trantor 0.18.31 → 0.18.32

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.28",
+  "version": "0.18.32",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -382,13 +382,13 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   const state = `${down ? "down" : "error"}:${reason}`;
   if (state !== announced) {
     announced = state;
-    await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+    await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
     // #5684: a broadcast does not wake anyone — the incident is the operator spotting dead seats
     // before the foreman did, twice in one morning. The same state-change event now goes DIRECT
     // to the project's orchestrator (direct = wake), gated identically so a standing outage says
     // it once. A seat that IS the orchestrator's own runner has nobody above it to wake.
     const orch = `${hostId()}:${PROJ}`;
-    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ }).catch(() => {});
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   } else {
     log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
   }
@@ -434,7 +434,7 @@ async function notifyAssigners(pairs, text) {
     seen.add(f);
     // `re` threads this outcome to the exact contract it answers, so the sender's ledger closes the
     // right one instead of guessing from timing.
-    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ };
+    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ, kind: "receipt" };
     if (id) payload.re = id;
     await api("/send", payload).catch(() => {});
   }
@@ -447,7 +447,7 @@ async function reportHealthy() {
   // Recovery is a change too, so the next failure is news again.
   announced = "";
   await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL }).catch(() => {});
-  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
+  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
@@ -617,6 +617,57 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   return built.prompt;
 }
 
+const RECEIPT_MARKER = "✅ done on";
+const CARD_REF_RE = /#\d{1,7}(?!\d)/;
+
+// Runner-authored metadata is bus state, not work. Typed messages are authoritative; `re` and the
+// stable text marker keep a mixed-version crew safe while older runners are still on the bus.
+function isReceipt(message) {
+  const text = String(message?.text || "").trimStart();
+  return message?.kind === "receipt" || Number(message?.re) > 0 || text.startsWith(RECEIPT_MARKER);
+}
+
+function isStatusBroadcast(message) {
+  if (message?.to !== "all") return false;
+  if (message?.kind === "status") return true;
+  const text = String(message?.text || "").trim();
+  return /^[A-Za-z0-9_.-]+ reporting — ready for a contract\b/.test(text)
+    || /^[✅⚠️🛑]\s+\S+\s+(?:recovered|turn FAILED|DOWN)\b/.test(text);
+}
+
+function isContract(message) {
+  const text = String(message?.text || "");
+  return message?.kind === "contract" || /^\s*contract\s*:/i.test(text) || CARD_REF_RE.test(text);
+}
+
+function isRunnerSession(session) {
+  const suffix = `:${PROJ}`;
+  const name = String(session || "");
+  if (!name.endsWith(suffix)) return false;
+  const label = name.slice(0, -suffix.length);
+  // Crew labels are CLI/provider slugs. Host sessions keep their machine-style identity and remain
+  // valid direct assigners; runner-to-runner prose needs `contract:` or a card reference.
+  return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
+}
+
+function shouldWake(message) {
+  if (isReceipt(message) || isStatusBroadcast(message)) return false;
+  if (message?.to === SESSION) {
+    if (message?.kind === "status") return false;
+    return !isRunnerSession(message?.from) || isContract(message);
+  }
+  return message?.to === "all"
+    && isContract(message)
+    && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
+}
+
+function askedExcerpt(message) {
+  let text = String(message?.text || "").replace(/\s+/g, " ").trim();
+  const nested = text.search(/\s+[·|]\s*asked\s*:/i);
+  if (nested >= 0) text = text.slice(0, nested).trim();
+  return text.slice(0, 120);
+}
+
 (async () => {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
@@ -631,7 +682,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     const { loadOrCreate } = await import("../lib/identity.mjs");
     await sfetchJson(`${HUB}/send`, {
       identity: loadOrCreate(SESSION, "agent"),
-      payload: { from: SESSION, to: "all", project: PROJ, text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
+      payload: { from: SESSION, to: "all", project: PROJ, kind: "status", text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
       signal: AbortSignal.timeout(2500),
     });
   } catch {}
@@ -640,8 +691,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
-  let pendingWake = restored.wake;
-  let pendingBcast = restored.bcast;
+  let pendingWake = restored.wake.filter(shouldWake);
+  let pendingBcast = restored.bcast.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
@@ -688,6 +739,10 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // never wake on your own broadcasts: a claude seat's report contains "claude:" and matched the
     // @mention filter, buying one echo turn per report (seen live on the first pulsed orchestrator)
     msgs = msgs.filter(m => m.from !== SESSION);
+    // A receipt is the terminal state of a contract, never a new contract. Consume typed receipts,
+    // reply-linked outcomes, and the old stable marker before direct-address logic sees them. Status
+    // broadcasts are presence chatter and are dropped rather than saved as future prompt context.
+    msgs = msgs.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
     // #5760 (the night of 08-31): the hub's hourly "same-project-sessions" FYI woke every seat
     // into a real CLI turn — three wedged for hours mid-chatter, one on the metered pool. That
     // kind is pure coordination CONTEXT ("no human needs to relay this" — and no turn needs to
@@ -695,8 +750,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // warnings still wake — those are actionable by the seat right now.
     const fyi = msgs.filter(m => m.from === "hub:duty" && String(m.text || "").startsWith("🤝 OVERSEER same-project-sessions"));
     const rest = msgs.filter(m => !fyi.includes(m));
-    const direct = rest.filter(m => m.to === SESSION);
-    const mentions = rest.filter(m => m.to === "all" && (m.text.includes(`@${AGENT}`) || m.text.toLowerCase().includes(`${AGENT}:`)));
+    const direct = rest.filter(m => m.to === SESSION && shouldWake(m));
+    const mentions = rest.filter(m => m.to === "all" && shouldWake(m));
     const bcast = [...rest.filter(m => m.to === "all" && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
     const wake = [...direct, ...mentions];
@@ -708,7 +763,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       const dropped = pendingWake.splice(0, pendingWake.length - PENDING_MAX);
       log(`\x1b[31mundelivered queue overflowed — dropped ${dropped.length} oldest message(s)\x1b[0m`);
       await api("/send", { from: SESSION, to: "all", project: PROJ,
-        text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
+        kind: "status", text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
     }
     savePending(pendingWake, pendingBcast);
     // Respect an active backoff: a new message during an outage joins the batch, it does not
@@ -741,7 +796,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
     const assigners = [];
     for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
-    const asked = String(wake[0]?.text || "").replace(/\s+/g, " ").trim().slice(0, 90);
+    const asked = askedExcerpt(wake[0]);
     const tStart = Date.now();
     const prompt = composedTurn({
       wakeText, ctxText, againText,

package/bin/crew.sh

@@ -352,7 +352,7 @@ spawn_herdr() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -743,11 +743,19 @@ resolve_model() {
   else
     out="$(python3 "$SCROOGE" route --provider "$provider" -t "$task" -d "$diff" --json 2>/dev/null)"
   fi
-  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — refusing opencode global default" >&2; return 1; }
-  out="$(printf '%s' "$out" | python3 -c 'import json,sys
+  if [ -n "$out" ]; then
+    out="$(printf '%s' "$out" | python3 -c 'import json,sys
 try: print(json.load(sys.stdin).get("qualified") or "")
 except Exception: pass' 2>/dev/null)"
-  [ -n "$out" ] || { echo "[crew] router returned no model for $agent:$provider — refusing opencode global default" >&2; return 1; }
+  fi
+  # The router can be absent (a fresh machine, a dry run, scrooge without its registry). That must
+  # never hand the seat to opencode's GLOBAL default (#6068, the DeepSeek bill) and must not drop
+  # the seat either (#6110): fall back INSIDE the provider — the head of its own catalog — and say so.
+  if [ -z "$out" ] && [ -n "$cands" ]; then
+    out="$provider/${cands%% *}"
+    echo "[crew] router unavailable for $agent:$provider — using the provider's own catalog head ($out)" >&2
+  fi
+  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — no router and no catalog; refusing opencode global default" >&2; return 1; }
   [ "${out%%/*}" = "$provider" ] || {
     echo "[crew] router selected $out outside $provider — refusing cross-provider fallback" >&2
     return 1
@@ -758,7 +766,11 @@ except Exception: pass' 2>/dev/null)"
 epoch_ms() { python3 -c 'import time;print(int(time.time()*1000))'; }
 
 # resolve_spec <spec> -> sets AGENT + MODEL globals (live-selects a provider-only spec).
-AGENT=""; MODEL=""
+# On failure, returns 1 (AGENT is still set; MODEL is empty) instead of exiting the whole script —
+# callers are responsible for skipping that one seat and continuing the batch. SKIPPED_SEATS
+# accumulates "agent: reason" entries across every spawn path so `up` can report + exit non-zero
+# at the end without killing seats that already launched earlier in the loop.
+AGENT=""; MODEL=""; SKIPPED_SEATS=()
 resolve_spec() {
   local SPEC="$1" FIELD
   AGENT="${SPEC%%:*}"; MODEL=""
@@ -780,11 +792,26 @@ resolve_spec() {
   if [ -n "$FIELD" ]; then
     case "$FIELD" in
       */*) MODEL="$FIELD" ;;
-      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || exit 1
+      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || {
+             echo "[crew] ✗ skipping seat '$AGENT' — model resolution failed for $FIELD ($TASK/$DIFF); remaining seats still launch" >&2
+             SKIPPED_SEATS+=("$AGENT: model resolution failed for $FIELD ($TASK/$DIFF)")
+             return 1
+           }
            echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)" ;;
     esac
   fi
 }
+# report_skipped_seats: prints a summary of every seat resolve_spec skipped this run (if any) and
+# returns 1 so callers can propagate a non-zero exit — the whole point is that a batch with some
+# skips still launched the rest of the crew, so this is a REPORT, not an abort.
+report_skipped_seats() {
+  [ "${#SKIPPED_SEATS[@]}" -gt 0 ] || return 0
+  echo ""
+  echo "✗✗ ${#SKIPPED_SEATS[@]} seat(s) skipped (model resolution failed) — the rest of the crew still launched:"
+  local s
+  for s in "${SKIPPED_SEATS[@]}"; do echo "   - $s"; done
+  return 1
+}
 # Kill any runner ALREADY serving this exact agent+project before starting another.
 #
 # Without this, `trantor up <agent>` ADDS a runner instead of replacing one — and every duplicate
@@ -816,7 +843,7 @@ spawn_tmux() {   # $@ = specs
   # a pre-existing session for THIS project = the crew is already up; add missing seats as new panes.
   tmux has-session -t "$TMUX_SESS" 2>/dev/null && first=0
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local pane=""
     if [ "$first" = "1" ]; then
@@ -867,7 +894,7 @@ spawn_grid() {   # $@ = specs
   local ROWS=$(( (N + COLS - 1) / COLS ))
   local CW=$(( GW / COLS )) CH=$(( GH / ROWS )) i=0 SPEC
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local C=$(( i % COLS )) R=$(( i / COLS )) X1 Y1 WID=""
     X1=$(( GX + C * CW )); Y1=$(( GY + R * CH ))
@@ -952,7 +979,7 @@ spawn_cmux() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -1054,7 +1081,7 @@ OSA
   fi
   [ -n "$REUSE_TAB" ] && { tabid="$REUSE_TAB"; echo "  → reusing existing crew workspace for $PROJ ($tabid)"; }
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     # In REUSE mode, replace-in-place: split off the agent's old terminal when tracked, close it after.
     local OLD_SURF=""
@@ -1175,7 +1202,11 @@ echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
 spawn_crew "$@"
 
-if [ "$DRY" = "1" ]; then echo "— dry run: no bus verify —"; exit 0; fi
+if [ "$DRY" = "1" ]; then
+  echo "— dry run: no bus verify —"
+  report_skipped_seats
+  exit $?
+fi
 echo "— verifying on the bus (the spawn is not the truth; the bus is) —"
 AGENTS_ONLY=$(for a in "$@"; do printf "%s " "${a%%:*}"; done)
 VER=$(node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" $AGENTS_ONLY --since "$SPAWN_EPOCH" --timeout 30)
@@ -1196,3 +1227,5 @@ if [ -n "${RETRY// }" ]; then
   fi
 fi
 echo "— crew verified on the bus. Send contracts with relay_send; runners keep agents alive for free. Teardown (this project only): trantor down —"
+report_skipped_seats
+exit $?

package/bin/new.mjs

@@ -131,6 +131,7 @@ try {
   // do we fall back to the plain TOFU enroll.
   const viaOwner = await enrollViaOwnerInvite(hub, identity, name, { timeoutMs: 8000 });
   if (!viaOwner.ok && viaOwner.reason === "no-owner-key") await enrollTofu(session, identity, name);
+  else if (!viaOwner.ok) console.error(`genesis: enrollment via owner invite failed: ${viaOwner.reason}`);
   const briefForHub = (brief || `Genesis of ${name} — created by trantor new.`).slice(0, 600);
   const r1 = await signedPost("/project", { project: name, brief: briefForHub, by: session }, { session, project: name, timeoutMs: 8000 });
   if (!r1.ok) throw new Error(`hub ${r1.status} on /project${r1.json?.error ? `: ${r1.json.error}` : ""}`);

package/hub.mjs

@@ -2627,7 +2627,8 @@ const server = http.createServer(async (req, res) => {
       // is guesswork: a seat still working and a seat that died look identical from the sender's
       // side, which is how an orchestrator ends up waiting forever on a dead peer.
       const re = Number.isFinite(Number(b.re)) && Number(b.re) > 0 ? Number(b.re) : 0;
-      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}) };
+      const kind = String(b.kind || "").slice(0, 40);
+      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}), ...(kind ? { kind } : {}) };
       state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
       dirty = true; pushToStreams(msg);               // <-- instant push to live watchers
       // Mirror onto the unified log. `refs` = the card ids this message cites (#3701), which is what

package/lib/classify-failure.mjs

@@ -38,16 +38,27 @@ export function stripPromptEcho(errText, promptText) {
   const text = String(errText || "");
   if (!promptText) return text;
   const norm = (l) => String(l).replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\s+/g, " ").trim();
-  const prompts = String(promptText).split("\n").map(norm).filter(l => l.length >= 40);
-  if (!prompts.length) return text;
+  const promptLines = String(promptText).split("\n").map(norm).filter(Boolean);
+  if (!promptLines.length) return text;
+  const prompts = promptLines.filter(l => l.length >= 40);
+  // Whole-prompt normalized text, for the short-line VERBATIM check below: a short line has no
+  // 40-char run to fuzzy-match against (that's the ECHO_RUN heuristic for long lines), but a short
+  // echoed wake fragment ("check the 401 on the hub") still reappears byte-for-byte (post-
+  // normalization) as a line or substring of the prompt — that's still replay, not the CLI's own
+  // voice, and must not survive to trip looksLikeAuthDeath on a healthy exit-0 turn (#6110).
+  const promptFull = promptLines.join(" ");
   const hasRun = (p, n) => {
     for (let i = 0; i + ECHO_RUN <= p.length; i++) if (n.includes(p.slice(i, i + ECHO_RUN))) return true;
     return false;
   };
   return text.split("\n").filter(line => {
     const n = norm(line);
-    // Short lines survive — no signature, nothing to match against.
-    if (n.length < 40) return true;
+    if (!n) return true;
+    // Short lines: survive unless they are a multi-word fragment (has a space — excludes a bare
+    // token like "codex" or "4,387" that trivially co-occurs with unrelated prompt text) that
+    // appears verbatim in the prompt. A genuine short CLI error the prompt never mentioned, or a
+    // single echoed token, still passes through untouched; a full echoed phrase does not.
+    if (n.length < 40) return !(n.includes(" ") && promptFull.includes(n));
     return !prompts.some(p => n.includes(p) || p.includes(n) || hasRun(p, n));
   }).join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.31",
+  "version": "0.18.32",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"