mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -6,9 +6,12 @@
 // grandchildren (uv.exe -> mcp-for-unity.exe -> python.exe) orphaned. This
 // module implements the MCP spec shutdown order over the whole process tree:
 // close stdin -> grace wait for voluntary exit -> force-kill the recorded
-// tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
-// POSIX). No external dependencies.
-import { spawn } from 'node:child_process';
+// tree (the creation-checked tree kill below on Windows, SIGTERM->SIGKILL of
+// every descendant on POSIX). No external dependencies.
+//
+// It also owns Mixdog's one Windows process-tree kill (treeKillCommand), which
+// every other Windows tree kill runs, sync, async or detached.
+import { spawn, spawnSync } from 'node:child_process';
 import { runProcessOffThread } from '../../../shared/process-runner.mjs';
 import { detachedSpawnOpts } from '../../../shared/spawn-flags.mjs';
 
@@ -49,13 +52,21 @@ export const ENUMERATION_DEADLINE_MS = 20_000;
 // Output bound of one helper command: a process table is tens of KB.
 const HELPER_MAX_BYTES = 64 * 1024 * 1024;
 
-// Run a helper command off the event loop (process-runner.mjs: under load one
-// PowerShell start blocked the daemon's loop for seconds) and resolve its
-// stdout. Past `timeoutMs` (default ENUMERATION_DEADLINE_MS) the helper is
-// killed and the call settles. Strict: a failed, non-zero or timed-out run
-// rejects; otherwise it resolves '' (non-zero exits keep their stdout).
+// Run a helper command (a process-table read or a tree kill) off the event
+// loop (process-runner.mjs: under load one PowerShell start blocked the
+// daemon's loop for seconds). Past `timeoutMs` the helper itself is killed
+// directly: it starts nothing worth walking, and a tree kill of it would be
+// one more pass on the same stuck table read, with a deadline of its own.
+function runHelper(cmd, args, timeoutMs) {
+  return runProcessOffThread(cmd, args, { timeoutMs, maxBytes: HELPER_MAX_BYTES, killTree: false });
+}
+
+// A process-table helper's stdout. Past `timeoutMs` (default
+// ENUMERATION_DEADLINE_MS) the helper is killed and the call settles. Strict:
+// a failed, non-zero or timed-out run rejects; otherwise it resolves ''
+// (non-zero exits keep their stdout).
 function run(cmd, args, { strict = false, timeoutMs = ENUMERATION_DEADLINE_MS } = {}) {
-  return runProcessOffThread(cmd, args, { timeoutMs, maxBytes: HELPER_MAX_BYTES }).then(
+  return runHelper(cmd, args, timeoutMs).then(
     ({ code, stdout }) => {
       if (strict && code !== 0) throw new Error(`Process enumeration failed (${code}).`);
       return stdout;
@@ -147,27 +158,41 @@ export function readProcessTable() {
   return nextTable;
 }
 
+// Windows keeps a dead parent's pid in its children and hands that pid to new
+// processes, so an older process can look like a newer one's child: wininit.exe
+// still names its boot-time parent's pid, and a tree walked from whatever holds
+// that pid now reaches services.exe and every service host under it. A child is
+// never created before its parent, so on Windows a link is followed only from a
+// process whose creation time is known, to one created no earlier. POSIX
+// reparents orphans, so its links never dangle.
+const createdTicks = (token) => (typeof token === 'string' && /^\d+$/.test(token) ? BigInt(token) : null);
+
 // Walk every descendant pid of rootPid (excludes rootPid).
-function descendantsOf(childrenOf, rootPid) {
+function descendantsOf(childrenOf, rootPid, tokenOf) {
   const result = [];
   const seen = new Set([rootPid]);
   const stack = [rootPid];
   while (stack.length) {
     const cur = stack.pop();
+    const parentCreated = isWin ? createdTicks(tokenOf.get(cur)) : null;
+    if (isWin && parentCreated == null) continue;
     for (const child of childrenOf.get(cur) ?? []) {
-      if (!seen.has(child)) {
-        seen.add(child);
-        result.push(child);
-        stack.push(child);
+      if (seen.has(child)) continue;
+      if (isWin) {
+        const childCreated = createdTicks(tokenOf.get(child));
+        if (childCreated == null || childCreated < parentCreated) continue;
       }
+      seen.add(child);
+      result.push(child);
+      stack.push(child);
     }
   }
   return result;
 }
 
 async function collectDescendants(rootPid) {
-  const { childrenOf } = await enumerate();
-  return descendantsOf(childrenOf, rootPid);
+  const { childrenOf, tokenOf } = await enumerate();
+  return descendantsOf(childrenOf, rootPid, tokenOf);
 }
 
 /** Descendant pids WITH their image names and identity tokens (creation
@@ -177,24 +202,163 @@ export async function collectDescendantProcesses(rootPid, { strict = false } = {
   const { childrenOf, nameOf, tokenOf } = strict
     ? await snapshot
     : await snapshot.catch(() => ({ childrenOf: new Map(), nameOf: new Map(), tokenOf: new Map() }));
-  return descendantsOf(childrenOf, rootPid).map((pid) => ({
+  return descendantsOf(childrenOf, rootPid, tokenOf).map((pid) => ({
     pid,
     name: nameOf.get(pid) || '',
     token: tokenOf.get(pid) ?? null,
   }));
 }
 
-/** Force-kill whole process trees by pid. Windows batches one taskkill /T /F
- *  for every pid; POSIX escalates SIGTERM → SIGKILL. Best-effort: the caller
+const positivePids = (pids) => [...new Set((pids || []).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
+
+// The Windows tree kill, one PowerShell pass. taskkill /T is never used: it
+// walks parent ids with no creation times, so it follows the dangling links
+// descendantsOf refuses (on 2026-10-30 one such kill ended every user-owned
+// service host and sihost.exe). A root counts only if it was created no later
+// than -AliveAt (a pid taken over after the caller saw its process is not
+// that process); a descendant only if created no earlier than its parent.
+// Each process is ended through a handle whose start time matches the table.
+// Exit: 0 ended, 128 no root matched (gone or a different process), 1 a root
+// survived; a failed or timed-out table read fails the pass. The table read
+// times out on its own (a pass detached from an exiting caller still ends);
+// every spawn from Node is also held to TREE_KILL_DEADLINE_MS. -Table/-List: tests only, a
+// stand-in table whose member pids are printed instead of ended.
+export const TREE_KILL_SCRIPT = `param([int[]]$Pids, [long]$AliveAt, [object[]]$Table, [switch]$List)
+$ErrorActionPreference = 'Stop'
+$limit = [DateTime]::FromFileTimeUtc($AliveAt)
+if ($Table) {
+  $rows = @(foreach ($t in $Table) { [pscustomobject]@{ Id = [int]$t.Id; Parent = [int]$t.Parent; Created = [DateTime]::FromFileTimeUtc([long]$t.Created) } })
+} else {
+  $rows = @(Get-CimInstance Win32_Process -OperationTimeoutSec 10 | Where-Object CreationDate | ForEach-Object { [pscustomobject]@{ Id = [int]$_.ProcessId; Parent = [int]$_.ParentProcessId; Created = $_.CreationDate.ToUniversalTime() } })
+}
+$byId = @{}
+$byParent = @{}
+foreach ($r in $rows) {
+  $byId[$r.Id] = $r
+  if (-not $byParent.ContainsKey($r.Parent)) { $byParent[$r.Parent] = [Collections.Generic.List[object]]::new() }
+  $byParent[$r.Parent].Add($r)
+}
+$members = [Collections.Generic.List[object]]::new()
+foreach ($id in $Pids) {
+  $r = $byId[$id]
+  if ($r -and $r.Created -le $limit -and -not $members.Contains($r)) { $members.Add($r) }
+}
+$roots = $members.Count
+if ($roots -eq 0) { exit 128 }
+for ($i = 0; $i -lt $members.Count; $i++) {
+  $parent = $members[$i]
+  if (-not $byParent.ContainsKey($parent.Id)) { continue }
+  foreach ($child in $byParent[$parent.Id]) {
+    if ($child.Created -ge $parent.Created -and -not $members.Contains($child)) { $members.Add($child) }
+  }
+}
+if ($List) { foreach ($m in $members) { $m.Id }; exit 0 }
+$survived = $false
+for ($i = 0; $i -lt $members.Count; $i++) {
+  $m = $members[$i]
+  try { $p = [Diagnostics.Process]::GetProcessById($m.Id) } catch { continue }
+  try { $same = [math]::Abs(($p.StartTime.ToUniversalTime() - $m.Created).TotalMilliseconds) -lt 1 } catch { $same = $null }
+  if ($same -eq $false) { continue }
+  # A start time that cannot be read proves nothing: the process is left alone,
+  # and a root left alone counts as surviving.
+  if ($null -eq $same) { if ($i -lt $roots) { $survived = $true }; continue }
+  try { $p.Kill() } catch {}
+  if ($i -lt $roots) { try { if (-not $p.WaitForExit(2000)) { $survived = $true } } catch { $survived = $true } }
+}
+if ($survived) { exit 1 }
+exit 0`;
+
+const fileTime = (ms) => BigInt(Math.floor(Number(ms))) * 10_000n + 116_444_736_000_000_000n;
+
+/** The command of one Windows tree kill of `pids` (see TREE_KILL_SCRIPT), for
+ *  callers that spawn it themselves: awaited, synchronous, or detached and
+ *  unref'd so it outlives an exiting caller. `aliveAt` (epoch ms): when the
+ *  caller last knew each pid was its process (a live child handle: now; a
+ *  pid file: when it was written). `table`: tests only, rows { pid, ppid,
+ *  created (epoch ms) } standing in for the live table; the command then
+ *  prints the member pids instead of ending them. */
+export function treeKillCommand(pids, { aliveAt = Date.now(), table = null } = {}) {
+  const rows = table
+    ? ` -List -Table @(${table.map((row) => `@{Id=${row.pid};Parent=${row.ppid};Created=${fileTime(row.created)}}`).join(',')})`
+    : '';
+  const source = `& {\n${TREE_KILL_SCRIPT}\n} -Pids @(${positivePids(pids).join(',')}) -AliveAt ${fileTime(aliveAt)}${rows}`;
+  const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+  return {
+    command: `${systemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+    args: ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(source, 'utf16le').toString('base64')],
+  };
+}
+
+/** The hard lifetime of one tree-kill pass, enforced from Node whatever the
+ *  table read does (its own timeout is 10 s). */
+export const TREE_KILL_DEADLINE_MS = 15_000;
+
+/** The tree kill run synchronously (Windows only): its exit status (see
+ *  TREE_KILL_SCRIPT), or null when it could not run or outlived `timeoutMs`. */
+export function killProcessTreesSync(pids, { aliveAt = Date.now(), timeoutMs = TREE_KILL_DEADLINE_MS } = {}) {
+  const { command, args } = treeKillCommand(pids, { aliveAt });
+  return spawnSync(command, args, { stdio: 'ignore', windowsHide: true, timeout: timeoutMs }).status;
+}
+
+/** The tree kill spawned (Windows only) and held to TREE_KILL_DEADLINE_MS:
+ *  past it the pass is killed. `root`: the caller's own ChildProcess, alive
+ *  now; it is killed directly once the pass has ended, failed or run out of
+ *  time, so a hung pass never keeps it alive. `detached`: the pass outlives
+ *  an exiting caller and is bounded only by its own table-read timeout.
+ *  Neither the pass nor its deadline keeps the caller's event loop alive.
+ *  Returns the pass's ChildProcess, or null when it could not be spawned. */
+export function spawnTreeKill(pids, { aliveAt = Date.now(), root = null, detached = false } = {}) {
+  const killRoot = () => {
+    try {
+      root?.kill();
+    } catch {
+      /* already gone */
+    }
+  };
+  let pass;
+  try {
+    const { command, args } = treeKillCommand(pids, { aliveAt });
+    pass = spawn(command, args, { stdio: 'ignore', ...detachedSpawnOpts });
+  } catch {
+    killRoot();
+    return null;
+  }
+  pass.unref?.();
+  if (detached) {
+    pass.once('error', killRoot);
+    return pass;
+  }
+  const deadline = setTimeout(() => {
+    try {
+      pass.kill();
+    } catch {
+      /* already gone */
+    }
+    killRoot();
+  }, TREE_KILL_DEADLINE_MS);
+  deadline.unref?.();
+  const settle = () => {
+    clearTimeout(deadline);
+    killRoot();
+  };
+  pass.once('error', settle);
+  pass.once('exit', settle);
+  return pass;
+}
+
+/** Force-kill whole process trees by pid. Windows runs the tree kill off the
+ *  event loop and resolves to its exit status (null: it could not run or
+ *  timed out); POSIX escalates SIGTERM → SIGKILL. Best-effort: the caller
  *  verifies liveness afterwards rather than trusting the signal. */
-export async function killProcessTrees(pids) {
-  const targets = [...new Set((pids || []).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
-  if (targets.length === 0) return;
+export async function killProcessTrees(pids, { aliveAt = Date.now() } = {}) {
+  const targets = positivePids(pids);
+  if (targets.length === 0) return isWin ? 128 : undefined;
   if (isWin) {
-    const args = ['/F', '/T'];
-    for (const pid of targets) args.push('/PID', String(pid));
-    await run('taskkill', args);
-    return;
+    const { command, args } = treeKillCommand(targets, { aliveAt });
+    return runHelper(command, args, TREE_KILL_DEADLINE_MS).then(
+      ({ code }) => code,
+      () => null
+    );
   }
   for (const pid of targets) signalQuietly(pid, 'SIGTERM');
   await delay(300);
@@ -206,10 +370,10 @@ export async function killProcessTrees(pids) {
 /**
  * Immediate, non-blocking tree kill for a transport whose MCP handshake never
  * completed (shutdown-during-connect). Unlike shutdownStdioChild there is no
- * grace wait and no identity-checked enumeration on Windows — the ChildProcess
- * handle is live, so the pid is current, and taskkill /T reaps the still-
- * parented tree. Everything is unref'd/fire-and-forget so the kill can never
- * hold the caller's event loop open (the caller is a process about to exit).
+ * grace wait and no enumeration here — the ChildProcess handle is live, so the
+ * pid is current, and a detached tree kill reaps the still-parented tree after
+ * the caller is gone. Everything is unref'd/fire-and-forget so the kill can
+ * never hold the caller's event loop open (the caller is a process about to exit).
  */
 export function killStdioChildTreeFast(transport) {
   const proc = transport?._process;
@@ -234,15 +398,7 @@ export function killStdioChildTreeFast(transport) {
     }
   }
   if (isWin) {
-    try {
-      const cp = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
-        stdio: 'ignore',
-        ...detachedSpawnOpts,
-      });
-      cp.unref();
-    } catch {
-      /* ignore */
-    }
+    spawnTreeKill([pid], { root: proc, detached: true });
     return true;
   }
   // POSIX: cheap ps enumerate, then SIGKILL descendants + root. Best-effort
@@ -308,11 +464,8 @@ async function killVerified(pids, snapshotToken, currentTokens) {
   const verified = pids.filter((pid) => stillSame(pid, snapshotToken, currentTokens));
   if (verified.length === 0) return;
   if (isWin) {
-    // /T also reaps any still-live children spawned since enumeration;
-    // every listed /PID was identity-checked just above.
-    const args = ['/F', '/T'];
-    for (const p of verified) args.push('/PID', String(p));
-    await run('taskkill', args);
+    // Every listed pid was identity-checked just above.
+    await killProcessTrees(verified);
     return;
   }
   // POSIX: terminate, brief wait, then hard-kill survivors. Re-verify with a
@@ -339,7 +492,7 @@ export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
   // Snapshot #1: tree + identity tokens while it is still fully intact.
   // Covers children that later get re-parented/orphaned during shutdown.
   const before = await enumerate().catch(() => empty);
-  const initial = descendantsOf(before.childrenOf, pid);
+  const initial = descendantsOf(before.childrenOf, pid, before.tokenOf);
   snapshotToken.set(pid, before.tokenOf.get(pid) ?? null);
   for (const d of initial) snapshotToken.set(d, before.tokenOf.get(d) ?? null);
   // 1. Close stdin to request a voluntary shutdown.
@@ -353,7 +506,7 @@ export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
   // 3. Snapshot #2 after the grace: catches children spawned late during
   //    shutdown that were absent from the first snapshot.
   const after = await enumerate().catch(() => empty);
-  const fresh = descendantsOf(after.childrenOf, pid);
+  const fresh = descendantsOf(after.childrenOf, pid, after.tokenOf);
   for (const d of fresh) {
     if (!snapshotToken.has(d)) snapshotToken.set(d, after.tokenOf.get(d) ?? null);
   }

package/src/runtime/agent/orchestrator/mcp/client-config.mjs

@@ -8,11 +8,9 @@ import { rememberMcpToolIdentity } from '../../../shared/tool-primitives.mjs';
 
 /** Known auto-detect targets: the discovery-advert service name and the MCP
  *  endpoint path on its port.
- *  Note: `mixdog` used to self-loopback via active-instance.json's
- *  httpPort, but that path went through channels' owner HTTP server which
- *  only exposes a subset of tools. The plugin's own tools are now injected
- *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
- *  so this registry is for genuinely external port-based MCP targets only. */
+ *  The plugin's own tools are injected in-process through agent's
+ *  toolExecutor (see orchestrator/internal-tools), so this registry is for
+ *  genuinely external port-based MCP targets only. */
 export const AUTO_DETECT_PORTS = {
   'mixdog-memory': { discovery: 'memory', endpoint: '/mcp' },
 };

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -10,6 +10,8 @@ import { googleMcpService, withGoogleMcp } from '../../../connectors/google-mcp.
 import { gmailAppPasswordService, withGmailAppPasswordMcp } from '../../../connectors/gmail-app-password.mjs';
 import { withConnectorAccountsMcp } from '../../../connectors/connector-accounts-mcp.mjs';
 import {
+  connectorAccountEnabled,
+  connectorAccountId,
   connectorAccountsOf,
   connectorLiveAccountServers,
   gmailAppPasswordAccount,
@@ -271,9 +273,13 @@ function missingEnvWarnings(name, cfg, strictEnv, log) {
 // A connector server: one server, every account behind it (its account choice
 // on `connectorAccounts`); closing the transport closes every account client.
 function connectorAccountsTransport({ name, cfg, Transport, url, accountServers, sdk, oauthOptions, log }) {
-  const accounts = accountServers.map((accountCfg) =>
-    connectorAccountClient(name, accountCfg, { sdk, log, oauthOptions })
-  );
+  // `accountServers` are the switched-on stored accounts, in order.
+  const stored = connectorAccountsOf(cfg).filter(connectorAccountEnabled);
+  const accounts = accountServers.map((accountCfg, index) => {
+    const account = connectorAccountClient(name, accountCfg, { sdk, log, oauthOptions });
+    account.id = connectorAccountId(cfg, stored[index]);
+    return account;
+  });
   const fetchImpl = withConnectorAccountsMcp({ connector: cfg.connector, accounts });
   const transport = new Transport(new URL(url), { fetch: fetchImpl });
   transport.connectorAccounts = fetchImpl.connectorAccounts;

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -54,8 +54,9 @@ import {
 export { probeMcpServerAuth } from './oauth-probe.mjs';
 
 // Config interpretation (transport kind, URL policy, env expansion, headers,
-// timeouts, log scrubbing) lives in client-config.mjs; re-exported so every
-// existing importer resolves unchanged.
+// timeouts, log scrubbing) lives in client-config.mjs; the names importers
+// use (including through namespace loads such as boot.mcpClient) are
+// re-exported here.
 export {
   normalizeMcpTransportUrl,
   mcpUrlForLog,
@@ -64,9 +65,6 @@ export {
   resolveMcpHttpHeaders,
   resolveMcpTransportKind,
   resolveMcpStartupTimeoutMs,
-  resolveMcpCallTimeoutMs,
-  resolveMcpMaxTotalTimeoutMs,
-  resolveMcpRequestTimeouts,
 } from './client-config.mjs';
 const servers = new Map();
 const reconnects = createKeyedSingleflight();

package/src/runtime/agent/orchestrator/mcp/oauth-client.mjs

@@ -6,7 +6,7 @@
 //   - else the catalog connector's (connector-catalog.mjs `oauthClient`), with
 //     its scopes and the provider's offline-access parameter.
 import { createHash } from 'node:crypto';
-import keychain from '../../../../lib/keychain-cjs.cjs';
+import { keychainSecretStore as keychain } from '../../../shared/config.mjs';
 import { connectorById, connectorOfServer, gmailAppPasswordAccount } from '../../../shared/connector-catalog.mjs';
 import { GOOGLE_AUTH_PARAMS, googleOAuthClient } from '../../../shared/google-oauth-client.mjs';
 import { normalizeMcpTransportUrl } from './client-config.mjs';

package/src/runtime/agent/orchestrator/mcp/oauth-credentials.mjs

@@ -145,11 +145,16 @@ export function createCredentialCache({ url, credentialStore, account }) {
         }
         exists = Boolean(saved);
       }
+      const signedIn = Boolean(creds.tokens);
       change();
       hold();
+      // Other processes follow a refresh through the revision marker; only a
+      // sign-in or sign-out is announced as a settings change (it may let a
+      // server that needed sign-in connect, or end its connection).
+      const announce = remove ? signedIn : Boolean(creds.tokens) !== signedIn;
       if (remove) {
         await writeRevisionMarker(account, null);
-        if (exists) await credentialStore.deleteSecretAsync(account);
+        if (exists) await credentialStore.deleteSecretAsync(account, { announce });
         await writeIdentityFile(account, null);
         creds.observed = null;
       } else {
@@ -158,7 +163,8 @@ export function createCredentialCache({ url, credentialStore, account }) {
         const { tokens, clientInformation, redirectUrl, discovery, identity } = creds;
         await credentialStore.setSecretAsync(
           account,
-          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery, identity })
+          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery, identity }),
+          { announce }
         );
         await writeIdentityFile(account, creds);
         creds.observed = revision;

package/src/runtime/agent/orchestrator/mcp/oauth-probe.mjs

@@ -12,7 +12,7 @@ import {
 } from './client-config.mjs';
 import { hasConfiguredMcpAuth } from './client-transport.mjs';
 
-export const MCP_AUTH_PROBE_TIMEOUT_MS = 10_000;
+const MCP_AUTH_PROBE_TIMEOUT_MS = 10_000;
 
 const INITIALIZE_PROBE = JSON.stringify({
   jsonrpc: '2.0',

package/src/runtime/agent/orchestrator/mcp/oauth-provider.mjs

@@ -145,6 +145,20 @@ export function createOAuthProvider({ cache, flow, lifetimeSignal, client = null
       // access_type=offline, without which no refresh token is issued).
       if (client?.scopes) target.searchParams.set('scope', client.scopes.join(' '));
       for (const [key, value] of Object.entries(client?.authParams || {})) target.searchParams.set(key, value);
+      // A dynamically registered client asks for offline access when the
+      // authorization server lists it (MCP SEP-2207): the SDK sends only the
+      // resource's scopes (Vercel's `openid`), and without `offline_access`
+      // such a server issues no refresh token, so the sign-in ends within the
+      // hour. `prompt=consent` is what the SDK adds beside that scope. An
+      // empty scope stays empty: the server's default scopes would be lost.
+      if (!client) {
+        const scope = target.searchParams.get('scope');
+        const offered = creds.discovery?.authorizationServerMetadata?.scopes_supported;
+        if (scope && offered?.includes('offline_access') && !scope.split(' ').includes('offline_access')) {
+          target.searchParams.set('scope', `${scope} offline_access`);
+          target.searchParams.append('prompt', 'consent');
+        }
+      }
       // The explicit sign-in's account mode (mcp-oauth-login.mjs) decides the
       // provider's documented account-choice parameter, if any.
       await flow.launchBrowser(withAccountParams(target.href, flow.launchBrowser.accountMode || 'connect').href);

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import keychain from '../../../../lib/keychain-cjs.cjs';
+import { keychainSecretStore as keychain } from '../../../shared/config.mjs';
 import { openInBrowser } from '../../../shared/open-url.mjs';
 import { normalizeMcpTransportUrl } from './client-config.mjs';
 import {

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.312';
+export const DEFAULT_CLI_VERSION = '2.1.316';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;

package/src/runtime/agent/orchestrator/providers/anthropic-sse-turn/turn-events/content-block-stop.mjs

@@ -7,9 +7,9 @@
 import { makeInvalidToolArgsMarker } from '../../lib/openai-tool-args.mjs';
 import { OAUTH_STREAM_LABELS } from '../../lib/anthropic-stream-labels.mjs';
 
-// Bare JSON.parse used to throw straight up into the surrounding broad catch,
-// which swallowed the whole tool_call — the loop never saw it and the
-// assistant turn ended with an unmatched tool_use id. A malformed input still
+// A bare JSON.parse would throw into the surrounding broad catch, which
+// swallows the whole tool_call — the loop never sees it and the assistant
+// turn ends with an unmatched tool_use id. A malformed input still
 // produces a tool_call (with an invalid-args marker and a logged error)
 // instead of a silent drop or accidental `{}` dispatch. Tool arguments must
 // be a plain object: Anthropic's tool_use input is always a JSON object, but

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -20,7 +20,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // version (gpt-6.1-sol requires >= 0.159.0, measured 2026-10-09), so the
 // release workflow raises this to the published CLI version on every release
 // (scripts/sync-client-version-floors.mjs).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.165.0';
+export const CODEX_CLIENT_VERSION_FLOOR = '0.166.0';
 export const CODEX_CLI_NPM_PACKAGE = '@openai/codex';
 const live = createNpmVersionSource(CODEX_CLI_NPM_PACKAGE, { persistKey: 'codex-cli' });
 

package/src/runtime/agent/orchestrator/providers/gemini-thinking.mjs

@@ -52,7 +52,7 @@ function budgetSpec(model) {
 
 // Levels documented for models whose ladder differs from the generic wire
 // vocabulary (a catalog ladder, when declared, still takes precedence).
-function documentedThinkingLevels(model) {
+export function geminiDocumentedThinkingLevels(model) {
   const bare = String(model || '')
     .replace(/^models\//i, '')
     .toLowerCase();
@@ -105,7 +105,7 @@ export function geminiThinkingConfig(model, opts = {}, { includeThoughts, provid
     }
     config.thinkingBudget = spec.efforts[level];
   } else if (level) {
-    const supported = catalogThinkingLevels(model, provider) ?? documentedThinkingLevels(model) ?? LEVELS;
+    const supported = catalogThinkingLevels(model, provider) ?? geminiDocumentedThinkingLevels(model) ?? LEVELS;
     if (!supported.includes(level)) {
       throw new TypeError(`${model} supports thinking levels ${supported.join(', ')}; received ${level}.`);
     }

package/src/runtime/agent/orchestrator/providers/openai-compat-response-normalization.mjs

@@ -234,12 +234,10 @@ export function normalizeCompatChatResponse({
     model: response.model || useModel,
     toolCalls,
     stopReason,
-    // P1 audit fix: a text-only completion that hit finish_reason=
-    // 'length' (no tool calls, so not thrown above as
-    // ProviderIncompleteError) previously returned as an ordinary
-    // success with no signal that the content is a mid-sentence
-    // cutoff. Flag it so loop.mjs can surface a one-line warning
-    // instead of silently treating a truncated answer as complete.
+    // A text-only completion that hit finish_reason='length' (no tool
+    // calls, so not thrown above as ProviderIncompleteError) is flagged so
+    // loop.mjs can surface a one-line warning instead of silently treating
+    // a mid-sentence cutoff as complete.
     ...(stopReason === 'length' && (assembled.content || '').length > 0 ? { truncated: true } : {}),
     ...(reasoningContent !== null ? { reasoningContent } : {}),
     ...(Object.keys(providerMetadata).length ? { providerMetadata } : {}),