@addai/node 0.23.0 → 0.24.1

package/dist/claude-print.d.ts

@@ -13,6 +13,20 @@ export interface ClaudePrintInput {
     /** Restrict to a specific set of tools (claude only). null/undefined = inherit. */
     allowedTools?: string[];
 }
+/**
+ * The text to emit for one flushed block, given what came before.
+ *
+ * The final reply is rebuilt with string_agg(delta, '') — an empty join,
+ * because deltas are partial TOKENS and any separator between them would
+ * corrupt words mid-word. Correct within a block, wrong between them: the
+ * entity narrates, calls a tool, narrates again, and the two blocks own no
+ * whitespace of their own, so they arrive glued as "the chat tool.Let me".
+ * The boundary is known here and nowhere else, so it is marked here.
+ */
+export declare function blockDelta(text: string, opts: {
+    afterTool: boolean;
+    hadTextBefore: boolean;
+}): string;
 export interface ClaudePrintHandle {
     pid: number | undefined;
     sessionId: string | null;

package/dist/claude-print.js

@@ -5,11 +5,29 @@
 // our normalised RuntimeEvent shape, and resolves when the process exits.
 // No PTY needed — Claude detects non-TTY and runs headless.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.blockDelta = blockDelta;
 exports.lineToEvents = lineToEvents;
 exports.spawnClaudePrint = spawnClaudePrint;
 const child_process_1 = require("child_process");
 const claude_binary_1 = require("./claude-binary");
 const win_1 = require("./win");
+/**
+ * The text to emit for one flushed block, given what came before.
+ *
+ * The final reply is rebuilt with string_agg(delta, '') — an empty join,
+ * because deltas are partial TOKENS and any separator between them would
+ * corrupt words mid-word. Correct within a block, wrong between them: the
+ * entity narrates, calls a tool, narrates again, and the two blocks own no
+ * whitespace of their own, so they arrive glued as "the chat tool.Let me".
+ * The boundary is known here and nowhere else, so it is marked here.
+ */
+function blockDelta(text, opts) {
+    if (!opts.afterTool || !opts.hadTextBefore || !text.trim())
+        return text;
+    // Drop leading whitespace the model may already have supplied so a break
+    // is exactly one blank line, never two.
+    return `\n\n${text.replace(/^\s+/, '')}`;
+}
 /**
  * Parse one stream-json line into 0+ RuntimeEvents.
  *
@@ -190,6 +208,16 @@ function spawnClaudePrint(input) {
     let textBuf = '';
     let flushTimer = null;
     let sawDeltaThisMsg = false;
+    // Has any answer text been emitted for this run yet? The final reply is
+    // rebuilt by string_agg(delta, '') — an empty join, because deltas are
+    // partial TOKENS and any separator between them would corrupt words. That
+    // is right within a block and wrong between them: the model narrates, calls
+    // a tool, narrates again, and the two blocks arrive as separate messages
+    // with no whitespace of their own. Glued together they read
+    // "load the chat tool.Let me confirm". So the boundary is marked here,
+    // where it is actually known, rather than guessed at in SQL.
+    let emittedAnyText = false;
+    let blockBreakPending = false;
     // Thinking deltas (extended thinking) — coalesced lazily into 'thinking'
     // events; the chat relay renders them as a collapsed section.
     const THINK_FLUSH_MS = 700;
@@ -212,8 +240,11 @@ function spawnClaudePrint(input) {
             flushTimer = null;
         }
         if (textBuf) {
-            const t = textBuf;
+            let t = textBuf;
             textBuf = '';
+            t = blockDelta(t, { afterTool: blockBreakPending, hadTextBefore: emittedAnyText });
+            blockBreakPending = false;
+            emittedAnyText = true;
             emit({ type: 'assistant_text', delta: t });
         }
     };
@@ -258,6 +289,11 @@ function spawnClaudePrint(input) {
         // was seen for this message, in which case we keep the block (never lose text).
         if (partialStream && (type === 'assistant' || type === 'user' || type === 'result'))
             flushText();
+        // A tool result means the entity stopped talking to go and do something.
+        // Whatever it says next is a new paragraph, not a continuation of the
+        // sentence it was halfway through.
+        if (type === 'user')
+            blockBreakPending = true;
         const suppressText = partialStream && sawDeltaThisMsg && type === 'assistant';
         for (const ev of lineToEvents(parsed, suppressText))
             emit(ev);

package/dist/control-server.js

@@ -114,7 +114,12 @@ async function handleRequest(req, res) {
         if (data == null)
             return;
         const inflight = (0, request_pump_1.inflightCount)();
-        return send(res, 200, { ...data, inflight });
+        // The ceiling next to the count: "3 inflight" means nothing without it.
+        return send(res, 200, {
+            ...data,
+            inflight,
+            max_concurrent: (0, request_pump_1.maxConcurrentRuns)(),
+        });
     }
     // Recent requests (most recent first). ?limit=20 caps the count.
     if (path === '/requests' && method === 'GET') {

package/dist/grok-spawn.js

@@ -161,11 +161,24 @@ function writeProjectMcpConfig(workingDirectory, servers) {
     }
     const lines = [];
     for (const s of usable) {
-        // Remote MCP servers. xAI documents [mcp_servers.<name>] with `url` and a
-        // `headers` inline table, so grok now gets them properly instead of the
-        // skip this used to do — a skip that was safe (better than emitting
-        // `command = "http"`, which grok would try to exec) but meant an entity
-        // running on grok silently had none of its remote servers.
+        // Remote MCP servers are BRIDGED through mcp-remote, because grok cannot
+        // speak HTTP MCP itself.
+        //
+        // Its bundled README documents `url` + a `headers` inline table, and this
+        // code used to emit exactly that. Measured against grok 1.0.3, that entry
+        // is SILENTLY IGNORED: in one run grok loaded ten stdio servers and skipped
+        // both url-based ones — ours and a pre-existing third-party entry — with no
+        // error for either. The docs describe a transport the binary does not have.
+        //
+        // That is why entities on grok lost every Connection the moment the
+        // registry moved from `npx` to `http`: the servers were simply not there,
+        // and grok reported it to the model as "(auth required)".
+        //
+        // mcp-remote is the standard stdio<->HTTP shim (grok's own README reaches
+        // for it in its Linear example) and it is verified working here. The cost
+        // is an npx start per remote server on grok runs only — the very cost the
+        // HTTP move removed for every other agent. Revisit when grok ships real
+        // remote-MCP support.
         //
         // Folder trust still gates repo-local config.toml servers, so the --trust
         // launch flag remains load-bearing for these entries to start at all.
@@ -175,15 +188,16 @@ function writeProjectMcpConfig(workingDirectory, servers) {
                 console.error(`[grok] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
                 continue;
             }
+            // The bridge itself is shared — see AGENTS_WITHOUT_HTTP_MCP for which
+            // agents need it and the evidence for each.
+            const bridge = (0, mcp_headers_1.remoteMcpBridge)(url, s.env);
+            const bridged = (0, win_1.wrapMcpCommandForPlatform)(bridge.command, bridge.args);
             lines.push(`[mcp_servers.${tomlStr(s.slug)}]`);
-            lines.push(`url = ${tomlStr(url)}`);
-            const headers = Object.entries((0, mcp_headers_1.remoteMcpHeaders)(s.env));
-            if (headers.length > 0) {
-                const kv = headers.map(([k, v]) => `${tomlStr(k)} = ${tomlStr(v)}`).join(', ');
-                lines.push(`headers = { ${kv} }`);
-            }
+            lines.push(`command = ${tomlStr(bridged.command)}`);
+            lines.push(`args = [${bridged.args.map(tomlStr).join(', ')}]`);
             lines.push('enabled = true');
-            lines.push('startup_timeout_sec = 30');
+            // The first run on a machine downloads mcp-remote, which 30s does not cover.
+            lines.push('startup_timeout_sec = 90');
             lines.push('');
             continue;
         }

package/dist/heartbeat.js

@@ -53,6 +53,12 @@ async function tick() {
         }
         if (res && typeof res.auto_update === 'boolean')
             autoUpdateArmed = res.auto_update;
+        // How many runs this node may hold at once. Same rationale as auto_update:
+        // one number on the node's own row, and the daemon is already talking to
+        // the server every 30s. Absent field = older server = leave the pump on
+        // whatever it already had (its own default of 4).
+        if (res && res.max_concurrent_runs != null)
+            (0, request_pump_1.setMaxConcurrent)(res.max_concurrent_runs);
     }
     catch (err) {
         if (err instanceof supabase_client_1.RpcError && err.status === 401) {

package/dist/mcp-headers.d.ts

@@ -13,3 +13,44 @@ export declare function remoteMcpUrl(args?: string[] | null): string | null;
  * and must never be sent as a header.
  */
 export declare function remoteMcpHeaders(env?: Record<string, string> | null): Record<string, string>;
+/**
+ * Which agents can actually open an HTTP MCP connection, measured against the
+ * real binaries rather than their documentation.
+ *
+ *   claude  YES  — proven in production; entities use these every day.
+ *   codex   YES  — `codex mcp list` shows a `url` entry under Url, enabled.
+ *   kimi    YES  — `kimi mcp list` prints "<slug> (http): <url>".
+ *   gemini  ?    — UNVERIFIED. The CLI on hand cannot authenticate at all
+ *                  ("no longer supported for Gemini Code Assist for
+ *                  individuals"), so its httpUrl handling was never observed
+ *                  connecting. No entity runs gemini today. If one ever does,
+ *                  verify before trusting it — this exact assumption is what
+ *                  cost us grok.
+ *   grok    NO   — grok 1.0.3 SILENTLY IGNORES url-based entries. In one run it
+ *                  loaded ten stdio servers and skipped every remote one, ours
+ *                  and a third party's, with no error, while its own bundled
+ *                  README documents `url` + `headers`. The docs describe a
+ *                  transport the binary does not have.
+ *
+ * An agent listed here gets its remote servers bridged instead — see
+ * remoteMcpBridge. Add to this set only on evidence from the binary; the whole
+ * point is that "the docs say it works" is not evidence.
+ */
+export declare const AGENTS_WITHOUT_HTTP_MCP: Set<string>;
+export declare function agentNeedsMcpBridge(agent: string): boolean;
+/**
+ * Turn a remote MCP server into a STDIO command, for agents that cannot speak
+ * HTTP MCP themselves.
+ *
+ * mcp-remote is the standard stdio<->HTTP shim, and the one grok's own README
+ * reaches for in its Linear example. Verified end to end against grok 1.0.3:
+ * the bridged server's tools appear and are callable.
+ *
+ * The cost is an npx start per remote server — exactly the cost moving to HTTP
+ * removed — so this is a fallback for the agents that need it, never the
+ * default path.
+ */
+export declare function remoteMcpBridge(url: string, env?: Record<string, string> | null): {
+    command: string;
+    args: string[];
+};

package/dist/mcp-headers.js

@@ -8,9 +8,12 @@
 // inline in install.ts (the claude path) and the other four adapters each got
 // it wrong in their own way, so it lives here now and they all call it.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENTS_WITHOUT_HTTP_MCP = void 0;
 exports.isRemoteMcp = isRemoteMcp;
 exports.remoteMcpUrl = remoteMcpUrl;
 exports.remoteMcpHeaders = remoteMcpHeaders;
+exports.agentNeedsMcpBridge = agentNeedsMcpBridge;
+exports.remoteMcpBridge = remoteMcpBridge;
 /** True when a registry row describes a remote MCP server rather than a
  *  local process to spawn. */
 function isRemoteMcp(command) {
@@ -47,3 +50,52 @@ function remoteMcpHeaders(env) {
     }
     return headers;
 }
+/**
+ * Which agents can actually open an HTTP MCP connection, measured against the
+ * real binaries rather than their documentation.
+ *
+ *   claude  YES  — proven in production; entities use these every day.
+ *   codex   YES  — `codex mcp list` shows a `url` entry under Url, enabled.
+ *   kimi    YES  — `kimi mcp list` prints "<slug> (http): <url>".
+ *   gemini  ?    — UNVERIFIED. The CLI on hand cannot authenticate at all
+ *                  ("no longer supported for Gemini Code Assist for
+ *                  individuals"), so its httpUrl handling was never observed
+ *                  connecting. No entity runs gemini today. If one ever does,
+ *                  verify before trusting it — this exact assumption is what
+ *                  cost us grok.
+ *   grok    NO   — grok 1.0.3 SILENTLY IGNORES url-based entries. In one run it
+ *                  loaded ten stdio servers and skipped every remote one, ours
+ *                  and a third party's, with no error, while its own bundled
+ *                  README documents `url` + `headers`. The docs describe a
+ *                  transport the binary does not have.
+ *
+ * An agent listed here gets its remote servers bridged instead — see
+ * remoteMcpBridge. Add to this set only on evidence from the binary; the whole
+ * point is that "the docs say it works" is not evidence.
+ */
+exports.AGENTS_WITHOUT_HTTP_MCP = new Set(['grok']);
+function agentNeedsMcpBridge(agent) {
+    return exports.AGENTS_WITHOUT_HTTP_MCP.has(agent);
+}
+/**
+ * Turn a remote MCP server into a STDIO command, for agents that cannot speak
+ * HTTP MCP themselves.
+ *
+ * mcp-remote is the standard stdio<->HTTP shim, and the one grok's own README
+ * reaches for in its Linear example. Verified end to end against grok 1.0.3:
+ * the bridged server's tools appear and are callable.
+ *
+ * The cost is an npx start per remote server — exactly the cost moving to HTTP
+ * removed — so this is a fallback for the agents that need it, never the
+ * default path.
+ */
+function remoteMcpBridge(url, env) {
+    const args = ['-y', 'mcp-remote', url];
+    for (const [key, value] of Object.entries(remoteMcpHeaders(env))) {
+        // Spawned without a shell, so "K:V" needs no quoting of its own.
+        args.push('--header', `${key}:${value}`);
+    }
+    // Our servers are streamable HTTP; skip the SSE fallback probing.
+    args.push('--transport', 'http-only');
+    return { command: 'npx', args };
+}

package/dist/request-pump.d.ts

@@ -1,3 +1,14 @@
+export declare const DEFAULT_MAX_CONCURRENT = 4;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+export declare function clampMaxConcurrent(value: unknown): number;
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+export declare function setMaxConcurrent(value: unknown): void;
+/** The node's current ceiling. Exported for /stats and the TUI. */
+export declare function maxConcurrentRuns(): number;
 export declare function inflightCount(): number;
 export declare function activeRequestIdList(): string[];
 export declare function start(): void;

package/dist/request-pump.js

@@ -4,6 +4,10 @@
 // from spawning unlimited Claude processes when a burst of requests
 // arrives.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_CONCURRENT = void 0;
+exports.clampMaxConcurrent = clampMaxConcurrent;
+exports.setMaxConcurrent = setMaxConcurrent;
+exports.maxConcurrentRuns = maxConcurrentRuns;
 exports.inflightCount = inflightCount;
 exports.activeRequestIdList = activeRequestIdList;
 exports.start = start;
@@ -25,7 +29,51 @@ const diskguard_1 = require("./diskguard");
 // ~16x cheaper at steady state. Successful pickups still re-tick
 // immediately so bursts drain fast.
 const POLL_INTERVAL_MS = 2_000;
-const MAX_CONCURRENT = 4;
+// How many runs this node holds at once. This used to be `const MAX_CONCURRENT
+// = 4` — one number, compiled in, the same for a 64-core box and a Mac mini.
+// It is now the node's own setting (entity_runtimes.max_concurrent_runs),
+// pushed in by the heartbeat that already talks to the server every 30s.
+//
+// The default is still 4, and specifically 4 when the server says NOTHING: a
+// server without the migration must read as "the behaviour you had yesterday",
+// never as 0 (a node that accepts no work at all) or unbounded.
+exports.DEFAULT_MAX_CONCURRENT = 4;
+const MAX_MAX_CONCURRENT = 32;
+let maxConcurrent = exports.DEFAULT_MAX_CONCURRENT;
+/** Clamp whatever the server sent into something the pump can act on. A null,
+ *  a string, a 0 or a 10_000 must not be able to wedge the pump shut or uncap
+ *  it — the ceiling matches the DB's own 1..32 check constraint. */
+function clampMaxConcurrent(value) {
+    // Absent is NOT zero. `Number(null)` and `Number('')` are both 0, which the
+    // clamp below would happily read as "one slot" — so a server that said
+    // nothing would quietly throttle the node to a single run. Anything that
+    // isn't a real number-shaped value means "no answer", which means: keep
+    // doing what you were doing.
+    if (typeof value !== 'number' && typeof value !== 'string')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    if (typeof value === 'string' && value.trim() === '')
+        return exports.DEFAULT_MAX_CONCURRENT;
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n))
+        return exports.DEFAULT_MAX_CONCURRENT;
+    return Math.min(MAX_MAX_CONCURRENT, Math.max(1, Math.floor(n)));
+}
+/** Called by the heartbeat when the node's row says a different number.
+ *  Lowering it never interrupts a run already in flight — those finish; the
+ *  pump simply stops picking up new work until it is back under the line. */
+function setMaxConcurrent(value) {
+    const next = clampMaxConcurrent(value);
+    if (next === maxConcurrent)
+        return;
+    console.log(`[request-pump] runs at once: ${maxConcurrent} -> ${next}`);
+    maxConcurrent = next;
+    // Raising the cap should take effect NOW, not at the next 2s poll — the
+    // usual reason someone raises it is that work is queued up behind it.
+    if (!stopped && inflight < maxConcurrent)
+        queueMicrotask(() => { void tick(); });
+}
+/** The node's current ceiling. Exported for /stats and the TUI. */
+function maxConcurrentRuns() { return maxConcurrent; }
 // Anti-leak backstop ONLY — how long the pump will hold a concurrency slot
 // for a run whose promise never resolves (e.g. a spawn whose onExit is
 // lost). This does NOT kill the agent and is NOT an execution limit: it
@@ -72,7 +120,7 @@ function activeRequestIdList() { return [...activeRequestIds]; }
 async function tick() {
     if (stopped)
         return;
-    if (inflight >= MAX_CONCURRENT)
+    if (inflight >= maxConcurrent)
         return;
     // Honour the backoff window — skip this tick if we recently failed.
     if (Date.now() < nextPickAllowedAt)
@@ -215,7 +263,7 @@ async function tick() {
     // Re-tick immediately so back-to-back requests don't wait for the
     // next interval. If there's nothing to pick up the next call is a
     // cheap no-op.
-    if (!stopped && inflight < MAX_CONCURRENT) {
+    if (!stopped && inflight < maxConcurrent) {
         queueMicrotask(() => { void tick(); });
     }
 }

package/dist/tui/dashboard.d.ts

@@ -20,6 +20,8 @@ export interface DashboardState {
     pid: number | null;
     startedAt: number | null;
     inflight: number;
+    /** The node's ceiling on concurrent runs — the denominator for `inflight`. */
+    maxConcurrent: number;
     paired: boolean;
     viewerMode: boolean;
     /** First press of 'd' asks; the second one does it. */

package/dist/tui/dashboard.js

@@ -84,7 +84,7 @@ function headerLines(st) {
     const up = st.startedAt ? (0, render_1.fmtDuration)(st.now - st.startedAt) : '—';
     const daemon = st.viewerMode
         ? `${(0, render_1.cyan)('⏺')} Viewer  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)('· another process owns this node')}`
-        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight} in flight`)}`;
+        : `${(0, render_1.green)('⏺')} Running  ${(0, render_1.dim)(`pid ${st.pid ?? '?'}`)}  ${(0, render_1.dim)(`up ${up}`)}  ${(0, render_1.dim)(`${st.inflight}/${st.maxConcurrent} in flight`)}`;
     const chip = st.offline ? `  ${(0, render_1.yellow)('⚠ Offline · retrying')}` : '';
     return [first, daemon + chip, autostartLine(st)];
 }

package/dist/tui/run.js

@@ -195,7 +195,7 @@ async function runDashboard(opts) {
     const state = {
         self: null, stats: null, recent: [], sel: 0, nowSelId: null, nowRows: 0, spin: 0,
         pid: opts.pid, startedAt: opts.startedAt,
-        inflight: 0, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
+        inflight: 0, maxConcurrent: request_pump_1.DEFAULT_MAX_CONCURRENT, paired: (0, store_1.isPaired)(), viewerMode: opts.viewerMode,
         offline: false, now: Date.now(), version: opts.version,
         logCount: 0,
         // Read on the first poll rather than here — the first frame must paint
@@ -229,6 +229,7 @@ async function runDashboard(opts) {
     // The daemon's own numbers don't come from an RPC.
     setInterval(() => {
         state.inflight = (0, request_pump_1.inflightCount)();
+        state.maxConcurrent = (0, request_pump_1.maxConcurrentRuns)();
         state.logCount = logs.count();
     }, 1000).unref();
     await ui.run();

package/dist/win.d.ts

@@ -35,13 +35,37 @@ export declare function resolveCliInvocation(bin: string, args: string[]): CliIn
  *  note: no trailing `%`). */
 declare function resolveNpmShimScript(shimPath: string): string | null;
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 export declare function killProcessTree(proc: {
     pid?: number | undefined;
+    exitCode?: number | null;
+    signalCode?: NodeJS.Signals | null;
     kill(signal?: NodeJS.Signals): boolean | void;
 }): void;
 /**

package/dist/win.js

@@ -244,11 +244,77 @@ function resolveNpmShimScript(shimPath) {
     }
     return null;
 }
+/** How long a POSIX agent gets to honour SIGINT before we stop asking. */
+const KILL_ESCALATE_MS = 3000;
+/** One `ps` snapshot as (pid, ppid) pairs. Empty on any failure — callers
+ *  then fall back to signalling just the process they were handed, which is
+ *  the old behaviour and never worse than it. */
+function posixProcessTable() {
+    try {
+        const out = (0, child_process_1.execFileSync)('ps', ['-Ao', 'pid=,ppid='], { encoding: 'utf8', timeout: 5000 });
+        return out.split('\n')
+            .map(line => line.trim().split(/\s+/))
+            .filter(parts => parts.length === 2)
+            .map(([a, b]) => ({ pid: Number(a), ppid: Number(b) }))
+            .filter(r => Number.isInteger(r.pid) && Number.isInteger(r.ppid) && r.pid > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/** Every descendant of `root`, breadth-first (so the deepest come last). */
+function posixDescendants(root) {
+    const byParent = new Map();
+    for (const { pid, ppid } of posixProcessTable()) {
+        if (pid === ppid)
+            continue; // pid 1 parents itself on some kernels
+        const kids = byParent.get(ppid);
+        if (kids)
+            kids.push(pid);
+        else
+            byParent.set(ppid, [pid]);
+    }
+    const out = [];
+    const seen = new Set([root]);
+    const queue = [root];
+    while (queue.length > 0) {
+        for (const kid of byParent.get(queue.shift()) ?? []) {
+            if (seen.has(kid))
+                continue;
+            seen.add(kid);
+            out.push(kid);
+            queue.push(kid);
+        }
+    }
+    return out;
+}
 /**
- * Kill an agent child process. POSIX: SIGINT (graceful — CLIs flush and
- * exit). win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
+ * Kill an agent child process AND everything it spawned.
+ *
+ * win32: `taskkill /T /F` — Node's SIGINT emulation is a hard
  * TerminateProcess on the one process anyway, and /T also reaps the MCP
  * server grandchildren that would otherwise be orphaned.
+ *
+ * POSIX used to be one line — `proc.kill('SIGINT')` — which is neither a
+ * tree nor a guarantee, and both halves of that bit us. On 2026-08-12 a
+ * chatflows stop killed grok's direct child (the run reported
+ * `session_end exitCode -1`, i.e. died by signal) while the process it had
+ * forked carried on for another 49 seconds on the inherited stdout pipe,
+ * finished its turn, and posted a real message into someone's DM 22 seconds
+ * after the user pressed stop. So:
+ *
+ *   1. Signal the whole tree, not just the handle. We do not spawn agents
+ *      `detached`, so there is no process group to signal — walking `ps` is
+ *      the portable way to find the descendants, and it also catches stdio
+ *      MCP servers the agent started (the same ones /T reaps on Windows).
+ *   2. Escalate. SIGINT first, because an agent CLI flushes its session
+ *      file on it; SIGKILL KILL_ESCALATE_MS later for anything still there.
+ *      A CLI is entitled to treat SIGINT as "interrupt the current input"
+ *      rather than "exit" — being polite once and never following up is how
+ *      a stop button turns into a suggestion.
+ *
+ * The escalation re-walks the tree: a process that ignored SIGINT may have
+ * forked since. The timer is unref'd so it never holds the daemon open.
  */
 function killProcessTree(proc) {
     if (exports.IS_WINDOWS && proc.pid) {
@@ -261,10 +327,33 @@ function killProcessTree(proc) {
         }
         catch { /* fall through to plain kill */ }
     }
-    try {
-        proc.kill('SIGINT');
+    const pid = proc.pid;
+    // Already reaped: the pid is no longer ours and could belong to something
+    // else by now. proc.kill() is safe (Node no-ops it); process.kill() is not.
+    if (!pid || proc.exitCode !== null && proc.exitCode !== undefined
+        || proc.signalCode !== null && proc.signalCode !== undefined) {
+        try {
+            proc.kill('SIGINT');
+        }
+        catch { /* already gone */ }
+        return;
     }
-    catch { /* already gone */ }
+    const signalTree = (signal) => {
+        // Deepest first: a parent that is about to die cannot usefully re-fork,
+        // but a live parent handed the signal first might.
+        for (const child of posixDescendants(pid).reverse()) {
+            try {
+                process.kill(child, signal);
+            }
+            catch { /* gone already */ }
+        }
+        try {
+            proc.kill(signal);
+        }
+        catch { /* already gone */ }
+    };
+    signalTree('SIGINT');
+    setTimeout(() => signalTree('SIGKILL'), KILL_ESCALATE_MS).unref();
 }
 /**
  * Rewrite a stdio MCP server command for the platform. On native Windows,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [