@heretyc/subagent-mcp 2.12.8 → 2.12.10

package/dist/index.js

@@ -29,6 +29,7 @@ import { pendingPermissionManager, } from "./pending-permissions.js";
 const agents = new Map();
 const deadlockWindow = createDeadlockWindow();
 const STDOUT_RING_BYTES = 2 * 1024 * 1024;
+export const AGENT_RETENTION_MS = 30 * 60 * 1000;
 // Advanced-ruleset gate: per-process latch with exactly the deadlock-window
 // scoping. The env-check runs lazily at the FIRST launch_agent call; success
 // latches enabled/disabled for the process lifetime, failure never latches.
@@ -116,6 +117,15 @@ const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (server pi
 function errorResult(text) {
     return { content: [{ type: "text", text }], isError: true };
 }
+function currentLaunchDepth(env = process.env) {
+    const raw = env.SUBAGENT_MCP_DEPTH;
+    if (raw !== undefined && raw !== "") {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isInteger(parsed) && parsed >= 0 && String(parsed) === raw.trim())
+            return parsed;
+    }
+    return env.SUBAGENT_MCP_SUBAGENT === "1" ? 1 : 0;
+}
 function envDuration(name, fallback) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -161,6 +171,33 @@ function isLiveAgent(agent) {
         agent.status === "permission_requested" ||
         agent.status === "stalled");
 }
+function isTerminalAgentStatus(status) {
+    return (status === "finished" ||
+        status === "errored" ||
+        status === "stopped" ||
+        status === "zombie_killed");
+}
+export function shouldEvictAgent(agent, now = Date.now(), retentionMs = AGENT_RETENTION_MS) {
+    if (!isTerminalAgentStatus(agent.status))
+        return false;
+    if (!agent.driver.closed)
+        return false;
+    if (!agent.waitReported)
+        return false;
+    if (agent.exitedAt === null)
+        return false;
+    return now - agent.exitedAt > retentionMs;
+}
+export function evictExpiredAgents(agentMap, now = Date.now(), retentionMs = AGENT_RETENTION_MS) {
+    let evicted = 0;
+    for (const [id, agent] of agentMap) {
+        if (!shouldEvictAgent(agent, now, retentionMs))
+            continue;
+        agentMap.delete(id);
+        evicted++;
+    }
+    return evicted;
+}
 function isSameOwnerSlot(agent, slotMeta) {
     if (!slotMeta)
         return true;
@@ -321,6 +358,7 @@ function runToolMaintenance() {
         }
         updateSlotMetadata(agent);
     }
+    evictExpiredAgents(agents, now);
     return records;
 }
 function withMaintenance(handler, options = {}) {
@@ -500,6 +538,7 @@ const reconcileInterval = setInterval(() => {
             });
         }
     }
+    evictExpiredAgents(agents, now);
 }, 10000);
 reconcileInterval.unref();
 // Heavy operating-model + governance guidance for ORCHESTRATION MODE. Carried in
@@ -512,10 +551,10 @@ reconcileInterval.unref();
 // compressed under MCP metadata limits:
 // READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.
 const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are jointly binding; genuine conflict => STOP and ask. Only the hook flips ON/OFF; absence of any tag = UNKNOWN => fail-safe ON.\n\nSOLE CHANNEL. Every launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator: use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex), subagent-mcp, and /workflows. No direct reads/writes; inline-by-right does not exist. Non-delegable step: ask a one-time exception, do only that step, resume delegating.\n\nSUB-AGENT CONTRACT. Every prompt carries objective + output format + tools/sources + boundaries. SCALE: ~1 agent for a fact-find, 2-4 for comparisons; never one-shot multi-phase work; split into atomic steps, one agent each. FAN-OUT independents, sequence dependents, SERIALIZE writers over shared paths (no cwd lock). VERIFY code and non-trivial steps with a separate sub-agent first.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads, orchestrator never reads them. Empty/stalled tail means ALIVE; learn finish via wait, do not poll-loop.\n\nORCHESTRATION OFF. If context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to enable; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime. DISABLE: user-only, never on your own initiative.\n\nMODEL SELECTION. Default smart auto-picks, rejects provider/model/effort selectors. user-approved-overrides honors them 30 min, expires lazily on launch_agent, needs user authorization.";
-const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
+const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that. launch_agent is code-capped at 2 spawn levels below the main orchestrator: depth 1 may launch depth 2 workers; depth 2 workers cannot spawn further.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.12.8",
+    version: "2.12.10",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions and is the orchestrator's sole launch channel. Claude runs via the Claude Agent SDK over the local Claude Code executable; Codex via `codex app-server` over stdio. The server never calls Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
@@ -580,7 +619,11 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, permissionSnapsho
             command: cmd,
             args: buildResult.args,
             cwd: agentCwd,
-            env: { ...process.env, SUBAGENT_MCP_SUBAGENT: "1" },
+            env: {
+                ...process.env,
+                SUBAGENT_MCP_SUBAGENT: "1",
+                SUBAGENT_MCP_DEPTH: String(currentLaunchDepth() + 1),
+            },
             model: candidate.model,
             effort: candidate.effort,
             ucSettingsPath: buildResult.ucSettingsPath,
@@ -894,6 +937,10 @@ server.tool("launch_agent", "Spawn a sub-agent session. CONTRACT: every `prompt`
     deadlock: z.boolean().optional().describe("MANDATE: ALWAYS set deadlock=true when, and ONLY when, 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory — the 3rd attempt onward. Re-wording the prompt does NOT make it a different task; splitting a failed task does NOT reset attempts for its unchanged parts; re-launching for the same deliverable means the prior attempt COUNTS as failed/unsatisfactory ('partial progress' is not an exemption). NEVER set it on a 1st or 2nd attempt, NEVER for a different task, NEVER speculatively. Auto mode only: cannot be combined with provider/model/effort — from the 3rd attempt deadlock outranks any capability override, so drop those params. Passing false is identical to omitting it."),
 }, withMaintenance(async (params) => {
     const { task_category, provider, model, effort, deadlock } = params;
+    const launchDepth = currentLaunchDepth();
+    if (launchDepth >= 2) {
+        return errorResult(`Error: launch_agent depth cap reached: current SUBAGENT_MCP_DEPTH=${launchDepth}. subagent-mcp permits exactly 2 spawn levels below the main orchestrator (depth 0 -> 1 -> 2); depth 2 workers cannot spawn further sub-agents.`);
+    }
     // D19/D20/S8: server silently upserts the parent-process marker as the TRUE
     // first line of every sub-agent prompt (idempotent; never duplicates; never
     // mutates the body). This is what makes the child first-line exemption fire.
@@ -1567,7 +1614,7 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     };
 }));
 // Tool 8: orchestration-mode
-server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query. SOLE CHANNEL holds in BOTH states: subagent-mcp is the only sanctioned way to launch sub-agents; toggling OFF does not lift that. WHAT: default-ON mode for LONG-HORIZON work that would fill the context window if run inline; when ON act as a delegate-ONLY orchestrator — delegate every step, inline-by-right does not exist, a non-delegable atomic step needs a one-time user-approved exception via the structured-question tool (state which + why). OFF upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask whether to remain enabled (every qualifying turn; a decline does not latch; reset the count only when you ask). PERSISTENCE: a permitted disable applies to THIS session only, resumes ON next new session (or after the 2h backstop), no mid-session re-enable. CARRYOVER: if ON was inherited from a prior session (carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker) — notify the user it auto-activated and confirm keeping it ON. DISABLE: never on your own initiative; you may PROPOSE OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation). Full operating model is in this server's MCP `instructions` (read once at initialize) — this is the operational summary only.", {
+server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query. SOLE CHANNEL holds in BOTH states: subagent-mcp is the only sanctioned way to launch sub-agents; toggling OFF does not lift that. WHAT: default-ON mode for LONG-HORIZON work that would fill the context window if run inline; when ON act as a delegate-ONLY orchestrator — delegate every step, inline-by-right does not exist, a non-delegable atomic step needs a one-time user-approved exception via the structured-question tool (state which + why). OFF upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask whether to remain enabled (every qualifying turn; a decline does not latch; reset the count only when you ask). PERSISTENCE: a permitted disable is session-keyed only, applies to THIS session only, resumes ON next new session (or after the 2h backstop), no mid-session re-enable; keyless hosts get only the one-time non-persisted conversational opt-out. CARRYOVER: if ON was inherited from a prior session (carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker) — notify the user it auto-activated and confirm keeping it ON. DISABLE: never on your own initiative; you may PROPOSE OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation). Full operating model is in this server's MCP `instructions` (read once at initialize) — this is the operational summary only.", {
     enabled: z.boolean().optional(),
 }, withMaintenance(async (params) => {
     const cwd = process.cwd();
@@ -1589,10 +1636,13 @@ server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MOD
         };
     }
     else if (params.enabled === false) {
-        if (key)
-            orchestrationMarker.writeDisable(key);
-        else
-            orchestrationMarker.writeDisableCwd(cwd);
+        if (!key) {
+            return errorResult("cannot disable: no session pointer found for this project (the per-turn hook has not fired yet). Disable records are session-keyed only; send one prompt first, or check wiring with `subagent-mcp doctor`.");
+        }
+        if (!orchestrationMarker.isSessionScopedKey(key)) {
+            return errorResult("cannot disable: this host supplies no session identity (no session_id/transcript_path in hook payloads) and disable records are session-keyed only. Offer the user the one-time, non-persisted conversational opt-out for this window; orchestration stays ON.");
+        }
+        orchestrationMarker.writeDisable(key);
         return {
             content: [
                 {
@@ -1613,6 +1663,11 @@ server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MOD
                 type: "text",
                 text: JSON.stringify({
                     orchestration_mode: active ? "ON" : "disabled-this-session",
+                    session_scope: key
+                        ? orchestrationMarker.isSessionScopedKey(key)
+                            ? "session"
+                            : "anonymous"
+                        : "none",
                 }),
             },
         ],
@@ -1820,8 +1875,8 @@ if (isMain) {
     // explicit user permission. On a new session a carried-over legacy ON marker
     // (if any) triggers a one-time prompt asking whether to remain enabled; under
     // default-ON this rarely fires.
-    // (the tool's enabled:false writes a disable record via writeDisable /
-    // writeDisableCwd; it does not call disable().)
+    // (the tool's enabled:false writes only a session-keyed disable record via
+    // writeDisable; keyless persistent-disable requests are refused.)
     getNpmPrefix();
     void checkForNpmUpdate().catch(() => { });
     startLivenessHeartbeat();

package/dist/launch-prompt.js

@@ -7,6 +7,18 @@
 // fail-safe-ON default from recursively orchestrating child sessions (fork-bomb
 // prevention). Idempotent, silent, never mutates the prompt body.
 export const MARKER = "<this is a request from a parent process>";
+export function hasParentMarker(prompt) {
+    if (typeof prompt !== "string")
+        return false;
+    const head = prompt.slice(0, 4096);
+    const nl = head.indexOf("\n");
+    let firstLine = nl === -1 ? head : head.slice(0, nl);
+    if (firstLine.endsWith("\r"))
+        firstLine = firstLine.slice(0, -1);
+    if (firstLine.charCodeAt(0) === 0xfeff)
+        firstLine = firstLine.slice(1);
+    return firstLine.startsWith(MARKER);
+}
 // Return `prompt` with MARKER guaranteed as its literal first line.
 // - First line = position 0 up to the first "\n"; a trailing "\r" (CRLF) is
 //   stripped before comparison only.
@@ -17,13 +29,7 @@ export const MARKER = "<this is a request from a parent process>";
 // - Present (after BOM-strip) -> returned unchanged (no duplicate).
 // - Absent -> MARKER + "\n" + prompt.
 export function ensureParentMarker(prompt) {
-    const nl = prompt.indexOf("\n");
-    let firstLine = nl === -1 ? prompt : prompt.slice(0, nl);
-    if (firstLine.endsWith("\r"))
-        firstLine = firstLine.slice(0, -1);
-    if (firstLine.charCodeAt(0) === 0xfeff)
-        firstLine = firstLine.slice(1);
-    if (firstLine.startsWith(MARKER))
+    if (hasParentMarker(prompt))
         return prompt;
     return MARKER + "\n" + prompt;
 }

package/dist/orchestration/atomic-write.js

@@ -0,0 +1,31 @@
+import { renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+export function atomicWriteFile(path, data, options) {
+    const dir = dirname(path);
+    const tmp = join(dir, `.${basename(path)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+    try {
+        writeFileSync(tmp, data, options);
+        try {
+            renameSync(tmp, path);
+        }
+        catch (e) {
+            const code = e?.code;
+            if (code !== "EEXIST" && code !== "EPERM")
+                throw e;
+            unlinkSync(path);
+            renameSync(tmp, path);
+        }
+    }
+    catch (e) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // Best-effort cleanup only; preserve the original write/rename error.
+        }
+        throw e;
+    }
+}
+export function atomicWriteJson(path, value, options) {
+    atomicWriteFile(path, JSON.stringify(value), options);
+}

package/dist/orchestration/hook-core.js

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, isAbsolute, join } from "node:path";
@@ -30,6 +29,8 @@ import { appendUpdateNotice, readInstalledPackageInfo, } from "./update-check.js
  */
 /** Long-reminder cadence: every Nth counted prompt is a LONG turn. */
 export const REMINDER_PERIOD = 5;
+export const ANON_CLAIM_TTL_MS = 2 * 60 * 60 * 1000;
+const OWNER_CLAIM_CAP = 8;
 /**
  * Resolve the repo-root `directives/` dir at runtime. Honors an explicit plugin
  * root (Claude sets CLAUDE_PLUGIN_ROOT; a generic PLUGIN_ROOT is also accepted)
@@ -161,29 +162,62 @@ export function countJsonlType(transcriptPath, wantedType) {
  * sticky without changing classifyClaim's string/undefined contract.
  */
 export function sessionKey(payload) {
-    if (typeof payload.session_id === "string") {
+    if (typeof payload.session_id === "string" && payload.session_id.length > 0) {
         return payload.session_id;
     }
     if (typeof payload.transcript_path === "string" &&
         payload.transcript_path.length > 0) {
-        return ("tp-" +
-            createHash("sha256")
-                .update(payload.transcript_path, "utf8")
-                .digest("hex")
-                .slice(0, 16));
+        return "tp-" + marker.hashKey(payload.transcript_path);
     }
     return undefined;
 }
-export function classifyClaim(owner_session, baseline_turn, current) {
+export function ownerKey(payload, cwd, adapter) {
+    return sessionKey(payload) ?? marker.anonKey(cwd, adapter.anonScope);
+}
+export function classifyClaim(owner_session, baseline_turn, current, claimed_at = null, now = Date.now()) {
     if (baseline_turn == null || owner_session == null) {
         return "fresh";
     }
-    // owner_session is a real string here.
-    if (current === undefined || owner_session !== current) {
+    if (owner_session !== current) {
         return "carryover";
     }
+    if (!marker.isSessionScopedKey(current)) {
+        const age = typeof claimed_at === "number" ? now - claimed_at : Number.NaN;
+        if (!Number.isFinite(age) || age < 0 || age > ANON_CLAIM_TTL_MS) {
+            return "fresh";
+        }
+    }
     return "same";
 }
+export function classifyOwnerClaim(m, owner, now = Date.now()) {
+    const claim = m.owners?.[owner];
+    if (claim) {
+        return classifyClaim(owner, claim.baseline_turn, owner, claim.claimed_at, now);
+    }
+    const hasLiveOwner = m.owners !== undefined && Object.keys(m.owners).length > 0;
+    if (hasLiveOwner || typeof m.owner_session === "string") {
+        return "carryover";
+    }
+    return "fresh";
+}
+function claimOwner(m, owner, turn, now) {
+    const owners = { ...(m.owners ?? {}) };
+    owners[owner] = { baseline_turn: turn, claimed_at: now };
+    const entries = Object.entries(owners).sort((a, b) => {
+        const at = a[1].claimed_at ?? 0;
+        const bt = b[1].claimed_at ?? 0;
+        return at - bt;
+    });
+    while (entries.length > OWNER_CLAIM_CAP) {
+        const [oldest] = entries.shift() ?? [];
+        if (oldest)
+            delete owners[oldest];
+    }
+    m.owners = owners;
+    m.owner_session = owner;
+    m.baseline_turn = turn;
+    m.claimed_at = now;
+}
 /**
  * Per-prompt reminder cadence emission: the LONG block (longFile) on every
  * REMINDER_PERIOD-th counted prompt, the one-line rule carrier between. When the
@@ -208,8 +242,7 @@ function cadenceEmit(env, adapter, longFile, shortFile, count, persisted) {
  */
 export function claimAndEmit(cwd, current, turn, m, kind, env, adapter) {
     const firstCarryover = kind === "carryover" && !m.carryover_ack;
-    m.baseline_turn = turn;
-    m.owner_session = current ?? null;
+    claimOwner(m, current, turn, Date.now());
     if (kind === "carryover") {
         m.provenance = "carried-over";
         m.carryover_ack = true;
@@ -273,17 +306,16 @@ export function runHook(payload, env, adapter) {
             return "";
         }
         const cwd = payload.cwd || process.cwd();
-        const current = sessionKey(payload);
+        const current = ownerKey(payload, cwd, adapter);
         const updateNoticeSessionId = typeof payload.session_id === "string" ? payload.session_id : undefined;
-        if (current)
-            marker.writeCurrentSession(cwd, current);
+        marker.writeCurrentSession(cwd, current);
         if (!marker.isActive(cwd, current)) {
             // OFF: no claim machinery — just the per-prompt reminder cadence.
             const r = reminder.advance(cwd, current);
             return appendHookUpdateNotice(cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted), updateNoticeSessionId, env);
         }
         const m = marker.readMarker(cwd);
-        const kind = classifyClaim(m.owner_session, m.baseline_turn, current);
+        const kind = classifyOwnerClaim(m, current);
         if (kind === "fresh" || kind === "carryover") {
             const turn = adapter.currentTurn(payload.transcript_path);
             return appendHookUpdateNotice(claimAndEmit(cwd, current, turn, m, kind, env, adapter), updateNoticeSessionId, env);

package/dist/orchestration/liveness.js

@@ -1,5 +1,6 @@
-import { mkdirSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { atomicWriteFile } from "./atomic-write.js";
 import { stateDir } from "./marker.js";
 export const LIVENESS_TTL_MS = 120_000;
 export const LIVENESS_INTERVAL_MS = 30_000;
@@ -9,7 +10,7 @@ export function alivePath() {
 export function touchAlive(now = Date.now()) {
     try {
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(alivePath(), `${now}\n`, { encoding: "utf8", mode: 0o600 });
+        atomicWriteFile(alivePath(), `${now}\n`, { encoding: "utf8", mode: 0o600 });
     }
     catch {
         // Hooks fail open when liveness cannot be observed.

package/dist/orchestration/marker.js

@@ -1,9 +1,11 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { atomicWriteJson } from "./atomic-write.js";
 const markerDir = join(tmpdir(), "subagent-mcp");
 export const ORCH_DISABLE_TTL_MS = 2 * 60 * 60 * 1000; // 2h GC backstop ONLY (independent of model-mode WINDOW_MS)
+export const ANON_PREFIX = "anon-";
 /**
  * Shared per-project state dir for ALL hook state files (marker + reminder
  * counter). Exported so sibling state modules key off the SAME location — a
@@ -34,7 +36,7 @@ export function normalizeCwd(cwd) {
     }
     return p;
 }
-function hashKey(key) {
+export function hashKey(key) {
     return createHash("sha256")
         .update(key, "utf8")
         .digest("hex")
@@ -43,6 +45,12 @@ function hashKey(key) {
 export function cwdHash(cwd) {
     return hashKey(normalizeCwd(cwd));
 }
+export function anonKey(cwd, scope) {
+    return `${ANON_PREFIX}${scope}-${cwdHash(cwd)}`;
+}
+export function isSessionScopedKey(key) {
+    return !key.startsWith(ANON_PREFIX);
+}
 export function markerPath(cwd) {
     return join(markerDir, "orch-" + cwdHash(cwd) + ".flag");
 }
@@ -74,10 +82,12 @@ export function enable(cwd) {
         const state = {
             owner_session: null,
             baseline_turn: null,
+            claimed_at: null,
+            owners: {},
             provenance: "user-enabled",
             carryover_ack: false,
         };
-        writeFileSync(markerPath(cwd), JSON.stringify(state), { encoding: "utf8", mode: 0o600 });
+        atomicWriteJson(markerPath(cwd), state, { encoding: "utf8", mode: 0o600 });
         try {
             unlinkSync(cwdDisablePath(cwd));
         }
@@ -91,26 +101,12 @@ export function enable(cwd) {
         // Fail-safe: never throw to the caller.
     }
 }
-/**
- * Disable orchestration for cwd using cwd-keyed shared fallback state. The
- * hook's session-keyed path uses writeDisable(sessionKey) instead.
- */
-export function disable(cwd) {
-    try {
-        mkdirSync(markerDir, { recursive: true, mode: 0o700 });
-        writeFileSync(cwdDisablePath(cwd), JSON.stringify({ disabled_at: Date.now() }), {
-            encoding: "utf8",
-            mode: 0o600,
-        });
-    }
-    catch {
-        // Fail-safe: never throw to the caller.
-    }
-}
 export function writeDisable(sessionKey) {
+    if (!isSessionScopedKey(sessionKey))
+        return;
     try {
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(disablePath(sessionKey), JSON.stringify({ disabled_at: Date.now() }), {
+        atomicWriteJson(disablePath(sessionKey), { disabled_at: Date.now() }, {
             encoding: "utf8",
             mode: 0o600,
         });
@@ -119,13 +115,9 @@ export function writeDisable(sessionKey) {
         // Fail-safe: never throw to the caller.
     }
 }
-export function writeDisableCwd(cwd) {
+export function removeDisable(sessionKey) {
     try {
-        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(cwdDisablePath(cwd), JSON.stringify({ disabled_at: Date.now() }), {
-            encoding: "utf8",
-            mode: 0o600,
-        });
+        unlinkSync(disablePath(sessionKey));
     }
     catch {
         // Fail-safe: never throw to the caller.
@@ -134,13 +126,13 @@ export function writeDisableCwd(cwd) {
 export function writeCurrentSession(cwd, sessionKey, serverKey = process.ppid) {
     try {
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(serverSessionPointerPath(cwd, serverKey), JSON.stringify({ session_key: sessionKey }), {
+        atomicWriteJson(serverSessionPointerPath(cwd, serverKey), { session_key: sessionKey }, {
             encoding: "utf8",
             mode: 0o600,
         });
         // Back-compat only: older consumers may still read the cwd-keyed pointer.
         // New disable/query paths must read the server-scoped pointer instead.
-        writeFileSync(sessionPointerPath(cwd), JSON.stringify({ session_key: sessionKey }), {
+        atomicWriteJson(sessionPointerPath(cwd), { session_key: sessionKey }, {
             encoding: "utf8",
             mode: 0o600,
         });
@@ -153,6 +145,15 @@ export function readCurrentSession(cwd, serverKey = process.ppid) {
     try {
         const raw = readFileSync(serverSessionPointerPath(cwd, serverKey), "utf8");
         const parsed = JSON.parse(raw);
+        if (typeof parsed.session_key === "string")
+            return parsed.session_key;
+    }
+    catch {
+        // Fall through to legacy cwd pointer below.
+    }
+    try {
+        const raw = readFileSync(sessionPointerPath(cwd), "utf8");
+        const parsed = JSON.parse(raw);
         return typeof parsed.session_key === "string" ? parsed.session_key : undefined;
     }
     catch {
@@ -177,13 +178,42 @@ function isDisableActive(path, now) {
 }
 export function isActive(cwd, sessionKey) {
     try {
-        const path = sessionKey === undefined ? cwdDisablePath(cwd) : disablePath(sessionKey);
-        return !isDisableActive(path, Date.now());
+        if (sessionKey === undefined || !isSessionScopedKey(sessionKey))
+            return true;
+        return !isDisableActive(disablePath(sessionKey), Date.now());
     }
     catch {
         return true;
     }
 }
+function readOwners(parsed) {
+    const owners = {};
+    if (parsed.owners && typeof parsed.owners === "object") {
+        for (const [owner, claim] of Object.entries(parsed.owners)) {
+            if (!owner || !claim || typeof claim !== "object")
+                continue;
+            const baseline = claim.baseline_turn;
+            const claimed = claim.claimed_at;
+            if (typeof baseline !== "number" || !Number.isFinite(baseline))
+                continue;
+            owners[owner] = {
+                baseline_turn: baseline,
+                claimed_at: typeof claimed === "number" && Number.isFinite(claimed) ? claimed : null,
+            };
+        }
+    }
+    if (Object.keys(owners).length === 0 &&
+        typeof parsed.owner_session === "string" &&
+        typeof parsed.baseline_turn === "number" &&
+        Number.isFinite(parsed.baseline_turn)) {
+        const claimed = parsed.claimed_at;
+        owners[parsed.owner_session] = {
+            baseline_turn: parsed.baseline_turn,
+            claimed_at: typeof claimed === "number" && Number.isFinite(claimed) ? claimed : null,
+        };
+    }
+    return owners;
+}
 export function readMarker(cwd) {
     try {
         const raw = readFileSync(markerPath(cwd), "utf8");
@@ -194,6 +224,10 @@ export function readMarker(cwd) {
         return {
             owner_session: typeof parsed.owner_session === "string" ? parsed.owner_session : null,
             baseline_turn: typeof parsed.baseline_turn === "number" ? parsed.baseline_turn : null,
+            claimed_at: typeof parsed.claimed_at === "number" && Number.isFinite(parsed.claimed_at)
+                ? parsed.claimed_at
+                : null,
+            owners: readOwners(parsed),
             provenance,
             carryover_ack: typeof parsed.carryover_ack === "boolean" ? parsed.carryover_ack : false,
         };
@@ -203,6 +237,8 @@ export function readMarker(cwd) {
         return {
             owner_session: null,
             baseline_turn: null,
+            claimed_at: null,
+            owners: {},
             provenance: null,
             carryover_ack: false,
         };
@@ -212,16 +248,9 @@ export function writeMarker(cwd, obj) {
     try {
         // Owner-only perms (see enable()): the marker persists owner_session.
         mkdirSync(markerDir, { recursive: true, mode: 0o700 });
-        writeFileSync(markerPath(cwd), JSON.stringify(obj), { encoding: "utf8", mode: 0o600 });
+        atomicWriteJson(markerPath(cwd), obj, { encoding: "utf8", mode: 0o600 });
     }
     catch {
         // Fail-safe.
     }
 }
-/**
- * Cwd-keyed disable alias, identical to disable. RETAINED for callers that
- * clear legacy marker state explicitly (e.g. the tool's enabled:false path).
- */
-export function clearForCwd(cwd) {
-    disable(cwd);
-}

package/dist/orchestration/model-mode.js

@@ -1,5 +1,6 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { atomicWriteJson } from "./atomic-write.js";
 import { cwdHash, stateDir } from "./marker.js";
 /**
  * Per-project model-selection mode — the SINGLE source of truth for whether a
@@ -37,7 +38,7 @@ function writeModelMode(cwd, state) {
     try {
         // Owner-only perms (mirror marker.ts): the file persists an enable-time.
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(modelModePath(cwd), JSON.stringify(state), {
+        atomicWriteJson(modelModePath(cwd), state, {
             encoding: "utf8",
             mode: 0o600,
         });

package/dist/orchestration/pretool.js

@@ -23,8 +23,6 @@ function decision(permissionDecision, permissionDecisionReason, additionalContex
 export function runClaudePreTool(payload, env, now = Date.now()) {
     try {
         const zombieRecords = cullHookZombies();
-        if (env.SUBAGENT_MCP_SUBAGENT === "1")
-            return null;
         const maintenanceAllowedDecision = zombieRecords.length > 0
             ? decision("allow", "maintenance completed; allowing requested tool.")
             : null;
@@ -36,6 +34,8 @@ export function runClaudePreTool(payload, env, now = Date.now()) {
         if (NATIVE_SUBAGENT_TOOLS.has(tool)) {
             return decision("deny", "subagent-mcp is alive; harness-native Task/Agent/Explore is not the sanctioned sub-agent channel. Use the subagent-mcp launch_agent MCP tool with the parent-process sentinel as prompt line 1.");
         }
+        if (env.SUBAGENT_MCP_SUBAGENT === "1")
+            return maintenanceAllowedDecision;
         return maintenanceAllowedDecision;
     }
     catch {

package/dist/orchestration/reminder.js

@@ -1,5 +1,6 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { atomicWriteJson } from "./atomic-write.js";
 import { cwdHash, stateDir } from "./marker.js";
 /** Bound the per-owner map so a busy multi-session cwd cannot grow it without
  * limit; evicting ALL entries on overflow is crude but rare and self-heals. */
@@ -34,7 +35,7 @@ export function writeReminder(cwd, obj) {
     try {
         // Owner-only perms (see marker.enable()): the state persists session keys.
         mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-        writeFileSync(reminderPath(cwd), JSON.stringify(obj), {
+        atomicWriteJson(reminderPath(cwd), obj, {
             encoding: "utf8",
             mode: 0o600,
         });