mixdog 1.4.1 → 1.4.3

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -20,7 +20,7 @@ import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { mixyIdentityDir, userDefinitionDir } from '../../../shared/agent-store.mjs';
 import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
-import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { connectorById, connectorToolDefault } from '../../../shared/connector-catalog.mjs';
 import { MIXY_AGENT_ID } from '../session/agent-home.mjs';
 import { AGENT_MODE, sessionModeOf } from '../session/agent-mode.mjs';
 import { serverConnector } from './server-connectors.mjs';
@@ -214,12 +214,43 @@ export function connectorToolPermission(policy, toolOrName) {
   const mcp = parseMcpToolName(toolOrName);
   if (!mcp || isSelfMcpToolName(toolOrName)) return 'auto';
   if (policy && !connectorEnabled(policy, mcp.server)) return 'disabled';
-  // An explicit per-tool entry decides; otherwise a catalog connector's
-  // high-risk tools ask (connectorToolDefault) and any other tool is auto.
-  return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
+  // An explicit per-tool entry of the tool's connector decides; otherwise a
+  // catalog connector's high-risk tools ask (connectorToolDefault) and any
+  // other tool is auto.
+  const [own] = connectorToolEntries(policy?.tools, connectorGroupId(mcp.server), mcp.tool);
+  return own || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
 export const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+
+/** The connector a server (account) belongs to: `gmail-2` → `gmail` for a
+ *  catalog connector; any other id is its own. A tool's permission is stored
+ *  once, under this id, and governs every account. */
+export function connectorGroupId(serverId) {
+  const base = String(serverId).replace(/-\d+$/, '');
+  return base !== serverId && connectorById(base) ? base : serverId;
+}
+
+const accountNumber = (id) => Number(/-(\d+)$/.exec(id)?.[1] ?? 0);
+
+/** The entries for `tool` under the connector `group` or any of its accounts,
+ *  topmost first: the connector's own, then the lowest-numbered account. An
+ *  account only holds one in data saved before permissions were kept per
+ *  connector; the first entry is the one that applies. */
+export function connectorToolEntries(tools, group, tool) {
+  return Object.entries(tools || {})
+    .filter(([id, own]) => connectorGroupId(id) === group && CONNECTOR_PERMISSIONS.includes(own?.[tool]))
+    .sort(([a], [b]) => accountNumber(a) - accountNumber(b))
+    .map(([, own]) => own[tool]);
+}
+
+const UNLISTED_ACCOUNT = '\0unlisted account';
+
+/** Rank of `tool` on one account of connector `group`: 0 when that account is
+ *  off, else the topmost entry for the connector, else `unset` (no override:
+ *  at least asks / at most runs freely). */
+const accountRank = (tools, off, account, group, tool, unset) =>
+  off.has(account) ? 0 : (PERMISSION_RANK[connectorToolEntries(tools, group, tool)[0]] ?? unset);
 export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 
 /** Whether replacing the stored policy `before` (a stored value, a parsed
@@ -243,21 +274,102 @@ function connectorPolicyWidens(before, after) {
   for (const server of offBefore) if (!offAfter.has(server)) return true;
   const toolsBefore = old.tools || {};
   const toolsAfter = next.tools || {};
-  for (const server of new Set([...Object.keys(toolsBefore), ...Object.keys(toolsAfter)])) {
-    const tools = new Set([...Object.keys(toolsBefore[server] || {}), ...Object.keys(toolsAfter[server] || {})]);
-    for (const tool of tools) {
-      // No override: at least asks / at most runs freely.
-      const was = offBefore.has(server) ? 0 : (PERMISSION_RANK[toolsBefore[server]?.[tool]] ?? 1);
-      const now = offAfter.has(server) ? 0 : (PERMISSION_RANK[toolsAfter[server]?.[tool]] ?? 2);
+  // Judged per connector and tool: the accounts of one connector share them.
+  const pairs = new Set(
+    [toolsBefore, toolsAfter].flatMap((tools) =>
+      Object.entries(tools).flatMap(([id, own]) =>
+        Object.keys(own || {}).map((tool) => `${connectorGroupId(id)}\0${tool}`)
+      )
+    )
+  );
+  for (const pair of pairs) {
+    const [group, tool] = pair.split('\0');
+    // Each account on its own: one that is off does not hold back its siblings.
+    // Plus one account the policy never names: it is on in both policies, so it
+    // stands for every installed account that is not listed.
+    const accounts = new Set([
+      UNLISTED_ACCOUNT,
+      ...[group, ...offBefore, ...offAfter, ...Object.keys(toolsBefore), ...Object.keys(toolsAfter)].filter(
+        (id) => connectorGroupId(id) === group
+      ),
+    ]);
+    for (const account of accounts) {
+      const was = accountRank(toolsBefore, offBefore, account, group, tool, 1);
+      const now = accountRank(toolsAfter, offAfter, account, group, tool, 2);
       if (now > was) return true;
     }
   }
   return false;
 }
 
-/** Throws NO_WIDEN_MESSAGE when `after` could widen `before` (see connectorPolicyWidens). */
+/** The `code` of the error a refused widening throws. */
+export const CONNECTOR_POLICY_WIDENS = 'CONNECTOR_POLICY_WIDENS';
+/** An approved tool change met a restriction newer than its request. */
+export const CONNECTOR_TOOL_NARROWED = 'CONNECTOR_TOOL_NARROWED';
+/** An approved tool change found the tool already at that level or more. */
+export const CONNECTOR_TOOL_ALREADY = 'CONNECTOR_TOOL_ALREADY';
+
+const codedError = (code, message) => Object.assign(new Error(message), { code });
+
+// The one change a person approved on a card (setup-tool connector-widen-approval.mjs),
+// set only for the synchronous stretch of its write.
+let approvedToolChange = null;
+
+/** Run `write` (a writer whose noWiden check runs synchronously, before it
+ *  writes) with one approved change `{ server, tool, from, to }`: its check
+ *  then lets exactly that tool go to `to`, judged on the stored policy it
+ *  writes over, and nothing else widen. Returns what `write` returns. */
+export function withApprovedConnectorToolChange(change, write) {
+  approvedToolChange = change;
+  try {
+    return write();
+  } finally {
+    approvedToolChange = null;
+  }
+}
+
+// The approved tool's entries (the connector's, and any account's) pinned to
+// one value in both policies, so the comparison judges every other tool and switch.
+const pinTool = (policy, group, tool) => {
+  const tools = Object.fromEntries(
+    Object.entries(policy?.tools || {}).map(([id, own]) => [
+      id,
+      connectorGroupId(id) === group ? { ...own, [tool]: 'disabled' } : own,
+    ])
+  );
+  tools[group] = { ...tools[group], [tool]: 'disabled' };
+  return { off: policy?.off || [], tools };
+};
+
+function assertApprovedToolChange(before, after, { server, tool, from, to }) {
+  let old;
+  try {
+    old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);
+  } catch {
+    throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  }
+  // The approved change is the connector's: its one entry goes to `to`.
+  const group = connectorGroupId(server);
+  if (old.allow || after?.tools?.[group]?.[tool] !== to) throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  if (connectorPolicyWidens(pinTool(old, group, tool), pinTool(after, group, tool))) {
+    throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
+  }
+  // No override: it asks at least (as connectorPolicyWidens reads it).
+  const was = accountRank(old.tools, new Set(old.off), server, group, tool, 1);
+  if (was < PERMISSION_RANK[from]) {
+    throw codedError(CONNECTOR_TOOL_NARROWED, 'A newer restriction on this tool landed meanwhile; it was kept.');
+  }
+  if (was >= PERMISSION_RANK[to]) {
+    throw codedError(CONNECTOR_TOOL_ALREADY, 'The tool already has this permission or more; nothing changed.');
+  }
+}
+
+/** Throws NO_WIDEN_MESSAGE (code CONNECTOR_POLICY_WIDENS) when `after` could
+ *  widen `before` (see connectorPolicyWidens); inside
+ *  withApprovedConnectorToolChange, only its approved change may. */
 export function assertConnectorPolicyNotWidened(before, after) {
-  if (connectorPolicyWidens(before, after)) throw new Error(NO_WIDEN_MESSAGE);
+  if (approvedToolChange) return assertApprovedToolChange(before, after, approvedToolChange);
+  if (connectorPolicyWidens(before, after)) throw codedError(CONNECTOR_POLICY_WIDENS, NO_WIDEN_MESSAGE);
 }
 
 let toolPermissionWriter = null;

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -6,9 +6,12 @@
 // grandchildren (uv.exe -> mcp-for-unity.exe -> python.exe) orphaned. This
 // module implements the MCP spec shutdown order over the whole process tree:
 // close stdin -> grace wait for voluntary exit -> force-kill the recorded
-// tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
-// POSIX). No external dependencies.
-import { spawn } from 'node:child_process';
+// tree (the creation-checked tree kill below on Windows, SIGTERM->SIGKILL of
+// every descendant on POSIX). No external dependencies.
+//
+// It also owns Mixdog's one Windows process-tree kill (treeKillCommand), which
+// every other Windows tree kill runs, sync, async or detached.
+import { spawn, spawnSync } from 'node:child_process';
 import { runProcessOffThread } from '../../../shared/process-runner.mjs';
 import { detachedSpawnOpts } from '../../../shared/spawn-flags.mjs';
 
@@ -49,13 +52,21 @@ export const ENUMERATION_DEADLINE_MS = 20_000;
 // Output bound of one helper command: a process table is tens of KB.
 const HELPER_MAX_BYTES = 64 * 1024 * 1024;
 
-// Run a helper command off the event loop (process-runner.mjs: under load one
-// PowerShell start blocked the daemon's loop for seconds) and resolve its
-// stdout. Past `timeoutMs` (default ENUMERATION_DEADLINE_MS) the helper is
-// killed and the call settles. Strict: a failed, non-zero or timed-out run
-// rejects; otherwise it resolves '' (non-zero exits keep their stdout).
+// Run a helper command (a process-table read or a tree kill) off the event
+// loop (process-runner.mjs: under load one PowerShell start blocked the
+// daemon's loop for seconds). Past `timeoutMs` the helper itself is killed
+// directly: it starts nothing worth walking, and a tree kill of it would be
+// one more pass on the same stuck table read, with a deadline of its own.
+function runHelper(cmd, args, timeoutMs) {
+  return runProcessOffThread(cmd, args, { timeoutMs, maxBytes: HELPER_MAX_BYTES, killTree: false });
+}
+
+// A process-table helper's stdout. Past `timeoutMs` (default
+// ENUMERATION_DEADLINE_MS) the helper is killed and the call settles. Strict:
+// a failed, non-zero or timed-out run rejects; otherwise it resolves ''
+// (non-zero exits keep their stdout).
 function run(cmd, args, { strict = false, timeoutMs = ENUMERATION_DEADLINE_MS } = {}) {
-  return runProcessOffThread(cmd, args, { timeoutMs, maxBytes: HELPER_MAX_BYTES }).then(
+  return runHelper(cmd, args, timeoutMs).then(
     ({ code, stdout }) => {
       if (strict && code !== 0) throw new Error(`Process enumeration failed (${code}).`);
       return stdout;
@@ -69,8 +80,10 @@ function run(cmd, args, { strict = false, timeoutMs = ENUMERATION_DEADLINE_MS }
 }
 
 // Snapshot the whole process table once: parent map + a per-pid identity
-// token (Windows CreationDate, POSIX lstart) so a later kill can prove a pid
-// number was not recycled onto a different process before signalling it.
+// token (Windows CreationDate as a UTC FILETIME, POSIX lstart) so a later kill
+// can prove a pid number was not recycled onto a different process before
+// signalling it. The FILETIME form orders against the spawn server's root
+// creation time and carries no local-time offset.
 // POSIX rows also carry the process group id (Windows has none).
 async function enumerate({ strict = false } = {}) {
   const childrenOf = new Map();
@@ -84,7 +97,7 @@ async function enumerate({ strict = false } = {}) {
           '-NoProfile',
           '-NonInteractive',
           '-Command',
-          `${strict ? "$ErrorActionPreference = 'Stop'; " : ''}Get-CimInstance Win32_Process | ForEach-Object { $created = if ($_.CreationDate) { $_.CreationDate.ToString('o') } else { '' }; "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $created" }`,
+          `${strict ? "$ErrorActionPreference = 'Stop'; " : ''}Get-CimInstance Win32_Process | ForEach-Object { $created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { '' }; "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $created" }`,
         ],
         { strict, timeoutMs: ENUMERATION_DEADLINE_MS }
       )
@@ -145,27 +158,41 @@ export function readProcessTable() {
   return nextTable;
 }
 
+// Windows keeps a dead parent's pid in its children and hands that pid to new
+// processes, so an older process can look like a newer one's child: wininit.exe
+// still names its boot-time parent's pid, and a tree walked from whatever holds
+// that pid now reaches services.exe and every service host under it. A child is
+// never created before its parent, so on Windows a link is followed only from a
+// process whose creation time is known, to one created no earlier. POSIX
+// reparents orphans, so its links never dangle.
+const createdTicks = (token) => (typeof token === 'string' && /^\d+$/.test(token) ? BigInt(token) : null);
+
 // Walk every descendant pid of rootPid (excludes rootPid).
-function descendantsOf(childrenOf, rootPid) {
+function descendantsOf(childrenOf, rootPid, tokenOf) {
   const result = [];
   const seen = new Set([rootPid]);
   const stack = [rootPid];
   while (stack.length) {
     const cur = stack.pop();
+    const parentCreated = isWin ? createdTicks(tokenOf.get(cur)) : null;
+    if (isWin && parentCreated == null) continue;
     for (const child of childrenOf.get(cur) ?? []) {
-      if (!seen.has(child)) {
-        seen.add(child);
-        result.push(child);
-        stack.push(child);
+      if (seen.has(child)) continue;
+      if (isWin) {
+        const childCreated = createdTicks(tokenOf.get(child));
+        if (childCreated == null || childCreated < parentCreated) continue;
       }
+      seen.add(child);
+      result.push(child);
+      stack.push(child);
     }
   }
   return result;
 }
 
 async function collectDescendants(rootPid) {
-  const { childrenOf } = await enumerate();
-  return descendantsOf(childrenOf, rootPid);
+  const { childrenOf, tokenOf } = await enumerate();
+  return descendantsOf(childrenOf, rootPid, tokenOf);
 }
 
 /** Descendant pids WITH their image names and identity tokens (creation
@@ -175,24 +202,163 @@ export async function collectDescendantProcesses(rootPid, { strict = false } = {
   const { childrenOf, nameOf, tokenOf } = strict
     ? await snapshot
     : await snapshot.catch(() => ({ childrenOf: new Map(), nameOf: new Map(), tokenOf: new Map() }));
-  return descendantsOf(childrenOf, rootPid).map((pid) => ({
+  return descendantsOf(childrenOf, rootPid, tokenOf).map((pid) => ({
     pid,
     name: nameOf.get(pid) || '',
     token: tokenOf.get(pid) ?? null,
   }));
 }
 
-/** Force-kill whole process trees by pid. Windows batches one taskkill /T /F
- *  for every pid; POSIX escalates SIGTERM → SIGKILL. Best-effort: the caller
+const positivePids = (pids) => [...new Set((pids || []).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
+
+// The Windows tree kill, one PowerShell pass. taskkill /T is never used: it
+// walks parent ids with no creation times, so it follows the dangling links
+// descendantsOf refuses (on 2026-10-30 one such kill ended every user-owned
+// service host and sihost.exe). A root counts only if it was created no later
+// than -AliveAt (a pid taken over after the caller saw its process is not
+// that process); a descendant only if created no earlier than its parent.
+// Each process is ended through a handle whose start time matches the table.
+// Exit: 0 ended, 128 no root matched (gone or a different process), 1 a root
+// survived; a failed or timed-out table read fails the pass. The table read
+// times out on its own (a pass detached from an exiting caller still ends);
+// every spawn from Node is also held to TREE_KILL_DEADLINE_MS. -Table/-List: tests only, a
+// stand-in table whose member pids are printed instead of ended.
+export const TREE_KILL_SCRIPT = `param([int[]]$Pids, [long]$AliveAt, [object[]]$Table, [switch]$List)
+$ErrorActionPreference = 'Stop'
+$limit = [DateTime]::FromFileTimeUtc($AliveAt)
+if ($Table) {
+  $rows = @(foreach ($t in $Table) { [pscustomobject]@{ Id = [int]$t.Id; Parent = [int]$t.Parent; Created = [DateTime]::FromFileTimeUtc([long]$t.Created) } })
+} else {
+  $rows = @(Get-CimInstance Win32_Process -OperationTimeoutSec 10 | Where-Object CreationDate | ForEach-Object { [pscustomobject]@{ Id = [int]$_.ProcessId; Parent = [int]$_.ParentProcessId; Created = $_.CreationDate.ToUniversalTime() } })
+}
+$byId = @{}
+$byParent = @{}
+foreach ($r in $rows) {
+  $byId[$r.Id] = $r
+  if (-not $byParent.ContainsKey($r.Parent)) { $byParent[$r.Parent] = [Collections.Generic.List[object]]::new() }
+  $byParent[$r.Parent].Add($r)
+}
+$members = [Collections.Generic.List[object]]::new()
+foreach ($id in $Pids) {
+  $r = $byId[$id]
+  if ($r -and $r.Created -le $limit -and -not $members.Contains($r)) { $members.Add($r) }
+}
+$roots = $members.Count
+if ($roots -eq 0) { exit 128 }
+for ($i = 0; $i -lt $members.Count; $i++) {
+  $parent = $members[$i]
+  if (-not $byParent.ContainsKey($parent.Id)) { continue }
+  foreach ($child in $byParent[$parent.Id]) {
+    if ($child.Created -ge $parent.Created -and -not $members.Contains($child)) { $members.Add($child) }
+  }
+}
+if ($List) { foreach ($m in $members) { $m.Id }; exit 0 }
+$survived = $false
+for ($i = 0; $i -lt $members.Count; $i++) {
+  $m = $members[$i]
+  try { $p = [Diagnostics.Process]::GetProcessById($m.Id) } catch { continue }
+  try { $same = [math]::Abs(($p.StartTime.ToUniversalTime() - $m.Created).TotalMilliseconds) -lt 1 } catch { $same = $null }
+  if ($same -eq $false) { continue }
+  # A start time that cannot be read proves nothing: the process is left alone,
+  # and a root left alone counts as surviving.
+  if ($null -eq $same) { if ($i -lt $roots) { $survived = $true }; continue }
+  try { $p.Kill() } catch {}
+  if ($i -lt $roots) { try { if (-not $p.WaitForExit(2000)) { $survived = $true } } catch { $survived = $true } }
+}
+if ($survived) { exit 1 }
+exit 0`;
+
+const fileTime = (ms) => BigInt(Math.floor(Number(ms))) * 10_000n + 116_444_736_000_000_000n;
+
+/** The command of one Windows tree kill of `pids` (see TREE_KILL_SCRIPT), for
+ *  callers that spawn it themselves: awaited, synchronous, or detached and
+ *  unref'd so it outlives an exiting caller. `aliveAt` (epoch ms): when the
+ *  caller last knew each pid was its process (a live child handle: now; a
+ *  pid file: when it was written). `table`: tests only, rows { pid, ppid,
+ *  created (epoch ms) } standing in for the live table; the command then
+ *  prints the member pids instead of ending them. */
+export function treeKillCommand(pids, { aliveAt = Date.now(), table = null } = {}) {
+  const rows = table
+    ? ` -List -Table @(${table.map((row) => `@{Id=${row.pid};Parent=${row.ppid};Created=${fileTime(row.created)}}`).join(',')})`
+    : '';
+  const source = `& {\n${TREE_KILL_SCRIPT}\n} -Pids @(${positivePids(pids).join(',')}) -AliveAt ${fileTime(aliveAt)}${rows}`;
+  const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+  return {
+    command: `${systemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+    args: ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(source, 'utf16le').toString('base64')],
+  };
+}
+
+/** The hard lifetime of one tree-kill pass, enforced from Node whatever the
+ *  table read does (its own timeout is 10 s). */
+export const TREE_KILL_DEADLINE_MS = 15_000;
+
+/** The tree kill run synchronously (Windows only): its exit status (see
+ *  TREE_KILL_SCRIPT), or null when it could not run or outlived `timeoutMs`. */
+export function killProcessTreesSync(pids, { aliveAt = Date.now(), timeoutMs = TREE_KILL_DEADLINE_MS } = {}) {
+  const { command, args } = treeKillCommand(pids, { aliveAt });
+  return spawnSync(command, args, { stdio: 'ignore', windowsHide: true, timeout: timeoutMs }).status;
+}
+
+/** The tree kill spawned (Windows only) and held to TREE_KILL_DEADLINE_MS:
+ *  past it the pass is killed. `root`: the caller's own ChildProcess, alive
+ *  now; it is killed directly once the pass has ended, failed or run out of
+ *  time, so a hung pass never keeps it alive. `detached`: the pass outlives
+ *  an exiting caller and is bounded only by its own table-read timeout.
+ *  Neither the pass nor its deadline keeps the caller's event loop alive.
+ *  Returns the pass's ChildProcess, or null when it could not be spawned. */
+export function spawnTreeKill(pids, { aliveAt = Date.now(), root = null, detached = false } = {}) {
+  const killRoot = () => {
+    try {
+      root?.kill();
+    } catch {
+      /* already gone */
+    }
+  };
+  let pass;
+  try {
+    const { command, args } = treeKillCommand(pids, { aliveAt });
+    pass = spawn(command, args, { stdio: 'ignore', ...detachedSpawnOpts });
+  } catch {
+    killRoot();
+    return null;
+  }
+  pass.unref?.();
+  if (detached) {
+    pass.once('error', killRoot);
+    return pass;
+  }
+  const deadline = setTimeout(() => {
+    try {
+      pass.kill();
+    } catch {
+      /* already gone */
+    }
+    killRoot();
+  }, TREE_KILL_DEADLINE_MS);
+  deadline.unref?.();
+  const settle = () => {
+    clearTimeout(deadline);
+    killRoot();
+  };
+  pass.once('error', settle);
+  pass.once('exit', settle);
+  return pass;
+}
+
+/** Force-kill whole process trees by pid. Windows runs the tree kill off the
+ *  event loop and resolves to its exit status (null: it could not run or
+ *  timed out); POSIX escalates SIGTERM → SIGKILL. Best-effort: the caller
  *  verifies liveness afterwards rather than trusting the signal. */
-export async function killProcessTrees(pids) {
-  const targets = [...new Set((pids || []).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
-  if (targets.length === 0) return;
+export async function killProcessTrees(pids, { aliveAt = Date.now() } = {}) {
+  const targets = positivePids(pids);
+  if (targets.length === 0) return isWin ? 128 : undefined;
   if (isWin) {
-    const args = ['/F', '/T'];
-    for (const pid of targets) args.push('/PID', String(pid));
-    await run('taskkill', args);
-    return;
+    const { command, args } = treeKillCommand(targets, { aliveAt });
+    return runHelper(command, args, TREE_KILL_DEADLINE_MS).then(
+      ({ code }) => code,
+      () => null
+    );
   }
   for (const pid of targets) signalQuietly(pid, 'SIGTERM');
   await delay(300);
@@ -204,10 +370,10 @@ export async function killProcessTrees(pids) {
 /**
  * Immediate, non-blocking tree kill for a transport whose MCP handshake never
  * completed (shutdown-during-connect). Unlike shutdownStdioChild there is no
- * grace wait and no identity-checked enumeration on Windows — the ChildProcess
- * handle is live, so the pid is current, and taskkill /T reaps the still-
- * parented tree. Everything is unref'd/fire-and-forget so the kill can never
- * hold the caller's event loop open (the caller is a process about to exit).
+ * grace wait and no enumeration here — the ChildProcess handle is live, so the
+ * pid is current, and a detached tree kill reaps the still-parented tree after
+ * the caller is gone. Everything is unref'd/fire-and-forget so the kill can
+ * never hold the caller's event loop open (the caller is a process about to exit).
  */
 export function killStdioChildTreeFast(transport) {
   const proc = transport?._process;
@@ -232,15 +398,7 @@ export function killStdioChildTreeFast(transport) {
     }
   }
   if (isWin) {
-    try {
-      const cp = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
-        stdio: 'ignore',
-        ...detachedSpawnOpts,
-      });
-      cp.unref();
-    } catch {
-      /* ignore */
-    }
+    spawnTreeKill([pid], { root: proc, detached: true });
     return true;
   }
   // POSIX: cheap ps enumerate, then SIGKILL descendants + root. Best-effort
@@ -306,11 +464,8 @@ async function killVerified(pids, snapshotToken, currentTokens) {
   const verified = pids.filter((pid) => stillSame(pid, snapshotToken, currentTokens));
   if (verified.length === 0) return;
   if (isWin) {
-    // /T also reaps any still-live children spawned since enumeration;
-    // every listed /PID was identity-checked just above.
-    const args = ['/F', '/T'];
-    for (const p of verified) args.push('/PID', String(p));
-    await run('taskkill', args);
+    // Every listed pid was identity-checked just above.
+    await killProcessTrees(verified);
     return;
   }
   // POSIX: terminate, brief wait, then hard-kill survivors. Re-verify with a
@@ -337,7 +492,7 @@ export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
   // Snapshot #1: tree + identity tokens while it is still fully intact.
   // Covers children that later get re-parented/orphaned during shutdown.
   const before = await enumerate().catch(() => empty);
-  const initial = descendantsOf(before.childrenOf, pid);
+  const initial = descendantsOf(before.childrenOf, pid, before.tokenOf);
   snapshotToken.set(pid, before.tokenOf.get(pid) ?? null);
   for (const d of initial) snapshotToken.set(d, before.tokenOf.get(d) ?? null);
   // 1. Close stdin to request a voluntary shutdown.
@@ -351,7 +506,7 @@ export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
   // 3. Snapshot #2 after the grace: catches children spawned late during
   //    shutdown that were absent from the first snapshot.
   const after = await enumerate().catch(() => empty);
-  const fresh = descendantsOf(after.childrenOf, pid);
+  const fresh = descendantsOf(after.childrenOf, pid, after.tokenOf);
   for (const d of fresh) {
     if (!snapshotToken.has(d)) snapshotToken.set(d, after.tokenOf.get(d) ?? null);
   }

package/src/runtime/agent/orchestrator/mcp/client-config.mjs

@@ -8,11 +8,9 @@ import { rememberMcpToolIdentity } from '../../../shared/tool-primitives.mjs';
 
 /** Known auto-detect targets: the discovery-advert service name and the MCP
  *  endpoint path on its port.
- *  Note: `mixdog` used to self-loopback via active-instance.json's
- *  httpPort, but that path went through channels' owner HTTP server which
- *  only exposes a subset of tools. The plugin's own tools are now injected
- *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
- *  so this registry is for genuinely external port-based MCP targets only. */
+ *  The plugin's own tools are injected in-process through agent's
+ *  toolExecutor (see orchestrator/internal-tools), so this registry is for
+ *  genuinely external port-based MCP targets only. */
 export const AUTO_DETECT_PORTS = {
   'mixdog-memory': { discovery: 'memory', endpoint: '/mcp' },
 };
@@ -307,14 +305,25 @@ export function resolveMcpTransportKind(cfg) {
   throw new Error(`Invalid config: need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`);
 }
 
-/** The exact URL OAuth credentials of an HTTP/SSE server config are stored
- *  under; null for other transports. */
+/** The exact URL an HTTP/SSE server config signs in at with OAuth; null for
+ *  other transports. */
 export function resolveMcpOAuthUrl(cfg) {
   const kind = resolveMcpTransportKind(cfg);
   if (kind !== 'http' && kind !== 'sse') return null;
   return normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), kind);
 }
 
+/** What the OAuth credentials of an HTTP/SSE server config are stored under:
+ *  its exact URL, or a connector account's own `oauthKey` (another account
+ *  of the connector signs in at the same URL), whatever the URL. Null for
+ *  other transports. */
+export function resolveMcpOAuthCredentialKey(cfg) {
+  const url = resolveMcpOAuthUrl(cfg);
+  if (!url) return null;
+  const own = typeof cfg.oauthKey === 'string' ? cfg.oauthKey.trim() : '';
+  return own ? `mcp-account:${own}` : url;
+}
+
 // MCP per-tool-call timeout. Default 2min: a hung/unresponsive MCP server
 // (e.g. a busy editor) must not stall a tool call indefinitely. Genuinely
 // long-running tools can raise/disable it via MIXDOG_MCP_CALL_TIMEOUT_MS or a