@heretyc/subagent-mcp 2.12.5-beta.1 → 2.12.5-beta.2

package/dist/index.js

@@ -516,7 +516,7 @@ const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (fu
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.5-beta.1",
+    version: "2.12.5-beta.2",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"

package/dist/permission-engine.js

@@ -58,9 +58,15 @@ export function verdict(op, rules = {}) {
 export function applyPermissionCeiling(engineVote, ceiling) {
     if (ceiling === "yolo")
         return "allow";
-    if (ceiling === "manual")
-        return minVerdict(engineVote, "ask");
-    return minVerdict(engineVote, "allow");
+    // The ceilings are NOT points on a permissiveness total order (the J2-9
+    // "total-order-over-modes" mistake). Neither `auto` nor `manual` may demote
+    // the engine's allow (SAFE) or deny (DANGER) decisions: SAFE always
+    // auto-allows, DANGER always auto-denies, and only NEUTRAL residue ("ask")
+    // parks. The auto/manual difference is solely *who* answers an "ask" —
+    // `auto` escalates only irreversible residue to a human while `manual` routes
+    // all residue to a human — which is decided downstream (see pending-permissions
+    // `escalate_to_human`), never by mapping SAFE ops to "ask" here.
+    return engineVote;
 }
 export function classifyPermissionOp(op) {
     const command = commandText(op);
@@ -247,7 +253,3 @@ function wildcardMatch(pattern, value) {
     const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[\\s\\S]*");
     return new RegExp(`^${escaped}$`, "i").test(value);
 }
-function minVerdict(a, b) {
-    const rank = { deny: 0, ask: 1, allow: 2 };
-    return rank[a] <= rank[b] ? a : b;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretyc/subagent-mcp",
-  "version": "2.12.5-beta.1",
+  "version": "2.12.5-beta.2",
   "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
   "keywords": [
     "mcp",