@heretyc/subagent-mcp 2.12.13 → 2.12.15

package/dist/config-scaffold.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-subagent-mcp-config.jsonc — DO NOT EDIT.
-export const CONCURRENCY_SCAFFOLD = "// subagent-mcp - Global Subagent MCP Config\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for machine-wide subagent-mcp defaults that must be\r\n// available beside the compiled server.\r\n//\r\n// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE\r\n// across EVERY session, process, and user on this machine. There is NO\r\n// environment-variable override for the cap.\r\n//\r\n// RE-READ on every launch_agent call - edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Cap value rules:\r\n//   - missing / unset / non-integer / 0 / negative -> reset to default 20\r\n//   - 1 through 9                                  -> forced UP to minimum 10\r\n//   - 10 or greater                                -> used as-is\r\n//\r\n// checkForUpdates controls the silent npmjs update check started when the MCP\r\n// server connects. Default true. Set to false to skip the registry fetch and\r\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\r\n//\r\n// permissionsCeiling controls launch-time permissions posture:\r\n//   - auto   (default): shared engine gates unsafe/residue actions\r\n//   - manual: human approval for residue while still auto-denying DANGER\r\n//   - yolo:  preserve the historical bypass/danger-full-access path, except\r\n//            for non-bypassable config-file self-protection\r\n//\r\n// escalation applies only in auto mode. irreversible-only routes irreversible\r\n// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.\r\n//\r\n// strictReadParity controls logging only. Unparseable Codex approval payloads\r\n// always fail closed to ask; warn logs the construct, off silences that log.\r\n//\r\n// sandboxNetwork controls Codex workspace-write network access. Default false.\r\n// Set true only when sub-agents need network after permission approval.\r\n{\r\n  \"globalConcurrentSubagents\": 20,\r\n  \"checkForUpdates\": true,\r\n  \"permissionsCeiling\": \"auto\",\r\n  \"escalation\": \"irreversible-only\",\r\n  \"strictReadParity\": \"warn\",\r\n  \"sandboxNetwork\": false\r\n}\r\n";
+export const CONCURRENCY_SCAFFOLD = "// subagent-mcp - Global Subagent MCP Config\n// ------------------------------------------------------------------\n// SOLE source of truth for machine-wide subagent-mcp defaults that must be\n// available beside the compiled server.\n//\n// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE\n// across EVERY session, process, and user on this machine. There is NO\n// environment-variable override for the cap.\n//\n// RE-READ on every launch_agent call - edits take effect immediately, no\n// server restart required.\n//\n// Cap value rules:\n//   - missing / unset / non-integer / 0 / negative -> reset to default 20\n//   - 1 through 9                                  -> forced UP to minimum 10\n//   - 10 or greater                                -> used as-is\n//\n// checkForUpdates controls the silent npmjs update check started when the MCP\n// server connects. Default true. Set to false to skip the registry fetch and\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\n//\n// permissionsCeiling controls launch-time permissions posture:\n//   - auto   (default): shared engine gates unsafe/residue actions\n//   - manual: human approval for residue while still auto-denying DANGER\n//   - yolo:  preserve the historical bypass/danger-full-access path, except\n//            for non-bypassable config-file self-protection\n//\n// escalation applies only in auto mode. irreversible-only routes irreversible\n// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.\n//\n// strictReadParity controls logging only. Unparseable Codex approval payloads\n// always fail closed to ask; warn logs the construct, off silences that log.\n//\n// sandboxNetwork controls Codex workspace-write network access. Default false.\n// Set true only when sub-agents need network after permission approval.\n{\n  \"globalConcurrentSubagents\": 20,\n  \"checkForUpdates\": true,\n  \"permissionsCeiling\": \"auto\",\n  \"escalation\": \"irreversible-only\",\n  \"strictReadParity\": \"warn\",\n  \"sandboxNetwork\": false\n}\n";

package/dist/drivers.js

@@ -18,6 +18,7 @@ export const CLAUDE_SESSION_LIMIT = /^\s*you['’]ve hit your session limit\s*·
 export function isClaudeSessionLimit(text) {
     return CLAUDE_SESSION_LIMIT.test(text);
 }
+const TRANSIENT_FAILURE_RE = /\b429\b|\b(?:http(?:\/\d(?:\.\d)?)?|status|statuscode|status_code|code|error)\b[\s:=#-]*5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i;
 export function claudeMessageText(message) {
     if (message?.type === "assistant") {
         const content = message.message?.content;
@@ -167,7 +168,9 @@ function isElicitationMethod(method) {
 // Shape the `result` payload for an elicitation reply. When the RPC offered a
 // discrete option set, select only an exact case-insensitive label match and
 // echo its identifier; otherwise pass the answer through as text.
-function buildElicitationResult(options, answer) {
+function buildElicitationResult(options, answer, action = "answer") {
+    if (action === "decline")
+        return { action: "decline" };
     if (options && options.length > 0) {
         const norm = answer.trim().toLowerCase();
         const chosen = options.find((opt) => {
@@ -751,7 +754,8 @@ export class CodexAppServerDriver {
         else if (isJsonRpcId(message.id) &&
             typeof message.method === "string" &&
             isElicitationMethod(message.method)) {
-            void this.replyJsonRpc(message.id, buildElicitationResult(undefined, ""));
+            console.error(`[codex app-server driver] declining unhandled elicitation method: ${message.method}`);
+            void this.replyJsonRpc(message.id, buildElicitationResult(undefined, "", "decline"));
         }
         if (message.method === "turn/started" && message.params && typeof message.params === "object") {
             const turn = (message.params.turn ?? {});
@@ -819,7 +823,7 @@ export class CodexAppServerDriver {
     }
     fail(error) {
         const msg = error.message;
-        const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+        const transient = TRANSIENT_FAILURE_RE.test(msg);
         this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : error);
         this.process.fail(error);
         this.rejectPending(error);
@@ -1028,7 +1032,7 @@ export class ClaudeSdkDriver {
         catch (error) {
             if (!this.process.killed) {
                 const msg = error instanceof Error ? error.message : String(error);
-                const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+                const transient = TRANSIENT_FAILURE_RE.test(msg);
                 this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : new Error(msg));
                 this.closedFlag = true;
                 this.process.stderr.write(msg);
@@ -1038,8 +1042,11 @@ export class ClaudeSdkDriver {
     }
 }
 export async function createProviderDriver(options) {
-    if ((options.provider === "claude" && process.env.SUBAGENT_MOCK_CLAUDE_DRIVER === "jsonl") ||
-        (options.provider === "codex" && process.env.SUBAGENT_MOCK_CODEX_DRIVER === "jsonl")) {
+    const testSeamsEnabled = process.env.NODE_ENV === "test" || process.env.SUBAGENT_MCP_ENABLE_TEST_SEAMS === "1";
+    if (testSeamsEnabled &&
+        ((options.provider === "claude" && process.env.SUBAGENT_MOCK_CLAUDE_DRIVER === "jsonl") ||
+            (options.provider === "codex" && process.env.SUBAGENT_MOCK_CODEX_DRIVER === "jsonl"))) {
+        // Test seam: never honor mock-driver script env vars in production by default.
         const mockScript = process.env.SUBAGENT_MOCK_DRIVER_SCRIPT;
         const child = mockScript
             ? spawn(process.execPath, [mockScript, options.provider], {

package/dist/effort.js

@@ -6,9 +6,13 @@ export function mapModel(provider, model) {
     if (provider === "claude") {
         if (model === "opus" || model === "opus-4-8")
             return "claude-opus-4-8";
+        if (model === "sonnet")
+            return "claude-sonnet-4-6";
+        if (model === "haiku")
+            return "claude-haiku-4-5";
         if (model === "fable")
             return "claude-fable-5";
-        return model; // haiku, sonnet as-is
+        return model;
     }
     else {
         return model; // gpt-5.5
@@ -60,10 +64,8 @@ export function buildCommand(provider, model, effort, cwd, agentId) {
             const ucSettingsPath = join(ucSettingsDir, "settings.json");
             writeFileSync(ucSettingsPath, '{"ultracode":true}', { mode: 0o600 });
             args.push("--settings", ucSettingsPath);
-            args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
             return { args, ucSettingsPath, ucSettingsDir };
         }
-        args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
         return { args };
     }
     else {

package/dist/global-concurrency.jsonc

@@ -1,43 +1,43 @@
-// subagent-mcp - Global Subagent MCP Config
-// ------------------------------------------------------------------
-// SOLE source of truth for machine-wide subagent-mcp defaults that must be
-// available beside the compiled server.
-//
-// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
-// across EVERY session, process, and user on this machine. There is NO
-// environment-variable override for the cap.
-//
-// RE-READ on every launch_agent call - edits take effect immediately, no
-// server restart required.
-//
-// Cap value rules:
-//   - missing / unset / non-integer / 0 / negative -> reset to default 20
-//   - 1 through 9                                  -> forced UP to minimum 10
-//   - 10 or greater                                -> used as-is
-//
-// checkForUpdates controls the silent npmjs update check started when the MCP
-// server connects. Default true. Set to false to skip the registry fetch and
-// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
-//
-// permissionsCeiling controls launch-time permissions posture:
-//   - auto   (default): shared engine gates unsafe/residue actions
-//   - manual: human approval for residue while still auto-denying DANGER
-//   - yolo:  preserve the historical bypass/danger-full-access path, except
-//            for non-bypassable config-file self-protection
-//
-// escalation applies only in auto mode. irreversible-only routes irreversible
-// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
-//
-// strictReadParity controls logging only. Unparseable Codex approval payloads
-// always fail closed to ask; warn logs the construct, off silences that log.
-//
-// sandboxNetwork controls Codex workspace-write network access. Default false.
-// Set true only when sub-agents need network after permission approval.
-{
-  "globalConcurrentSubagents": 20,
-  "checkForUpdates": true,
-  "permissionsCeiling": "auto",
-  "escalation": "irreversible-only",
-  "strictReadParity": "warn",
-  "sandboxNetwork": false
-}
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
+}

package/dist/global-subagent-mcp-config.jsonc

@@ -1,43 +1,43 @@
-// subagent-mcp - Global Subagent MCP Config
-// ------------------------------------------------------------------
-// SOLE source of truth for machine-wide subagent-mcp defaults that must be
-// available beside the compiled server.
-//
-// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
-// across EVERY session, process, and user on this machine. There is NO
-// environment-variable override for the cap.
-//
-// RE-READ on every launch_agent call - edits take effect immediately, no
-// server restart required.
-//
-// Cap value rules:
-//   - missing / unset / non-integer / 0 / negative -> reset to default 20
-//   - 1 through 9                                  -> forced UP to minimum 10
-//   - 10 or greater                                -> used as-is
-//
-// checkForUpdates controls the silent npmjs update check started when the MCP
-// server connects. Default true. Set to false to skip the registry fetch and
-// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
-//
-// permissionsCeiling controls launch-time permissions posture:
-//   - auto   (default): shared engine gates unsafe/residue actions
-//   - manual: human approval for residue while still auto-denying DANGER
-//   - yolo:  preserve the historical bypass/danger-full-access path, except
-//            for non-bypassable config-file self-protection
-//
-// escalation applies only in auto mode. irreversible-only routes irreversible
-// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
-//
-// strictReadParity controls logging only. Unparseable Codex approval payloads
-// always fail closed to ask; warn logs the construct, off silences that log.
-//
-// sandboxNetwork controls Codex workspace-write network access. Default false.
-// Set true only when sub-agents need network after permission approval.
-{
-  "globalConcurrentSubagents": 20,
-  "checkForUpdates": true,
-  "permissionsCeiling": "auto",
-  "escalation": "irreversible-only",
-  "strictReadParity": "warn",
-  "sandboxNetwork": false
-}
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
+}

package/dist/hooks/orchestration-codex.js

@@ -3,7 +3,7 @@ import { pathToFileURL } from "node:url";
 import { claimAndEmit, classifyOwnerClaim, computeEffectiveActive, countJsonlType, cullHookZombies, ownerKey, runHook, TRANSCRIPT_READ_CAP, } from "../orchestration/hook-core.js";
 import * as marker from "../orchestration/marker.js";
 import { resolveContextWindow, } from "../orchestration/metering.js";
-import { hasParentMarker } from "../launch-prompt.js";
+import { isParentProcessMarkerFirstLine } from "../launch-prompt.js";
 /**
  * Codex CLI hook entry. Branches on payload.hook_event_name:
  *   - 'SessionStart'     -> if active and not a subagent, emit FULL + the ON
@@ -174,7 +174,7 @@ export const codexAdapter = {
         if (typeof source === "string" && SUBAGENT_SOURCE_STRINGS.has(source)) {
             return true;
         }
-        return hasParentMarker(payload.prompt);
+        return isParentProcessMarkerFirstLine(payload.prompt);
     },
     // Count JSONL lines whose parsed object.type === 'turn_context'. Delegates to
     // the bounded counter (reads at most the trailing window so a huge/

package/dist/index.js

@@ -393,10 +393,11 @@ function withMaintenance(handler, options = {}) {
 }
 export function classifyFailureReason(reason, stderr) {
     const text = `${reason}\n${stderr}`;
-    return /\b429\b|\b5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(text)
+    return TRANSIENT_FAILURE_RE.test(text)
         ? "transient_provider"
         : "permanent";
 }
+const TRANSIENT_FAILURE_RE = /\b429\b|\b(?:http(?:\/\d(?:\.\d)?)?|status|statuscode|status_code|code|error)\b[\s:=#-]*5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i;
 function buildFailoverNote(skipped, winner) {
     const top = skipped[0];
     const topLabel = `${top.model}@${top.effort} (${top.provider})`;
@@ -438,10 +439,9 @@ export function isClaudeBackgroundWakeLine(line) {
             return true;
         if (marker.includes("taskoutput") && marker.includes("complete"))
             return true;
-        // No concrete Claude bg-task-complete JSONL fixture exists in-repo. As a
-        // backstop, any non-result JSONL activity after a finished turn means the
-        // still-live SDK stream observed something new and needs a nudge.
-        return true;
+        // Only concrete Claude bg-task-complete markers should wake the parked SDK
+        // loop; unrelated post-turn JSONL activity is not a resume signal.
+        return false;
     }
     catch {
         return false;
@@ -572,7 +572,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that. launch_agent is code-capped at 2 spawn levels below the main orchestrator: depth 1 may launch depth 2 workers; depth 2 workers cannot spawn further.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.13",
+    version: "2.12.15",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"

package/dist/launch-prompt.js

@@ -7,7 +7,7 @@
 // fail-safe-ON default from recursively orchestrating child sessions (fork-bomb
 // prevention). Idempotent, silent, never mutates the prompt body.
 export const MARKER = "<this is a request from a parent process>";
-export function hasParentMarker(prompt) {
+export function isParentProcessMarkerFirstLine(prompt) {
     if (typeof prompt !== "string")
         return false;
     const head = prompt.slice(0, 4096);
@@ -19,6 +19,7 @@ export function hasParentMarker(prompt) {
         firstLine = firstLine.slice(1);
     return firstLine.startsWith(MARKER);
 }
+export const hasParentMarker = isParentProcessMarkerFirstLine;
 // Return `prompt` with MARKER guaranteed as its literal first line.
 // - First line = position 0 up to the first "\n"; a trailing "\r" (CRLF) is
 //   stripped before comparison only.
@@ -29,7 +30,7 @@ export function hasParentMarker(prompt) {
 // - Present (after BOM-strip) -> returned unchanged (no duplicate).
 // - Absent -> MARKER + "\n" + prompt.
 export function ensureParentMarker(prompt) {
-    if (hasParentMarker(prompt))
+    if (isParentProcessMarkerFirstLine(prompt))
         return prompt;
     return MARKER + "\n" + prompt;
 }

package/dist/orchestration/hook-core.js

@@ -65,8 +65,8 @@ export function resolveDirectivesDir(env) {
 }
 /** Read a directive asset by filename. On ANY failure return '' (fail-safe). */
 export function readDirective(env, fileName) {
-    const directivesDir = resolveDirectivesDir(env);
     try {
+        const directivesDir = resolveDirectivesDir(env);
         return readFileSync(join(directivesDir, fileName), "utf8");
     }
     catch {
@@ -356,13 +356,6 @@ export function computeEffectiveActive(cwd, current, now, meteringUndetectableFa
  */
 export function claimAndEmit(cwd, current, turn, m, kind, env, adapter, effectiveActive = true, phase = "normal", usedPercentage = null, updateNoticeSessionId, fullBodyFile) {
     const firstCarryover = kind === "carryover" && !m.carryover_ack;
-    claimOwner(m, current, turn, Date.now());
-    if (kind === "carryover") {
-        m.provenance = "carried-over";
-        m.carryover_ack = true;
-    }
-    marker.writeMarker(cwd, m);
-    reminder.rebase(cwd, current, 0);
     const full = fullBodyFile
         ? bodyFromDirective(readDirective(env, fullBodyFile))
         : bodyFromDirective(readDirective(env, adapter.fullDirectiveFile)) +
@@ -385,6 +378,15 @@ export function claimAndEmit(cwd, current, turn, m, kind, env, adapter, effectiv
         kind: firstCarryover ? "carryover" : "directive",
         isLong: true,
     };
+    if (emission.body.trim() === "")
+        return "";
+    claimOwner(m, current, turn, Date.now());
+    if (kind === "carryover") {
+        m.provenance = "carried-over";
+        m.carryover_ack = true;
+    }
+    marker.writeMarker(cwd, m);
+    reminder.rebase(cwd, current, 0);
     return composeHookUpdateNotice(env, updateNoticeSessionId, emission, effectiveActive, phase, usedPercentage);
 }
 function hookCullDeps(env = process.env) {

package/dist/orchestration/liveness.js

@@ -1,4 +1,4 @@
-import { mkdirSync, statSync } from "node:fs";
+import { mkdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile } from "./atomic-write.js";
 import { stateDir } from "./marker.js";
@@ -10,16 +10,37 @@ export function alivePath() {
 export function touchAlive(now = Date.now()) {
     try {
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        atomicWriteFile(alivePath(), `${now}\n`, { encoding: "utf8", mode: 0o600 });
+        atomicWriteFile(alivePath(), `${now}\npid=${process.pid}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
     }
     catch {
         // Hooks fail open when liveness cannot be observed.
     }
 }
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function serverAlive(now = Date.now()) {
     try {
         const s = statSync(alivePath());
-        return now - s.mtimeMs <= LIVENESS_TTL_MS;
+        if (now - s.mtimeMs > LIVENESS_TTL_MS)
+            return false;
+        const raw = readFileSync(alivePath(), "utf8");
+        const pid = raw
+            .split(/\r?\n/)
+            .map((line) => /^pid=(\d+)$/.exec(line)?.[1])
+            .find((value) => value !== undefined);
+        if (!pid)
+            return false;
+        return pidAlive(Number(pid));
     }
     catch {
         return false;

package/dist/orchestration/marker.js

@@ -14,16 +14,17 @@ export const ANON_PREFIX = "anon-";
 export const stateDir = markerDir;
 /**
  * Canonicalize a working directory so two spellings of the same path hash
- * identically. Strip a leading Windows \\?\ extended-length prefix FIRST (on
- * the raw input) — resolve() canonicalizes that prefix away, so stripping after
- * resolve is dead code and an extended-length cwd would otherwise hash
- * differently from its plain form. Then resolve() to an absolute path; use
- * forward slashes; lowercase on win32 (the FS is case-insensitive there); drop
- * a trailing slash.
+ * identically. Strip Windows extended-length prefixes first on the raw input.
+ * Handle \\?\UNC\ before the generic \\?\ form so UNC paths keep their network
+ * root. Then resolve() to an absolute path; use forward slashes; lowercase on
+ * win32 (the FS is case-insensitive there); drop a trailing slash.
  */
 export function normalizeCwd(cwd) {
     let raw = cwd;
-    if (raw.startsWith("\\\\?\\")) {
+    if (raw.startsWith("\\\\?\\UNC\\")) {
+        raw = "\\\\" + raw.slice(8);
+    }
+    else if (raw.startsWith("\\\\?\\")) {
         raw = raw.slice(4);
     }
     let p = resolve(raw);
@@ -60,50 +61,12 @@ export function disablePath(sessionKey) {
 export function enablePath(sessionKey) {
     return join(stateDir, `orch-enable-${hashKey(sessionKey)}.json`);
 }
-function cwdDisablePath(cwd) {
-    return join(stateDir, `orch-disable-${cwdHash(cwd)}.json`);
-}
 export function sessionPointerPath(cwd) {
     return join(stateDir, `orch-session-${cwdHash(cwd)}.json`);
 }
 export function serverSessionPointerPath(cwd, serverKey = process.ppid) {
     return join(stateDir, `orch-session-${cwdHash(cwd)}-${hashKey(String(serverKey))}.json`);
 }
-/**
- * Enable orchestration for cwd. ALWAYS overwrites — re-enabling re-baselines by
- * clearing owner_session/baseline_turn back to null so the next hook turn
- * re-claims and re-baselines.
- */
-export function enable(cwd) {
-    try {
-        // Restrictive POSIX perms: the marker dir/file live in the shared,
-        // world-readable /tmp on Linux/macOS and persist a session_id. mode 0o700/
-        // 0o600 keeps them owner-only so other local users cannot read the
-        // session_id or enumerate which projects have orchestration enabled. mode is
-        // ignored on Windows (harmless; tmpdir is already per-user there).
-        mkdirSync(markerDir, { recursive: true, mode: 0o700 });
-        const state = {
-            owner_session: null,
-            baseline_turn: null,
-            claimed_at: null,
-            owners: {},
-            provenance: "user-enabled",
-            carryover_ack: false,
-        };
-        atomicWriteJson(markerPath(cwd), state, { encoding: "utf8", mode: 0o600 });
-        try {
-            unlinkSync(cwdDisablePath(cwd));
-        }
-        catch (e) {
-            if (e?.code !== "ENOENT") {
-                // Fail-safe: enable still succeeds if stale disable cleanup fails.
-            }
-        }
-    }
-    catch {
-        // Fail-safe: never throw to the caller.
-    }
-}
 export function writeDisable(sessionKey) {
     if (!isSessionScopedKey(sessionKey))
         return;
@@ -300,7 +263,7 @@ export function readMarker(cwd) {
 }
 export function writeMarker(cwd, obj) {
     try {
-        // Owner-only perms (see enable()): the marker persists owner_session.
+        // Owner-only perms: the marker persists owner_session.
         mkdirSync(markerDir, { recursive: true, mode: 0o700 });
         atomicWriteJson(markerPath(cwd), obj, { encoding: "utf8", mode: 0o600 });
     }

package/dist/orchestration/model-mode.js

@@ -94,7 +94,7 @@ export function setMode(cwd, mode, now = Date.now()) {
 }
 export function gateLaunch(cwd, selectors, now = Date.now()) {
     const r = resolveMode(cwd, now);
-    const supplied = !!(selectors.provider || selectors.model || selectors.effort);
+    const supplied = [selectors.provider, selectors.model, selectors.effort].some((value) => value !== undefined);
     if (r.mode === "user-approved-overrides") {
         return { allowed: true, mode: r.mode, reverted: r.reverted };
     }