trantor 0.18.29 → 0.18.30

package/bin/crew-runner.mjs

@@ -16,6 +16,11 @@ import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
+import { redactKeys } from "../lib/redact.mjs";
+import {
+  AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
+  readPromptText, stripPromptEcho,
+} from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 
 const AGENT = process.argv[2];
@@ -127,7 +132,7 @@ if (!enrolment.ok && enrolment.reason !== "hub-unreachable") {
 }
 process.on("uncaughtException", (e) => { console.log(`\x1b[31m[runner] UNCAUGHT: ${e?.stack || e}\x1b[0m`); });
 process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLED REJECTION: ${e?.stack || e}\x1b[0m`); });
-const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${s}`);
+const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${redactKeys(String(s))}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = 0;
@@ -337,30 +342,19 @@ function loadPending() {
 
 // Auth-failure markers in TURN OUTPUT. opencode prints its auth error ("401 Unauthorized" /
 // "Invalid API key") and STILL exits 0, so a bare 0 from the CLI is not proof the turn ran
-// (card #5405). This regex gates the exit-0 path in runTurn; kept tighter than
-// classifyFailure's set (no bare /expired/) so a healthy transcript never trips it.
-const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
-
-function classifyFailure(exit, errText, emptyOutput = false) {
-  // #5481: silence with a clean exit is a failure shape, not success — see lastEmptyOutput.
-  if (emptyOutput) return "empty-output";
-  const t = (errText || "").toLowerCase();
-  if (exit === 127) return "missing-cli";
-  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
-  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
-  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
-  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
-  if (/unexpected status (404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/.test(t)) return "backend-error";
-  // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
-  // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
-  if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|reached your [^.\n]*limit|usage limit|out of (credit|quota)/.test(t)) return "exhausted";
-  if (/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/.test(t)) return "auth";
-  return "crashed";
+// (card #5405). The rules live in lib/classify-failure.mjs (#5868) so they are testable against
+// the real specimens; classify() wraps them with the one-line verdict the seat log carries, and
+// runTurn judges only the CLI's OWN output (the prompt echo is replay, not speech — the rules
+// line "…deleting failing tests is forbidden." once classified healthy codex turns as auth).
+function classify(exit) {
+  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput);
+  log(`classified ${reason} because ${matched}`);
+  return reason;
 }
 
 async function reportFailure(exit, trigger, undelivered = 0) {
   consecFails++;
-  const reason = classifyFailure(exit, lastErrText, lastEmptyOutput);
+  const reason = classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
   await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
@@ -377,9 +371,10 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   // The count of messages this seat is HOLDING is the operator-actionable half of a failure: a
   // crashed pulse costs nothing, a crashed turn sitting on three escalations is someone waiting.
   const held = undelivered ? ` · holding ${undelivered} undelivered message${undelivered > 1 ? "s" : ""} (will retry)` : "";
-  const text = down
+  // #5869: the broadcast quotes failure context; keys never ride the bus.
+  const text = redactKeys(down
     ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}${held}`
-    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`;
+    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`);
   // Announce a CHANGE of state, never the continuation of one. The registered status above already
   // carries "down: exhausted · N fails" for anyone who looks, which is state and costs nobody a
   // turn; the broadcast is the event, and an unchanged state is not an event.
@@ -400,6 +395,23 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
 }
 
+// ---- activity truth (#5965): the RUNNER is the source for this seat ----------------
+// The app pulses a seat from its hub peer status. The runner is what actually knows when a
+// turn starts and ends, so it reports the boundaries: `working · <trigger>` the moment a turn
+// begins and `idle` the instant it lands clean. herdr's screen detection cannot see a
+// runner-driven CLI mid-turn (it sets screen_detection_skipped for those panes), which is why
+// seats used to read as idle while genuinely working — the desktop's herdr row is unreliable
+// for runner seats, so it falls back to this hub status. Bounded 5s so a slow hub never delays
+// the very turn it is reporting; one HTTP call per transition, never a poll.
+async function registerStatus(status) {
+  const url = HUB + "/register";
+  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL });
+  try {
+    const opts = { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body };
+    await fetch(url, { ...opts, headers: { ...opts.headers, ...signedHeaders(identity, url, opts) }, signal: AbortSignal.timeout(5000) });
+  } catch {}
+}
+
 // ---- telling the ASSIGNER, mechanically ------------------------------------
 // A seat used to finish its contract and say nothing. Completion lived only in the RULES prompt
 // ("report on the bus"), so a cheap model that did the work and ended its turn left the
@@ -410,6 +422,7 @@ async function reportFailure(exit, trigger, undelivered = 0) {
 // So: whoever sent the message that woke this seat gets told DIRECTLY what became of it. Direct
 // messages wake; that is the whole difference. Kept short, like every other bus line.
 async function notifyAssigners(pairs, text) {
+  text = redactKeys(text);   // #5869: the "asked" excerpt quotes the wake message — keys stay off the bus
   const seen = new Set();
   for (const { from: f, id } of pairs) {
     // `hub:*` senders are the hub's own pseudo-ids (hub:duty, the overseer), not sessions: nothing
@@ -438,9 +451,13 @@ async function reportHealthy() {
 }
 
 let sid = "";
-function runTurn(prompt, isFirst, trigger = "kickoff") {
+async function runTurn(prompt, isFirst, trigger = "kickoff") {
   TURN++; banner(trigger);
   const t0 = Date.now();
+  // #5965 — TURN START. The hub peer row is where the app reads activity from, and the runner is
+  // the only one who knows a turn is starting, so say so before the CLI spawn (awaited: the spawn
+  // below blocks the loop, an unawaited fetch would not leave the machine until the turn ended).
+  await registerStatus(`working · ${trigger}`);
   const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
@@ -470,7 +487,13 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // `crashed` and nobody knew to swap it. sid seats already fold stdout into the ERRF stream via
   // `tee /dev/stderr`; the rest now tee straight into ERRF. A real pipeline (not a process
   // substitution) so bash waits for tee to flush before we read the file back.
-  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
+  // #5869: redaction rides IN the pipeline — lib/redact.mjs is a tee replacement that echoes
+  // stdin verbatim to the live window and appends only REDACTED bytes to ERRF, so a CLI that
+  // echoes its environment never parks a provider key in a file every seat can read. The tee
+  // topology is load-bearing (#5481): stdout+stderr must still BOTH land in ERRF, and the sid
+  // path still folds stdout in via /dev/stderr → the --tee2 hop below.
+  const SCRUB = `node ${join(import.meta.dirname, "..", "lib", "redact.mjs")}`;
+  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | ${SCRUB} --tee ${ERRF}`;
   // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
   // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
   // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
@@ -482,7 +505,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
       { detached: true, stdio: "ignore" });
     wd.unref();
   } catch {}
-  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
+  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF})`], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
@@ -499,18 +522,31 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
     maxBuffer: 16 * 1024 * 1024,
   });
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }
+  // #5869: scrub AT REST, synchronously, before anything reads the file back. The stderr hop is
+  // a process substitution bash does not wait for, so this pass also catches its tail — the
+  // auth classifier and the empty-output check below must judge REDACTED text and a settled file.
+  try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
+  // #5868: classify only what the CLI itself said. The transcript replays the whole turn prompt
+  // (rules, lessons, the wake text) — and those lines once classified healthy codex turns as
+  // auth ("…is forbidden.") and exhausted ("retries burn quota"). Prompt lines are stripped
+  // before anything downstream looks at the text.
+  let ownOut = "";
+  try { ownOut = stripPromptEcho(readFileSync(ERRF, "utf8"), readPromptText(pf)); } catch { ownOut = ""; }
+  lastErrText = ownOut.slice(-4000);
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   const realExit = r.status;
   // A zero exit is NOT proof the turn ran: opencode prints "401 Unauthorized" / "Invalid API key"
   // and exits 0, so a bare 0 made the runner ack "✅ done", clear the pending queue and heartbeat
   // green through an auth outage (card #5405). Cross-check the turn output and treat an
-  // exit-0-with-auth turn as FAILED. Telemetry keeps the REAL exit; the returned code is the
-  // effective one every call site branches on (kickoff, pulse, deliverWake).
+  // exit-0-with-auth turn as FAILED — but ONLY when the CLI's own output is short enough to be
+  // just the error (#5868): a long output is a real answer, and a warning inside it must not
+  // fail the turn. Telemetry keeps the REAL exit; the returned code is the effective one every
+  // call site branches on (kickoff, pulse, deliverWake).
   let effExit = realExit;
-  if (realExit === 0 && AUTH_MARKER_RE.test(lastErrText)) {
+  if (realExit === 0 && looksLikeAuthDeath(ownOut)) {
     effExit = 1;
-    log("\x1b[31mexit 0 but turn output shows an auth failure — treating as FAILED (auth)\x1b[0m");
+    const hit = AUTH_MARKER_RE.exec(ownOut)[0];
+    log(`\x1b[31mexit 0 but the turn output IS an auth failure — treating as FAILED (auth, "${hit}")\x1b[0m`);
   }
   // #5481: the Inception/Mercury trap — exit 0 with a NULL completion. ERRF is the TOTAL output
   // capture, not just stderr: every seat's stdout is tee'd into it (`| tee -a ERRF` for the
@@ -519,6 +555,8 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // real CLI prints something on success (drill C pins that), so silence is the trap, not a
   // quiet victory. (Integration note: this was nearly "fixed" into stdout-only detection that
   // never fired — the tee topology is the load-bearing fact; keep this comment with it.)
+  // The judgment now runs on the ECHO-STRIPPED text (#5868): a CLI that replays the prompt but
+  // does no work has still produced nothing of its own.
   if (realExit === 0 && effExit === 0 && !lastErrText.trim()) {
     effExit = 1;
     lastEmptyOutput = true;
@@ -527,6 +565,9 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput });
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
+  // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
+  // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
+  if (realExit === 0 && effExit === 0) await registerStatus("idle");
   return effExit;
 }
 
@@ -592,7 +633,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
-  const ec0 = runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
+  const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
   let lastTurnAt = Date.now();
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
@@ -602,7 +643,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
-      const ecp = runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
+      const ecp = await runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
       if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
       lastTurnAt = Date.now();
       log("parked — waiting for the next message or pulse");
@@ -694,7 +735,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
       rulesText: RULES, lessons,
     });
-    const ec = runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    const ec = await runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
     const secs = Math.round((Date.now() - tStart) / 1000);
     if (ec) {
       deliveryFails++;
@@ -704,7 +745,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       await reportFailure(ec, "message", pendingWake.length);
       // The room hears the broadcast above; the one who is actually blocked hears it directly.
       await notifyAssigners(assigners,
-        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${classifyFailure(ec, lastErrText)}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
+        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${classify(ec)}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
       log(`\x1b[31m${pendingWake.length} message(s) still UNDELIVERED — next attempt in ${Math.round(wait / 1000)}s\x1b[0m`);
     } else {
       pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;

package/bin/new.mjs

@@ -18,7 +18,8 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureEnrolled, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
-import { resolveHub } from "../lib/project.mjs";
+import { setAutonomy } from "../lib/autonomy.mjs";
+import { resolveHub, setProjectHub } from "../lib/project.mjs";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 
@@ -104,8 +105,16 @@ if (existsSync(claude)) {
 const hook = spawnSync(process.execPath, [join(ROOT, "bin", "init-hooks.mjs")], { cwd: dir, encoding: "utf8" });
 if (hook.status !== 0) die(`hook install failed: ${(hook.stderr || "").trim()}`);
 
-// ── the hub: brief + first card, signed like every other client ─────────────────────────────────
+// A new project is a new trust boundary. Pin its harness dial even when the machine-wide default
+// is bypass, so opening it can never inherit another project's permission choice.
+setAutonomy(name, { harness: "prompt" });
+
+// ── the hub: pin + brief + first card, signed like every other client ──────────────────────────
 const hub = resolveHub(name);
+// Pin the new project to the hub it posts to (#5862 residual): without the pin, the first
+// session in the dir falls back to the global default and wears the "not pinned to a hub"
+// warning even though genesis chose this hub deliberately. Same persistence as `trantor hub set`.
+setProjectHub(name, hub);
 const session = process.env.RELAY_SESSION || `genesis:${name}`;
 const identity = loadIdentity(session);
 let card = null;

package/bin/profile.mjs

@@ -43,7 +43,12 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   if (cmd === "set") {
     for (const a of args) {
       const [prov, plan] = a.split("=");
-      if (!prov || !plan) { console.error(`bad arg '${a}' — use provider=plan`); process.exit(1); }
+      // A flag in the provider position (`set --help=api`) is a usage mistake, not a provider —
+      // die before the write, or profile.json grows a '--help' entry (#5998). 'help' likewise.
+      if (!prov || !plan || prov.startsWith("--") || prov === "help") {
+        console.error(`bad arg '${a}' — use provider=plan`);
+        process.exit(1);
+      }
       prof.providers[prov.toLowerCase()] = { plan: plan.toLowerCase(), tier: TIER(plan) };
     }
     prof.updated = new Date().toISOString().slice(0, 10);

package/bin/provider.mjs

@@ -70,7 +70,14 @@ function listSeats() {
 }
 
 function addProvider(name, opts) {
-  if (!name) { console.error("usage: trantor provider add <name> [--key sk-…] [--plan api] [--label <bus-name>] [--base-url <url> [--models m1,m2]]"); process.exit(1); }
+  // A flag left in the name position (`provider add --help`) is a usage question, not a provider
+  // name (#5998): the old path minted a '--help' provider into profile.json and a __HELP_API_KEY
+  // line into .env, then announced "Seat ready." The literal 'help' is guarded too — it is never
+  // a provider name. Both die HERE, before .env, profile.json or opencode.json are touched.
+  if (!name || name.startsWith("--") || name === "help") {
+    console.error("usage: trantor provider add <name> [--key sk-…] [--plan api] [--label <bus-name>] [--base-url <url> [--models m1,m2]]");
+    process.exit(1);
+  }
   const provider = name.toLowerCase();
   const label = (opts.label || provider).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   const plan = (opts.plan || "api").toLowerCase();
@@ -117,7 +124,11 @@ function addProvider(name, opts) {
 }
 
 function removeProvider(name) {
-  if (!name) { console.error("usage: trantor provider remove <name>"); process.exit(1); }
+  // Same guard as add (#5998): a flag-like name is a usage question, not a provider.
+  if (!name || name.startsWith("--") || name === "help") {
+    console.error("usage: trantor provider remove <name>");
+    process.exit(1);
+  }
   const FILE = join(H, ".agent-bus", "profile.json");
   const prof = read(FILE, { providers: {} });
   if (prof.providers && prof.providers[name.toLowerCase()]) {

package/lib/classify-failure.mjs

@@ -0,0 +1,66 @@
+// Failure classification for crew seats (#5868) — split out of crew-runner.mjs so the rules are
+// unit-testable against the REAL specimens that misfired.
+//
+// EVIDENCE (err-codex-trantor.txt + logs/codex-trantor.jsonl, 2026-09-02): the codex seat sat
+// "DOWN — 44 consecutive failures (exhausted)" while every telemetry row read exit:0 and the
+// transcript showed real work ("tokens used 4,387", Stop hooks, a delivered answer). Both labels
+// were echoes of the seat's own PROMPT: the rules line "…deleting failing tests is forbidden."
+// matched AUTH_MARKER_RE's bare "forbidden", and the codex lesson "retries burn quota" matched
+// the exhausted rule. Three fixes, one per failure mode:
+//   · stripPromptEcho — a prompt line reappearing in the err stream is the CLI REPLAYING what it
+//     was told, not the CLI speaking; classification sees only the CLI's own output.
+//   · looksLikeAuthDeath — the #5405 exit-0 escalation fires only on a SHORT error-only output
+//     (the opencode "401 Unauthorized" specimen is a couple of lines); a long output is a real
+//     answer, and a warning inside it must not fail the turn.
+//   · classifyFailure — "exhausted" demands an explicit quota/rate-limit message; the broad bare
+//     words ("credit", "balance", bare "insufficient") labelled ordinary prose on a dead turn and
+//     sent the operator to wait out a window that did not exist.
+import { readFileSync } from "node:fs";
+
+export const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
+
+/** Prompt lines (≥40 chars — a short line carries no signature) echoed back verbatim by the CLI
+ *  are replay, not speech. Returns the err stream with those lines removed. */
+export function stripPromptEcho(errText, promptText) {
+  const text = String(errText || "");
+  if (!promptText) return text;
+  const echo = new Set(String(promptText).split("\n").filter(l => l.length >= 40));
+  return text.split("\n").filter(l => !(l.length >= 40 && echo.has(l))).join("\n");
+}
+
+/** A real answer is long; an auth death is a couple of lines. The opencode specimen (#5405)
+ *  printed its whole failure in under a hundred characters and produced nothing else. */
+export const OWN_OUTPUT_ANSWER_MIN = 400;
+
+/** The #5405 rule, refined by #5868: exit 0 + an auth-shaped marker means FAILED only when the
+ *  CLI's own output is short enough to be JUST the error. */
+export function looksLikeAuthDeath(ownText) {
+  return String(ownText || "").length < OWN_OUTPUT_ANSWER_MIN && AUTH_MARKER_RE.test(ownText);
+}
+
+/** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
+ *  runner logs, so the next misclassification is diagnosable from the seat log alone. */
+export function classifyFailure(exit, errText, emptyOutput = false) {
+  // #5481: silence with a clean exit is a failure shape, not success — see lastEmptyOutput.
+  if (emptyOutput) return { reason: "empty-output", matched: "exit 0 with no output on either stream" };
+  const t = String(errText || "").toLowerCase();
+  if (exit === 127) return { reason: "missing-cli", matched: "exit 127 — command not found" };
+  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
+  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
+  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
+  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  let m = t.match(/unexpected status (?:404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/);
+  if (m) return { reason: "backend-error", matched: m[0] };
+  // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
+  // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
+  m = t.match(/quota|payment required|402|429|too many requests|rate.?limit|usage limit|exceeded your|reached your [^.\n]*limit|insufficient (?:credits?|funds)|out of (?:credits?|quota)/);
+  if (m) return { reason: "exhausted", matched: m[0] };
+  m = t.match(/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/);
+  if (m) return { reason: "auth", matched: m[0] };
+  return { reason: "crashed", matched: `exit ${exit} with no known failure pattern` };
+}
+
+/** Read the prompt file if it exists (the turn prompt the CLI may echo into its transcript). */
+export function readPromptText(pf) {
+  try { return readFileSync(pf, "utf8"); } catch { return ""; }
+}

package/lib/redact.mjs

@@ -0,0 +1,62 @@
+// #5869 — key-material redaction for everything a seat runner writes at rest.
+//
+// A CLI that echoes its environment or dumps a config puts live provider keys into the seat's
+// err log (err-<agent>-<project>.txt), and any seat on the machine can read ~/.agent-bus. So the
+// runner scrubs known key shapes to `<redacted:NAME>` before the bytes land:
+//
+//   sk-… / sk-sp-… / sk-ws-…   → <redacted:SK>      (every OpenAI-style prefix is sk-)
+//   AIza…                      → <redacted:AIZA>    (Google)
+//   xai-…                      → <redacted:XAI>     (xAI)
+//   ghp_…                      → <redacted:GHP>     (GitHub PAT)
+//   <VAR>_KEY=… / <VAR>_TOKEN=… with a 32+-char hex/base64 value
+//                              → <VAR>=<redacted:VAR>  (the variable NAME is not secret)
+//   Authorization: Bearer …    → Authorization: Bearer <redacted:BEARER>
+//
+// Ordinary lines are byte-identical: every rule anchors on a key prefix or a KEY=/TOKEN=/Bearer
+// position, never on "looks long". The function is idempotent (already-redacted text passes
+// through unchanged), so callers can scrub in the write path AND again on read-back.
+const RULES = [
+  // VAR=value first, so the surviving name is the env var and short values after KEY=/TOKEN=
+  // still fall through to the bare-prefix rules below.
+  { re: /\b([A-Za-z0-9_.-]*(?:KEY|TOKEN))=(["']?)[A-Za-z0-9+/_=-]{32,}\2/g, sub: (m, name, q) => `${name}=${q}<redacted:${name}>` },
+  { re: /\bsk-[A-Za-z0-9][A-Za-z0-9_-]{7,}/g, sub: () => "<redacted:SK>" },
+  { re: /\bAIza[0-9A-Za-z_-]{30,}/g, sub: () => "<redacted:AIZA>" },
+  { re: /\bxai-[A-Za-z0-9][A-Za-z0-9_-]{9,}/g, sub: () => "<redacted:XAI>" },
+  { re: /\bghp_[A-Za-z0-9]{20,}/g, sub: () => "<redacted:GHP>" },
+  { re: /(Authorization:\s*Bearer\s+)[A-Za-z0-9._+/=-]{16,}/gi, sub: (m, p) => `${p}<redacted:BEARER>` },
+];
+
+export function redactKeys(text) {
+  if (text == null) return text;
+  let out = String(text);
+  for (const { re, sub } of RULES) out = out.replace(re, sub);
+  return out;
+}
+
+// The runner's tee replacement. Modes:
+//   --tee  <file>  stdin → STDOUT verbatim (the live window), redacted → <file> (append)
+//   --tee2 <file>  stdin → STDERR verbatim (the live window), redacted → <file> (append)
+// The redacted append is LINE-BUFFERED: chunks can split a match mid-token (a 100-char bearer
+// JWT straddling a 64KB read boundary would otherwise leak its tail), but keys never span LINES.
+// Complete lines go out redacted; a partial trailing line waits for its newline. Every byte is
+// appended exactly once, in order, so the file stays verbatim apart from redactions.
+if (process.argv[1] && process.argv[1].endsWith("redact.mjs") && (process.argv[2] === "--tee" || process.argv[2] === "--tee2")) {
+  const { appendFileSync } = await import("node:fs");
+  const target = process.argv[3];
+  const passthrough = process.argv[2] === "--tee"
+    ? (c) => process.stdout.write(c)
+    : (c) => process.stderr.write(c);
+  let carry = "";
+  process.stdin.on("data", (chunk) => {
+    passthrough(chunk);
+    const lines = (carry + chunk.toString("utf8")).split("\n");
+    carry = lines.pop();   // the partial trailing line — or "" when the chunk ended on a newline
+    if (lines.length) {
+      try { appendFileSync(target, redactKeys(lines.join("\n")) + "\n"); } catch {}
+    }
+  });
+  process.stdin.on("end", () => {
+    if (carry) { try { appendFileSync(target, redactKeys(carry)); } catch {} }
+  });
+  process.stdin.resume();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.29",
+  "version": "0.18.30",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [