@heretyc/subagent-mcp 2.10.4 → 2.12.2

package/dist/orchestration/hook-core.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
-import { closeSync, openSync, readFileSync, readSync, statSync, } from "node:fs";
+import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import * as marker from "./marker.js";
 import * as reminder from "./reminder.js";
 import { cullStaleSlots, slotDir, ZOMBIE_FORCE_GRACE_MS, } from "../concurrency.js";
+import { appendUpdateNotice, readInstalledPackageInfo, } from "./update-check.js";
 /**
  * Provider-agnostic core of the UserPromptSubmit / SessionStart hook.
  *
@@ -37,9 +38,18 @@ export const REMINDER_PERIOD = 5;
  * === <repoRoot>/directives.
  */
 export function resolveDirectivesDir(env) {
-    const root = env.CLAUDE_PLUGIN_ROOT || env.PLUGIN_ROOT;
-    if (root) {
-        return join(root, "directives");
+    const rootEnvName = env.CLAUDE_PLUGIN_ROOT !== undefined
+        ? "CLAUDE_PLUGIN_ROOT"
+        : env.PLUGIN_ROOT !== undefined
+            ? "PLUGIN_ROOT"
+            : undefined;
+    if (rootEnvName) {
+        const root = env[rootEnvName] ?? "";
+        const directivesDir = join(root, "directives");
+        if (!isAbsolute(root) || !existsSync(directivesDir)) {
+            throw new Error(`${rootEnvName} must be an absolute path with an existing directives directory: ${root}`);
+        }
+        return directivesDir;
     }
     const here = dirname(fileURLToPath(import.meta.url));
     // Compiled location is dist/orchestration/hook-core.js, so ../../directives
@@ -50,8 +60,9 @@ export function resolveDirectivesDir(env) {
 }
 /** Read a directive asset by filename. On ANY failure return '' (fail-safe). */
 export function readDirective(env, fileName) {
+    const directivesDir = resolveDirectivesDir(env);
     try {
-        return readFileSync(join(resolveDirectivesDir(env), fileName), "utf8");
+        return readFileSync(join(directivesDir, fileName), "utf8");
     }
     catch {
         return "";
@@ -230,15 +241,13 @@ export function cullHookZombies(deps = hookCullDeps()) {
         return [];
     }
 }
-export function hookZombieReportText(records) {
-    const ids = Array.from(new Set(records.map((r) => r.agent_id))).filter(Boolean);
-    return ids.length > 0 ? `zombies: ${ids.join(",")}` : "";
-}
-export function appendHookZombieReport(out, records) {
-    const report = hookZombieReportText(records);
-    if (!report)
+function appendHookUpdateNotice(out, current, env) {
+    try {
+        return appendUpdateNotice(out, readInstalledPackageInfo().version, current, env);
+    }
+    catch {
         return out;
-    return out ? `${out}\n${report}` : report;
+    }
 }
 /**
  * Core hook logic. Returns the string to inject, or '' to inject nothing.
@@ -259,28 +268,29 @@ export function appendHookZombieReport(out, records) {
  */
 export function runHook(payload, env, adapter) {
     try {
-        const zombieRecords = cullHookZombies();
+        cullHookZombies();
         if (adapter.isSubagent(payload, env)) {
-            return appendHookZombieReport("", zombieRecords);
+            return "";
         }
         const cwd = payload.cwd || process.cwd();
         const current = sessionKey(payload);
+        const updateNoticeSessionId = typeof payload.session_id === "string" ? payload.session_id : undefined;
         if (current)
             marker.writeCurrentSession(cwd, current);
         if (!marker.isActive(cwd, current)) {
             // OFF: no claim machinery — just the per-prompt reminder cadence.
             const r = reminder.advance(cwd, current);
-            return appendHookZombieReport(cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted), zombieRecords);
+            return appendHookUpdateNotice(cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted), updateNoticeSessionId, env);
         }
         const m = marker.readMarker(cwd);
         const kind = classifyClaim(m.owner_session, m.baseline_turn, current);
         if (kind === "fresh" || kind === "carryover") {
             const turn = adapter.currentTurn(payload.transcript_path);
-            return appendHookZombieReport(claimAndEmit(cwd, current, turn, m, kind, env, adapter), zombieRecords);
+            return appendHookUpdateNotice(claimAndEmit(cwd, current, turn, m, kind, env, adapter), updateNoticeSessionId, env);
         }
         // SAME-SESSION: per-prompt reminder cadence, ON variant.
         const r = reminder.advance(cwd, current);
-        return appendHookZombieReport(cadenceEmit(env, adapter, adapter.reminderOnFile, adapter.shortOnFile, r.count, r.persisted), zombieRecords);
+        return appendHookUpdateNotice(cadenceEmit(env, adapter, adapter.reminderOnFile, adapter.shortOnFile, r.count, r.persisted), updateNoticeSessionId, env);
     }
     catch {
         // Any failure -> inject nothing. Never crash or stall the host turn.

package/dist/orchestration/pretool.js

@@ -1,5 +1,5 @@
 import { serverAlive } from "./liveness.js";
-import { cullHookZombies, hookZombieReportText } from "./hook-core.js";
+import { cullHookZombies } from "./hook-core.js";
 const NATIVE_SUBAGENT_TOOLS = new Set(["Task", "Agent", "Explore"]);
 function decision(permissionDecision, permissionDecisionReason, additionalContext) {
     return {
@@ -22,21 +22,21 @@ function decision(permissionDecision, permissionDecisionReason, additionalContex
  */
 export function runClaudePreTool(payload, env, now = Date.now()) {
     try {
-        const zombieReport = hookZombieReportText(cullHookZombies());
+        const zombieRecords = cullHookZombies();
         if (env.SUBAGENT_MCP_SUBAGENT === "1")
             return null;
-        const zombieAllowedDecision = zombieReport
-            ? decision("allow", "zombies culled; allowing requested tool.", zombieReport)
+        const maintenanceAllowedDecision = zombieRecords.length > 0
+            ? decision("allow", "maintenance completed; allowing requested tool.")
             : null;
         if (!serverAlive(now))
-            return zombieAllowedDecision;
+            return maintenanceAllowedDecision;
         const tool = typeof payload.tool_name === "string" ? payload.tool_name : "";
         if (!tool)
-            return zombieAllowedDecision;
+            return maintenanceAllowedDecision;
         if (NATIVE_SUBAGENT_TOOLS.has(tool)) {
-            return decision("deny", "subagent-mcp is alive; harness-native Task/Agent/Explore is not the sanctioned sub-agent channel. Use the subagent-mcp launch_agent MCP tool with the parent-process sentinel as prompt line 1.", zombieReport || undefined);
+            return decision("deny", "subagent-mcp is alive; harness-native Task/Agent/Explore is not the sanctioned sub-agent channel. Use the subagent-mcp launch_agent MCP tool with the parent-process sentinel as prompt line 1.");
         }
-        return zombieAllowedDecision;
+        return maintenanceAllowedDecision;
     }
     catch {
         return null;

package/dist/orchestration/update-check.js

@@ -0,0 +1,174 @@
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { readCheckForUpdates } from "../concurrency.js";
+import { stateDir } from "./marker.js";
+export const UPDATE_NOTICE_TEXT = "Notice: An improved version of subagent-mcp is available via the CLI command `subagent-mcp update` and can then be fully installed with `subagent-mcp setup`. This will fix security issues and improve user experience.";
+export const UPDATE_CHECK_TIMEOUT_MS = 2500;
+export const UPDATE_NOTICE_INTERVAL_MS = 12 * 60 * 60 * 1000;
+function pendingNoticePath() {
+    return join(stateDir, "update-notice.json");
+}
+function emitRecordPath() {
+    return join(stateDir, "update-notice-emitted.json");
+}
+function atomicWriteJson(path, value) {
+    try {
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+        writeFileSync(tmp, JSON.stringify(value), { encoding: "utf8", mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch {
+        // Fail-safe: update notices must never affect the host turn or MCP channel.
+    }
+}
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function removeFile(path) {
+    try {
+        rmSync(path, { force: true });
+    }
+    catch {
+        // Fail-safe.
+    }
+}
+export function clearUpdateNoticeState() {
+    removeFile(pendingNoticePath());
+    removeFile(emitRecordPath());
+}
+export function writePendingUpdateNotice(latestVersion, now = Date.now()) {
+    atomicWriteJson(pendingNoticePath(), {
+        latest_version: latestVersion,
+        checked_at: new Date(now).toISOString(),
+    });
+}
+export function readPendingUpdateNotice() {
+    const parsed = readJson(pendingNoticePath());
+    if (parsed &&
+        typeof parsed.latest_version === "string" &&
+        typeof parsed.checked_at === "string") {
+        return { latest_version: parsed.latest_version, checked_at: parsed.checked_at };
+    }
+    return undefined;
+}
+export function readUpdateNoticeEmitRecord() {
+    const parsed = readJson(emitRecordPath());
+    if (!parsed || typeof parsed.notified_at !== "number")
+        return undefined;
+    return {
+        notified_at: parsed.notified_at,
+        ...(typeof parsed.session_id === "string" ? { session_id: parsed.session_id } : {}),
+    };
+}
+function writeUpdateNoticeEmitRecord(record) {
+    atomicWriteJson(emitRecordPath(), record);
+}
+export function updateCheckEnvDisabled(env = process.env) {
+    const raw = env.SUBAGENT_UPDATE_CHECK;
+    return typeof raw === "string" && /^(?:0|false)$/i.test(raw.trim());
+}
+export function shouldCheckForUpdates(env = process.env, configPath) {
+    if (updateCheckEnvDisabled(env))
+        return false;
+    return readCheckForUpdates(configPath);
+}
+export function compareNumericVersions(a, b) {
+    const parse = (value) => {
+        const match = /^(\d+)\.(\d+)\.(\d+)(?:$|[^\d])/.exec(value.trim());
+        return match ? match.slice(1, 4).map((part) => Number.parseInt(part, 10)) : undefined;
+    };
+    const left = parse(a);
+    const right = parse(b);
+    if (!left || !right)
+        return 0;
+    for (let i = 0; i < 3; i++) {
+        if (left[i] < right[i])
+            return -1;
+        if (left[i] > right[i])
+            return 1;
+    }
+    return 0;
+}
+export function isVersionNewer(latest, installed) {
+    return compareNumericVersions(installed, latest) < 0;
+}
+export function readInstalledPackageInfo() {
+    return JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+}
+function registryPackageUrl(packageName, registryBaseUrl) {
+    const base = registryBaseUrl.replace(/\/+$/, "");
+    return `${base}/${packageName.replace("/", "%2F")}`;
+}
+async function fetchLatestVersion(packageName, deps) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), deps.timeoutMs);
+    try {
+        const response = await deps.fetch(registryPackageUrl(packageName, deps.registryBaseUrl), {
+            headers: { accept: "application/json" },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return undefined;
+        const metadata = (await response.json());
+        return typeof metadata?.["dist-tags"]?.latest === "string"
+            ? metadata["dist-tags"].latest
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function checkForNpmUpdate(deps = {}) {
+    try {
+        const env = deps.env ?? process.env;
+        if (!shouldCheckForUpdates(env, deps.configPath))
+            return;
+        const pkg = (deps.packageInfo ?? readInstalledPackageInfo)();
+        const latest = await fetchLatestVersion(pkg.name, {
+            fetch: deps.fetch ?? fetch,
+            registryBaseUrl: deps.registryBaseUrl ?? "https://registry.npmjs.org",
+            timeoutMs: deps.timeoutMs ?? UPDATE_CHECK_TIMEOUT_MS,
+        });
+        if (latest && isVersionNewer(latest, pkg.version)) {
+            writePendingUpdateNotice(latest, deps.now?.() ?? Date.now());
+        }
+    }
+    catch {
+        // Silent skip: never throw and never log to MCP stdio.
+    }
+}
+export function appendUpdateNotice(out, installedVersion, sessionId, env = process.env, now = Date.now(), configPath) {
+    try {
+        if (!out || !shouldCheckForUpdates(env, configPath))
+            return out;
+        const pending = readPendingUpdateNotice();
+        if (!pending)
+            return out;
+        if (!isVersionNewer(pending.latest_version, installedVersion)) {
+            removeFile(pendingNoticePath());
+            return out;
+        }
+        const emitted = readUpdateNoticeEmitRecord();
+        if (emitted?.session_id && sessionId && emitted.session_id === sessionId)
+            return out;
+        if (emitted && now - emitted.notified_at < UPDATE_NOTICE_INTERVAL_MS)
+            return out;
+        writeUpdateNoticeEmitRecord({
+            notified_at: now,
+            ...(sessionId ? { session_id: sessionId } : {}),
+        });
+        return `${out}\n${UPDATE_NOTICE_TEXT}`;
+    }
+    catch {
+        return out;
+    }
+}