trantor 0.18.75 → 0.18.76

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.75",
+  "version": "0.18.76",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -17,6 +17,7 @@ import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
   verdictFor, substantiveOutput, stallVerdict, cutSignalFor,
   BILLING_RE, looksLikeBillingDeath, usageSaysNoWork, zeroUsageVerdict,
+  permissionRejection, looksLikePermissionDeath,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine } from "./crew-payload.mjs";
@@ -401,6 +402,8 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
     : reason === "auth" ? " — check credentials"
     : reason === "backend-error" ? " — provider backend error (NOT quota): retry, or `trantor swap` to another provider"
     : reason === "missing-cli" ? " — CLI not on PATH"
+    // #9919: the sandbox refused a path outside the worktree — the fix is where the scratch goes.
+    : reason === "permission-rejected" ? " — the sandbox refuses paths outside the worktree: keep scratch (logs, baselines, temp files) under <worktree>/.agent-bus-out"
     // #5481: name the suspected trap, not just the symptom — the dial lives in the provider's
     // opencode model config (limit.output), not in the runner.
     : reason === "empty-output" ? (AGENT === "inception"
@@ -954,6 +957,14 @@ exit $turn_exit`;
     effExit = 1;
     log(`\x1b[31mexit 0 but the turn output IS a provider billing rejection — treating as FAILED (exhausted, "${BILLING_RE.exec(ownOut)[0]}")\x1b[0m`);
   }
+  // #9919: the same trap in the sandbox family — the seat reached outside its worktree, opencode
+  // auto-rejected the permission and killed the turn at exit 0, and glm:ibkr sat 8h on an
+  // uncommitted #9859 under a "success" row. Judged on the output TAIL: the rejection prints where
+  // the turn ended, so a turn that only quotes the phrase mid-stream stays success.
+  if (realExit === 0 && effExit === 0 && looksLikePermissionDeath(ownOut, newCommit)) {
+    effExit = 1;
+    log(`\x1b[31mexit 0 but the turn output IS a sandbox permission rejection — treating as FAILED (permission-rejected, "${permissionRejection(ownOut)}")\x1b[0m`);
+  }
   // #5481: exit 0 with an empty ERRF (the TOTAL capture, both streams) is the null-completion trap,
   // judged on echo-stripped text (#5868). #6969: on a state step ERRF is stderr only, so silence is normal.
   if (realExit === 0 && effExit === 0 && !lastErrText.trim() && !lastEnvelope.trim()) {

package/hooks/lib/inbox-page.mjs

@@ -0,0 +1,58 @@
+// relay_inbox paging (#9822): an overnight backlog once returned 197K chars in ONE tool result.
+// formatInboxPage bounds every read: newest-first, ≤ INBOX_PAGE_SIZE messages, capped near
+// INBOX_PAGE_CHARS, repeated context notices collapsed ×N, footer carrying the before-cursor.
+// Contracts (wake) and questions are never collapsed.
+export const INBOX_PAGE_SIZE = 40;
+export const INBOX_PAGE_CHARS = 20000;
+
+// Same line shape mcp.mjs has always emitted, so inbox and wait read identically.
+export const fmtMessage = (m) => `#${m.id} [${m.from} -> ${m.to}] ${new Date(m.ts).toLocaleTimeString()}: ${m.text}`;
+
+// Stripping digit runs folds "12:04:11" and "3 cards" into one shape, so the same notice at
+// different times and counts is one repeat. A kind (ask), a wake (contract), or a question mark
+// opts the message out of collapsing entirely.
+const collapsible = (m) => !m.kind && m.wake === false && !String(m.text || "").includes("?");
+const collapseKey = (m) => `${m.from}|${String(m.text || "").replace(/\d+/g, "#")}`;
+
+// Newest-first entries {m, n}: n counts how many messages the representative stands for.
+export function collapseMessages(messages) {
+  const entries = [];
+  const seen = new Map();
+  for (let i = (messages || []).length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (!collapsible(m)) { entries.push({ m, n: 1 }); continue; }
+    const key = collapseKey(m);
+    const at = seen.get(key);
+    if (at === undefined) { seen.set(key, entries.length); entries.push({ m, n: 1 }); }
+    else entries[at].n++;
+  }
+  return entries;
+}
+
+// messages ascending by id (the hub's order) -> bounded newest-first text. The page is the newest
+// `limit` messages that fit the char cap — a CONTIGUOUS slice, so before-cursor paging has no gaps
+// and no double-shown repeats; collapsing is display-only inside the window. Returns
+// { text, shown, hidden, before } — before pages further back via relay_inbox({before}).
+export function formatInboxPage(messages, { limit = INBOX_PAGE_SIZE, capChars = INBOX_PAGE_CHARS } = {}) {
+  const list = messages || [];
+  const window = [];
+  let chars = 0;
+  for (let i = list.length - 1; i >= 0 && window.length < limit; i--) {
+    const lineLen = fmtMessage(list[i]).length + 8; // slack for a ×N suffix
+    // The first line always lands, however long — an empty page would read as "no messages".
+    if (window.length && chars + lineLen + 1 > capChars) break;
+    window.push(list[i]);
+    chars += lineLen + 1;
+  }
+  const lines = collapseMessages(window.slice().reverse()).map(e => fmtMessage(e.m) + (e.n > 1 ? `  (×${e.n})` : ""));
+  const hidden = list.length - window.length;
+  let text = lines.join("\n");
+  let before = 0;
+  const oldestShownId = Number(window[window.length - 1]?.id) || 0;
+  if (hidden > 0 && oldestShownId) {
+    before = oldestShownId;
+    const footer = `… ${hidden} older not shown — relay_inbox({before:${before}}) for more`;
+    text = text ? `${text}\n${footer}` : footer;
+  }
+  return { text, shown: window.length, hidden, before };
+}

package/lib/classify-failure.mjs

@@ -91,6 +91,10 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
     // real work (checked by the runner via git), and it stands above the captured stream.
     const bl = looksLikeBillingDeath(ownText);
     if (bl) return `classified exhausted because ${BILLING_RE.exec(String(ownText || ""))[0]} in the CLI's own output on a clean exit`;
+    // #9919: the sandbox family's exit-0 trap — the rejection prints at the TAIL and the runner
+    // lifts effExit below; a caller that reaches here un-lifted still names the death.
+    const pm = permissionRejection(String(ownText || ""));
+    if (pm) return `classified permission-rejected because ${pm} on a clean exit`;
     return emptyTurn
     ? "classified empty-turn because exit 0 with no worktree change, no substantive output, no bus activity"
     : "classified success because exit 0 with CLI output";
@@ -105,6 +109,10 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
     // credit error must read exhausted here, never fall through to the auth label.
     const bl = String(ownText || "").match(BILLING_RE);
     if (bl) return `classified exhausted because ${bl[0]} in the CLI's own output on a clean exit`;
+    // #9919: the lifted permission death lands HERE (the runner raised effExit to 1) — it must
+    // name permission-rejected plus the refused path, never the auth label below it.
+    const pm = permissionRejection(String(ownText || ""));
+    if (pm) return `classified permission-rejected because ${pm} on a clean exit`;
     const m = AUTH_MARKER_RE.exec(String(ownText || ""));
     return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
   }
@@ -148,6 +156,37 @@ export function looksLikeBillingDeath(ownText, realWork = false) {
   return t.length < OWN_OUTPUT_ANSWER_MIN && BILLING_RE.test(t);
 }
 
+// ---- the sandbox permission rejection on a clean exit (#9919) -----------------------------------
+// The seat reached outside its worktree and opencode auto-rejected the permission, killed the
+// turn — and exited 0, so the runner read "success" over a turn that died mid-step (#9919). Both
+// deaths print at the TAIL: the turn ends right there, after real work above it.
+export const PERMISSION_RE = /rejected permission to use this specific tool call|permission requested: .*?auto-rejecting/i;
+
+/** The judged zone is the TAIL, not the whole capture: a long turn that merely QUOTES the phrase
+ *  (a contract, a commit message, this file) has it mid-stream, never at the end where a death
+ *  prints — #9812's whole-text answer floor cannot apply, because a dying turn's capture is long. */
+export const PERMISSION_TAIL = 600;
+
+const PERMISSION_PATH_RE = /permission requested:\s*\S+\s*\(([^)]*)\);?\s*auto-rejecting/i;
+
+/** The tail's rejection evidence: names the refused path when the auto-reject banner printed one
+ *  ("/tmp/w0-base/*"), else the matched phrase. Null when the tail carries no rejection. */
+export function permissionRejection(ownText) {
+  const tail = String(ownText || "").slice(-PERMISSION_TAIL);
+  const m = PERMISSION_RE.exec(tail);
+  if (!m) return null;
+  const path = (PERMISSION_PATH_RE.exec(tail) || [])[1] || "";
+  return path ? `the sandbox auto-rejected permission for ${path}` : m[0];
+}
+
+/** #9919: a sandbox permission rejection on a clean exit is the turn dying mid-step. Same doctrine
+ *  as looksLikeBillingDeath (a shipped commit is a live turn), but judged on the TAIL: the capture
+ *  above the rejection is real work, not the answer floor's "just the error" shape. */
+export function looksLikePermissionDeath(ownText, realWork = false) {
+  if (realWork) return false;
+  return permissionRejection(ownText) !== null;
+}
+
 /** #9724/#8234: a usage record that RESOLVED (the #8234 lookup found the session's record) to all
  *  zeros means no model work happened. Null usage — the CLI prints none and keeps none — stays
  *  unknown and is never failure. */
@@ -190,6 +229,10 @@ export function classifyFailure(exit, errText, emptyOutput = false, emptyTurn =
   // phrase, and either pattern reading first would relabel the same provider-side rejection.
   const pr = providerRejected(String(errText || ""));
   if (pr) return pr;
+  // #9919: a permission death with a non-zero exit is still the sandbox refusing the turn — named
+  // on the TAIL evidence so a crash that merely quoted the phrase mid-stream stays crashed.
+  const perm = permissionRejection(String(errText || ""));
+  if (perm) return { reason: "permission-rejected", matched: perm };
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
   // #9724: the OpenRouter billing phrasing — "requires more credits … can only afford 16" — and

package/mcp.mjs

@@ -15,6 +15,7 @@ import { loadSeatRecord } from "./lib/seat-record.mjs";
 import { resolveProject, hostId, resolveHubInfo, nonSeatReason, handoffDir, orchWriterSid } from "./lib/project.mjs";
 import { signedPost, signedGet } from "./hooks/lib/api.mjs";
 import { anchorCursor } from "./hooks/lib/inbox-ledger.mjs";
+import { formatInboxPage, fmtMessage } from "./hooks/lib/inbox-page.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 import { isMessageCardTitle, OPEN_CARD_STATUSES } from "./lib/turn-policy.mjs";
 import { markDoing, hollowVerdict, blastRadius, blastLine } from "./hooks/lib/hollow-move.mjs";
@@ -121,7 +122,7 @@ async function api(method, path, payload, { timeoutMs } = {}) {
   }
   return r.json;
 }
-const fmt = (m) => `#${m.id} [${m.from} -> ${m.to}] ${new Date(m.ts).toLocaleTimeString()}: ${m.text}`;
+const fmt = fmtMessage;
 
 const server = new McpServer({ name: "trantor", version: "0.1.0" });
 
@@ -543,12 +544,21 @@ server.tool("relay_handoff", "Write a rich handoff for THIS session so a fresh s
     return { content: [{ type: "text", text: `handoff saved (${rec.id}). A fresh session in ${name} will load it on start. Tell the user to open a new terminal here.` }] };
   });
 
-server.tool("relay_inbox", "Read NEW messages addressed to this session since the last read (non-blocking).", {}, async () => {
-  await seedCursor();
-  const { messages, cursor: c } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=${cursor}`);
-  cursor = c;
-  return { content: [{ type: "text", text: messages.length ? messages.map(fmt).join("\n") : "(no new messages)" }] };
-});
+server.tool("relay_inbox", "Read NEW messages addressed to this session since the last read (non-blocking). The result is a bounded page — newest first, repeats of the same notice collapsed with ×N, capped near 20K chars. When older messages exist it ends with a before-cursor: pass it back as relay_inbox({before}) to page into older history.",
+  { before: z.number().optional().describe("page BACK: return only messages with id < before (the cursor from the 'older not shown' footer). A peek — does not advance the new-message cursor.") },
+  async ({ before }) => {
+    if (before) {
+      // History paging peeks from 0 and filters: it must not advance the delivery ledger.
+      const { messages } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=0&peek=1`);
+      const page = formatInboxPage((messages || []).filter(m => Number(m.id) < before));
+      return { content: [{ type: "text", text: page.text || `(nothing older than #${before})` }] };
+    }
+    await seedCursor();
+    const { messages, cursor: c } = await api("GET", `/inbox?session=${encodeURIComponent(SESSION)}&since=${cursor}`);
+    cursor = c;
+    const page = formatInboxPage(messages || []);
+    return { content: [{ type: "text", text: page.text || "(no new messages)" }] };
+  });
 
 server.tool("relay_wait", "Block up to `timeout` seconds waiting for the next message to this session (long-poll). Returns the instant a message arrives. When idle, park by calling this repeatedly. IMPORTANT: MCP clients cap or background long tool calls — OpenCode ~60s; Codex ~120s; Claude Code auto-backgrounds ANY MCP call at 120s (CC 2.1.212+, tunable via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS), which breaks inline parking. Use timeout 50 and loop for cross-client safety.",
   { timeout: z.number().optional().describe("seconds to wait, default 25. Effective wait is capped at 110s so the call always returns inline (a longer wait would be auto-backgrounded by Claude Code's 120s MCP floor or dropped by other clients). Use 50 and call repeatedly to park while idle.") },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.75",
+  "version": "0.18.76",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"