves (e.g. a spawn whose onExit is
 // lost). This does NOT kill the agent and is NOT an execution limit: it
@@ -72,7 +120,7 @@ function activeRequestIdList() { return [...activeRequestIds]; }
 async function tick() {
     if (stopped)
         return;
-    if (inflight >= MAX_CONCURRENT)
+    if (inflight >= maxConcurrent)
         return;
     // Honour the backoff window — skip this tick if we recently failed.
     if (Date.now() < nextPickAllowedAt)
@@ -215,7 +263,7 @@ async function tick() {
     // Re-tick immediately so back-to-back requests don't wait for the
     // next interval. If there's nothing to pick up the next call is a
     // cheap no-op.
-    if (!stopped && inflight < MAX_CONCURRENT) {
+    if (!stopped && inflight < maxConcurrent) {
         queueMicrotask(() => { void tick(); });
     }
 }

package/dist/tui/dashboard.d.ts

@@ -20,6 +20,8 @@ export interface DashboardState {
     pid: number | null;
     startedAt: number | null;
     inflight: number;
+    /** The node's ceiling on concurrent runs — the denominator for `inflight`. */
+    maxConcurrent: number;
     paired: boolean;
     viewerMode: boolean;
     /** First press of 'd' asks; the second one does it. */

package/dist/tui/dashboard.js

@@ -84,7 +84,7 @@ function headerLines(st) {
     const up = st.startedAt ? (0, render_1.fmtDuration)(st.now - st.startedAt) : '—';
     const daemon = st.viewerMode
         ? `${(0, render_1.cyan)('⏺')} Viewer  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)('· another process owns this node')}`
-        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight} in flight`)}`;
+        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight}/${st.maxConcurrent} in flight`)}`;
     const chip = st.offline ? `  ${(0, render_1.yellow)('⚠ Offline · retrying')}` : '';
     return [first, daemon + chip, autostartLine(st)];
 }

package/dist/tui/run.js

@@ -195,7 +195,7 @@ async function runDashboard(opts) {
     const state = {
         self: null, stats: null, recent: [], sel: 0, nowSelId: null, nowRows: 0, spin: 0,
         pid: opts.pid, startedAt: opts.startedAt,
-        inflight: 0, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
+        inflight: 0, maxConcurrent: request_pump_1.DEFAULT_MAX_CONCURRENT, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
         offline: false, now: Date.now(), version: opts.version,
         logCount: 0,
         // Read on the first poll rather than here — the first frame must paint
@@ -229,6 +229,7 @@ async function runDashboard(opts) {
     // The daemon's own numbers don't come from an RPC.
     setInterval(() => {
         state.inflight = (0, request_pump_1.inflightCount)();
+        state.maxConcurrent = (0, request_pump_1.maxConcurrentRuns)();
         state.logCount = logs.count();
     }, 1000).unref();
     await ui.run();

package/dist/win.d.ts

@@ -35,13 +35,37 @@ export declare function resolveCliInvocation(bin: string, args: string[]): CliIn
  *  note: no trailing `%`). */
 declare function resolveNpmShimScript(shimPath: string): string | null;
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 export declare function killProcessTree(proc: {
     pid?: number | undefined;
+    exitCode?: number | null;
+    signalCode?: NodeJS.Signals | null;
     kill(signal?: NodeJS.Signals): boolean | void;
 }): void;
 /**

package/dist/win.js

@@ -244,11 +244,77 @@ function resolveNpmShimScript(shimPath) {
     }
     return null;
 }
+/** How long a POSIX agent gets to honour SIGINT before we stop asking. */
+const KILL_ESCALATE_MS = 3000;
+/** One `ps` snapshot as (pid, ppid) pairs. Empty on any failure — callers
+ *  then fall back to signalling just the process they were handed, which is
+ *  the old behaviour and never worse than it. */
+function posixProcessTable() {
+    try {
+        const out = (0, child_process_1.execFileSync)('ps', ['-Ao', 'pid=,ppid='], { encoding: 'utf8', timeout: 5000 });
+        return out.split('\n')
+            .map(line => line.trim().split(/\s+/))
+            .filter(parts => parts.length === 2)
+            .map(([a, b]) => ({ pid: Number(a), ppid: Number(b) }))
+            .filter(r => Number.isInteger(r.pid) && Number.isInteger(r.ppid) && r.pid > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/** Every descendant of `root`, breadth-first (so the deepest come last). */
+function posixDescendants(root) {
+    const byParent = new Map();
+    for (const { pid, ppid } of posixProcessTable()) {
+        if (pid === ppid)
+            continue; // pid 1 parents itself on some kernels
+        const kids = byParent.get(ppid);
+        if (kids)
+            kids.push(pid);
+        else
+            byParent.set(ppid, [pid]);
+    }
+    const out = [];
+    const seen = new Set([root]);
+    const queue = [root];
+    while (queue.length > 0) {
+        for (const kid of byParent.get(queue.shift()) ?? []) {
+            if (seen.has(kid))
+                continue;
+            seen.add(kid);
+            out.push(kid);
+            queue.push(kid);
+        }
+    }
+    return out;
+}
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 function killProcessTree(proc) {
     if (exports.IS_WINDOWS && proc.pid) {
@@ -261,10 +327,33 @@ function killProcessTree(proc) {
         }
         catch { /* fall through to plain kill */ }
     }
-    try {
-        proc.kill('SIGINT');
+    const pid = proc.pid;
+    // Already reaped: the pid is no longer ours and could belong to something
+    // else by now. proc.kill() is safe (Node no-ops it); process.kill() is not.
+    if (!pid || proc.exitCode !== null && proc.exitCode !== undefined
+        || proc.signalCode !== null && proc.signalCode !== undefined) {
+        try {
+            proc.kill('SIGINT');
+        }
+        catch { /* already gone */ }
+        return;
     }
-    catch { /* already gone */ }
+    const signalTree = (signal) => {
+        // Deepest first: a parent that is about to die cannot usefully re-fork,
+        // but a live parent handed the signal first might.
+        for (const child of posixDescendants(pid).reverse()) {
+            try {
+                process.kill(child, signal);
+            }
+            catch { /* gone already */ }
+        }
+        try {
+            proc.kill(signal);
+        }
+        catch { /* already gone */ }
+    };
+    signalTree('SIGINT');
+    setTimeout(() => signalTree('SIGKILL'), KILL_ESCALATE_MS).unref();
 }
 /**
  * Rewrite a stdio MCP server command for the platform. On native Windows,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [