@heretyc/subagent-mcp 2.12.16 → 2.12.17

package/dist/hooks/orchestration-codex.js

@@ -84,6 +84,25 @@ function stringField(value, key) {
     const child = value[key];
     return typeof child === "string" ? child : null;
 }
+function isSubagentSourceObject(source) {
+    if (!source || typeof source !== "object")
+        return false;
+    const record = source;
+    if (Object.prototype.hasOwnProperty.call(record, "subagent")) {
+        return true;
+    }
+    for (const kind of SUBAGENT_SOURCE_STRINGS) {
+        if (Object.prototype.hasOwnProperty.call(record, kind)) {
+            return true;
+        }
+    }
+    // Local Codex rollouts did not verify the subagent object schema. Accept the
+    // known subagent kind strings if Codex places them in a discriminator field.
+    const kind = record.kind;
+    const type = record.type;
+    return ((typeof kind === "string" && SUBAGENT_SOURCE_STRINGS.has(kind)) ||
+        (typeof type === "string" && SUBAGENT_SOURCE_STRINGS.has(type)));
+}
 function isTokenCountLine(obj) {
     if (obj.type === "token_count")
         return true;
@@ -166,11 +185,9 @@ export const codexAdapter = {
             return true;
         }
         const source = payload.source;
-        // 0.131+: source is an object whose keys name the subagent kind.
-        if (source && typeof source === "object") {
-            if (Object.prototype.hasOwnProperty.call(source, "subagent")) {
-                return true;
-            }
+        // 0.131+: source may be an object whose keys name the subagent kind.
+        if (isSubagentSourceObject(source)) {
+            return true;
         }
         // Older: source is a string enum.
         if (typeof source === "string" && SUBAGENT_SOURCE_STRINGS.has(source)) {

package/dist/index.js

@@ -572,7 +572,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that. launch_agent is code-capped at 2 spawn levels below the main orchestrator: depth 1 may launch depth 2 workers; depth 2 workers cannot spawn further.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.16",
+    version: "2.12.17",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"

package/dist/orchestration/hook-core.js

@@ -1,6 +1,7 @@
 import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, } from "node:fs";
+import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { dirname, isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import * as marker from "./marker.js";
 import * as reminder from "./reminder.js";
 import * as handoff from "./handoff.js";
@@ -38,11 +39,14 @@ const OWNER_CLAIM_CAP = 8;
 /**
  * Resolve the repo-root `directives/` dir at runtime. Honors an explicit plugin
  * root (Claude sets CLAUDE_PLUGIN_ROOT; a generic PLUGIN_ROOT is also accepted)
- * so the bundled plugin finds its assets wherever it is installed. Otherwise we
- * walk up from the COMPILED file location: dist/hooks/<x>.js -> ../../directives
- * === <repoRoot>/directives.
+ * so the bundled plugin finds its assets wherever it is installed, but only
+ * when that root is under an expected install prefix. Otherwise we walk up from
+ * the COMPILED file location: dist/hooks/<x>.js -> ../../directives ===
+ * <repoRoot>/directives.
  */
 export function resolveDirectivesDir(env) {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const compiledRoot = resolve(here, "..", "..");
     const rootEnvName = env.CLAUDE_PLUGIN_ROOT !== undefined
         ? "CLAUDE_PLUGIN_ROOT"
         : env.PLUGIN_ROOT !== undefined
@@ -51,17 +55,57 @@ export function resolveDirectivesDir(env) {
     if (rootEnvName) {
         const root = env[rootEnvName] ?? "";
         const directivesDir = join(root, "directives");
-        if (!isAbsolute(root) || !existsSync(directivesDir)) {
-            throw new Error(`${rootEnvName} must be an absolute path with an existing directives directory: ${root}`);
+        if (isAbsolute(root) &&
+            existsSync(directivesDir) &&
+            isTrustedPluginRoot(root, env, compiledRoot)) {
+            return directivesDir;
         }
-        return directivesDir;
     }
-    const here = dirname(fileURLToPath(import.meta.url));
     // Compiled location is dist/orchestration/hook-core.js, so ../../directives
     // is the repo root's directives dir; the entry shims live at dist/hooks/<x>.js
     // and import this module, but __dirname here is the hook-core module's own
     // dir. Two levels up from dist/orchestration is the repo root either way.
-    return join(here, "..", "..", "directives");
+    return join(compiledRoot, "directives");
+}
+function normalizePathKey(pathValue) {
+    let p = resolve(pathValue);
+    p = p.replace(/\\/g, "/");
+    if (process.platform === "win32") {
+        p = p.toLowerCase();
+    }
+    if (p.length > 1 && p.endsWith("/")) {
+        p = p.slice(0, -1);
+    }
+    return p;
+}
+function isPathUnder(pathValue, prefix) {
+    const child = normalizePathKey(pathValue);
+    const parent = normalizePathKey(prefix);
+    return child === parent || child.startsWith(parent + "/");
+}
+function installPrefixes(env, compiledRoot) {
+    const prefixes = [
+        compiledRoot,
+        env.npm_config_prefix,
+        env.PREFIX,
+        process.env.npm_config_prefix,
+        process.env.PREFIX,
+        process.platform === "win32" && env.APPDATA ? join(env.APPDATA, "npm") : undefined,
+        process.platform === "win32" && process.env.APPDATA
+            ? join(process.env.APPDATA, "npm")
+            : undefined,
+        join(dirname(process.execPath), ".."),
+        join(homedir(), ".claude", "plugins"),
+        join(homedir(), ".codex", "plugins", "cache"),
+        join(homedir(), ".codex", "plugins"),
+    ];
+    return [...new Set(prefixes.filter((p) => typeof p === "string" && p.length > 0))];
+}
+function isTrustedPluginRoot(root, env, compiledRoot) {
+    // Trust assumption: env roots are host-controlled only after they resolve
+    // under the package install, npm global prefix, or known plugin cache roots.
+    const resolvedRoot = resolve(root);
+    return installPrefixes(env, compiledRoot).some((prefix) => isPathUnder(resolvedRoot, prefix));
 }
 /** Read a directive asset by filename. On ANY failure return '' (fail-safe). */
 export function readDirective(env, fileName) {
@@ -171,7 +215,9 @@ export function sessionKey(payload) {
     }
     if (typeof payload.transcript_path === "string" &&
         payload.transcript_path.length > 0) {
-        return "tp-" + marker.hashKey(payload.transcript_path);
+        // Residual caveat: a genuinely moved transcript still re-keys. Prefer the
+        // host session_id when present, which remains the precedence above.
+        return "tp-" + marker.hashKey(normalizePathKey(payload.transcript_path));
     }
     return undefined;
 }

package/dist/orchestration/update-check.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { readCheckForUpdates } from "../concurrency.js";
 import { atomicWriteJson } from "./atomic-write.js";
 import { stateDir } from "./marker.js";
-export const UPDATE_NOTICE_TEXT = "Notice: An improved version of subagent-mcp is available via the CLI command `subagent-mcp update` and can then be fully installed with `subagent-mcp setup`. This will fix security issues and improve user experience.";
+export const UPDATE_NOTICE_TEXT = "Notice: An improved version of subagent-mcp is available via the CLI command `subagent-mcp update` and can then be fully installed with `subagent-mcp setup`. This may include security and user experience improvements.";
 export const UPDATE_CHECK_TIMEOUT_MS = 2500;
 export const UPDATE_NOTICE_INTERVAL_MS = 12 * 60 * 60 * 1000;
 function pendingNoticePath() {
@@ -165,6 +165,7 @@ export function appendUpdateNotice(out, installedVersion, sessionId, env = proce
             notified_at: now,
             ...(sessionId ? { session_id: sessionId } : {}),
         });
+        // Injection invariant: NEVER interpolate registry-sourced strings into injected text.
         return `${out}\n${UPDATE_NOTICE_TEXT}`;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretyc/subagent-mcp",
-  "version": "2.12.16",
+  "version": "2.12.17",
   "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
   "keywords": [
     "mcp",