[BUG] Team-mode teammate crashes with "<Box> can't be nested inside <Text>" when inbox contains permission_request / permission_response JSON

[BUG] Team-mode teammate crashes with <Box> can't be nested inside <Text> when inbox contains permission_request / permission_response JSON

Environment

• Claude Code version: 2.1.117 (latest published on npm as of 2026-04-22)
• Platform: macOS Darwin 25.3.0 (iTerm2, tmux)
• Node: v24.14.0 (nvm)
• Shell: zsh

Summary

A persistent team-mode teammate spawned via Agent(team_name=..., subagent_type=...) deterministically crashes with an Ink reconciler error when its inbox receives permission_request or permission_response messages from the team-lead. The crash happens inside createInstance at /$bunfs/root/src/entrypoints/cli.js:495:249 and indicates that a <Box> Ink component is being rendered inside a <Text> component — which Ink's runtime invariant forbids.

Stack trace

ERROR <Box> can't be nested inside <Text> component

 - createInstance (/$bunfs/root/src/entrypoints/cli.js:495:249)
 - BU (/$bunfs/root/src/entrypoints/cli.js:477:57938)
 - gTH (/$bunfs/root/src/entrypoints/cli.js:477:87786)
 - XWH (/$bunfs/root/src/entrypoints/cli.js:477:86997)
 - bgH (/$bunfs/root/src/entrypoints/cli.js:477:85896)
 - Ir (/$bunfs/root/src/entrypoints/cli.js:477:85717)
 - MWH (/$bunfs/root/src/entrypoints/cli.js:477:82456)
 - T_ (/$bunfs/root/src/entrypoints/cli.js:477:6497)
 - hH (/$bunfs/root/src/entrypoints/cli.js:477:4980)
 - eH (/$bunfs/root/src/entrypoints/cli.js:477:5281)

The nearby source references ink-text and ink-box createElement call sites inside memoized render functions dT (text) and qt4 (box), confirming this is the Ink renderer path.

Minimal reproduce

Observed three times in under six hours, twice in a deliberately controlled A/B reproduce.

Case 1 — baseline, no permission flow → PASS (no crash)

TeamCreate team_name=repro-c1
Agent(
  team_name="repro-c1",
  name="idle",
  subagent_type="general-purpose",
  prompt="SendMessage to team-lead with the plain text ok and then stop. Do not call any other tool."
)

Agent sends one plain-text SendMessage, goes idle, accepts shutdown_request. Clean exit.

Case 2 — one tool call triggering permission flow → CRASH

TeamCreate team_name=repro-c2
Agent(
  team_name="repro-c2",
  name="reader",
  subagent_type="general-purpose",
  prompt="Read the file /etc/hostname using the Read tool. Then SendMessage to team-lead with the hostname content as plain text. Then end your turn. Do not call any other tool."
)

The teammate's first Read emits a permission_request into the team-lead inbox; the orchestrator replies with permission_response in the teammate inbox. Both messages carry the structured payload as a serialised JSON string inside the text field of the inbox record, including nested quotes, braces, description / permission_suggestions substrings.

Shortly after (~1 minute), the teammate pane crashes with the stack above. The tmux pane's claude.exe process exits and the pane returns to zsh.

Evidence artifacts

Both teammate inboxes at crash time were preserved. Representative excerpt from ~/.claude/teams/repro-c2/inboxes/reader.json:

{
  "from": "reader",
  "text": "{\"type\":\"permission_request\",\"request_id\":\"perm-1776880202149-ge2fqht\",\"agent_id\":\"reader\",\"tool_name\":\"Read\",\"tool_use_id\":\"toolu_01EzK4pAa8hngyFhpSzYjbWi\",\"description\":\"Read a file from the local filesystem.\",\"input\":{\"file_path\":\"/etc/hostname\"},\"permission_suggestions\":[...]}",
  "timestamp": "2026-04-22T17:50:02.150Z",
  "color": "blue",
  "read": true
}

Note the embedded JSON is stored as a string inside text, not as a structured field. The TUI renderer appears to then parse / markdown-format this string and emits an ink-box descendant of an ink-text along the way.

Impact

• Blocks the full "persistent team with tool-using implementer + one-shot reviewer" workflow (our wf-001 topology).
• One-shot Agent() calls are unaffected in our testing; we suspect the permission flow for one-shots renders through the parent session rather than a teammate pane, but have not confirmed the exact render path. Team-lead coordination-only teams are unaffected (no tool invocations → no permission_request inbox traffic).
• Orchestrator session (team-lead) is not affected — only the teammate pane crashes.

Workaround adopted

We route all tool-using implementers through sequential one-shot Agent() calls instead of persistent team members. This loses multi-turn continuity but is stable. Documented internally as wf-005.

Suggested fix direction

Either:

1. Treat message text strings starting with {"type":"permission_... as opaque and render via a path that never emits <Box> inside <Text>, or
2. Fix the markdown/code-span renderer invariant (whichever path in the TUI is emitting ink-box under ink-text) so it cannot produce the invalid nesting regardless of input content.

Happy to share the full preserved inbox JSONs and pane buffers if useful.