@heretyc/subagent-mcp 2.10.3 → 2.10.4

package/LICENSE

@@ -1,201 +1,201 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction,
-and distribution as defined in Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by
-the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all
-other entities that control, are controlled by, or are under common
-control with that entity. For the purposes of this definition,
-"control" means (i) the power, direct or indirect, to cause the
-direction or management of such entity, whether by contract or
-otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications,
-including but not limited to software source code, documentation
-source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical
-transformation or translation of a Source form, including but
-not limited to compiled object code, generated documentation,
-and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object
-form, made available under the License, as indicated by a copyright
-notice that is included in or attached to the work (an example is
-provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object
-form, that is based on (or derived from) the Work and for which the
-editorial revisions, annotations, elaborations, or other modifications
-represent, as a whole, an original work of authorship. For the purposes
-of this License, Derivative Works shall not include works that remain
-separable from, or merely link (or bind by name) to the interfaces of,
-the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including
-the original Work and any Derivative Works thereof, and any modifications
-and enhancements to those works or Derivative Works thereof, that is
-intentionally submitted to Licensor for inclusion in the Work by the
-copyright owner or by an individual or Legal Entity authorized to submit
-on behalf of the copyright owner. For the purposes of this definition,
-"submitted" means any form of electronic, verbal, or written communication
-sent to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems,
-and issue tracking systems that are managed by, or on behalf of, the
-Licensor for the purpose of discussing and improving the Work, but
-excluding communication that is conspicuously marked or otherwise
-designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any Legal Entity on behalf of
-whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the
-Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-(except as stated in this section) patent license to make, have made,
-use, offer to sell, sell, import, and otherwise transfer the Work,
-where such license applies only to those patent claims licensable
-by such Contributor that are necessarily infringed by their
-Contribution(s) alone or by combination of their Contribution(s)
-with the Work to which such Contribution(s) was submitted. If You
-institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work
-or a Contribution incorporated within the Work constitutes direct
-or contributory patent infringement, then any patent licenses
-granted to You under this License for that Work shall terminate
-as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-Work or Derivative Works thereof in any medium, with or without
-modifications, and in Source or Object form, provided that You
-meet the following conditions:
-
-(a) You must give any other recipients of the Work or
-Derivative Works a copy of this License; and
-
-(b) You must cause any modified files to carry prominent notices
-stating that You changed the files; and
-
-(c) You must retain, in the Source form of any Derivative Works
-that You distribute, all copyright, patent, trademark, and
-attribution notices from the Source form of the Work,
-excluding those notices that do not pertain to any part of
-the Derivative Works; and
-
-(d) If the Work includes a "NOTICE" text file, then any
-Derivative Works that You distribute must include a readable
-copy of the attribution notices contained within such NOTICE
-file, excluding those notices that do not pertain to any part
-of the Derivative Works, in at least one of the following
-places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation,
-if provided along with the Derivative Works; or, within a
-display generated by the Derivative Works, if and
-wherever such third-party notices normally appear. The contents
-of the NOTICE file are for informational purposes only and
-do not modify the License. You may add Your own attribution
-notices within Derivative Works that You distribute, alongside
-or as an addendum to the NOTICE from the Work, provided that
-such additional attribution notices cannot be construed as
-modifying the License.
-
-You may add Your own copyright statement to Your modifications and
-may provide additional or different license terms and conditions
-for use, reproduction, or distribution of Your modifications, or
-for any such Derivative Works as a whole, provided Your use,
-reproduction, and distribution of the Work otherwise complies with
-the conditions of this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-any Contribution intentionally submitted for inclusion in the Work by
-You to Licensor shall be under the terms and conditions of this License,
-without any additional terms or conditions. Notwithstanding the above,
-nothing herein shall supersede or modify the terms of any separate
-license agreement you may have executed with Licensor regarding such
-Contribution.
-
-6. Trademarks. This License does not grant permission to use the trade
-names, trademarks, service marks, or product names of the Licensor,
-except as required for reasonable and customary use in describing the
-origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-agreed to in writing, Licensor provides the Work (and each
-Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-implied, including, without limitation, any warranties or conditions
-of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-PARTICULAR PURPOSE. You are solely responsible for determining the
-appropriateness of using or redistributing the Work and assume any
-risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-whether in tort (including negligence), contract, or otherwise,
-unless required by applicable law (such as deliberate and grossly
-negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special,
-incidental, or consequential damages of any character arising as a
-result of this License or out of the use or inability to use the
-Work (including but not limited to damages for loss of goodwill,
-work stoppage, computer failure or malfunction, or any and all
-other commercial damages or losses), even if such Contributor
-has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-the Work or Derivative Works thereof, You may choose to offer,
-and charge a fee for, acceptance of support, warranty, indemnity,
-or other liability obligations and/or rights consistent with this
-License. However, in accepting such obligations, You may act only
-on Your own behalf and on Your sole responsibility, not on behalf
-of any other Contributor, and only if You agree to indemnify,
-defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason
-of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-To apply the Apache License to your work, attach the following
-boilerplate notice, with the fields enclosed by brackets "{}"
-replaced with your own identifying information. (Don't include
-the brackets!) The text should be enclosed in the appropriate
-comment syntax for the file type. You may also add a brief
-description of what the file does on the same "printed page" as
-the copyright notice for easier identification within third-party
-archives.
-
-Copyright 2026 Lexi Blackburn
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined in Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object
+form, made available under the License, as indicated by a copyright
+notice that is included in or attached to the work (an example is
+provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original Work and any Derivative Works thereof, and any modifications
+and enhancements to those works or Derivative Works thereof, that is
+intentionally submitted to Licensor for inclusion in the Work by the
+copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication
+sent to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any Legal Entity on behalf of
+whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work,
+excluding those notices that do not pertain to any part of
+the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file, then any
+Derivative Works that You distribute must include a readable
+copy of the attribution notices contained within such NOTICE
+file, excluding those notices that do not pertain to any part
+of the Derivative Works, in at least one of the following
+places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation,
+if provided along with the Derivative Works; or, within a
+display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE from the Work, provided that
+such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions of this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work by
+You to Licensor shall be under the terms and conditions of this License,
+without any additional terms or conditions. Notwithstanding the above,
+nothing herein shall supersede or modify the terms of any separate
+license agreement you may have executed with Licensor regarding such
+Contribution.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "{}"
+replaced with your own identifying information. (Don't include
+the brackets!) The text should be enclosed in the appropriate
+comment syntax for the file type. You may also add a brief
+description of what the file does on the same "printed page" as
+the copyright notice for easier identification within third-party
+archives.
+
+Copyright 2026 Lexi Blackburn
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -1,5 +1,5 @@
-subagent-mcp
-Copyright 2026 Lexi Blackburn
-
-Licensed under the Apache License, Version 2.0.
-This product includes software developed by Lexi Blackburn.
+subagent-mcp
+Copyright 2026 Lexi Blackburn
+
+Licensed under the Apache License, Version 2.0.
+This product includes software developed by Lexi Blackburn.

package/README.md

@@ -1,187 +1,187 @@
-# subagent-mcp
-
-[![npm version](https://img.shields.io/npm/v/@heretyc/subagent-mcp?label=npm)](https://www.npmjs.com/package/@heretyc/subagent-mcp)
-[![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
-[![node](https://img.shields.io/node/v/@heretyc/subagent-mcp)](https://www.npmjs.com/package/@heretyc/subagent-mcp)
-[![CI](https://github.com/Heretyc/subagent-mcp/actions/workflows/claude-routine.yml/badge.svg)](https://github.com/Heretyc/subagent-mcp/actions/workflows/claude-routine.yml)
-
-MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions — on macOS, Linux, and Windows. No direct API calls. No API keys.
-
-## Install
-
-### Prerequisites (runtime)
-
-To run the published CLI you need:
-
-- Node.js >= 18  (`node --version`)
-- `claude` CLI — globally installed and authenticated  (`claude --version`)
-- `codex` CLI — globally installed and authenticated  (`codex --version`; optional if you only use Claude paths)
-
-Building from source needs additional developer tooling — see [CONTRIBUTING.md § Prerequisites](CONTRIBUTING.md#prerequisites).
-
-### npmjs (default)
-
-No authentication, no `.npmrc` configuration, and no PAT required. The package is publicly available on [npmjs.com](https://www.npmjs.com/package/@heretyc/subagent-mcp).
-
-```bash
-npm install -g @heretyc/subagent-mcp
-```
-
-**Use this path for all standard installs.**
-
-`subagent-mcp update` always refreshes from npmjs, even on machines whose `.npmrc` routes `@heretyc` packages through GitHub Packages.
-
-### GitHub Packages (org-internal pin / supply-chain auditing)
-
-Use this path when your organization's `.npmrc` already routes the `@heretyc` scope through GitHub Packages, when you need supply-chain audit tracing against the org-internal artifact, or when you run inside a GitHub Actions workflow whose `GITHUB_TOKEN` carries `read:packages`. Otherwise prefer npmjs above — it is simpler and needs no credentials.
-
-```bash
-# One-time machine setup
-echo "@heretyc:registry=https://npm.pkg.github.com" >> ~/.npmrc
-echo "//npm.pkg.github.com/:_authToken=YOUR_GITHUB_PAT" >> ~/.npmrc
-# PAT must be a classic PAT with the read:packages scope
-
-npm install -g @heretyc/subagent-mcp
-```
-
-> **Note:** GitHub Packages requires authentication even for public packages. If you see `401 Unauthorized`, verify your PAT has the `read:packages` scope and has not expired. GitHub Packages does not render a README page — the live documentation appears on [npmjs.com](https://www.npmjs.com/package/@heretyc/subagent-mcp).
-
-## Quick Start
-
-**1. Install** (see [Install](#install) above):
-
-```bash
-npm install -g @heretyc/subagent-mcp
-```
-
-**2. Register the MCP server + orchestration hooks:**
-
-```bash
-subagent-mcp setup
-```
-
-Installing the package only ships the binary — it does **not** auto-wire anything. `subagent-mcp setup` auto-detects Claude Code / Codex and registers the MCP server plus the per-turn orchestration-mode hooks. Preview with `subagent-mcp setup --dry-run`.
-
-**3. Restart your host.**
-
-Restart your Claude Code or Codex session so it picks up the new binary. On Codex, run `/hooks` and trust the new hook.
-
-**4. Initialize the orchestration invariant (recommended):**
-
-```bash
-subagent-mcp init --global
-```
-
-`init --global` writes the managed invariant block into the providers' official global user-config files — `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md` — set up once, works across every project. For a single project instead, use `subagent-mcp init --root /path/to/project` to write into that project's instruction files. `--global` and `--root` are mutually exclusive.
-
-For manual wiring, Gemini CLI, Claude Desktop, and developer install from source, see [docs/registration.md](docs/registration.md).
-
-## Features
-
-- Start Claude or Codex interactive sessions as managed sub-agents from any MCP host
-- Poll status, stream stdout/stderr tails, and enqueue follow-up messages to live sessions
-- Concurrency caps: 5 concurrent Claude + 5 concurrent Codex agents (only `processing` agents count toward the cap; `stalled` agents do not hold a slot)
-- Liveness tracking via the visible provider stream (Claude SDK events, Codex app-server JSONL): agents with no parsed visible provider stream item for 10 minutes enter `stalled` state (still alive, just quiet — thinking or awaiting a temp-file handoff), and recover to `processing` if the visible stream resumes
-- Ultracode mode for Opus 4.8 via `--settings {"ultracode":true}` — see [docs/usage.md](docs/usage.md)
-- Cross-platform exe resolution (Windows: npm-prefix .exe paths; macOS/Linux: PATH + Homebrew/usr-local fallbacks); immediate `taskkill /t /f` (Windows) / `SIGKILL` (POSIX) force-kill; no graceful shutdown period
-- stdio MCP transport; built with `@modelcontextprotocol/sdk` + `zod`
-- `orchestration-mode` tool — toggles orchestrator directives injected by bundled Claude Code / Codex hooks; Claude also gets a deterministic `PreToolUse` gate
-
-## Orchestration Mode
-
-**ON:** the agent operates as an orchestrator — hook injection governs each session turn, preventing inline reads or writes, and all work is delegated through sub-agent tools.
-
-**OFF:** the agent operates normally, with no orchestration constraints.
-
-Toggle with the `orchestration-mode` tool. Desktop hosts toggle the mode but receive no hook injection. See [docs/spec/dev-loop/orchestration-directive-architecture.md](docs/spec/dev-loop/orchestration-directive-architecture.md) for full semantics.
-
-## Auto Mode
-
-`launch_agent` supports **auto mode**: pass `prompt` + `task_category` and the server picks the best provider/model/effort for that category from its routing table, silently falling back to the next-best candidate on any launch-time failure.
-
-`provider`, `model`, and `effort` are optional overrides — omit them to get the auto-selected best combination. Rules: passing `model` requires `provider`; passing `effort` requires both `provider` and `model`.
-
-**task_category** (required) — pick one:
-
-| Category | What it is |
-|---|---|
-| `math_proof` | deliverable is a proof/derivation/formally-checkable result |
-| `security_review` | security verdict, threat assessment, or demonstrated exploit |
-| `debugging` | verified fix/root-cause; requires an observed failure as precondition |
-| `quality_review` | evaluative verdict on existing artifact (review, A-vs-B, validate-vs-spec) |
-| `architecture` | cross-module design/plan, no code, no execution loop |
-| `agentic_execution` | end-state via act/observe/adapt loop (run/deploy/provision/browse) |
-| `data_analysis` | empirical finding about structured dataset (query, stat, model) |
-| `coding` | bounded runnable code artifact, one-pass (implement, test, refactor) |
-| `knowledge_synthesis` | novel integrated prose over sources (synthesize, summarize, draft) |
-| `mechanical` | deterministic single-pass transform, exact-match checkable (grep, rename, reformat) |
-| `prompt_engineering` | designed/optimized prompt or prompt-system steering an LLM/agent (composite-inferred) |
-| `vulnerability_research` | discovery + PoC of a novel vulnerability (composite-inferred) |
-| `molecular_biology` | reasoned molecular/computational-biology result over sequences, structures, or -omics data (composite-inferred) |
-| `ml_accelerator_design` | hardware/software design for ML acceleration — dataflow, kernel, roofline (composite-inferred) |
-| `fallback_default` | no category matches with confidence; prefer splitting work instead |
-
-The last four are **composite-inferred**: they carry no dedicated benchmark and their routing competency is composed from parent categories rather than measured directly.
-
-**Atomic-split guidance:** if you are unsure which category fits, do NOT submit one large amorphous task. Break the work into smaller atomic steps each mapping to a single category and launch one agent per step.
-
-## Configuration
-
-### Global concurrent-subagent cap
-
-subagent-mcp enforces a machine-global cap on the number of **live concurrent subagents** across all agentic sessions and MCP server processes on the machine. The count includes agents started by other active sessions and the whole recursive descendant tree; slots free as agents finish or are killed.
-
-The cap is configured in `global-concurrency.jsonc`, a dedicated dist-sibling file in the install directory. It is separate from the advanced routing directives file, ships as a commented template, and is retained across installs and updates by the same preserve-user-edits mechanism as the advanced routing directives.
-
-Set `globalConcurrentSubagents` in that file. The default is `20`; the minimum valid value is `10`. Validation is forced: `0`, unset, missing, or invalid values reset to `20`, and values `1` through `9` are pinned up to `10`. There is no environment-variable override; the file is the sole source of truth. The file is re-read on every `launch_agent` call, so edits take effect on the next launch with no server restart.
-
-When the cap is reached, `launch_agent` is rejected immediately; it never queues. Before cap checks, hooks and tool calls run default zombie culling with no config knob: live agents idle for more than 6 minutes and terminal-but-alive agents idle for more than 30 seconds are terminated process-tree-first, then force-killed after 20 seconds if needed. Reports include `zombies`, and `poll_agent` keeps the tail with `zombie_killed` when culling terminates an agent.
-
-## Tools
-
-Eight tools are exposed over the stdio MCP transport.
-
-| Tool | Description |
-|---|---|
-| `launch_agent` | Start a new sub-agent session with a prompt and optional task category / overrides |
-| `poll_agent` | Check status and stream tail output for a running agent |
-| `kill_agent` | Terminate a running or stalled agent |
-| `send_message` | Enqueue a message into a running agent's stdin |
-| `list_agents` | List all tracked agents and their current status |
-| `wait` | Block until a specific agent reaches a terminal state |
-| `orchestration-mode` | Toggle orchestration-mode ON/OFF; controls whether hook directives are injected into agent sessions |
-| `model-selection-mode` | Control model selection: `smart` (auto-pick) or `user-approved-overrides` (30-min override window) |
-
-Full parameters, return shapes, and the `alive` / `idle_seconds` / `hint` / `recent_stream` fields are in [docs/tools.md](docs/tools.md).
-
-## Agent Lifecycle
-
-Each agent transitions through these states:
-
-| Status | Meaning |
-|---|---|
-| `processing` | Driver alive with a visible provider-stream heartbeat in the last 10 minutes — actively working. Launch time counts as the initial heartbeat |
-| `stalled` | Driver STILL ALIVE but no parsed visible provider stream item for >= 10 minutes — working, thinking, or awaiting a temp-file handoff (not a failure). Recovers to `processing` if the visible stream resumes |
-| `finished` | Current turn completed, or driver exited with code 0 |
-| `errored` | Process exited with non-zero code |
-| `stopped` | Terminated by `kill_agent` |
-
-`processing` and `stalled` are live. `stalled` means the driver is alive but quiet (>= 10 min no visible stream); it recovers automatically and is never auto-killed — do not `kill_agent` a stalled agent. `wait` does not return on `stalled`. Full semantics: [docs/reference/status-lifecycle.md](docs/reference/status-lifecycle.md).
-
-## Documentation
-
-| Document | Contents |
-|---|---|
-| [docs/registration.md](docs/registration.md) | Per-platform setup: Claude Code, Codex, Gemini CLI, Claude Desktop; manual wiring; developer install from source |
-| [docs/tools.md](docs/tools.md) | Full tool reference — all eight tools, parameters, return shapes |
-| [docs/usage.md](docs/usage.md) | Model & effort matrix, ultracode mode, CLI invocations, usage examples |
-| [docs/SPEC.md](docs/SPEC.md) | Full technical specification — architecture, schemas, status lifecycle, error catalogue |
-| [docs/spec/interactive-drivers.md](docs/spec/interactive-drivers.md) | Always-interactive Claude/Codex driver model |
-| [docs/release-notes.md](docs/release-notes.md) | Operator-facing release notes |
-| [CONTRIBUTING.md](CONTRIBUTING.md) | Contributor guide — dev environment, build, test, publish |
-
-## License
-
-Apache-2.0 — Copyright 2026 Lexi Blackburn
-
-See [LICENSE](LICENSE).
+# subagent-mcp
+
+[![npm version](https://img.shields.io/npm/v/@heretyc/subagent-mcp?label=npm)](https://www.npmjs.com/package/@heretyc/subagent-mcp)
+[![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
+[![node](https://img.shields.io/node/v/@heretyc/subagent-mcp)](https://www.npmjs.com/package/@heretyc/subagent-mcp)
+[![CI](https://github.com/Heretyc/subagent-mcp/actions/workflows/claude-routine.yml/badge.svg)](https://github.com/Heretyc/subagent-mcp/actions/workflows/claude-routine.yml)
+
+MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions — on macOS, Linux, and Windows. No direct API calls. No API keys.
+
+## Install
+
+### Prerequisites (runtime)
+
+To run the published CLI you need:
+
+- Node.js >= 18  (`node --version`)
+- `claude` CLI — globally installed and authenticated  (`claude --version`)
+- `codex` CLI — globally installed and authenticated  (`codex --version`; optional if you only use Claude paths)
+
+Building from source needs additional developer tooling — see [CONTRIBUTING.md § Prerequisites](CONTRIBUTING.md#prerequisites).
+
+### npmjs (default)
+
+No authentication, no `.npmrc` configuration, and no PAT required. The package is publicly available on [npmjs.com](https://www.npmjs.com/package/@heretyc/subagent-mcp).
+
+```bash
+npm install -g @heretyc/subagent-mcp
+```
+
+**Use this path for all standard installs.**
+
+`subagent-mcp update` always refreshes from npmjs, even on machines whose `.npmrc` routes `@heretyc` packages through GitHub Packages.
+
+### GitHub Packages (org-internal pin / supply-chain auditing)
+
+Use this path when your organization's `.npmrc` already routes the `@heretyc` scope through GitHub Packages, when you need supply-chain audit tracing against the org-internal artifact, or when you run inside a GitHub Actions workflow whose `GITHUB_TOKEN` carries `read:packages`. Otherwise prefer npmjs above — it is simpler and needs no credentials.
+
+```bash
+# One-time machine setup
+echo "@heretyc:registry=https://npm.pkg.github.com" >> ~/.npmrc
+echo "//npm.pkg.github.com/:_authToken=YOUR_GITHUB_PAT" >> ~/.npmrc
+# PAT must be a classic PAT with the read:packages scope
+
+npm install -g @heretyc/subagent-mcp
+```
+
+> **Note:** GitHub Packages requires authentication even for public packages. If you see `401 Unauthorized`, verify your PAT has the `read:packages` scope and has not expired. GitHub Packages does not render a README page — the live documentation appears on [npmjs.com](https://www.npmjs.com/package/@heretyc/subagent-mcp).
+
+## Quick Start
+
+**1. Install** (see [Install](#install) above):
+
+```bash
+npm install -g @heretyc/subagent-mcp
+```
+
+**2. Register the MCP server + orchestration hooks:**
+
+```bash
+subagent-mcp setup
+```
+
+Installing the package only ships the binary — it does **not** auto-wire anything. `subagent-mcp setup` auto-detects Claude Code / Codex and registers the MCP server plus the per-turn orchestration-mode hooks. Preview with `subagent-mcp setup --dry-run`.
+
+**3. Restart your host.**
+
+Restart your Claude Code or Codex session so it picks up the new binary. On Codex, run `/hooks` and trust the new hook.
+
+**4. Initialize the orchestration invariant (recommended):**
+
+```bash
+subagent-mcp init --global
+```
+
+`init --global` writes the managed invariant block into the providers' official global user-config files — `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md` — set up once, works across every project. For a single project instead, use `subagent-mcp init --root /path/to/project` to write into that project's instruction files. `--global` and `--root` are mutually exclusive.
+
+For manual wiring, Gemini CLI, Claude Desktop, and developer install from source, see [docs/registration.md](docs/registration.md).
+
+## Features
+
+- Start Claude or Codex interactive sessions as managed sub-agents from any MCP host
+- Poll status, stream stdout/stderr tails, and enqueue follow-up messages to live sessions
+- Concurrency caps: 5 concurrent Claude + 5 concurrent Codex agents (only `processing` agents count toward the cap; `stalled` agents do not hold a slot)
+- Liveness tracking via the visible provider stream (Claude SDK events, Codex app-server JSONL): agents with no parsed visible provider stream item for 10 minutes enter `stalled` state (still alive, just quiet — thinking or awaiting a temp-file handoff), and recover to `processing` if the visible stream resumes
+- Ultracode mode for Opus 4.8 via `--settings {"ultracode":true}` — see [docs/usage.md](docs/usage.md)
+- Cross-platform exe resolution (Windows: npm-prefix .exe paths; macOS/Linux: PATH + Homebrew/usr-local fallbacks); immediate `taskkill /t /f` (Windows) / `SIGKILL` (POSIX) force-kill; no graceful shutdown period
+- stdio MCP transport; built with `@modelcontextprotocol/sdk` + `zod`
+- `orchestration-mode` tool — toggles orchestrator directives injected by bundled Claude Code / Codex hooks; Claude also gets a deterministic `PreToolUse` gate
+
+## Orchestration Mode
+
+**ON:** the agent operates as an orchestrator — hook injection governs each session turn, preventing inline reads or writes, and all work is delegated through sub-agent tools.
+
+**OFF:** the agent operates normally, with no orchestration constraints.
+
+Toggle with the `orchestration-mode` tool. Desktop hosts toggle the mode but receive no hook injection. See [docs/spec/dev-loop/orchestration-directive-architecture.md](docs/spec/dev-loop/orchestration-directive-architecture.md) for full semantics.
+
+## Auto Mode
+
+`launch_agent` supports **auto mode**: pass `prompt` + `task_category` and the server picks the best provider/model/effort for that category from its routing table, silently falling back to the next-best candidate on any launch-time failure.
+
+`provider`, `model`, and `effort` are optional overrides — omit them to get the auto-selected best combination. Rules: passing `model` requires `provider`; passing `effort` requires both `provider` and `model`.
+
+**task_category** (required) — pick one:
+
+| Category | What it is |
+|---|---|
+| `math_proof` | deliverable is a proof/derivation/formally-checkable result |
+| `security_review` | security verdict, threat assessment, or demonstrated exploit |
+| `debugging` | verified fix/root-cause; requires an observed failure as precondition |
+| `quality_review` | evaluative verdict on existing artifact (review, A-vs-B, validate-vs-spec) |
+| `architecture` | cross-module design/plan, no code, no execution loop |
+| `agentic_execution` | end-state via act/observe/adapt loop (run/deploy/provision/browse) |
+| `data_analysis` | empirical finding about structured dataset (query, stat, model) |
+| `coding` | bounded runnable code artifact, one-pass (implement, test, refactor) |
+| `knowledge_synthesis` | novel integrated prose over sources (synthesize, summarize, draft) |
+| `mechanical` | deterministic single-pass transform, exact-match checkable (grep, rename, reformat) |
+| `prompt_engineering` | designed/optimized prompt or prompt-system steering an LLM/agent (composite-inferred) |
+| `vulnerability_research` | discovery + PoC of a novel vulnerability (composite-inferred) |
+| `molecular_biology` | reasoned molecular/computational-biology result over sequences, structures, or -omics data (composite-inferred) |
+| `ml_accelerator_design` | hardware/software design for ML acceleration — dataflow, kernel, roofline (composite-inferred) |
+| `fallback_default` | no category matches with confidence; prefer splitting work instead |
+
+The last four are **composite-inferred**: they carry no dedicated benchmark and their routing competency is composed from parent categories rather than measured directly.
+
+**Atomic-split guidance:** if you are unsure which category fits, do NOT submit one large amorphous task. Break the work into smaller atomic steps each mapping to a single category and launch one agent per step.
+
+## Configuration
+
+### Global concurrent-subagent cap
+
+subagent-mcp enforces a machine-global cap on the number of **live concurrent subagents** across all agentic sessions and MCP server processes on the machine. The count includes agents started by other active sessions and the whole recursive descendant tree; slots free as agents finish or are killed.
+
+The cap is configured in `global-concurrency.jsonc`, a dedicated dist-sibling file in the install directory. It is separate from the advanced routing directives file, ships as a commented template, and is retained across installs and updates by the same preserve-user-edits mechanism as the advanced routing directives.
+
+Set `globalConcurrentSubagents` in that file. The default is `20`; the minimum valid value is `10`. Validation is forced: `0`, unset, missing, or invalid values reset to `20`, and values `1` through `9` are pinned up to `10`. There is no environment-variable override; the file is the sole source of truth. The file is re-read on every `launch_agent` call, so edits take effect on the next launch with no server restart.
+
+When the cap is reached, `launch_agent` is rejected immediately; it never queues. Before cap checks, hooks and tool calls run default zombie culling with no config knob: stale slots whose owner server is gone may terminate their managed child process-tree, while live owned slots are heartbeated and preserved; terminal-but-alive agents idle for more than 30 seconds are force-killed. Reports include `zombies`, and `poll_agent` keeps the tail with `zombie_killed` when culling terminates an agent.
+
+## Tools
+
+Eight tools are exposed over the stdio MCP transport.
+
+| Tool | Description |
+|---|---|
+| `launch_agent` | Start a new sub-agent session with a prompt and optional task category / overrides |
+| `poll_agent` | Check status and stream tail output for a running agent |
+| `kill_agent` | Terminate a running or stalled agent |
+| `send_message` | Enqueue a message into a running agent's stdin |
+| `list_agents` | List all tracked agents and their current status |
+| `wait` | Block until a specific agent reaches a terminal state |
+| `orchestration-mode` | Toggle orchestration-mode ON/OFF; controls whether hook directives are injected into agent sessions |
+| `model-selection-mode` | Control model selection: `smart` (auto-pick) or `user-approved-overrides` (30-min override window) |
+
+Full parameters, return shapes, and the `alive` / `idle_seconds` / `hint` / `recent_stream` fields are in [docs/tools.md](docs/tools.md).
+
+## Agent Lifecycle
+
+Each agent transitions through these states:
+
+| Status | Meaning |
+|---|---|
+| `processing` | Driver alive with a visible provider-stream heartbeat in the last 10 minutes — actively working. Launch time counts as the initial heartbeat |
+| `stalled` | Driver STILL ALIVE but no parsed visible provider stream item for >= 10 minutes — working, thinking, or awaiting a temp-file handoff (not a failure). Recovers to `processing` if the visible stream resumes |
+| `finished` | Current turn completed, or driver exited with code 0 |
+| `errored` | Process exited with non-zero code |
+| `stopped` | Terminated by `kill_agent` |
+
+`processing` and `stalled` are live. `stalled` means the driver is alive but quiet (>= 10 min no visible stream); it recovers automatically and is never auto-killed — do not `kill_agent` a stalled agent. `wait` does not return on `stalled`. Full semantics: [docs/reference/status-lifecycle.md](docs/reference/status-lifecycle.md).
+
+## Documentation
+
+| Document | Contents |
+|---|---|
+| [docs/registration.md](docs/registration.md) | Per-platform setup: Claude Code, Codex, Gemini CLI, Claude Desktop; manual wiring; developer install from source |
+| [docs/tools.md](docs/tools.md) | Full tool reference — all eight tools, parameters, return shapes |
+| [docs/usage.md](docs/usage.md) | Model & effort matrix, ultracode mode, CLI invocations, usage examples |
+| [docs/SPEC.md](docs/SPEC.md) | Full technical specification — architecture, schemas, status lifecycle, error catalogue |
+| [docs/spec/interactive-drivers.md](docs/spec/interactive-drivers.md) | Always-interactive Claude/Codex driver model |
+| [docs/release-notes.md](docs/release-notes.md) | Operator-facing release notes |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | Contributor guide — dev environment, build, test, publish |
+
+## License
+
+Apache-2.0 — Copyright 2026 Lexi Blackburn
+
+See [LICENSE](LICENSE).

package/dist/config-scaffold.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-concurrency.jsonc — DO NOT EDIT.
-export const CONCURRENCY_SCAFFOLD = "// subagent-mcp — Global Concurrent Subagent Cap\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for the machine-wide limit on how many subagents\r\n// may be ALIVE AT ONCE across EVERY session, process, and user on this\r\n// machine. There is NO environment-variable override.\r\n//\r\n// The whole recursive descendant tree counts toward this ONE number: a\r\n// subagent that itself launches subagents adds to the same machine-wide\r\n// total, and OTHER active agentic sessions count too.\r\n//\r\n// RE-READ on every launch_agent call — edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Value rules (forcibly applied to the number below):\r\n//   - missing / unset / non-integer / 0 / negative  -> reset to default 20\r\n//   - 1 through 9                                    -> forced UP to minimum 10\r\n//   - 10 or greater                                 -> used as-is\r\n//\r\n// Zombie culling is always enabled. There is no config knob. Before cap\r\n// rejection, launch/tool/hook paths cull stale live agents idle for 6min and\r\n// terminal-but-alive agents idle for 30s. Culling gracefully terminates the\r\n// full process tree, then force-kills after 20s when needed.\r\n//\r\n// When the cap is reached after culling, launch_agent is REJECTED (never\r\n// queued). Free a slot with list_agents + kill_agent, then retry.\r\n{\r\n  \"globalConcurrentSubagents\": 20\r\n}\r\n";
+export const CONCURRENCY_SCAFFOLD = "// subagent-mcp — Global Concurrent Subagent Cap\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for the machine-wide limit on how many subagents\r\n// may be ALIVE AT ONCE across EVERY session, process, and user on this\r\n// machine. There is NO environment-variable override.\r\n//\r\n// The whole recursive descendant tree counts toward this ONE number: a\r\n// subagent that itself launches subagents adds to the same machine-wide\r\n// total, and OTHER active agentic sessions count too.\r\n//\r\n// RE-READ on every launch_agent call — edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Value rules (forcibly applied to the number below):\r\n//   - missing / unset / non-integer / 0 / negative  -> reset to default 20\r\n//   - 1 through 9                                    -> forced UP to minimum 10\r\n//   - 10 or greater                                 -> used as-is\r\n//\r\n// Zombie culling is always enabled. There is no config knob. Before cap\n// rejection, launch/tool/hook paths refresh live owned slots, preserve stale\n// slots whose owner server is still alive, and cull stale slots whose owner is\n// gone. Managed stale slots terminate the child process tree, then force-kill\n// after 20s when needed; unmanaged stale slots are only unlinked.\n//\r\n// When the cap is reached after culling, launch_agent is REJECTED (never\r\n// queued). Free a slot with list_agents + kill_agent, then retry.\r\n{\r\n  \"globalConcurrentSubagents\": 20\r\n}\r\n";

package/dist/global-concurrency.jsonc

@@ -16,10 +16,11 @@
 //   - 1 through 9                                    -> forced UP to minimum 10
 //   - 10 or greater                                 -> used as-is
 //
-// Zombie culling is always enabled. There is no config knob. Before cap
-// rejection, launch/tool/hook paths cull stale live agents idle for 6min and
-// terminal-but-alive agents idle for 30s. Culling gracefully terminates the
-// full process tree, then force-kills after 20s when needed.
+// Zombie culling is always enabled. There is no config knob. Before cap
+// rejection, launch/tool/hook paths refresh live owned slots, preserve stale
+// slots whose owner server is still alive, and cull stale slots whose owner is
+// gone. Managed stale slots terminate the child process tree, then force-kill
+// after 20s when needed; unmanaged stale slots are only unlinked.
 //
 // When the cap is reached after culling, launch_agent is REJECTED (never
 // queued). Free a slot with list_agents + kill_agent, then retry.

package/dist/index.js

@@ -91,9 +91,31 @@ function withZombieReport(result, records) {
     result.content[0].text = `${text}\n${report}`;
     return result;
 }
-function updateSlotMetadata(agent) {
+function slotHeartbeatIntervalMs() {
+    return Math.max(1000, Math.min(30_000, Math.floor(zombieLiveIdleMs() / 3)));
+}
+function isLiveAgent(agent) {
+    return agent.status === "processing" || agent.status === "stalled";
+}
+function isSameOwnerSlot(agent, slotMeta) {
+    if (!slotMeta)
+        return true;
+    if (slotMeta.agent_id !== agent.id)
+        return false;
+    return slotMeta.server_pid === null || slotMeta.server_pid === process.pid;
+}
+function adoptNewerSlotActivity(agent, slotMeta) {
+    if (!slotMeta?.last_activity_ms || !isSameOwnerSlot(agent, slotMeta))
+        return;
+    if (slotMeta.last_activity_ms > agent.slotLastActivity) {
+        agent.slotLastActivity = slotMeta.last_activity_ms;
+    }
+}
+function updateSlotMetadata(agent, slotActivityMs) {
     if (!agent.slotPath)
         return;
+    const lastActivityMs = Math.max(agent.slotLastActivity, agent.lastActivity, slotActivityMs ?? 0);
+    agent.slotLastActivity = lastActivityMs;
     writeSlotMetadata(agent.slotPath, {
         agent_id: agent.id,
         server_pid: process.pid,
@@ -101,10 +123,25 @@ function updateSlotMetadata(agent) {
         cwd: agent.cwd,
         started_at: new Date(agent.startedAt).toISOString(),
         started_at_ms: agent.startedAt,
-        last_activity_ms: agent.lastActivity,
+        last_activity_ms: lastActivityMs,
         status: agent.status,
     });
 }
+function refreshLiveSlotMetadata(agent, now) {
+    if (!agent.slotPath || !isLiveAgent(agent))
+        return;
+    const slotMeta = readSlotMetadata(agent.slotPath);
+    if (!isSameOwnerSlot(agent, slotMeta))
+        return;
+    adoptNewerSlotActivity(agent, slotMeta);
+    const diskActivityMs = slotMeta?.last_activity_ms ?? null;
+    const shouldRefresh = slotMeta === null ||
+        diskActivityMs === null ||
+        diskActivityMs < agent.slotLastActivity ||
+        now - agent.slotLastActivity >= slotHeartbeatIntervalMs();
+    if (shouldRefresh)
+        updateSlotMetadata(agent, now);
+}
 function spawnProcessTreeKill(pid, force) {
     const commands = buildProcessTreeKillCommands(pid);
     const command = force ? commands.force : commands.graceful;
@@ -202,17 +239,13 @@ function runToolMaintenance() {
         if (agent.status === "zombie_killed")
             continue;
         reconcileAgent(agent, now);
-        const slotMeta = agent.slotPath ? readSlotMetadata(agent.slotPath) : null;
-        if (slotMeta?.last_activity_ms !== null && slotMeta?.last_activity_ms !== undefined) {
-            agent.lastActivity = Math.min(agent.lastActivity, slotMeta.last_activity_ms);
-        }
-        const live = agent.status === "processing" || agent.status === "stalled";
-        if (live && now - agent.lastActivity > zombieLiveIdleMs()) {
-            const record = markZombieKilled(agent, "stale_live", now);
-            records.push(record);
-            applied.add(agent.id);
+        const live = isLiveAgent(agent);
+        if (live) {
+            refreshLiveSlotMetadata(agent, now);
             continue;
         }
+        const slotMeta = agent.slotPath ? readSlotMetadata(agent.slotPath) : null;
+        adoptNewerSlotActivity(agent, slotMeta);
         const terminalButAlive = (agent.status === "finished" || agent.status === "errored" || agent.status === "stopped") &&
             !agent.driver.closed &&
             agent.exitedAt !== null &&
@@ -313,6 +346,7 @@ const reconcileInterval = setInterval(() => {
     const now = Date.now();
     for (const agent of agents.values()) {
         reconcileAgent(agent, now);
+        refreshLiveSlotMetadata(agent, now);
     }
 }, 10000);
 reconcileInterval.unref();
@@ -329,7 +363,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.10.3",
+    version: "2.10.4",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
@@ -476,6 +510,7 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         waitReported: false,
         visibleStream: [],
         streamBuf: "",
+        slotLastActivity: now,
     };
     childProcess.on("error", (err) => {
         // Captured into the stderr tail for debugging. Not a visible provider stream
@@ -1148,7 +1183,7 @@ server.tool("list_agents", "List all agents with token-efficient core metrics (s
 // Tool 6: wait
 server.tool("wait", "Blocks until one or more sub-agents reach a reportable state (turn-finished, errored, stopped, or zombie_killed), returning exit code when known + local-time timestamp; or returns the live-job list after a 15-minute timeout. This is how you learn an agent finished — do NOT poll-loop. A `finished` agent with null exit_code is still alive and accepts `send_message`; a `stalled` agent is still ALIVE and does NOT end the wait. `verbose: true` adds each finished agent's `final_output`.", {
     verbose: z.boolean().optional().default(false),
-}, withMaintenance(async (params) => {
+}, withMaintenance(async (params, zombieRecords) => {
     const { verbose } = params;
     const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
     const TIMEOUT_MS = 15 * 60 * 1000;
@@ -1205,6 +1240,7 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     while (Date.now() < deadline) {
         await sleep(250);
         unreported = selectUnreported(Array.from(agents.values()));
+        zombieRecords.push(...runToolMaintenance());
         if (unreported.length > 0) {
             for (const a of unreported)
                 a.waitReported = true;

package/dist/zombie.js

@@ -122,6 +122,18 @@ export function drainZombieIntents(dir) {
 function defaultRunCommand(command, args) {
     execFileSync(command, args, { stdio: "ignore" });
 }
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+function livePid(pid) {
+    return typeof pid === "number" && Number.isInteger(pid) && pid > 0;
+}
 function defaultSleepMs(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -130,6 +142,7 @@ export function cullStaleSlots(dir, deps = {}) {
     const runCommand = deps.runCommand ?? defaultRunCommand;
     const sleepMs = deps.sleepMs ?? defaultSleepMs;
     const forceGraceMs = deps.forceGraceMs?.() ?? ZOMBIE_FORCE_GRACE_MS;
+    const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive;
     const p = deps.platform ?? platform();
     const records = [];
     let files;
@@ -146,8 +159,16 @@ export function cullStaleSlots(dir, deps = {}) {
             continue;
         if (now - meta.last_activity_ms <= ZOMBIE_LIVE_IDLE_MS)
             continue;
+        const ownerPid = livePid(meta.server_pid) ? meta.server_pid : null;
+        if (ownerPid !== null) {
+            try {
+                if (isProcessAlive(ownerPid))
+                    continue;
+            }
+            catch { }
+        }
         const pid = meta.child_pid;
-        if (pid && pid !== process.pid) {
+        if (ownerPid !== null && livePid(pid) && pid !== process.pid) {
             const commands = buildProcessTreeKillCommands(pid, p);
             try {
                 runCommand(commands.graceful.command, commands.graceful.args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretyc/subagent-mcp",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
   "keywords": [
     "mcp",