talon-agent 5.24.0 → 5.25.0

package/src/core/mcp-hub/index.ts

@@ -20,7 +20,10 @@
  *   - tool-surface trimming (disabledTools / disabledToolTags)
  *   - plugin reload retires children; the next request respawns from
  *     the current registry (see reloadHubChildren)
- *   - children run under the supervisor wrap (orphan cleanup)
+ *   - children are orphan-guarded (one reaper per daemon, falling back
+ *     to the per-child supervisor wrap — see child-guard.ts)
+ *   - a session's tools/list does not spawn its chat's child when any
+ *     chat already listed that server (see listChildTools)
  *
  * Endpoints live on the gateway HTTP server (127.0.0.1-bound, behind the
  * same token and Host/Origin guard as /action — see engine/gateway-auth.ts;
@@ -33,7 +36,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { getPluginMcpServers } from "../plugin/index.js";
-import { wrapMcpServer } from "./launcher.js";
+import { enableChildGuard, stopChildGuard } from "./child-guard.js";
 import { log, logError } from "../../util/log.js";
 import { buildTalonToolServer, VALID_TOOL_FRONTENDS } from "./talon-server.js";
 import { buildProxyServer } from "./proxy-server.js";
@@ -42,6 +45,7 @@ import {
   closeAllChildren,
   formatChildExit,
   getLastChildExit,
+  listChildTools,
   retireAllChildren,
   startChildReaper,
   stopChildReaper,
@@ -71,6 +75,12 @@ export type HubConfig = {
   adminUserId?: number;
   /** Further operator sender keys (see guest-scope.ts). */
   operatorIds?: readonly string[];
+  /**
+   * Orphan-guard hub children with the reaper (child-guard.ts). Set by the
+   * daemon bootstrap, whose entrypoint dispatches `_mcp-reaper`; left off
+   * by embedders/tests that drive the hub from an entry that doesn't.
+   */
+  guardChildren?: boolean;
 };
 
 let hubConfig: HubConfig = {};
@@ -79,6 +89,7 @@ let hubConfig: HubConfig = {};
 export function initHub(config: HubConfig): void {
   hubConfig = config;
   initGuestDmScope(config.guestDmScope, config.adminUserId, config.operatorIds);
+  if (config.guardChildren) enableChildGuard();
   startChildReaper();
 }
 
@@ -124,10 +135,10 @@ export async function listHubPluginToolNames(
   chatId: string,
   bridgeUrl: string,
 ): Promise<string[]> {
-  const child = await acquireChild(childKey(serverName, chatId), () =>
+  const tools = await listChildTools(childKey(serverName, chatId), () =>
     pluginSpec(serverName, chatId, bridgeUrl),
   );
-  return (await child.listTools()).map((tool) => tool.name);
+  return tools.map((tool) => tool.name);
 }
 
 /** Stderr lines quoted in a registration-failure warning (full tail is in the exit log line). */
@@ -181,15 +192,16 @@ function parseHubPath(rawUrl: string): HubTarget | null {
   return null;
 }
 
-function braveSpec(): ChildSpec {
-  return wrapMcpServer({
+function braveSpec(bridgeUrl: string): ChildSpec {
+  return {
     command: resolve(
       import.meta.dirname ?? ".",
       "../../../node_modules/.bin/brave-search-mcp-server",
     ),
     args: [],
     env: { BRAVE_API_KEY: hubConfig.braveApiKey ?? "" },
-  });
+    bridgeUrl,
+  };
 }
 
 /**
@@ -202,11 +214,16 @@ function pluginSpec(
   chatId: string,
   bridgeUrl: string,
 ): ChildSpec {
-  if (serverName === "brave-search") return braveSpec();
+  if (serverName === "brave-search") return braveSpec(bridgeUrl);
   const specs = getPluginMcpServers(bridgeUrl, chatId);
   const spec = specs[serverName];
   if (!spec) throw new Error(`Unknown hub plugin server: ${serverName}`);
-  return { command: spec.command, args: [...spec.args], env: spec.env };
+  return {
+    command: spec.command,
+    args: [...spec.args],
+    env: spec.env,
+    bridgeUrl,
+  };
 }
 
 /** Test-only: expose the spec resolution for the pass-through contract. */
@@ -226,13 +243,15 @@ function buildServerFor(target: HubTarget, bridgeUrl: string) {
   }
   // Re-checked per request: a session opened during an operator turn must
   // not serve a later guest turn in the same chat.
-  return buildProxyServer(target.serverName, () => {
-    if (guestPluginDenied(target)) {
-      return Promise.reject(new Error("Not available in this chat"));
-    }
-    return acquireChild(childKey(target.serverName, target.chatId), () =>
-      pluginSpec(target.serverName, target.chatId, bridgeUrl),
-    );
+  const key = childKey(target.serverName, target.chatId);
+  const spec = () => pluginSpec(target.serverName, target.chatId, bridgeUrl);
+  const denied = () =>
+    guestPluginDenied(target)
+      ? Promise.reject(new Error("Not available in this chat"))
+      : null;
+  return buildProxyServer(target.serverName, {
+    listTools: () => denied() ?? listChildTools(key, spec),
+    getChild: () => denied() ?? acquireChild(key, spec),
   });
 }
 
@@ -412,6 +431,7 @@ export async function shutdownHub(): Promise<void> {
   sessions.clear();
   await Promise.allSettled(entries.map((entry) => entry.transport.close()));
   await closeAllChildren();
+  stopChildGuard();
 }
 
 /** Diagnostic: live hub session count. */

package/src/core/mcp-hub/launcher.ts

@@ -1,11 +1,19 @@
 /**
  * MCP supervisor — one universal launch method for every install type.
  *
- * Every MCP stdio server Talon hands to a backend SDK is wrapped
- * through a supervisor process that proxies stdio, filters non-JSON
+ * The per-child supervisor process proxies stdio, filters non-JSON
  * stdout lines, and kills the child when Talon dies — no orphans, no
  * /proc scan, no per-plugin signature list.
  *
+ * The hub no longer runs one per MCP child by default: it spawns
+ * children itself, filters stdout in-process (child-transport.ts, same
+ * parseJsonRpcLine rule) and guards them with ONE reaper process per
+ * daemon (child-guard.ts / reaper.ts, same stdin-EOF + BridgeWatchdog +
+ * SIGTERM→SIGKILL semantics as below). Wrapping a child in this
+ * supervisor is the fallback when the reaper can't run, or when
+ * `TALON_MCP_SUPERVISOR=per-child` asks for it. `selfInvocation` below
+ * is how both helpers are launched.
+ *
  * The supervisor is Talon itself: `wrapMcpServer()` re-invokes the
  * current process (`process.execPath` + `process.execArgv` + entry
  * script) with the hidden `_mcp-launch` subcommand, the same
@@ -28,8 +36,8 @@
  *   }
  *
  * src/index.ts and src/cli.ts are the two real entrypoints; both
- * dispatch. index.ts additionally defers the whole app graph behind a
- * dynamic import so supervisor processes stay light.
+ * dispatch (the reaper's `_mcp-reaper` too), each helper behind its own
+ * dynamic import so helper processes load only their own module.
  *
  * Child-shutdown signals (both terminate the child with SIGTERM, then
  * SIGKILL after a grace period):
@@ -107,7 +115,8 @@ function isEmbeddedEntry(entry: string): boolean {
  * The command prefix that re-invokes the current Talon process with a
  * hidden subcommand, in every install shape (tsx source run, bun source
  * run, bun-compiled binary, npm install). Used for MCP supervision
- * (`_mcp-launch`) and the WASM Lua trigger runner (`_lua-run`) — any
+ * (`_mcp-launch`, `_mcp-reaper`) and the WASM Lua trigger runner
+ * (`_lua-run`) — any
  * subcommand passed here must be dispatched by src/index.ts and
  * src/cli.ts before the app graph loads.
  */
@@ -275,6 +284,63 @@ export class BridgeWatchdog {
   }
 }
 
+/** Tag prefixed to child stdout lines that were re-routed to stderr. */
+export const STDOUT_REROUTE_TAG = "[mcp-launcher: stdout→stderr] ";
+
+/**
+ * Parse one line of MCP child stdout under the stdio filter rule: a
+ * JSON-RPC line must be a JSON OBJECT (starts with `{`, parses). Returns
+ * the parsed value, or null for anything else — banners, log lines,
+ * `[timestamp] [INFO] …`, a stray `{ tip: "…" }` that isn't JSON. Both
+ * the per-child supervisor and the hub's in-process transport use this,
+ * so the two filtering paths cannot drift apart.
+ */
+export function parseJsonRpcLine(line: string): object | null {
+  const s = line.trimStart();
+  if (s.length === 0 || s[0] !== "{") return null;
+  try {
+    const parsed: unknown = JSON.parse(s);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Run the bridge-health watchdog: ping `${bridgeUrl}/health` every
+ * BRIDGE_PING_INTERVAL_MS (first tick staggered randomly), and call
+ * `onTrip` once BridgeWatchdog says the daemon is gone. `isStopping`
+ * short-circuits ticks after shutdown began. Shared by the per-child
+ * supervisor and the hub's reaper so both keep identical semantics.
+ */
+export function startBridgeWatchdog(
+  bridgeUrl: string,
+  isStopping: () => boolean,
+  onTrip: (outcome: BridgePingOutcome, downForSec: number) => void,
+): void {
+  const watchdog = new BridgeWatchdog();
+  const tick = async (): Promise<void> => {
+    if (isStopping()) return;
+    const outcome = await pingBridge(bridgeUrl);
+    if (isStopping()) return;
+    if (watchdog.record(outcome)) {
+      onTrip(
+        outcome,
+        watchdog.consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000),
+      );
+    }
+  };
+  // Stagger first tick so a process-wide restart doesn't have every
+  // watchdog pinging the bridge in lockstep.
+  const initialDelay = Math.floor(Math.random() * BRIDGE_PING_INTERVAL_MS);
+  const startTimer = setTimeout(() => {
+    void tick();
+    const interval = setInterval(() => void tick(), BRIDGE_PING_INTERVAL_MS);
+    interval.unref?.();
+  }, initialDelay);
+  startTimer.unref?.();
+}
+
 /**
  * Run the supervisor over `argvTail` = [cmd, ...args].
  *
@@ -331,16 +397,7 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
   // `[ISO-timestamp] [INFO] …`). Restrict to `{` and verify it's
   // parseable JSON before forwarding, so a stray `{ tip: "..." }`
   // shell-style line that isn't valid JSON still goes to stderr.
-  const looksJson = (line: string): boolean => {
-    const s = line.trimStart();
-    if (s.length === 0 || s[0] !== "{") return false;
-    try {
-      JSON.parse(s);
-      return true;
-    } catch {
-      return false;
-    }
-  };
+  const looksJson = (line: string): boolean => parseJsonRpcLine(line) !== null;
   let buf = "";
   child.stdout.setEncoding("utf-8");
   child.stdout.on("data", (chunk: string) => {
@@ -352,7 +409,7 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
       if (looksJson(line)) {
         process.stdout.write(line);
       } else if (line.trim().length > 0) {
-        process.stderr.write(`[mcp-launcher: stdout→stderr] ${line}`);
+        process.stderr.write(`${STDOUT_REROUTE_TAG}${line}`);
       }
     }
   });
@@ -361,7 +418,7 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
     if (looksJson(buf)) {
       process.stdout.write(buf);
     } else {
-      process.stderr.write(`[mcp-launcher: stdout→stderr] ${buf}`);
+      process.stderr.write(`${STDOUT_REROUTE_TAG}${buf}`);
     }
     buf = "";
   });
@@ -416,33 +473,20 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
   // (every Talon-spawned MCP server has it; ad-hoc supervisor uses
   // without the env var keep the stdin-EOF-only behavior).
   if (BRIDGE_URL) {
-    const watchdog = new BridgeWatchdog();
-    const tick = async (): Promise<void> => {
-      if (terminating) return;
-      const outcome = await pingBridge(BRIDGE_URL);
-      if (terminating) return;
-      if (watchdog.record(outcome)) {
+    startBridgeWatchdog(
+      BRIDGE_URL,
+      () => terminating,
+      (outcome, downForSec) => {
         // Talon's gateway is gone (or wedged for minutes). The MCP child
         // has nothing useful to serve — bridge calls would 404 against a
         // dead port — so shut down. Kilo/OpenCode notice the stdio close
         // on the next interaction and drop the registration on their side.
         process.stderr.write(
-          `mcp-launcher: bridge ${BRIDGE_URL} ${outcome} for ${
-            watchdog.consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000)
-          }s; shutting down child\n`,
+          `mcp-launcher: bridge ${BRIDGE_URL} ${outcome} for ${downForSec}s; shutting down child\n`,
         );
         terminate(0);
-      }
-    };
-    // Stagger first tick so a process-wide restart doesn't have every
-    // supervisor pinging the bridge in lockstep.
-    const initialDelay = Math.floor(Math.random() * BRIDGE_PING_INTERVAL_MS);
-    const startTimer = setTimeout(() => {
-      void tick();
-      const interval = setInterval(() => void tick(), BRIDGE_PING_INTERVAL_MS);
-      interval.unref?.();
-    }, initialDelay);
-    startTimer.unref?.();
+      },
+    );
   }
 
   // The child + stdin pipe keep the event loop alive; exit happens via

package/src/core/mcp-hub/proxy-server.ts

@@ -3,9 +3,11 @@
  * and tools/call to a hub-managed child (see children.ts).
  *
  * One proxy per hub session; many sessions share one child. The child
- * is re-acquired through `getChild` on every request, so a child that
+ * is re-acquired through `getChild` on every call, so a child that
  * was idle-reaped or crashed respawns transparently mid-session —
  * clients never see the lifecycle, only (at worst) a slow first call.
+ * tools/list goes through `listTools`, which the hub answers from its
+ * per-server cache when it can, so listing alone need not spawn.
  *
  * Tools-only by design: every MCP server Talon consumes (plugins,
  * brave) exposes tools, and the backends only wire tools. Resource /
@@ -18,26 +20,28 @@ import {
   ListToolsRequestSchema,
   CallToolRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
 import type { ChildHandle } from "./children.js";
 
-export function buildProxyServer(
-  name: string,
-  getChild: () => Promise<ChildHandle>,
-): Server {
+export type ProxySource = {
+  listTools: () => Promise<Tool[]>;
+  getChild: () => Promise<ChildHandle>;
+};
+
+export function buildProxyServer(name: string, source: ProxySource): Server {
   const server = new Server(
     { name, version: "1.0.0" },
     { capabilities: { tools: {} } },
   );
 
   server.setRequestHandler(ListToolsRequestSchema, async () => {
-    const child = await getChild();
-    return { tools: await child.listTools() };
+    return { tools: await source.listTools() };
   });
 
   // `extra.signal` fires when the upstream client cancels or its session
   // closes; passing it on stops the child's work instead of orphaning it.
   server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-    const child = await getChild();
+    const child = await source.getChild();
     return child.callTool(
       request.params.name,
       request.params.arguments ?? {},

package/src/core/mcp-hub/reaper.ts

@@ -0,0 +1,120 @@
+/**
+ * MCP reaper process — the `_mcp-reaper` side of the hub's child guard
+ * (see child-guard.ts for the design). Kept in its own module with no
+ * imports beyond launcher.ts so the reaper process stays small: the
+ * entry shims dispatch it before the app graph loads.
+ */
+
+import { startBridgeWatchdog } from "./launcher.js";
+
+/** Hidden CLI subcommand that turns a Talon process into the reaper. */
+export const MCP_REAPER_SUBCOMMAND = "_mcp-reaper";
+
+/** SIGTERM → SIGKILL grace, matching the per-child supervisor. */
+const REAPER_KILL_GRACE_MS = 1_000;
+
+/** One parsed control line: register (`+`) or release (`-`) a pid. */
+export function parseGuardLine(
+  line: string,
+): { op: "+" | "-"; pid: number } | null {
+  const m = /^([+-])(\d+)$/.exec(line.trim());
+  if (!m) return null;
+  const pid = Number(m[2]);
+  return Number.isSafeInteger(pid) && pid > 0
+    ? { op: m[1] as "+" | "-", pid }
+    : null;
+}
+
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM: the pid exists but is not ours to signal — still alive.
+    return (err as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+function signalPid(pid: number, signal: NodeJS.Signals): void {
+  try {
+    process.kill(pid, signal);
+  } catch {
+    /* already gone */
+  }
+}
+
+/**
+ * SIGTERM every pid, wait up to `graceMs` for them to exit, then SIGKILL
+ * whatever is left. Resolves once the SIGKILLs are sent.
+ */
+export async function killPids(
+  pids: readonly number[],
+  graceMs: number = REAPER_KILL_GRACE_MS,
+): Promise<void> {
+  for (const pid of pids) signalPid(pid, "SIGTERM");
+  const deadline = Date.now() + graceMs;
+  let alive = pids.filter(pidAlive);
+  while (alive.length > 0 && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    alive = alive.filter(pidAlive);
+  }
+  for (const pid of alive) signalPid(pid, "SIGKILL");
+}
+
+/**
+ * Reaper main. Never resolves: the process exits once it has reaped, which
+ * happens on stdin EOF/close, a termination signal, or a bridge-watchdog
+ * trip (only when TALON_BRIDGE_URL is set).
+ */
+export function runReaper(): Promise<never> {
+  const pids = new Set<number>();
+  let reaping = false;
+  let buf = "";
+
+  const reap = (): void => {
+    if (reaping) return;
+    reaping = true;
+    void killPids([...pids]).finally(() => process.exit(0));
+  };
+
+  // The daemon's end of stdin/stderr may vanish at any moment (that is
+  // the point); an EPIPE must not take the reaper down before it reaps.
+  process.stdin.on("error", () => {});
+  process.stderr.on("error", () => {});
+  process.stdin.setEncoding("utf-8");
+  process.stdin.on("data", (chunk: string) => {
+    buf += chunk;
+    let nl;
+    while ((nl = buf.indexOf("\n")) !== -1) {
+      const parsed = parseGuardLine(buf.slice(0, nl));
+      buf = buf.slice(nl + 1);
+      if (!parsed) continue;
+      if (parsed.op === "+") pids.add(parsed.pid);
+      else pids.delete(parsed.pid);
+    }
+  });
+  process.stdin.on("end", reap);
+  process.stdin.on("close", reap);
+
+  const signals: NodeJS.Signals[] =
+    process.platform === "win32"
+      ? ["SIGTERM", "SIGINT"]
+      : ["SIGTERM", "SIGINT", "SIGHUP"];
+  for (const sig of signals) process.on(sig, reap);
+
+  const bridgeUrl = process.env.TALON_BRIDGE_URL;
+  if (bridgeUrl) {
+    startBridgeWatchdog(
+      bridgeUrl,
+      () => reaping,
+      (outcome, downForSec) => {
+        process.stderr.write(
+          `mcp-reaper: bridge ${bridgeUrl} ${outcome} for ${downForSec}s; reaping ${pids.size} MCP child(ren)\n`,
+        );
+        reap();
+      },
+    );
+  }
+
+  return new Promise<never>(() => {});
+}

package/src/core/mesh/credentials/index.ts

@@ -3,7 +3,7 @@
  * the token format, the scope vocabulary, and the operator surface.
  */
 
-export { DeviceCredentialStore } from "./store.js";
+export { DeviceCredentialStore, UNBOUND_TTL_MS } from "./store.js";
 export { credentialIdOf, isDeviceCredentialToken } from "./token.js";
 export {
   DEFAULT_COMPANION_SCOPES,

package/src/core/mesh/credentials/store.ts

@@ -43,7 +43,7 @@ import {
 const DEFAULT_FILE = resolve(dirs.root, "mesh-credentials.json");
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** A pairing link or installer that is never used stops being a credential. */
-const UNBOUND_TTL_MS = 7 * DAY_MS;
+export const UNBOUND_TTL_MS = 7 * DAY_MS;
 /** How long a device has to pick up a requested rotation before it expires. */
 const ROTATION_GRACE_MS = 7 * DAY_MS;
 /** Revoked rows are kept this long for `talon mesh` / audit, then pruned. */

package/src/core/mesh/devices/service.ts

@@ -863,6 +863,14 @@ export class MeshService {
     return this.links.makeCompanionPairLink(label, bridgeUrl);
   }
 
+  /** `make_companion_pair_link`: the pairing link as a tool result. */
+  makeCompanionPairLinkText(
+    label?: unknown,
+    bridgeUrl?: unknown,
+  ): MeshToolResult {
+    return this.links.makeCompanionPairLinkText(label, bridgeUrl);
+  }
+
   /** GET /pair — serve a pairing grant (single-use). */
   openCompanionPair(
     token: string,

package/src/core/mesh/links/bridge-links.ts

@@ -12,6 +12,7 @@
 import { networkInterfaces } from "node:os";
 import {
   CompanionPairStore,
+  PAIR_GRANT_TTL_MS,
   pairLink,
   pairPage,
   type CompanionPairPayload,
@@ -32,7 +33,9 @@ import {
 } from "./node-provision.js";
 import {
   DEFAULT_COMPANION_SCOPES,
+  isDeviceCredentialToken,
   NODE_SCOPES,
+  UNBOUND_TTL_MS,
   type CredentialOrigin,
   type MeshScope,
 } from "../credentials/index.js";
@@ -281,6 +284,40 @@ export class BridgeLinks {
     };
   }
 
+  /**
+   * `make_companion_pair_link`: {@link makeCompanionPairLink} as a tool
+   * result — the one-tap link plus the values for typing in by hand, the
+   * same things the Telegram `/mesh pair` reply shows.
+   */
+  makeCompanionPairLinkText(
+    label?: unknown,
+    bridgeUrl?: unknown,
+  ): MeshToolResult {
+    const minted = this.makeCompanionPairLink(label, bridgeUrl);
+    if (!minted.ok) return minted;
+    const minutes = Math.round(PAIR_GRANT_TTL_MS / 60_000);
+    const perDevice = isDeviceCredentialToken(minted.token);
+    return {
+      ok: true,
+      text: [
+        "Open this link on the phone or computer running the Talon companion:",
+        "",
+        `  ${minted.link}`,
+        "",
+        `Single-use, expires in ${minutes} minutes. If the link doesn't open the app, enter these by hand:`,
+        `  Bridge URL: ${minted.url}`,
+        `  Token: ${minted.token}`,
+        ...(minted.fingerprint
+          ? [`  Certificate SHA-256: ${minted.fingerprint}`]
+          : []),
+        "",
+        perDevice
+          ? `The token is this device's own credential: it binds to the first device that registers with it and lapses after ${Math.round(UNBOUND_TTL_MS / 86_400_000)} days unused. It can't take over a device that already holds a live credential — revoke that one first (talon mesh revoke <device>).`
+          : "The token is the bridge's shared token (this mesh has no per-device credential store).",
+      ].join("\n"),
+    };
+  }
+
   /**
    * GET /pair — serve a pairing grant (single-use), as the landing page or
    * as the JSON the companion reads.

package/src/core/mesh/links/companion-pairing.ts

@@ -32,7 +32,7 @@
 import { randomBytes } from "node:crypto";
 
 /** Unclaimed grants die after this long. A pairing link is used at once. */
-const GRANT_TTL_MS = 10 * 60 * 1000;
+export const PAIR_GRANT_TTL_MS = 10 * 60 * 1000;
 
 export type CompanionPairGrant = {
   token: string;
@@ -59,7 +59,7 @@ export type CompanionPairPayload = {
 export class CompanionPairStore {
   private readonly grants = new Map<string, CompanionPairGrant>();
 
-  constructor(private readonly ttlMs = GRANT_TTL_MS) {}
+  constructor(private readonly ttlMs = PAIR_GRANT_TTL_MS) {}
 
   create(
     grant: Omit<CompanionPairGrant, "token" | "createdAt" | "used">,

package/src/core/plugin/mcp.ts

@@ -1,12 +1,12 @@
 /**
  * MCP server specs — the stdio command for every plugin that exposes an MCP
  * server (via `mcpServer` command/args or `mcpServerPath`), plus the
- * standalone MCP entries from config. The hub spawns its children from these.
+ * standalone MCP entries from config. The hub spawns its children from these
+ * raw specs and applies orphan protection itself (mcp-hub/child-guard.ts).
  */
 
 import { resolve } from "node:path";
 import { logWarn } from "../../util/log.js";
-import { wrapMcpServer } from "../mcp-hub/launcher.js";
 import { isBunRuntime } from "../../util/runtime.js";
 import { registry, reloadState } from "./registry.js";
 import type { McpServerConfig } from "./types.js";
@@ -71,14 +71,14 @@ export function getPluginMcpServers(
 
     if (plugin.mcpServer) {
       // Custom command/args (Python, Go, etc.) — no tsx wrapper
-      servers[`${plugin.name}-tools`] = wrapMcpServer({
+      servers[`${plugin.name}-tools`] = {
         command: plugin.mcpServer.command,
         args: [...plugin.mcpServer.args],
         env: baseEnv,
-      });
+      };
     } else if (plugin.mcpServerPath) {
       // TS server entry: bun runs it directly; node needs the tsx loader.
-      servers[`${plugin.name}-tools`] = wrapMcpServer({
+      servers[`${plugin.name}-tools`] = {
         command: isBunRuntime()
           ? process.execPath
           : process.platform === "win32"
@@ -90,17 +90,17 @@ export function getPluginMcpServers(
             ? ["tsx", plugin.mcpServerPath]
             : ["--import", tsxPath, plugin.mcpServerPath],
         env: baseEnv,
-      });
+      };
     }
   }
 
   for (const entry of registry.mcpEntries) {
     if (only !== undefined && !only.includes(entry.name)) continue;
-    servers[`${entry.name}-tools`] = wrapMcpServer({
+    servers[`${entry.name}-tools`] = {
       command: entry.command,
       args: [...(entry.args ?? [])],
       env: buildBridgeEnv(bridgeUrl, chatId, entry.env),
-    });
+    };
   }
 
   return servers;

package/src/core/tools/bridge.ts

@@ -28,6 +28,8 @@ const LONG_ACTION_TIMEOUTS_MS: Record<string, number> = {
   // must sit above it so the layer that gives up is the tool (which reports
   // the agent's live state), never the transport.
   wait_for_agent: 180_000,
+  // The pre-flight lane caps itself at 600s; same margin rule as above.
+  run_preflight: 660_000,
   device_pull_file: 3_600_000,
   device_push_file: 3_600_000,
   device_read_file: 3_600_000,
@@ -36,6 +38,9 @@ const LONG_ACTION_TIMEOUTS_MS: Record<string, number> = {
   native_write: 3_600_000,
   native_edit: 3_600_000,
   device_exec: 330_000,
+  // The fetch ladder may climb several rungs (and install curl-impersonate
+  // on first use) inside its own 150s budget.
+  fetch_url: 180_000,
   native_bash: 330_000,
   native_glob: 330_000,
   native_search: 330_000,

package/src/core/tools/content/web.ts

@@ -14,7 +14,7 @@ export const webTools: ToolDefinition[] = [
   {
     name: "fetch_url",
     description:
-      "Fetch a URL — web pages return text content, image URLs are downloaded to workspace. Use to read articles, download images, or fetch any URL.",
+      "Fetch a URL — web pages return text content, image URLs are downloaded to workspace. Use to read articles, download images, or fetch any URL. Bot walls are retried automatically (browser-TLS impersonation, then any configured exits/browser); the result footer names the route that worked. A 404 means the URL is wrong, not that you were blocked.",
     schema: {
       url: z.string().describe("The URL to fetch"),
     },