@addai/node 0.23.0 → 0.24.0

package/dist/control-server.js

@@ -114,7 +114,12 @@ async function handleRequest(req, res) {
         if (data == null)
             return;
         const inflight = (0, request_pump_1.inflightCount)();
-        return send(res, 200, { ...data, inflight });
+        // The ceiling next to the count: "3 inflight" means nothing without it.
+        return send(res, 200, {
+            ...data,
+            inflight,
+            max_concurrent: (0, request_pump_1.maxConcurrentRuns)(),
+        });
     }
     // Recent requests (most recent first). ?limit=20 caps the count.
     if (path === '/requests' && method === 'GET') {

package/dist/heartbeat.js

@@ -53,6 +53,12 @@ async function tick() {
         }
         if (res && typeof res.auto_update === 'boolean')
             autoUpdateArmed = res.auto_update;
+        // How many runs this node may hold at once. Same rationale as auto_update:
+        // one number on the node's own row, and the daemon is already talking to
+        // the server every 30s. Absent field = older server = leave the pump on
+        // whatever it already had (its own default of 4).
+        if (res && res.max_concurrent_runs != null)
+            (0, request_pump_1.setMaxConcurrent)(res.max_concurrent_runs);
     }
     catch (err) {
         if (err instanceof supabase_client_1.RpcError && err.status === 401) {

package/dist/request-pump.d.ts

@@ -1,3 +1,14 @@
+export declare const DEFAULT_MAX_CONCURRENT = 4;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+export declare function clampMaxConcurrent(value: unknown): number;
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+export declare function setMaxConcurrent(value: unknown): void;
+/** The node's current ceiling. Exported for /stats and the TUI. */
+export declare function maxConcurrentRuns(): number;
 export declare function inflightCount(): number;
 export declare function activeRequestIdList(): string[];
 export declare function start(): void;

package/dist/request-pump.js

@@ -4,6 +4,10 @@
 // from spawning unlimited Claude processes when a burst of requests
 // arrives.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_CONCURRENT = void 0;
+exports.clampMaxConcurrent = clampMaxConcurrent;
+exports.setMaxConcurrent = setMaxConcurrent;
+exports.maxConcurrentRuns = maxConcurrentRuns;
 exports.inflightCount = inflightCount;
 exports.activeRequestIdList = activeRequestIdList;
 exports.start = start;
@@ -25,7 +29,51 @@ const diskguard_1 = require("./diskguard");
 // ~16x cheaper at steady state. Successful pickups still re-tick
 // immediately so bursts drain fast.
 const POLL_INTERVAL_MS = 2_000;
-const MAX_CONCURRENT = 4;
+// How many runs this node holds at once. This used to be `const MAX_CONCURRENT
+// = 4` — one number, compiled in, the same for a 64-core box and a Mac mini.
+// It is now the node's own setting (entity_runtimes.max_concurrent_runs),
+// pushed in by the heartbeat that already talks to the server every 30s.
+//
+// The default is still 4, and specifically 4 when the server says NOTHING: a
+// server without the migration must read as "the behaviour you had yesterday",
+// never as 0 (a node that accepts no work at all) or unbounded.
+exports.DEFAULT_MAX_CONCURRENT = 4;
+const MAX_MAX_CONCURRENT = 32;
+let maxConcurrent = exports.DEFAULT_MAX_CONCURRENT;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+function clampMaxConcurrent(value) {
+    // Absent is NOT zero. `Number(null)` and `Number('')` are both 0, which the
+    // clamp below would happily read as "one slot" — so a server that said
+    // nothing would quietly throttle the node to a single run. Anything that
+    // isn't a real number-shaped value means "no answer", which means: keep
+    // doing what you were doing.
+    if (typeof value !== 'number' && typeof value !== 'string')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    if (typeof value === 'string' && value.trim() === '')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n))
+        return exports.DEFAULT_MAX_CONCURRENT;
+    return Math.min(MAX_MAX_CONCURRENT, Math.max(1, Math.floor(n)));
+}
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+function setMaxConcurrent(value) {
+    const next = clampMaxConcurrent(value);
+    if (next === maxConcurrent)
+        return;
+    console.log(`[request-pump] runs at once: ${maxConcurrent} -> ${next}`);
+    maxConcurrent = next;
+    // Raising the cap should take effect NOW, not at the next 2s poll — the
+    // usual reason someone raises it is that work is queued up behind it.
+    if (!stopped && inflight < maxConcurrent)
+        queueMicrotask(() => { void tick(); });
+}
+/** The node's current ceiling. Exported for /stats and the TUI. */
+function maxConcurrentRuns() { return maxConcurrent; }
 // Anti-leak backstop ONLY — how long the pump will hold a concurrency slot
 // for a run whose promise never resolves (e.g. a spawn whose onExit is
 // lost). This does NOT kill the agent and is NOT an execution limit: it
@@ -72,7 +120,7 @@ function activeRequestIdList() { return [...activeRequestIds]; }
 async function tick() {
     if (stopped)
         return;
-    if (inflight >= MAX_CONCURRENT)
+    if (inflight >= maxConcurrent)
         return;
     // Honour the backoff window — skip this tick if we recently failed.
     if (Date.now() < nextPickAllowedAt)
@@ -215,7 +263,7 @@ async function tick() {
     // Re-tick immediately so back-to-back requests don't wait for the
     // next interval. If there's nothing to pick up the next call is a
     // cheap no-op.
-    if (!stopped && inflight < MAX_CONCURRENT) {
+    if (!stopped && inflight < maxConcurrent) {
         queueMicrotask(() => { void tick(); });
     }
 }

package/dist/tui/dashboard.d.ts

@@ -20,6 +20,8 @@ export interface DashboardState {
     pid: number | null;
     startedAt: number | null;
     inflight: number;
+    /** The node's ceiling on concurrent runs — the denominator for `inflight`. */
+    maxConcurrent: number;
     paired: boolean;
     viewerMode: boolean;
     /** First press of 'd' asks; the second one does it. */

package/dist/tui/dashboard.js

@@ -84,7 +84,7 @@ function headerLines(st) {
     const up = st.startedAt ? (0, render_1.fmtDuration)(st.now - st.startedAt) : '—';
     const daemon = st.viewerMode
         ? `${(0, render_1.cyan)('⏺')} Viewer  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)('· another process owns this node')}`
-        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight} in flight`)}`;
+        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight}/${st.maxConcurrent} in flight`)}`;
     const chip = st.offline ? `  ${(0, render_1.yellow)('⚠ Offline · retrying')}` : '';
     return [first, daemon + chip, autostartLine(st)];
 }

package/dist/tui/run.js

@@ -195,7 +195,7 @@ async function runDashboard(opts) {
     const state = {
         self: null, stats: null, recent: [], sel: 0, nowSelId: null, nowRows: 0, spin: 0,
         pid: opts.pid, startedAt: opts.startedAt,
-        inflight: 0, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
+        inflight: 0, maxConcurrent: request_pump_1.DEFAULT_MAX_CONCURRENT, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
         offline: false, now: Date.now(), version: opts.version,
         logCount: 0,
         // Read on the first poll rather than here — the first frame must paint
@@ -229,6 +229,7 @@ async function runDashboard(opts) {
     // The daemon's own numbers don't come from an RPC.
     setInterval(() => {
         state.inflight = (0, request_pump_1.inflightCount)();
+        state.maxConcurrent = (0, request_pump_1.maxConcurrentRuns)();
         state.logCount = logs.count();
     }, 1000).unref();
     await ui.run();

package/dist/win.d.ts

@@ -35,13 +35,37 @@ export declare function resolveCliInvocation(bin: string, args: string[]): CliIn
  *  note: no trailing `%`). */
 declare function resolveNpmShimScript(shimPath: string): string | null;
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 export declare function killProcessTree(proc: {
     pid?: number | undefined;
+    exitCode?: number | null;
+    signalCode?: NodeJS.Signals | null;
     kill(signal?: NodeJS.Signals): boolean | void;
 }): void;
 /**

package/dist/win.js

@@ -244,11 +244,77 @@ function resolveNpmShimScript(shimPath) {
     }
     return null;
 }
+/** How long a POSIX agent gets to honour SIGINT before we stop asking. */
+const KILL_ESCALATE_MS = 3000;
+/** One `ps` snapshot as (pid, ppid) pairs. Empty on any failure — callers
+ *  then fall back to signalling just the process they were handed, which is
+ *  the old behaviour and never worse than it. */
+function posixProcessTable() {
+    try {
+        const out = (0, child_process_1.execFileSync)('ps', ['-Ao', 'pid=,ppid='], { encoding: 'utf8', timeout: 5000 });
+        return out.split('\n')
+            .map(line => line.trim().split(/\s+/))
+            .filter(parts => parts.length === 2)
+            .map(([a, b]) => ({ pid: Number(a), ppid: Number(b) }))
+            .filter(r => Number.isInteger(r.pid) && Number.isInteger(r.ppid) && r.pid > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/** Every descendant of `root`, breadth-first (so the deepest come last). */
+function posixDescendants(root) {
+    const byParent = new Map();
+    for (const { pid, ppid } of posixProcessTable()) {
+        if (pid === ppid)
+            continue; // pid 1 parents itself on some kernels
+        const kids = byParent.get(ppid);
+        if (kids)
+            kids.push(pid);
+        else
+            byParent.set(ppid, [pid]);
+    }
+    const out = [];
+    const seen = new Set([root]);
+    const queue = [root];
+    while (queue.length > 0) {
+        for (const kid of byParent.get(queue.shift()) ?? []) {
+            if (seen.has(kid))
+                continue;
+            seen.add(kid);
+            out.push(kid);
+            queue.push(kid);
+        }
+    }
+    return out;
+}
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 function killProcessTree(proc) {
     if (exports.IS_WINDOWS && proc.pid) {
@@ -261,10 +327,33 @@ function killProcessTree(proc) {
         }
         catch { /* fall through to plain kill */ }
     }
-    try {
-        proc.kill('SIGINT');
+    const pid = proc.pid;
+    // Already reaped: the pid is no longer ours and could belong to something
+    // else by now. proc.kill() is safe (Node no-ops it); process.kill() is not.
+    if (!pid || proc.exitCode !== null && proc.exitCode !== undefined
+        || proc.signalCode !== null && proc.signalCode !== undefined) {
+        try {
+            proc.kill('SIGINT');
+        }
+        catch { /* already gone */ }
+        return;
     }
-    catch { /* already gone */ }
+    const signalTree = (signal) => {
+        // Deepest first: a parent that is about to die cannot usefully re-fork,
+        // but a live parent handed the signal first might.
+        for (const child of posixDescendants(pid).reverse()) {
+            try {
+                process.kill(child, signal);
+            }
+            catch { /* gone already */ }
+        }
+        try {
+            proc.kill(signal);
+        }
+        catch { /* already gone */ }
+    };
+    signalTree('SIGINT');
+    setTimeout(() => signalTree('SIGKILL'), KILL_ESCALATE_MS).unref();
 }
 /**
  * Rewrite a stdio MCP server command for the platform. On native Windows,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [