@heretyc/subagent-mcp 2.8.7 → 2.8.8

package/LICENSE

@@ -1,201 +1,201 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction,
-and distribution as defined in Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by
-the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all
-other entities that control, are controlled by, or are under common
-control with that entity. For the purposes of this definition,
-"control" means (i) the power, direct or indirect, to cause the
-direction or management of such entity, whether by contract or
-otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications,
-including but not limited to software source code, documentation
-source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical
-transformation or translation of a Source form, including but
-not limited to compiled object code, generated documentation,
-and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object
-form, made available under the License, as indicated by a copyright
-notice that is included in or attached to the work (an example is
-provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object
-form, that is based on (or derived from) the Work and for which the
-editorial revisions, annotations, elaborations, or other modifications
-represent, as a whole, an original work of authorship. For the purposes
-of this License, Derivative Works shall not include works that remain
-separable from, or merely link (or bind by name) to the interfaces of,
-the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including
-the original Work and any Derivative Works thereof, and any modifications
-and enhancements to those works or Derivative Works thereof, that is
-intentionally submitted to Licensor for inclusion in the Work by the
-copyright owner or by an individual or Legal Entity authorized to submit
-on behalf of the copyright owner. For the purposes of this definition,
-"submitted" means any form of electronic, verbal, or written communication
-sent to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems,
-and issue tracking systems that are managed by, or on behalf of, the
-Licensor for the purpose of discussing and improving the Work, but
-excluding communication that is conspicuously marked or otherwise
-designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any Legal Entity on behalf of
-whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the
-Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-(except as stated in this section) patent license to make, have made,
-use, offer to sell, sell, import, and otherwise transfer the Work,
-where such license applies only to those patent claims licensable
-by such Contributor that are necessarily infringed by their
-Contribution(s) alone or by combination of their Contribution(s)
-with the Work to which such Contribution(s) was submitted. If You
-institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work
-or a Contribution incorporated within the Work constitutes direct
-or contributory patent infringement, then any patent licenses
-granted to You under this License for that Work shall terminate
-as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-Work or Derivative Works thereof in any medium, with or without
-modifications, and in Source or Object form, provided that You
-meet the following conditions:
-
-(a) You must give any other recipients of the Work or
-Derivative Works a copy of this License; and
-
-(b) You must cause any modified files to carry prominent notices
-stating that You changed the files; and
-
-(c) You must retain, in the Source form of any Derivative Works
-that You distribute, all copyright, patent, trademark, and
-attribution notices from the Source form of the Work,
-excluding those notices that do not pertain to any part of
-the Derivative Works; and
-
-(d) If the Work includes a "NOTICE" text file, then any
-Derivative Works that You distribute must include a readable
-copy of the attribution notices contained within such NOTICE
-file, excluding those notices that do not pertain to any part
-of the Derivative Works, in at least one of the following
-places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation,
-if provided along with the Derivative Works; or, within a
-display generated by the Derivative Works, if and
-wherever such third-party notices normally appear. The contents
-of the NOTICE file are for informational purposes only and
-do not modify the License. You may add Your own attribution
-notices within Derivative Works that You distribute, alongside
-or as an addendum to the NOTICE from the Work, provided that
-such additional attribution notices cannot be construed as
-modifying the License.
-
-You may add Your own copyright statement to Your modifications and
-may provide additional or different license terms and conditions
-for use, reproduction, or distribution of Your modifications, or
-for any such Derivative Works as a whole, provided Your use,
-reproduction, and distribution of the Work otherwise complies with
-the conditions of this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-any Contribution intentionally submitted for inclusion in the Work by
-You to Licensor shall be under the terms and conditions of this License,
-without any additional terms or conditions. Notwithstanding the above,
-nothing herein shall supersede or modify the terms of any separate
-license agreement you may have executed with Licensor regarding such
-Contribution.
-
-6. Trademarks. This License does not grant permission to use the trade
-names, trademarks, service marks, or product names of the Licensor,
-except as required for reasonable and customary use in describing the
-origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-agreed to in writing, Licensor provides the Work (and each
-Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-implied, including, without limitation, any warranties or conditions
-of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-PARTICULAR PURPOSE. You are solely responsible for determining the
-appropriateness of using or redistributing the Work and assume any
-risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-whether in tort (including negligence), contract, or otherwise,
-unless required by applicable law (such as deliberate and grossly
-negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special,
-incidental, or consequential damages of any character arising as a
-result of this License or out of the use or inability to use the
-Work (including but not limited to damages for loss of goodwill,
-work stoppage, computer failure or malfunction, or any and all
-other commercial damages or losses), even if such Contributor
-has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-the Work or Derivative Works thereof, You may choose to offer,
-and charge a fee for, acceptance of support, warranty, indemnity,
-or other liability obligations and/or rights consistent with this
-License. However, in accepting such obligations, You may act only
-on Your own behalf and on Your sole responsibility, not on behalf
-of any other Contributor, and only if You agree to indemnify,
-defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason
-of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-To apply the Apache License to your work, attach the following
-boilerplate notice, with the fields enclosed by brackets "{}"
-replaced with your own identifying information. (Don't include
-the brackets!) The text should be enclosed in the appropriate
-comment syntax for the file type. You may also add a brief
-description of what the file does on the same "printed page" as
-the copyright notice for easier identification within third-party
-archives.
-
-Copyright 2026 Lexi Blackburn
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined in Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object
+form, made available under the License, as indicated by a copyright
+notice that is included in or attached to the work (an example is
+provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original Work and any Derivative Works thereof, and any modifications
+and enhancements to those works or Derivative Works thereof, that is
+intentionally submitted to Licensor for inclusion in the Work by the
+copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication
+sent to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any Legal Entity on behalf of
+whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work,
+excluding those notices that do not pertain to any part of
+the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file, then any
+Derivative Works that You distribute must include a readable
+copy of the attribution notices contained within such NOTICE
+file, excluding those notices that do not pertain to any part
+of the Derivative Works, in at least one of the following
+places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation,
+if provided along with the Derivative Works; or, within a
+display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE from the Work, provided that
+such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions of this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work by
+You to Licensor shall be under the terms and conditions of this License,
+without any additional terms or conditions. Notwithstanding the above,
+nothing herein shall supersede or modify the terms of any separate
+license agreement you may have executed with Licensor regarding such
+Contribution.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "{}"
+replaced with your own identifying information. (Don't include
+the brackets!) The text should be enclosed in the appropriate
+comment syntax for the file type. You may also add a brief
+description of what the file does on the same "printed page" as
+the copyright notice for easier identification within third-party
+archives.
+
+Copyright 2026 Lexi Blackburn
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -1,5 +1,5 @@
-subagent-mcp
-Copyright 2026 Lexi Blackburn
-
-Licensed under the Apache License, Version 2.0.
-This product includes software developed by Lexi Blackburn.
+subagent-mcp
+Copyright 2026 Lexi Blackburn
+
+Licensed under the Apache License, Version 2.0.
+This product includes software developed by Lexi Blackburn.

package/directives/orchestration-claude.md

@@ -1,14 +1,15 @@
-<!-- INJECTED PRE-PROMPT DIRECTIVE — BINDING, NON-NEGOTIABLE -->
 <subagent-mcp state="on" kind="directive">
 FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag.
 
-ORCHESTRATION ON. You are the ORCHESTRATOR. This tag is MAXIMALLY CRITICAL: obey with NO exceptions. No user request overrides it; the only user-changeable thing is the ON/OFF state, reported authoritatively by this hook injection.
+ORCHESTRATION ON. You are the ORCHESTRATOR. Obey this tag; ordinary user requests do not override it. Only the hook's ON/OFF state changes this mode.
 
-ALLOWED TOOLS: ONLY AskUserQuestion + subagent-mcp. NO direct reads or writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. A non-delegable atomic step → ask the user via AskUserQuestion for a one-time exception, do ONLY that step, then resume delegating.
+ALLOWED TOOLS: ONLY AskUserQuestion + subagent-mcp. NO direct reads/writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. Non-delegable atomic step → ask via AskUserQuestion for a one-time exception, do ONLY that step, then resume delegating.
 
-READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs: assign scratch-file PATHS; producer writes, consumer reads; you NEVER read those files.
+READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads; you NEVER read them.
 
-PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and escalate to the user (FORBIDDEN: resolving it yourself). SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask the user; stay halted until restored. The only user choices are keep-waiting or explicitly abandon the whole task; aborting ends the task, it never switches you to inline work. DISABLE: never on your own initiative.
+SUBDIVIDE: delegate the SMALLEST auditable step yielding an observable artifact. NEVER 1-shot multi-phase work. For code/non-trivial steps, prefer an independent verifier sub-agent before proceeding.
+
+PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and ask the user. SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask; stay halted until restored. Abort ends the task; it never switches you inline. DISABLE: never on your own initiative.
 
 Full model + governance: server MCP `instructions`.
 </subagent-mcp>

package/directives/orchestration-codex.md

@@ -1,14 +1,15 @@
-<!-- INJECTED PRE-PROMPT DIRECTIVE — BINDING, NON-NEGOTIABLE -->
 <subagent-mcp state="on" kind="directive">
 FIRST-LINE EXEMPTION: if this session's prompt's literal first line begins with "<this is a request from a parent process>", ignore this entire tag.
 
-ORCHESTRATION ON. You are the ORCHESTRATOR. This tag is MAXIMALLY CRITICAL: obey with NO exceptions. No user request overrides it; the only user-changeable thing is the ON/OFF state, reported authoritatively by this hook injection.
+ORCHESTRATION ON. You are the ORCHESTRATOR. Obey this tag; ordinary user requests do not override it. Only the hook's ON/OFF state changes this mode.
 
-ALLOWED TOOLS: ONLY request-user-input + subagent-mcp. NO direct reads or writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. A non-delegable atomic step → ask the user via request-user-input for a one-time exception, do ONLY that step, then resume delegating.
+ALLOWED TOOLS: ONLY request-user-input + subagent-mcp. NO direct reads/writes. Inline-by-right does NOT exist. Every step runs in a sub-agent. Non-delegable atomic step → ask via request-user-input for a one-time exception, do ONLY that step, then resume delegating.
 
-READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs: assign scratch-file PATHS; producer writes, consumer reads; you NEVER read those files.
+READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the USER reads it. Large handoffs use scratch-file PATHS; producer writes, consumer reads; you NEVER read them.
 
-PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and escalate to the user (FORBIDDEN: resolving it yourself). SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask the user; stay halted until restored. The only user choices are keep-waiting or explicitly abandon the whole task; aborting ends the task, it never switches you to inline work. DISABLE: never on your own initiative.
+SUBDIVIDE: delegate the SMALLEST auditable step yielding an observable artifact. NEVER 1-shot multi-phase work. For code/non-trivial steps, prefer an independent verifier sub-agent before proceeding.
+
+PRECEDENCE: this tag and safety-scope are CO-SUPREME and equal; genuine conflict → STOP and ask the user. SOLE CHANNEL: all launches via launch_agent. DROPOUT while ON: HALT and ask; stay halted until restored. Abort ends the task; it never switches you inline. DISABLE: never on your own initiative.
 
 Full model + governance: server MCP `instructions`.
 </subagent-mcp>

package/directives/reminder-on.md

@@ -6,6 +6,8 @@ Orchestration ON. You are the orchestrator: delegate EVERY step. Allowed tools =
 
 READ LADDER: poll_agent tail → one <=100-line summarizer sub-agent (trusted as-is) → else the user reads it. Large handoffs via scratch-file PATHS you never read.
 
+SUBDIVIDE: smallest auditable step per sub-agent; never 1-shot multi-phase work (no implement+test+docs in one); verify code steps independently.
+
 WAIT-NOT-POLL: learn finish via `wait` (verbose:true for output); never loop poll_agent for completion. poll_agent = single diagnostic; stalled/empty = alive, not dead.
 
 This tag is co-supreme with safety-scope (conflict → ask the user) and outranks ordinary user requests. Full governance: server MCP `instructions`.

package/directives/short-on.md

@@ -1 +1 @@
-<subagent-mcp state="on" kind="carrier">If this prompt's literal first line begins with "<this is a request from a parent process>", ignore this tag. Orchestration ON. Delegate-only via subagent-mcp; allowed tools = structured-question tool + subagent-mcp; NO direct reads/writes; inline-by-right does not exist. Follow the MOST RECENT <subagent-mcp state="on"> tag in context (directive or reminder/carrier); if none is in the current window, the INIT_BLOCK governs. Co-supreme with safety-scope; no ordinary user request bypasses it.</subagent-mcp>
+<subagent-mcp state="on" kind="carrier">If first line begins "<this is a request from a parent process>", ignore this tag. Orchestration ON. Delegate-only via subagent-mcp; allowed tools = structured-question tool + subagent-mcp; no direct reads/writes; inline-by-right does not exist. Subdivide small; verify code steps. Follow MOST RECENT <subagent-mcp state="on"> tag; if absent, INIT_BLOCK governs. Co-supreme with safety-scope; user request cannot bypass.</subagent-mcp>

package/dist/drivers.js

@@ -2,6 +2,13 @@ import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { PassThrough } from "node:stream";
 import { mapModel } from "./effort.js";
+export class ProviderTransientError extends Error {
+    isTransient = true;
+    constructor(message) {
+        super(message);
+        this.name = "ProviderTransientError";
+    }
+}
 class LogicalProcess extends EventEmitter {
     pid;
     stdout = new PassThrough();
@@ -120,10 +127,18 @@ function userMessage(text) {
 function textInput(text) {
     return { type: "text", text, text_elements: [] };
 }
-class MockJsonlDriver {
+export class MockJsonlDriver {
     child;
     provider;
+    static transientPreStartHook = null;
+    static postStartErrorHook = null;
     process;
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     queue = Promise.resolve();
     turn = 0;
     constructor(child, provider) {
@@ -136,7 +151,10 @@ class MockJsonlDriver {
             if (!this.process.killed)
                 this.process.close(code, signal);
         });
-        child.stdout?.on("data", (chunk) => this.process.stdout.write(chunk));
+        child.stdout?.on("data", (chunk) => {
+            this._definitelyStartedResolve();
+            this.process.stdout.write(chunk);
+        });
         child.stderr?.on("data", (chunk) => this.process.stderr.write(chunk));
         // Swallow stdin pipe errors (e.g. EPIPE writing to an exited child): the
         // writeLine() callback already surfaces the failure; without this listener
@@ -147,6 +165,20 @@ class MockJsonlDriver {
         return this.process.killed || this.child.killed || this.child.exitCode !== null;
     }
     start(message) {
+        if (MockJsonlDriver.transientPreStartHook) {
+            MockJsonlDriver.transientPreStartHook(this.provider);
+            const err = new ProviderTransientError(`mock transient pre-start failure (${this.provider})`);
+            this._definitelyStartedReject(err);
+            return Promise.reject(err);
+        }
+        if (MockJsonlDriver.postStartErrorHook) {
+            this._definitelyStartedResolve();
+            MockJsonlDriver.postStartErrorHook(this.provider);
+            setTimeout(() => {
+                this.process.stderr.write(`mock post-start error (${this.provider})\n`);
+                this.process.close(1);
+            }, 0);
+        }
         return this.send(message);
     }
     send(message) {
@@ -175,6 +207,12 @@ export class CodexAppServerDriver {
     child;
     options;
     process;
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     pending = new Map();
     queuedTurns = [];
     nextId = 1;
@@ -341,6 +379,7 @@ export class CodexAppServerDriver {
             const turn = (message.params.turn ?? {});
             if (typeof turn.id === "string")
                 this.activeTurnId = turn.id;
+            this._definitelyStartedResolve();
         }
         if (message.method === "turn/completed") {
             this.activeTurnId = null;
@@ -349,6 +388,9 @@ export class CodexAppServerDriver {
         }
     }
     fail(error) {
+        const msg = error.message;
+        const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+        this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : error);
         this.process.fail(error);
         this.rejectPending(error);
     }
@@ -364,6 +406,12 @@ export class CodexAppServerDriver {
 export class ClaudeSdkDriver {
     queryFn;
     process = new LogicalProcess(undefined, true);
+    _definitelyStartedResolve;
+    _definitelyStartedReject;
+    definitelyStarted = new Promise((res, rej) => {
+        this._definitelyStartedResolve = res;
+        this._definitelyStartedReject = rej;
+    });
     input = new AsyncInputQueue();
     abortController = new AbortController();
     queue = Promise.resolve();
@@ -421,8 +469,13 @@ export class ClaudeSdkDriver {
         this.process.kill("SIGKILL");
     }
     async pump(query) {
+        let started = false;
         try {
             for await (const message of query) {
+                if (!started) {
+                    started = true;
+                    this._definitelyStartedResolve();
+                }
                 this.process.stdout.write(`${JSON.stringify(message)}\n`);
             }
             this.closedFlag = true;
@@ -430,8 +483,11 @@ export class ClaudeSdkDriver {
         }
         catch (error) {
             if (!this.process.killed) {
+                const msg = error instanceof Error ? error.message : String(error);
+                const transient = /\b429\b|\b5\d{2}\b|quota|rate.?limit|timeout|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(msg);
+                this._definitelyStartedReject(transient ? new ProviderTransientError(msg) : new Error(msg));
                 this.closedFlag = true;
-                this.process.stderr.write(error instanceof Error ? error.message : String(error));
+                this.process.stderr.write(msg);
                 this.process.close(1);
             }
         }

package/dist/index.js

@@ -19,6 +19,7 @@ import { loadRoutingTable, buildCandidates, validatePresence, TASK_CATEGORIES, A
 import { createDeadlockWindow } from "./deadlock.js";
 import { createRulesetGate, RULESET_HARD_FAIL_MSG, } from "./ruleset.js";
 import * as orchestrationMarker from "./orchestration/marker.js";
+import * as modelMode from "./orchestration/model-mode.js";
 import { startLivenessHeartbeat } from "./orchestration/liveness.js";
 import { ensureParentMarker } from "./launch-prompt.js";
 const agents = new Map();
@@ -52,6 +53,23 @@ const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (server pi
 function errorResult(text) {
     return { content: [{ type: "text", text }], isError: true };
 }
+export function classifyFailureReason(reason, stderr) {
+    const text = `${reason}\n${stderr}`;
+    return /\b429\b|\b5\d{2}\b|quota|usage.?cap|rate.?limit|timeout|connection.?reset|ECONNRESET|ETIMEDOUT|ECONNREFUSED|too many requests|service unavailable|server error|overloaded/i.test(text)
+        ? "transient_provider"
+        : "permanent";
+}
+function buildFailoverNote(skipped, winner) {
+    const top = skipped[0];
+    const topLabel = `${top.model}@${top.effort} (${top.provider})`;
+    const winnerLabel = `${winner.model}@${winner.effort} (${winner.provider})`;
+    return `Rank-1 candidate ${topLabel} failed with ${top.failure_type === "transient_provider" ? "a transient provider error" : "a permanent error"}; auto-selected ${winnerLabel}.`;
+}
+function failureTypeForError(error, stderr) {
+    return error.isTransient
+        ? "transient_provider"
+        : classifyFailureReason(error.message, stderr);
+}
 const isWindows = process.platform === "win32";
 let _npmPrefix = null;
 function getNpmPrefix() {
@@ -117,11 +135,15 @@ reconcileInterval.unref();
 // initialize (per the MCP spec the initialize result has an `instructions`
 // field) rather than re-injecting it on every turn. The bundled per-turn hook
 // injects only a small compact reminder; this is the durable, full explanation.
-const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp — CANONICAL OPERATING MODEL (read once; full detail in docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE (co-supreme). A <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are EQUAL top tier; genuine conflict → STOP and escalate to the user. Tags outrank user requests; only the hook `state` attribute changes ON/OFF.\n\nSOLE CHANNEL. EVERY sub-agent launch goes through launch_agent; never harness Task/Agent or shell spawn.\n\nORCHESTRATION ON (state=on; no-hook UNKNOWN→ON fail-safe). You are a delegate-ONLY orchestrator: directly use ONLY the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp; delegate all work. No direct read/write; inline-by-right DOES NOT EXIST. Non-delegable step: ASK for a ONE-TIME exception, do only it, resume.\n\nREAD-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.\n\nORCHESTRATION OFF (state=off). Long-horizon task = TOTAL footprint (read+produced) >200 lines, CUMULATIVE since last upgrade ask; after EVERY turn, if it qualifies STOP and ASK whether to switch ON; reset only when you ask.\n\nDROPOUT WHILE ON: HALT and ask user; nothing inline; stay halted UNTIL restored.\n\nSUB-AGENT EXEMPTION. A prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" SKIPS the whole regime (sub-agent); the only automatic suppressor of fail-safe-ON.";
-const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.";
+// Canonical A2 mirror fragment retained byte-identical for
+// test/mirror-fragments.test.mjs while ORCHESTRATION_INSTRUCTIONS below stays
+// compressed under MCP metadata limits:
+// READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.
+const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask the user. Only the hook state changes ON/OFF.\n\nSOLE CHANNEL. Every sub-agent launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator. Use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp. No direct reads/writes; inline-by-right does not exist. Non-delegable atomic step: ask for a one-time exception, do only that step, then resume delegating.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads; orchestrator never reads those files. Empty/stalled tail means ALIVE; use wait.\n\nORCHESTRATION OFF. If total context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to switch ON; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask; stay halted until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime.\n\nMODEL SELECTION MODE. Default smart rejects provider/model/effort selectors; launch_agent auto-picks. user-approved-overrides lasts 30 minutes, expires lazily on launch_agent, and must be enabled only after explicit user authorization via AskUserQuestion/request-user-input.";
+const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.8.7",
+    version: "2.8.8",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions. Claude uses the Claude Agent SDK over the local Claude Code executable; Codex uses `codex app-server` over stdio. The server does not call Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
@@ -156,9 +178,8 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     const running = countProcessing(candidate.provider);
     const max = candidate.provider === "claude" ? MAX_CLAUDE : MAX_CODEX;
     if (running >= max) {
-        return {
-            reason: `Maximum ${max} concurrent ${candidate.provider} agents already running. Current: ${running}`,
-        };
+        const reason = `Maximum ${max} concurrent ${candidate.provider} agents already running. Current: ${running}`;
+        return { reason, failure_type: "permanent" };
     }
     // Build the command. haiku ignores effort; pass "high" placeholder for the
     // "none" sentinel (buildCommand drops it for haiku anyway).
@@ -170,13 +191,14 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         cmd = resolveExe(candidate.provider);
     }
     catch (e) {
-        return { reason: e instanceof Error ? e.message : String(e) };
+        const reason = e instanceof Error ? e.message : String(e);
+        return { reason, failure_type: "permanent" };
     }
     // Fast-fail absolute paths only. Bare names intentionally rely on PATH; spawn
     // below resolves them and reports ENOENT/EACCES through the same failure path.
     if (isAbsolute(cmd) && !existsSync(cmd)) {
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: `CLI executable not found: ${cmd}` };
+        return { reason: `CLI executable not found: ${cmd}`, failure_type: "permanent" };
     }
     let driver;
     try {
@@ -194,9 +216,24 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     catch (error) {
         // Synchronous spawn throw (rare) — clean up and report as a launch failure.
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: error instanceof Error ? error.message : String(error) };
+        const reason = error instanceof Error ? error.message : String(error);
+        return { reason, failure_type: classifyFailureReason(reason, "") };
     }
     const childProcess = driver.process;
+    let definitelyStarted = false;
+    const definitelyStartedProbe = driver.definitelyStarted.then(() => {
+        definitelyStarted = true;
+        return true;
+    }, () => {
+        return false;
+    });
+    const readStartedBoundary = async () => {
+        await Promise.race([
+            definitelyStartedProbe,
+            new Promise((resolve) => setTimeout(resolve, 0)),
+        ]);
+        return definitelyStarted;
+    };
     // Await the one-shot spawn/error race. The 'error' handler is attached BEFORE
     // we await so an async ENOENT cannot escape as an unhandled event.
     try {
@@ -217,7 +254,8 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
         }
         catch { }
         cleanupUcSettingsPath(buildResult.ucSettingsPath);
-        return { reason: err instanceof Error ? err.message : String(err) };
+        const reason = err instanceof Error ? err.message : String(err);
+        return { reason, failure_type: classifyFailureReason(reason, "") };
     }
     // Spawn succeeded. Register the agent exactly as before. Keep a persistent
     // 'error' handler so a LATE spawn error never crashes the process; fold it
@@ -367,6 +405,15 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     }
     catch (err) {
         startError = err instanceof Error ? err : new Error(String(err));
+        await readStartedBoundary();
+        if (!definitelyStarted) {
+            const reason = startError.message;
+            cleanupUcSettings(agentState);
+            return {
+                reason,
+                failure_type: failureTypeForError(startError, agentState.stderr),
+            };
+        }
     }
     // Post-spawn grace window: a 'spawn' win alone is NOT success — a provider
     // driver that starts then dies immediately must advance the attempt loop, not
@@ -399,14 +446,22 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
             // turn.completed fast completion must never be misread as a launch
             // failure and the task silently re-executed on the next candidate.
             await closedAfterFlush;
-            if (!agentState.turnCompleted) {
+            const startedBeforeExit = await readStartedBoundary();
+            if (!agentState.turnCompleted && !startedBeforeExit) {
                 const tail = agentState.stderr.trim().split("\n").slice(-1)[0] ?? "";
+                const reason = `process exited (code ${earlyExit.code ?? earlyExit.signal}) within ${SPAWN_GRACE_MS}ms of spawn${tail ? `: ${tail}` : ""}`;
                 return {
-                    reason: `process exited (code ${earlyExit.code ?? earlyExit.signal}) within ${SPAWN_GRACE_MS}ms of spawn${tail ? `: ${tail}` : ""}`,
+                    reason,
+                    failure_type: classifyFailureReason(reason, agentState.stderr),
                 };
             }
         }
         else if (startError && !agentState.turnCompleted) {
+            const startedBeforeStartError = await readStartedBoundary();
+            if (startedBeforeStartError) {
+                agents.set(agentId, agentState);
+                return { agentId };
+            }
             // Lived past the grace window but the startup write failed: the child is
             // not accepting input, so advance the loop rather than register an agent
             // that never received its prompt.
@@ -415,7 +470,10 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
             }
             catch { }
             cleanupUcSettings(agentState);
-            return { reason: startError.message };
+            return {
+                reason: startError.message,
+                failure_type: failureTypeForError(startError, agentState.stderr),
+            };
         }
     }
     agents.set(agentId, agentState);
@@ -453,6 +511,10 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
     if (presenceError) {
         return errorResult(presenceError);
     }
+    const modelGate = modelMode.gateLaunch(agentCwd, { provider, model, effort });
+    if (!modelGate.allowed) {
+        return errorResult(modelGate.message ?? modelMode.SELECTOR_REJECTION_MESSAGE);
+    }
     // 6. Build the candidate list per mode.
     const overrides = { provider, model, effort };
     const isExplicit = !!(provider && model && effort);
@@ -542,6 +604,17 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
             if (branch === "performance") {
                 deadlockWindow.consume();
             }
+            if (skipped.length > 0) {
+                const registeredAgent = agents.get(outcome.agentId);
+                if (registeredAgent) {
+                    registeredAgent.failoverFrom = skipped.map((s) => ({
+                        provider: s.provider,
+                        model: s.model,
+                        effort: s.effort,
+                        failure_type: s.failure_type,
+                    }));
+                }
+            }
             return {
                 content: [
                     {
@@ -559,6 +632,18 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
                                     ruleset_original_selection: rulesetOriginalSelection,
                                 }
                                 : {}),
+                            ...(skipped.length > 0
+                                ? {
+                                    failover_occurred: true,
+                                    failover_from: skipped.map((s) => ({
+                                        provider: s.provider,
+                                        model: s.model,
+                                        effort: s.effort,
+                                        failure_type: s.failure_type,
+                                    })),
+                                    failover_note: buildFailoverNote(skipped, candidate),
+                                }
+                                : {}),
                         }),
                     },
                 ],
@@ -569,17 +654,24 @@ server.tool("launch_agent", "Spawn a sub-agent session. AUTO MODE (mandatory fir
             effort: candidate.effort,
             provider: candidate.provider,
             reason: outcome.reason,
+            failure_type: outcome.failure_type,
         });
+        if (!pureAuto) {
+            break;
+        }
     }
-    // 7. All candidates failed. A ruleset-modified explicit launch may have
-    //    attempted N≠1 candidates — only the numbered ALL_FAILED shape can
-    //    report that, so the explicit shape is reserved for unmodified launches.
-    if (isExplicit && !rulesetApplied) {
+    // 7. All candidates failed. Override selector modes are single-attempt hard
+    //    failures; pure auto mode reports the attempted candidates.
+    if (!pureAuto) {
         const f = skipped[0];
-        return errorResult(`Error: explicit launch ${f.model}@${f.effort} (${f.provider}) failed: ${f.reason}.\n${AUTO_HINT}`);
+        const transientNote = f.failure_type === "transient_provider"
+            ? `\nNote: this failure appears transient (quota/rate-limit/network). Switch to auto mode (omit provider/model/effort) for automatic silent failover to the next-best provider.`
+            : "";
+        const label = isExplicit ? "explicit" : "override";
+        return errorResult(`Error: ${label} launch ${f.model}@${f.effort} (${f.provider}) failed: ${f.reason}.${transientNote}\n${AUTO_HINT}`);
     }
     const lines = skipped
-        .map((s, i) => `  ${i + 1}. ${s.model}@${s.effort} (${s.provider}): ${s.reason}`)
+        .map((s, i) => `  ${i + 1}. ${s.model}@${s.effort} (${s.provider}) [${s.failure_type}]: ${s.reason}`)
         .join("\n");
     return errorResult(`Error: all ${skipped.length} candidate launches failed for task_category ${task_category}:\n${lines}\n${SPLIT_HINT}\n${AUTO_HINT}`);
 });
@@ -634,6 +726,12 @@ server.tool("poll_agent", "Get an agent's current status and output. Status `pro
                             ruleset_original_selection: agent.rulesetOriginalSelection,
                         }
                         : {}),
+                    ...(agent.failoverFrom && agent.failoverFrom.length > 0
+                        ? {
+                            failover_occurred: true,
+                            failover_from: agent.failoverFrom,
+                        }
+                        : {}),
                     recent_stream: agent.visibleStream.map((it) => ({
                         type: it.type,
                         text: it.text,
@@ -925,6 +1023,28 @@ server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MOD
         ],
     };
 });
+// Tool 8: model-selection-mode
+server.tool("model-selection-mode", "Set or query per-project MODEL SELECTION MODE, which gates launch_agent's `provider`/`model`/`effort` selectors. `mode`: \"smart\" or \"user-approved-overrides\"; omit to query current state. \"smart\" is the DEFAULT and is used whenever the mode is unset — in smart, launch_agent REJECTS any call that supplies provider/model/effort and the server auto-picks the best model for the task_category. \"user-approved-overrides\" opens a 30-MINUTE window during which selectors are HONORED; the window is enforced LAZILY — the mode reverts to smart on the next launch_agent call after the 30 minutes elapse — and re-enabling does NOT extend an already-active window. HONOR-BASED, parallel to orchestration-mode: you MUST NOT set this to \"user-approved-overrides\" without explicit interactive USER authorization obtained via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex; a plain yes/no exchange if neither exists). This tool CANNOT verify that authorization — never enable it on your own initiative. PERSISTENCE: per-project state keyed by cwd; both the mode and the override-window enable-timestamp persist across MCP server restarts (the remaining window is restored, not reset).", {
+    mode: z.enum(["smart", "user-approved-overrides"]).optional(),
+}, async (params) => {
+    const cwd = process.cwd();
+    if (params.mode)
+        modelMode.setMode(cwd, params.mode);
+    const r = modelMode.resolveMode(cwd);
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    model_selection_mode: r.mode,
+                    enabled_at: r.enabled_at,
+                    window_remaining_ms: r.window_remaining_ms,
+                    marker_path: modelMode.modelModePath(cwd),
+                }, null, 2),
+            },
+        ],
+    };
+});
 // Connect the stdio transport only when run as the entry point (the bin), NOT
 // when this module is imported (e.g. test/handler-validation.test.mjs importing
 // the exported validatePresence). Connecting on import would block the test on

package/dist/init.js

@@ -6,7 +6,9 @@ export const INIT_BLOCK = [
     "<!-- subagent-mcp:managed:begin schema=2 -->",
     "## subagent-mcp invariant — managed block, do not edit between markers",
     "",
-    'SUB-AGENT EXEMPTION: if this session\'s prompt\'s literal FIRST LINE begins with "<this is a request from a parent process>", SKIP this entire block (you are a sub-agent; this prevents fail-safe-ON recursion and fork-bombs). Leading blank lines do not count — the marker must be physically line 1.',
+    'SUB-AGENT EXEMPTION: if this session\'s prompt\'s literal FIRST LINE begins with "<this is a request from a parent process>", SKIP this entire block EXCEPT the SUB-AGENT WORKTREE CARVE-OUT below, which you MUST still obey (you are a sub-agent; this prevents fail-safe-ON recursion and fork-bombs). Leading blank lines do not count — the marker must be physically line 1.',
+    "",
+    "SUB-AGENT WORKTREE CARVE-OUT: you are a delegated sub-agent (env SUBAGENT_MCP_SUBAGENT=1), already placed in your target working tree by the orchestrator. Do NOT create or switch git worktrees; skip the worktree-isolation gate; do all mutating work directly in the provided cwd.",
     "",
     "CANONICAL SOURCE OF TRUTH: the subagent-mcp MCP `instructions` string (read once at connect) and docs/spec/dev-loop/orchestration-directive-architecture.md. This block carries the full ON operating model inline so the session is governed even if the MCP `instructions` are stale; if this block and the MCP `instructions` ever disagree, the MCP `instructions` win.",
     "",
@@ -16,6 +18,8 @@ export const INIT_BLOCK = [
     "",
     'ORCHESTRATION ON — you are the ORCHESTRATOR. Allowed tools: ONLY the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp. NO direct reads or writes of any kind. "Inline-by-right" does not exist. Every step runs in a sub-agent. If one atomic step truly cannot run in a sub-agent, ASK the user via the structured-question tool for a one-time exception for that single step, perform only that step, then resume delegating. SOLE CHANNEL: while subagent-mcp is connected, every sub-agent launch goes through `launch_agent`; never use harness-native sub-agent tools or shell-spawned agents.',
     "",
+    "ORCHESTRATOR WORKTREE SETUP: launch sub-agents in the main checkout cwd (they no longer self-isolate into per-agent worktrees); SERIALIZE any sub-agents that write the SAME files — never run concurrent writers over overlapping paths (no cwd-level lock exists).",
+    "",
     "READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.",
     "",
     'ORCHESTRATION OFF — a "long-horizon task" = any task whose TOTAL context footprint (input you read + output you produce) exceeds 200 lines of text. After EVERY user turn, measure the CUMULATIVE footprint accumulated since your last upgrade ask; reset that cumulative count to zero ONLY when you actually ask. If it qualifies, ASK the user via the structured-question tool whether to switch orchestration ON. Ask on EVERY qualifying turn; a decline does NOT suppress future asks. You never assert ON yourself — you only ask.',

package/dist/orchestration/model-mode.js

@@ -0,0 +1,132 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { cwdHash, stateDir } from "./marker.js";
+/**
+ * Per-project model-selection mode — the SINGLE source of truth for whether a
+ * working directory is in "smart" mode (the default; provider/model/effort
+ * selectors are rejected and the best model is chosen automatically) or
+ * "user-approved-overrides" mode (the user has explicitly authorized manual
+ * selectors for a bounded window).
+ *
+ * State is a per-project file in the SAME shared state dir as the marker,
+ * keyed by the SAME cwdHash so path-keying style stays uniform. The
+ * user-approved-overrides grant is time-boxed: WINDOW_MS after enable, the
+ * next resolveMode() lazily reverts the project to smart mode.
+ *
+ * FAIL-SAFE: filesystem reads return safe defaults ("smart") on any failure;
+ * writes mirror marker.ts perms (0o700 dir / 0o600 file).
+ */
+const WINDOW_MS = 30 * 60 * 1000;
+export function modelModePath(cwd) {
+    return join(stateDir, `model-${cwdHash(cwd)}.json`);
+}
+function readModelMode(cwd) {
+    try {
+        const raw = readFileSync(modelModePath(cwd), "utf8");
+        const parsed = JSON.parse(raw);
+        const mode = parsed.mode === "user-approved-overrides" ? "user-approved-overrides" : "smart";
+        const enabled_at = typeof parsed.enabled_at === "number" ? parsed.enabled_at : null;
+        return { mode, enabled_at };
+    }
+    catch {
+        // Missing/corrupt/invalid -> safe default (smart, never enabled).
+        return { mode: "smart", enabled_at: null };
+    }
+}
+function writeModelMode(cwd, state) {
+    try {
+        // Owner-only perms (mirror marker.ts): the file persists an enable-time.
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        writeFileSync(modelModePath(cwd), JSON.stringify(state), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Fail-safe: never throw to the caller.
+    }
+}
+export function resolveMode(cwd, now = Date.now()) {
+    const state = readModelMode(cwd);
+    if (state.mode === "user-approved-overrides" &&
+        typeof state.enabled_at === "number" &&
+        now - state.enabled_at > WINDOW_MS) {
+        // Lazy revert side-effect: the grant has expired, persist smart mode.
+        writeModelMode(cwd, { mode: "smart", enabled_at: null });
+        return {
+            mode: "smart",
+            enabled_at: null,
+            window_remaining_ms: 0,
+            reverted: true,
+        };
+    }
+    if (state.mode === "user-approved-overrides") {
+        return {
+            mode: "user-approved-overrides",
+            enabled_at: state.enabled_at,
+            window_remaining_ms: Math.max(0, WINDOW_MS - (now - state.enabled_at)),
+            reverted: false,
+        };
+    }
+    return {
+        mode: "smart",
+        enabled_at: state.enabled_at,
+        window_remaining_ms: 0,
+        reverted: false,
+    };
+}
+export function setMode(cwd, mode, now = Date.now()) {
+    if (mode === "smart") {
+        writeModelMode(cwd, { mode: "smart", enabled_at: null });
+    }
+    else {
+        const cur = resolveMode(cwd, now);
+        if (cur.mode === "user-approved-overrides") {
+            // Re-enabling an already-active window must NOT refresh/extend it: the
+            // original enable-timestamp stands.
+        }
+        else {
+            writeModelMode(cwd, { mode: "user-approved-overrides", enabled_at: now });
+        }
+    }
+    return resolveMode(cwd, now);
+}
+export function gateLaunch(cwd, selectors, now = Date.now()) {
+    const r = resolveMode(cwd, now);
+    const supplied = !!(selectors.provider || selectors.model || selectors.effort);
+    if (r.mode === "user-approved-overrides") {
+        return { allowed: true, mode: r.mode, reverted: r.reverted };
+    }
+    if (supplied) {
+        return {
+            allowed: false,
+            mode: "smart",
+            message: SELECTOR_REJECTION_MESSAGE,
+            reverted: r.reverted,
+        };
+    }
+    return { allowed: true, mode: "smart", reverted: r.reverted };
+}
+export const SELECTOR_REJECTION_MESSAGE = [
+    "Model/provider/effort selection is DISABLED in smart mode (the default). " +
+        "The best model is ALREADY being selected for you from the latest " +
+        "benchmarking data, rigorous ongoing research, and numerous environment " +
+        "conditions you may not be aware of — relaunch WITHOUT provider/model/effort.",
+    "",
+    "If you have a specific, scoped need for a particular provider/model/effort, " +
+        "you must ALWAYS stop and ask the USER for authorization using the " +
+        "structured-question tool (AskUserQuestion on Claude / request-user-input on " +
+        "Codex; if no structured-question tool exists, a plain yes/no question), THEN " +
+        'call `model-selection-mode` with mode "user-approved-overrides" before retrying.',
+    "",
+    "Fallback ladder (a): if you are blocked here because the structured-question " +
+        "tool ITSELF is unavailable/failing (a provider issue), do NOT guess — keep " +
+        "working until you actually need the answer, then RETURN to your caller with " +
+        "the question plus the possible multiple-choice answers; the calling/" +
+        "orchestrator agent asks the user in the orchestration context and relaunches " +
+        "you with the answer.",
+    "",
+    "Fallback ladder (b): if you are blocked due to a REAL error (not a deliberate " +
+        "smart-mode policy block), the user needs to know — surface it and consult the " +
+        "user before continuing.",
+].join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretyc/subagent-mcp",
-  "version": "2.8.7",
+  "version": "2.8.8",
   "description": "MCP server that launches and manages always-interactive Claude Code and Codex sub-agent sessions (no direct Anthropic/OpenAI API).",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "postinstall": "node scripts/postinstall.mjs",
     "prepare": "npm run build",
     "prepublishOnly": "npm test",
-    "test": "npm run check:versions && node test/effort.test.mjs && node test/drivers.test.mjs && node test/platform.test.mjs && node test/wait.test.mjs && node test/status.test.mjs && node test/output.test.mjs && node test/stream.test.mjs && node test/routing.test.mjs && node test/deadlock.test.mjs && node test/handler-validation.test.mjs && node test/index-handler.test.mjs && node test/ruleset.test.mjs && node test/ruleset-exec.test.mjs && node test/ruleset-handler.test.mjs && node test/failover.test.mjs && node test/orchestration-marker.test.mjs && node test/orchestration-hook-core.test.mjs && node test/orchestration-adapters.test.mjs && node test/orchestration-pretool.test.mjs && node test/orchestration-directives.test.mjs && node test/no-five-call.test.mjs && node test/launch-agent-upsert.test.mjs && node test/init-migration.test.mjs && node test/mirror-fragments.test.mjs && node test/performance-tier-effort.test.mjs && node test/setup-repair.test.mjs && node test/setup-quoting.test.mjs && node test/setup-wire.test.mjs && node test/setup-cli-integration.test.mjs && node test/init.test.mjs && node test/cli-args.test.mjs && node scripts/validate_provider.mjs && node scripts/validate_seed_sites.mjs && node scripts/validate_routing_audit.mjs && node test/seed-sites.test.mjs && node test/mcp-compliance.test.mjs"
+    "test": "npm run check:versions && node test/effort.test.mjs && node test/drivers.test.mjs && node test/platform.test.mjs && node test/wait.test.mjs && node test/status.test.mjs && node test/output.test.mjs && node test/stream.test.mjs && node test/routing.test.mjs && node test/deadlock.test.mjs && node test/handler-validation.test.mjs && node test/index-handler.test.mjs && node test/ruleset.test.mjs && node test/ruleset-exec.test.mjs && node test/ruleset-handler.test.mjs && node test/failover.test.mjs && node test/orchestration-marker.test.mjs && node test/orchestration-hook-core.test.mjs && node test/orchestration-adapters.test.mjs && node test/orchestration-pretool.test.mjs && node test/orchestration-directives.test.mjs && node test/no-five-call.test.mjs && node test/check-worktree-subagent.test.mjs && node test/launch-agent-upsert.test.mjs && node test/init-migration.test.mjs && node test/mirror-fragments.test.mjs && node test/performance-tier-effort.test.mjs && node test/setup-repair.test.mjs && node test/setup-quoting.test.mjs && node test/setup-wire.test.mjs && node test/setup-cli-integration.test.mjs && node test/init.test.mjs && node test/model-selection-mode.test.mjs && node test/cli-args.test.mjs && node scripts/validate_provider.mjs && node scripts/validate_seed_sites.mjs && node scripts/validate_routing_audit.mjs && node test/seed-sites.test.mjs && node test/mcp-compliance.test.mjs"
   },
   "author": "Lexi Blackburn",
   "license": "Apache-2.0",