@heretyc/subagent-mcp 2.12.13 → 2.12.14

package/dist/drivers.js

@@ -18,6 +18,7 @@ export const CLAUDE_SESSION_LIMIT = /^\s*you['’]ve hit your session limit\s*·
 export function isClaudeSessionLimit(text) {
     return CLAUDE_SESSION_LIMIT.test(text);
 }
+const TRANSIENT_FAILURE_RE = /\b429\b|\b(?:http(?:\/\d(?:\.\d)?)?|status|statuscode|status_code|code|error)\b[\s:=#-]*5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i;
 export function claudeMessageText(message) {
     if (message?.type === "assistant") {
         const content = message.message?.content;
@@ -167,7 +168,9 @@ function isElicitationMethod(method) {
 // Shape the `result` payload for an elicitation reply. When the RPC offered a
 // discrete option set, select only an exact case-insensitive label match and
 // echo its identifier; otherwise pass the answer through as text.
-function buildElicitationResult(options, answer) {
+function buildElicitationResult(options, answer, action = "answer") {
+    if (action === "decline")
+        return { action: "decline" };
     if (options && options.length > 0) {
         const norm = answer.trim().toLowerCase();
         const chosen = options.find((opt) => {
@@ -751,7 +754,8 @@ export class CodexAppServerDriver {
         else if (isJsonRpcId(message.id) &&
             typeof message.method === "string" &&
             isElicitationMethod(message.method)) {
-            void this.replyJsonRpc(message.id, buildElicitationResult(undefined, ""));
+            console.error(`[codex app-server driver] declining unhandled elicitation method: ${message.method}`);
+            void this.replyJsonRpc(message.id, buildElicitationResult(undefined, "", "decline"));
         }
         if (message.method === "turn/started" && message.params && typeof message.params === "object") {
             const turn = (message.params.turn ?? {});
@@ -819,7 +823,7 @@ export class CodexAppServerDriver {
     }
     fail(error) {
         const msg = error.message;
-        const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+        const transient = TRANSIENT_FAILURE_RE.test(msg);
         this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : error);
         this.process.fail(error);
         this.rejectPending(error);
@@ -1028,7 +1032,7 @@ export class ClaudeSdkDriver {
         catch (error) {
             if (!this.process.killed) {
                 const msg = error instanceof Error ? error.message : String(error);
-                const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+                const transient = TRANSIENT_FAILURE_RE.test(msg);
                 this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : new Error(msg));
                 this.closedFlag = true;
                 this.process.stderr.write(msg);
@@ -1038,8 +1042,11 @@ export class ClaudeSdkDriver {
     }
 }
 export async function createProviderDriver(options) {
-    if ((options.provider === "claude" && process.env.SUBAGENT_MOCK_CLAUDE_DRIVER === "jsonl") ||
-        (options.provider === "codex" && process.env.SUBAGENT_MOCK_CODEX_DRIVER === "jsonl")) {
+    const testSeamsEnabled = process.env.NODE_ENV === "test" || process.env.SUBAGENT_MCP_ENABLE_TEST_SEAMS === "1";
+    if (testSeamsEnabled &&
+        ((options.provider === "claude" && process.env.SUBAGENT_MOCK_CLAUDE_DRIVER === "jsonl") ||
+            (options.provider === "codex" && process.env.SUBAGENT_MOCK_CODEX_DRIVER === "jsonl"))) {
+        // Test seam: never honor mock-driver script env vars in production by default.
         const mockScript = process.env.SUBAGENT_MOCK_DRIVER_SCRIPT;
         const child = mockScript
             ? spawn(process.execPath, [mockScript, options.provider], {

package/dist/effort.js

@@ -6,9 +6,13 @@ export function mapModel(provider, model) {
     if (provider === "claude") {
         if (model === "opus" || model === "opus-4-8")
             return "claude-opus-4-8";
+        if (model === "sonnet")
+            return "claude-sonnet-4-6";
+        if (model === "haiku")
+            return "claude-haiku-4-5";
         if (model === "fable")
             return "claude-fable-5";
-        return model; // haiku, sonnet as-is
+        return model;
     }
     else {
         return model; // gpt-5.5
@@ -60,10 +64,8 @@ export function buildCommand(provider, model, effort, cwd, agentId) {
             const ucSettingsPath = join(ucSettingsDir, "settings.json");
             writeFileSync(ucSettingsPath, '{"ultracode":true}', { mode: 0o600 });
             args.push("--settings", ucSettingsPath);
-            args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
             return { args, ucSettingsPath, ucSettingsDir };
         }
-        args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
         return { args };
     }
     else {

package/dist/global-concurrency.jsonc

@@ -1,43 +1,43 @@
-// subagent-mcp - Global Subagent MCP Config
-// ------------------------------------------------------------------
-// SOLE source of truth for machine-wide subagent-mcp defaults that must be
-// available beside the compiled server.
-//
-// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
-// across EVERY session, process, and user on this machine. There is NO
-// environment-variable override for the cap.
-//
-// RE-READ on every launch_agent call - edits take effect immediately, no
-// server restart required.
-//
-// Cap value rules:
-//   - missing / unset / non-integer / 0 / negative -> reset to default 20
-//   - 1 through 9                                  -> forced UP to minimum 10
-//   - 10 or greater                                -> used as-is
-//
-// checkForUpdates controls the silent npmjs update check started when the MCP
-// server connects. Default true. Set to false to skip the registry fetch and
-// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
-//
-// permissionsCeiling controls launch-time permissions posture:
-//   - auto   (default): shared engine gates unsafe/residue actions
-//   - manual: human approval for residue while still auto-denying DANGER
-//   - yolo:  preserve the historical bypass/danger-full-access path, except
-//            for non-bypassable config-file self-protection
-//
-// escalation applies only in auto mode. irreversible-only routes irreversible
-// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
-//
-// strictReadParity controls logging only. Unparseable Codex approval payloads
-// always fail closed to ask; warn logs the construct, off silences that log.
-//
-// sandboxNetwork controls Codex workspace-write network access. Default false.
-// Set true only when sub-agents need network after permission approval.
-{
-  "globalConcurrentSubagents": 20,
-  "checkForUpdates": true,
-  "permissionsCeiling": "auto",
-  "escalation": "irreversible-only",
-  "strictReadParity": "warn",
-  "sandboxNetwork": false
-}
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
+}

package/dist/global-subagent-mcp-config.jsonc

@@ -1,43 +1,43 @@
-// subagent-mcp - Global Subagent MCP Config
-// ------------------------------------------------------------------
-// SOLE source of truth for machine-wide subagent-mcp defaults that must be
-// available beside the compiled server.
-//
-// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
-// across EVERY session, process, and user on this machine. There is NO
-// environment-variable override for the cap.
-//
-// RE-READ on every launch_agent call - edits take effect immediately, no
-// server restart required.
-//
-// Cap value rules:
-//   - missing / unset / non-integer / 0 / negative -> reset to default 20
-//   - 1 through 9                                  -> forced UP to minimum 10
-//   - 10 or greater                                -> used as-is
-//
-// checkForUpdates controls the silent npmjs update check started when the MCP
-// server connects. Default true. Set to false to skip the registry fetch and
-// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
-//
-// permissionsCeiling controls launch-time permissions posture:
-//   - auto   (default): shared engine gates unsafe/residue actions
-//   - manual: human approval for residue while still auto-denying DANGER
-//   - yolo:  preserve the historical bypass/danger-full-access path, except
-//            for non-bypassable config-file self-protection
-//
-// escalation applies only in auto mode. irreversible-only routes irreversible
-// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
-//
-// strictReadParity controls logging only. Unparseable Codex approval payloads
-// always fail closed to ask; warn logs the construct, off silences that log.
-//
-// sandboxNetwork controls Codex workspace-write network access. Default false.
-// Set true only when sub-agents need network after permission approval.
-{
-  "globalConcurrentSubagents": 20,
-  "checkForUpdates": true,
-  "permissionsCeiling": "auto",
-  "escalation": "irreversible-only",
-  "strictReadParity": "warn",
-  "sandboxNetwork": false
-}
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
+}

package/dist/index.js

@@ -393,10 +393,11 @@ function withMaintenance(handler, options = {}) {
 }
 export function classifyFailureReason(reason, stderr) {
     const text = `${reason}\n${stderr}`;
-    return /\b429\b|\b5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(text)
+    return TRANSIENT_FAILURE_RE.test(text)
         ? "transient_provider"
         : "permanent";
 }
+const TRANSIENT_FAILURE_RE = /\b429\b|\b(?:http(?:\/\d(?:\.\d)?)?|status|statuscode|status_code|code|error)\b[\s:=#-]*5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i;
 function buildFailoverNote(skipped, winner) {
     const top = skipped[0];
     const topLabel = `${top.model}@${top.effort} (${top.provider})`;
@@ -438,10 +439,9 @@ export function isClaudeBackgroundWakeLine(line) {
             return true;
         if (marker.includes("taskoutput") && marker.includes("complete"))
             return true;
-        // No concrete Claude bg-task-complete JSONL fixture exists in-repo. As a
-        // backstop, any non-result JSONL activity after a finished turn means the
-        // still-live SDK stream observed something new and needs a nudge.
-        return true;
+        // Only concrete Claude bg-task-complete markers should wake the parked SDK
+        // loop; unrelated post-turn JSONL activity is not a resume signal.
+        return false;
     }
     catch {
         return false;
@@ -572,7 +572,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that. launch_agent is code-capped at 2 spawn levels below the main orchestrator: depth 1 may launch depth 2 workers; depth 2 workers cannot spawn further.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.13",
+    version: "2.12.14",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"

package/dist/pending-permissions.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 const PARK_TIMEOUT_MS = 5 * 60 * 1000;
 const PER_AGENT_FIFO_CAP = 16;
+const PENDING_PERMISSION_HISTORY_CAP = 200;
 function publicRecord(record) {
     // record may be a StoredPendingPermission at runtime, which carries a live
     // NodeJS.Timeout and a resolve closure. Both are non-serializable (the timer
@@ -57,7 +58,7 @@ export class PendingPermissionManager {
                 answer_reason: "pending-queue cap reached",
             };
             this.telemetry.cap_overflow_auto_denies += 1;
-            this.history.push(publicRecord(record));
+            this.remember(record);
             console.error(`[permissions] auto-deny ${record.request_id} for agent ${record.agent_id}: pending-queue cap reached`);
             void Promise.resolve(input.resolve({
                 request_id: record.request_id,
@@ -125,6 +126,7 @@ export class PendingPermissionManager {
             if (record)
                 closed.push(await this.finish(record, "deny", reason));
         }
+        this.askedCountByAgent.delete(agentId);
         return closed;
     }
     async autoDeny(requestId, reason) {
@@ -141,8 +143,10 @@ export class PendingPermissionManager {
         const queue = (this.pendingByAgent.get(record.agent_id) ?? []).filter((id) => id !== record.request_id);
         if (queue.length > 0)
             this.pendingByAgent.set(record.agent_id, queue);
-        else
+        else {
             this.pendingByAgent.delete(record.agent_id);
+            this.askedCountByAgent.delete(record.agent_id);
+        }
         record.state = autoRule ? "auto_answered" : "answered";
         record.auto_answer_rule = autoRule;
         record.answered_at = Date.now();
@@ -160,10 +164,16 @@ export class PendingPermissionManager {
             record.state = "errored";
             record.answer_reason = e instanceof Error ? e.message : String(e);
         }
-        this.history.push(publicRecord(record));
+        this.remember(record);
         this.emitQueue(record.agent_id);
         return publicRecord(record);
     }
+    remember(record) {
+        this.history.push(publicRecord(record));
+        if (this.history.length > PENDING_PERMISSION_HISTORY_CAP) {
+            this.history.splice(0, this.history.length - PENDING_PERMISSION_HISTORY_CAP);
+        }
+    }
     emitQueue(agentId) {
         const count = this.pendingCount(agentId);
         for (const listener of this.queueListeners)