@heretyc/subagent-mcp 2.8.9 → 2.9.2

package/dist/index.js

@@ -139,11 +139,11 @@ reconcileInterval.unref();
 // test/mirror-fragments.test.mjs while ORCHESTRATION_INSTRUCTIONS below stays
 // compressed under MCP metadata limits:
 // READ-ESCALATION LADDER (the orchestrator's only read channels, in order): (1) subagent-mcp `poll_agent` TAIL; (2) if the tail is insufficient, dispatch ONE sub-agent to return a single summary of <=100 lines, trusted as-is (no separate verification step); (3) anything larger: the USER reads the document directly. No reads or writes occur outside these channels. An empty or stalled tail means the agent is ALIVE, not dead — do NOT busy-loop poll_agent; learn completion via `wait`. Large inter-agent data: the orchestrator assigns scratch-file paths (%TEMP% on Windows, /tmp on POSIX) in prompts; the producing sub-agent writes, the consuming sub-agent reads; the orchestrator NEVER reads those files.
-const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask the user. Only the hook state changes ON/OFF.\n\nSOLE CHANNEL. Every sub-agent launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator. Use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp. No direct reads/writes; inline-by-right does not exist. Non-delegable atomic step: ask for a one-time exception, do only that step, then resume delegating.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads; orchestrator never reads those files. Empty/stalled tail means ALIVE; use wait.\n\nORCHESTRATION OFF. If total context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to switch ON; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask; stay halted until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime.\n\nMODEL SELECTION MODE. Default smart rejects provider/model/effort selectors; launch_agent auto-picks. user-approved-overrides lasts 30 minutes, expires lazily on launch_agent, and must be enabled only after explicit user authorization via AskUserQuestion/request-user-input.";
+const ORCHESTRATION_INSTRUCTIONS = "subagent-mcp - CANONICAL OPERATING MODEL (full spec: docs/spec/dev-loop/orchestration-directive-architecture.md).\n\nPRECEDENCE. The latest <subagent-mcp state=\"...\"> hook tag and repo/system safety rules are co-supreme; genuine conflict => STOP and ask the user. Only the hook state changes ON/OFF.\n\nSOLE CHANNEL. Every sub-agent launch uses launch_agent; never harness Task/Agent or shell-spawned agents.\n\nORCHESTRATION ON. You are a delegate-ONLY orchestrator. Use only the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex), subagent-mcp, and the /workflows tool. No direct reads/writes; inline-by-right does not exist. Non-delegable atomic step: ask for a one-time exception, do only that step, then resume delegating.\n\nREAD LADDER. poll_agent tail -> one <=100-line summarizer sub-agent, trusted as-is -> else the USER reads it. Large handoffs use scratch-file paths; producer writes, consumer reads; orchestrator never reads those files. Empty/stalled tail means ALIVE; use wait.\n\nORCHESTRATION OFF. If total context footprint since last upgrade ask exceeds 200 lines, after that turn STOP and ask whether to remain enabled; reset count only when you ask.\n\nDROPOUT WHILE ON: HALT and ask; stay halted until restored. SUB-AGENT EXEMPTION: a prompt whose literal FIRST LINE begins \"<this is a request from a parent process>\" skips this regime.\n\nMODEL SELECTION MODE. Default smart rejects provider/model/effort selectors; launch_agent auto-picks. user-approved-overrides lasts 30 minutes, expires lazily on launch_agent, and must be enabled only after explicit user authorization via AskUserQuestion/request-user-input.";
 const SUBAGENT_INSTRUCTIONS = "SUB-AGENT SESSION: you are a child process launched by subagent-mcp. Follow the parent prompt. Do not treat yourself as the orchestrator, do not re-trigger orchestration carryover, and do not launch further sub-agents unless the parent prompt explicitly assigns that.\n\nMODEL SELECTION MODE (parallel to orchestration-mode, set via the model-selection-mode tool). DEFAULT is \"smart\" and is used whenever unset: in smart, launch_agent REJECTS any call supplying provider/model/effort selectors and the server auto-picks the best model. \"user-approved-overrides\" opens a 30-MINUTE window where selectors are HONORED, enforced LAZILY (the mode reverts to smart on the next launch_agent call after 30 minutes) and re-enabling does NOT extend an active window. HONOR-BASED: you MUST NOT set \"user-approved-overrides\" without explicit interactive USER authorization via the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex); never enable it on your own initiative.";
 const server = new McpServer({
     name: "subagent-mcp",
-    version: "2.8.9",
+    version: "2.9.2",
     description: "Launches always-interactive local Claude and Codex sub-agent sessions. Claude uses the Claude Agent SDK over the local Claude Code executable; Codex uses `codex app-server` over stdio. The server does not call Anthropic or OpenAI HTTP APIs directly.",
 }, {
     instructions: process.env.SUBAGENT_MCP_SUBAGENT === "1"
@@ -221,10 +221,12 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
     }
     const childProcess = driver.process;
     let definitelyStarted = false;
+    let startupRejection = null;
     const definitelyStartedProbe = driver.definitelyStarted.then(() => {
         definitelyStarted = true;
         return true;
-    }, () => {
+    }, (e) => {
+        startupRejection = e instanceof Error ? e : new Error(String(e));
         return false;
     });
     const readStartedBoundary = async () => {
@@ -452,7 +454,9 @@ async function tryLaunchCandidate(candidate, prompt, agentCwd, routingTier, rule
                 const reason = `process exited (code ${earlyExit.code ?? earlyExit.signal}) within ${SPAWN_GRACE_MS}ms of spawn${tail ? `: ${tail}` : ""}`;
                 return {
                     reason,
-                    failure_type: classifyFailureReason(reason, agentState.stderr),
+                    failure_type: startupRejection
+                        ? failureTypeForError(startupRejection, agentState.stderr)
+                        : classifyFailureReason(reason, agentState.stderr),
                 };
             }
         }
@@ -1000,24 +1004,52 @@ server.tool("wait", "Blocks until one or more sub-agents reach a reportable stat
     };
 });
 // Tool 7: orchestration-mode
-server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF, omit = query current state. SOLE CHANNEL: the subagent MCP is the ONLY sanctioned channel for launching sub-agents whether this mode is ON or OFF — toggling OFF does not lift that obligation. When OFF, run the per-turn upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask the user whether to switch ON (ask every qualifying turn; a decline does not latch; reset the count only when you actually ask). The FULL operating model + governance is carried in this server's MCP `instructions` (read once at initialize) — this is the operational summary only; do not act on the mode without that detail. WHAT: a per-project toggle for LONG-HORIZON work that would fill the context window if run to completion inline; when ON, act as an orchestrator with delegate-default, but steps bound to main-session-only capability stay INLINE BY RIGHT (state which + why). PERSISTENCE: a per-project marker keyed by cwd; absence of the marker = OFF = no injection; once ON it persists across restarts/sessions until a permitted disable (it does NOT reset on a new session). CARRYOVER: if ON was inherited from a PRIOR session (provenance = carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker, never per turn) — you MUST then notify the user it auto-activated and confirm whether to keep it ON. DISABLE: never on your own initiative; you MAY PROPOSE turning it OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation).", {
+server.tool("orchestration-mode", "Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query current state. SOLE CHANNEL: the subagent MCP is the ONLY sanctioned channel for launching sub-agents whether this mode is ON or OFF — toggling OFF does not lift that obligation. When OFF, run the per-turn upgrade check: a long-horizon task = any whose TOTAL context footprint (input read + output produced) exceeds 200 lines, measured CUMULATIVELY since your last upgrade ask; after EVERY user turn, if it qualifies, STOP and ask the user whether to remain enabled (ask every qualifying turn; a decline does not latch; reset the count only when you actually ask). The FULL operating model + governance is carried in this server's MCP `instructions` (read once at initialize) — this is the operational summary only; do not act on the mode without that detail. WHAT: a default-ON orchestration mode for LONG-HORIZON work that would fill the context window if run to completion inline; when ON, act as a delegate-ONLY orchestrator: delegate every step; inline-by-right does not exist; a non-delegable atomic step requires a one-time user-approved exception via the structured-question tool (state which + why). PERSISTENCE: orchestration is DEFAULT ON; a permitted disable applies to THIS session only, resumes ON next new session (or after the 2h backstop), and cannot be re-enabled mid-session. CARRYOVER: if ON was inherited from a PRIOR session (provenance = carried-over, not user-enabled this session), the bundled hook prepends a ONE-TIME notice (once per marker, never per turn) — you MUST then notify the user it auto-activated and confirm whether to keep it ON. DISABLE: never on your own initiative; you MAY PROPOSE turning it OFF on task-fit mismatch, but only EXPLICIT user permission (AskUserQuestion on Claude, request-user-input on Codex) may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing (documented degradation).", {
     enabled: z.boolean().optional(),
 }, async (params) => {
     const cwd = process.cwd();
+    const key = orchestrationMarker.readCurrentSession(cwd);
     if (params.enabled === true) {
-        orchestrationMarker.enable(cwd);
+        if (!orchestrationMarker.isActive(cwd, key)) {
+            return errorResult("orchestration already disabled for this session, cannot re-enable mid-session; resumes ON automatically next new session (or after the 2h backstop).");
+        }
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        orchestration_mode: "ON",
+                        message: "orchestration is ON by default.",
+                    }),
+                },
+            ],
+        };
     }
     else if (params.enabled === false) {
-        orchestrationMarker.disable(cwd);
+        if (key)
+            orchestrationMarker.writeDisable(key);
+        else
+            orchestrationMarker.writeDisableCwd(cwd);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        orchestration_mode: "disabled-this-session",
+                        message: "orchestration disabled for THIS session only; the next new session resumes ON automatically (or after the 2h backstop); no mid-session re-enable.",
+                    }),
+                },
+            ],
+        };
     }
     // enabled === undefined -> query only; no marker mutation.
+    const active = orchestrationMarker.isActive(cwd, key);
     return {
         content: [
             {
                 type: "text",
                 text: JSON.stringify({
-                    orchestration_mode: orchestrationMarker.isActive(cwd),
-                    marker_path: orchestrationMarker.markerPath(cwd),
+                    orchestration_mode: active ? "ON" : "disabled-this-session",
                 }),
             },
         ],
@@ -1065,6 +1097,7 @@ if (isMain) {
         "  init, --init [flags]",
         "                     upsert project instruction-file invariant blocks",
         "                     flags: --dry-run --remove --force --root <dir> --files <csv> --copilot --cursor",
+        "                     --global  upsert into ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, ~/.gemini/GEMINI.md",
         "  doctor             check install and wiring health",
         "  update, --update   update to the latest release (npm install -g)",
         "  version, --version, -v",
@@ -1179,11 +1212,14 @@ if (isMain) {
         process.exit(1);
     }
     // ORCHESTRATION MODE PERSISTS across restarts/sessions: the server does NOT
-    // clear the marker on startup. DEFAULT OFF now means ABSENCE of a marker — a
-    // project never enabled stays OFF; a project explicitly enabled persists ON
-    // until disabled with explicit user permission. On a new session the bundled
-    // hook detects the carried-over marker and prompts the user to confirm.
-    // (orchestrationMarker.disable is still used by the tool's enabled:false.)
+    // clear the marker on startup. DEFAULT ON now means ABSENCE of a disable
+    // record — a project stays ON with no marker write needed; OFF is only a
+    // per-session disable record that holds while it is active, cleared with
+    // explicit user permission. On a new session a carried-over legacy ON marker
+    // (if any) triggers a one-time prompt asking whether to remain enabled; under
+    // default-ON this rarely fires.
+    // (the tool's enabled:false writes a disable record via writeDisable /
+    // writeDisableCwd; it does not call disable().)
     startLivenessHeartbeat();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/init.js

@@ -1,4 +1,5 @@
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import * as os from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 const MIGRATE_RE = /<!-- subagent-mcp:(?:managed:)?begin\b[^>]*-->[\s\S]*?<!-- subagent-mcp:(?:managed:)?end -->/;
 const OWNER_CAP = 8;
@@ -16,7 +17,7 @@ export const INIT_BLOCK = [
     "",
     "PRECEDENCE (co-supreme top tier): <subagent-mcp> hook tags AND repo/system safety-scope rules are BOTH supreme and EQUAL — neither outranks the other. If they genuinely conflict, STOP and escalate to the user via the structured-question tool; do not silently pick one or average them. FORBIDDEN: resolving such a conflict yourself. Hook tags otherwise outrank ordinary user requests.",
     "",
-    'ORCHESTRATION ON — you are the ORCHESTRATOR. Allowed tools: ONLY the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex) and subagent-mcp. NO direct reads or writes of any kind. "Inline-by-right" does not exist. Every step runs in a sub-agent. If one atomic step truly cannot run in a sub-agent, ASK the user via the structured-question tool for a one-time exception for that single step, perform only that step, then resume delegating. SOLE CHANNEL: while subagent-mcp is connected, every sub-agent launch goes through `launch_agent`; never use harness-native sub-agent tools or shell-spawned agents.',
+    'ORCHESTRATION ON — you are the ORCHESTRATOR. Allowed tools: ONLY the structured-question tool (AskUserQuestion on Claude / request-user-input on Codex), subagent-mcp, and the /workflows tool. NO direct reads or writes of any kind. "Inline-by-right" does not exist. Every step runs in a sub-agent. If one atomic step truly cannot run in a sub-agent, ASK the user via the structured-question tool for a one-time exception for that single step, perform only that step, then resume delegating. SOLE CHANNEL: while subagent-mcp is connected, every sub-agent launch goes through `launch_agent`; never use harness-native sub-agent tools or shell-spawned agents.',
     "",
     "ORCHESTRATOR WORKTREE SETUP: launch sub-agents in the main checkout cwd (they no longer self-isolate into per-agent worktrees); SERIALIZE any sub-agents that write the SAME files — never run concurrent writers over overlapping paths (no cwd-level lock exists).",
     "",
@@ -28,7 +29,7 @@ export const INIT_BLOCK = [
     "",
     'NO-HOOK / UNKNOWN STATE: if no harness-hook injection bearing a <subagent-mcp state="..."> tag is present this session (e.g. Gemini, desktop apps, or any host that fires no hook), the state is UNKNOWN — represented by the ABSENCE of any tag, never by a tag value. Emit this UNKNOWN-STATE WARNING to the user: "subagent-mcp: no hook injection detected — orchestration state unknown; defaulting to ON". Briefly explain WHY: no hook injection detected — cannot verify orchestration state; defaulting to ON to prevent uncontrolled inline execution. Then DEFAULT TO ORCHESTRATION ON (fail-safe). One-time opt-out: if you are not currently running an orchestration workflow, you may explicitly opt out of ON for this session by saying so now; this opt-out does not persist and is not recorded. The sub-agent first-line exemption is the ONLY automatic suppressor of this default.',
     "",
-    "DISABLE: never on your own initiative; you MAY propose OFF on task-fit mismatch via the structured-question tool, and only explicit user approval may call orchestration-mode enabled:false.",
+    "DISABLE: never on your own initiative; you MAY propose OFF on task-fit mismatch via the structured-question tool, and only explicit user approval may set enabled:false — per-session only; the next new session resumes ON; no mid-session re-enable.",
     "<!-- subagent-mcp:managed:end -->",
 ].join("\n");
 function detectEol(s) {
@@ -145,16 +146,18 @@ export function upsertInitBlock(file, opts = {}) {
     }
     return { file, status, changed };
 }
-function parseArgs(args) {
+export function parseArgs(args) {
     const parsed = {
         dryRun: false,
         remove: false,
         force: false,
         copilot: false,
         cursor: false,
+        global: false,
         root: process.cwd(),
         files: null,
     };
+    let rootProvided = false;
     const readValue = (args, i, flag) => {
         const value = args[i + 1];
         if (value === undefined || value === "" || value.startsWith("--")) {
@@ -174,8 +177,11 @@ function parseArgs(args) {
             parsed.copilot = true;
         else if (a === "--cursor")
             parsed.cursor = true;
+        else if (a === "--global")
+            parsed.global = true;
         else if (a === "--root") {
             parsed.root = readValue(args, i, a);
+            rootProvided = true;
             i++;
         }
         else if (a === "--files") {
@@ -187,6 +193,9 @@ function parseArgs(args) {
     }
     if (!parsed.root)
         throw new Error("--root requires a directory");
+    if (parsed.global && (rootProvided || parsed.files || parsed.copilot || parsed.cursor)) {
+        throw new Error("--global cannot be combined with --root/--files/--copilot/--cursor");
+    }
     return parsed;
 }
 function isSelfRepo(root) {
@@ -198,6 +207,13 @@ function isSelfRepo(root) {
         return false;
     }
 }
+export function globalTargetFiles(home = os.homedir()) {
+    return [
+        join(home, ".claude", "CLAUDE.md"),
+        join(home, ".codex", "AGENTS.md"),
+        join(home, ".gemini", "GEMINI.md"),
+    ];
+}
 function targetFiles(root, opts) {
     const resolveTarget = (f) => {
         const target = isAbsolute(f) ? resolve(f) : resolve(root, f);
@@ -225,19 +241,24 @@ export async function runInit(args = process.argv.slice(3)) {
         console.error(e instanceof Error ? e.message : String(e));
         return 1;
     }
-    const root = resolve(opts.root);
-    if (isSelfRepo(root) && !opts.force) {
-        console.error("Refusing to run init inside the subagent-mcp source repo without --force.");
-        console.error("This repo keeps CLAUDE.md/GEMINI.md as thin redirects; use --root for a consumer repo.");
-        return 1;
-    }
     let files;
-    try {
-        files = targetFiles(root, opts);
+    if (opts.global) {
+        files = globalTargetFiles();
     }
-    catch (e) {
-        console.error(e instanceof Error ? e.message : String(e));
-        return 1;
+    else {
+        const root = resolve(opts.root);
+        if (isSelfRepo(root) && !opts.force) {
+            console.error("Refusing to run init inside the subagent-mcp source repo without --force.");
+            console.error("This repo keeps CLAUDE.md/GEMINI.md as thin redirects; use --root for a consumer repo.");
+            return 1;
+        }
+        try {
+            files = targetFiles(root, opts);
+        }
+        catch (e) {
+            console.error(e instanceof Error ? e.message : String(e));
+            return 1;
+        }
     }
     const issues = [];
     const results = [];

package/dist/orchestration/hook-core.js

@@ -234,7 +234,9 @@ export function runHook(payload, env, adapter) {
         }
         const cwd = payload.cwd || process.cwd();
         const current = sessionKey(payload);
-        if (!marker.isActive(cwd)) {
+        if (current)
+            marker.writeCurrentSession(cwd, current);
+        if (!marker.isActive(cwd, current)) {
             // OFF: no claim machinery — just the per-prompt reminder cadence.
             const r = reminder.advance(cwd, current);
             return cadenceEmit(env, adapter, adapter.reminderOffFile, adapter.shortOffFile, r.count, r.persisted);

package/dist/orchestration/marker.js

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 const markerDir = join(tmpdir(), "subagent-mcp");
+export const ORCH_DISABLE_TTL_MS = 2 * 60 * 60 * 1000; // 2h GC backstop ONLY (independent of model-mode WINDOW_MS)
 /**
  * Shared per-project state dir for ALL hook state files (marker + reminder
  * counter). Exported so sibling state modules key off the SAME location — a
@@ -33,15 +34,27 @@ export function normalizeCwd(cwd) {
     }
     return p;
 }
-export function cwdHash(cwd) {
+function hashKey(key) {
     return createHash("sha256")
-        .update(normalizeCwd(cwd), "utf8")
+        .update(key, "utf8")
         .digest("hex")
         .slice(0, 16);
 }
+export function cwdHash(cwd) {
+    return hashKey(normalizeCwd(cwd));
+}
 export function markerPath(cwd) {
     return join(markerDir, "orch-" + cwdHash(cwd) + ".flag");
 }
+export function disablePath(sessionKey) {
+    return join(stateDir, `orch-disable-${hashKey(sessionKey)}.json`);
+}
+function cwdDisablePath(cwd) {
+    return join(stateDir, `orch-disable-${cwdHash(cwd)}.json`);
+}
+export function sessionPointerPath(cwd) {
+    return join(stateDir, `orch-session-${cwdHash(cwd)}.json`);
+}
 /**
  * Enable orchestration for cwd. ALWAYS overwrites — re-enabling re-baselines by
  * clearing owner_session/baseline_turn back to null so the next hook turn
@@ -62,44 +75,105 @@ export function enable(cwd) {
             carryover_ack: false,
         };
         writeFileSync(markerPath(cwd), JSON.stringify(state), { encoding: "utf8", mode: 0o600 });
+        try {
+            unlinkSync(cwdDisablePath(cwd));
+        }
+        catch (e) {
+            if (e?.code !== "ENOENT") {
+                // Fail-safe: enable still succeeds if stale disable cleanup fails.
+            }
+        }
     }
     catch {
         // Fail-safe: never throw to the caller.
     }
 }
 /**
- * Disable orchestration for cwd by removing the marker.
- *
- * No existsSync() guard: that only opens a TOCTOU window where a concurrent
- * clearForCwd/disable for the same cwd removes the file between the check and
- * the unlink. We just unlink and swallow ENOENT (already-gone is success).
- *
- * KNOWN LIMITATION: the marker is keyed by cwd, NOT by session. Two CLI
- * sessions in the same project share one marker, so their enable/disable
- * interleave and the last writer wins. Per-session isolation would require
- * keying the marker by cwd+session_id; not done here because LOCKED DECISION 1
- * keys the marker by working directory alone. (The hook tracks the owning
- * session via owner_session so a carried-over marker is re-claimed, but the
- * marker file itself is still shared per cwd.)
+ * Disable orchestration for cwd using cwd-keyed shared fallback state. The
+ * hook's session-keyed path uses writeDisable(sessionKey) instead.
  */
 export function disable(cwd) {
     try {
-        unlinkSync(markerPath(cwd));
+        mkdirSync(markerDir, { recursive: true, mode: 0o700 });
+        writeFileSync(cwdDisablePath(cwd), JSON.stringify({ disabled_at: Date.now() }), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
     }
-    catch (e) {
-        if (e?.code !== "ENOENT") {
-            // Any non-ENOENT failure is still swallowed (fail-safe); ENOENT means the
-            // marker was already gone, which is the desired end state anyway.
-        }
+    catch {
+        // Fail-safe: never throw to the caller.
+    }
+}
+export function writeDisable(sessionKey) {
+    try {
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        writeFileSync(disablePath(sessionKey), JSON.stringify({ disabled_at: Date.now() }), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Fail-safe: never throw to the caller.
     }
 }
-export function isActive(cwd) {
+export function writeDisableCwd(cwd) {
     try {
-        return existsSync(markerPath(cwd));
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        writeFileSync(cwdDisablePath(cwd), JSON.stringify({ disabled_at: Date.now() }), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
     }
     catch {
+        // Fail-safe: never throw to the caller.
+    }
+}
+export function writeCurrentSession(cwd, sessionKey) {
+    try {
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        writeFileSync(sessionPointerPath(cwd), JSON.stringify({ session_key: sessionKey }), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Fail-safe: never throw to the caller.
+    }
+}
+export function readCurrentSession(cwd) {
+    try {
+        const raw = readFileSync(sessionPointerPath(cwd), "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.session_key === "string" ? parsed.session_key : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isDisableActive(path, now) {
+    if (!existsSync(path)) {
         return false;
     }
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.disabled_at !== "number") {
+        return false;
+    }
+    if (now - parsed.disabled_at <= ORCH_DISABLE_TTL_MS) {
+        return true;
+    }
+    // Lazy GC side-effect: the disable has expired, so remove it.
+    unlinkSync(path);
+    return false;
+}
+export function isActive(cwd, sessionKey) {
+    try {
+        const path = sessionKey === undefined ? cwdDisablePath(cwd) : disablePath(sessionKey);
+        return !isDisableActive(path, Date.now());
+    }
+    catch {
+        return true;
+    }
 }
 export function readMarker(cwd) {
     try {
@@ -136,9 +210,8 @@ export function writeMarker(cwd, obj) {
     }
 }
 /**
- * Marker removal alias, identical to disable. RETAINED for callers that clear a
- * marker explicitly (e.g. the tool's enabled:false path). NOTE: the server no
- * longer calls this on startup — orchestration mode now PERSISTS across sessions.
+ * Cwd-keyed disable alias, identical to disable. RETAINED for callers that
+ * clear legacy marker state explicitly (e.g. the tool's enabled:false path).
  */
 export function clearForCwd(cwd) {
     disable(cwd);