@heretyc/subagent-mcp 2.12.3 → 2.12.5-beta.0

package/dist/concurrency.js

@@ -1,13 +1,18 @@
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
-import { platform } from "node:os";
-import { join } from "node:path";
+import { homedir, platform } from "node:os";
+import { dirname, join, parse as parsePath, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONCURRENCY_SCAFFOLD } from "./config-scaffold.js";
 import { cullStaleSlots, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, parseSlotMetadata, readSlotMetadata, slotPathForAgent, writeSlotMetadata, } from "./zombie.js";
 export const DEFAULT_CAP = 20;
 export const MIN_CAP = 10;
 export const DEFAULT_CHECK_FOR_UPDATES = true;
-export const CONFIG_FILENAME = "global-concurrency.jsonc";
+export const DEFAULT_PERMISSIONS_CEILING = "auto";
+export const DEFAULT_ESCALATION = "irreversible-only";
+export const DEFAULT_STRICT_READ_PARITY = "warn";
+export const CONFIG_FILENAME = "global-subagent-mcp-config.jsonc";
+export const LEGACY_CONFIG_FILENAME = "global-concurrency.jsonc";
 export { cullStaleSlots, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, parseSlotMetadata, readSlotMetadata, slotPathForAgent, writeSlotMetadata, };
 export function clampCap(raw) {
     if (!Number.isInteger(raw))
@@ -22,6 +27,13 @@ export function clampCap(raw) {
 export function stripJsoncComments(text) {
     return text.replace(/^\s*\/\/.*$/gm, "");
 }
+function parseJsonObject(text) {
+    const parsed = JSON.parse(stripJsoncComments(text));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("expected JSON object");
+    }
+    return parsed;
+}
 export function parseConcurrencyConfig(text) {
     let raw;
     try {
@@ -42,34 +54,336 @@ export function parseCheckForUpdatesConfig(text) {
         return DEFAULT_CHECK_FOR_UPDATES;
     }
 }
+export function parsePermissionsCeilingConfig(text) {
+    try {
+        const raw = parseJsonObject(text).permissionsCeiling;
+        if (raw === "yolo" || raw === "manual" || raw === "auto")
+            return raw;
+        return raw === undefined ? DEFAULT_PERMISSIONS_CEILING : "manual";
+    }
+    catch {
+        return "manual";
+    }
+}
+export function parseEscalationConfig(text) {
+    try {
+        const raw = parseJsonObject(text).escalation;
+        return raw === "irreversible-only" || raw === "off" ? raw : DEFAULT_ESCALATION;
+    }
+    catch {
+        return DEFAULT_ESCALATION;
+    }
+}
+export function parseStrictReadParityConfig(text) {
+    try {
+        const raw = parseJsonObject(text).strictReadParity;
+        return raw === "warn" || raw === "off" ? raw : DEFAULT_STRICT_READ_PARITY;
+    }
+    catch {
+        return DEFAULT_STRICT_READ_PARITY;
+    }
+}
 export function defaultConfigPath() {
     return fileURLToPath(new URL("./" + CONFIG_FILENAME, import.meta.url));
 }
+export function legacyConfigPath(path = defaultConfigPath()) {
+    return join(dirname(path), LEGACY_CONFIG_FILENAME);
+}
+export function resolveGlobalConfigPath(path = defaultConfigPath()) {
+    if (existsSync(path))
+        return { path, usedLegacyPath: false };
+    const legacyPath = legacyConfigPath(path);
+    if (existsSync(legacyPath))
+        return { path: legacyPath, usedLegacyPath: true };
+    return { path, usedLegacyPath: false };
+}
 export function ensureConcurrencyConfig(path = defaultConfigPath()) {
     try {
-        if (existsSync(path))
+        const resolved = resolveGlobalConfigPath(path);
+        if (existsSync(resolved.path))
             return;
         writeFileSync(path, CONCURRENCY_SCAFFOLD);
     }
     catch { }
 }
-export function readGlobalCap(path = defaultConfigPath()) {
+export function readGlobalConfig(path = defaultConfigPath()) {
     try {
         ensureConcurrencyConfig(path);
-        return parseConcurrencyConfig(readFileSync(path, "utf8"));
+        const resolved = resolveGlobalConfigPath(path);
+        const text = readFileSync(resolved.path, "utf8");
+        parseJsonObject(text);
+        return {
+            globalConcurrentSubagents: parseConcurrencyConfig(text),
+            checkForUpdates: parseCheckForUpdatesConfig(text),
+            permissionsCeiling: parsePermissionsCeilingConfig(text),
+            escalation: parseEscalationConfig(text),
+            strictReadParity: parseStrictReadParityConfig(text),
+            path: resolved.path,
+            usedLegacyPath: resolved.usedLegacyPath,
+            parseFailure: null,
+        };
     }
-    catch {
-        return DEFAULT_CAP;
+    catch (e) {
+        return {
+            globalConcurrentSubagents: DEFAULT_CAP,
+            checkForUpdates: DEFAULT_CHECK_FOR_UPDATES,
+            permissionsCeiling: "manual",
+            escalation: DEFAULT_ESCALATION,
+            strictReadParity: DEFAULT_STRICT_READ_PARITY,
+            path,
+            usedLegacyPath: false,
+            parseFailure: e instanceof Error ? e.message : String(e),
+        };
     }
 }
+export function readGlobalCap(path = defaultConfigPath()) {
+    return readGlobalConfig(path).globalConcurrentSubagents;
+}
 export function readCheckForUpdates(path = defaultConfigPath()) {
+    return readGlobalConfig(path).checkForUpdates;
+}
+export function readPermissionsCeiling(path = defaultConfigPath()) {
+    return readGlobalConfig(path).permissionsCeiling;
+}
+export function readEscalation(path = defaultConfigPath()) {
+    return readGlobalConfig(path).escalation;
+}
+export function readStrictReadParity(path = defaultConfigPath()) {
+    return readGlobalConfig(path).strictReadParity;
+}
+let legacyConfigDeprecationPending = false;
+export function noteLegacyConfigIfUsed(path = defaultConfigPath()) {
+    if (resolveGlobalConfigPath(path).usedLegacyPath)
+        legacyConfigDeprecationPending = true;
+}
+export function consumeLegacyConfigDeprecationNotice() {
+    if (!legacyConfigDeprecationPending)
+        return null;
+    legacyConfigDeprecationPending = false;
+    return `${LEGACY_CONFIG_FILENAME} is deprecated; rename it to ${CONFIG_FILENAME}. The legacy name is still read for one major version when the new file is absent.`;
+}
+function fileDigest(path) {
     try {
-        ensureConcurrencyConfig(path);
-        return parseCheckForUpdatesConfig(readFileSync(path, "utf8"));
+        return createHash("sha256").update(readFileSync(path)).digest("hex");
     }
     catch {
-        return DEFAULT_CHECK_FOR_UPDATES;
+        return null;
+    }
+}
+let startupCeilingDigest = fileDigest(resolveGlobalConfigPath().path);
+export function checkCeilingIntegrity(path = defaultConfigPath()) {
+    const digest = fileDigest(resolveGlobalConfigPath(path).path);
+    if (digest !== startupCeilingDigest) {
+        startupCeilingDigest = digest;
+        return "changed_since_startup";
+    }
+    return null;
+}
+export function configSelfProtectionDenyRules(path = defaultConfigPath()) {
+    const current = resolve(path);
+    const legacy = resolve(legacyConfigPath(path));
+    return [current, legacy].flatMap((p) => [`Edit(${p})`, `Write(${p})`, `NotebookEdit(${p})`]);
+}
+function asStringArray(raw) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw) || raw.some((v) => typeof v !== "string"))
+        return null;
+    return raw;
+}
+function readClaudePermissions(source, path, userScoped) {
+    try {
+        const parsed = parseJsonObject(readFileSync(path, "utf8"));
+        const permissions = parsed.permissions;
+        if (permissions !== undefined && (!permissions || typeof permissions !== "object" || Array.isArray(permissions))) {
+            throw new Error("permissions must be an object");
+        }
+        const p = (permissions ?? {});
+        const allow = asStringArray(p.allow);
+        const deny = asStringArray(p.deny);
+        const ask = asStringArray(p.ask);
+        const additionalDirectories = asStringArray(p.additionalDirectories);
+        if (!allow || !deny || !ask || !additionalDirectories) {
+            throw new Error("permissions arrays must contain only strings");
+        }
+        const disableBypass = userScoped && parsed.disableBypassPermissionsMode === "disable";
+        return {
+            rules: { allow, deny, ask, additionalDirectories },
+            disableBypass,
+            failure: null,
+        };
+    }
+    catch (e) {
+        return {
+            rules: blanketMutatingAskRules(),
+            disableBypass: false,
+            failure: { source, path, error: e instanceof Error ? e.message : String(e) },
+        };
+    }
+}
+function blanketMutatingAskRules() {
+    return {
+        allow: [],
+        deny: [],
+        ask: ["Bash", "Edit", "Write", "NotebookEdit", "MultiEdit"],
+        additionalDirectories: [],
+    };
+}
+function mergeRules(target, next) {
+    target.allow.push(...next.allow);
+    target.deny.push(...next.deny);
+    target.ask.push(...next.ask);
+    target.additionalDirectories.push(...next.additionalDirectories);
+}
+function unique(items) {
+    return [...new Set(items)];
+}
+function codexTomlValue(text, key) {
+    const m = text.match(new RegExp(`^\\s*${key}\\s*=\\s*["']?([^"'\\r\\n#]+)["']?`, "m"));
+    return m ? m[1].trim() : null;
+}
+function codexTomlArray(text, key) {
+    const m = text.match(new RegExp(`^\\s*${key}\\s*=\\s*\\[([^\\]]*)\\]`, "m"));
+    if (!m)
+        return [];
+    return [...m[1].matchAll(/["']([^"']+)["']/g)].map((v) => v[1]);
+}
+function assertBasicTomlParsable(text) {
+    let inArray = false;
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.replace(/#.*$/, "").trim();
+        if (!trimmed)
+            continue;
+        if (/^\[[^\]]+\]$/.test(trimmed))
+            continue;
+        if (!trimmed.includes("=") && !inArray)
+            throw new Error(`malformed TOML line: ${trimmed}`);
+        const quoteCount = (trimmed.match(/(?<!\\)"/g) ?? []).length + (trimmed.match(/(?<!\\)'/g) ?? []).length;
+        if (quoteCount % 2 !== 0)
+            throw new Error(`unbalanced TOML quotes: ${trimmed}`);
+        const opens = (trimmed.match(/\[/g) ?? []).length;
+        const closes = (trimmed.match(/\]/g) ?? []).length;
+        inArray = inArray || opens > closes;
+        if (closes > opens)
+            inArray = false;
+    }
+    if (inArray)
+        throw new Error("unterminated TOML array");
+}
+function readCodexConfig(path) {
+    try {
+        const text = readFileSync(path, "utf8");
+        assertBasicTomlParsable(text);
+        const rules = { allow: [], deny: [], ask: [], additionalDirectories: [] };
+        if (codexTomlValue(text, "sandbox_mode") === "read-only") {
+            rules.deny.push("Edit", "Write", "NotebookEdit");
+        }
+        rules.additionalDirectories.push(...codexTomlArray(text, "writable_roots"));
+        for (const m of text.matchAll(/^\s*path\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
+            rules.deny.push(`Edit(${m[1]})`, `Write(${m[1]})`);
+        }
+        for (const m of text.matchAll(/^\s*domain\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
+            rules.deny.push(`WebFetch(domain:${m[1]})`);
+        }
+        return { rules, failure: null };
+    }
+    catch (e) {
+        return {
+            rules: blanketMutatingAskRules(),
+            failure: { source: "repo-codex-config", path, error: e instanceof Error ? e.message : String(e) },
+        };
+    }
+}
+function codexConfigChain(cwd) {
+    const out = [];
+    let cur = resolve(cwd);
+    const root = parsePath(cur).root;
+    const dirs = [];
+    while (true) {
+        dirs.push(cur);
+        if (cur === root)
+            break;
+        cur = dirname(cur);
+    }
+    for (const dir of dirs.reverse()) {
+        const cfg = join(dir, ".codex", "config.toml");
+        if (existsSync(cfg))
+            out.push(cfg);
+    }
+    return out;
+}
+function repoConfigDigest(cwd) {
+    const files = [
+        join(cwd, ".claude", "settings.json"),
+        join(cwd, ".claude", "settings.local.json"),
+        ...codexConfigChain(cwd),
+    ].filter((p) => existsSync(p));
+    const h = createHash("sha256");
+    for (const file of files)
+        h.update(file).update("\0").update(readFileSync(file));
+    return h.digest("hex");
+}
+const firstRepoDigests = new Map();
+export function readMergedPermissionConfig(cwd, path = defaultConfigPath()) {
+    const global = readGlobalConfig(path);
+    noteLegacyConfigIfUsed(path);
+    const merged = { allow: [], deny: [], ask: [], additionalDirectories: [] };
+    const failures = [];
+    let ceiling = global.permissionsCeiling;
+    if (global.parseFailure) {
+        failures.push({ source: "builtin", path: global.path, error: global.parseFailure });
+        ceiling = "manual";
+        mergeRules(merged, blanketMutatingAskRules());
+    }
+    let disableBypass = false;
+    const sources = [
+        ["user-settings", join(homedir(), ".subagent-mcp", "settings.json"), true],
+        ["user-settings-local", join(homedir(), ".subagent-mcp", "settings.local.json"), true],
+        ["repo-claude-settings", join(cwd, ".claude", "settings.json"), false],
+        ["repo-claude-settings-local", join(cwd, ".claude", "settings.local.json"), false],
+    ];
+    for (const [source, file, userScoped] of sources) {
+        if (!existsSync(file))
+            continue;
+        const read = readClaudePermissions(source, file, userScoped);
+        mergeRules(merged, read.rules);
+        if (read.disableBypass)
+            disableBypass = true;
+        if (read.failure) {
+            failures.push(read.failure);
+            ceiling = "manual";
+        }
+    }
+    for (const file of codexConfigChain(cwd)) {
+        const read = readCodexConfig(file);
+        mergeRules(merged, read.rules);
+        if (read.failure) {
+            failures.push(read.failure);
+            ceiling = "manual";
+        }
     }
+    if (disableBypass && ceiling === "yolo")
+        ceiling = "auto";
+    const digest = repoConfigDigest(cwd);
+    const first = firstRepoDigests.get(cwd);
+    const repoConfigChangedSinceFirstSeen = first !== undefined && first !== digest;
+    if (first === undefined)
+        firstRepoDigests.set(cwd, digest);
+    const selfProtectionDeny = configSelfProtectionDenyRules(path);
+    const protectedDirs = new Set([resolve(path), resolve(legacyConfigPath(path))]);
+    merged.deny.push(...selfProtectionDeny);
+    return {
+        allow: unique(merged.allow),
+        deny: unique(merged.deny),
+        ask: unique(merged.ask),
+        additionalDirectories: unique(merged.additionalDirectories).filter((p) => !protectedDirs.has(resolve(p))),
+        permissionsCeiling: ceiling,
+        escalation: global.escalation,
+        strictReadParity: global.strictReadParity,
+        configParseFailure: failures,
+        repoConfigChangedSinceFirstSeen,
+        selfProtectionDeny,
+    };
 }
 export function slotDir() {
     if (process.env.SUBAGENT_SLOT_DIR)

package/dist/config-scaffold.js

@@ -1,2 +1,2 @@
-// GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-concurrency.jsonc — DO NOT EDIT.
-export const CONCURRENCY_SCAFFOLD = "// subagent-mcp — Global Concurrent Subagent Cap\r\n// ------------------------------------------------------------------\r\n// SOLE source of truth for the machine-wide limit on how many subagents\r\n// may be ALIVE AT ONCE across EVERY session, process, and user on this\r\n// machine. There is NO environment-variable override for the cap.\r\n//\r\n// The whole recursive descendant tree counts toward this ONE number: a\r\n// subagent that itself launches subagents adds to the same machine-wide\r\n// total, and OTHER active agentic sessions count too.\r\n//\r\n// RE-READ on every launch_agent call — edits take effect immediately, no\r\n// server restart required.\r\n//\r\n// Value rules (forcibly applied to the number below):\r\n//   - missing / unset / non-integer / 0 / negative  -> reset to default 20\r\n//   - 1 through 9                                    -> forced UP to minimum 10\r\n//   - 10 or greater                                 -> used as-is\r\n//\r\n// Zombie culling is always enabled. There is no config knob. Before cap\r\n// rejection, launch/tool/hook paths refresh live owned slots, preserve stale\r\n// slots whose owner server is still alive, and cull stale slots whose owner is\r\n// gone. Managed stale slots terminate the child process tree, then force-kill\r\n// after 20s when needed; unmanaged stale slots are only unlinked.\r\n//\r\n// When the cap is reached after culling, launch_agent is REJECTED (never\r\n// queued). Free a slot with list_agents + kill_agent, then retry.\r\n//\r\n// checkForUpdates controls the silent npmjs update check started when the MCP\r\n// server connects. Default true. Set to false to skip the registry fetch and\r\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\r\n{\r\n  \"globalConcurrentSubagents\": 20,\r\n  \"checkForUpdates\": true\r\n}\r\n";
+// GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-subagent-mcp-config.jsonc — DO NOT EDIT.
+export const CONCURRENCY_SCAFFOLD = "// subagent-mcp - Global Subagent MCP Config\n// ------------------------------------------------------------------\n// SOLE source of truth for machine-wide subagent-mcp defaults that must be\n// available beside the compiled server.\n//\n// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE\n// across EVERY session, process, and user on this machine. There is NO\n// environment-variable override for the cap.\n//\n// RE-READ on every launch_agent call - edits take effect immediately, no\n// server restart required.\n//\n// Cap value rules:\n//   - missing / unset / non-integer / 0 / negative -> reset to default 20\n//   - 1 through 9                                  -> forced UP to minimum 10\n//   - 10 or greater                                -> used as-is\n//\n// checkForUpdates controls the silent npmjs update check started when the MCP\n// server connects. Default true. Set to false to skip the registry fetch and\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\n//\n// permissionsCeiling controls launch-time permissions posture:\n//   - auto   (default): shared engine gates unsafe/residue actions\n//   - manual: human approval for residue while still auto-denying DANGER\n//   - yolo:  preserve the historical bypass/danger-full-access path, except\n//            for non-bypassable config-file self-protection\n//\n// escalation applies only in auto mode. irreversible-only routes irreversible\n// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.\n//\n// strictReadParity controls logging only. Unparseable Codex approval payloads\n// always fail closed to ask; warn logs the construct, off silences that log.\n{\n  \"globalConcurrentSubagents\": 20,\n  \"checkForUpdates\": true,\n  \"permissionsCeiling\": \"auto\",\n  \"escalation\": \"irreversible-only\",\n  \"strictReadParity\": \"warn\"\n}\n";