@heretyc/subagent-mcp 2.8.6 → 2.8.8

package/dist/drivers.js

@@ -2,6 +2,13 @@ import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { PassThrough } from "node:stream";
 import { mapModel } from "./effort.js";
+export class ProviderTransientError extends Error {
+    isTransient = true;
+    constructor(message) {
+        super(message);
+        this.name = "ProviderTransientError";
+    }
+}
 class LogicalProcess extends EventEmitter {
     pid;
     stdout = new PassThrough();
@@ -120,10 +127,18 @@ function userMessage(text) {
 function textInput(text) {
     return { type: "text", text, text_elements: [] };
 }
-class MockJsonlDriver {
+export class MockJsonlDriver {
     child;
     provider;
+    static transientPreStartHook = null;
+    static postStartErrorHook = null;
     process;
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     queue = Promise.resolve();
     turn = 0;
     constructor(child, provider) {
@@ -136,7 +151,10 @@ class MockJsonlDriver {
             if (!this.process.killed)
                 this.process.close(code, signal);
         });
-        child.stdout?.on("data", (chunk) => this.process.stdout.write(chunk));
+        child.stdout?.on("data", (chunk) => {
+            this._definitelyStartedResolve();
+            this.process.stdout.write(chunk);
+        });
         child.stderr?.on("data", (chunk) => this.process.stderr.write(chunk));
         // Swallow stdin pipe errors (e.g. EPIPE writing to an exited child): the
         // writeLine() callback already surfaces the failure; without this listener
@@ -147,6 +165,20 @@ class MockJsonlDriver {
         return this.process.killed || this.child.killed || this.child.exitCode !== null;
     }
     start(message) {
+        if (MockJsonlDriver.transientPreStartHook) {
+            MockJsonlDriver.transientPreStartHook(this.provider);
+            const err = new ProviderTransientError(`mock transient pre-start failure (${this.provider})`);
+            this._definitelyStartedReject(err);
+            return Promise.reject(err);
+        }
+        if (MockJsonlDriver.postStartErrorHook) {
+            this._definitelyStartedResolve();
+            MockJsonlDriver.postStartErrorHook(this.provider);
+            setTimeout(() => {
+                this.process.stderr.write(`mock post-start error (${this.provider})\n`);
+                this.process.close(1);
+            }, 0);
+        }
         return this.send(message);
     }
     send(message) {
@@ -175,6 +207,12 @@ export class CodexAppServerDriver {
     child;
     options;
     process;
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     pending = new Map();
     queuedTurns = [];
     nextId = 1;
@@ -341,6 +379,7 @@ export class CodexAppServerDriver {
             const turn = (message.params.turn ?? {});
             if (typeof turn.id === "string")
                 this.activeTurnId = turn.id;
+            this._definitelyStartedResolve();
         }
         if (message.method === "turn/completed") {
             this.activeTurnId = null;
@@ -349,6 +388,9 @@ export class CodexAppServerDriver {
         }
     }
     fail(error) {
+        const msg = error.message;
+        const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+        this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : error);
         this.process.fail(error);
         this.rejectPending(error);
     }
@@ -364,6 +406,12 @@ export class CodexAppServerDriver {
 export class ClaudeSdkDriver {
     queryFn;
     process = new LogicalProcess(undefined, true);
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     input = new AsyncInputQueue();
     abortController = new AbortController();
     queue = Promise.resolve();
@@ -421,8 +469,13 @@ export class ClaudeSdkDriver {
         this.process.kill("SIGKILL");
     }
     async pump(query) {
+        let started = false;
         try {
             for await (const message of query) {
+                if (!started) {
+                    started = true;
+                    this._definitelyStartedResolve();
+                }
                 this.process.stdout.write(`${JSON.stringify(message)}\n`);
             }
             this.closedFlag = true;
@@ -430,8 +483,11 @@ export class ClaudeSdkDriver {
         }
         catch (error) {
             if (!this.process.killed) {
+                const msg = error instanceof Error ? error.message : String(error);
+                const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+                this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : new Error(msg));
                 this.closedFlag = true;
-                this.process.stderr.write(error instanceof Error ? error.message : String(error));
+                this.process.stderr.write(msg);
                 this.process.close(1);
             }
         }

package/dist/effort.js

@@ -14,6 +14,9 @@ export function mapModel(provider, model) {
 }
 export function resolveEffort(provider, model, effort) {
     const isOpus48 = provider === "claude" && (model === "opus" || model === "opus-4-8");
+    if (effort === "low") {
+        throw new Error(`low effort is not supported. Valid efforts: medium, high, xhigh, max, ultracode.`);
+    }
     if (effort === "ultracode") {
         if (!isOpus48) {
             throw new Error(`ultracode effort is only available on Opus 4.8+ (got ${provider}/${model}). Use xhigh for other models.`);
@@ -24,15 +27,15 @@ export function resolveEffort(provider, model, effort) {
         return { kind: "none" };
     }
     if (provider === "claude" && ["sonnet", "opus", "opus-4-8"].includes(model)) {
-        if (["low", "medium", "high", "xhigh", "max"].includes(effort)) {
+        if (["medium", "high", "xhigh", "max"].includes(effort)) {
             return { kind: "flag", value: effort };
         }
     }
     if (provider === "codex") {
         if (effort === "max") {
-            throw new Error(`max effort is not valid for gpt-5.5 (Codex). Valid: low, medium, high, xhigh.`);
+            throw new Error(`max effort is not valid for gpt-5.5 (Codex). Valid: medium, high, xhigh.`);
         }
-        if (["low", "medium", "high", "xhigh"].includes(effort)) {
+        if (["medium", "high", "xhigh"].includes(effort)) {
             return { kind: "flag", value: effort };
         }
     }

package/dist/hooks/orchestration-claude.js

@@ -1,7 +1,6 @@
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { countJsonlType, runHook, } from "../orchestration/hook-core.js";
-import { resetToolCount } from "../orchestration/pretool.js";
 /**
  * Claude Code UserPromptSubmit hook entry. Reads the JSON payload from stdin,
  * runs the provider-agnostic core with the Claude adapter, and writes the
@@ -51,9 +50,6 @@ export const claudeAdapter = {
 };
 export function runClaudeHook(payload, env, adapter = claudeAdapter) {
     try {
-        if (!adapter.isSubagent(payload, env)) {
-            resetToolCount(payload);
-        }
         return runHook(payload, env, adapter);
     }
     catch {

package/dist/index.js

@@ -19,7 +19,9 @@ import { loadRoutingTable, buildCandidates, validatePresence, TASK_CATEGORIES, A
 import { createDeadlockWindow } from "./deadlock.js";
 import { createRulesetGate, RULESET_HARD_FAIL_MSG, } from "./ruleset.js";
 import * as orchestrationMarker from "./orchestration/marker.js";
+import * as modelMode from "./orchestration/model-mode.js";
 import { startLivenessHeartbeat } from "./orchestration/liveness.js";
+import { ensureParentMarker } from "./launch-prompt.js";
 const agents = new Map();
 const MAX_CLAUDE = 5;
 const MAX_CODEX = 5;
@@ -51,6 +53,23 @@ const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (server pi
 function errorResult(text) {
     return { content: [{ type: "text", text }], isError: true };
 }
+export function classifyFailureReason(reason, stderr) {
+    const text = `${reason}\n${stderr}`;
+    return /\b429\b|\b5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(text)
+        ? "transient_provider"
+        : "permanent";
+}
+function buildFailoverNote(skipped, winner) {
+    const top = skipped[0];
+    const topLabel = `${top.model}@${top.effort} (${top.provider})`;
+    const winnerLabel = `${winner.model}@${winner.effort} (${winner.provider})`;
+    return `Rank-1 candidate ${topLabel} failed with ${top.failure_type === "transient_provider" ? "a transient provider error" : "a permanent error"}; auto-selected ${winnerLabel}.`;
+}
+function failureTypeForError(error, stderr) {
+    return error.isTransient
+        ? "transient_provider"
+        : classifyFailureReason(error.message, stderr);
+}
 const isWindows = process.platform === "win32";
 let _npmPrefix = null;
 function getNpmPrefix() {
@@ -116,11 +135,15 @@ reconcileInterval.unref();
 // initialize (per the MCP spec the initialize result has an `instructions`
 // field) rather than re-injecting it on every turn. The bundled per-turn hook
 // injects only a small compact reminder; this is the durable, full explanation.
-const ORCHESTRATION_INSTRUCTIONS = "BINDING IN BOTH MODES - SOLE CHANNEL: while this server is connected, EVERY sub-agent launch goes through launch_agent; harness Task/Agent tools AND any other spawn path (shell claude -p/codex exec, skills) FORBIDDEN. 5-CALL RULE: >5 tool calls needed for the request (all turns, no reset), or >5 already spent? If yes you MUST use orchestration mode + this server; OFF -> ask the user before enabling, a decline authorizes inline for that request. ORCHESTRATION MODE (orchestration-mode tool). WHAT: per-project toggle for LONG-HORIZON work that would fill the context window inline. OPERATING MODEL: when ON you are a delegate-default orchestrator: decompose, DELEGATE/offload; EVERY reply starts: route: delegate|inline - <reason>. MUST DELEGATE/OFFLOAD: pure compute; any payload >50KB or >200 lines via temp scratch-file path handoff (%TEMP% / /tmp); mixed = SPLIT (one MCP-bound step != whole-task inline); keep the orchestrator context lean. INLINE BY RIGHT - the ONLY exemption: steps bound to main-session-only capability (non-inheritable MCP tools, interactive/consent tools, verify loops = re-run existing checks); state which and why. CONFLICT ORDER: safety-scope > user instruction this turn > 5-CALL RULE/delegate-default. User tool-pin re-partitions work; never suspends mode. PERSISTENCE: per-project marker; survives restarts/sessions until disabled with user permission. CARRYOVER: inherited-ON gets a notice ONCE per marker; you MUST tell the user it auto-activated, ask keep ON?, advise fit. DISABLE: never on own initiative. You MAY propose it on task-fit mismatch (bounded/interactive/MCP-bound): explain WHAT+WHY, ask via AskUserQuestion (Claude) / request-user-input (Codex); only explicit approval may call orchestration-mode enabled:false. Declined -> continue under inline-by-right; ask once per topic, never re-nag. Per-turn injection: CLI hosts with bundled hook only; desktop hosts toggle the marker but inject nothing.";
-const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.";
+// Canonical A2 mirror fragment retained byte-identical for
+// test/mirror-fragments.test.mjs while ORCHESTRATION_INSTRUCTIONS below stays
+// compressed under MCP metadata limits:
+// READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.
+const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask the user. Only the hook state changes ON/OFF.\n\nSOLE CHANNEL. Every sub-agent launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator. Use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp. No direct reads/writes; inline-by-right does not exist. Non-delegable atomic step: ask for a one-time exception, do only that step, then resume delegating.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads; orchestrator never reads those files. Empty/stalled tail means ALIVE; use wait.\n\nORCHESTRATION OFF. If total context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to switch ON; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask; stay halted until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime.\n\nMODEL SELECTION MODE. Default smart rejects provider/model/effort selectors; launch_agent auto-picks. user-approved-overrides lasts 30 minutes, expires lazily on launch_agent, and must be enabled only after explicit user authorization via AskUserQuestion/request-user-input.";
+const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.8.6",
+    version: "2.8.8",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions. Claude uses the Claude Agent SDK over the local Claude Code executable; Codex uses `codex app-server` over stdio. The server does not call Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
@@ -155,9 +178,8 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     const running = countProcessing(candidate.provider);
     const max = candidate.provider === "claude" ? MAX_CLAUDE : MAX_CODEX;
     if (running >= max) {
-        return {
-            reason: `Maximum ${max} concurrent ${candidate.provider} agents already running. Current: ${running}`,
-        };
+        const reason = `Maximum ${max} concurrent ${candidate.provider} agents already running. Current: ${running}`;
+        return { reason, failure_type: "permanent" };
     }
     // Build the command. haiku ignores effort; pass "high" placeholder for the
     // "none" sentinel (buildCommand drops it for haiku anyway).
@@ -169,13 +191,14 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         cmd = resolveExe(candidate.provider);
     }
     catch (e) {
-        return { reason: e instanceof Error ? e.message : String(e) };
+        const reason = e instanceof Error ? e.message : String(e);
+        return { reason, failure_type: "permanent" };
     }
     // Fast-fail absolute paths only. Bare names intentionally rely on PATH; spawn
     // below resolves them and reports ENOENT/EACCES through the same failure path.
     if (isAbsolute(cmd) && !existsSync(cmd)) {
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: `CLI executable not found: ${cmd}` };
+        return { reason: `CLI executable not found: ${cmd}`, failure_type: "permanent" };
     }
     let driver;
     try {
@@ -193,9 +216,24 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     catch (error) {
         // Synchronous spawn throw (rare) — clean up and report as a launch failure.
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: error instanceof Error ? error.message : String(error) };
+        const reason = error instanceof Error ? error.message : String(error);
+        return { reason, failure_type: classifyFailureReason(reason, "") };
     }
     const childProcess = driver.process;
+    let definitelyStarted = false;
+    const definitelyStartedProbe = driver.definitelyStarted.then(() => {
+        definitelyStarted = true;
+        return true;
+    }, () => {
+        return false;
+    });
+    const readStartedBoundary = async () => {
+        await Promise.race([
+            definitelyStartedProbe,
+            new Promise((resolve) => setTimeout(resolve, 0)),
+        ]);
+        return definitelyStarted;
+    };
     // Await the one-shot spawn/error race. The 'error' handler is attached BEFORE
     // we await so an async ENOENT cannot escape as an unhandled event.
     try {
@@ -216,7 +254,8 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         }
         catch { }
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: err instanceof Error ? err.message : String(err) };
+        const reason = err instanceof Error ? err.message : String(err);
+        return { reason, failure_type: classifyFailureReason(reason, "") };
     }
     // Spawn succeeded. Register the agent exactly as before. Keep a persistent
     // 'error' handler so a LATE spawn error never crashes the process; fold it
@@ -366,6 +405,15 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     }
     catch (err) {
         startError = err instanceof Error ? err : new Error(String(err));
+        await readStartedBoundary();
+        if (!definitelyStarted) {
+            const reason = startError.message;
+            cleanupUcSettings(agentState);
+            return {
+                reason,
+                failure_type: failureTypeForError(startError, agentState.stderr),
+            };
+        }
     }
     // Post-spawn grace window: a 'spawn' win alone is NOT success — a provider
     // driver that starts then dies immediately must advance the attempt loop, not
@@ -398,14 +446,22 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
             // turn.completed fast completion must never be misread as a launch
             // failure and the task silently re-executed on the next candidate.
             await closedAfterFlush;
-            if (!agentState.turnCompleted) {
+            const startedBeforeExit = await readStartedBoundary();
+            if (!agentState.turnCompleted && !startedBeforeExit) {
                 const tail = agentState.stderr.trim().split("\n").slice(-1)[0] ?? "";
+                const reason = `process exited (code ${earlyExit.code ?? earlyExit.signal}) within ${SPAWN_GRACE_MS}ms of spawn${tail ? `: ${tail}` : ""}`;
                 return {
-                    reason: `process exited (code ${earlyExit.code ?? earlyExit.signal}) within ${SPAWN_GRACE_MS}ms of spawn${tail ? `: ${tail}` : ""}`,
+                    reason,
+                    failure_type: classifyFailureReason(reason, agentState.stderr),
                 };
             }
         }
         else if (startError && !agentState.turnCompleted) {
+            const startedBeforeStartError = await readStartedBoundary();
+            if (startedBeforeStartError) {
+                agents.set(agentId, agentState);
+                return { agentId };
+            }
             // Lived past the grace window but the startup write failed: the child is
             // not accepting input, so advance the loop rather than register an agent
             // that never received its prompt.
@@ -414,7 +470,10 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
             }
             catch { }
             cleanupUcSettings(agentState);
-            return { reason: startError.message };
+            return {
+                reason: startError.message,
+                failure_type: failureTypeForError(startError, agentState.stderr),
+            };
         }
     }
     agents.set(agentId, agentState);
@@ -429,16 +488,20 @@ function sameTriples(a, b) {
     return a.every((c, i) => c.provider === b[i].provider && c.model === b[i].model && c.effort === b[i].effort);
 }
 // Tool 1: launch_agent
-server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory first attempt unless an override is licensed below): pass only `prompt` + `task_category` and NO overrides; the server picks the best provider/model/effort for that category from its routing table, launches the top candidate, and silently falls back to the next-best on launch failure. `provider`/`model`/`effort` are overrides — licensed on 1st/2nd attempts ONLY when the task verifiably requires a specific capability; STATE that capability when overriding; if you pass `model` you must also pass `provider`, and if you pass `effort` you must pass both `provider` and `model`. SOLE CHANNEL: while this server is connected this tool is the ONLY sanctioned way to spawn sub-agents, in BOTH orchestration states — harness-native Task/Agent tools are FORBIDDEN for sub-agent launches. PROMPT RULE: the FIRST line of every `prompt` MUST be \"<this is a request from a parent process>\" (sub-agent self-identification). Unsure which task_category fits? Don't submit one amorphous task — SPLIT into atomic steps that each map to a single category, one agent per step. ultracode effort is Opus 4.8+ only. Claude uses a Claude Agent SDK logical session over the local Claude executable; Codex uses a `codex app-server` child. Children run with env SUBAGENT_MCP_SUBAGENT=1 so the orchestration hooks skip them (they are not orchestrators and don't re-trigger carryover). Launch returns status `processing` (alive); a later `stalled` is alive-but-quiet (thinking or awaiting a temp-file handoff), NOT dead — wait or re-poll, don't kill (see poll_agent). DEADLOCK RULE: you MUST ALWAYS set `deadlock=true` when 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory (the 3rd attempt onward; re-wording or re-splitting the prompt does NOT make it a different task), and NEVER otherwise — from the 3rd attempt deadlock outranks any capability override: drop provider/model/effort.", {
+server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory first attempt unless an override is licensed below): pass only `prompt` + `task_category` and NO overrides; the server picks the best provider/model/effort for that category from its routing table, launches the top candidate, and silently falls back to the next-best on launch failure. `provider`/`model`/`effort` are overrides — licensed on 1st/2nd attempts ONLY when the task verifiably requires a specific capability; STATE that capability when overriding; if you pass `model` you must also pass `provider`, and if you pass `effort` you must pass both `provider` and `model`. SOLE CHANNEL: while this server is connected this tool is the ONLY sanctioned way to spawn sub-agents, in BOTH orchestration states — harness-native Task/Agent tools are FORBIDDEN for sub-agent launches. PROMPT RULE: every sub-agent `prompt`'s first line is the self-identification marker \"<this is a request from a parent process>\"; the server now UPSERTS this marker as the true first line automatically (idempotent — it is never duplicated and your prompt body is never mutated), so you need not add it yourself. Unsure which task_category fits? Don't submit one amorphous task — SPLIT into atomic steps that each map to a single category, one agent per step. ultracode effort is Opus 4.8+ only. Claude uses a Claude Agent SDK logical session over the local Claude executable; Codex uses a `codex app-server` child. Children run with env SUBAGENT_MCP_SUBAGENT=1 so the orchestration hooks skip them (they are not orchestrators and don't re-trigger carryover). Launch returns status `processing` (alive); a later `stalled` is alive-but-quiet (thinking or awaiting a temp-file handoff), NOT dead — wait or re-poll, don't kill (see poll_agent). DEADLOCK RULE: you MUST ALWAYS set `deadlock=true` when 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory (the 3rd attempt onward; re-wording or re-splitting the prompt does NOT make it a different task), and NEVER otherwise — from the 3rd attempt deadlock outranks any capability override: drop provider/model/effort.", {
     task_category: z.enum(TASK_CATEGORIES).describe(TASK_CATEGORY_GLOSS),
     prompt: z.string().min(1),
     provider: z.enum(["claude", "codex"]).optional(),
     model: z.enum(["haiku", "sonnet", "opus", "opus-4-8", "gpt-5.5"]).optional(),
-    effort: z.enum(["low", "medium", "high", "xhigh", "max", "ultracode"]).optional(),
+    effort: z.enum(["medium", "high", "xhigh", "max", "ultracode"]).optional(),
     cwd: z.string().optional(),
     deadlock: z.boolean().optional().describe("MANDATE: ALWAYS set deadlock=true when, and ONLY when, 2 launch attempts for the SAME atomic task have already failed or been unsatisfactory — the 3rd attempt onward. Re-wording the prompt does NOT make it a different task; splitting a failed task does NOT reset attempts for its unchanged parts; re-launching for the same deliverable means the prior attempt COUNTS as failed/unsatisfactory ('partial progress' is not an exemption). NEVER set it on a 1st or 2nd attempt, NEVER for a different task, NEVER speculatively. Auto mode only: cannot be combined with provider/model/effort — from the 3rd attempt deadlock outranks any capability override, so drop those params. Passing false is identical to omitting it."),
 }, async (params) => {
-    const { task_category, provider, model, effort, prompt, deadlock } = params;
+    const { task_category, provider, model, effort, deadlock } = params;
+    // D19/D20/S8: server silently upserts the parent-process marker as the TRUE
+    // first line of every sub-agent prompt (idempotent; never duplicates; never
+    // mutates the body). This is what makes the child first-line exemption fire.
+    const prompt = ensureParentMarker(params.prompt);
     const agentCwd = params.cwd || process.cwd();
     // 1-5. Param-presence validation (zod already constrains task_category, but
     //       hard-validate so the spec error text — valid list + hints, and the
@@ -448,6 +511,10 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
     if (presenceError) {
         return errorResult(presenceError);
     }
+    const modelGate = modelMode.gateLaunch(agentCwd, { provider, model, effort });
+    if (!modelGate.allowed) {
+        return errorResult(modelGate.message ?? modelMode.SELECTOR_REJECTION_MESSAGE);
+    }
     // 6. Build the candidate list per mode.
     const overrides = { provider, model, effort };
     const isExplicit = !!(provider && model && effort);
@@ -537,6 +604,17 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
             if (branch === "performance") {
                 deadlockWindow.consume();
             }
+            if (skipped.length > 0) {
+                const registeredAgent = agents.get(outcome.agentId);
+                if (registeredAgent) {
+                    registeredAgent.failoverFrom = skipped.map((s) => ({
+                        provider: s.provider,
+                        model: s.model,
+                        effort: s.effort,
+                        failure_type: s.failure_type,
+                    }));
+                }
+            }
             return {
                 content: [
                     {
@@ -554,6 +632,18 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
                                     ruleset_original_selection: rulesetOriginalSelection,
                                 }
                                 : {}),
+                            ...(skipped.length > 0
+                                ? {
+                                    failover_occurred: true,
+                                    failover_from: skipped.map((s) => ({
+                                        provider: s.provider,
+                                        model: s.model,
+                                        effort: s.effort,
+                                        failure_type: s.failure_type,
+                                    })),
+                                    failover_note: buildFailoverNote(skipped, candidate),
+                                }
+                                : {}),
                         }),
                     },
                 ],
@@ -564,17 +654,24 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
             effort: candidate.effort,
             provider: candidate.provider,
             reason: outcome.reason,
+            failure_type: outcome.failure_type,
         });
+        if (!pureAuto) {
+            break;
+        }
     }
-    // 7. All candidates failed. A ruleset-modified explicit launch may have
-    //    attempted N≠1 candidates — only the numbered ALL_FAILED shape can
-    //    report that, so the explicit shape is reserved for unmodified launches.
-    if (isExplicit && !rulesetApplied) {
+    // 7. All candidates failed. Override selector modes are single-attempt hard
+    //    failures; pure auto mode reports the attempted candidates.
+    if (!pureAuto) {
         const f = skipped[0];
-        return errorResult(`Error: explicit launch ${f.model}@${f.effort} (${f.provider}) failed: ${f.reason}.\n${AUTO_HINT}`);
+        const transientNote = f.failure_type === "transient_provider"
+            ? `\nNote: this failure appears transient (quota/rate-limit/network). Switch to auto mode (omit provider/model/effort) for automatic silent failover to the next-best provider.`
+            : "";
+        const label = isExplicit ? "explicit" : "override";
+        return errorResult(`Error: ${label} launch ${f.model}@${f.effort} (${f.provider}) failed: ${f.reason}.${transientNote}\n${AUTO_HINT}`);
     }
     const lines = skipped
-        .map((s, i) => `  ${i + 1}. ${s.model}@${s.effort} (${s.provider}): ${s.reason}`)
+        .map((s, i) => `  ${i + 1}. ${s.model}@${s.effort} (${s.provider}) [${s.failure_type}]: ${s.reason}`)
         .join("\n");
     return errorResult(`Error: all ${skipped.length} candidate launches failed for task_category ${task_category}:\n${lines}\n${SPLIT_HINT}\n${AUTO_HINT}`);
 });
@@ -629,6 +726,12 @@ server.tool("poll_agent", "Get an agent's current status and output. Status `pro
                             ruleset_original_selection: agent.rulesetOriginalSelection,
                         }
                         : {}),
+                    ...(agent.failoverFrom && agent.failoverFrom.length > 0
+                        ? {
+                            failover_occurred: true,
+                            failover_from: agent.failoverFrom,
+                        }
+                        : {}),
                     recent_stream: agent.visibleStream.map((it) => ({
                         type: it.type,
                         text: it.text,
@@ -897,7 +1000,7 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     };
 });
 // Tool 7: orchestration-mode
-server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF, omit = query current state. SOLE CHANNEL: the subagent MCP is the ONLY sanctioned channel for launching sub-agents whether this mode is ON or OFF, and the 5-CALL RULE (>5 tool calls needed for the request — all turns, no reset — or >5 already spent → ON: delegate via the subagent MCP; OFF: ask the user before enabling) binds in BOTH states — toggling OFF lifts neither obligation. The FULL operating model + governance is carried in this server's MCP `instructions` (read once at initialize) — this is the operational summary only; do not act on the mode without that detail. WHAT: a per-project toggle for LONG-HORIZON work that would fill the context window if run to completion inline; when ON, act as an orchestrator with delegate-default, but steps bound to main-session-only capability stay INLINE BY RIGHT (state which + why). PERSISTENCE: a per-project marker keyed by cwd; absence of the marker = OFF = no injection; once ON it persists across restarts/sessions until a permitted disable (it does NOT reset on a new session). CARRYOVER: if ON was inherited from a PRIOR session (provenance = carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker, never per turn) — you MUST then notify the user it auto-activated and confirm whether to keep it ON. DISABLE: never on your own initiative; you MAY PROPOSE turning it OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation).", {
+server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF, omit = query current state. SOLE CHANNEL: the subagent MCP is the ONLY sanctioned channel for launching sub-agents whether this mode is ON or OFF — toggling OFF does not lift that obligation. When OFF, run the per-turn upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask the user whether to switch ON (ask every qualifying turn; a decline does not latch; reset the count only when you actually ask). The FULL operating model + governance is carried in this server's MCP `instructions` (read once at initialize) — this is the operational summary only; do not act on the mode without that detail. WHAT: a per-project toggle for LONG-HORIZON work that would fill the context window if run to completion inline; when ON, act as an orchestrator with delegate-default, but steps bound to main-session-only capability stay INLINE BY RIGHT (state which + why). PERSISTENCE: a per-project marker keyed by cwd; absence of the marker = OFF = no injection; once ON it persists across restarts/sessions until a permitted disable (it does NOT reset on a new session). CARRYOVER: if ON was inherited from a PRIOR session (provenance = carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker, never per turn) — you MUST then notify the user it auto-activated and confirm whether to keep it ON. DISABLE: never on your own initiative; you MAY PROPOSE turning it OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation).", {
     enabled: z.boolean().optional(),
 }, async (params) => {
     const cwd = process.cwd();
@@ -920,6 +1023,28 @@ server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MOD
         ],
     };
 });
+// Tool 8: model-selection-mode
+server.tool("model-selection-mode", "Set or query per-project MODEL SELECTION MODE, which gates launch_agent's `provider`/`model`/`effort` selectors. `mode`: \"smart\" or \"user-approved-overrides\"; omit to query current state. \"smart\" is the DEFAULT and is used whenever the mode is unset — in smart, launch_agent REJECTS any call that supplies provider/model/effort and the server auto-picks the best model for the task_category. \"user-approved-overrides\" opens a 30-MINUTE window during which selectors are HONORED; the window is enforced LAZILY — the mode reverts to smart on the next launch_agent call after the 30 minutes elapse — and re-enabling does NOT extend an already-active window. HONOR-BASED, parallel to orchestration-mode: you MUST NOT set this to \"user-approved-overrides\" without explicit interactive USER authorization obtained via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex; a plain yes/no exchange if neither exists). This tool CANNOT verify that authorization — never enable it on your own initiative. PERSISTENCE: per-project state keyed by cwd; both the mode and the override-window enable-timestamp persist across MCP server restarts (the remaining window is restored, not reset).", {
+    mode: z.enum(["smart", "user-approved-overrides"]).optional(),
+}, async (params) => {
+    const cwd = process.cwd();
+    if (params.mode)
+        modelMode.setMode(cwd, params.mode);
+    const r = modelMode.resolveMode(cwd);
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    model_selection_mode: r.mode,
+                    enabled_at: r.enabled_at,
+                    window_remaining_ms: r.window_remaining_ms,
+                    marker_path: modelMode.modelModePath(cwd),
+                }, null, 2),
+            },
+        ],
+    };
+});
 // Connect the stdio transport only when run as the entry point (the bin), NOT
 // when this module is imported (e.g. test/handler-validation.test.mjs importing
 // the exported validatePresence). Connecting on import would block the test on