trantor 0.18.74 → 0.18.76

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.74",
+  "version": "0.18.76",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -132,6 +132,7 @@ switch (cmd) {
   case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
+  case "disk": run("bin/disk.mjs"); break;
   case "retire": run("bin/retire.mjs"); break;
   case "identity": {
     const { load, publicView, generate, keyPath } = await import(join(ROOT, "lib/identity.mjs"));
@@ -274,6 +275,7 @@ switch (cmd) {
   trantor orchestrate a per-project ORCHESTRATOR with a MISSION.md and a pulse: up [--every 10m] | down | status — the loop-orchestrator pattern
   trantor retire      retire orchestrator panes nothing is using — preview by default [--hours N] [--yes] [--json]
   trantor patrol      machine-wide resource sweep: crews/runners/workspaces/orphans — [--json] [--reap] (reap = dead rows + stale artifacts ONLY)
+  trantor disk        where the disk went + the safe tier to reclaim — [--dry-run] [--clean] [--json] · install (Monday 09:00 launchd)
 
 Claude Code plugin (the orchestrator side):
   claude plugin marketplace add sashabogi/trantor && claude plugin install trantor

package/bin/crew/state.mjs

@@ -1,5 +1,7 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { call, listPids, run } from "./core.mjs";
+import { hostId } from "../../lib/project.mjs";
+import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
 
 export function parseRow(line) {
   const fields = line.split("\t");
@@ -42,8 +44,23 @@ export function dropState(ctx, project, kind, agent = "", handle = "") {
   writeRows(ctx, rows);
 }
 
-function killSeatProcesses(ctx, project, agent) {
+// #9778: a seat going down releases the containers its runner recorded — `docker stop` only,
+// never rm, never volumes; docker absent skips silently. Same kill-switch as the process kill.
+async function stopSeatContainers(ctx, project, agent) {
+  if (ctx.dry || ctx.env?.CREW_NO_PROC_KILL === "1" || !project || !agent) return;
+  const r = dockerSweep({ path: dockerStatePathFor(agent, project) });
+  if (r.skipped || !r.stopped.length) return;
+  console.log(`  🧹 ${agent}:${project} — stopped ${r.stopped.length} container(s): ${r.stopped.join(", ")}`);
+  try {
+    const { signedPost } = await import("../../hooks/lib/api.mjs");
+    await signedPost("/send", { from: `${hostId()}:${project}`, to: "all", kind: "status", project,
+      text: `🧹 ${agent}:${project} torn down — stopped ${r.stopped.length} container(s): ${r.stopped.join(", ")}` }, { project });
+  } catch {}
+}
+
+async function killSeatProcesses(ctx, project, agent) {
   if (ctx.env.CREW_NO_PROC_KILL === "1" || !project || !agent) return;
+  await stopSeatContainers(ctx, project, agent);
   const patterns = [`seats/${project}-${agent}\\.sh`, `crew-runner\\.mjs ${agent} .*/${project}$`];
   for (const pattern of patterns) {
     for (const pid of listPids(pattern)) run(ctx, "kill", ["-9", pid], { rendered: `kill -9 ${pid} 2>/dev/null` });
@@ -79,7 +96,7 @@ function parseDownArgs(ctx, args) {
   return parsed;
 }
 
-function closeRow(ctx, row, selected, orchProjects, adapters, tmuxClosed) {
+async function closeRow(ctx, row, selected, orchProjects, adapters, tmuxClosed) {
   const perSeat = selected.length > 0;
   const hasOrch = orchProjects.has(row.project);
   if (row.kind === "cmuxws" && !perSeat && !hasOrch) adapters.cmux.closeWorkspace(row.handle);
@@ -88,7 +105,7 @@ function closeRow(ctx, row, selected, orchProjects, adapters, tmuxClosed) {
   if (row.kind === "herdr" && (perSeat || hasOrch)) adapters.herdr.closePane(row.handle);
   if (row.kind === "tmux") closeTmux(ctx, row, perSeat, tmuxClosed);
   if ((row.kind === "win" || row.kind === "attach") && !(perSeat && row.kind === "attach")) killTerminal(ctx, row.handle);
-  if (!["cmuxws", "attach", "herdrws", "orch"].includes(row.kind)) killSeatProcesses(ctx, row.project, row.agent);
+  if (!["cmuxws", "attach", "herdrws", "orch"].includes(row.kind)) await killSeatProcesses(ctx, row.project, row.agent);
 }
 
 function closeTmux(ctx, row, perSeat, seen) {
@@ -102,7 +119,7 @@ function closeTmux(ctx, row, perSeat, seen) {
   run(ctx, "tmux", ["kill-session", "-t", session], { rendered: `tmux kill-session -t '${session}' 2>/dev/null` });
 }
 
-export function down(ctx, args, adapters) {
+export async function down(ctx, args, adapters) {
   const options = parseDownArgs(ctx, args);
   if (options.help) return 0;
   if (options.error) return 1;
@@ -119,7 +136,7 @@ export function down(ctx, args, adapters) {
   }
   const orchProjects = new Set(rows.filter(row => row.kind === "orch").map(row => row.project));
   const tmuxClosed = new Set();
-  for (const row of scoped) closeRow(ctx, row, options.agents, orchProjects, adapters, tmuxClosed);
+  for (const row of scoped) await closeRow(ctx, row, options.agents, orchProjects, adapters, tmuxClosed);
   const removed = new Set(scoped.map(row => `${row.project}|${row.kind}|${row.agent}|${row.handle}`));
   const kept = rows.filter(row => !removed.has(`${row.project}|${row.kind}|${row.agent}|${row.handle}`) || (orchProjects.has(row.project) && ["herdrws", "cmuxws", "orch"].includes(row.kind)));
   writeRows(ctx, kept);

package/bin/crew-runner.mjs

@@ -17,6 +17,7 @@ import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
   verdictFor, substantiveOutput, stallVerdict, cutSignalFor,
   BILLING_RE, looksLikeBillingDeath, usageSaysNoWork, zeroUsageVerdict,
+  permissionRejection, looksLikePermissionDeath,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine } from "./crew-payload.mjs";
@@ -26,6 +27,7 @@ import {
   CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
 } from "../lib/turn-policy.mjs";
 import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
+import { listContainers, newContainers, recordContainers, statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../lib/docker-janitor.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
   observedDutyNudgeIds, requeueMissingWakeMessages, shedExpiredHubAlerts,
@@ -252,7 +254,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: ""
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If your work starts containers or a dev server (\`supabase start\`, \`docker run\`, a watch process), stop them before moving your card to testing and name them in the note — the runner also stops containers it saw your turn create when the card closes, but the first responsibility is yours (#9778). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -304,6 +306,17 @@ const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
 // `trantor seat-why` read "live, last turn failed". This file is the state behind that event, so a
 // reader who missed the message still finds the reason, the evidence and when it lifts.
 const PARKF = join(homedir(), ".agent-bus", `park-${AGENT}-${PROJ}.json`);
+// #9778: the seat's recorded containers, persisted per seat so a card close, a park or
+// `trantor down <seat>` can stop what the seat started even after this runner is gone.
+const DOCKERF = dockerStatePathFor(AGENT, PROJ);
+// One bus line per sweep, naming what was stopped; docker absent sweeps stay silent by contract.
+async function janitorStop(why, card) {
+  const r = dockerSweep({ path: DOCKERF, card });
+  if (r.skipped || !r.stopped.length) return;
+  const text = `🧹 ${SESSION} stopped ${r.stopped.length} container(s) (${why}): ${r.stopped.join(", ")}${r.failed.length ? ` · could not stop: ${r.failed.join(", ")}` : ""}`;
+  log(text);
+  await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
+}
 // #7778: message ids this seat already consumed through its OWN inbox path (relay_inbox, the
 // PostToolUse hook) — reconciled from the hub's deliveredUpTo ledger at each clean turn boundary
 // and persisted in the pending file, so a message the session read mid-turn is never re-woken by
@@ -389,6 +402,8 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
     : reason === "auth" ? " — check credentials"
     : reason === "backend-error" ? " — provider backend error (NOT quota): retry, or `trantor swap` to another provider"
     : reason === "missing-cli" ? " — CLI not on PATH"
+    // #9919: the sandbox refused a path outside the worktree — the fix is where the scratch goes.
+    : reason === "permission-rejected" ? " — the sandbox refuses paths outside the worktree: keep scratch (logs, baselines, temp files) under <worktree>/.agent-bus-out"
     // #5481: name the suspected trap, not just the symptom — the dial lives in the provider's
     // opencode model config (limit.output), not in the runner.
     : reason === "empty-output" ? (AGENT === "inception"
@@ -466,6 +481,8 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
   // orchestrator stops confusing a quota-held seat with a working or a dead one.
   writeTurnState(AGENT, PROJ, { phase: "parked", since: Date.now() });
   await registerStatus(`parked (${reason})`, { phase: "parked", phaseSince: Date.now() });
+  // #9778: a parked seat is done working for now — its recorded containers go down with it.
+  await janitorStop(`seat parked (${reason})`);
   return until;
 }
 
@@ -725,6 +742,9 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #7759: the worktree snapshot the turn is judged against at its end — porcelain covers edits
   // AND new untracked files, which a HEAD-only comparison misses.
   const statusBefore = gitOut(["status", "--porcelain"], TURN_DIR);
+  // #9778: the docker snapshot the turn is judged against — containers the CLI spawns are recorded
+  // against the seat's card at turn end, then stopped when the card closes or the seat parks.
+  const dockerBefore = listContainers();
   // #7759: the bus event cursor the turn is judged against — anything the seat posts after this
   // (relay_send, a card move or note) is bus activity, which counts as work.
   const busSeqBefore = await latestBusEventId();
@@ -937,6 +957,14 @@ exit $turn_exit`;
     effExit = 1;
     log(`\x1b[31mexit 0 but the turn output IS a provider billing rejection — treating as FAILED (exhausted, "${BILLING_RE.exec(ownOut)[0]}")\x1b[0m`);
   }
+  // #9919: the same trap in the sandbox family — the seat reached outside its worktree, opencode
+  // auto-rejected the permission and killed the turn at exit 0, and glm:ibkr sat 8h on an
+  // uncommitted #9859 under a "success" row. Judged on the output TAIL: the rejection prints where
+  // the turn ended, so a turn that only quotes the phrase mid-stream stays success.
+  if (realExit === 0 && effExit === 0 && looksLikePermissionDeath(ownOut, newCommit)) {
+    effExit = 1;
+    log(`\x1b[31mexit 0 but the turn output IS a sandbox permission rejection — treating as FAILED (permission-rejected, "${permissionRejection(ownOut)}")\x1b[0m`);
+  }
   // #5481: exit 0 with an empty ERRF (the TOTAL capture, both streams) is the null-completion trap,
   // judged on echo-stripped text (#5868). #6969: on a state step ERRF is stderr only, so silence is normal.
   if (realExit === 0 && effExit === 0 && !lastErrText.trim() && !lastEnvelope.trim()) {
@@ -950,6 +978,13 @@ exit $turn_exit`;
   // turn: an auth death or a null completion is never re-labelled empty (#7759, #5405, #5481).
   const worktreeChanged = newCommit || gitOut(["status", "--porcelain"], TURN_DIR) !== statusBefore;
   const busActive = await busActivitySince(busSeqBefore);
+  // #9778: containers this turn created are recorded against its card — and land on the telemetry
+  // row, which is the ledger the seat record (#7762) is derived from.
+  const dockerNew = newContainers(dockerBefore, listContainers());
+  if (dockerNew.length) {
+    recordContainers({ path: DOCKERF, card: sessionCard || 0, containers: dockerNew });
+    log(`turn started ${dockerNew.length} container(s) — recorded against #${sessionCard || 0}: ${dockerNew.map(c => c.name || c.id).join(", ")}`);
+  }
   lastEmptyTurn = !cut && realExit === 0 && effExit === 0 && !authHit && !opts.state
     && !worktreeChanged && !busActive && !substantiveOutput(ownOut);
   if (lastEmptyTurn) log("\x1b[33mexit 0 but the turn was EMPTY — no worktree change, no substantive output, no bus activity\x1b[0m");
@@ -994,6 +1029,7 @@ exit $turn_exit`;
   }
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
+  if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
   if (cut) telemetryRow.cut = true;
   if (stallCut) telemetryRow.stalled = true;
   if (extensions) { telemetryRow.extensions = extensions; telemetryRow.boxMs = boxMs; }
@@ -1712,6 +1748,14 @@ async function resolveWakeCard(messages, { session }) {
       await reconcileSessionReads(cursor);
       savePending([], []);
       await reportHealthy();
+      // #9778: the seat moves its own card mid-turn — a card that just reached testing/done
+      // releases the containers recorded against it, one bus line naming them.
+      if (sessionCard > 0) {
+        try {
+          const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
+          if (task && (task.status === "testing" || task.status === "done")) await janitorStop(`#${sessionCard} → ${task.status}`, sessionCard);
+        } catch {}
+      }
       await notifyAssigners(assigners,
         `✅ done on ${SESSION} (exit 0, ${secs}s) · asked: "${asked}" · check the board card and the files for what changed`);
     }

package/bin/crew.mjs

@@ -102,7 +102,7 @@ async function swap(args) {
     return 1;
   }
   console.log(`— tearing down old seat '${oldAgent}' in ${ctx.project} —`);
-  down(ctx, [oldAgent], adapters);
+  await down(ctx, [oldAgent], adapters);
   console.log(`— spawning replacement: ${replacement} —`);
   const code = await runUp([...flags, replacement]);
   if (!code) console.log(`— swapped. RESEND the contract to '${replacement.split(":")[0]}' (it joined fresh with no context). —`);
@@ -110,7 +110,7 @@ async function swap(args) {
 }
 
 let code = 0;
-if (command === "down") code = down(ctx, rawArgs, adapters);
+if (command === "down") code = await down(ctx, rawArgs, adapters);
 else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
 else if (command === "open") code = openOrchestrator(ctx, rawArgs);
 else if (command === "swap") code = await swap(rawArgs);

package/bin/disk.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// trantor disk — report where the disk went; --clean runs the safe tier ONLY;
+// install wires a Monday 09:00 launchd job; --weekly is what that job runs
+// (safe clean, then exactly ONE summary message on the bus for the operator).
+import { spawnSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { homedir, platform, userInfo } from "node:os";
+import { runDisk, formatHuman, fmtBytes, launchdPlist } from "../lib/disk.mjs";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+
+function summaryLine(r, results) {
+  const okN = results.filter((x) => x.ok).length;
+  const failN = results.length - okN;
+  const freed = r.plan.filter((p) => p.type === "build-dir").reduce((n, p) => n + (p.bytes || 0), 0);
+  return `disk janitor: safe tier ${okN ? `cleaned ${okN} item(s)` : "nothing to clean"}${failN ? `, ${failN} FAILED` : ""} (~${fmtBytes(freed)} build output), now ${fmtBytes(r.freeBytes)} free of ${fmtBytes(r.totalBytes)} — report: trantor disk`;
+}
+
+async function sendWeeklyMessage(text) {
+  // One message, signed, into the operator's project lane — never a wall of warnings.
+  try {
+    const { resolveProject, resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
+    const { sfetchJson } = await import(join(ROOT, "lib/signed-fetch.mjs"));
+    const { loadOrCreate } = await import(join(ROOT, "lib/identity.mjs"));
+    const project = resolveProject(process.cwd());
+    const url = resolveHubInfo(project).url;
+    await sfetchJson(`${url}/send`, {
+      payload: { from: "trantor-disk", to: "all", project, kind: "disk", text },
+      identity: loadOrCreate("trantor-disk", "agent"),
+    });
+  } catch (e) {
+    process.stderr.write(`disk janitor: bus message failed: ${e.message}\n`);
+  }
+}
+
+async function install() {
+  if (platform() !== "darwin") {
+    console.error("trantor disk install: launchd is macOS-only; run `trantor disk --clean` from cron elsewhere");
+    process.exit(1);
+  }
+  const agentDir = join(homedir(), "Library", "LaunchAgents");
+  const plistPath = join(agentDir, "com.trantor.disk.plist");
+  const logPath = join(homedir(), ".agent-bus", "disk-launchd.log");
+  mkdirSync(agentDir, { recursive: true });
+  mkdirSync(dirname(logPath), { recursive: true });
+  writeFileSync(plistPath, launchdPlist({ nodePath: process.execPath, scriptPath: join(ROOT, "bin", "disk.mjs"), logPath }));
+  const uid = userInfo().uid;
+  exec("launchctl", ["bootout", `gui/${uid}/com.trantor.disk`]);
+  const r = exec("launchctl", ["bootstrap", `gui/${uid}`, plistPath]);
+  if (r.status !== 0) {
+    // bootout+bootstrap can race an existing job; load -w is the legacy fallback.
+    exec("launchctl", ["load", "-w", plistPath]);
+  }
+  console.log(`installed: ${plistPath}\nruns every Monday 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
+}
+
+function exec(file, args) {
+  return spawnSync(file, args, { encoding: "utf8" });
+}
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
+  console.log(`trantor disk — where the space went, and the provably safe slice to reclaim
+
+  trantor disk              report only (also prints exactly what the safe tier would delete)
+  trantor disk --dry-run    the same report, explicit
+  trantor disk --clean      run the SAFE tier: unavailable simulators, build output in dead
+                            seat worktrees (.next, target, desktop/src-tauri/target),
+                            opencode sessions idle >14 days. Everything else stays.
+  trantor disk --json       machine-readable report
+  trantor disk install      Monday 09:00 launchd job (runs --weekly: clean + one bus message)`);
+  process.exit(0);
+}
+if (args[0] === "install") { await install(); process.exit(0); }
+
+const weekly = args.includes("--weekly");
+const passArgs = weekly ? [...args, "--clean"] : args;
+const { report, results, json } = await runDisk({ args: passArgs });
+if (json) {
+  process.stdout.write(`${JSON.stringify({ report, results }, null, 2)}\n`);
+} else {
+  process.stdout.write(formatHuman(report));
+  if (results.length) {
+    console.log(`\ncleaned: ${results.filter((r) => r.ok).length}, failed: ${results.filter((r) => !r.ok).length}`);
+    for (const r of results.filter((r) => !r.ok)) console.log(`  FAILED ${r.type} ${r.path || r.id || ""}: ${r.error}`);
+  }
+}
+if (weekly) await sendWeeklyMessage(summaryLine(report, results));

package/hooks/await-operator.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// trantor Stop / UserPromptSubmit hook (#9814) — a pane session whose turn ENDS on a question to
+// the operator is waiting, not idle. The app maps a peer status of "blocked …" to needs-you, so at
+// Stop we stamp "blocked · awaiting operator" when the final assistant paragraph ends in "?" or an
+// ask sidecar is still open (#7776); it clears on the next prompt or a convergent no-question Stop.
+import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { sessionContext, signedPost } from "./lib/api.mjs";
+import { endsWithOperatorQuestion, lastAssistantText } from "./lib/await-operator.mjs";
+
+const TIMEOUT_MS = Number(process.env.RELAY_AWAIT_OPERATOR_TIMEOUT_MS || 1500);
+const AWAITING_STATUS = "blocked · awaiting operator";
+
+const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+const stampPath = (session) =>
+  join(busDir(), `await-operator-${String(session).replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
+// Same sanitising as ask-sidecar.mjs's sidecarPath: a session id is a file name, nothing more.
+const sidecarPath = (sid) => {
+  const s = String(sid ?? "").trim();
+  return s && s !== "." && s !== ".." && /^[A-Za-z0-9._-]+$/.test(s) ? join(busDir(), "asks", `${s}.json`) : null;
+};
+
+function readStdin() {
+  return new Promise(res => {
+    let d = ""; process.stdin.setEncoding("utf8");
+    process.stdin.on("data", c => { d += c; });
+    process.stdin.on("end", () => res(d));
+    setTimeout(() => res(d), 400);
+  });
+}
+
+// The restore vocabulary is mcp.mjs's boot registration ("active in <project>"), which the app
+// reads as idle — exactly what a session that just got its answer is.
+async function clearStamp(session, project) {
+  try { unlinkSync(stampPath(session)); } catch {}
+  await signedPost("/register", { session, project, status: `active in ${project}` }, { session, timeoutMs: TIMEOUT_MS });
+}
+
+async function main() {
+  const raw = await readStdin();
+  let input = {};
+  try { input = JSON.parse(raw || "{}"); } catch {}
+  const event = String(input.hook_event_name ?? "");
+  const projectDir = input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // Mirror the other hooks: a home-directory session isn't project work and isn't on the bus.
+  if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return;
+  if (process.env.TRANTOR_SEAT) return;   // the runner owns a crew seat's status vocabulary
+  const { session, project } = sessionContext(projectDir);
+  const stamped = existsSync(stampPath(session));
+
+  if (event === "UserPromptSubmit") {
+    if (stamped) await clearStamp(session, project);
+    return;
+  }
+  if (event !== "Stop") return;
+
+  const sidecar = sidecarPath(input.session_id);
+  const viaSidecar = sidecar !== null && existsSync(sidecar);
+  const asked = viaSidecar || endsWithOperatorQuestion(lastAssistantText(input.transcript_path));
+  if (!asked) {
+    if (stamped) await clearStamp(session, project);   // the turn kept moving; the wait is over
+    return;
+  }
+  const r = await signedPost("/register", { session, project, status: AWAITING_STATUS }, { session, timeoutMs: TIMEOUT_MS });
+  if (r.ok) {
+    try {
+      mkdirSync(busDir(), { recursive: true });
+      writeFileSync(stampPath(session), JSON.stringify({ ts: Date.now(), via: viaSidecar ? "ask-sidecar" : "question" }));
+    } catch {}
+  }
+}
+
+main().catch(() => {}).finally(() => {
+  try { process.stdout.write("{}"); } catch {}
+  process.exit(0);
+});

package/hooks/hooks.json

@@ -34,6 +34,15 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/await-operator.mjs"
+          }
+        ]
       }
     ],
     "PreToolUse": [
@@ -196,6 +205,15 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/stop-inbox.mjs"
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/await-operator.mjs"
+          }
+        ]
       }
     ]
   }

package/hooks/lib/await-operator.mjs

@@ -0,0 +1,49 @@
+// Pure helpers for hooks/await-operator.mjs (#9814): read the turn's final assistant text from the
+// transcript tail and decide whether it asks the OPERATOR a question. Kept pure and exported so the
+// hook test drives the detector directly, without a harness or a hub.
+import { closeSync, existsSync, openSync, readSync, statSync } from "node:fs";
+
+// Transcripts grow to MBs; the final assistant message is at the END at Stop time, so a tail window
+// is enough. 128 KiB covers a long closing reply; anything older is not the turn that just ended.
+const TAIL_BYTES = 128 * 1024;
+
+/** The verdict zone is the LAST paragraph. A "?" buried mid-reply — a regex like `a?b`, a
+ *  rhetorical aside, a question the turn itself went on to answer — is not the session waiting on
+ *  anyone; only a reply that ENDS on a question leaves the operator holding the turn. */
+export function endsWithOperatorQuestion(text) {
+  const t = String(text ?? "").replace(/\r\n/g, "\n");
+  const paragraphs = t.split(/\n\s*\n/).map(p => p.trim()).filter(Boolean);
+  const last = paragraphs[paragraphs.length - 1] || "";
+  return last.endsWith("?");
+}
+
+/** The joined text of the LAST assistant message that carries any. A turn that ends on tool calls
+ *  alone has no prose to judge, so it returns "". Every failure reads as "" — no transcript means
+ *  no stamp, never a guessed one. */
+export function lastAssistantText(transcriptPath) {
+  try {
+    if (!transcriptPath || !existsSync(transcriptPath)) return "";
+    const size = statSync(transcriptPath).size;
+    if (!size) return "";
+    const want = Math.min(size, TAIL_BYTES);
+    const f = openSync(transcriptPath, "r");
+    let tail;
+    try {
+      const buf = Buffer.alloc(want);
+      readSync(f, buf, 0, want, size - want);
+      tail = buf.toString("utf8");
+    } finally { closeSync(f); }
+    const lines = tail.split("\n");
+    if (want < size) lines.shift();   // the window can open mid-line; drop the partial
+    let text = "";
+    for (const line of lines) {
+      let entry;
+      try { entry = JSON.parse(line); } catch { continue; }
+      if (entry?.type !== "assistant") continue;
+      const parts = Array.isArray(entry.message?.content) ? entry.message.content : [];
+      const joined = parts.filter(p => p?.type === "text").map(p => String(p.text ?? "")).join("\n").trim();
+      if (joined) text = joined;
+    }
+    return text;
+  } catch { return ""; }
+}

package/hooks/lib/inbox-page.mjs

@@ -0,0 +1,58 @@
+// relay_inbox paging (#9822): an overnight backlog once returned 197K chars in ONE tool result.
+// formatInboxPage bounds every read: newest-first, ≤ INBOX_PAGE_SIZE messages, capped near
+// INBOX_PAGE_CHARS, repeated context notices collapsed ×N, footer carrying the before-cursor.
+// Contracts (wake) and questions are never collapsed.
+export const INBOX_PAGE_SIZE = 40;
+export const INBOX_PAGE_CHARS = 20000;
+
+// Same line shape mcp.mjs has always emitted, so inbox and wait read identically.
+export const fmtMessage = (m) => `#${m.id} [${m.from} -> ${m.to}] ${new Date(m.ts).toLocaleTimeString()}: ${m.text}`;
+
+// Stripping digit runs folds "12:04:11" and "3 cards" into one shape, so the same notice at
+// different times and counts is one repeat. A kind (ask), a wake (contract), or a question mark
+// opts the message out of collapsing entirely.
+const collapsible = (m) => !m.kind && m.wake === false && !String(m.text || "").includes("?");
+const collapseKey = (m) => `${m.from}|${String(m.text || "").replace(/\d+/g, "#")}`;
+
+// Newest-first entries {m, n}: n counts how many messages the representative stands for.
+export function collapseMessages(messages) {
+  const entries = [];
+  const seen = new Map();
+  for (let i = (messages || []).length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (!collapsible(m)) { entries.push({ m, n: 1 }); continue; }
+    const key = collapseKey(m);
+    const at = seen.get(key);
+    if (at === undefined) { seen.set(key, entries.length); entries.push({ m, n: 1 }); }
+    else entries[at].n++;
+  }
+  return entries;
+}
+
+// messages ascending by id (the hub's order) -> bounded newest-first text. The page is the newest
+// `limit` messages that fit the char cap — a CONTIGUOUS slice, so before-cursor paging has no gaps
+// and no double-shown repeats; collapsing is display-only inside the window. Returns
+// { text, shown, hidden, before } — before pages further back via relay_inbox({before}).
+export function formatInboxPage(messages, { limit = INBOX_PAGE_SIZE, capChars = INBOX_PAGE_CHARS } = {}) {
+  const list = messages || [];
+  const window = [];
+  let chars = 0;
+  for (let i = list.length - 1; i >= 0 && window.length < limit; i--) {
+    const lineLen = fmtMessage(list[i]).length + 8; // slack for a ×N suffix
+    // The first line always lands, however long — an empty page would read as "no messages".
+    if (window.length && chars + lineLen + 1 > capChars) break;
+    window.push(list[i]);
+    chars += lineLen + 1;
+  }
+  const lines = collapseMessages(window.slice().reverse()).map(e => fmtMessage(e.m) + (e.n > 1 ? `  (×${e.n})` : ""));
+  const hidden = list.length - window.length;
+  let text = lines.join("\n");
+  let before = 0;
+  const oldestShownId = Number(window[window.length - 1]?.id) || 0;
+  if (hidden > 0 && oldestShownId) {
+    before = oldestShownId;
+    const footer = `… ${hidden} older not shown — relay_inbox({before:${before}}) for more`;
+    text = text ? `${text}\n${footer}` : footer;
+  }
+  return { text, shown: window.length, hidden, before };
+}

package/lib/classify-failure.mjs

@@ -91,6 +91,10 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
     // real work (checked by the runner via git), and it stands above the captured stream.
     const bl = looksLikeBillingDeath(ownText);
     if (bl) return `classified exhausted because ${BILLING_RE.exec(String(ownText || ""))[0]} in the CLI's own output on a clean exit`;
+    // #9919: the sandbox family's exit-0 trap — the rejection prints at the TAIL and the runner
+    // lifts effExit below; a caller that reaches here un-lifted still names the death.
+    const pm = permissionRejection(String(ownText || ""));
+    if (pm) return `classified permission-rejected because ${pm} on a clean exit`;
     return emptyTurn
     ? "classified empty-turn because exit 0 with no worktree change, no substantive output, no bus activity"
     : "classified success because exit 0 with CLI output";
@@ -105,6 +109,10 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
     // credit error must read exhausted here, never fall through to the auth label.
     const bl = String(ownText || "").match(BILLING_RE);
     if (bl) return `classified exhausted because ${bl[0]} in the CLI's own output on a clean exit`;
+    // #9919: the lifted permission death lands HERE (the runner raised effExit to 1) — it must
+    // name permission-rejected plus the refused path, never the auth label below it.
+    const pm = permissionRejection(String(ownText || ""));
+    if (pm) return `classified permission-rejected because ${pm} on a clean exit`;
     const m = AUTH_MARKER_RE.exec(String(ownText || ""));
     return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
   }
@@ -148,6 +156,37 @@ export function looksLikeBillingDeath(ownText, realWork = false) {
   return t.length < OWN_OUTPUT_ANSWER_MIN && BILLING_RE.test(t);
 }
 
+// ---- the sandbox permission rejection on a clean exit (#9919) -----------------------------------
+// The seat reached outside its worktree and opencode auto-rejected the permission, killed the
+// turn — and exited 0, so the runner read "success" over a turn that died mid-step (#9919). Both
+// deaths print at the TAIL: the turn ends right there, after real work above it.
+export const PERMISSION_RE = /rejected permission to use this specific tool call|permission requested: .*?auto-rejecting/i;
+
+/** The judged zone is the TAIL, not the whole capture: a long turn that merely QUOTES the phrase
+ *  (a contract, a commit message, this file) has it mid-stream, never at the end where a death
+ *  prints — #9812's whole-text answer floor cannot apply, because a dying turn's capture is long. */
+export const PERMISSION_TAIL = 600;
+
+const PERMISSION_PATH_RE = /permission requested:\s*\S+\s*\(([^)]*)\);?\s*auto-rejecting/i;
+
+/** The tail's rejection evidence: names the refused path when the auto-reject banner printed one
+ *  ("/tmp/w0-base/*"), else the matched phrase. Null when the tail carries no rejection. */
+export function permissionRejection(ownText) {
+  const tail = String(ownText || "").slice(-PERMISSION_TAIL);
+  const m = PERMISSION_RE.exec(tail);
+  if (!m) return null;
+  const path = (PERMISSION_PATH_RE.exec(tail) || [])[1] || "";
+  return path ? `the sandbox auto-rejected permission for ${path}` : m[0];
+}
+
+/** #9919: a sandbox permission rejection on a clean exit is the turn dying mid-step. Same doctrine
+ *  as looksLikeBillingDeath (a shipped commit is a live turn), but judged on the TAIL: the capture
+ *  above the rejection is real work, not the answer floor's "just the error" shape. */
+export function looksLikePermissionDeath(ownText, realWork = false) {
+  if (realWork) return false;
+  return permissionRejection(ownText) !== null;
+}
+
 /** #9724/#8234: a usage record that RESOLVED (the #8234 lookup found the session's record) to all
  *  zeros means no model work happened. Null usage — the CLI prints none and keeps none — stays
  *  unknown and is never failure. */
@@ -190,6 +229,10 @@ export function classifyFailure(exit, errText, emptyOutput = false, emptyTurn =
   // phrase, and either pattern reading first would relabel the same provider-side rejection.
   const pr = providerRejected(String(errText || ""));
   if (pr) return pr;
+  // #9919: a permission death with a non-zero exit is still the sandbox refusing the turn — named
+  // on the TAIL evidence so a crash that merely quoted the phrase mid-stream stays crashed.
+  const perm = permissionRejection(String(errText || ""));
+  if (perm) return { reason: "permission-rejected", matched: perm };
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
   // #9724: the OpenRouter billing phrasing — "requires more credits … can only afford 16" — and

package/lib/disk.mjs

@@ -0,0 +1,421 @@
+// trantor disk — measure first, print the list, delete ONLY the provably safe tier
+// (unavailable simulators via simctl, build output in seat worktrees whose runner is
+// dead, opencode sessions idle >14d via the official CLI). Everything else is
+// REPORT-only; our own deletions are fs.rm on paths asserted under $HOME, never rm -rf.
+import { spawnSync } from "node:child_process";
+import * as nodeFs from "node:fs";
+import { join, resolve, sep, basename, dirname } from "node:path";
+import { homedir } from "node:os";
+
+export const DAY = 24 * 60 * 60 * 1000;
+export const BUILD_DIRS = [".next", "target", "desktop/src-tauri/target"];
+export const SESSION_IDLE_MAX = 14 * DAY;
+
+const GB = 1024 ** 3;
+const KB = 1024;
+
+export function fmtBytes(n) {
+  if (!Number.isFinite(n)) return "?";
+  if (n >= GB) return `${(n / GB).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${Math.round(n / 1024 ** 2)} MB`;
+  if (n >= KB) return `${Math.round(n / KB)} KB`;
+  return `${n} B`;
+}
+
+// The one gate every delete-on-disk must pass. resolve() first: a `..` or a symlink
+// spell in the path must not smuggle it outside $HOME past a string prefix check.
+export function assertUnderHome(path, home) {
+  const child = resolve(String(path));
+  const root = resolve(String(home));
+  if (child === root || child.startsWith(root.endsWith(sep) ? root : root + sep)) return child;
+  throw new Error(`refused: ${child} is not under ${root}`);
+}
+
+function isUnder(path, parent) {
+  const child = resolve(String(path));
+  const root = resolve(String(parent));
+  return child === root || child.startsWith(root.endsWith(sep) ? root : root + sep);
+}
+
+// Default dependency kit — every call site takes `d` so tests inject a temp HOME,
+// a canned exec and a recording remove, and no real simctl/opencode/docker ever runs.
+function defaults(d = {}) {
+  return {
+    fs: d.fs || nodeFs,
+    exec: d.exec || ((file, args) => {
+      const r = spawnSync(file, args, { encoding: "utf8" });
+      return { stdout: r.stdout || "", stderr: r.stderr || "", status: r.status ?? 1 };
+    }),
+    remove: d.remove || null,
+    home: d.home || homedir(),
+    now: d.now || Date.now(),
+    worktreesRoot: d.worktreesRoot || null,
+    entryBudget: d.entryBudget || 400_000,
+  };
+}
+
+// Recursive size walk. Skips symlinks entirely — a worktree symlink must not make
+// us measure (or later rm) outside its root. Budget caps pathological trees.
+export function dirSize(fs, path, { entryBudget = 400_000 } = {}) {
+  let bytes = 0, files = 0, partial = false, seen = 0;
+  const stack = [String(path)];
+  while (stack.length) {
+    if (seen++ > entryBudget) { partial = true; break; }
+    const dir = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+    catch { continue; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isSymbolicLink()) continue;
+      if (e.isDirectory()) { stack.push(p); continue; }
+      try { bytes += fs.statSync(p).size; files++; } catch {}
+    }
+  }
+  return { bytes, files, partial };
+}
+
+export function freeSpace(fs, path = "/") {
+  try {
+    const s = fs.statfsSync(path);
+    return { free: Number(s.bfree) * Number(s.bsize), total: Number(s.blocks) * Number(s.bsize) };
+  } catch { return { free: 0, total: 0 }; }
+}
+
+// One `ps` snapshot answers "is anything alive that uses this path" for every check
+// below: crew-runner workdirs, opencode run -c, portless/next dev servers all carry
+// the worktree path on their command line. Fails open as [] only when ps is unusable.
+export function liveCommandLines(exec) {
+  const r = exec("ps", ["-axo", "command="]);
+  if (r.status !== 0 && !r.stdout) return [];
+  return r.stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+}
+
+function gitOut(exec, args) {
+  const r = exec("git", args);
+  return r.status === 0 ? String(r.stdout || "") : "";
+}
+
+// A build dir that git tracks is source-adjacent state, not disposable output —
+// deleting it would fight the checkout. Checked per candidate, never assumed.
+export function gitTracked(exec, worktree, rel) {
+  return gitOut(exec, ["-C", worktree, "ls-files", "--", rel]).trim().length > 0;
+}
+
+export function scanSeatWorktrees(d) {
+  const { fs, exec, home, now } = d;
+  const root = d.worktreesRoot || join(home, ".agent-bus", "worktrees");
+  const live = liveCommandLines(exec);
+  const seats = [], plan = [], kept = [];
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { root, seats, plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const isLive = live.some((l) => l.includes(wt));
+      const size = dirSize(fs, wt, d);
+      seats.push({ project: proj.name, seat: seat.name, path: wt, bytes: size.bytes, live: isLive });
+      for (const rel of BUILD_DIRS) {
+        const p = join(wt, ...rel.split("/"));
+        let st;
+        try { st = fs.statSync(p); } catch { continue; }
+        if (!st.isDirectory()) continue;
+        if (isLive) { kept.push({ path: p, reason: "KEPT: a live seat process uses this worktree" }); continue; }
+        if (gitTracked(exec, wt, rel)) { kept.push({ path: p, reason: `KEPT: ${rel} is git-tracked in ${proj.name}/${seat.name}` }); continue; }
+        plan.push({ type: "build-dir", path: p, worktree: wt, project: proj.name, seat: seat.name, bytes: dirSize(fs, p, d).bytes });
+      }
+    }
+  }
+  seats.sort((a, b) => b.bytes - a.bytes);
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { root, seats, plan, kept };
+}
+
+export function scanOpencodeSessions(d) {
+  const { exec, now } = d;
+  const live = liveCommandLines(exec);
+  const rows = [], plan = [], kept = [];
+  const r = exec("opencode", ["session", "list", "--format", "json"]);
+  let list = [];
+  if (r.status === 0 && String(r.stdout).includes("[")) {
+    try { list = JSON.parse(String(r.stdout).slice(String(r.stdout).indexOf("["))); } catch { list = []; }
+  }
+  if (!Array.isArray(list)) list = [];
+  for (const s of list) {
+    const idleMs = now - Number(s.updated || 0);
+    const row = { id: s.id, title: s.title, directory: s.directory, idleDays: Math.max(0, Math.round(idleMs / DAY)) };
+    rows.push(row);
+    if (idleMs <= SESSION_IDLE_MAX) continue;
+    if (s.directory && live.some((l) => l.includes(String(s.directory)))) {
+      kept.push({ path: s.directory, reason: `KEPT: session ${s.id} sits in a live process directory` });
+      continue;
+    }
+    plan.push({ type: "opencode-session", id: String(s.id), directory: s.directory || "", cmd: ["opencode", "session", "delete", String(s.id)] });
+  }
+  return { rows, plan, kept, listed: r.status === 0 };
+}
+
+export function scanSimulators(d) {
+  const { fs, exec, home } = d;
+  const r = exec("xcrun", ["simctl", "list", "devices"]);
+  let unavailable = 0, available = false;
+  if (r.status === 0) {
+    available = true;
+    let inUnavail = false;
+    for (const line of String(r.stdout).split("\n")) {
+      if (line.startsWith("--")) { inUnavail = /Unavailable/i.test(line); continue; }
+      if (inUnavail && /\(/.test(line)) unavailable++;
+    }
+  }
+  const devicesDir = join(home, "Library", "Developer", "CoreSimulator", "Devices");
+  let bytes = 0;
+  try { bytes = dirSize(fs, devicesDir, d).bytes; } catch {}
+  const plan = available ? [{ type: "simulators", cmd: ["xcrun", "simctl", "delete", "unavailable"] }] : [];
+  return { available, unavailable, bytes, plan };
+}
+
+export function reportDocker(exec) {
+  const df = exec("docker", ["system", "df", "--format", "{{json .}}"]);
+  if (df.status !== 0) return { running: false, note: "docker not running — colima stacks unmeasured" };
+  const out = {};
+  for (const line of String(df.stdout).split("\n").filter(Boolean)) {
+    try { const j = JSON.parse(line); if (j.Type) out[j.Type] = { size: j.Size, reusable: j.Reclaimable }; } catch {}
+  }
+  const names = exec("docker", ["ps", "-a", "--format", "{{.Names}}"]);
+  const byProject = {};
+  for (const n of String(names.stdout || "").split("\n").filter(Boolean)) {
+    // supabase_db_lindadrive → lindadrive; glm8977 → glm8977. Supabase names one
+    // container per service, so per-container rows would flood the report.
+    const proj = n.startsWith("supabase_") ? (n.split("_").pop() || n) : n.split("-")[0];
+    (byProject[proj] ||= []).push(n);
+  }
+  return { running: true, df: out, byProject };
+}
+
+// Size an HF model by its BLOBS, not its symlinks: snapshot files are symlinks to the
+// real weights (per-model blobs/ or the shared hub/blobs store), so realpath each link
+// and count every distinct blob once — by dev:ino, which also dedupes hardlinks and
+// repeated revs. globalSeen keeps a cross-model shared blob out of totalBytes twice.
+export function sizeHfModel(fs, modelDir, { entryBudget = 400_000, globalSeen = null } = {}) {
+  let bytes = 0, globalNew = 0, seen = 0, partial = false;
+  const counted = new Set();
+  const stack = [String(modelDir)];
+  while (stack.length) {
+    if (seen++ > entryBudget) { partial = true; break; }
+    const dir = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) { stack.push(p); continue; }
+      let st;
+      try { st = fs.statSync(e.isSymbolicLink() ? fs.realpathSync(p) : p); }
+      catch { continue; }
+      if (!st.isFile()) continue;
+      const key = `${st.dev}:${st.ino}`;
+      if (!counted.has(key)) { counted.add(key); bytes += st.size; }
+      if (globalSeen && !globalSeen.has(key)) { globalSeen.add(key); globalNew += st.size; }
+    }
+  }
+  return { bytes, globalNew, partial };
+}
+
+export function reportHfCache(d) {
+  const { fs, home } = d;
+  const hub = join(home, ".cache", "huggingface", "hub");
+  let entries;
+  try { entries = fs.readdirSync(hub, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("models--")); }
+  catch { return { root: hub, models: [], totalBytes: 0 }; }
+  const seen = new Set();
+  let totalBytes = 0;
+  const models = entries.map((e) => {
+    const r = sizeHfModel(fs, join(hub, e.name), { entryBudget: d.entryBudget, globalSeen: seen });
+    totalBytes += r.globalNew;
+    return { model: e.name, bytes: r.bytes };
+  }).sort((a, b) => b.bytes - a.bytes).slice(0, 20);
+  return { root: hub, models, totalBytes };
+}
+
+// Claude agent worktrees are never cleaned here — each row carries dirty and
+// unmerged counts, which is exactly the work a reaper would destroy.
+export function reportClaudeWorktrees(d) {
+  const { fs, exec, home } = d;
+  const roots = [join(home, ".claude", "worktrees"), join(home, ".claude", "projects")];
+  const rows = [];
+  for (const root of roots) {
+    let tops;
+    try { tops = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); } catch { continue; }
+    for (const top of tops) {
+      const candidates = root.endsWith("projects") ? listNested(fs, join(root, top.name), "worktrees") : [join(root, top.name)];
+      for (const wt of candidates) {
+        const dirty = gitOut(exec, ["-C", wt, "status", "--porcelain"]).split("\n").filter(Boolean).length;
+        const unmerged = Number(gitOut(exec, ["-C", wt, "rev-list", "--count", "main..HEAD"]).trim()) || 0;
+        rows.push({ path: wt, bytes: dirSize(fs, wt, d).bytes, dirty, unmerged });
+      }
+    }
+  }
+  return { rows: rows.sort((a, b) => b.bytes - a.bytes) };
+}
+
+function listNested(fs, dir, name) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name === name).map((e) => join(dir, e.name));
+  } catch { return []; }
+}
+
+// Big-file sweep over the known sink roots — deliberately NOT a whole-$HOME walk.
+export function collectBigFiles(d, minBytes = GB) {
+  const { fs, home } = d;
+  const roots = [
+    join(home, ".agent-bus"), join(home, ".claude"), join(home, ".cache"),
+    join(home, ".colima"), join(home, "Library", "Developer"), join(home, ".local", "share"),
+  ];
+  const found = [];
+  let seen = 0;
+  const stack = [...roots];
+  while (stack.length) {
+    if (seen++ > d.entryBudget) break;
+    const dir = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isSymbolicLink()) continue;
+      if (e.isDirectory()) { stack.push(p); continue; }
+      try {
+        const size = fs.statSync(p).size;
+        if (size >= minBytes) found.push({ path: p, bytes: size });
+      } catch {}
+    }
+  }
+  return found.sort((a, b) => b.bytes - a.bytes).slice(0, 50);
+}
+
+export function buildDiskReport(d) {
+  const dep = defaults(d);
+  const { fs, home, now } = dep;
+  const space = freeSpace(fs, "/");
+  const seats = scanSeatWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const sessions = scanOpencodeSessions(dep);
+  const sims = scanSimulators(dep);
+  const dbPath = join(home, ".local", "share", "opencode", "opencode.db");
+  const report = {
+    generated: new Date(now).toISOString(),
+    home,
+    freeBytes: space.free,
+    totalBytes: space.total,
+    seats: { root: seats.root, rows: seats.seats, totalBytes: seats.seats.reduce((n, s) => n + s.bytes, 0) },
+    simulators: { available: sims.available, unavailable: sims.unavailable, bytes: sims.bytes },
+    opencode: { listed: sessions.listed, rows: sessions.rows, dbPath, dbBytes: fileSize(fs, dbPath) },
+    docker: reportDocker(dep.exec),
+    hf: reportHfCache(dep),
+    claudeWorktrees: reportClaudeWorktrees(dep),
+    bigFiles: collectBigFiles(dep),
+    plan: [...sims.plan, ...seats.plan, ...sessions.plan],
+    kept: [...seats.kept, ...sessions.kept],
+  };
+  return report;
+}
+
+function fileSize(fs, p) {
+  try { return fs.statSync(p).size; } catch { return 0; }
+}
+
+export function formatHuman(r) {
+  const L = [];
+  L.push(`trantor disk — ${fmtBytes(r.freeBytes)} free of ${fmtBytes(r.totalBytes)} (${new Date(r.generated).toLocaleString()})`);
+  L.push(`seat worktrees: ${fmtBytes(r.seats.totalBytes)} total`);
+  for (const s of r.seats.rows.slice(0, 12)) L.push(`  ${s.live ? "LIVE" : "dead"}  ${s.project}/${s.seat}  ${fmtBytes(s.bytes)}`);
+  L.push(`simulators: ${fmtBytes(r.simulators.bytes)}${r.simulators.available ? `, ${r.simulators.unavailable} unavailable device(s)` : " (xcrun unavailable)"}`);
+  L.push(`opencode sessions: ${r.opencode.rows.length} listed, db ${fmtBytes(r.opencode.dbBytes)} (shrinks only after a VACUUM when no opencode process holds it)`);
+  if (r.docker.running) {
+    const parts = Object.entries(r.docker.df).map(([k, v]) => `${k} ${v.size}`).join(", ");
+    L.push(`docker: ${parts || "no layers"}`);
+    for (const [proj, names] of Object.entries(r.docker.byProject)) L.push(`  stack ${proj}: ${names.length} container(s)`);
+  } else L.push(`docker: ${r.docker.note}`);
+  if (r.hf.models.length) {
+    L.push(`huggingface cache: ${fmtBytes(r.hf.totalBytes ?? r.hf.models.reduce((n, m) => n + m.bytes, 0))}`);
+    for (const m of r.hf.models.slice(0, 8)) L.push(`  ${m.model}  ${fmtBytes(m.bytes)}`);
+  }
+  if (r.claudeWorktrees.rows.length) {
+    L.push(`claude agent worktrees: ${r.claudeWorktrees.rows.length} (never auto-cleaned)`);
+    for (const w of r.claudeWorktrees.rows.slice(0, 8)) L.push(`  ${w.dirty} dirty, ${w.unmerged} unmerged  ${fmtBytes(w.bytes)}  ${basename(dirname(w.path))}/${basename(w.path)}`);
+  }
+  if (r.bigFiles.length) {
+    L.push(`files >1 GB: ${r.bigFiles.length}`);
+    for (const f of r.bigFiles.slice(0, 10)) L.push(`  ${fmtBytes(f.bytes)}  ${f.path}`);
+  }
+  L.push("");
+  L.push(`safe tier would delete ${r.plan.length} item(s):`);
+  for (const p of r.plan) L.push(`  DELETE ${p.type === "build-dir" ? `${fmtBytes(p.bytes)} ${p.path}` : p.type === "opencode-session" ? `session ${p.id} (idle)` : "unavailable simulators"}`);
+  for (const k of r.kept) L.push(`  ${k.reason}${k.path ? `  ${k.path}` : ""}`);
+  if (!r.kept.length) L.push("  (nothing held back)");
+  return `${L.join("\n")}\n`;
+}
+
+// Execute the safe tier. simctl/opencode run as their own CLIs (injected in tests);
+// build dirs are removed by the injected `remove` (default fs.rmSync) only after
+// assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
+export async function runClean(r, d) {
+  const dep = defaults(d);
+  const { exec, home } = dep;
+  const remove = dep.remove || ((p, opts) => dep.fs.rmSync(p, opts));
+  const results = [];
+  for (const item of r.plan) {
+    try {
+      if (item.type === "simulators") {
+        exec("xcrun", ["simctl", "delete", "unavailable"]);
+        results.push({ type: item.type, ok: true });
+      } else if (item.type === "opencode-session") {
+        exec("opencode", ["session", "delete", item.id]);
+        results.push({ type: item.type, id: item.id, ok: true });
+      } else if (item.type === "build-dir") {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, join(home, ".agent-bus", "worktrees"))) throw new Error(`refused: ${p} is not a seat-worktree build dir`);
+        remove(p, { recursive: true, force: true });
+        results.push({ type: item.type, path: p, ok: true });
+      }
+    } catch (e) {
+      results.push({ type: item.type, path: item.path || item.id, ok: false, error: String(e.message || e) });
+    }
+  }
+  return results;
+}
+
+export function launchdPlist({ nodePath, scriptPath, logPath }) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>com.trantor.disk</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodePath}</string>
+    <string>${scriptPath}</string>
+    <string>--weekly</string>
+  </array>
+  <key>StartCalendarInterval</key>
+  <dict>
+    <key>Weekday</key><integer>1</integer>
+    <key>Hour</key><integer>9</integer>
+    <key>Minute</key><integer>0</integer>
+  </dict>
+  <key>StandardOutPath</key><string>${logPath}</string>
+  <key>StandardErrorPath</key><string>${logPath}</string>
+</dict>
+</plist>
+`;
+}
+
+export async function runDisk(d = {}) {
+  const dep = defaults(d);
+  const clean = d.args?.includes("--clean");
+  const json = d.args?.includes("--json");
+  const report = buildDiskReport(dep);
+  const results = clean ? await runClean(report, dep) : [];
+  return { report, results, json, clean };
+}

package/lib/docker-janitor.mjs

@@ -0,0 +1,103 @@
+// #9778: the stale-resource janitor's docker half. Snapshots, diffs and stops, with the docker
+// exec injectable so a drill never starts a real container. Stop means `docker stop` only —
+// never rm, never volumes: a stopped stack keeps its data and is one `start` away from back.
+import { spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+
+const dockerExec = (args) =>
+  spawnSync("docker", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 8000 });
+
+// `docker ps --format '{{.ID}} {{.Names}}'` → [{id, name}]. null = docker absent or the daemon
+// errored (the caller skips silently, by contract); [] = docker up, nothing running.
+export function listContainers(exec = dockerExec) {
+  let r;
+  try { r = exec(["ps", "--format", "{{.ID}} {{.Names}}"]); } catch { return null; }
+  if (!r || r.error || r.status !== 0) return null;
+  return String(r.stdout || "").split("\n").map(l => l.trim()).filter(Boolean).map(l => {
+    const sp = l.indexOf(" ");
+    return sp < 0 ? { id: l, name: l } : { id: l.slice(0, sp), name: l.slice(sp + 1).trim() };
+  });
+}
+
+// Containers present in `after` that were not in `before`, by id. A null snapshot (docker was
+// absent on either side) diffs to nothing — we never accuse a turn we could not observe.
+export function newContainers(before, after) {
+  if (!Array.isArray(before) || !Array.isArray(after)) return [];
+  const seen = new Set(before.map(c => c.id));
+  return after.filter(c => !seen.has(c.id));
+}
+
+// One state file per seat, so a card close, a park or `trantor down <seat>` can still stop what
+// the seat started even after its runner is gone.
+export function statePathFor(agent, project, dir = join(homedir(), ".agent-bus")) {
+  return join(dir, `docker-${agent}-${project}.json`);
+}
+
+export function loadContainers(path) {
+  try {
+    const j = JSON.parse(readFileSync(path, "utf8"));
+    const cards = j?.cards instanceof Object ? j.cards : {};
+    return { cards };
+  } catch { return { cards: {} }; }
+}
+
+function saveContainers(path, state) {
+  try {
+    if (!Object.values(state.cards).some(list => Array.isArray(list) && list.length)) {
+      try { unlinkSync(path); } catch {}
+      return;
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch {}
+}
+
+// Record containers a turn created against the seat's card (0 = no card bound). Dedupes by id:
+// a container two turns both saw new is recorded once. Returns the rows newly added.
+export function recordContainers({ path, card, containers, now = Date.now() }) {
+  if (!containers?.length) return [];
+  const state = loadContainers(path);
+  const key = String(card || 0);
+  const have = new Set((state.cards[key] || []).map(c => c.id));
+  const fresh = containers.filter(c => c.id && !have.has(c.id)).map(c => ({ id: c.id, name: c.name || c.id, at: now }));
+  if (!fresh.length) return [];
+  state.cards[key] = [...(state.cards[key] || []), ...fresh];
+  saveContainers(path, state);
+  return fresh;
+}
+
+// `docker stop <ids>` — the ONLY verb this module ever runs. unavailable = docker is absent or
+// wedged: the caller stays silent and the record stands for the next sweep.
+export function stopContainers({ exec = dockerExec, containers } = {}) {
+  const ids = (containers || []).map(c => c.id).filter(Boolean);
+  if (!ids.length) return { unavailable: false, stopped: [], failed: [] };
+  let r;
+  try { r = exec(["stop", ...ids]); } catch { return { unavailable: true, stopped: [], failed: [] }; }
+  if (!r || r.error) return { unavailable: true, stopped: [], failed: [] };
+  if (r.status !== 0) return { unavailable: false, stopped: [], failed: containers.map(c => c.name || c.id) };
+  const stoppedIds = new Set(String(r.stdout || "").split("\n").map(l => l.trim()).filter(Boolean));
+  const stopped = [], failed = [];
+  for (const c of containers) (stoppedIds.has(c.id) ? stopped : failed).push(c.name || c.id);
+  return { unavailable: false, stopped, failed };
+}
+
+// Stop everything recorded for one card (or every card when card is undefined) and forget what
+// stopped; what could not be stopped stays recorded so the next sweep tries again.
+export function sweep({ path, exec = dockerExec, card } = {}) {
+  const state = loadContainers(path);
+  const keys = card === undefined ? Object.keys(state.cards) : [String(card)];
+  const targets = keys.flatMap(k => (state.cards[k] || []));
+  if (!targets.length) return { skipped: false, stopped: [], failed: [] };
+  const r = stopContainers({ exec, containers: targets });
+  if (r.unavailable) return { skipped: true, stopped: [], failed: [] };
+  for (const k of keys) {
+    state.cards[k] = (state.cards[k] || []).filter(c => !r.stopped.includes(c.name || c.id));
+    if (!state.cards[k].length) delete state.cards[k];
+  }
+  saveContainers(path, state);
+  return { skipped: false, stopped: r.stopped, failed: r.failed };
+}

package/mcp.mjs

@@ -15,6 +15,7 @@ import { loadSeatRecord } from "./lib/seat-record.mjs";
 import { resolveProject, hostId, resolveHubInfo, nonSeatReason, handoffDir, orchWriterSid } from "./lib/project.mjs";
 import { signedPost, signedGet } from "./hooks/lib/api.mjs";
 import { anchorCursor } from "./hooks/lib/inbox-ledger.mjs";
+import { formatInboxPage, fmtMessage } from "./hooks/lib/inbox-page.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 import { isMessageCardTitle, OPEN_CARD_STATUSES } from "./lib/turn-policy.mjs";
 import { markDoing, hollowVerdict, blastRadius, blastLine } from "./hooks/lib/hollow-move.mjs";
@@ -121,7 +122,7 @@ async function api(method, path, payload, { timeoutMs } = {}) {
   }
   return r.json;
 }
-const fmt = (m) => `#${m.id} [${m.from} -> ${m.to}] ${new Date(m.ts).toLocaleTimeString()}: ${m.text}`;
+const fmt = fmtMessage;
 
 const server = new McpServer({ name: "trantor", version: "0.1.0" });
 
@@ -543,12 +544,21 @@ server.tool("relay_handoff", "Write a rich handoff for THIS session so a fresh s
     return { content: [{ type: "text", text: `handoff saved (${rec.id}). A fresh session in ${name} will load it on start. Tell the user to open a new terminal here.` }] };
   });
 
-server.tool("relay_inbox", "Read NEW messages addressed to this session since the last read (non-blocking).", {}, async () => {
-  await seedCursor();
-  const { messages, cursor: c } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=${cursor}`);
-  cursor = c;
-  return { content: [{ type: "text", text: messages.length ? messages.map(fmt).join("\n") : "(no new messages)" }] };
-});
+server.tool("relay_inbox", "Read NEW messages addressed to this session since the last read (non-blocking). The result is a bounded page — newest first, repeats of the same notice collapsed with ×N, capped near 20K chars. When older messages exist it ends with a before-cursor: pass it back as relay_inbox({before}) to page into older history.",
+  { before: z.number().optional().describe("page BACK: return only messages with id < before (the cursor from the 'older not shown' footer). A peek — does not advance the new-message cursor.") },
+  async ({ before }) => {
+    if (before) {
+      // History paging peeks from 0 and filters: it must not advance the delivery ledger.
+      const { messages } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=0&peek=1`);
+      const page = formatInboxPage((messages || []).filter(m => Number(m.id) < before));
+      return { content: [{ type: "text", text: page.text || `(nothing older than #${before})` }] };
+    }
+    await seedCursor();
+    const { messages, cursor: c } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=${cursor}`);
+    cursor = c;
+    const page = formatInboxPage(messages || []);
+    return { content: [{ type: "text", text: page.text || "(no new messages)" }] };
+  });
 
 server.tool("relay_wait", "Block up to `timeout` seconds waiting for the next message to this session (long-poll). Returns the instant a message arrives. When idle, park by calling this repeatedly. IMPORTANT: MCP clients cap or background long tool calls — OpenCode ~60s; Codex ~120s; Claude Code auto-backgrounds ANY MCP call at 120s (CC 2.1.212+, tunable via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS), which breaks inline parking. Use timeout 50 and loop for cross-client safety.",
   { timeout: z.number().optional().describe("seconds to wait, default 25. Effective wait is capped at 110s so the call always returns inline (a longer wait would be auto-backgrounded by Claude Code's 120s MCP floor or dropped by other clients). Use 50 and call repeatedly to park while idle.") },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.74",
+  "version": "0.18.76",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"