Support and limitations#

Platform

Pre-flight deny

Start/stop detection

Desktop notification

Linux

yes

yes

notify-send, kitten notify

macOS

yes

yes

terminal-notifier, osascript (best-effort, untested)

Windows

yes

yes

PowerShell toast (best-effort, untested)

Claude Code’s three layers and Codex’s native pre-flight spawn_agent denial have been exercised with synthetic payloads on Linux.

Known limits#

  • SubagentStop is detection, not prevention; that agent’s tokens have already been spent.

  • Dynamic model options can escape workflow static analysis, then surface at stop-time.

  • A launch remains unobservable and therefore fails open when it has no explicit model, no resolvable on-disk definition, no readable parent transcript, and no remembered session model from the last six hours.

  • Codex provides the native pre-flight spawn_agent event, but not Claude-compatible start/stop lifecycle events; its runtime-only launches have no notification backstop.

  • A missing hook script blocks the matched Claude Code call; uninstall through the supported command instead of deleting files by hand.

  • New model families remain ungated until superheavy_pattern includes them.

  • Grant locking is advisory on network filesystems.

  • Notification throttling groups repeated detections by subject and session.