@heretyc/subagent-mcp 2.12.3 → 2.12.5-beta.0

package/dist/drivers.js

@@ -1,7 +1,12 @@
 import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
+import { realpathSync } from "node:fs";
+import { resolve as resolvePath } from "node:path";
 import { PassThrough } from "node:stream";
+import { readMergedPermissionConfig } from "./concurrency.js";
 import { mapModel } from "./effort.js";
+import { applyPermissionCeiling, verdict, } from "./permission-engine.js";
+import { requestPendingPermission } from "./pending-permissions.js";
 export class ProviderTransientError extends Error {
     isTransient = true;
     constructor(message) {
@@ -195,6 +200,233 @@ function optionId(opt) {
 function isJsonRpcId(id) {
     return typeof id === "string" || typeof id === "number";
 }
+function denyClaudePermission(message) {
+    return { behavior: "deny", message };
+}
+function allowClaudePermission() {
+    return { behavior: "allow" };
+}
+function permissionSnapshotForLaunch(options) {
+    if (options.permissionSnapshot)
+        return options.permissionSnapshot;
+    const merged = readMergedPermissionConfig(options.cwd);
+    const snapshot = {
+        ceiling: merged.permissionsCeiling,
+        escalation: merged.escalation,
+        rules: { allow: merged.allow, deny: merged.deny, ask: merged.ask },
+        additionalDirectories: merged.additionalDirectories,
+        repoConfigChangedSinceFirstSeen: merged.repoConfigChangedSinceFirstSeen,
+        strictReadParity: merged.strictReadParity,
+    };
+    return snapshot;
+}
+function claudeToolName(request) {
+    for (const key of ["toolName", "tool_name", "name"]) {
+        const value = request[key];
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return "unknown";
+}
+function claudeToolInput(request) {
+    for (const key of ["input", "toolInput", "tool_input"]) {
+        const value = request[key];
+        if (value && typeof value === "object" && !Array.isArray(value))
+            return value;
+    }
+    return {};
+}
+function stringField(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+function stringArrayField(input, keys) {
+    const out = [];
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string" && value.length > 0)
+            out.push(value);
+        else if (Array.isArray(value)) {
+            out.push(...value.filter((v) => typeof v === "string" && v.length > 0));
+        }
+    }
+    return out;
+}
+/**
+ * Adapter-layer symlink parity: the shared engine denies against the RESOLVED
+ * target (see PermissionOp.resolvedPaths), so every adapter must populate it.
+ * Resolve each path via realpath where it exists; pass the literal through
+ * otherwise. Fail-closed: a resolution error keeps the literal in the match set
+ * (never drops the path), it never turns a deny into a grant.
+ */
+function resolveOpPaths(paths, cwd) {
+    return paths.map((p) => {
+        try {
+            return realpathSync(resolvePath(cwd, p));
+        }
+        catch {
+            return p;
+        }
+    });
+}
+function permissionOpFromClaudeRequest(request, cwd) {
+    const input = claudeToolInput(request);
+    const command = stringField(input, ["command", "cmd"]);
+    const url = stringField(input, ["url"]);
+    const host = stringField(input, ["host", "domain"]);
+    const paths = stringArrayField(input, [
+        "path",
+        "file_path",
+        "filePath",
+        "notebook_path",
+        "notebookPath",
+        "paths",
+    ]);
+    return {
+        tool: claudeToolName(request),
+        ...(command ? { command } : {}),
+        ...(paths.length > 0 ? { paths, resolvedPaths: resolveOpPaths(paths, cwd) } : {}),
+        ...(url || host ? { network: [{ ...(url ? { url } : {}), ...(host ? { host } : {}) }] } : {}),
+        cwd,
+        irreversible: Boolean(input.irreversible),
+    };
+}
+function claudeCorrelationId(request) {
+    for (const key of ["tool_use_id", "toolUseId", "id"]) {
+        const value = request[key];
+        if (typeof value === "string" || typeof value === "number")
+            return value;
+    }
+    return null;
+}
+function isBypassImmuneClaudeAsk(request, op) {
+    const input = claudeToolInput(request);
+    if (input.requiresUserInteraction === true || input.requires_user_interaction === true)
+        return true;
+    const command = op.command?.toLowerCase() ?? "";
+    if (/\b(shell|bash|zsh|fish|powershell|profile|rc)\b/.test(command) && /\b(edit|write|append|set)\b/.test(command)) {
+        return true;
+    }
+    return (op.paths ?? []).some((path) => /(^|[\\/])\.(git|claude|vscode)([\\/]|$)/i.test(path));
+}
+function permissionDecisionToClaude(decision, reason) {
+    return decision === "allow" ? allowClaudePermission() : denyClaudePermission(reason);
+}
+function resolveCodexLaunchValues(snapshot) {
+    if (snapshot.ceiling === "yolo") {
+        return {
+            approvalPolicy: "never",
+            threadSandbox: "danger-full-access",
+            turnSandboxPolicy: { type: "dangerFullAccess" },
+        };
+    }
+    return {
+        approvalPolicy: "untrusted",
+        threadSandbox: "workspace-write",
+        turnSandboxPolicy: {
+            type: "workspaceWrite",
+            writableRoots: snapshot.additionalDirectories ?? [],
+        },
+    };
+}
+function isCodexApprovalMethod(method) {
+    return (method === "item/commandExecution/requestApproval" ||
+        method === "item/fileChange/requestApproval" ||
+        method === "execCommandApproval" ||
+        method === "applyPatchApproval" ||
+        method === "mcpServer/elicitation/request");
+}
+function codexApprovalKey(id) {
+    return `${typeof id}:${id}`;
+}
+function codexParams(message) {
+    return message.params && typeof message.params === "object" && !Array.isArray(message.params)
+        ? message.params
+        : {};
+}
+function codexStringArray(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.length > 0) : [];
+}
+function codexFileChangePaths(fileChanges) {
+    if (!fileChanges || typeof fileChanges !== "object" || Array.isArray(fileChanges))
+        return [];
+    return Object.keys(fileChanges).filter((p) => p.length > 0);
+}
+// Codex apply-patch op taxonomy: add/create -> Write, modify -> Edit. Mirrors
+// how the Claude adapter and golden vectors distinguish creation from mutation
+// so Write(...) rules round-trip identically through both adapters. Any create
+// in the batch makes it a Write; a pure-modify batch is an Edit.
+function codexFileChangeTool(fileChanges) {
+    if (!fileChanges || typeof fileChanges !== "object" || Array.isArray(fileChanges))
+        return "Edit";
+    const creates = /^(add|create)/i;
+    for (const change of Object.values(fileChanges)) {
+        const type = change && typeof change === "object" ? change.type : change;
+        if (typeof type === "string" && creates.test(type))
+            return "Write";
+    }
+    return "Edit";
+}
+function codexCommandFromParams(params) {
+    const command = params.command;
+    if (typeof command === "string" && command.length > 0)
+        return { command };
+    const argv = codexStringArray(command);
+    if (argv.length > 0)
+        return { command: argv.join(" "), argv };
+    return {};
+}
+export function codexApprovalOp(method, params, cwd) {
+    if (method === "item/commandExecution/requestApproval" || method === "execCommandApproval") {
+        const command = codexCommandFromParams(params);
+        const opCwd = typeof params.cwd === "string" && params.cwd.length > 0 ? params.cwd : cwd;
+        return {
+            op: {
+                tool: "Bash",
+                ...command,
+                cwd: opCwd,
+                irreversible: Boolean(params.irreversible),
+            },
+            confidence: Boolean(command.command),
+        };
+    }
+    if (method === "item/fileChange/requestApproval" || method === "applyPatchApproval") {
+        const paths = [
+            ...(typeof params.grantRoot === "string" && params.grantRoot.length > 0 ? [params.grantRoot] : []),
+            ...codexFileChangePaths(params.fileChanges),
+        ];
+        return {
+            op: {
+                tool: codexFileChangeTool(params.fileChanges),
+                ...(paths.length > 0 ? { paths, resolvedPaths: resolveOpPaths(paths, cwd) } : {}),
+                cwd,
+                irreversible: false,
+            },
+            confidence: paths.length > 0 || method === "item/fileChange/requestApproval",
+        };
+    }
+    return {
+        op: {
+            tool: "mcpServer/elicitation",
+            cwd,
+            irreversible: false,
+        },
+        confidence: false,
+    };
+}
+export function codexApprovalResult(method, decision) {
+    const allowed = decision === "allow";
+    if (method === "mcpServer/elicitation/request")
+        return { action: allowed ? "accept" : "decline" };
+    if (method === "execCommandApproval" || method === "applyPatchApproval") {
+        return { decision: allowed ? "approved" : "denied" };
+    }
+    return { decision: allowed ? "accept" : "decline" };
+}
 export class MockJsonlDriver {
     child;
     provider;
@@ -293,7 +525,9 @@ export class CodexAppServerDriver {
         this._definitelyStartedReject = rej;
     });
     pending = new Map();
+    pendingApprovals = new Map();
     queuedTurns = [];
+    pendingDenyReasons = [];
     nextId = 1;
     stdoutBuf = "";
     threadId = null;
@@ -302,13 +536,14 @@ export class CodexAppServerDriver {
     initialized = false;
     turnInFlight = false;
     maxQueueDepth = 32;
-    // An inbound server->client RPC (elicitation, e.g. requestUserInput / approval)
-    // awaiting a reply. While set, the next send() answers this request instead of
-    // enqueuing a new turn — otherwise the in-flight question turn wedges the queue.
-    pendingServerRequest = null;
+    maxPendingApprovals = 16;
+    permissionSnapshot;
+    codexLaunchValues;
     constructor(child, options) {
         this.child = child;
         this.options = options;
+        this.permissionSnapshot = permissionSnapshotForLaunch(options);
+        this.codexLaunchValues = resolveCodexLaunchValues(this.permissionSnapshot);
         this.process = new LogicalProcess(child.pid);
         child.once("spawn", () => this.process.emit("spawn"));
         child.once("error", (err) => this.fail(err));
@@ -336,8 +571,8 @@ export class CodexAppServerDriver {
         const thread = await this.request("thread/start", {
             model: this.options.model,
             cwd: this.options.cwd,
-            approvalPolicy: "never",
-            sandbox: "danger-full-access",
+            approvalPolicy: this.codexLaunchValues.approvalPolicy,
+            sandbox: this.codexLaunchValues.threadSandbox,
             ephemeral: true,
             threadSource: "subagent",
         });
@@ -353,18 +588,6 @@ export class CodexAppServerDriver {
         if (!this.initialized || !this.threadId) {
             return Promise.reject(new Error("codex app-server thread is not initialized"));
         }
-        if (this.pendingServerRequest) {
-            // The message is the user's answer to a parked server-side elicitation.
-            // Reply on the same JSON-RPC id (mirroring the { id, result } envelope our
-            // own request() responses arrive in) instead of enqueuing a fresh turn.
-            const req = this.pendingServerRequest;
-            this.pendingServerRequest = null;
-            return writeLine(this.child.stdin, {
-                jsonrpc: "2.0",
-                id: req.id,
-                result: buildElicitationResult(req.options, message),
-            });
-        }
         if (this.queuedTurns.length >= this.maxQueueDepth) {
             return Promise.reject(new Error(`provider input queue is full (${this.maxQueueDepth})`));
         }
@@ -379,7 +602,7 @@ export class CodexAppServerDriver {
         this.process.kill("SIGKILL");
         this.rejectPending(new Error("codex app-server driver was killed"));
         this.queuedTurns.length = 0;
-        this.pendingServerRequest = null;
+        this.pendingApprovals.clear();
     }
     async drainQueuedTurns() {
         if (this.drainActive)
@@ -407,15 +630,16 @@ export class CodexAppServerDriver {
         if (!this.threadId)
             throw new Error("codex app-server thread is not initialized");
         this.turnInFlight = true;
+        const inputText = this.consumeDenyNotice(message);
         try {
             const response = await this.request("turn/start", {
                 threadId: this.threadId,
-                input: [textInput(message)],
+                input: [textInput(inputText)],
                 cwd: this.options.cwd,
                 model: this.options.model,
                 effort: this.options.effort,
-                approvalPolicy: "never",
-                sandboxPolicy: { type: "dangerFullAccess" },
+                approvalPolicy: this.codexLaunchValues.approvalPolicy,
+                sandboxPolicy: this.codexLaunchValues.turnSandboxPolicy,
             });
             const turn = response.result?.turn;
             this.activeTurnId = typeof turn?.id === "string" ? turn.id : this.activeTurnId;
@@ -440,6 +664,13 @@ export class CodexAppServerDriver {
     notify(method, params) {
         return writeLine(this.child.stdin, params === undefined ? { method } : { method, params });
     }
+    consumeDenyNotice(message) {
+        if (this.pendingDenyReasons.length === 0)
+            return message;
+        const reasons = this.pendingDenyReasons.splice(0);
+        const shown = [...new Set(reasons)].slice(0, 8).join("; ");
+        return `Permission DENIED for ${reasons.length} action(s) since your last message: ${shown}. Do not retry; adjust approach.\n\n${message}`;
+    }
     onStdout(chunk) {
         this.stdoutBuf += chunk;
         const lines = this.stdoutBuf.split("\n");
@@ -471,15 +702,15 @@ export class CodexAppServerDriver {
                 pending.resolve(message);
             }
         }
+        else if (isJsonRpcId(message.id) &&
+            typeof message.method === "string" &&
+            isCodexApprovalMethod(message.method)) {
+            void this.handleCodexApproval(message.id, message.method, codexParams(message));
+        }
         else if (isJsonRpcId(message.id) &&
             typeof message.method === "string" &&
             isElicitationMethod(message.method)) {
-            // Inbound server->client RPC (elicitation) that is NOT a reply to one of
-            // our requests. Park it so the next send() answers it instead of queuing a
-            // new turn; leaving it unanswered wedges the in-flight question turn.
-            const params = (message.params ?? {});
-            const options = Array.isArray(params.options) ? params.options : undefined;
-            this.pendingServerRequest = { id: message.id, method: message.method, options };
+            void this.replyJsonRpc(message.id, buildElicitationResult(undefined, ""));
         }
         if (message.method === "turn/started" && message.params && typeof message.params === "object") {
             const turn = (message.params.turn ?? {});
@@ -493,6 +724,58 @@ export class CodexAppServerDriver {
             void this.drainQueuedTurns();
         }
     }
+    async handleCodexApproval(jsonRpcId, method, params) {
+        const key = codexApprovalKey(jsonRpcId);
+        const record = { jsonRpcId, method, params };
+        if (this.pendingApprovals.size >= this.maxPendingApprovals) {
+            await this.replyCodexApproval(record, "deny", "pending approval cap reached; auto-denied fail-closed");
+            return;
+        }
+        this.pendingApprovals.set(key, record);
+        const { op, confidence } = codexApprovalOp(method, params, this.options.cwd);
+        const strictReadParity = this.permissionSnapshot.strictReadParity ?? "warn";
+        if (!confidence && this.permissionSnapshot.ceiling !== "yolo" && strictReadParity === "warn") {
+            console.error(`[permissions] strictReadParity warn: Codex approval payload for ${method} could not be matched with full confidence; routing to ask`);
+        }
+        const engineResult = confidence
+            ? verdict(op, this.permissionSnapshot.rules)
+            : {
+                verdict: "ask",
+                classification: "neutral",
+                irreversible: Boolean(op.irreversible),
+                reason: "Codex approval payload could not be matched with full confidence",
+            };
+        const decision = applyPermissionCeiling(engineResult.verdict, this.permissionSnapshot.ceiling);
+        if (decision !== "ask") {
+            await this.replyCodexApproval(record, decision, engineResult.reason);
+            return;
+        }
+        const pendingDecision = await requestPendingPermission({
+            agentId: this.options.agentId,
+            harnessChannel: "codex-app-server",
+            toolNameOrMethod: method,
+            action: params,
+            permissionCeiling: this.permissionSnapshot.ceiling,
+            escalation: this.permissionSnapshot.escalation,
+            irreversible: engineResult.irreversible,
+            reason: engineResult.reason,
+            suggestions: [],
+            correlationId: jsonRpcId,
+        });
+        await this.replyCodexApproval(record, pendingDecision.verdict, pendingDecision.reason);
+    }
+    async replyCodexApproval(record, decision, reason) {
+        const key = codexApprovalKey(record.jsonRpcId);
+        if (!this.pendingApprovals.has(key))
+            return;
+        this.pendingApprovals.delete(key);
+        if (decision !== "allow")
+            this.pendingDenyReasons.push(`${record.method}: ${reason}`);
+        await this.replyJsonRpc(record.jsonRpcId, codexApprovalResult(record.method, decision));
+    }
+    replyJsonRpc(id, result) {
+        return writeLine(this.child.stdin, { jsonrpc: "2.0", id, result });
+    }
     fail(error) {
         const msg = error.message;
         const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
@@ -534,6 +817,8 @@ export class ClaudeSdkDriver {
         return this.closedFlag || this.process.killed;
     }
     open(options) {
+        const permissionSnapshot = permissionSnapshotForLaunch(options);
+        const isYolo = permissionSnapshot.ceiling === "yolo";
         const sdkOptions = {
             abortController: this.abortController,
             cwd: options.cwd,
@@ -542,9 +827,34 @@ export class ClaudeSdkDriver {
             // model_not_found (404); normalize to the full id the SDK accepts.
             model: mapModel(options.provider, options.model),
             pathToClaudeCodeExecutable: options.command,
-            permissionMode: "bypassPermissions",
-            allowDangerouslySkipPermissions: true,
+            permissionMode: isYolo ? "bypassPermissions" : "default",
+            allowDangerouslySkipPermissions: isYolo,
+            settingSources: [],
             tools: { type: "preset", preset: "claude_code" },
+            canUseTool: async (request) => {
+                const op = permissionOpFromClaudeRequest(request, options.cwd);
+                const engineResult = verdict(op, permissionSnapshot.rules);
+                if (isYolo && isBypassImmuneClaudeAsk(request, op)) {
+                    return denyClaudePermission("bypass-immune Claude safety prompt auto-denied under yolo");
+                }
+                const decision = applyPermissionCeiling(engineResult.verdict, permissionSnapshot.ceiling);
+                if (decision !== "ask") {
+                    return permissionDecisionToClaude(decision, engineResult.reason);
+                }
+                const pendingDecision = await requestPendingPermission({
+                    agentId: options.agentId,
+                    harnessChannel: "claude-canUseTool",
+                    toolNameOrMethod: op.tool,
+                    action: claudeToolInput(request),
+                    permissionCeiling: permissionSnapshot.ceiling,
+                    escalation: permissionSnapshot.escalation,
+                    irreversible: engineResult.irreversible,
+                    reason: engineResult.reason,
+                    suggestions: [],
+                    correlationId: claudeCorrelationId(request),
+                });
+                return permissionDecisionToClaude(pendingDecision.verdict, pendingDecision.reason);
+            },
             maxTurns: 50,
             includePartialMessages: true,
         };

package/dist/effort.js

@@ -1,4 +1,4 @@
-import { writeFileSync } from "fs";
+import { mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
@@ -43,7 +43,7 @@ export function resolveEffort(provider, model, effort) {
     }
     return { kind: "flag", value: "high" };
 }
-export function buildCommand(provider, model, effort, cwd) {
+export function buildCommand(provider, model, effort, cwd, agentId) {
     const mapped = mapModel(provider, model);
     const er = resolveEffort(provider, model, effort);
     if (provider === "claude") {
@@ -52,11 +52,16 @@ export function buildCommand(provider, model, effort, cwd) {
             args.push("--effort", er.value);
         }
         else if (er.kind === "settings") {
-            const ucSettingsPath = join(tmpdir(), `subagent-uc-${randomUUID()}.json`);
-            writeFileSync(ucSettingsPath, '{"ultracode":true}');
+            const safeAgentId = (agentId ?? randomUUID()).replace(/[^a-zA-Z0-9._-]/g, "_");
+            // J1-5: keep per-agent settings under the user's temp profile; POSIX modes
+            // restrict the scratch dir/file, while Windows applies fs defaults.
+            const ucSettingsDir = join(tmpdir(), "subagent-mcp", `perm-${safeAgentId}`);
+            mkdirSync(ucSettingsDir, { recursive: true, mode: 0o700 });
+            const ucSettingsPath = join(ucSettingsDir, "settings.json");
+            writeFileSync(ucSettingsPath, '{"ultracode":true}', { mode: 0o600 });
             args.push("--settings", ucSettingsPath);
             args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
-            return { args, ucSettingsPath };
+            return { args, ucSettingsPath, ucSettingsDir };
         }
         args.push("--permission-mode", "bypassPermissions", "--tools", "default", "--max-turns", "50");
         return { args };

package/dist/global-concurrency.jsonc

@@ -1,34 +1,39 @@
-// subagent-mcp — Global Concurrent Subagent Cap
-// ------------------------------------------------------------------
-// SOLE source of truth for the machine-wide limit on how many subagents
-// may be ALIVE AT ONCE across EVERY session, process, and user on this
-// machine. There is NO environment-variable override for the cap.
-//
-// The whole recursive descendant tree counts toward this ONE number: a
-// subagent that itself launches subagents adds to the same machine-wide
-// total, and OTHER active agentic sessions count too.
-//
-// RE-READ on every launch_agent call — edits take effect immediately, no
-// server restart required.
-//
-// Value rules (forcibly applied to the number below):
-//   - missing / unset / non-integer / 0 / negative  -> reset to default 20
-//   - 1 through 9                                    -> forced UP to minimum 10
-//   - 10 or greater                                 -> used as-is
-//
-// Zombie culling is always enabled. There is no config knob. Before cap
-// rejection, launch/tool/hook paths refresh live owned slots, preserve stale
-// slots whose owner server is still alive, and cull stale slots whose owner is
-// gone. Managed stale slots terminate the child process tree, then force-kill
-// after 20s when needed; unmanaged stale slots are only unlinked.
-//
-// When the cap is reached after culling, launch_agent is REJECTED (never
-// queued). Free a slot with list_agents + kill_agent, then retry.
-//
-// checkForUpdates controls the silent npmjs update check started when the MCP
-// server connects. Default true. Set to false to skip the registry fetch and
-// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
-{
-  "globalConcurrentSubagents": 20,
-  "checkForUpdates": true
-}
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn"
+}

package/dist/global-subagent-mcp-config.jsonc

@@ -0,0 +1,39 @@
+// subagent-mcp - Global Subagent MCP Config
+// ------------------------------------------------------------------
+// SOLE source of truth for machine-wide subagent-mcp defaults that must be
+// available beside the compiled server.
+//
+// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE
+// across EVERY session, process, and user on this machine. There is NO
+// environment-variable override for the cap.
+//
+// RE-READ on every launch_agent call - edits take effect immediately, no
+// server restart required.
+//
+// Cap value rules:
+//   - missing / unset / non-integer / 0 / negative -> reset to default 20
+//   - 1 through 9                                  -> forced UP to minimum 10
+//   - 10 or greater                                -> used as-is
+//
+// checkForUpdates controls the silent npmjs update check started when the MCP
+// server connects. Default true. Set to false to skip the registry fetch and
+// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.
+//
+// permissionsCeiling controls launch-time permissions posture:
+//   - auto   (default): shared engine gates unsafe/residue actions
+//   - manual: human approval for residue while still auto-denying DANGER
+//   - yolo:  preserve the historical bypass/danger-full-access path, except
+//            for non-bypassable config-file self-protection
+//
+// escalation applies only in auto mode. irreversible-only routes irreversible
+// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.
+//
+// strictReadParity controls logging only. Unparseable Codex approval payloads
+// always fail closed to ask; warn logs the construct, off silences that log.
+{
+  "globalConcurrentSubagents": 20,
+  "checkForUpdates": true,
+  "permissionsCeiling": "auto",
+  "escalation": "irreversible-only",
+  "strictReadParity": "warn"
+}