trantor 0.18.79 → 0.18.80

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.79",
+  "version": "0.18.80",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -24,7 +24,7 @@ import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine }
 import {
   cardRefs, servedContractCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
-  CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
+  CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark, askDuringTurn, askedVerdict,
 } from "../lib/turn-policy.mjs";
 import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
 import { listContainers, newContainers, recordContainers, statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../lib/docker-janitor.mjs";
@@ -356,17 +356,17 @@ let askReleased = false;
 // session. deliverWake judges each clean wake turn against /contracts — an open ask renames the
 // ledger row "asked" and HOLDS the wake (no failure count, no backoff, no park) until the answer.
 let turnAsk = null;
-async function askJudge() {
+async function askJudge(startedAt) {
   try {
     const r = await api(`/contracts?session=${encodeURIComponent(SESSION)}&project=${encodeURIComponent(PROJ)}`);
-    // abandonedContracts included on purpose: an ask to a gone-quiet assigner is exactly the ask
-    // that must keep holding, and the hub files those rows under their own key (#7079).
-    const rows = [...(r?.contracts || []), ...(r?.abandonedContracts || [])];
-    const open = rows.filter(c => c.kind === "ask" && !c.answered);
-    turnAsk = open.length ? { id: open[open.length - 1].id, to: String(open[open.length - 1].to || "") } : null;
-    return turnAsk ? "asked" : null;
+    const rows = [...(r?.contracts || []), ...(r?.abandonedContracts || []),
+      ...(r?.supersededContracts || []), ...(r?.ackContracts || [])];
+    const ask = askDuringTurn(rows, startedAt);
+    turnAsk = ask && !ask.answered ? { id: ask.id, to: String(ask.to || "") } : null;
+    return ask ? redactKeys(askedVerdict(ask)) : null;
   } catch { return null; }
 }
+
 function savePending(wake, bcast) {
   try {
     // the seen-set (#7778) and a held ask (#7756) keep the file alive even with both queues empty:
@@ -1031,6 +1031,12 @@ exit $turn_exit`;
     effExit = 1;
     log("\x1b[31mexit 0 but the session usage record resolved to all zeros — no model work happened; treating as FAILED\x1b[0m");
   }
+  // #11230: asking is delivery even without a commit or a completed card move.
+  let askVerdict = null;
+  if (!cut && realExit === 0 && effExit === 0 && opts.judgeOutcome) {
+    askVerdict = await opts.judgeOutcome(t0);
+    if (askVerdict) lastEmptyTurn = false;
+  }
   // #10197: a turn BOUND to a card contract reads done only on DELIVERY — a NEW commit since the
   // turn started, or the card moved to testing/done under it. The ibkr shape (exit 0, output, no
   // commit, card still todo) is NO-DELIVERY: the ledger names it and the contract stays owed.
@@ -1045,7 +1051,7 @@ exit $turn_exit`;
     if (endStatus !== null) {
       cardStatusAtEnd = endStatus;
       const moved = ["testing", "done"].includes(endStatus) && !["testing", "done"].includes(cardStatusBefore);
-      noDelivery = !newCommit && !moved;
+      noDelivery = !newCommit && !moved && !askVerdict;
     }
   }
   lastNoDelivery = noDelivery;
@@ -1056,6 +1062,7 @@ exit $turn_exit`;
   // verdict (#7752): the exit under it is the sweep's SIGPIPE. A box cut passes `cut` so its 137
   // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
   const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict()
+    : askVerdict ? askVerdict
     : noDelivery ? noDeliveryVerdict(sessionCard, cardStatusAtEnd || "unknown")
     : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
@@ -1063,12 +1070,7 @@ exit $turn_exit`;
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
-  // #7756: a clean turn that ASKED its assigner is demoted-but-owed, not "completed". The judge
-  // (deliverWake's /contracts read) renames the ledger row, so "asked" is what the log keeps.
-  let finalOutcome = outcome;
-  if (outcome === "completed" && opts.judgeOutcome) {
-    try { finalOutcome = (await opts.judgeOutcome()) || outcome; } catch {}
-  }
+  const finalOutcome = askVerdict ? "asked" : outcome;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
   if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
@@ -1775,6 +1777,7 @@ async function resolveWakeCard(messages, { session }) {
       // the ask's id, so a restart keeps holding — and the failure ladder never sees it. The
       // assigner is NOT notified here: the kind:ask message itself is already that notification.
       awaitingAsk = turnAsk; turnAsk = null;
+      deliveryFails = 0; retryAt = 0; noDeliveryRetry = false;
       savePending(pendingWake, pendingBcast);
       await reportHealthy();
       log(`turn asked its assigner — holding the contract until ask #${awaitingAsk.id} is answered`);

package/hooks/lib/handoff-claims.mjs

@@ -0,0 +1,121 @@
+import { asString, asRecord } from "../../lib/decode.mjs";
+import { readFileSync, writeFileSync, renameSync, symlinkSync, readlinkSync, unlinkSync, statSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { handoffDir } from "../../lib/project.mjs";
+import { readFirstPaths, pathsReadIn } from "./handoff.mjs";
+
+export const CLAIM_TTL_SECONDS = 600;
+
+export function claimHandoff(record, session, now, transcriptBytes = 0, token = "") {
+  if (record.consumed || !session?.session_id) return null;
+  if (record.claim && record.claim.expiresAt > now) return null;
+  const claim = { ...session, at: now, expiresAt: now + CLAIM_TTL_SECONDS, transcriptBytes, token };
+  return { ...record, consumed: false, claim,
+    states: [...(record.states || []), { state: "claimed", ts: now, by: session.session_id }] };
+}
+
+export function recapHandoff(record, { sessionId, token, replied, missed }, now) {
+  if (record.consumed || record.claim?.session_id !== sessionId || record.claim?.token !== token) return null;
+  if (!replied || missed.length) return null;
+  return { ...record, consumed: true, consumedAt: now, consumedBy: record.claim,
+    states: [...(record.states || []), { state: "recapped", ts: now, by: sessionId }] };
+}
+
+export function hasAssistantReply(body, claimedAt) {
+  return body.split("\n").some(line => {
+    let row;
+    try { row = asRecord(JSON.parse(line)); } catch { return false; }
+    if (row?.type !== "assistant" || row.isSidechain) return false;
+    const timestamp = asString(row.timestamp);
+    if (timestamp && Date.parse(timestamp) < claimedAt * 1000) return false;
+    const content = asRecord(row.message)?.content;
+    const text = asString(content);
+    if (text !== null) return text.trim().length > 0;
+    return Array.isArray(content) && content.some(block => {
+      const b = asRecord(block);
+      return b?.type === "text" && !!asString(b.text)?.trim();
+    });
+  });
+}
+
+// Serialize claim and recap writes; a killed hook's PID lock can be reclaimed (#11223).
+function updateRecord(path, update) {
+  const lock = `${path}.lock`;
+  try { symlinkSync(String(process.pid), lock); }
+  catch {
+    try {
+      const owner = readlinkSync(lock);
+      try { process.kill(Number(owner), 0); return null; }
+      catch (error) { if (error.code !== "ESRCH") return null; }
+      if (readlinkSync(lock) !== owner) return null;
+      unlinkSync(lock);
+      symlinkSync(String(process.pid), lock);
+    } catch { return null; }
+  }
+  try {
+    const next = update(JSON.parse(readFileSync(path, "utf8")));
+    if (!next) return null;
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(next, null, 2));
+    renameSync(tmp, path);
+    return next;
+  } finally { unlinkSync(lock); }
+}
+
+export function claimHandoffFile(path, session, now = Math.floor(Date.now() / 1000)) {
+  let bytes = 0;
+  try { bytes = statSync(session.transcript_path).size; } catch {}
+  return updateRecord(path, record => claimHandoff(record, session, now, bytes, randomUUID()));
+}
+
+export function loadPendingHandoff(project, { claim = true, freshSession = null, dir = handoffDir(), now = Math.floor(Date.now() / 1000) } = {}) {
+  const prefix = `${project}-`;
+  let files;
+  try {
+    files = readdirSync(dir).filter(f => f.startsWith(prefix) && /^\d+\.json$/.test(f.slice(prefix.length)))
+      .sort((a, b) => Number(b.slice(prefix.length, -5)) - Number(a.slice(prefix.length, -5)));
+  } catch { return null; }
+  for (const file of files) {
+    try {
+      const path = join(dir, file);
+      const record = JSON.parse(readFileSync(path, "utf8"));
+      if (record.consumed) continue;
+      if (record.claim?.expiresAt > now) return null;
+      if (!claim) return record;
+      const next = claimHandoffFile(path, freshSession, now);
+      if (!next) return null;
+      const readFirst = readFirstPaths(next.summary || "");
+      writeFileSync(recapStampPath(dir, freshSession.session_id), JSON.stringify({
+        handoffId: next.id, file, token: next.claim.token, ts: now,
+        mode: next.mode === "unattended" ? "unattended" : "attended", readFirst,
+      }));
+      return next;
+    } catch { return null; }
+  }
+  return null;
+}
+
+export function recapStampPath(dir, sid) {
+  return join(dir, `recap-pending-${String(sid).replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
+}
+
+export function completeHandoffRecap({ sessionId, transcriptPath, dir = handoffDir(), now = Math.floor(Date.now() / 1000) }) {
+  const stampPath = recapStampPath(dir, sessionId);
+  try {
+    const stamp = JSON.parse(readFileSync(stampPath, "utf8"));
+    const file = stamp.file || `${stamp.handoffId}.json`;
+    if (file.includes("/") || file.includes("\\")) return null;
+    let missed = [];
+    const next = updateRecord(join(dir, file), record => {
+      if (record.claim?.session_id !== sessionId || record.claim?.token !== stamp.token) return null;
+      if (record.claim.transcript_path !== transcriptPath) return null;
+      const body = readFileSync(transcriptPath).subarray(record.claim.transcriptBytes).toString("utf8");
+      missed = pathsReadIn(transcriptPath, stamp.readFirst || []).missed;
+      return recapHandoff(record, { sessionId, token: stamp.token, missed,
+        replied: hasAssistantReply(body, record.claim.at) }, now);
+    });
+    if (next) unlinkSync(stampPath);
+    return { recapped: !!next, missed };
+  } catch { return null; }
+}

package/hooks/sessionstart.mjs

@@ -2,7 +2,7 @@
 // trantor SessionStart hook — every session registers with the hub and gets a roster of OTHER live
 // sessions injected, so independent sessions discover each other. Config: env RELAY_URL →
 // ~/.agent-bus/config.json → http://127.0.0.1:4477. Identity: RELAY_SESSION → "<hostname>:<basename(cwd)>".
-import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { join, basename, dirname } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
@@ -10,7 +10,8 @@ import { fileURLToPath } from "node:url";
 import { resolveProject, hostId, resolveHubInfo, knownProjects, nonSeatReason, nestedProjects, handoffDir, readOrchSession, writeOrchSession } from "../lib/project.mjs";
 import { formatSubagentManifest } from "../lib/subagent-manifest.mjs";
 import { updateAvailable, maybeNotifyDesktop, readConfig } from "./lib/update-check.mjs";
-import { renderStateBlock, readFirstPaths, capSummary } from "./lib/handoff.mjs";
+import { renderStateBlock, capSummary } from "./lib/handoff.mjs";
+import { loadPendingHandoff } from "./lib/handoff-claims.mjs";
 import { maybeCheckBalances } from "./lib/balance-check.mjs";
 import { getJSON, signedGet, signedPost, loadIdentity } from "./lib/api.mjs";
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
@@ -40,59 +41,6 @@ function buildDoctrineShortForm() {
     `</trantor-build-doctrine>\n`;
 }
 
-// Load the most recent UNCONSUMED handoff for this project; `claim` marks it consumed so exactly one
-// session takes it. A compaction-triggered start may show it but must NOT claim it from the new window.
-function loadPendingHandoff(projectName, { claim = true, freshSession = null } = {}) {
-  try {
-    const dir = handoffDir();   // NEVER join(homedir(), …) here: a drill pointed at a temp bus dir must not claim the real handoffs
-    if (!existsSync(dir)) return null;
-    // Match ONLY "<projectName>-<numeric stamp>.json" (a loose startsWith caught leaked fixtures), and
-    // sort by the numeric stamp, newest first, since a string sort could pick a stale handoff.
-    const re = new RegExp("^" + projectName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "-(\\d+)\\.json$");
-    const files = readdirSync(dir)
-      .map(f => { const m = re.exec(f); return m ? { f, stamp: Number(m[1]) } : null; })
-      .filter(Boolean)
-      .sort((a, b) => b.stamp - a.stamp)
-      .map(x => x.f);
-    for (const f of files) {
-      const p = join(dir, f);
-      const rec = JSON.parse(readFileSync(p, "utf8"));
-      if (!rec.consumed) {
-        if (claim) {
-          // `consumed` is set at hook time, BEFORE the model has read anything, so also record WHO is
-          // taking over: baton-close waits for the successor's first assistant turn before closing the original.
-          rec.consumed = true;
-          rec.consumedAt = nowSec();
-          if (freshSession && (freshSession.session_id || freshSession.transcript_path)) {
-            rec.consumedBy = {
-              session_id: freshSession.session_id || "",
-              transcript_path: freshSession.transcript_path || "",
-            };
-          }
-          // §5 CLAIMED on the machine's ledger (SYSTEM-CONTRACT) and the recap net armed: a recap-pending
-          // stamp names this successor, so a successor that never recaps is mechanically impossible.
-          if (!Array.isArray(rec.states)) rec.states = [];
-          rec.states.push({ state: "claimed", ts: nowSec(), by: freshSession?.session_id || "" });
-          writeFileSync(p, JSON.stringify(rec, null, 2));
-          if (freshSession?.session_id) {
-            try {
-              // #5645: the mandate rides the stamp too, so prompt-focus's recap reminder pins
-              // the SAME rec.mode the injection below announces (attended=WAIT / unattended=RESUME).
-              // #8162: the READ-FIRST list rides the stamp as DATA, so the Stop hook can check the
-              // successor opened it instead of accepting a reply as proof it understood anything.
-              const readFirst = readFirstPaths(rec.summary || "");
-              writeFileSync(join(dir, `recap-pending-${String(freshSession.session_id).replace(/[^A-Za-z0-9_.-]/g, "_")}.json`),
-                JSON.stringify({ handoffId: rec.id, ts: nowSec(), mode: rec.mode === "unattended" ? "unattended" : "attended", readFirst }));
-            } catch {}
-          }
-        }
-        return rec;
-      }
-    }
-  } catch {}
-  return null;
-}
-
 function nowSec() { try { return Number(execSync("date +%s", { encoding: "utf8" }).trim()) || 0; } catch { return 0; } }
 
 function readStdin() {

package/hooks/stop-inbox.mjs

@@ -8,10 +8,12 @@ import { join, dirname } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
-import { resolveProject, hostId, handoffDir, busDir } from "../lib/project.mjs";
+import { resolveProject, hostId, busDir } from "../lib/project.mjs";
 import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
-import { readArm, clearArm, markHandedOff, appendHandoffState, subagentsActive, pathsReadIn} from "./lib/handoff.mjs";
+import { readArm, clearArm, markHandedOff, subagentsActive } from "./lib/handoff.mjs";
+
+import { completeHandoffRecap } from "./lib/handoff-claims.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -125,10 +127,14 @@ async function main() {
   let input = {};
   try { input = JSON.parse(raw || "{}"); } catch {}
 
-  // Loop guard FIRST, before any work: if we already blocked once this stop-cycle, the model has had
-  // its chance to deal with the inbox and is entitled to stop.
-  if (input.stop_hook_active) return allow();
   if (process.env.RELAY_STOP_INBOX === "0") return allow();
+  const recap = completeHandoffRecap({ sessionId: String(input.session_id || ""), transcriptPath: input.transcript_path || "" });
+  if (recap?.missed.length && !input.stop_hook_active) {
+    process.stdout.write(JSON.stringify({ decision: "block", reason: `Read these handoff files before recapping: ${recap.missed.join(", ")}` }));
+    return;
+  }
+  // A retry may satisfy the recap evidence, but must never loop the inbox block (#11223).
+  if (input.stop_hook_active) return allow();
 
   const projectDir = input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
 
@@ -151,41 +157,6 @@ async function main() {
       process.stderr.write("[trantor] turn boundary reached — firing the armed baton\n");
     }
   } catch {}
-  // §5 RECAPPED (SYSTEM-CONTRACT): this session's FIRST turn boundary after claiming a handoff.
-  // By Stop time an assistant reply exists, and every prompt of that first turn carried the
-  // recap reminder (prompt-focus) — so the reply had the instruction in front of it. Record the
-  // transition on the handoff's own ledger and disarm the net.
-  try {
-    const sid = String(input.session_id || "");
-    if (sid) {
-      const stampPath = join(handoffDir(), `recap-pending-${sid.replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
-      if (existsSync(stampPath)) {
-        try {
-          const stamp = JSON.parse(readFileSync(stampPath, "utf8"));
-          // #8162: RECAPPED used to mean "a reply exists by Stop time", which a successor satisfies
-          // from the injected summary alone — so a handoff naming read-first files certified a
-          // takeover that opened none of them, three days running. Now the ledger asks the same
-          // question the state gate learned to ask: ground truth, not testimony. A Read/Grep tool
-          // call naming the path is evidence; the successor's own say-so is not.
-          const want = Array.isArray(stamp.readFirst) ? stamp.readFirst : [];
-          const { missed } = want.length
-            ? pathsReadIn(input.transcript_path || "", want)
-            : { missed: [] };
-          if (missed.length) {
-            // The stamp STAYS. Not recapped, so the next boundary asks again — and the successor is
-            // told exactly what it skipped rather than left to discover it when the operator does.
-            process.stderr.write(
-              `[trantor] handoff ${stamp.handoffId}: NOT recapped — the handoff named ${want.length} file(s) to read first and ${missed.length} ${missed.length === 1 ? "was" : "were"} never opened: ${missed.join(", ")}. Read them before going further; this is the context the handoff exists to carry.\n`);
-          } else {
-            appendHandoffState(stamp.handoffId, "recapped", sid);
-            try { unlinkSync(stampPath); } catch {}
-          }
-        } catch {
-          try { unlinkSync(stampPath); } catch {}
-        }
-      }
-    }
-  } catch {}
   // Mirror the other hooks: a home-directory session isn't project work and isn't on the bus.
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return allow();
 

package/lib/turn-policy.mjs

@@ -287,3 +287,15 @@ export function cutChainEvidence(rows) {
 export function isBoundedPark(reason) {
   return !PARKING_REASONS.has(reason);
 }
+
+// #11230: only an ask posted in this turn is delivery; an older unanswered ask cannot excuse it.
+export function askDuringTurn(rows, startedAt) {
+  const asks = rows.filter(row => Number(row.ts) >= startedAt
+    && (row.kind === "ask" || /^❓\s/.test(String(row.text || ""))));
+  return asks.sort((a, b) => Number(b.id) - Number(a.id))[0] || null;
+}
+
+export function askedVerdict(ask) {
+  const firstLine = String(ask.text || "").trim().split(/\r?\n/)[0];
+  return `asked: ${firstLine.replace(/^❓\s*(?:ask(?:s)?(?: on #[0-9]+)?\s*:\s*)?/, "")}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.79",
+  "version": "0.18.80",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"