mixdog 0.9.147 → 0.9.148

package/src/headless-exec.test.mjs

@@ -5,10 +5,28 @@ import { join } from 'node:path';
 import test from 'node:test';
 
 import { classifyCliInvocation } from './headless-command.mjs';
-import { runHeadlessExec } from './headless-exec.mjs';
+import { prewarmHeadlessSearch, runHeadlessExec } from './headless-exec.mjs';
 import { resolveCursorOAuthAccessToken } from './runtime/agent/orchestrator/providers/cursor-auth.mjs';
 import { createPristineExecutionBoundary } from './runtime/shared/pristine-execution.mjs';
 
+test('headless search prewarm starts the native server and Project inventory together', async () => {
+  const calls = [];
+  await prewarmHeadlessSearch('/app/project', {
+    loadNativeSearch: async () => ({
+      async warmNativeSearchServer() {
+        calls.push('server');
+        return true;
+      },
+    }),
+    loadListTool: async () => ({
+      async prewarmFindEnumeration(root) {
+        calls.push(`index:${root}`);
+      },
+    }),
+  });
+  assert.deepEqual(calls.sort(), ['index:/app/project', 'server']);
+});
+
 test('pristine headless execution binds Cursor OAuth credentials in process', async () => {
   const root = mkdtempSync(join(tmpdir(), 'mixdog-headless-cursor-auth-test-'));
   const dataDir = join(root, 'data');
@@ -71,6 +89,7 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
           clientHostPid: 123,
           ask: async (_prompt, optionsForAsk) => {
             optionsForAsk.onUsageDelta({
+              model: 'gpt-fallback',
               deltaInput: 11,
               deltaCachedRead: 7,
               deltaCacheWrite: 3,
@@ -110,6 +129,7 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
     assert.equal(runtimeClosed, true);
     assert.deepEqual(cleanupOrder, ['runtime', 'memory', 'boundary']);
     const usage = JSON.parse(readFileSync(usageLogPath, 'utf8'));
+    assert.deepEqual(usage.sessions[0].models, ['gpt-test', 'gpt-fallback']);
     assert.deepEqual(usage.totals, {
       inputTokens: 11,
       cacheTokens: 7,
@@ -122,18 +142,17 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
   }
 });
 
-test('headless exec drains tracked work and returns the completion follow-up answer', async () => {
+test('headless exec answers an arrived completion and exits without waiting on live work', async () => {
   const output = [];
   const errors = [];
   const prompts = [];
-  let active = true;
+  let closeOptions = null;
   let notificationListener = null;
   const code = await runHeadlessExec({
     message: 'start the long task',
     provider: 'openai-oauth',
     model: 'gpt-test',
     usageLogPath: '',
-    idlePollMs: 1,
     write: (text) => output.push(text),
     writeErr: (text) => errors.push(text),
     boundaryFactory: () => ({
@@ -151,20 +170,20 @@ test('headless exec drains tracked work and returns the completion follow-up ans
       async ask(prompt) {
         prompts.push(prompt);
         if (prompts.length === 1) {
-          setTimeout(() => {
-            active = false;
-            notificationListener?.({
-              content: 'background task completed',
-              meta: { status: 'completed', execution_id: 'job_drain' },
-            });
-          }, 10);
+          notificationListener?.({
+            content: 'background task completed',
+            meta: { status: 'completed', execution_id: 'job_drain' },
+          });
           return { result: { content: 'task started' } };
         }
         return { result: { content: 'final result' } };
       },
-      async close() {},
+      async close(reason, options) { closeOptions = options ?? null; },
     }),
-    hasActiveTasks: () => active,
+    // The job the model left running never ends — a server it was asked to
+    // keep up. Exit must not wait for it, and must not reap it either: this
+    // test hangs on a regression instead of failing slowly.
+    hasActiveTasks: () => true,
     installSignalCleanupFn: () => ({ uninstall() {} }),
   });
 
@@ -172,6 +191,7 @@ test('headless exec drains tracked work and returns the completion follow-up ans
   assert.deepEqual(errors, []);
   assert.deepEqual(prompts, ['start the long task', '']);
   assert.deepEqual(output, ['final result\n']);
+  assert.deepEqual(closeOptions, { keepBackgroundWork: true });
 });
 
 test('headless exec emits a timestamped JSONL lifecycle and exact tool count', async () => {
@@ -351,6 +371,47 @@ test('headless exec emits structured JSONL failure before returning exit 1', asy
   assert.deepEqual(errors, ['mixdog: boom\n']);
 });
 
+test('headless exec exposes typed refusal as an API error result', async () => {
+  const output = [];
+  const code = await runHeadlessExec({
+    message: 'request',
+    provider: 'anthropic-oauth',
+    model: 'claude-test',
+    json: true,
+    usageLogPath: '',
+    write: (text) => output.push(text),
+    writeErr() {},
+    boundaryFactory: () => ({
+      loadConfig: () => ({ providers: { 'anthropic-oauth': { enabled: true } } }),
+      cleanup() {},
+    }),
+    runtimeFactory: async () => ({
+      id: 'sess_json_refusal',
+      model: 'claude-test',
+      clientHostPid: 123,
+      async ask() {
+        return {
+          result: {
+            content: 'Unable to respond.',
+            stopReason: 'refusal',
+            terminationReason: 'refusal',
+          },
+        };
+      },
+      async close() {},
+    }),
+    hasActiveTasks: () => false,
+    installSignalCleanupFn: () => ({ uninstall() {} }),
+  });
+
+  const terminal = output.join('').trim().split('\n').map((line) => JSON.parse(line)).at(-1);
+  assert.equal(code, 0);
+  assert.equal(terminal.subtype, 'success');
+  assert.equal(terminal.is_error, true);
+  assert.equal(terminal.stop_reason, 'refusal');
+  assert.equal(terminal.termination_reason, 'refusal');
+});
+
 test('--json is accepted for exec and rejected for the interactive command', () => {
   const exec = classifyCliInvocation([
     'exec',

package/src/rules/lead/01-general.md

@@ -10,6 +10,8 @@
   recoverability.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
   answer while work continues. After compaction, resume the summary.
+- Periodic task reports stay in-turn: after each update, call `task wait` for
+  the requested interval again until the task settles or the request changes.
 - Auto-compact owns context management: never propose stopping work to the
   user and never stop on your own judgment; resume and continue the work
   after every compaction.

package/src/rules/shared/10-tool-workflow.md

@@ -13,9 +13,10 @@
   apply one analysis to many targets as one parameterized call when supported.
 - Route each evidence facet once to its primary owner, preferring the operation
   that directly returns the evidence needed for the next decision. A summary,
-  overview, or enumeration is not a prerequisite when that operation's complete
-  inputs are already known; if independently required, batch it with the
-  detailed operation.
+  overview, or enumeration is not a prerequisite to an operation whose complete
+  inputs are already known, and is itself that operation when structure is the
+  evidence sought; if independently required, batch it with the detailed
+  operation.
 - Known state — system guarantees, supplied facts, visible tool returns,
   applied patches, and passed checks — is never re-found, re-derived, or
   re-verified at any granularity: no re-query call, no confirmation subcommand
@@ -27,7 +28,9 @@
   necessary.
 - Evidence that determines the answer, edit, or deliverable ends retrieval.
 - Treat failure as new evidence and re-enter that loop only for the affected
-  facets. Report a blocker when no deterministic next action remains.
+  facets. Do not abandon a viable approach after one failure or leave the
+  required deliverable half-finished. Report a blocker when no deterministic
+  next action remains.
 - Use only named tools present in the current tool surface; deferred tools
   auto-load on a direct call, and when their exact arguments are not visible,
   call `load_tool` first and read the surfaced schema.

package/src/rules/shared/30-exploration.md

@@ -6,7 +6,8 @@
   a successful owner result closes that facet.
 - Route the missing evidence to its primary owner:
   repository state, history, or diff→`git`;
-  exact symbol declaration, body, usage, or relation→`code_graph`;
+  source-file structure or outline, and exact symbol declaration, body,
+  usage, or relation→`code_graph`;
   literal, regex, or text location→`grep`;
   known-file content, range, or image→`read`;
   wildcard or recursive file paths→`glob`;

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -412,19 +412,38 @@ export function resolveProviderPromptCacheLane(provider, opts = {}, config = {})
             || promptCacheLaneAutoRequested(opts?.promptCacheLane?.auto)
             || promptCacheLaneAutoRequested(config?.promptCacheLaneAuto)
             || promptCacheLaneAutoRequested(config?.openaiCacheLaneAuto);
-    const rawLimit = requestedAuto
-        ? 'auto'
-        : (opts?.promptCacheLaneShards
-            ?? opts?.promptCacheLane?.shards
-            ?? opts?.openaiCacheLaneShards
+    // Lane SHARDS, requested either by their own name (`*CacheLaneShards`) or
+    // through the legacy `*CacheMaxParallel` / MIXDOG_*_CACHE_MAX_PARALLEL
+    // aliases. Those knobs also bounded in-flight admission for the removed
+    // compat cache lane — that half is gone for good, admission now belongs
+    // solely to the provider/account scheduler — but on OpenAI direct/OAuth
+    // they have always selected the prompt-cache shard count as well, and
+    // existing configurations depend on it. They stay accepted here at LOWER
+    // precedence than the explicitly named shard settings.
+    // Exception: xAI compatibility routing passes promptCacheLaneIgnoreAliases
+    // so the alias keeps meaning nothing there (openai-compat-xai.mjs), where
+    // it never selected shards and would silently fan out cache keys.
+    const ignoreAliases = opts?.promptCacheLaneIgnoreAliases === true
+        || config?.promptCacheLaneIgnoreAliases === true;
+    const rawShards = opts?.promptCacheLaneShards
+        ?? opts?.promptCacheLane?.shards
+        ?? opts?.openaiCacheLaneShards
+        ?? config?.promptCacheLaneShards
+        ?? config?.openaiCacheLaneShards
+        ?? env[`MIXDOG_${envKey}_CACHE_LANE_SHARDS`]
+        ?? env.MIXDOG_OPENAI_CACHE_LANE_SHARDS;
+    const rawAlias = ignoreAliases
+        ? undefined
+        : (opts?.promptCacheLaneMaxParallel
+            ?? opts?.promptCacheLane?.maxParallel
             ?? opts?.openaiCacheMaxParallel
-            ?? config?.promptCacheLaneShards
-            ?? config?.openaiCacheLaneShards
+            ?? config?.promptCacheLaneMaxParallel
             ?? config?.openaiCacheMaxParallel
-            ?? env[`MIXDOG_${envKey}_CACHE_LANE_SHARDS`]
             ?? env[`MIXDOG_${envKey}_CACHE_MAX_PARALLEL`]
-            ?? env.MIXDOG_OPENAI_CACHE_LANE_SHARDS
             ?? env.MIXDOG_OPENAI_CACHE_MAX_PARALLEL);
+    const rawLimit = requestedAuto
+        ? 'auto'
+        : (rawShards ?? rawAlias);
     const shards = parsePromptCacheLaneLimit(rawLimit, defaultPromptCacheLaneShards(provider));
     const auto = shards <= 0;
     const seed = cleanString(

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -347,7 +347,7 @@ function classifyToolFailure(resultText, toolName) {
     if (/^\[shell-tool-failed\](?:\s|$)/i.test(leading)) return 'tool-call/failure';
     if (/^\[shell-run-failed\](?:\s|$)/i.test(leading)) {
         if (/\[timeout:|cause:\s*(?:timeout|cancellation)\b/i.test(leading)) return 'timeout/abort';
-        if (/cause:\s*(?:output-limit|output-capture-error|background-adoption-failed)\b/i.test(leading)) return 'runtime/failure';
+        if (/cause:\s*(?:output-limit|output-capture-error|background-promotion-failed)\b/i.test(leading)) return 'runtime/failure';
         if (/\[signal:\s*[^\]]+/i.test(leading)) return 'process/signal';
         return 'command-exit';
     }
@@ -377,6 +377,11 @@ function classifyToolFailure(resultText, toolName) {
     if (/not in allow-list|not allowed/.test(text)) return 'permission';
     if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(raw)) return 'command-exit';
     if (isReadOnlyNavigationMiss(toolName, raw)) return 'navigation/miss';
+    // An absent executable is a fact about the environment, not a defect in
+    // the tool that reported it: the caller installs it or takes another
+    // route. Filed under runtime/failure it padded the count that is supposed
+    // to surface real tool bugs.
+    if (/executable not found in this environment/.test(text)) return 'environment/unavailable';
     if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/unknown tool|tool.*not.*available|missing.*tool/.test(text)) return 'tool-surface';

package/src/runtime/agent/orchestrator/config.mjs

@@ -5,13 +5,7 @@ import {
     canonicalizeAgentRouteStorage,
 } from '../../shared/agent-route-config.mjs';
 import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat-presets.mjs';
-import {
-    hasAnthropicOAuthCredentials,
-    hasOpenAIOAuthCredentials,
-    hasGrokOAuthCredentials,
-    hasCursorOAuthCredentials,
-    hasAntigravityOAuthCredentials,
-} from './providers/oauth-credential-probes.mjs';
+import { oauthCredentialProbeState } from './providers/oauth-credential-probes.mjs';
 
 // Thin wrapper around resolvePluginData so callers in this orchestrator tree
 // can import a single helper without reaching into shared/.
@@ -165,22 +159,40 @@ function buildDefaultConfig(options = {}) {
         };
     }
     // OAuth provider detection uses lightweight credential probes so config
-    // load does not import provider runtimes or SDKs. WebSocket transport is on by default —
-    // measured ~96% cross-session cache hit with delta payloads. Users who
-    // need to force SSE (e.g. a corporate proxy blocking WSS) can set
-    // `websocket: false` in mixdog-config.json (agent.providers.openai-oauth).
-    providers['openai-oauth'] = { enabled: detectCredentials ? hasOpenAIOAuthCredentials() : false, websocket: true };
-    providers['anthropic-oauth'] = { enabled: detectCredentials ? hasAnthropicOAuthCredentials() : false };
+    // load does not import provider runtimes or SDKs.
+    //
+    // The probe has THREE outcomes and `enabled` is only a boolean, so the
+    // third one is carried alongside it: a credential file that EXISTS but
+    // could not be read/parsed this instant (lock contention, EACCES, a torn
+    // atomic write) yields enabled:false + credentialProbeUnavailable:true.
+    // Without that marker the registry cannot tell such a load apart from a
+    // real logout/disable and would latch a momentary FS failure as a user
+    // opt-out. The marker is ephemeral: loadConfig drops it as soon as the
+    // stored config states `enabled` itself, and saveConfig never persists it.
+    const oauthEntry = (name, extra = {}) => {
+        const state = detectCredentials ? oauthCredentialProbeState(name) : 'absent';
+        return {
+            enabled: state === 'present',
+            ...(state === 'unreadable' ? { credentialProbeUnavailable: true } : {}),
+            ...extra,
+        };
+    };
+    // WebSocket transport is on by default — measured ~96% cross-session cache
+    // hit with delta payloads. Users who need to force SSE (e.g. a corporate
+    // proxy blocking WSS) can set `websocket: false` in mixdog-config.json
+    // (agent.providers.openai-oauth).
+    providers['openai-oauth'] = oauthEntry('openai-oauth', { websocket: true });
+    providers['anthropic-oauth'] = oauthEntry('anthropic-oauth');
     // Grok OAuth ("Grok Build"). Like the other OAuth entries it is not
     // stored in mixdog-config.json — enabled at runtime from the presence of
     // Mixdog-owned credentials.
-    providers['grok-oauth'] = { enabled: detectCredentials ? hasGrokOAuthCredentials() : false };
+    providers['grok-oauth'] = oauthEntry('grok-oauth');
     // Experimental direct Cursor wire provider. It remains disabled unless a
     // Mixdog-owned login or CURSOR_ACCESS_TOKEN is present.
-    providers['cursor-oauth'] = { enabled: detectCredentials ? hasCursorOAuthCredentials() : false };
+    providers['cursor-oauth'] = oauthEntry('cursor-oauth');
     // Google Antigravity (Cloud Code Assist). Gemini and Claude behind one
     // Google login; enabled only once a login has stored tokens + project.
-    providers['antigravity-oauth'] = { enabled: detectCredentials ? hasAntigravityOAuthCredentials() : false };
+    providers['antigravity-oauth'] = oauthEntry('antigravity-oauth');
     // Local providers — opt-in via setup UI after HTTP ping confirms server is running
     providers.ollama = { enabled: false, baseURL: 'http://localhost:11434/v1' };
     providers.lmstudio = { enabled: false, baseURL: 'http://localhost:1234/v1' };
@@ -461,6 +473,14 @@ export function loadConfig(options = {}) {
                 for (const [name, val] of Object.entries(raw.providers)) {
                     if (val && typeof val === 'object') {
                         mergedProviders[name] = { ...(mergedProviders[name] || {}), ...val };
+                        // A STORED `enabled` is the user's own decision (setup
+                        // UI disable / hand edit) and outranks the probe: keep
+                        // it authoritative by dropping the probe-availability
+                        // marker, so a disable still removes the provider even
+                        // while its credential file happens to be unreadable.
+                        if (Object.prototype.hasOwnProperty.call(val, 'enabled')) {
+                            delete mergedProviders[name].credentialProbeUnavailable;
+                        }
                     } else {
                         mergedProviders[name] = val;
                     }
@@ -679,13 +699,28 @@ function buildAgentSaveBuilder(config, appliedDirty) {
     // provider keys are keychain-only (loadConfig overlays them into memory;
     // persisting would leak plaintext back into mixdog-config.json). It stays
     // in KNOWN_PROVIDER_KEYS so the generic passthrough loop also skips it.
-    const KNOWN_PROVIDER_KEYS = new Set(['apiKey', 'enabled', 'baseURL']);
+    // `credentialProbeUnavailable` is a per-load probe observation, not user
+    // state: persisting it would turn one unreadable-file moment into a marker
+    // that outlives the condition on every later load. Listed here so the
+    // generic passthrough loop below skips it.
+    const KNOWN_PROVIDER_KEYS = new Set(['apiKey', 'enabled', 'baseURL', 'credentialProbeUnavailable']);
     const persistedProviders = {};
     if (config.providers) {
         for (const [name, val] of Object.entries(config.providers)) {
             if (!val || typeof val !== 'object') continue;
             const slim = {};
-            if (typeof val.enabled === 'boolean') slim.enabled = val.enabled;
+            // NEVER persist an `enabled:false` that came from a credential probe
+            // which could not READ the credential this load. Writing it would
+            // convert a momentary FS failure into a stored user decision: the
+            // marker is stripped on save, so the next load would read that false
+            // as a deliberate disable and the provider would stay off for good.
+            // Omitting the key leaves `enabled` derived from the probe again on
+            // the next load. This can never erase a real user disable: loadConfig
+            // drops the marker whenever the stored config states `enabled`
+            // itself, so a marker in memory means nothing was stored for it.
+            const probeUnavailable = val.credentialProbeUnavailable === true;
+            const skipEnabled = probeUnavailable && val.enabled === false;
+            if (typeof val.enabled === 'boolean' && !skipEnabled) slim.enabled = val.enabled;
             if (val.baseURL) slim.baseURL = val.baseURL;
             for (const [k, v] of Object.entries(val)) {
                 if (KNOWN_PROVIDER_KEYS.has(k)) continue;

package/src/runtime/agent/orchestrator/mcp/cancellation.test.mjs

@@ -0,0 +1,139 @@
+// MCP tool-call cancellation: an aborted caller (hook timeout, aborted turn,
+// closed pane) must settle immediately AND release its admission slot, in every
+// phase of a call — queued, admitted-and-running, and stalled mid-reconnect.
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  _registerMcpServerForTest,
+  executeMcpTool,
+  getMcpAdmissionSnapshot,
+} from './client.mjs';
+
+const never = () => new Promise(() => {});
+
+function deferred() {
+  let resolve;
+  const promise = new Promise((res) => { resolve = res; });
+  return { promise, resolve };
+}
+
+async function waitFor(predicate, label, timeoutMs = 2_000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (predicate()) return;
+    await new Promise((resolve) => { setTimeout(resolve, 10); });
+  }
+  throw new Error(`timed out waiting for ${label}`);
+}
+
+function slotsFor(scopeId, serverName) {
+  const gate = getMcpAdmissionSnapshot(scopeId).find((entry) => entry.name === serverName);
+  return { active: gate?.active ?? 0, queued: gate?.queued ?? 0 };
+}
+
+/** Settle-state probe: a cancellation fix is only real if the promise settles
+ *  while the callee is still stuck. */
+function track(promise) {
+  const state = { settled: false, error: null };
+  promise.then(
+    () => { state.settled = true; },
+    (error) => { state.settled = true; state.error = error; },
+  );
+  return state;
+}
+
+test('an aborted caller settles a QUEUED call and frees its queue seat', async () => {
+  const scopeId = 'mcp-cancel-queued';
+  _registerMcpServerForTest(scopeId, 'busy', [{ name: 'hang' }], {
+    cfg: { maxConcurrency: 1, timeoutMs: 'off' },
+    callTool: never,
+  });
+  const held = executeMcpTool('mcp__busy__hang', {}, { scopeId });
+  held.catch(() => {});
+  await waitFor(() => slotsFor(scopeId, 'busy').active === 1, 'the first call to occupy the slot');
+
+  const controller = new AbortController();
+  const queued = executeMcpTool('mcp__busy__hang', {}, { scopeId, signal: controller.signal });
+  const state = track(queued);
+  await waitFor(() => slotsFor(scopeId, 'busy').queued === 1, 'the second call to queue');
+
+  controller.abort(new Error('queued hook aborted'));
+  await assert.rejects(queued, /queued hook aborted/);
+  assert.equal(state.settled, true);
+  assert.equal(slotsFor(scopeId, 'busy').queued, 0, 'the queue seat is released');
+});
+
+test('an aborted caller settles an ADMITTED call whose server ignores cancellation', async () => {
+  const scopeId = 'mcp-cancel-active';
+  let sawSignal = false;
+  _registerMcpServerForTest(scopeId, 'deaf', [{ name: 'hang' }], {
+    // Server call timeout DISABLED: the caller's abort is the only bound.
+    cfg: { maxConcurrency: 1, timeoutMs: 'off' },
+    callTool: (_params, _schema, options) => {
+      sawSignal = Boolean(options?.signal);
+      return never();
+    },
+  });
+  const controller = new AbortController();
+  const call = executeMcpTool('mcp__deaf__hang', {}, { scopeId, signal: controller.signal });
+  const state = track(call);
+  await waitFor(() => slotsFor(scopeId, 'deaf').active === 1, 'the call to be admitted');
+  assert.equal(state.settled, false, 'a running call does not settle on its own');
+
+  controller.abort(new Error('mcp_tool hook timed out: mcp__deaf__hang'));
+  await assert.rejects(call, /mcp_tool hook timed out/);
+  assert.equal(sawSignal, true, 'the abort signal reaches the SDK request');
+  await waitFor(() => slotsFor(scopeId, 'deaf').active === 0, 'the admission slot to be released');
+
+  // The freed slot is genuinely reusable.
+  _registerMcpServerForTest(scopeId, 'deaf-ok', [{ name: 'go' }], {
+    cfg: { maxConcurrency: 1 },
+    callTool: async () => ({ content: [{ type: 'text', text: 'ran after cancel' }] }),
+  });
+  assert.equal(await executeMcpTool('mcp__deaf-ok__go', {}, { scopeId }), 'ran after cancel');
+});
+
+test('an aborted caller settles a call stalled inside a shared reconnect', async () => {
+  const scopeId = 'mcp-cancel-reconnect';
+  const closeEntered = deferred();
+  _registerMcpServerForTest(scopeId, 'flaky', [{ name: 'boom' }], {
+    cfg: { maxConcurrency: 1, timeoutMs: 'off' },
+    // A plain failure (not a timeout, not an abort) is what sends the call into
+    // the shared reconnect path.
+    callTool: async () => { throw new Error('transport went away'); },
+    // Teardown never completes, so the reconnect stays in flight forever.
+    close: () => { closeEntered.resolve(); return never(); },
+  });
+  const controller = new AbortController();
+  const call = executeMcpTool('mcp__flaky__boom', {}, { scopeId, signal: controller.signal });
+  const state = track(call);
+  await closeEntered.promise;
+  await waitFor(() => slotsFor(scopeId, 'flaky').active === 1, 'the call to hold its slot in reconnect');
+  assert.equal(state.settled, false, 'the stalled reconnect keeps the call pending');
+
+  controller.abort(new Error('hook aborted during reconnect'));
+  await assert.rejects(call, /hook aborted during reconnect/);
+  await waitFor(
+    () => slotsFor(scopeId, 'flaky').active === 0,
+    'the admission slot to be released while the reconnect is still stalled',
+  );
+});
+
+test('cancellation never turns into a reconnect-and-retry (no duplicate side effect)', async () => {
+  const scopeId = 'mcp-cancel-no-retry';
+  let calls = 0;
+  const closeEntered = deferred();
+  _registerMcpServerForTest(scopeId, 'once', [{ name: 'effect' }], {
+    cfg: { maxConcurrency: 1, timeoutMs: 'off' },
+    callTool: async () => { calls += 1; throw new Error('transport went away'); },
+    close: () => { closeEntered.resolve(); return never(); },
+  });
+  const controller = new AbortController();
+  const call = executeMcpTool('mcp__once__effect', {}, { scopeId, signal: controller.signal });
+  await closeEntered.promise;
+  controller.abort(new Error('aborted before retry'));
+  await assert.rejects(call, /aborted before retry/);
+  await new Promise((resolve) => { setTimeout(resolve, 50); });
+  assert.equal(calls, 1, 'the aborted call is never replayed against a reconnected server');
+});

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -44,23 +44,25 @@ function run(cmd, args) {
 async function enumerate() {
     const childrenOf = new Map();
     const tokenOf = new Map();
+    const nameOf = new Map();
     const out = isWin
         ? await run('powershell.exe', [
             '-NoProfile', '-NonInteractive', '-Command',
-            `Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToString('o'))" }`,
+            `Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $($_.CreationDate.ToString('o'))" }`,
         ])
-        : await run('ps', ['-A', '-o', 'pid=,ppid=,lstart=']);
+        : await run('ps', ['-A', '-o', 'pid=,ppid=,comm=,lstart=']);
     for (const line of out.split(/\r?\n/)) {
-        const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.+))?$/);
+        const m = line.trim().match(/^(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/);
         if (!m) continue;
         const pid = Number(m[1]);
         const ppid = Number(m[2]);
-        const token = (m[3] || '').trim() || null;
+        const token = (m[4] || '').trim() || null;
         if (!childrenOf.has(ppid)) childrenOf.set(ppid, []);
         childrenOf.get(ppid).push(pid);
         tokenOf.set(pid, token);
+        nameOf.set(pid, m[3]);
     }
-    return { childrenOf, tokenOf };
+    return { childrenOf, tokenOf, nameOf };
 }
 
 // BFS every descendant pid of rootPid (excludes rootPid).
@@ -87,6 +89,33 @@ async function collectDescendants(rootPid) {
     return descendantsOf(childrenOf, rootPid);
 }
 
+/** Descendant pids WITH their image names, from one batched process-table
+ *  read. Shared with the shell runner's post-exit descendant observation so
+ *  both use a single enumeration implementation. */
+export async function collectDescendantProcesses(rootPid) {
+    const { childrenOf, nameOf } = await enumerate().catch(() => ({ childrenOf: new Map(), nameOf: new Map() }));
+    return descendantsOf(childrenOf, rootPid).map((pid) => ({ pid, name: nameOf.get(pid) || '' }));
+}
+
+/** Force-kill whole process trees by pid. Windows batches one taskkill /T /F
+ *  for every pid; POSIX escalates SIGTERM → SIGKILL. Best-effort: the caller
+ *  verifies liveness afterwards rather than trusting the signal. */
+export async function killProcessTrees(pids) {
+    const targets = [...new Set((pids || []).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
+    if (targets.length === 0) return;
+    if (isWin) {
+        const args = ['/F', '/T'];
+        for (const pid of targets) args.push('/PID', String(pid));
+        await run('taskkill', args);
+        return;
+    }
+    for (const pid of targets) { try { process.kill(pid, 'SIGTERM'); } catch { /* ignore */ } }
+    await delay(300);
+    for (const pid of targets) {
+        if (isAlive(pid)) { try { process.kill(pid, 'SIGKILL'); } catch { /* ignore */ } }
+    }
+}
+
 /**
  * Immediate, non-blocking tree kill for a transport whose MCP handshake never
  * completed (shutdown-during-connect). Unlike shutdownStdioChild there is no