@heretyc/subagent-mcp 2.12.8 → 2.12.10

package/dist/concurrency.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir, platform } from "node:os";
+import { homedir, platform, userInfo } from "node:os";
 import { dirname, join, parse as parsePath, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONCURRENCY_SCAFFOLD } from "./config-scaffold.js";
@@ -11,6 +11,7 @@ export const DEFAULT_CHECK_FOR_UPDATES = true;
 export const DEFAULT_PERMISSIONS_CEILING = "auto";
 export const DEFAULT_ESCALATION = "irreversible-only";
 export const DEFAULT_STRICT_READ_PARITY = "warn";
+export const DEFAULT_SANDBOX_NETWORK = false;
 export const CONFIG_FILENAME = "global-subagent-mcp-config.jsonc";
 export const LEGACY_CONFIG_FILENAME = "global-concurrency.jsonc";
 export { cullStaleSlots, ZOMBIE_FORCE_GRACE_MS, ZOMBIE_LIVE_IDLE_MS, ZOMBIE_TERMINAL_IDLE_MS, buildProcessTreeKillCommands, drainZombieIntents, drainZombieReports, parseSlotMetadata, readSlotMetadata, slotPathForAgent, writeSlotMetadata, };
@@ -83,6 +84,15 @@ export function parseStrictReadParityConfig(text) {
         return DEFAULT_STRICT_READ_PARITY;
     }
 }
+export function parseSandboxNetworkConfig(text) {
+    try {
+        const raw = parseJsonObject(text).sandboxNetwork;
+        return typeof raw === "boolean" ? raw : DEFAULT_SANDBOX_NETWORK;
+    }
+    catch {
+        return DEFAULT_SANDBOX_NETWORK;
+    }
+}
 export function defaultConfigPath() {
     return fileURLToPath(new URL("./" + CONFIG_FILENAME, import.meta.url));
 }
@@ -118,6 +128,7 @@ export function readGlobalConfig(path = defaultConfigPath()) {
             permissionsCeiling: parsePermissionsCeilingConfig(text),
             escalation: parseEscalationConfig(text),
             strictReadParity: parseStrictReadParityConfig(text),
+            sandboxNetwork: parseSandboxNetworkConfig(text),
             path: resolved.path,
             usedLegacyPath: resolved.usedLegacyPath,
             parseFailure: null,
@@ -130,6 +141,7 @@ export function readGlobalConfig(path = defaultConfigPath()) {
             permissionsCeiling: "manual",
             escalation: DEFAULT_ESCALATION,
             strictReadParity: DEFAULT_STRICT_READ_PARITY,
+            sandboxNetwork: DEFAULT_SANDBOX_NETWORK,
             path,
             usedLegacyPath: false,
             parseFailure: e instanceof Error ? e.message : String(e),
@@ -151,6 +163,9 @@ export function readEscalation(path = defaultConfigPath()) {
 export function readStrictReadParity(path = defaultConfigPath()) {
     return readGlobalConfig(path).strictReadParity;
 }
+export function readSandboxNetwork(path = defaultConfigPath()) {
+    return readGlobalConfig(path).sandboxNetwork;
+}
 let legacyConfigDeprecationPending = false;
 export function noteLegacyConfigIfUsed(path = defaultConfigPath()) {
     if (resolveGlobalConfigPath(path).usedLegacyPath)
@@ -208,7 +223,7 @@ function readClaudePermissions(source, path, userScoped) {
         }
         const disableBypass = userScoped && parsed.disableBypassPermissionsMode === "disable";
         return {
-            rules: { allow, deny, ask, additionalDirectories },
+            rules: { allow, deny, ask, additionalDirectories, sandboxNetwork: false },
             disableBypass,
             failure: null,
         };
@@ -227,6 +242,7 @@ function blanketMutatingAskRules() {
         deny: [],
         ask: ["Bash", "Edit", "Write", "NotebookEdit", "MultiEdit"],
         additionalDirectories: [],
+        sandboxNetwork: false,
     };
 }
 function mergeRules(target, next) {
@@ -234,57 +250,204 @@ function mergeRules(target, next) {
     target.deny.push(...next.deny);
     target.ask.push(...next.ask);
     target.additionalDirectories.push(...next.additionalDirectories);
+    target.sandboxNetwork ||= next.sandboxNetwork;
 }
 function unique(items) {
     return [...new Set(items)];
 }
+function codexKeyPattern(key) {
+    return new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*(.*)$`);
+}
+function scanBasicString(line, start) {
+    for (let i = start + 1; i < line.length; i++) {
+        if (line[i] === "\\" && i + 1 < line.length) {
+            i++;
+            continue;
+        }
+        if (line[i] === "\"")
+            return i;
+    }
+    throw new Error(`unbalanced TOML quotes: ${line.trim()}`);
+}
+function scanLiteralString(line, start) {
+    const end = line.indexOf("'", start + 1);
+    if (end === -1)
+        throw new Error(`unbalanced TOML quotes: ${line.trim()}`);
+    return end;
+}
+function stripTomlCommentsAndMultilineStrings(text) {
+    let multiline = null;
+    const out = [];
+    for (const line of text.split(/\r?\n/)) {
+        let sanitized = "";
+        let i = 0;
+        if (multiline) {
+            const end = line.indexOf(multiline);
+            if (end === -1) {
+                out.push("");
+                continue;
+            }
+            i = end + 3;
+            multiline = null;
+        }
+        while (i < line.length) {
+            if (line.startsWith(`"""`, i) || line.startsWith("'''", i)) {
+                const delimiter = line.startsWith(`"""`, i) ? `"""` : "'''";
+                sanitized += delimiter === `"""` ? `""` : "''";
+                i += 3;
+                const end = line.indexOf(delimiter, i);
+                if (end === -1) {
+                    multiline = delimiter;
+                    break;
+                }
+                i = end + 3;
+                continue;
+            }
+            if (line[i] === "#")
+                break;
+            if (line[i] === "\"") {
+                const end = scanBasicString(line, i);
+                sanitized += line.slice(i, end + 1);
+                i = end + 1;
+                continue;
+            }
+            if (line[i] === "'") {
+                const end = scanLiteralString(line, i);
+                sanitized += line.slice(i, end + 1);
+                i = end + 1;
+                continue;
+            }
+            sanitized += line[i];
+            i++;
+        }
+        out.push(sanitized);
+    }
+    if (multiline)
+        throw new Error("unterminated TOML multiline string");
+    return out.join("\n");
+}
+function countTomlBrackets(line) {
+    let opens = 0;
+    let closes = 0;
+    for (let i = 0; i < line.length; i++) {
+        if (line[i] === "\"") {
+            i = scanBasicString(line, i);
+            continue;
+        }
+        if (line[i] === "'") {
+            i = scanLiteralString(line, i);
+            continue;
+        }
+        if (line[i] === "[")
+            opens++;
+        if (line[i] === "]")
+            closes++;
+    }
+    return { opens, closes };
+}
+function tomlAssignmentValue(text, key) {
+    const keyPattern = codexKeyPattern(key);
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(keyPattern);
+        if (!m)
+            continue;
+        let value = m[1].trim();
+        if (!value.startsWith("["))
+            return value;
+        let balance = 0;
+        for (let j = i; j < lines.length; j++) {
+            const fragment = j === i ? value : lines[j];
+            const { opens, closes } = countTomlBrackets(fragment);
+            balance += opens - closes;
+            if (j > i)
+                value += `\n${fragment.trim()}`;
+            if (balance <= 0)
+                return value;
+        }
+        return value;
+    }
+    return null;
+}
+function parseTomlScalar(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("\"")) {
+        const end = scanBasicString(trimmed, 0);
+        return trimmed.slice(1, end);
+    }
+    if (trimmed.startsWith("'")) {
+        const end = scanLiteralString(trimmed, 0);
+        return trimmed.slice(1, end);
+    }
+    const bare = trimmed.match(/^[^\s,]+/);
+    return bare ? bare[0] : null;
+}
 function codexTomlValue(text, key) {
-    const m = text.match(new RegExp(`^\\s*${key}\\s*=\\s*["']?([^"'\\r\\n#]+)["']?`, "m"));
-    return m ? m[1].trim() : null;
+    const value = tomlAssignmentValue(text, key);
+    return value === null ? null : parseTomlScalar(value);
 }
 function codexTomlArray(text, key) {
-    const m = text.match(new RegExp(`^\\s*${key}\\s*=\\s*\\[([^\\]]*)\\]`, "m"));
-    if (!m)
+    const value = tomlAssignmentValue(text, key);
+    if (!value || !value.trim().startsWith("["))
         return [];
-    return [...m[1].matchAll(/["']([^"']+)["']/g)].map((v) => v[1]);
+    const out = [];
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] === "\"") {
+            const end = scanBasicString(value, i);
+            out.push(value.slice(i + 1, end));
+            i = end;
+        }
+        else if (value[i] === "'") {
+            const end = scanLiteralString(value, i);
+            out.push(value.slice(i + 1, end));
+            i = end;
+        }
+    }
+    return out;
 }
 function assertBasicTomlParsable(text) {
-    let inArray = false;
-    for (const line of text.split(/\r?\n/)) {
-        const trimmed = line.replace(/#.*$/, "").trim();
+    const sanitized = stripTomlCommentsAndMultilineStrings(text);
+    let arrayDepth = 0;
+    for (const line of sanitized.split(/\r?\n/)) {
+        const trimmed = line.trim();
         if (!trimmed)
             continue;
         if (/^\[[^\]]+\]$/.test(trimmed))
             continue;
-        if (!trimmed.includes("=") && !inArray)
+        if (!trimmed.includes("=") && arrayDepth === 0)
+            throw new Error(`malformed TOML line: ${trimmed}`);
+        const { opens, closes } = countTomlBrackets(trimmed);
+        arrayDepth += opens - closes;
+        if (arrayDepth < 0)
             throw new Error(`malformed TOML line: ${trimmed}`);
-        const quoteCount = (trimmed.match(/(?<!\\)"/g) ?? []).length + (trimmed.match(/(?<!\\)'/g) ?? []).length;
-        if (quoteCount % 2 !== 0)
-            throw new Error(`unbalanced TOML quotes: ${trimmed}`);
-        const opens = (trimmed.match(/\[/g) ?? []).length;
-        const closes = (trimmed.match(/\]/g) ?? []).length;
-        inArray = inArray || opens > closes;
-        if (closes > opens)
-            inArray = false;
-    }
-    if (inArray)
+    }
+    if (arrayDepth > 0)
         throw new Error("unterminated TOML array");
+    return sanitized;
 }
 function readCodexConfig(path) {
     try {
         const text = readFileSync(path, "utf8");
-        assertBasicTomlParsable(text);
-        const rules = { allow: [], deny: [], ask: [], additionalDirectories: [] };
-        if (codexTomlValue(text, "sandbox_mode") === "read-only") {
+        const toml = assertBasicTomlParsable(text);
+        const rules = { allow: [], deny: [], ask: [], additionalDirectories: [], sandboxNetwork: false };
+        if (codexTomlValue(toml, "sandbox_mode") === "read-only") {
             rules.deny.push("Edit", "Write", "NotebookEdit");
         }
-        rules.additionalDirectories.push(...codexTomlArray(text, "writable_roots"));
-        for (const m of text.matchAll(/^\s*path\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
+        if (/\bsandbox_workspace_write\.network_access\s*=\s*true\b/i.test(toml) ||
+            /^\s*\[sandbox_workspace_write\][\s\S]*?^\s*network_access\s*=\s*true\b/im.test(toml)) {
+            rules.sandboxNetwork = true;
+        }
+        rules.additionalDirectories.push(...codexTomlArray(toml, "writable_roots"));
+        for (const m of toml.matchAll(/^\s*path\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
             rules.deny.push(`Edit(${m[1]})`, `Write(${m[1]})`);
         }
-        for (const m of text.matchAll(/^\s*domain\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
+        for (const m of toml.matchAll(/^\s*domain\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']deny["']/gm)) {
             rules.deny.push(`WebFetch(domain:${m[1]})`);
         }
+        for (const m of toml.matchAll(/^\s*domain\s*=\s*["']([^"']+)["']\s*\r?\n\s*access\s*=\s*["']allow["']/gm)) {
+            rules.allow.push(`WebFetch(domain:${m[1]})`);
+            rules.sandboxNetwork = true;
+        }
         return { rules, failure: null };
     }
     catch (e) {
@@ -327,7 +490,13 @@ const firstRepoDigests = new Map();
 export function readMergedPermissionConfig(cwd, path = defaultConfigPath()) {
     const global = readGlobalConfig(path);
     noteLegacyConfigIfUsed(path);
-    const merged = { allow: [], deny: [], ask: [], additionalDirectories: [] };
+    const merged = {
+        allow: [],
+        deny: [],
+        ask: [],
+        additionalDirectories: [],
+        sandboxNetwork: global.sandboxNetwork,
+    };
     const failures = [];
     let ceiling = global.permissionsCeiling;
     if (global.parseFailure) {
@@ -377,6 +546,7 @@ export function readMergedPermissionConfig(cwd, path = defaultConfigPath()) {
         deny: unique(merged.deny),
         ask: unique(merged.ask),
         additionalDirectories: unique(merged.additionalDirectories).filter((p) => !protectedDirs.has(resolve(p))),
+        sandboxNetwork: merged.sandboxNetwork,
         permissionsCeiling: ceiling,
         escalation: global.escalation,
         strictReadParity: global.strictReadParity,
@@ -385,7 +555,24 @@ export function readMergedPermissionConfig(cwd, path = defaultConfigPath()) {
         selfProtectionDeny,
     };
 }
-export function slotDir() {
+function safeSlotNamespace(raw) {
+    const cleaned = raw.replace(/[^A-Za-z0-9_.-]/g, "_");
+    return cleaned || createHash("sha256").update(raw || "unknown").digest("hex").slice(0, 16);
+}
+export function currentUserSlotNamespace() {
+    try {
+        const info = userInfo();
+        if (platform() !== "win32" && Number.isInteger(info.uid))
+            return `uid-${info.uid}`;
+        return safeSlotNamespace(info.username);
+    }
+    catch { }
+    const uid = typeof process.getuid === "function" ? process.getuid() : null;
+    if (typeof uid === "number")
+        return `uid-${uid}`;
+    return safeSlotNamespace(process.env.USERNAME || process.env.USER || "unknown");
+}
+export function slotBaseDir() {
     if (process.env.SUBAGENT_SLOT_DIR)
         return process.env.SUBAGENT_SLOT_DIR;
     if (platform() === "win32") {
@@ -393,6 +580,9 @@ export function slotDir() {
     }
     return "/tmp/subagent-mcp/slots";
 }
+export function slotDir() {
+    return join(slotBaseDir(), currentUserSlotNamespace());
+}
 export function countSlots(dir = slotDir()) {
     try {
         return readdirSync(dir).filter((f) => f.startsWith("slot-")).length;
@@ -410,7 +600,13 @@ export const NONBLOCKING_CULL_DEPS = {
 };
 export function reserveSlot(agentId, max, dir = slotDir(), cullDeps) {
     try {
-        mkdirSync(dir, { recursive: true, mode: 0o1777 });
+        if (dir === slotDir()) {
+            mkdirSync(slotBaseDir(), { recursive: true, mode: 0o1777 });
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        else {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
         cullStaleSlots(dir, cullDeps);
         const slotPath = slotPathForAgent(dir, agentId);
         const before = countSlots(dir);

package/dist/config-scaffold.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/gen-ruleset-scaffold.mjs from src/global-subagent-mcp-config.jsonc — DO NOT EDIT.
-export const CONCURRENCY_SCAFFOLD = "// subagent-mcp - Global Subagent MCP Config\n// ------------------------------------------------------------------\n// SOLE source of truth for machine-wide subagent-mcp defaults that must be\n// available beside the compiled server.\n//\n// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE\n// across EVERY session, process, and user on this machine. There is NO\n// environment-variable override for the cap.\n//\n// RE-READ on every launch_agent call - edits take effect immediately, no\n// server restart required.\n//\n// Cap value rules:\n//   - missing / unset / non-integer / 0 / negative -> reset to default 20\n//   - 1 through 9                                  -> forced UP to minimum 10\n//   - 10 or greater                                -> used as-is\n//\n// checkForUpdates controls the silent npmjs update check started when the MCP\n// server connects. Default true. Set to false to skip the registry fetch and\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\n//\n// permissionsCeiling controls launch-time permissions posture:\n//   - auto   (default): shared engine gates unsafe/residue actions\n//   - manual: human approval for residue while still auto-denying DANGER\n//   - yolo:  preserve the historical bypass/danger-full-access path, except\n//            for non-bypassable config-file self-protection\n//\n// escalation applies only in auto mode. irreversible-only routes irreversible\n// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.\n//\n// strictReadParity controls logging only. Unparseable Codex approval payloads\n// always fail closed to ask; warn logs the construct, off silences that log.\n{\n  \"globalConcurrentSubagents\": 20,\n  \"checkForUpdates\": true,\n  \"permissionsCeiling\": \"auto\",\n  \"escalation\": \"irreversible-only\",\n  \"strictReadParity\": \"warn\"\n}\n";
+export const CONCURRENCY_SCAFFOLD = "// subagent-mcp - Global Subagent MCP Config\n// ------------------------------------------------------------------\n// SOLE source of truth for machine-wide subagent-mcp defaults that must be\n// available beside the compiled server.\n//\n// globalConcurrentSubagents controls how many subagents may be ALIVE AT ONCE\n// across EVERY session, process, and user on this machine. There is NO\n// environment-variable override for the cap.\n//\n// RE-READ on every launch_agent call - edits take effect immediately, no\n// server restart required.\n//\n// Cap value rules:\n//   - missing / unset / non-integer / 0 / negative -> reset to default 20\n//   - 1 through 9                                  -> forced UP to minimum 10\n//   - 10 or greater                                -> used as-is\n//\n// checkForUpdates controls the silent npmjs update check started when the MCP\n// server connects. Default true. Set to false to skip the registry fetch and\n// suppress hook notices. SUBAGENT_UPDATE_CHECK=0 or false also disables it.\n//\n// permissionsCeiling controls launch-time permissions posture:\n//   - auto   (default): shared engine gates unsafe/residue actions\n//   - manual: human approval for residue while still auto-denying DANGER\n//   - yolo:  preserve the historical bypass/danger-full-access path, except\n//            for non-bypassable config-file self-protection\n//\n// escalation applies only in auto mode. irreversible-only routes irreversible\n// NEUTRAL residue to a human; off leaves residue to orchestrator judgment.\n//\n// strictReadParity controls logging only. Unparseable Codex approval payloads\n// always fail closed to ask; warn logs the construct, off silences that log.\n//\n// sandboxNetwork controls Codex workspace-write network access. Default false.\n// Set true only when sub-agents need network after permission approval.\n{\n  \"globalConcurrentSubagents\": 20,\n  \"checkForUpdates\": true,\n  \"permissionsCeiling\": \"auto\",\n  \"escalation\": \"irreversible-only\",\n  \"strictReadParity\": \"warn\",\n  \"sandboxNetwork\": false\n}\n";

package/dist/drivers.js

@@ -217,9 +217,29 @@ function permissionSnapshotForLaunch(options) {
         additionalDirectories: merged.additionalDirectories,
         repoConfigChangedSinceFirstSeen: merged.repoConfigChangedSinceFirstSeen,
         strictReadParity: merged.strictReadParity,
+        sandboxNetwork: merged.sandboxNetwork,
     };
     return snapshot;
 }
+export function providerChildSpawnOptions(options, p = process.platform) {
+    return {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+        detached: p !== "win32",
+    };
+}
+export function killProviderChildProcess(child, signal, p = process.platform, killGroup = process.kill) {
+    if (p !== "win32" && typeof child.pid === "number") {
+        try {
+            killGroup(-child.pid, signal);
+            return true;
+        }
+        catch { }
+    }
+    return child.kill(signal);
+}
 function claudeToolName(request) {
     for (const key of ["toolName", "tool_name", "name"]) {
         const value = request[key];
@@ -273,7 +293,7 @@ function resolveOpPaths(paths, cwd) {
         }
     });
 }
-function permissionOpFromClaudeRequest(request, cwd) {
+function permissionOpFromClaudeRequest(request, cwd, additionalDirectories) {
     const input = claudeToolInput(request);
     const command = stringField(input, ["command", "cmd"]);
     const url = stringField(input, ["url"]);
@@ -292,6 +312,7 @@ function permissionOpFromClaudeRequest(request, cwd) {
         ...(paths.length > 0 ? { paths, resolvedPaths: resolveOpPaths(paths, cwd) } : {}),
         ...(url || host ? { network: [{ ...(url ? { url } : {}), ...(host ? { host } : {}) }] } : {}),
         cwd,
+        ...(additionalDirectories ? { additionalDirectories } : {}),
         irreversible: Boolean(input.irreversible),
     };
 }
@@ -316,21 +337,38 @@ function isBypassImmuneClaudeAsk(request, op) {
 function permissionDecisionToClaude(decision, reason) {
     return decision === "allow" ? allowClaudePermission() : denyClaudePermission(reason);
 }
-function resolveCodexLaunchValues(snapshot) {
+function networkAllowRuleTriggersSandbox(rule) {
+    const trimmed = rule.trim();
+    if (/^WebFetch(?:\b|\()/i.test(trimmed))
+        return true;
+    if (/^Bash(?:\(\s*(?:\*|[\w./\\-]*\s*)?\)|$)/i.test(trimmed))
+        return true;
+    return /^Bash\([^)]*\b(?:git\s+(?:push|fetch|pull|clone|ls-remote)|gh|npm|pnpm|yarn|curl|wget)\b/i.test(trimmed);
+}
+export function resolveCodexLaunchValues(snapshot, logTranslation = true) {
     if (snapshot.ceiling === "yolo") {
         return {
             approvalPolicy: "never",
             threadSandbox: "danger-full-access",
             turnSandboxPolicy: { type: "dangerFullAccess" },
+            cliConfigArgs: [],
         };
     }
+    const driverSnapshot = snapshot;
+    const translatedNetworkAllow = (snapshot.rules.allow ?? []).some(networkAllowRuleTriggersSandbox);
+    const networkAccess = Boolean(driverSnapshot.sandboxNetwork || translatedNetworkAllow);
+    if (logTranslation && translatedNetworkAllow && !driverSnapshot.sandboxNetwork) {
+        console.error("[permissions] translated network allow rule(s) to Codex workspace-write network access");
+    }
     return {
         approvalPolicy: "untrusted",
         threadSandbox: "workspace-write",
         turnSandboxPolicy: {
             type: "workspaceWrite",
             writableRoots: snapshot.additionalDirectories ?? [],
+            ...(networkAccess ? { networkAccess: true } : {}),
         },
+        cliConfigArgs: networkAccess ? ["-c", "sandbox_workspace_write.network_access=true"] : [],
     };
 }
 function isCodexApprovalMethod(method) {
@@ -380,7 +418,7 @@ function codexCommandFromParams(params) {
         return { command: argv.join(" "), argv };
     return {};
 }
-export function codexApprovalOp(method, params, cwd) {
+export function codexApprovalOp(method, params, cwd, additionalDirectories) {
     if (method === "item/commandExecution/requestApproval" || method === "execCommandApproval") {
         const command = codexCommandFromParams(params);
         const opCwd = typeof params.cwd === "string" && params.cwd.length > 0 ? params.cwd : cwd;
@@ -389,6 +427,7 @@ export function codexApprovalOp(method, params, cwd) {
                 tool: "Bash",
                 ...command,
                 cwd: opCwd,
+                ...(additionalDirectories ? { additionalDirectories } : {}),
                 irreversible: Boolean(params.irreversible),
             },
             confidence: Boolean(command.command),
@@ -404,6 +443,7 @@ export function codexApprovalOp(method, params, cwd) {
                 tool: codexFileChangeTool(params.fileChanges),
                 ...(paths.length > 0 ? { paths, resolvedPaths: resolveOpPaths(paths, cwd) } : {}),
                 cwd,
+                ...(additionalDirectories ? { additionalDirectories } : {}),
                 irreversible: false,
             },
             confidence: paths.length > 0 || method === "item/fileChange/requestApproval",
@@ -413,6 +453,7 @@ export function codexApprovalOp(method, params, cwd) {
         op: {
             tool: "mcpServer/elicitation",
             cwd,
+            ...(additionalDirectories ? { additionalDirectories } : {}),
             irreversible: false,
         },
         confidence: false,
@@ -598,7 +639,7 @@ export class CodexAppServerDriver {
     kill() {
         this.process.killed = true;
         this.child.stdin?.destroy();
-        this.child.kill("SIGKILL");
+        killProviderChildProcess(this.child, "SIGKILL");
         this.process.kill("SIGKILL");
         this.rejectPending(new Error("codex app-server driver was killed"));
         this.queuedTurns.length = 0;
@@ -732,7 +773,7 @@ export class CodexAppServerDriver {
             return;
         }
         this.pendingApprovals.set(key, record);
-        const { op, confidence } = codexApprovalOp(method, params, this.options.cwd);
+        const { op, confidence } = codexApprovalOp(method, params, this.options.cwd, this.permissionSnapshot.additionalDirectories);
         const strictReadParity = this.permissionSnapshot.strictReadParity ?? "warn";
         if (!confidence && this.permissionSnapshot.ceiling !== "yolo" && strictReadParity === "warn") {
             console.error(`[permissions] strictReadParity warn: Codex approval payload for ${method} could not be matched with full confidence; routing to ask`);
@@ -890,7 +931,7 @@ export class ClaudeSdkDriver {
     // allow/deny; parks (early-returns to the parent, resolves on respond/timeout)
     // when the engine verdict is "ask".
     async gateRequest(request, options, permissionSnapshot, isYolo, harnessChannel) {
-        const op = permissionOpFromClaudeRequest(request, options.cwd);
+        const op = permissionOpFromClaudeRequest(request, options.cwd, permissionSnapshot.additionalDirectories);
         const engineResult = verdict(op, permissionSnapshot.rules);
         if (isYolo && isBypassImmuneClaudeAsk(request, op)) {
             return denyClaudePermission("bypass-immune Claude safety prompt auto-denied under yolo");
@@ -1030,11 +1071,9 @@ export async function createProviderDriver(options) {
         driver.open(options);
         return driver;
     }
-    const child = spawn(options.command, options.args, {
-        cwd: options.cwd,
-        env: options.env,
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true,
-    });
-    return new CodexAppServerDriver(child, options);
+    const permissionSnapshot = permissionSnapshotForLaunch(options);
+    const launchValues = resolveCodexLaunchValues(permissionSnapshot, false);
+    const driverOptions = options.permissionSnapshot ? options : { ...options, permissionSnapshot };
+    const child = spawn(options.command, [...launchValues.cliConfigArgs, ...options.args], providerChildSpawnOptions(options));
+    return new CodexAppServerDriver(child, driverOptions);
 }

package/dist/global-concurrency.jsonc

@@ -30,10 +30,14 @@
 //
 // strictReadParity controls logging only. Unparseable Codex approval payloads
 // always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
 {
   "globalConcurrentSubagents": 20,
   "checkForUpdates": true,
   "permissionsCeiling": "auto",
   "escalation": "irreversible-only",
-  "strictReadParity": "warn"
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
 }

package/dist/global-subagent-mcp-config.jsonc

@@ -30,10 +30,14 @@
 //
 // strictReadParity controls logging only. Unparseable Codex approval payloads
 // always fail closed to ask; warn logs the construct, off silences that log.
+//
+// sandboxNetwork controls Codex workspace-write network access. Default false.
+// Set true only when sub-agents need network after permission approval.
 {
   "globalConcurrentSubagents": 20,
   "checkForUpdates": true,
   "permissionsCeiling": "auto",
   "escalation": "irreversible-only",
-  "strictReadParity": "warn"
+  "strictReadParity": "warn",
+  "sandboxNetwork": false
 }

package/dist/hooks/orchestration-claude.js

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { countJsonlType, runHook, } from "../orchestration/hook-core.js";
+import { hasParentMarker } from "../launch-prompt.js";
 /**
  * Claude Code UserPromptSubmit hook entry. Reads the JSON payload from stdin,
  * runs the provider-agnostic core with the Claude adapter, and writes the
@@ -31,7 +32,10 @@ export const claudeAdapter = {
             return true;
         }
         const entrypoint = env.CLAUDE_CODE_ENTRYPOINT;
-        return typeof entrypoint === "string" && SUBAGENT_ENTRYPOINTS.has(entrypoint);
+        if (typeof entrypoint === "string" && SUBAGENT_ENTRYPOINTS.has(entrypoint)) {
+            return true;
+        }
+        return hasParentMarker(payload.prompt);
     },
     // Count JSONL lines in the transcript whose parsed object.type === 'user'.
     // Delegates to the bounded counter (reads at most the trailing window so a
@@ -41,6 +45,7 @@ export const claudeAdapter = {
     currentTurn(transcriptPath) {
         return countJsonlType(transcriptPath, "user");
     },
+    anonScope: "claude",
     fullDirectiveFile: "orchestration-claude.md",
     shortOnFile: "short-on.md",
     shortOffFile: "short-off.md",

package/dist/hooks/orchestration-codex.js

@@ -1,7 +1,8 @@
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { claimAndEmit, classifyClaim, countJsonlType, cullHookZombies, runHook, sessionKey, } from "../orchestration/hook-core.js";
+import { claimAndEmit, classifyOwnerClaim, countJsonlType, cullHookZombies, ownerKey, runHook, } from "../orchestration/hook-core.js";
 import * as marker from "../orchestration/marker.js";
+import { hasParentMarker } from "../launch-prompt.js";
 /**
  * Codex CLI hook entry. Branches on payload.hook_event_name:
  *   - 'SessionStart'     -> if active and not a subagent, emit FULL + the ON
@@ -19,7 +20,6 @@ const SUBAGENT_SOURCE_STRINGS = new Set([
     "subAgentThreadSpawn",
     "subAgentOther",
 ]);
-const PARENT_PROCESS_MARKER = "this is a request from a parent process";
 export const codexAdapter = {
     isSubagent(payload, env) {
         // subagent-mcp-spawned children inherit this guard and must not claim/nag.
@@ -37,17 +37,7 @@ export const codexAdapter = {
         if (typeof source === "string" && SUBAGENT_SOURCE_STRINGS.has(source)) {
             return true;
         }
-        // Fallback: a parent-process handoff is detectable from the prompt's first
-        // non-empty line (our own subagent contract starts with this sentinel).
-        const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
-        const head = prompt.slice(0, 200);
-        for (const line of head.split("\n")) {
-            const trimmed = line.trim().toLowerCase();
-            if (!trimmed)
-                continue;
-            return trimmed.includes(PARENT_PROCESS_MARKER);
-        }
-        return false;
+        return hasParentMarker(payload.prompt);
     },
     // Count JSONL lines whose parsed object.type === 'turn_context'. Delegates to
     // the bounded counter (reads at most the trailing window so a huge/
@@ -57,6 +47,7 @@ export const codexAdapter = {
     currentTurn(transcriptPath) {
         return countJsonlType(transcriptPath, "turn_context");
     },
+    anonScope: "codex",
     fullDirectiveFile: "orchestration-codex.md",
     shortOnFile: "short-on.md",
     shortOffFile: "short-off.md",
@@ -85,13 +76,14 @@ export function runCodexHook(payload, env, adapter = codexAdapter) {
                 return "";
             }
             const cwd = payload.cwd || process.cwd();
-            if (!marker.isActive(cwd)) {
+            const current = ownerKey(payload, cwd, adapter);
+            marker.writeCurrentSession(cwd, current);
+            if (!marker.isActive(cwd, current)) {
                 return "";
             }
-            const current = sessionKey(payload);
             const turn = adapter.currentTurn(payload.transcript_path);
             const m = marker.readMarker(cwd);
-            const kind = classifyClaim(m.owner_session, m.baseline_turn, current);
+            const kind = classifyOwnerClaim(m, current);
             // Claim/re-claim + emit via the SHARED claim path (one copy of the
             // semantics — FULL + ON reminder, ack-latched CARRYOVER prepend, counter
             // re-baseline). SessionStart claims even on SAME-SESSION (resume) so