trantor 0.18.71 → 0.18.72

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.71",
+  "version": "0.18.72",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/lib/classify-failure.mjs

@@ -89,6 +89,10 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
     : "classified success because exit 0 with CLI output";
   if (realExit === 0 && effExit === 1) {
     if (emptyOutput) return "classified empty-output because exit 0 with no output on either stream";
+    // #8778: the exit-0 escalation must not relabel a provider-side rejection as "auth" — codex
+    // prints the chatgpt-backend 401 and exits 0, so the real specimen rode this exact path.
+    const pr = providerRejected(String(ownText || ""));
+    if (pr) return `classified ${pr.reason} because ${pr.matched}`;
     const m = AUTH_MARKER_RE.exec(String(ownText || ""));
     return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
   }
@@ -96,6 +100,26 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
   return `classified ${reason} because ${matched}`;
 }
 
+// ---- the provider-rejected 401 (#8778) ---------------------------------------------------------
+// chatgpt.com/backend-api is the ChatGPT-SUBSCRIPTION backend codex hits while logged in with no
+// API key stored, so a 401 naming it is OpenAI rejecting its own server-side key — the specimen's
+// sk-svcacct key existed in no env file, keychain or process env on the machine.
+const REQUEST_ID_RE = /request id:\s*([a-z0-9][a-z0-9-]*)/i;
+
+/** The #8778 rule: a 401 whose url is the chatgpt.com/backend-api endpoint classifies
+ *  provider-rejected — the verdict names the request id and steers to waiting or the OpenAI
+ *  account, never a re-login. Returns null for any other shape, so a 401 from an API-key
+ *  endpoint (or one naming no endpoint) stays "auth". */
+export function providerRejected(errText) {
+  const t = String(errText || "");
+  if (!/\b401\b/.test(t) || !/chatgpt\.com\/backend-api/i.test(t)) return null;
+  const rid = (t.match(REQUEST_ID_RE) || [])[1] || "";
+  return {
+    reason: "provider-rejected",
+    matched: `401 from https://chatgpt.com/backend-api${rid ? ` (request id ${rid})` : ""} — OpenAI rejected its own subscription key server-side; wait or check the OpenAI account, logging in again will not help`,
+  };
+}
+
 /** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
  *  runner logs, so the next misclassification is diagnosable from the seat log alone. `cut` is the
  *  runner's box/stall marker: 137 reads as the sweep's SIGKILL only under it — without the marker
@@ -118,9 +142,13 @@ export function classifyFailure(exit, errText, emptyOutput = false, emptyTurn =
   // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
   // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
   // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
-  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  // 401/403/429 deliberately fall through to the provider-rejected/auth/exhausted branches below.
   let m = t.match(/unexpected status (?:404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/);
   if (m) return { reason: "backend-error", matched: m[0] };
+  // #8778: ranked ABOVE the quota/auth patterns — the specimen text itself carries an "API key"
+  // phrase, and either pattern reading first would relabel the same provider-side rejection.
+  const pr = providerRejected(String(errText || ""));
+  if (pr) return pr;
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
   m = t.match(/quota|payment required|402|429|too many requests|rate.?limit|usage limit|exceeded your|reached your [^.\n]*limit|insufficient (?:credits?|funds)|out of (?:credits?|quota)/);

package/lib/state/derive.mjs

@@ -170,11 +170,10 @@ export function deriveState({ project, seat, card, worktree, handoffText, cardTi
     now: Number.isInteger(now) ? now : Math.floor(Date.now() / 1000),
     by: author,
     files: deriveFiles(worktree),
-    // This build is RECONSTRUCTION, not a seat asserting completion (#8068): a ✅ bullet in the
-    // predecessor's handoff records what it reported done. The evidence rule guards a live claim,
-    // and applying it here would drop the handoff's items on the floor. Credit is withheld the way
-    // the contract already says — deriveFiles marks every path verified:false and `verify` stays
-    // empty — so the successor must still re-earn evidence before anything NEW moves to done.
+    // RECONSTRUCTION, not a live claim (#8068): a ✅ bullet records what the predecessor reported
+    // done, so the arrival-in-done gate must not fire on this path — CONTRACT-state.md, "Derive".
+    // Credit is still withheld (verified:false everywhere), so the successor re-earns evidence
+    // before anything NEW moves to done.
     reconstructing: true,
   };
 

package/lib/state/driver.mjs

@@ -277,12 +277,10 @@ export async function runStep({
   // Per attempt, not per step (#7226): a cut on the first attempt belongs to that attempt's row.
   let stepCut = cut === true;
 
-  // §7.3's fallback ladder: a MALFORMED patch earns exactly one retry, with the rejection message
-  // as the observation. An EVIDENCE rejection is not retried in-turn — the code was wrong, not the
-  // grammar, and the seat needs a whole step to fix the code (§4.8).
-  // Where HEAD sat before this step ran anything (#8069). Captured ONCE, outside the retry loop:
-  // a malformed-output retry re-runs the CLI, and commits the first attempt already made are still
-  // this step's work — re-reading HEAD per attempt would silently drop them.
+  // Two seams, both in CONTRACT-state.md: (1) §7.3's ladder — a MALFORMED patch earns exactly one
+  // retry with the rejection as the observation; an EVIDENCE rejection is not retried in-turn,
+  // the code was wrong, not the grammar (#8068). (2) HEAD captured ONCE, outside the retry loop:
+  // the first attempt's commits are still this step's work (#8069).
   const headAtStart = (D.gitHead || gitHead)(cwd);
 
   for (;;) {

package/lib/state/store.mjs

@@ -91,12 +91,9 @@ export function gitHead(cwd) {
   return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
 }
 
-/** Paths changed by the COMMITS made since `sha`, NUL-separated (#8069). The two commands §4.8 named
- *  — `git status --porcelain` and `git diff --name-only HEAD` — both measure the working tree against
- *  HEAD, so a seat that commits moves HEAD along with its work and both come back empty. That is not a
- *  corner case: every seat is told to commit early and often so a cut cannot erase it, which made tier 1
- *  blind on the ordinary flow. A card that rewrote 8,000 lines across 4 commits recorded files:{}.
- *  Degrades to [] on any git error, exactly like the other readers — recovery never throws. */
+/** Paths changed by the COMMITS made since `sha`, NUL-separated (#8069). The §4.8 status/diff pair
+ *  measures the tree against HEAD, so a seat that commits (the ordinary flow) reads empty from
+ *  both — CONTRACT-state.md, "Tier 1". Degrades to [] on any git error, like the other readers. */
 export function gitCommittedSince(sha, cwd) {
   if (!sha || !cwd) return [];
   const out = git(["diff", "--name-only", "-z", `${sha}..HEAD`], cwd);

package/lib/state/validate.mjs

@@ -49,21 +49,16 @@ export function hasEvidence(state, item, ctx = {}) {
   return paths.every(p => ({ ...(state.files[p] || {}), ...(ctxFiles[p] || {}) }).verified === true);
 }
 
-/** The evidence gate for an item ARRIVING in `done`, by whichever op put it there (#8068). Returns the
- *  rejection, or null when the item may land. `move → done` had this inline and `add … list:"done"` had
- *  nothing at all, so a seat that completed an item in the turn it did the work — the ordinary flow —
- *  walked past the verified-done rule entirely. Both doors now lead through this one check; `at` is the
- *  only thing that differs, so the seat's rejection still names the op it actually wrote. */
+/** The evidence gate for an item ARRIVING in `done`, by whichever op put it there (#8068). Returns
+ *  the rejection, or null when the item may land. Both doors — `move → done` and
+ *  `add … list:"done"` — lead through this one check (CONTRACT-state.md, "Schema and validation");
+ *  only `at` differs, so the rejection names the op the seat actually wrote. */
 function arrivalInDone(state, item, ctx, at) {
   if (!item || hasEvidence(state, item, ctx)) return null;
-  // The one exception, and it is reconstruction rather than assertion: derive.mjs rebuilds a
-  // WorkingState from a predecessor's prose handoff, where a ✅ bullet is a RECORD of what was
-  // reported done, not this seat claiming it now. Gating that would delete the handoff's content —
-  // #6528's failure exactly — and the rule it would be enforcing is already kept another way:
-  // CONTRACT-state.md, "a derived state carries no credit … the successor must re-earn its evidence
-  // before anything moves to done". The items arrive uncredited, so the successor still cannot ride
-  // route (b) on them. `ctx` is harness-supplied and a patch cannot write it (§3.0 write matrix),
-  // so a seat cannot set this for itself — which is the only reason a flag is safe here at all.
+  // The one exception is RECONSTRUCTION, not assertion (#8068): derive.mjs's ✅ bullets are records
+  // of what the predecessor reported done, and gating them would delete the handoff's content
+  // (#6528's failure). The skipped rule is kept another way (CONTRACT-state.md, "Derive"); ctx is
+  // harness-supplied, so a seat cannot set this flag for itself.
   if (ctx.reconstructing === true) return null;
   // The split that makes §4.8's one-retry bound a fact: a gate that ran and failed looks
   // exactly like a gate that never ran, unless the driver says which happened.

package/lib/turn-policy.mjs

@@ -207,8 +207,9 @@ export function quotaResetAt(rows, now = Date.now()) {
 }
 
 /// Seats that park rather than retry. A backend error is the provider having a bad minute and the
-/// ladder is exactly right for it; a spent plan or a rejected key will not fix itself on a timer.
-export const PARKING_REASONS = new Set(["exhausted", "auth"]);
+/// ladder is exactly right for it; a spent plan, a rejected key, or a provider-side key rejection
+/// (#8778: the chatgpt-backend 401 on a seat whose login is valid) will not fix itself on a timer.
+export const PARKING_REASONS = new Set(["exhausted", "auth", "provider-rejected"]);
 
 /// #6228: the sender's home project, by the same "name suffix after the last colon" convention
 /// every crew/orch identity is minted with (isRunnerSession in crew-runner.mjs uses the mirror

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.71",
+  "version": "0.18.72",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"