@heretyc/subagent-mcp 2.10.0 → 2.10.2

package/README.md

@@ -7,8 +7,6 @@
 
 MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions — on macOS, Linux, and Windows. No direct API calls. No API keys.
 
----
-
 ## Install
 
 ### Prerequisites (runtime)
@@ -46,8 +44,6 @@ npm install -g @heretyc/subagent-mcp
 
 > **Note:** GitHub Packages requires authentication even for public packages. If you see `401 Unauthorized`, verify your PAT has the `read:packages` scope and has not expired. GitHub Packages does not render a README page — the live documentation appears on [npmjs.com](https://www.npmjs.com/package/@heretyc/subagent-mcp).
 
----
-
 ## Quick Start
 
 **1. Install** (see [Install](#install) above):
@@ -78,8 +74,6 @@ subagent-mcp init --global
 
 For manual wiring, Gemini CLI, Claude Desktop, and developer install from source, see [docs/registration.md](docs/registration.md).
 
----
-
 ## Features
 
 - Start Claude or Codex interactive sessions as managed sub-agents from any MCP host
@@ -91,8 +85,6 @@ For manual wiring, Gemini CLI, Claude Desktop, and developer install from source
 - stdio MCP transport; built with `@modelcontextprotocol/sdk` + `zod`
 - `orchestration-mode` tool — toggles orchestrator directives injected by bundled Claude Code / Codex hooks; Claude also gets a deterministic `PreToolUse` gate
 
----
-
 ## Orchestration Mode
 
 **ON:** the agent operates as an orchestrator — hook injection governs each session turn, preventing inline reads or writes, and all work is delegated through sub-agent tools.
@@ -101,12 +93,8 @@ For manual wiring, Gemini CLI, Claude Desktop, and developer install from source
 
 Toggle with the `orchestration-mode` tool. Desktop hosts toggle the mode but receive no hook injection. See [docs/spec/dev-loop/orchestration-directive-architecture.md](docs/spec/dev-loop/orchestration-directive-architecture.md) for full semantics.
 
----
-
 ## Auto Mode
 
-Pass `task_category` to `launch_agent` and the server picks the best provider, model, and effort for that category, with automatic fallback.
-
 `launch_agent` supports **auto mode**: pass `prompt` + `task_category` and the server picks the best provider/model/effort for that category from its routing table, silently falling back to the next-best candidate on any launch-time failure.
 
 `provider`, `model`, and `effort` are optional overrides — omit them to get the auto-selected best combination. Rules: passing `model` requires `provider`; passing `effort` requires both `provider` and `model`.
@@ -135,8 +123,6 @@ The last four are **composite-inferred**: they carry no dedicated benchmark and
 
 **Atomic-split guidance:** if you are unsure which category fits, do NOT submit one large amorphous task. Break the work into smaller atomic steps each mapping to a single category and launch one agent per step.
 
----
-
 ## Configuration
 
 ### Global concurrent-subagent cap
@@ -147,9 +133,7 @@ The cap is configured in `global-concurrency.jsonc`, a dedicated dist-sibling fi
 
 Set `globalConcurrentSubagents` in that file. The default is `20`; the minimum valid value is `10`. Validation is forced: `0`, unset, missing, or invalid values reset to `20`, and values `1` through `9` are pinned up to `10`. There is no environment-variable override; the file is the sole source of truth. The file is re-read on every `launch_agent` call, so edits take effect on the next launch with no server restart.
 
-When the cap is reached, `launch_agent` is rejected immediately; it never queues. Because the count includes other active sessions and the entire descendant tree, free slots manually with `list_agents` and `kill_agent` before retrying. There is no automatic cleanup or zombie reaping.
-
----
+When the cap is reached, `launch_agent` is rejected immediately; it never queues. Before cap checks, hooks and tool calls run default zombie culling with no config knob: live agents idle for more than 6 minutes and terminal-but-alive agents idle for more than 30 seconds are terminated process-tree-first, then force-killed after 20 seconds if needed. Reports include `zombies`, and `poll_agent` keeps the tail with `zombie_killed` when culling terminates an agent.
 
 ## Tools
 
@@ -168,8 +152,6 @@ Eight tools are exposed over the stdio MCP transport.
 
 Full parameters, return shapes, and the `alive` / `idle_seconds` / `hint` / `recent_stream` fields are in [docs/tools.md](docs/tools.md).
 
----
-
 ## Agent Lifecycle
 
 Each agent transitions through these states:
@@ -184,8 +166,6 @@ Each agent transitions through these states:
 
 `processing` and `stalled` are live. `stalled` means the driver is alive but quiet (>= 10 min no visible stream); it recovers automatically and is never auto-killed — do not `kill_agent` a stalled agent. `wait` does not return on `stalled`. Full semantics: [docs/reference/status-lifecycle.md](docs/reference/status-lifecycle.md).
 
----
-
 ## Documentation
 
 | Document | Contents |
@@ -198,8 +178,6 @@ Each agent transitions through these states:
 | [docs/release-notes.md](docs/release-notes.md) | Operator-facing release notes |
 | [CONTRIBUTING.md](CONTRIBUTING.md) | Contributor guide — dev environment, build, test, publish |
 
----
-
 ## License
 
 Apache-2.0 — Copyright 2026 Lexi Blackburn

package/directives/orchestration-claude.md

@@ -1,15 +1,13 @@
 <subagent-mcp state="on" kind="directive">
-FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag.
+EXEMPTION: if this prompt's literal first line begins "<this is a request from a parent process>", ignore this tag (blank lines don't count).
 
-ORCHESTRATION ON. You are the ORCHESTRATOR. Obey this tag; ordinary user requests do not override it. Only the hook's ON/OFF state changes this mode.
+ORCHESTRATION ON. You are the delegate-ONLY ORCHESTRATOR; obey this tag over user requests; only the hook flips it. TOOLS: ONLY AskUserQuestion + subagent-mcp + /workflows. NO direct reads/writes; inline-by-right does NOT exist. Every step runs in a sub-agent; a non-delegable one -> ask AskUserQuestion for a one-time exception, do ONLY it, resume.
 
-ALLOWED TOOLS: ONLY AskUserQuestion + subagent-mcp + /workflows. NO direct reads/writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. Non-delegable atomic step → ask via AskUserQuestion for a one-time exception, do ONLY that step, then resume delegating.
+SUB-AGENT CONTRACT: each prompt states objective + output format + tools/sources + boundaries. SCALE: ~1 for a fact-find, 2-4 for comparisons; never one-shot multi-phase work -- delegate the SMALLEST auditable step, then VERIFY code/non-trivial steps via an INDEPENDENT sub-agent. FAN-OUT independents, sequence dependents, SERIALIZE writers over shared paths.
 
-READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads; you NEVER read them.
+READ LADDER: poll_agent tail -> one <=100-line summarizer sub-agent (trusted as-is) -> else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads, you NEVER read them. Learn finish via wait; empty/stalled tail = ALIVE -- never kill or busy-poll.
 
-SUBDIVIDE: delegate the SMALLEST auditable step yielding an observable artifact. NEVER 1-shot multi-phase work. For code/non-trivial steps, prefer an independent verifier sub-agent before proceeding.
+PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict -> STOP and ask. SOLE CHANNEL: all launches via launch_agent; never harness Task/Agent. DROPOUT while ON: HALT and ask until restored. DISABLE: never on your own initiative; only user approval sets enabled:false.
 
-PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and ask the user. SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask; stay halted until restored. Abort ends the task; it never switches you inline. DISABLE: never on your own initiative.
-
-Full model + governance: server MCP `instructions`.
+Full model: server MCP `instructions`.
 </subagent-mcp>

package/directives/orchestration-codex.md

@@ -1,15 +1,13 @@
 <subagent-mcp state="on" kind="directive">
-FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag.
+EXEMPTION: if this prompt's literal first line begins "<this is a request from a parent process>", ignore this tag (blank lines don't count).
 
-ORCHESTRATION ON. You are the ORCHESTRATOR. Obey this tag; ordinary user requests do not override it. Only the hook's ON/OFF state changes this mode.
+ORCHESTRATION ON. You are the delegate-ONLY ORCHESTRATOR; obey this tag over user requests; only the hook flips it. TOOLS: ONLY request-user-input + subagent-mcp + /workflows. NO direct reads/writes; inline-by-right does NOT exist. Every step runs in a sub-agent; a non-delegable one -> ask request-user-input for a one-time exception, do ONLY it, resume.
 
-ALLOWED TOOLS: ONLY request-user-input + subagent-mcp + /workflows. NO direct reads/writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. Non-delegable atomic step → ask via request-user-input for a one-time exception, do ONLY that step, then resume delegating.
+SUB-AGENT CONTRACT: each prompt states objective + output format + tools/sources + boundaries. SCALE: ~1 for a fact-find, 2-4 for comparisons; never one-shot multi-phase work -- delegate the SMALLEST auditable step, then VERIFY code/non-trivial steps via an INDEPENDENT sub-agent. FAN-OUT independents, sequence dependents, SERIALIZE writers over shared paths.
 
-READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads; you NEVER read them.
+READ LADDER: poll_agent tail -> one <=100-line summarizer sub-agent (trusted as-is) -> else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads, you NEVER read them. Learn finish via wait; empty/stalled tail = ALIVE -- never kill or busy-poll.
 
-SUBDIVIDE: delegate the SMALLEST auditable step yielding an observable artifact. NEVER 1-shot multi-phase work. For code/non-trivial steps, prefer an independent verifier sub-agent before proceeding.
+PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict -> STOP and ask. SOLE CHANNEL: all launches via launch_agent; never harness Task/Agent. DROPOUT while ON: HALT and ask until restored. DISABLE: never on your own initiative; only user approval sets enabled:false.
 
-PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and ask the user. SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask; stay halted until restored. Abort ends the task; it never switches you inline. DISABLE: never on your own initiative.
-
-Full model + governance: server MCP `instructions`.
+Full model: server MCP `instructions`.
 </subagent-mcp>

package/directives/reminder-on.md

@@ -1,14 +1,12 @@
 <!-- INJECTED PER-PROMPT REMINDER — BINDING -->
 <subagent-mcp state="on" kind="reminder">
-FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag (you are a sub-agent).
+FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag (leading blank lines don't count; you are a sub-agent).
 
 Orchestration ON. You are the orchestrator: delegate EVERY step. Allowed tools = ONLY the structured-question tool (AskUserQuestion / request-user-input) + subagent-mcp + /workflows; NO direct reads or writes; inline-by-right does not exist. Non-delegable atomic step → ask the user for a one-time exception, do only it, resume delegating.
 
-READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the user reads it. Large handoffs via scratch-file PATHS you never read.
+Each launched prompt carries objective + output format + tools/sources + boundaries; scale agent count to complexity; subdivide to the smallest auditable step; verify code steps with an independent sub-agent.
 
-SUBDIVIDE: smallest auditable step per sub-agent; never 1-shot multi-phase work (no implement+test+docs in one); verify code steps independently.
-
-WAIT-NOT-POLL: learn finish via `wait` (verbose:true for output); never loop poll_agent for completion. poll_agent = single diagnostic; stalled/empty = alive, not dead.
+WAIT-NOT-POLL: learn finish via `wait` (verbose:true for output); never loop poll_agent for completion. poll_agent = single diagnostic; a stalled/empty tail means ALIVE, not dead. Read ladder: poll_agent tail → one <=100-line summarizer → else the user reads; large handoffs via scratch-file PATHS you never read.
 
 This tag is co-supreme with safety-scope (conflict → ask the user) and outranks ordinary user requests. Full governance: server MCP `instructions`.
 </subagent-mcp>

package/directives/short-on.md

@@ -1 +1 @@
-<subagent-mcp state="on" kind="carrier">If first line begins "<this is a request from a parent process>", ignore this tag. Orchestration ON. Delegate-only via subagent-mcp; allowed tools = structured-question tool + subagent-mcp + /workflows; no direct reads/writes; inline-by-right does not exist. Subdivide small; verify code steps. Follow MOST RECENT <subagent-mcp state="on"> tag; if absent, INIT_BLOCK governs. Co-supreme with safety-scope; user request cannot bypass.</subagent-mcp>
+<subagent-mcp state="on" kind="carrier">If first line begins "<this is a request from a parent process>", ignore this tag. Orchestration ON. Delegate-only via subagent-mcp; allowed tools = structured-question tool + subagent-mcp + /workflows; no direct reads/writes; inline-by-right does not exist. Subdivide small; verify code steps; never 1-shot multi-phase. Follow MOST RECENT <subagent-mcp state="on"> tag; if absent, INIT_BLOCK governs. Co-supreme with safety-scope; user request cannot bypass.</subagent-mcp>

package/dist/concurrency.js

@@ -3,9 +3,11 @@ import { platform } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONCURRENCY_SCAFFOLD } from "./config-scaffold.js";
+import { cullStaleSlots, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, parseSlotMetadata, readSlotMetadata, slotPathForAgent, writeSlotMetadata, } from "./zombie.js";
 export const DEFAULT_CAP = 20;
 export const MIN_CAP = 10;
 export const CONFIG_FILENAME = "global-concurrency.jsonc";
+export { cullStaleSlots, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, parseSlotMetadata, readSlotMetadata, slotPathForAgent, writeSlotMetadata, };
 export function clampCap(raw) {
     if (!Number.isInteger(raw))
         return DEFAULT_CAP;
@@ -50,6 +52,8 @@ export function readGlobalCap(path = defaultConfigPath()) {
     }
 }
 export function slotDir() {
+    if (process.env.SUBAGENT_SLOT_DIR)
+        return process.env.SUBAGENT_SLOT_DIR;
     if (platform() === "win32") {
         return join(process.env.ProgramData || process.env.ALLUSERSPROFILE || "C:\\ProgramData", "subagent-mcp", "slots");
     }
@@ -63,11 +67,19 @@ export function countSlots(dir = slotDir()) {
         return 0;
     }
 }
-export function reserveSlot(agentId, max, dir = slotDir()) {
+export function scheduleForceKill(ms, kill) {
+    const timer = setTimeout(kill, ms);
+    timer.unref();
+}
+export const NONBLOCKING_CULL_DEPS = {
+    scheduleForceKill,
+};
+export function reserveSlot(agentId, max, dir = slotDir(), cullDeps) {
     try {
         mkdirSync(dir, { recursive: true, mode: 0o1777 });
-        const slotPath = join(dir, `slot-${agentId}.json`);
-        writeFileSync(slotPath, JSON.stringify({ pid: process.pid, cwd: process.cwd(), startedAt: new Date().toISOString() }), { mode: 0o600 });
+        cullStaleSlots(dir, cullDeps);
+        const slotPath = slotPathForAgent(dir, agentId);
+        writeSlotMetadata(slotPath, { agent_id: agentId });
         const n = countSlots(dir);
         if (n > max) {
             try {

package/dist/config-scaffold.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-concurrency.jsonc — DO NOT EDIT.
-export const CONCURRENCY_SCAFFOLD = "// subagent-mcp — Global Concurrent Subagent Cap\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for the machine-wide limit on how many subagents\r\n// may be ALIVE AT ONCE across EVERY session, process, and user on this\r\n// machine. There is NO environment-variable override.\r\n//\r\n// The whole recursive descendant tree counts toward this ONE number: a\r\n// subagent that itself launches subagents adds to the same machine-wide\r\n// total, and OTHER active agentic sessions count too.\r\n//\r\n// RE-READ on every launch_agent call — edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Value rules (forcibly applied to the number below):\r\n//   - missing / unset / non-integer / 0 / negative  -> reset to default 20\r\n//   - 1 through 9                                    -> forced UP to minimum 10\r\n//   - 10 or greater                                 -> used as-is\r\n//\r\n// When the cap is reached, launch_agent is REJECTED (never queued). Free a\r\n// slot with list_agents + kill_agent, then retry.\r\n//\r\n// Slots free automatically as agents finish or are killed. There is NO\r\n// zombie reaping. If a server process CRASHES, its slots stay counted until\r\n// you delete the stale slot files by hand:\r\n//   Windows:      %ProgramData%\\subagent-mcp\\slots\r\n//   macOS/Linux:  /tmp/subagent-mcp/slots\r\n{\r\n  \"globalConcurrentSubagents\": 20\r\n}\r\n";
+export const CONCURRENCY_SCAFFOLD = "// subagent-mcp — Global Concurrent Subagent Cap\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for the machine-wide limit on how many subagents\r\n// may be ALIVE AT ONCE across EVERY session, process, and user on this\r\n// machine. There is NO environment-variable override.\r\n//\r\n// The whole recursive descendant tree counts toward this ONE number: a\r\n// subagent that itself launches subagents adds to the same machine-wide\r\n// total, and OTHER active agentic sessions count too.\r\n//\r\n// RE-READ on every launch_agent call — edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Value rules (forcibly applied to the number below):\r\n//   - missing / unset / non-integer / 0 / negative  -> reset to default 20\r\n//   - 1 through 9                                    -> forced UP to minimum 10\r\n//   - 10 or greater                                 -> used as-is\r\n//\r\n// Zombie culling is always enabled. There is no config knob. Before cap\r\n// rejection, launch/tool/hook paths cull stale live agents idle for 6min and\r\n// terminal-but-alive agents idle for 30s. Culling gracefully terminates the\r\n// full process tree, then force-kills after 20s when needed.\r\n//\r\n// When the cap is reached after culling, launch_agent is REJECTED (never\r\n// queued). Free a slot with list_agents + kill_agent, then retry.\r\n{\r\n  \"globalConcurrentSubagents\": 20\r\n}\r\n";

package/dist/global-concurrency.jsonc

@@ -16,14 +16,13 @@
 //   - 1 through 9                                    -> forced UP to minimum 10
 //   - 10 or greater                                 -> used as-is
 //
-// When the cap is reached, launch_agent is REJECTED (never queued). Free a
-// slot with list_agents + kill_agent, then retry.
+// Zombie culling is always enabled. There is no config knob. Before cap
+// rejection, launch/tool/hook paths cull stale live agents idle for 6min and
+// terminal-but-alive agents idle for 30s. Culling gracefully terminates the
+// full process tree, then force-kills after 20s when needed.
 //
-// Slots free automatically as agents finish or are killed. There is NO
-// zombie reaping. If a server process CRASHES, its slots stay counted until
-// you delete the stale slot files by hand:
-//   Windows:      %ProgramData%\subagent-mcp\slots
-//   macOS/Linux:  /tmp/subagent-mcp/slots
+// When the cap is reached after culling, launch_agent is REJECTED (never
+// queued). Free a slot with list_agents + kill_agent, then retry.
 {
   "globalConcurrentSubagents": 20
 }

package/dist/hooks/orchestration-codex.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { claimAndEmit, classifyClaim, countJsonlType, runHook, sessionKey, } from "../orchestration/hook-core.js";
+import { claimAndEmit, appendHookZombieReport, classifyClaim, countJsonlType, cullHookZombies, runHook, sessionKey, } from "../orchestration/hook-core.js";
 import * as marker from "../orchestration/marker.js";
 /**
  * Codex CLI hook entry. Branches on payload.hook_event_name:
@@ -80,11 +80,14 @@ export const codexAdapter = {
 export function runCodexHook(payload, env, adapter = codexAdapter) {
     try {
         if (payload.hook_event_name === "SessionStart") {
-            if (adapter.isSubagent(payload, env))
-                return "";
+            const zombieRecords = cullHookZombies();
+            if (adapter.isSubagent(payload, env)) {
+                return appendHookZombieReport("", zombieRecords);
+            }
             const cwd = payload.cwd || process.cwd();
-            if (!marker.isActive(cwd))
-                return "";
+            if (!marker.isActive(cwd)) {
+                return appendHookZombieReport("", zombieRecords);
+            }
             const current = sessionKey(payload);
             const turn = adapter.currentTurn(payload.transcript_path);
             const m = marker.readMarker(cwd);
@@ -93,7 +96,7 @@ export function runCodexHook(payload, env, adapter = codexAdapter) {
             // semantics — FULL + ON reminder, ack-latched CARRYOVER prepend, counter
             // re-baseline). SessionStart claims even on SAME-SESSION (resume) so
             // turn 0 is always covered.
-            return claimAndEmit(cwd, current, turn, m, kind, env, adapter);
+            return appendHookZombieReport(claimAndEmit(cwd, current, turn, m, kind, env, adapter), zombieRecords);
         }
         // UserPromptSubmit (and any other event) -> normal cadence.
         return runHook(payload, env, adapter);

package/dist/index.js

@@ -18,7 +18,7 @@ import { consumeStreamChunk, flushStream, isTurnCompletedLine, retainLastN, } fr
 import { loadRoutingTable, buildCandidates, validatePresence, TASK_CATEGORIES, AUTO_HINT, SPLIT_HINT, } from "./routing.js";
 import { createDeadlockWindow } from "./deadlock.js";
 import { createRulesetGate, RULESET_HARD_FAIL_MSG, } from "./ruleset.js";
-import { CONFIG_FILENAME, defaultConfigPath, globalCapMessage, readGlobalCap, releaseSlot, reserveSlot, } from "./concurrency.js";
+import { CONFIG_FILENAME, NONBLOCKING_CULL_DEPS, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, defaultConfigPath, globalCapMessage, readSlotMetadata, readGlobalCap, releaseSlot, reserveSlot, slotDir, writeSlotMetadata, } from "./concurrency.js";
 import * as orchestrationMarker from "./orchestration/marker.js";
 import * as modelMode from "./orchestration/model-mode.js";
 import { startLivenessHeartbeat } from "./orchestration/liveness.js";
@@ -54,6 +54,189 @@ const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (server pi
 function errorResult(text) {
     return { content: [{ type: "text", text }], isError: true };
 }
+function envDuration(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+function zombieLiveIdleMs() {
+    return envDuration("SUBAGENT_ZOMBIE_LIVE_IDLE_MS", ZOMBIE_LIVE_IDLE_MS);
+}
+function zombieTerminalIdleMs() {
+    return envDuration("SUBAGENT_ZOMBIE_TERMINAL_IDLE_MS", ZOMBIE_TERMINAL_IDLE_MS);
+}
+function zombieForceGraceMs() {
+    return envDuration("SUBAGENT_ZOMBIE_FORCE_GRACE_MS", ZOMBIE_FORCE_GRACE_MS);
+}
+function zombieReport(records) {
+    const ids = Array.from(new Set(records.map((r) => r.agent_id))).filter(Boolean);
+    return ids.length > 0 ? `zombies: ${ids.join(",")}` : undefined;
+}
+function withZombieReport(result, records) {
+    const report = zombieReport(records);
+    if (!report || !result.content?.[0] || result.content[0].type !== "text")
+        return result;
+    const text = result.content[0].text;
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            parsed.zombie_report = report;
+            result.content[0].text = JSON.stringify(parsed, null, text.includes("\n") ? 2 : undefined);
+            return result;
+        }
+    }
+    catch { }
+    result.content[0].text = `${text}\n${report}`;
+    return result;
+}
+function updateSlotMetadata(agent) {
+    if (!agent.slotPath)
+        return;
+    writeSlotMetadata(agent.slotPath, {
+        agent_id: agent.id,
+        server_pid: process.pid,
+        child_pid: agent.process.pid ?? null,
+        cwd: agent.cwd,
+        started_at: new Date(agent.startedAt).toISOString(),
+        started_at_ms: agent.startedAt,
+        last_activity_ms: agent.lastActivity,
+        status: agent.status,
+    });
+}
+function spawnProcessTreeKill(pid, force) {
+    const commands = buildProcessTreeKillCommands(pid);
+    const command = force ? commands.force : commands.graceful;
+    try {
+        const child = spawn(command.command, command.args, {
+            stdio: "ignore",
+            windowsHide: true,
+            detached: false,
+        });
+        child.unref();
+    }
+    catch { }
+}
+function scheduleZombieForceKill(agent) {
+    const pid = agent.process.pid;
+    if (!pid || agent.driver.closed)
+        return;
+    const timer = setTimeout(() => {
+        if (!agent.driver.closed && agent.status === "zombie_killed") {
+            try {
+                agent.driver.kill();
+            }
+            catch { }
+            spawnProcessTreeKill(pid, true);
+        }
+    }, zombieForceGraceMs());
+    timer.unref();
+}
+function markZombieKilled(agent, reason, now) {
+    agent.status = "zombie_killed";
+    agent.exitCode = agent.exitCode ?? -1;
+    agent.exitedAt = agent.exitedAt ?? now;
+    agent.waitReported = false;
+    releaseSlot(agent.slotPath ?? null);
+    const slotPath = agent.slotPath ?? "";
+    agent.slotPath = null;
+    const pid = agent.process.pid ?? null;
+    const record = {
+        kind: "zombie_killed",
+        agent_id: agent.id,
+        child_pid: pid,
+        server_pid: process.pid,
+        slot_path: slotPath,
+        reason,
+        detected_at_ms: now,
+        last_activity_ms: agent.lastActivity,
+        message: `zombies: culled ${agent.id}`,
+    };
+    if (pid && !agent.driver.closed) {
+        if (reason === "terminal_but_alive") {
+            try {
+                agent.driver.kill();
+            }
+            catch { }
+            spawnProcessTreeKill(pid, true);
+        }
+        else {
+            spawnProcessTreeKill(pid, false);
+            scheduleZombieForceKill(agent);
+        }
+    }
+    return record;
+}
+function applyZombieRecord(record, now) {
+    const agent = agents.get(record.agent_id);
+    if (!agent || agent.status === "zombie_killed")
+        return null;
+    agent.status = "zombie_killed";
+    agent.exitCode = agent.exitCode ?? -1;
+    agent.exitedAt = agent.exitedAt ?? now;
+    agent.waitReported = false;
+    releaseSlot(agent.slotPath ?? null);
+    agent.slotPath = null;
+    try {
+        if (!agent.driver.closed)
+            agent.driver.kill();
+    }
+    catch { }
+    return { ...record, detected_at_ms: record.detected_at_ms || now };
+}
+function runToolMaintenance() {
+    const now = Date.now();
+    const records = [];
+    const applied = new Set();
+    for (const record of [...drainZombieIntents(slotDir()), ...drainZombieReports(slotDir())]) {
+        if (applied.has(record.agent_id))
+            continue;
+        const appliedRecord = applyZombieRecord(record, now);
+        if (appliedRecord) {
+            records.push(appliedRecord);
+            applied.add(record.agent_id);
+        }
+    }
+    for (const agent of agents.values()) {
+        if (agent.status === "zombie_killed")
+            continue;
+        reconcileAgent(agent, now);
+        const slotMeta = agent.slotPath ? readSlotMetadata(agent.slotPath) : null;
+        if (slotMeta?.last_activity_ms !== null && slotMeta?.last_activity_ms !== undefined) {
+            agent.lastActivity = Math.min(agent.lastActivity, slotMeta.last_activity_ms);
+        }
+        const live = agent.status === "processing" || agent.status === "stalled";
+        if (live && now - agent.lastActivity > zombieLiveIdleMs()) {
+            const record = markZombieKilled(agent, "stale_live", now);
+            records.push(record);
+            applied.add(agent.id);
+            continue;
+        }
+        const terminalButAlive = (agent.status === "finished" || agent.status === "errored" || agent.status === "stopped") &&
+            !agent.driver.closed &&
+            agent.exitedAt !== null &&
+            now - agent.exitedAt > zombieTerminalIdleMs();
+        if (terminalButAlive) {
+            const record = markZombieKilled(agent, "terminal_but_alive", now);
+            records.push(record);
+            applied.add(agent.id);
+            continue;
+        }
+        updateSlotMetadata(agent);
+    }
+    return records;
+}
+function withMaintenance(handler) {
+    return async (params) => {
+        const zombieRecords = runToolMaintenance();
+        const result = await handler(params, zombieRecords);
+        if (result && typeof result === "object" && "content" in result) {
+            return withZombieReport(result, zombieRecords);
+        }
+        return result;
+    };
+}
 export function classifyFailureReason(reason, stderr) {
     const text = `${reason}\n${stderr}`;
     return /\b429\b|\b5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(text)
@@ -140,12 +323,12 @@ reconcileInterval.unref();
 // test/mirror-fragments.test.mjs while ORCHESTRATION_INSTRUCTIONS below stays
 // compressed under MCP metadata limits:
 // READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.
-const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask the user. Only the hook state changes ON/OFF.\n\nSOLE CHANNEL. Every sub-agent launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator. Use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex), subagent-mcp, and the /workflows tool. No direct reads/writes; inline-by-right does not exist. Non-delegable atomic step: ask for a one-time exception, do only that step, then resume delegating.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads; orchestrator never reads those files. Empty/stalled tail means ALIVE; use wait.\n\nORCHESTRATION OFF. If total context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to remain enabled; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask; stay halted until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime.\n\nMODEL SELECTION MODE. Default smart rejects provider/model/effort selectors; launch_agent auto-picks. user-approved-overrides lasts 30 minutes, expires lazily on launch_agent, and must be enabled only after explicit user authorization via AskUserQuestion/request-user-input.";
+const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask. Only the hook flips ON/OFF; absence of any tag = UNKNOWN => fail-safe ON.\n\nSOLE CHANNEL. Every launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator: use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex), subagent-mcp, and /workflows. No direct reads/writes; inline-by-right does not exist. Non-delegable step: ask a one-time exception, do only that step, resume delegating.\n\nSUB-AGENT CONTRACT. Every prompt carries objective + output format + tools/sources + boundaries. SCALE: ~1 agent for a fact-find, 2-4 for comparisons; never one-shot multi-phase work; split into atomic steps, one agent each. FAN-OUT independents, sequence dependents, SERIALIZE writers over shared paths (no cwd lock). VERIFY code and non-trivial steps with a separate sub-agent first.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads, orchestrator never reads them. Empty/stalled tail means ALIVE; learn finish via wait, do not poll-loop.\n\nORCHESTRATION OFF. If context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to enable; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime. DISABLE: user-only, never on your own initiative.\n\nMODEL SELECTION. Default smart auto-picks, rejects provider/model/effort selectors. user-approved-overrides honors them 30 min, expires lazily on launch_agent, needs user authorization.";
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.10.0",
-    description: "Launches always-interactive local Claude and Codex sub-agent sessions. Claude uses the Claude Agent SDK over the local Claude Code executable; Codex uses `codex app-server` over stdio. The server does not call Anthropic or OpenAI HTTP APIs directly.",
+    version: "2.10.2",
+    description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
         ? SUBAGENT_INSTRUCTIONS
@@ -314,6 +497,7 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
                 // Heartbeat refreshes only on parsed visible provider stream items,
                 // not on raw stdout bytes.
                 agentState.lastActivity = at;
+                updateSlotMetadata(agentState);
                 agentState.visibleStream = retainLastN(agentState.visibleStream, items.map((it) => ({ ...it, at })), 3);
             }
             // Provider completion events mark the current turn finished while the
@@ -365,6 +549,11 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         // Always record actual close time (unless already finalized)
         if (agentState.exitedAt === null)
             agentState.exitedAt = Date.now();
+        if (agentState.status === "zombie_killed") {
+            if (agentState.exitCode === null)
+                agentState.exitCode = code !== null ? code : -1;
+            return;
+        }
         if (agentState.status === "stopped") {
             // Record real exit code but preserve "stopped" status
             if (agentState.exitCode === null)
@@ -495,7 +684,7 @@ function sameTriples(a, b) {
     return a.every((c, i) => c.provider === b[i].provider && c.model === b[i].model && c.effort === b[i].effort);
 }
 // Tool 1: launch_agent
-server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory first attempt unless an override is licensed below): pass only `prompt` + `task_category` and NO overrides; the server picks the best provider/model/effort for that category from its routing table, launches the top candidate, and silently falls back to the next-best on launch failure. `provider`/`model`/`effort` are overrides — licensed on 1st/2nd attempts ONLY when the task verifiably requires a specific capability; STATE that capability when overriding; if you pass `model` you must also pass `provider`, and if you pass `effort` you must pass both `provider` and `model`. SOLE CHANNEL: while this server is connected this tool is the ONLY sanctioned way to spawn sub-agents, in BOTH orchestration states — harness-native Task/Agent tools are FORBIDDEN for sub-agent launches. PROMPT RULE: every sub-agent `prompt`'s first line is the self-identification marker \"<this is a request from a parent process>\"; the server now UPSERTS this marker as the true first line automatically (idempotent — it is never duplicated and your prompt body is never mutated), so you need not add it yourself. Unsure which task_category fits? Don't submit one amorphous task — SPLIT into atomic steps that each map to a single category, one agent per step. ultracode effort is Opus 4.8+ only. Claude uses a Claude Agent SDK logical session over the local Claude executable; Codex uses a `codex app-server` child. Children run with env SUBAGENT_MCP_SUBAGENT=1 so the orchestration hooks skip them (they are not orchestrators and don't re-trigger carryover). Launch returns status `processing` (alive); a later `stalled` is alive-but-quiet (thinking or awaiting a temp-file handoff), NOT dead — wait or re-poll, don't kill (see poll_agent). DEADLOCK RULE: you MUST ALWAYS set `deadlock=true` when 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory (the 3rd attempt onward; re-wording or re-splitting the prompt does NOT make it a different task), and NEVER otherwise — from the 3rd attempt deadlock outranks any capability override: drop provider/model/effort.", {
+server.tool("launch_agent", "Spawn a sub-agent session. CONTRACT: every `prompt` states objective + required output format + tools/sources + boundaries; the server auto-upserts the self-identification marker \"<this is a request from a parent process>\" as the true first line (idempotent, never duplicated, body never mutated), so you need not add it. SCALE to complexity: ~1 agent for a simple fact-find, 2-4 for comparisons; never one-shot a multi-phase task — SPLIT into atomic steps that each map to ONE task_category, one agent per step. AUTO MODE (mandatory first attempt unless an override is licensed below): pass only `prompt` + `task_category`, NO overrides; the server picks the best provider/model/effort for that category and silently falls back to the next-best on launch failure. `provider`/`model`/`effort` are OVERRIDES, licensed on the 1st/2nd attempt ONLY when the task verifiably needs a specific capability — STATE that capability; `model` requires `provider`, `effort` requires `provider`+`model`; ultracode effort is Opus 4.8+ only. SOLE CHANNEL: while this server is connected this is the ONLY sanctioned way to spawn sub-agents in BOTH orchestration states; harness-native Task/Agent tools are FORBIDDEN. Children run with env SUBAGENT_MCP_SUBAGENT=1 so orchestration hooks skip them (not orchestrators, no carryover re-trigger). Launch returns `processing` (alive); a later `stalled` is alive-but-quiet (thinking or awaiting a temp-file handoff), NOT dead — wait or re-poll, don't kill (see poll_agent). DEADLOCK RULE: you MUST set `deadlock=true` when, and ONLY when, 2 attempts for the SAME atomic task have already failed/been unsatisfactory (the 3rd attempt onward; re-wording or re-splitting does NOT make it a new task), and NEVER otherwise — from the 3rd attempt deadlock outranks any capability override: drop provider/model/effort.", {
     task_category: z.enum(TASK_CATEGORIES).describe(TASK_CATEGORY_GLOSS),
     prompt: z.string().min(1),
     provider: z.enum(["claude", "codex"]).optional(),
@@ -503,7 +692,7 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
     effort: z.enum(["medium", "high", "xhigh", "max", "ultracode"]).optional(),
     cwd: z.string().optional(),
     deadlock: z.boolean().optional().describe("MANDATE: ALWAYS set deadlock=true when, and ONLY when, 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory — the 3rd attempt onward. Re-wording the prompt does NOT make it a different task; splitting a failed task does NOT reset attempts for its unchanged parts; re-launching for the same deliverable means the prior attempt COUNTS as failed/unsatisfactory ('partial progress' is not an exemption). NEVER set it on a 1st or 2nd attempt, NEVER for a different task, NEVER speculatively. Auto mode only: cannot be combined with provider/model/effort — from the 3rd attempt deadlock outranks any capability override, so drop those params. Passing false is identical to omitting it."),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const { task_category, provider, model, effort, deadlock } = params;
     // D19/D20/S8: server silently upserts the parent-process marker as the TRUE
     // first line of every sub-agent prompt (idempotent; never duplicates; never
@@ -604,7 +793,7 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
     //    advance on launch-time failure. Sub-agent task outcome is NEVER a trigger.
     const cap = readGlobalCap();
     const reservationId = randomUUID();
-    const reservation = reserveSlot(reservationId, cap);
+    const reservation = reserveSlot(reservationId, cap, slotDir(), NONBLOCKING_CULL_DEPS);
     if (!reservation.ok) {
         return errorResult(globalCapMessage(reservation.current, cap, defaultConfigPath()));
     }
@@ -622,6 +811,7 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
                 const registeredAgent = agents.get(outcome.agentId);
                 if (registeredAgent) {
                     registeredAgent.slotPath = reservation.slotPath;
+                    updateSlotMetadata(registeredAgent);
                     // The child can reach a terminal state DURING tryLaunchCandidate's
                     // awaits — before slotPath was set — so its close handler ran
                     // releaseSlot(undefined) (a no-op) and left the slot leaked. Detect
@@ -706,12 +896,12 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
         .map((s, i) => `  ${i + 1}. ${s.model}@${s.effort} (${s.provider}) [${s.failure_type}]: ${s.reason}`)
         .join("\n");
     return errorResult(`Error: all ${skipped.length} candidate launches failed for task_category ${task_category}:\n${lines}\n${SPLIT_HINT}\n${AUTO_HINT}`);
-});
+}));
 // Tool 2: poll_agent
-server.tool("poll_agent", "Get an agent's current status and output. Status `processing` = ALIVE with visible provider activity in the last 10 minutes; `stalled` = ALIVE but no parsed visible provider stream item for 10 minutes (thinking, or awaiting a temp-file handoff) — NOT dead, so prefer `wait`/re-poll over killing. Always returns `alive` and `idle_seconds`, plus `recent_stream` (the last 3 visible provider stream items, each timestamped) and a `hint` while stalled. Pass `verbose: true` to also return `final_output`, the agent's final assistant turn extracted from its captured stdout.", {
+server.tool("poll_agent", "Get an agent's current status and output. `processing` = ALIVE with visible provider activity in the last 10 min; `stalled` = ALIVE but no visible provider stream item for 10 min (thinking, or awaiting a temp-file handoff) — NOT dead, so prefer `wait`/re-poll over killing. Always returns `alive` + `idle_seconds`, plus `recent_stream` (last 3 timestamped visible stream items) and a `hint` while stalled. `verbose: true` also returns `final_output`, the agent's final assistant turn from its captured stdout.", {
     agent_id: z.string(),
     verbose: z.boolean().optional().default(false),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const agent = agents.get(params.agent_id);
     if (!agent) {
         return {
@@ -776,11 +966,11 @@ server.tool("poll_agent", "Get an agent's current status and output. Status `pro
             },
         ],
     };
-});
+}));
 // Tool 3: kill_agent
 server.tool("kill_agent", "Terminate a live agent/session (status `processing`, `stalled`, or turn-finished but still interactive) by immediately force-killing its managed driver. No-op for already-terminal closed agents.", {
     agent_id: z.string(),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const agent = agents.get(params.agent_id);
     if (!agent) {
         return {
@@ -856,12 +1046,12 @@ server.tool("kill_agent", "Terminate a live agent/session (status `processing`,
             isError: true,
         };
     }
-});
+}));
 // Tool 4: send_message
 server.tool("send_message", "Enqueue a user message for an open interactive agent session. Observe output with poll_agent or wait.", {
     agent_id: z.string(),
     message: z.string().min(1),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const agent = agents.get(params.agent_id);
     if (!agent) {
         return {
@@ -896,6 +1086,7 @@ server.tool("send_message", "Enqueue a user message for an open interactive agen
         agent.waitReported = false;
         agent.turnCompleted = false;
         agent.lastActivity = now;
+        updateSlotMetadata(agent);
         return {
             content: [
                 {
@@ -921,9 +1112,9 @@ server.tool("send_message", "Enqueue a user message for an open interactive agen
             isError: true,
         };
     }
-});
+}));
 // Tool 5: list_agents
-server.tool("list_agents", "List all agents with token-efficient core metrics (status, `alive`, `idle_seconds`). `stalled` is ALIVE-but-quiet, NOT dead (full status semantics on poll_agent). Use `poll_agent` for per-agent stream items, hints, and final output.", {}, async () => {
+server.tool("list_agents", "List all agents with token-efficient core metrics (status, `alive`, `idle_seconds`). `stalled` is ALIVE-but-quiet, NOT dead (full status semantics on poll_agent). Use `poll_agent` for per-agent stream items, hints, and final output.", {}, withMaintenance(async () => {
     const now = Date.now();
     const agentList = Array.from(agents.values()).map((agent) => {
         // Reconcile exit synchronously so already-exited processes are reported
@@ -950,11 +1141,11 @@ server.tool("list_agents", "List all agents with token-efficient core metrics (s
             },
         ],
     };
-});
+}));
 // Tool 6: wait
-server.tool("wait", "Blocks until one or more sub-agents reach a reportable state (turn-finished, errored, or stopped), returning exit code when known + local-time timestamp; or returns the live-job list after a 15-minute timeout. A `finished` agent can still be alive and accept `send_message` when exit_code is null. A `stalled` agent is still ALIVE and does NOT end the wait. Pass `verbose: true` to add each finished agent's `final_output`.", {
+server.tool("wait", "Blocks until one or more sub-agents reach a reportable state (turn-finished, errored, stopped, or zombie_killed), returning exit code when known + local-time timestamp; or returns the live-job list after a 15-minute timeout. This is how you learn an agent finished — do NOT poll-loop. A `finished` agent with null exit_code is still alive and accepts `send_message`; a `stalled` agent is still ALIVE and does NOT end the wait. `verbose: true` adds each finished agent's `final_output`.", {
     verbose: z.boolean().optional().default(false),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const { verbose } = params;
     const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
     const TIMEOUT_MS = 15 * 60 * 1000;
@@ -994,7 +1185,7 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     }
     // Step 2: nothing alive and nothing unreported (includes stopped-but-not-yet-closed).
     // `stalled` is a LIVE state — it keeps the wait pending, it never ends it.
-    const TERMINAL_SET = new Set(["finished", "errored", "stopped"]);
+    const TERMINAL_SET = new Set(["finished", "errored", "stopped", "zombie_killed"]);
     const hasPending = Array.from(agents.values()).some((a) => a.status === "processing" ||
         a.status === "stalled" ||
         (TERMINAL_SET.has(a.status) && a.exitedAt === null));
@@ -1032,11 +1223,11 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     return {
         content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
     };
-});
+}));
 // Tool 7: orchestration-mode
-server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query current state. SOLE CHANNEL: the subagent MCP is the ONLY sanctioned channel for launching sub-agents whether this mode is ON or OFF — toggling OFF does not lift that obligation. When OFF, run the per-turn upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask the user whether to remain enabled (ask every qualifying turn; a decline does not latch; reset the count only when you actually ask). The FULL operating model + governance is carried in this server's MCP `instructions` (read once at initialize) — this is the operational summary only; do not act on the mode without that detail. WHAT: a default-ON orchestration mode for LONG-HORIZON work that would fill the context window if run to completion inline; when ON, act as a delegate-ONLY orchestrator: delegate every step; inline-by-right does not exist; a non-delegable atomic step requires a one-time user-approved exception via the structured-question tool (state which + why). PERSISTENCE: orchestration is DEFAULT ON; a permitted disable applies to THIS session only, resumes ON next new session (or after the 2h backstop), and cannot be re-enabled mid-session. CARRYOVER: if ON was inherited from a PRIOR session (provenance = carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker, never per turn) — you MUST then notify the user it auto-activated and confirm whether to keep it ON. DISABLE: never on your own initiative; you MAY PROPOSE turning it OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation).", {
+server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query. SOLE CHANNEL holds in BOTH states: subagent-mcp is the only sanctioned way to launch sub-agents; toggling OFF does not lift that. WHAT: default-ON mode for LONG-HORIZON work that would fill the context window if run inline; when ON act as a delegate-ONLY orchestrator — delegate every step, inline-by-right does not exist, a non-delegable atomic step needs a one-time user-approved exception via the structured-question tool (state which + why). OFF upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask whether to remain enabled (every qualifying turn; a decline does not latch; reset the count only when you ask). PERSISTENCE: a permitted disable applies to THIS session only, resumes ON next new session (or after the 2h backstop), no mid-session re-enable. CARRYOVER: if ON was inherited from a prior session (carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker) — notify the user it auto-activated and confirm keeping it ON. DISABLE: never on your own initiative; you may PROPOSE OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation). Full operating model is in this server's MCP `instructions` (read once at initialize) — this is the operational summary only.", {
     enabled: z.boolean().optional(),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const cwd = process.cwd();
     const key = orchestrationMarker.readCurrentSession(cwd);
     if (params.enabled === true) {
@@ -1084,11 +1275,11 @@ server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MOD
             },
         ],
     };
-});
+}));
 // Tool 8: model-selection-mode
-server.tool("model-selection-mode", "Set or query per-project MODEL SELECTION MODE, which gates launch_agent's `provider`/`model`/`effort` selectors. `mode`: \"smart\" or \"user-approved-overrides\"; omit to query current state. \"smart\" is the DEFAULT and is used whenever the mode is unset — in smart, launch_agent REJECTS any call that supplies provider/model/effort and the server auto-picks the best model for the task_category. \"user-approved-overrides\" opens a 30-MINUTE window during which selectors are HONORED; the window is enforced LAZILY — the mode reverts to smart on the next launch_agent call after the 30 minutes elapse — and re-enabling does NOT extend an already-active window. HONOR-BASED, parallel to orchestration-mode: you MUST NOT set this to \"user-approved-overrides\" without explicit interactive USER authorization obtained via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex; a plain yes/no exchange if neither exists). This tool CANNOT verify that authorization — never enable it on your own initiative. PERSISTENCE: per-project state keyed by cwd; both the mode and the override-window enable-timestamp persist across MCP server restarts (the remaining window is restored, not reset).", {
+server.tool("model-selection-mode", "Set or query per-project MODEL SELECTION MODE, which gates launch_agent's `provider`/`model`/`effort` selectors. `mode`: \"smart\" or \"user-approved-overrides\"; omit to query. \"smart\" is the DEFAULT (used whenever unset): launch_agent REJECTS any call supplying provider/model/effort and the server auto-picks the best model for the task_category. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (reverts to smart on the next launch_agent call after the 30 min elapse); re-enabling does NOT extend an active window. HONOR-BASED, parallel to orchestration-mode: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex; a plain yes/no if neither exists). This tool CANNOT verify that authorization — never enable on your own initiative. PERSISTENCE: state keyed by cwd; both the mode and the override-window timestamp survive server restarts (remaining window is restored, not reset).", {
     mode: z.enum(["smart", "user-approved-overrides"]).optional(),
-}, async (params) => {
+}, withMaintenance(async (params) => {
     const cwd = process.cwd();
     if (params.mode)
         modelMode.setMode(cwd, params.mode);
@@ -1106,7 +1297,7 @@ server.tool("model-selection-mode", "Set or query per-project MODEL SELECTION MO
             },
         ],
     };
-});
+}));
 // Connect the stdio transport only when run as the entry point (the bin), NOT
 // when this module is imported (e.g. test/handler-validation.test.mjs importing
 // the exported validatePresence). Connecting on import would block the test on

package/dist/orchestration/hook-core.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import * as marker from "./marker.js";
 import * as reminder from "./reminder.js";
+import { cullStaleSlots, slotDir, ZOMBIE_FORCE_GRACE_MS, } from "../concurrency.js";
 /**
  * Provider-agnostic core of the UserPromptSubmit / SessionStart hook.
  *
@@ -210,6 +211,35 @@ export function claimAndEmit(cwd, current, turn, m, kind, env, adapter) {
         ? readDirective(env, adapter.carryoverDirectiveFile) + full
         : full;
 }
+function hookCullDeps(env = process.env) {
+    return {
+        forceGraceMs: () => {
+            const raw = env.SUBAGENT_ZOMBIE_FORCE_GRACE_MS;
+            if (raw === undefined || raw === "")
+                return ZOMBIE_FORCE_GRACE_MS;
+            const parsed = Number.parseInt(raw, 10);
+            return Number.isInteger(parsed) && parsed >= 0 ? parsed : ZOMBIE_FORCE_GRACE_MS;
+        },
+    };
+}
+export function cullHookZombies(deps = hookCullDeps()) {
+    try {
+        return cullStaleSlots(slotDir(), deps);
+    }
+    catch {
+        return [];
+    }
+}
+export function hookZombieReportText(records) {
+    const ids = Array.from(new Set(records.map((r) => r.agent_id))).filter(Boolean);
+    return ids.length > 0 ? `zombies: ${ids.join(",")}` : "";
+}
+export function appendHookZombieReport(out, records) {
+    const report = hookZombieReportText(records);
+    if (!report)
+        return out;
+    return out ? `${out}\n${report}` : report;
+}
 /**
  * Core hook logic. Returns the string to inject, or '' to inject nothing.
  *
@@ -229,8 +259,9 @@ export function claimAndEmit(cwd, current, turn, m, kind, env, adapter) {
  */
 export function runHook(payload, env, adapter) {
     try {
+        const zombieRecords = cullHookZombies();
         if (adapter.isSubagent(payload, env)) {
-            return "";
+            return appendHookZombieReport("", zombieRecords);
         }
         const cwd = payload.cwd || process.cwd();
         const current = sessionKey(payload);
@@ -239,17 +270,17 @@ export function runHook(payload, env, adapter) {
         if (!marker.isActive(cwd, current)) {
             // OFF: no claim machinery — just the per-prompt reminder cadence.
             const r = reminder.advance(cwd, current);
-            return cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted);
+            return appendHookZombieReport(cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted), zombieRecords);
         }
         const m = marker.readMarker(cwd);
         const kind = classifyClaim(m.owner_session, m.baseline_turn, current);
         if (kind === "fresh" || kind === "carryover") {
             const turn = adapter.currentTurn(payload.transcript_path);
-            return claimAndEmit(cwd, current, turn, m, kind, env, adapter);
+            return appendHookZombieReport(claimAndEmit(cwd, current, turn, m, kind, env, adapter), zombieRecords);
         }
         // SAME-SESSION: per-prompt reminder cadence, ON variant.
         const r = reminder.advance(cwd, current);
-        return cadenceEmit(env, adapter, adapter.reminderOnFile, adapter.shortOnFile, r.count, r.persisted);
+        return appendHookZombieReport(cadenceEmit(env, adapter, adapter.reminderOnFile, adapter.shortOnFile, r.count, r.persisted), zombieRecords);
     }
     catch {
         // Any failure -> inject nothing. Never crash or stall the host turn.

package/dist/orchestration/pretool.js

@@ -1,4 +1,5 @@
 import { serverAlive } from "./liveness.js";
+import { cullHookZombies, hookZombieReportText } from "./hook-core.js";
 const NATIVE_SUBAGENT_TOOLS = new Set(["Task", "Agent", "Explore"]);
 function decision(permissionDecision, permissionDecisionReason, additionalContext) {
     return {
@@ -21,17 +22,21 @@ function decision(permissionDecision, permissionDecisionReason, additionalContex
  */
 export function runClaudePreTool(payload, env, now = Date.now()) {
     try {
+        const zombieReport = hookZombieReportText(cullHookZombies());
         if (env.SUBAGENT_MCP_SUBAGENT === "1")
             return null;
+        const zombieAllowedDecision = zombieReport
+            ? decision("allow", "zombies culled; allowing requested tool.", zombieReport)
+            : null;
         if (!serverAlive(now))
-            return null;
+            return zombieAllowedDecision;
         const tool = typeof payload.tool_name === "string" ? payload.tool_name : "";
         if (!tool)
-            return null;
+            return zombieAllowedDecision;
         if (NATIVE_SUBAGENT_TOOLS.has(tool)) {
-            return decision("deny", "subagent-mcp is alive; harness-native Task/Agent/Explore is not the sanctioned sub-agent channel. Use the subagent-mcp launch_agent MCP tool with the parent-process sentinel as prompt line 1.");
+            return decision("deny", "subagent-mcp is alive; harness-native Task/Agent/Explore is not the sanctioned sub-agent channel. Use the subagent-mcp launch_agent MCP tool with the parent-process sentinel as prompt line 1.", zombieReport || undefined);
         }
-        return null;
+        return zombieAllowedDecision;
     }
     catch {
         return null;

package/dist/status-helpers.js

@@ -9,6 +9,7 @@
 //   finished   - current turn completed, or driver exited 0.
 //   errored    - process exited non-zero.
 //   stopped    - process was killed.
+//   zombie_killed - stale process tree was culled outside the owning server.
 //
 // Liveness is driven by a heartbeat: launch time is the initial heartbeat and
 // every subsequent PARSED visible provider stream item refreshes it (raw
@@ -44,8 +45,7 @@ export function computeStatusTransition(input) {
 // opts in (poll_agent does; list_agents omits it to stay token-efficient).
 export function buildLivenessFields(status, exitCode, lastActivity, now, includeHint = true) {
     const idle_seconds = Math.floor((now - lastActivity) / 1000);
-    const alive = exitCode === null &&
-        (status === "processing" || status === "stalled" || status === "finished");
+    const alive = exitCode === null && (status === "processing" || status === "stalled");
     const fields = { alive, idle_seconds };
     if (status === "stalled" && includeHint) {
         fields.hint =

package/dist/wait-helpers.js

@@ -15,7 +15,7 @@ export function formatLocalIso(ms) {
     const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
     return `${year}-${month}-${day}T${hours}:${minutes}:${seconds}${sign}${offH}:${offM} (${zone})`;
 }
-const TERMINAL_STATUSES = new Set(["finished", "errored", "stopped"]);
+const TERMINAL_STATUSES = new Set(["finished", "errored", "stopped", "zombie_killed"]);
 export function selectUnreported(list) {
     return list.filter((a) => TERMINAL_STATUSES.has(a.status) && a.exitedAt !== null && !a.waitReported);
 }

package/dist/zombie.js

@@ -0,0 +1,189 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { platform } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+export const ZOMBIE_LIVE_IDLE_MS = 6 * 60 * 1000;
+export const ZOMBIE_TERMINAL_IDLE_MS = 30 * 1000;
+export const ZOMBIE_FORCE_GRACE_MS = 20 * 1000;
+export const ZOMBIE_INTENTS_FILENAME = "zombie-intents.jsonl";
+export const ZOMBIE_REPORTS_FILENAME = "zombie-reports.jsonl";
+function numberOrNull(v) {
+    return Number.isFinite(v) ? v : null;
+}
+function parseTimeMs(v) {
+    if (Number.isFinite(v))
+        return v;
+    if (typeof v !== "string")
+        return null;
+    const t = Date.parse(v);
+    return Number.isFinite(t) ? t : null;
+}
+export function slotPathForAgent(dir, agentId) {
+    return join(dir, `slot-${agentId}.json`);
+}
+export function parseSlotMetadata(text, slotPath = "") {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const baseAgentId = basename(slotPath).replace(/^slot-/, "").replace(/\.json$/, "");
+    const agent_id = typeof raw.agent_id === "string" ? raw.agent_id : baseAgentId;
+    const started_at = typeof raw.started_at === "string"
+        ? raw.started_at
+        : typeof raw.startedAt === "string"
+            ? raw.startedAt
+            : null;
+    const started_at_ms = parseTimeMs(raw.started_at_ms ?? raw.started_at ?? raw.startedAt);
+    return {
+        schema_version: 1,
+        agent_id,
+        server_pid: numberOrNull(raw.server_pid ?? raw.pid),
+        child_pid: numberOrNull(raw.child_pid),
+        cwd: typeof raw.cwd === "string" ? raw.cwd : null,
+        started_at,
+        started_at_ms,
+        last_activity_ms: parseTimeMs(raw.last_activity_ms ?? raw.lastActivity ?? raw.started_at_ms ?? raw.startedAt),
+        status: typeof raw.status === "string" ? raw.status : null,
+    };
+}
+export function readSlotMetadata(slotPath) {
+    try {
+        return parseSlotMetadata(readFileSync(slotPath, "utf8"), slotPath);
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSlotMetadata(slotPath, metadata) {
+    const now = Date.now();
+    const full = {
+        schema_version: 1,
+        agent_id: metadata.agent_id,
+        server_pid: metadata.server_pid ?? process.pid,
+        child_pid: metadata.child_pid ?? null,
+        cwd: metadata.cwd ?? process.cwd(),
+        started_at: metadata.started_at ?? new Date(now).toISOString(),
+        started_at_ms: metadata.started_at_ms ?? now,
+        last_activity_ms: metadata.last_activity_ms ?? now,
+        status: metadata.status ?? null,
+    };
+    writeFileSync(slotPath, JSON.stringify(full), { mode: 0o600 });
+}
+function drainJsonl(path) {
+    if (!existsSync(path))
+        return [];
+    const claim = join(dirname(path), `${basename(path)}.${process.pid}.drain`);
+    try {
+        renameSync(path, claim);
+    }
+    catch {
+        return [];
+    }
+    try {
+        return readFileSync(claim, "utf8")
+            .split(/\r?\n/)
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+    }
+    finally {
+        try {
+            unlinkSync(claim);
+        }
+        catch { }
+    }
+}
+export function buildProcessTreeKillCommands(pid, p = platform()) {
+    if (p === "win32") {
+        return {
+            graceful: { command: "taskkill", args: ["/PID", String(pid), "/T"] },
+            force: { command: "taskkill", args: ["/PID", String(pid), "/T", "/F"] },
+        };
+    }
+    return {
+        graceful: { command: "kill", args: ["-TERM", `-${pid}`] },
+        force: { command: "kill", args: ["-KILL", `-${pid}`] },
+    };
+}
+export function appendZombieRecord(dir, record) {
+    mkdirSync(dir, { recursive: true, mode: 0o1777 });
+    const line = `${JSON.stringify(record)}\n`;
+    writeFileSync(join(dir, ZOMBIE_INTENTS_FILENAME), line, { flag: "a", mode: 0o600 });
+    writeFileSync(join(dir, ZOMBIE_REPORTS_FILENAME), line, { flag: "a", mode: 0o600 });
+}
+export function drainZombieReports(dir) {
+    return drainJsonl(join(dir, ZOMBIE_REPORTS_FILENAME));
+}
+export function drainZombieIntents(dir) {
+    return drainJsonl(join(dir, ZOMBIE_INTENTS_FILENAME));
+}
+function defaultRunCommand(command, args) {
+    execFileSync(command, args, { stdio: "ignore" });
+}
+function defaultSleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export function cullStaleSlots(dir, deps = {}) {
+    const now = deps.now?.() ?? Date.now();
+    const runCommand = deps.runCommand ?? defaultRunCommand;
+    const sleepMs = deps.sleepMs ?? defaultSleepMs;
+    const forceGraceMs = deps.forceGraceMs?.() ?? ZOMBIE_FORCE_GRACE_MS;
+    const p = deps.platform ?? platform();
+    const records = [];
+    let files;
+    try {
+        files = readdirSync(dir).filter((f) => f.startsWith("slot-") && f.endsWith(".json"));
+    }
+    catch {
+        return records;
+    }
+    for (const file of files) {
+        const slotPath = join(dir, file);
+        const meta = readSlotMetadata(slotPath);
+        if (!meta?.last_activity_ms)
+            continue;
+        if (now - meta.last_activity_ms <= ZOMBIE_LIVE_IDLE_MS)
+            continue;
+        const pid = meta.child_pid;
+        if (pid && pid !== process.pid) {
+            const commands = buildProcessTreeKillCommands(pid, p);
+            try {
+                runCommand(commands.graceful.command, commands.graceful.args);
+            }
+            catch { }
+            const forceKill = () => {
+                try {
+                    runCommand(commands.force.command, commands.force.args);
+                }
+                catch { }
+            };
+            if (deps.scheduleForceKill) {
+                deps.scheduleForceKill(forceGraceMs, forceKill);
+            }
+            else {
+                sleepMs(forceGraceMs);
+                forceKill();
+            }
+        }
+        const record = {
+            kind: "zombie_killed",
+            agent_id: meta.agent_id,
+            child_pid: meta.child_pid,
+            server_pid: meta.server_pid,
+            slot_path: slotPath,
+            reason: "stale_live",
+            detected_at_ms: now,
+            last_activity_ms: meta.last_activity_ms,
+            message: `zombies: culled stale subagent ${meta.agent_id}`,
+        };
+        appendZombieRecord(dir, record);
+        try {
+            unlinkSync(slotPath);
+        }
+        catch { }
+        records.push(record);
+    }
+    return records;
+}

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "@heretyc/subagent-mcp",
-  "version": "2.10.0",
-  "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "mcp-server",
-    "claude",
-    "claude-code",
-    "codex",
-    "orchestration",
-    "subagent",
-    "sub-agent",
-    "multi-agent",
-    "ai-agents",
-    "anthropic",
-    "openai"
-  ],
-  "type": "module",
-  "main": "dist/index.js",
-  "bin": {
-    "subagent-mcp": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "directives",
-    "scripts/postinstall.mjs",
-    "LICENSE",
-    "NOTICE",
-    "README.md"
-  ],
-  "scripts": {
-    "check:versions": "node scripts/check_version_sync.mjs",
-    "build": "npm run check:versions && node scripts/gen-ruleset-scaffold.mjs && tsc && node scripts/copy-provider.mjs",
-    "start": "node dist/index.js",
-    "postinstall": "node scripts/postinstall.mjs",
-    "prepare": "npm run build",
-    "prepublishOnly": "npm test",
-    "test": "npm run check:versions && node test/effort.test.mjs && node test/drivers.test.mjs && node test/platform.test.mjs && node test/wait.test.mjs && node test/status.test.mjs && node test/output.test.mjs && node test/stream.test.mjs && node test/routing.test.mjs && node test/deadlock.test.mjs && node test/handler-validation.test.mjs && node test/index-handler.test.mjs && node test/ruleset.test.mjs && node test/ruleset-exec.test.mjs && node test/ruleset-handler.test.mjs && node test/failover.test.mjs && node test/global-concurrency-cap.test.mjs && node test/orchestration-marker.test.mjs && node test/orchestration-hook-core.test.mjs && node test/orchestration-adapters.test.mjs && node test/orchestration-pretool.test.mjs && node test/orchestration-directives.test.mjs && node test/no-five-call.test.mjs && node test/check-worktree-subagent.test.mjs && node test/launch-agent-upsert.test.mjs && node test/claude-session-limit.test.mjs && node test/init-migration.test.mjs && node test/init-global.test.mjs && node test/mirror-fragments.test.mjs && node test/performance-tier-effort.test.mjs && node test/setup-repair.test.mjs && node test/setup-quoting.test.mjs && node test/setup-wire.test.mjs && node test/setup-cli-integration.test.mjs && node test/init.test.mjs && node test/model-selection-mode.test.mjs && node test/cli-args.test.mjs && node scripts/validate_provider.mjs && node scripts/validate_seed_sites.mjs && node scripts/validate_routing_audit.mjs && node test/seed-sites.test.mjs && node test/mcp-compliance.test.mjs"
-  },
-  "author": "Lexi Blackburn",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Heretyc/subagent-mcp.git"
-  },
-  "homepage": "https://github.com/Heretyc/subagent-mcp#readme",
-  "bugs": {
-    "url": "https://github.com/Heretyc/subagent-mcp/issues"
-  },
-  "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.177",
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org",
-    "access": "public"
-  }
-}
+{
+  "name": "@heretyc/subagent-mcp",
+  "version": "2.10.2",
+  "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "mcp-server",
+    "claude",
+    "claude-code",
+    "codex",
+    "orchestration",
+    "subagent",
+    "sub-agent",
+    "multi-agent",
+    "ai-agents",
+    "anthropic",
+    "openai"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "subagent-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "directives",
+    "scripts/postinstall.mjs",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "scripts": {
+    "check:versions": "node scripts/check_version_sync.mjs",
+    "build": "npm run check:versions && node scripts/gen-ruleset-scaffold.mjs && tsc && node scripts/copy-provider.mjs",
+    "start": "node dist/index.js",
+    "postinstall": "node scripts/postinstall.mjs",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm test",
+    "test": "npm run check:versions && node test/effort.test.mjs && node test/drivers.test.mjs && node test/platform.test.mjs && node test/wait.test.mjs && node test/status.test.mjs && node test/output.test.mjs && node test/stream.test.mjs && node test/routing.test.mjs && node test/deadlock.test.mjs && node test/handler-validation.test.mjs && node test/index-handler.test.mjs && node test/ruleset.test.mjs && node test/ruleset-exec.test.mjs && node test/ruleset-handler.test.mjs && node test/failover.test.mjs && node test/global-concurrency-cap.test.mjs && node test/zombie.test.mjs && node test/orchestration-marker.test.mjs && node test/orchestration-hook-core.test.mjs && node test/orchestration-adapters.test.mjs && node test/orchestration-pretool.test.mjs && node test/orchestration-directives.test.mjs && node test/no-five-call.test.mjs && node test/check-worktree-subagent.test.mjs && node test/launch-agent-upsert.test.mjs && node test/claude-session-limit.test.mjs && node test/init-migration.test.mjs && node test/init-global.test.mjs && node test/mirror-fragments.test.mjs && node test/performance-tier-effort.test.mjs && node test/setup-repair.test.mjs && node test/setup-quoting.test.mjs && node test/setup-wire.test.mjs && node test/setup-cli-integration.test.mjs && node test/init.test.mjs && node test/model-selection-mode.test.mjs && node test/cli-args.test.mjs && node scripts/validate_provider.mjs && node scripts/validate_seed_sites.mjs && node scripts/validate_routing_audit.mjs && node test/seed-sites.test.mjs && node test/mcp-compliance.test.mjs"
+  },
+  "author": "Lexi Blackburn",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Heretyc/subagent-mcp.git"
+  },
+  "homepage": "https://github.com/Heretyc/subagent-mcp#readme",
+  "bugs": {
+    "url": "https://github.com/Heretyc/subagent-mcp/issues"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.177",
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}