@heretyc/subagent-mcp 2.12.16 → 2.12.18

package/dist/hooks/orchestration-claude.js

@@ -26,6 +26,11 @@ const SUBAGENT_ENTRYPOINTS = new Set([
 function finiteNumber(value) {
     return typeof value === "number" && Number.isFinite(value);
 }
+function isRealClaudeModel(value) {
+    return (typeof value === "string" &&
+        value.trim() !== "" &&
+        value.trim() !== "<synthetic>");
+}
 function readTranscriptTail(transcriptPath) {
     if (!transcriptPath)
         return null;
@@ -80,12 +85,12 @@ function liftClaudeUsageFromTranscript(transcriptPath) {
                 continue;
             if (msg.type !== "assistant" || !msg.message?.usage)
                 continue;
-            if (typeof msg.message.model !== "string")
-                return null;
+            if (!isRealClaudeModel(msg.message.model))
+                continue;
             const usage = msg.message.usage;
             return {
                 harness: "claude",
-                model: msg.message.model,
+                model: msg.message.model.trim(),
                 source_ref: transcriptPath,
                 usage: {
                     input: finiteNumber(usage.input_tokens) ? usage.input_tokens : 0,
@@ -97,6 +102,9 @@ function liftClaudeUsageFromTranscript(transcriptPath) {
                         ? usage.cache_read_input_tokens
                         : 0,
                 },
+                // Claude Code statusline receives context_window.used_percentage on its
+                // own stdin payload. Recent hook transcripts do not expose that object,
+                // so this adapter cannot pass it through without a hook-readable signal.
                 harnessPercentage: null,
             };
         }

package/dist/hooks/orchestration-codex.js

@@ -84,6 +84,25 @@ function stringField(value, key) {
     const child = value[key];
     return typeof child === "string" ? child : null;
 }
+function isSubagentSourceObject(source) {
+    if (!source || typeof source !== "object")
+        return false;
+    const record = source;
+    if (Object.prototype.hasOwnProperty.call(record, "subagent")) {
+        return true;
+    }
+    for (const kind of SUBAGENT_SOURCE_STRINGS) {
+        if (Object.prototype.hasOwnProperty.call(record, kind)) {
+            return true;
+        }
+    }
+    // Local Codex rollouts did not verify the subagent object schema. Accept the
+    // known subagent kind strings if Codex places them in a discriminator field.
+    const kind = record.kind;
+    const type = record.type;
+    return ((typeof kind === "string" && SUBAGENT_SOURCE_STRINGS.has(kind)) ||
+        (typeof type === "string" && SUBAGENT_SOURCE_STRINGS.has(type)));
+}
 function isTokenCountLine(obj) {
     if (obj.type === "token_count")
         return true;
@@ -166,11 +185,9 @@ export const codexAdapter = {
             return true;
         }
         const source = payload.source;
-        // 0.131+: source is an object whose keys name the subagent kind.
-        if (source && typeof source === "object") {
-            if (Object.prototype.hasOwnProperty.call(source, "subagent")) {
-                return true;
-            }
+        // 0.131+: source may be an object whose keys name the subagent kind.
+        if (isSubagentSourceObject(source)) {
+            return true;
         }
         // Older: source is a string enum.
         if (typeof source === "string" && SUBAGENT_SOURCE_STRINGS.has(source)) {

package/dist/index.js

@@ -572,7 +572,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that. launch_agent is code-capped at 2 spawn levels below the main orchestrator: depth 1 may launch depth 2 workers; depth 2 workers cannot spawn further.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.16",
+    version: "2.12.18",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"

package/dist/orchestration/hook-core.js

@@ -1,6 +1,7 @@
 import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, } from "node:fs";
+import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { dirname, isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import * as marker from "./marker.js";
 import * as reminder from "./reminder.js";
 import * as handoff from "./handoff.js";
@@ -38,11 +39,14 @@ const OWNER_CLAIM_CAP = 8;
 /**
  * Resolve the repo-root `directives/` dir at runtime. Honors an explicit plugin
  * root (Claude sets CLAUDE_PLUGIN_ROOT; a generic PLUGIN_ROOT is also accepted)
- * so the bundled plugin finds its assets wherever it is installed. Otherwise we
- * walk up from the COMPILED file location: dist/hooks/<x>.js -> ../../directives
- * === <repoRoot>/directives.
+ * so the bundled plugin finds its assets wherever it is installed, but only
+ * when that root is under an expected install prefix. Otherwise we walk up from
+ * the COMPILED file location: dist/hooks/<x>.js -> ../../directives ===
+ * <repoRoot>/directives.
  */
 export function resolveDirectivesDir(env) {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const compiledRoot = resolve(here, "..", "..");
     const rootEnvName = env.CLAUDE_PLUGIN_ROOT !== undefined
         ? "CLAUDE_PLUGIN_ROOT"
         : env.PLUGIN_ROOT !== undefined
@@ -51,17 +55,57 @@ export function resolveDirectivesDir(env) {
     if (rootEnvName) {
         const root = env[rootEnvName] ?? "";
         const directivesDir = join(root, "directives");
-        if (!isAbsolute(root) || !existsSync(directivesDir)) {
-            throw new Error(`${rootEnvName} must be an absolute path with an existing directives directory: ${root}`);
+        if (isAbsolute(root) &&
+            existsSync(directivesDir) &&
+            isTrustedPluginRoot(root, env, compiledRoot)) {
+            return directivesDir;
         }
-        return directivesDir;
     }
-    const here = dirname(fileURLToPath(import.meta.url));
     // Compiled location is dist/orchestration/hook-core.js, so ../../directives
     // is the repo root's directives dir; the entry shims live at dist/hooks/<x>.js
     // and import this module, but __dirname here is the hook-core module's own
     // dir. Two levels up from dist/orchestration is the repo root either way.
-    return join(here, "..", "..", "directives");
+    return join(compiledRoot, "directives");
+}
+function normalizePathKey(pathValue) {
+    let p = resolve(pathValue);
+    p = p.replace(/\\/g, "/");
+    if (process.platform === "win32") {
+        p = p.toLowerCase();
+    }
+    if (p.length > 1 && p.endsWith("/")) {
+        p = p.slice(0, -1);
+    }
+    return p;
+}
+function isPathUnder(pathValue, prefix) {
+    const child = normalizePathKey(pathValue);
+    const parent = normalizePathKey(prefix);
+    return child === parent || child.startsWith(parent + "/");
+}
+function installPrefixes(env, compiledRoot) {
+    const prefixes = [
+        compiledRoot,
+        env.npm_config_prefix,
+        env.PREFIX,
+        process.env.npm_config_prefix,
+        process.env.PREFIX,
+        process.platform === "win32" && env.APPDATA ? join(env.APPDATA, "npm") : undefined,
+        process.platform === "win32" && process.env.APPDATA
+            ? join(process.env.APPDATA, "npm")
+            : undefined,
+        join(dirname(process.execPath), ".."),
+        join(homedir(), ".claude", "plugins"),
+        join(homedir(), ".codex", "plugins", "cache"),
+        join(homedir(), ".codex", "plugins"),
+    ];
+    return [...new Set(prefixes.filter((p) => typeof p === "string" && p.length > 0))];
+}
+function isTrustedPluginRoot(root, env, compiledRoot) {
+    // Trust assumption: env roots are host-controlled only after they resolve
+    // under the package install, npm global prefix, or known plugin cache roots.
+    const resolvedRoot = resolve(root);
+    return installPrefixes(env, compiledRoot).some((prefix) => isPathUnder(resolvedRoot, prefix));
 }
 /** Read a directive asset by filename. On ANY failure return '' (fail-safe). */
 export function readDirective(env, fileName) {
@@ -171,7 +215,9 @@ export function sessionKey(payload) {
     }
     if (typeof payload.transcript_path === "string" &&
         payload.transcript_path.length > 0) {
-        return "tp-" + marker.hashKey(payload.transcript_path);
+        // Residual caveat: a genuinely moved transcript still re-keys. Prefer the
+        // host session_id when present, which remains the precedence above.
+        return "tp-" + marker.hashKey(normalizePathKey(payload.transcript_path));
     }
     return undefined;
 }
@@ -315,9 +361,10 @@ function updateMeteringForTurn(payload, env, adapter, current, turnIndex) {
         priorWindowFloor: prior?.window_floor ?? null,
     });
     metering.writeMetering(current, record);
-    // A valid harness-reported percentage stands on its own. Without one, a null
-    // window means the host is undetectable for this turn, even though the record
-    // is still persisted for observability and same-turn fail-safe agreement.
+    // A valid harness-reported percentage stands on its own. Without one, we fall
+    // back to the window: context_window_size is always numeric under the
+    // assumed-default ladder, so the null guard remains as a dead-man fallback only
+    // (the record is still persisted for observability and same-turn fail-safe agreement).
     const hasHarnessPercentage = typeof lifted.harnessPercentage === "number" &&
         Number.isFinite(lifted.harnessPercentage);
     return !hasHarnessPercentage && record.context_window_size === null;

package/dist/orchestration/metering.js

@@ -120,28 +120,44 @@ function maybeApplyLong(candidate, source, long, enabled) {
     }
     return { candidate, source };
 }
-export function resolveContextWindowDetailed(input) {
-    const normalized = normalizeModelId(input.modelId);
-    if (normalized === null) {
-        return { window: null, source: null, window_floor: null, contradiction: false };
-    }
-    const table = loadContextWindowTable();
-    if (table === null) {
-        return { window: null, source: null, window_floor: null, contradiction: false };
+function assumedDefaultResolution(window_floor) {
+    if (window_floor !== null && window_floor > DEFAULT_CONTEXT_WINDOW) {
+        return {
+            window: window_floor,
+            source: "assumed-default+floor",
+            window_floor,
+            contradiction: false,
+        };
     }
+    return {
+        window: DEFAULT_CONTEXT_WINDOW,
+        source: "assumed-default",
+        window_floor,
+        contradiction: false,
+    };
+}
+export function resolveContextWindowDetailed(input) {
     const promptSideTokens = finiteNumber(input.promptSideTokens)
         ? input.promptSideTokens
         : null;
     const priorFloor = usablePriorFloor(input.priorWindow, input.priorWindowSource, input.priorWindowFloor);
     const observedFloor = Math.max(promptSideTokens ?? 0, priorFloor ?? 0);
     const window_floor = observedFloor > 0 ? observedFloor : null;
+    const normalized = normalizeModelId(input.modelId);
+    if (normalized === null) {
+        return assumedDefaultResolution(window_floor);
+    }
+    const table = loadContextWindowTable();
+    if (table === null) {
+        return assumedDefaultResolution(window_floor);
+    }
     if (input.harness === "claude") {
         if (!/^claude-/i.test(normalized.base)) {
-            return { window: null, source: null, window_floor, contradiction: false };
+            return assumedDefaultResolution(window_floor);
         }
         const entry = table.claude[normalized.base] ?? table.family_defaults?.claude ?? null;
         if (entry === null) {
-            return { window: null, source: null, window_floor, contradiction: false };
+            return assumedDefaultResolution(window_floor);
         }
         const mapped = Object.prototype.hasOwnProperty.call(table.claude, normalized.base);
         let candidate = entry.default;
@@ -154,7 +170,7 @@ export function resolveContextWindowDetailed(input) {
                 source = "ratchet";
             }
             else {
-                return { window: null, source: "contradiction", window_floor, contradiction: true };
+                return { window: entry.long ?? entry.default, source: "contradiction", window_floor, contradiction: true };
             }
         }
         if (priorFloor !== null && priorFloor > candidate) {
@@ -163,7 +179,7 @@ export function resolveContextWindowDetailed(input) {
                 source = "prior";
             }
             else {
-                return { window: null, source: "contradiction", window_floor, contradiction: true };
+                return { window: entry.long ?? entry.default, source: "contradiction", window_floor, contradiction: true };
             }
         }
         return { window: candidate, source, window_floor, contradiction: false };
@@ -171,7 +187,7 @@ export function resolveContextWindowDetailed(input) {
     if (input.harness === "codex") {
         const entry = table.codex[normalized.base] ?? null;
         if (entry === null) {
-            return { window: null, source: null, window_floor, contradiction: false };
+            return assumedDefaultResolution(window_floor);
         }
         let candidate = entry.default;
         let source = "mapping";
@@ -182,7 +198,7 @@ export function resolveContextWindowDetailed(input) {
                 source = "ratchet";
             }
             else {
-                return { window: null, source: "contradiction", window_floor, contradiction: true };
+                return { window: entry.long ?? entry.default, source: "contradiction", window_floor, contradiction: true };
             }
         }
         if (priorFloor !== null && priorFloor > candidate) {
@@ -191,12 +207,12 @@ export function resolveContextWindowDetailed(input) {
                 source = "prior";
             }
             else {
-                return { window: null, source: "contradiction", window_floor, contradiction: true };
+                return { window: entry.long ?? entry.default, source: "contradiction", window_floor, contradiction: true };
             }
         }
         return { window: candidate, source, window_floor, contradiction: false };
     }
-    return { window: null, source: null, window_floor, contradiction: false };
+    return assumedDefaultResolution(window_floor);
 }
 export function resolveContextWindow(harness, modelId) {
     return resolveContextWindowDetailed({ harness, modelId }).window;

package/dist/orchestration/update-check.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { readCheckForUpdates } from "../concurrency.js";
 import { atomicWriteJson } from "./atomic-write.js";
 import { stateDir } from "./marker.js";
-export const UPDATE_NOTICE_TEXT = "Notice: An improved version of subagent-mcp is available via the CLI command `subagent-mcp update` and can then be fully installed with `subagent-mcp setup`. This will fix security issues and improve user experience.";
+export const UPDATE_NOTICE_TEXT = "Notice: An improved version of subagent-mcp is available via the CLI command `subagent-mcp update` and can then be fully installed with `subagent-mcp setup`. This may include security and user experience improvements.";
 export const UPDATE_CHECK_TIMEOUT_MS = 2500;
 export const UPDATE_NOTICE_INTERVAL_MS = 12 * 60 * 60 * 1000;
 function pendingNoticePath() {
@@ -165,6 +165,7 @@ export function appendUpdateNotice(out, installedVersion, sessionId, env = proce
             notified_at: now,
             ...(sessionId ? { session_id: sessionId } : {}),
         });
+        // Injection invariant: NEVER interpolate registry-sourced strings into injected text.
         return `${out}\n${UPDATE_NOTICE_TEXT}`;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretyc/subagent-mcp",
-  "version": "2.12.16",
+  "version": "2.12.18",
   "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
   "keywords": [
     "mcp",