strom-research 1.27.0-beta.3 → 1.27.0-beta.4

package/CHANGELOG.cs.md

@@ -7,7 +7,7 @@ Změny každé verze ve zkratce. Úplné poznámky a instalační řádky jsou n
 
 ## 1.27.0
 
-*Připravuje se: bety do 1.27.0-beta.3. Oddíl bude úplný s vydáním.*
+*Připravuje se: bety do 1.27.0-beta.4. Oddíl bude úplný s vydáním.*
 
 - **Snímky uložené ručně vrátí svůj úkol samy.** Kde se snímky archivu ukládají ručně – archiv, kam smí jen prohlížeč
   člověka, nebo archiv, jehož podmínky nic jiného nedovolují – výzkum požádá o knihu a čísla snímků a připraví pro ně
@@ -60,8 +60,9 @@ Změny každé verze ve zkratce. Úplné poznámky a instalační řádky jsou n
   spustit?“. Podmínka týdne předplatného uvádí využití za týden proti tomu, co je zatím dovoleno, a jak se počítá.
   `strom help --human` uvádí pořadí úkolů, práci mimo linie, opravy a ponechání rozporu mezi příkazy člověka. Výzkum s
   OpenCode pokračuje i po sezení, které OpenCode řádně uzavřel, ale ohlásil jako neúspěšné, a po přechodné chybě sítě –
-  totéž sezení se po krátkém čekání obnoví, v rámci času sezení. Když sandbox Codexu nepustí strom k výzkumu – na
-  Windows i u příkazu zadaného přes PowerShell –, výzkum se hned zastaví s tím, co zůstává volbou člověka, a takové
+  totéž sezení se po krátkém čekání obnoví, v rámci času sezení. Když sandbox Codexu nepustí strom k výzkumu – i v
+  rouře a na Windows i u příkazu zadaného přes PowerShell –, výzkum se hned zastaví s tím, co zůstává volbou člověka,
+  a takové
   sezení úkol nikdy neodloží. Díky za hlášení na GitHubu. Změnu čtení snímků, kterou výzkum udělal sám a po které se
   četlo zřetelně méně jistě, hned vrátí – už ne až po 60 dnech – a `strom recent` to uvede.
 

package/CHANGELOG.de.md

@@ -7,7 +7,7 @@ Die Änderungen jeder Version in Kürze. Die vollständigen Hinweise und die Ins
 
 ## 1.27.0
 
-*In Vorbereitung: die Betas bis 1.27.0-beta.3. Der Abschnitt ist mit dem Release vollständig.*
+*In Vorbereitung: die Betas bis 1.27.0-beta.4. Der Abschnitt ist mit dem Release vollständig.*
 
 - **Von Hand gespeicherte Bilder bringen ihre Aufgabe von selbst zurück.** Wo die Bilder eines Archivs von Hand
   gespeichert werden – ein Archiv, das nur der Browser eines Menschen erreicht, oder eines, dessen Bedingungen nichts
@@ -74,8 +74,9 @@ Die Änderungen jeder Version in Kürze. Die vollständigen Hinweise und die Ins
   abseits der Linien, Korrekturen und das Belassen eines Widerspruchs unter den eigenen Befehlen des Menschen. Die
   Forschung mit OpenCode geht weiter nach einer Sitzung, die es ordnungsgemäß abgeschlossen, aber als fehlgeschlagen
   gemeldet hat, und nach einem vorübergehenden Netzwerkfehler – dieselbe Sitzung wird nach kurzem Warten fortgesetzt,
-  innerhalb der Zeit der Sitzung. Hält die Sandbox von Codex strom von der Forschung fern – unter Windows auch bei einem
-  über PowerShell gegebenen Befehl –, hält die Forschung sofort an und nennt, was die Wahl des Menschen bleibt; eine
+  innerhalb der Zeit der Sitzung. Hält die Sandbox von Codex strom von der Forschung fern – auch in einer Pipe und
+  unter Windows auch bei einem über PowerShell gegebenen Befehl –, hält die Forschung sofort an und nennt, was die Wahl
+  des Menschen bleibt; eine
   solche Sitzung legt ihre Aufgabe nie beiseite. Danke für die Meldung auf GitHub. Eine Änderung beim Lesen der Scans,
   die die Forschung selbst vorgenommen hat und nach der die Lesungen deutlich unsicherer wurden, wird sofort
   zurückgenommen – nicht mehr erst nach 60 Tagen –, und `strom recent` sagt es.

package/CHANGELOG.md

@@ -7,7 +7,7 @@ The changes of each version in short. The full notes and the install lines are o
 
 ## 1.27.0
 
-*In preparation: the betas up to 1.27.0-beta.3. The section is complete with the release.*
+*In preparation: the betas up to 1.27.0-beta.4. The section is complete with the release.*
 
 - **Images saved by hand bring their task back by themselves.** Where an archive's images are saved by hand – an archive
   only a person's browser reaches, or one whose terms allow nothing else – the research asks for its book and the
@@ -65,8 +65,9 @@ The changes of each version in short. The full notes and the install lines are o
   counted. `strom help --human` lists the order of tasks, work off the lines, fixes and leaving a conflict among the
   person's own commands. OpenCode's research goes on after a session it closed properly but reported as failed, and
   after a passing network error – the same session resumed after a short wait, within the session's time. Codex kept
-  away from strom by its sandbox – on Windows also with a command said through PowerShell – stops the research at once
-  with what remains the person's choice, and such a session never puts its task aside. Thanks for the report on GitHub.
+  away from strom by its sandbox – also in a pipe, and on Windows with a command said through PowerShell – stops the
+  research at once with what remains the person's choice, and such a session never puts its task aside. Thanks for the
+  report on GitHub.
   A change the research made by itself in reading the scans, after which the readings got clearly less sure, is taken
   back at once – no longer only after 60 days – and `strom recent` says so.
 

package/CHANGELOG.pl.md

@@ -7,7 +7,7 @@ Zmiany każdej wersji w skrócie. Pełne informacje o wydaniach i polecenia inst
 
 ## 1.27.0
 
-*W przygotowaniu: bety do 1.27.0-beta.3. Sekcja będzie kompletna z wydaniem.*
+*W przygotowaniu: bety do 1.27.0-beta.4. Sekcja będzie kompletna z wydaniem.*
 
 - **Skany zapisane ręcznie same przywracają swoje zadanie.** Tam, gdzie skany archiwum zapisuje się ręcznie – archiwum,
   do którego wolno tylko przeglądarce człowieka, albo takie, którego warunki nie pozwalają na nic innego – badanie
@@ -67,8 +67,9 @@ Zmiany każdej wersji w skrócie. Pełne informacje o wydaniach i polecenia inst
   i jak jest liczone. `strom help --human` wymienia kolejność zadań, pracę poza liniami, poprawki i pozostawienie
   sprzeczności wśród poleceń człowieka. Badanie z OpenCode toczy się dalej po sesji, którą OpenCode poprawnie zamknął,
   ale zgłosił jako nieudaną, oraz po przejściowym błędzie sieci – ta sama sesja zostaje wznowiona po krótkim
-  oczekiwaniu, w ramach czasu sesji. Gdy sandbox Codexa nie dopuści strom do badań – w Windows także przy poleceniu
-  podanym przez PowerShell –, badanie od razu się zatrzymuje z tym, co pozostaje wyborem człowieka, a taka sesja nigdy
+  oczekiwaniu, w ramach czasu sesji. Gdy sandbox Codexa nie dopuści strom do badań – także w potoku, a w Windows
+  także przy poleceniu podanym przez PowerShell –, badanie od razu się zatrzymuje z tym, co pozostaje wyborem
+  człowieka, a taka sesja nigdy
   nie odkłada zadania. Dziękujemy za zgłoszenie na GitHubie. Zmiana odczytu skanów, którą badanie wprowadziło samo i po
   której odczyty stały się wyraźnie mniej pewne, zostaje od razu cofnięta – już nie dopiero po 60 dniach – a `strom
   recent` to podaje.

package/dist/commands/session.js

@@ -1268,15 +1268,6 @@ register(updatedDuringRun({
                     stopCode = "user";
                     break;
                 }
-                // An agent that may not run strom can do nothing: stop, do not burn session after session.
-                // A refused command that only starts with strom (strom … && sed …, a loop) is no such thing
-                // when strom worked for it otherwise.
-                if (!ranStrom && stromDenied) {
-                    // Codex: its sandbox (strom out of it only as a command of its own, by the research's rules; on Windows .git
-                    // closed inside it) — said with what is the person's choice; nothing more is started, the task stays queued
-                    stopCode = runnerId === "codex" && permissions !== "full" ? "denied.codex" : "denied";
-                    break;
-                }
                 if (result.outcome === "limit") {
                     stopCode = "limit";
                     stopValues = { resets: result.resumeAt ? ui(lang, "ui.run.stop.resets", { at: result.resumeAt }) : "" };
@@ -1287,6 +1278,16 @@ register(updatedDuringRun({
                     stopValues = { command: runnerId === "claude" ? claudeLoginCommand(runEnv) : runner.command };
                     break;
                 }
+                // An agent that may not run strom can do nothing: stop, do not burn session after session.
+                // A refused command that only starts with strom (strom … && sed …, a loop) is no such thing
+                // when strom worked for it otherwise. (The plan's limit and a login gone come first: they ended the session,
+                // the limit said with when it resets; a refusal is met again by the run after them.)
+                if (!ranStrom && stromDenied) {
+                    // Codex: its sandbox (strom out of it only as a command of its own, by the research's rules; on Windows .git
+                    // closed inside it) — said with what is the person's choice; nothing more is started, the task stays queued
+                    stopCode = runnerId === "codex" && permissions !== "full" ? "denied.codex" : "denied";
+                    break;
+                }
                 // the agent does not take its model: said with what to do, never only its raw error
                 if (result.outcome === "error" && result.modelRejected) {
                     stopCode = "model";

package/dist/core/tree.js

@@ -31,7 +31,7 @@ export const TREE_FILE = "strom.json";
 export const SEAL_FOREIGN = "seal.foreign";
 // between releases the candidate being made (a bridge run from the sources says what it is: the Strom app goes by it);
 // at a release the release's own (package.json)
-export const VERSION = "1.27.0-beta.3";
+export const VERSION = "1.27.0-beta.4";
 const GITIGNORE = `# Strom Research — local state and large files are not versioned
 .strom/
 /media/

package/dist/core/writable.js

@@ -72,6 +72,22 @@ const WINDOWS_HINT = `${FOLDER_HINT} — on Windows, OneDrive or the controlled
 export function agentName(id) {
     return AGENTS.find((a) => a.id === id)?.name ?? { cursor: "Cursor", gemini: "Gemini CLI" }[id] ?? id;
 }
+/**
+ * How strom says it was refused under an agent (fs.sandboxed), word for word: a run reads it in what the agent's command
+ * printed — also when the command's exit code is 0 (strom in a pipe: the code is the last program's; found with
+ * codex-cli 0.155.1, `strom … | cat` refused by Codex's sandbox ended with 0).
+ */
+export const SANDBOX_REFUSAL = "strom runs under an agent, and most likely its sandbox forbids it";
+/**
+ * The mark of the session strom refused in, after SANDBOX_REFUSAL: `(strom session N0042)`, from STROM_SESSION (set by
+ * strom run for the agent it starts; Codex hands its commands the environment it was started with). A run reads a
+ * refusal where the exit code is 0 (strom in a pipe) only with its own session's mark: the words quoted from another
+ * session — a summary in the next strom brief, a note, strom grep — carry that session's mark or none (#8). Undefined:
+ * no session, or an id that is none of strom's.
+ */
+export function refusalMark(session) {
+    return session && /^[\p{L}\p{N}_-]{1,40}$/u.test(session) ? `(strom session ${session})` : undefined;
+}
 /**
  * A refusal to use a file or folder: under an agent most likely its sandbox (fs.sandboxed) — else no right to write
  * there (fs.no-permission; on Windows OneDrive and the controlled folder access named as what may also do it). `above`:
@@ -82,8 +98,10 @@ export function agentName(id) {
 export function noPermission(where, agent, platform = process.platform, above) {
     const at = where ? `: ${where}` : "";
     const params = where ? { where } : undefined;
-    if (agent)
-        return new UsageError(`no permission to use${at} — strom runs under an agent, and most likely its sandbox forbids it`, { hint: sandboxHint(agent, where), code: "fs.sandboxed", ...(params ? { params } : {}) });
+    if (agent) {
+        const mark = refusalMark(agent.STROM_SESSION);
+        return new UsageError(`no permission to use${at} — ${SANDBOX_REFUSAL}${mark ? ` ${mark}` : ""}`, { hint: sandboxHint(agent, where), code: "fs.sandboxed", ...(params ? { params } : {}) });
+    }
     if (above === "?")
         return new UsageError(`no permission to use${at}`, {
             hint: `strom could not see the programs that started it, as in an agent's sandbox: if an agent started strom, most likely its sandbox forbids it — the command approved outside the sandbox; else ${platform === "win32" ? WINDOWS_HINT : FOLDER_HINT}`,

package/dist/runners/codex.js

@@ -12,6 +12,7 @@ import { codexConfigFile, codexModel, effortArgs } from "../agents/effort.js";
 import { CODEX_BROWSER_SERVERS } from "../core/browser.js";
 import { isolated } from "../core/paths.js";
 import { inRoom, readerRoom } from "./room.js";
+import { refusalMark, SANDBOX_REFUSAL } from "../core/writable.js";
 /**
  * What Codex's sandbox lets it write besides the tree folder: the tree's .git — its sandbox keeps a .git
  * read-only even inside the folder it works in, and every change strom makes is a commit (found live:
@@ -120,6 +121,20 @@ export function codexWeb(item) {
         return typeof action.url === "string" && action.url ? { via: "web", url: action.url, tool: "web_search" } : undefined;
     return { via: "search", tool: "web_search" };
 }
+/**
+ * strom's own refusal under an agent in what a command printed with the exit code 0 (strom in a pipe: the code is the
+ * last program's) — only with the mark of the session it ran in (`<SANDBOX_REFUSAL> (strom session N0042)`,
+ * refusalMark): the words quoted — a session's summary in the next strom brief or session show, a note, strom grep,
+ * cat, echo — carry another session's mark or none, whatever their lines look like (#8, found 2026-11-05: an agent
+ * summed up a refusal in its words, and the next session's strom brief stopped the run). The mark is read in whatever
+ * shape a pipe gives strom's error — plain, --json, `jq .` or `jq -r .message`, Windows PowerShell 5.1's own
+ * (`strom.cmd : error: …`, wrapped at the console's width: the lines joined again), a dash spoiled by the console's
+ * code page (the sentence and the mark are ASCII). No session (a run strom did not start): no refusal read here.
+ */
+export function codexRefusedStrom(output, session) {
+    const mark = refusalMark(session);
+    return !!mark && output.replace(/\r?\n/g, "").includes(`${SANDBOX_REFUSAL} ${mark}`);
+}
 /** The error Codex said last, kept when an earlier one said the plan's limit (the later one may only say the turn failed). */
 function failure(said, had) {
     return looksLikeLimit(had).limit && !looksLikeLimit(said).limit ? had : said || had;
@@ -167,10 +182,16 @@ function runCodex(opts) {
         }
         // The sandbox refused a command (a write outside the tree, .git closed, the network off — strom's own refusal says
         // "sandbox", Windows "access is denied"), or Codex did not run it (its rules, an approval nobody gives in exec:
-        // "declined"): counted like a denial, the command as the agent meant it (its shell around it taken off)
+        // "declined"): counted like a denial, the command as the agent meant it (its shell around it taken off). strom's own
+        // refusal under an agent counts with the exit code 0 too: in a pipe (`strom … | cat`, `| Select-Object`) the code
+        // is the last program's — but then only strom's error with this session's mark, never its words quoted
+        // (codexRefusedStrom). (Codex 0.155's exec_command says nothing at all of a command it refused before it ran — its
+        // rules — or one its sandbox stopped within 150 ms; strom itself starts slower and is always said.)
         if (msg.type === "item.completed" &&
             item?.type === "command_execution" &&
-            (item.status === "declined" || (item.exit_code !== 0 && /operation not permitted|sandbox|read-only file system|access (?:to the path .{1,200} )?is denied/i.test(item.aggregated_output ?? ""))))
+            (item.status === "declined" ||
+                (item.exit_code !== 0 && ((item.aggregated_output ?? "").includes(SANDBOX_REFUSAL) || /operation not permitted|sandbox|read-only file system|access (?:to the path .{1,200} )?is denied/i.test(item.aggregated_output ?? ""))) ||
+                (item.exit_code === 0 && codexRefusedStrom(item.aggregated_output ?? "", opts.env?.STROM_SESSION))))
             heard.denied.push(`Bash: ${shellUnwrapped(String(item.command ?? "")).slice(0, 120)}`);
         // its web search, once its item is done (counted after the fact: core/metrics.ts)
         if (msg.type === "item.completed") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strom-research",
-  "version": "1.27.0-beta.3",
+  "version": "1.27.0-beta.4",
   "description": "Genealogical research toolkit for AI coding agents",
   "type": "module",
   "stromLayout": 2,