trantor 0.17.23 → 0.17.25

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + context-handoff for independent AI coding agents (Claude, Codex, Gemini, …)",
-    "version": "0.17.23"
+    "version": "0.17.25"
   },
   "plugins": [
     {
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, Gemini, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.23",
+      "version": "0.17.25",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.23",
+  "version": "0.17.25",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -42,6 +42,41 @@ claude plugin install trantor
 That's it. (Prefer source? `git clone https://github.com/sashabogi/trantor && cd trantor &&
 npm install && bash deploy/setup.sh` — identical result.)
 
+## What gets installed — footprint & safety
+
+Trantor is a **local-first multi-agent orchestrator with a built-in cost router** — not a cloud
+service, and not an agent that runs off on its own. Here is *exactly* what the two steps above put
+on your machine, so you (or an agent installing it for you) can see the whole footprint up front:
+
+**`npm install -g trantor` + `trantor setup`**
+- The `trantor` CLI — one global npm package.
+- `~/.agent-bus/` — a single local directory holding **all** state: `config.json`, the board data
+  (`bus.json`), and `.env` for any **provider API keys you choose to add** (e.g. `DEEPSEEK_API_KEY`).
+  Nothing in here ever leaves your machine.
+- A local **hub** at `http://127.0.0.1:4477` — **loopback only**, not reachable from the network. On
+  macOS it's a launchd agent (`com.trantor.hub`) so it restarts at login; on Linux you run it yourself.
+- The economics engine (Scrooge) into `~/.local/bin` — the cost ledger and cheap-model router.
+
+**`claude plugin install trantor`** adds, inside Claude Code only:
+- An MCP server (`relay`) exposing the `relay_*` tools, plus the `/trantor:*` skills.
+- Hooks on four events — local Node scripts that only POST to the loopback hub: **SessionStart**
+  (register the session + show the live roster), **PostToolUse** (presence heartbeat + mirror your
+  TodoWrite list onto the board), **PreCompact** (write a handoff before the context window compacts),
+  **SubagentStop** (record each sub-agent's notional cost on the board).
+
+**What it does *not* do:** no cloud, no accounts, no telemetry, nothing phones home; it never uploads
+your code or keys; it doesn't touch other CLIs' credentials — Codex, Gemini, Kimi and DeepSeek are
+ones *you* already installed and signed into, and Trantor just coordinates them locally. The optional
+API keys in `~/.agent-bus/.env` are used only to call the cheap models *you* opted into for routing.
+
+**Remove everything, anytime:**
+```bash
+claude plugin uninstall trantor                  # drop the MCP tools, skills, and hooks
+launchctl bootout gui/$(id -u)/com.trantor.hub   # stop the hub service (macOS)
+rm -f ~/Library/LaunchAgents/com.trantor.hub.plist
+rm -rf ~/.agent-bus                              # delete all local state + keys
+```
+
 ## What to expect on first run
 
 `trantor setup` ends with the **doctor** — an honest map of where you stand:

package/bin/advise.mjs

@@ -14,6 +14,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
 
 const H = homedir();
 const read = (p, fb) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return fb; } };
@@ -134,7 +135,9 @@ export function advise(input, world = loadWorld()) {
 }
 
 // ---- CLI ----
-if (import.meta.url === `file://${process.argv[1]}`) {
+// is-main guard via PROPERLY ENCODED file URL — a hand-built `file://${argv[1]}` silently no-ops when the
+// install path contains a URL-reserved char (e.g. a SPACE in ".../Application Support/..."). See profile.mjs.
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
   let input;
   if (process.argv.includes("--demo")) {
     input = { task: "neon asteroids game", packages: [

package/bin/profile.mjs

@@ -12,9 +12,10 @@
 //                  for real builds; the plan's quota is a scarce budget)
 //   max | max-5x | max-20x | ultra — high-tier subscription (cost moot; context horizon decides)
 //   none         — provider not available on this machine
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
 import { homedir } from "node:os";
+import { pathToFileURL } from "node:url";
 
 const FILE = join(homedir(), ".agent-bus", "profile.json");
 const KNOWN = ["claude", "codex", "gemini", "kimi", "deepseek", "opencode"];
@@ -32,7 +33,11 @@ export function loadProfile() {
 export function tierOf(profile, provider) { return TIER(profile?.providers?.[provider]?.plan); }
 
 const [, , cmd, ...args] = process.argv;
-if (import.meta.url === `file://${process.argv[1]}`) {
+// is-main guard: compare against a PROPERLY ENCODED file URL. A hand-built `file://${argv[1]}` is raw
+// text, but import.meta.url is percent-encoded — so any URL-reserved char in the install path (most
+// commonly a SPACE, e.g. ".../Application Support/...") made this false and silently skipped main (exit 0,
+// no write). pathToFileURL is the canonical Node idiom. See regression in test-handoff.mjs / test.mjs.
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
   const prof = loadProfile();
   prof.providers ||= {};
   if (cmd === "set") {
@@ -42,6 +47,7 @@ if (import.meta.url === `file://${process.argv[1]}`) {
       prof.providers[prov.toLowerCase()] = { plan: plan.toLowerCase(), tier: TIER(plan) };
     }
     prof.updated = new Date().toISOString().slice(0, 10);
+    mkdirSync(dirname(FILE), { recursive: true });   // `set` creates its own ~/.agent-bus if absent
     writeFileSync(FILE, JSON.stringify(prof, null, 2) + "\n");
     console.log("profile saved →", FILE);
   } else if (cmd && cmd !== "show") {

package/hooks/lib/handoff.mjs

@@ -16,7 +16,7 @@ import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
-export const HANDOFF_DIR = join(homedir(), ".agent-bus", "handoffs");
+export const HANDOFF_DIR = join(process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus"), "handoffs");
 const HERE = dirname(fileURLToPath(import.meta.url));
 
 export function readConfig() {
@@ -229,7 +229,12 @@ export function terminalWindowForTty(tty) {
     end repeat
     return ""
   end tell`;
-  try { return execSync(`osascript -e ${JSON.stringify(osa)}`, { encoding: "utf8", timeout: 3000 }).trim(); } catch { return ""; }
+  // Pass the MULTI-LINE script via stdin, NOT `-e ${JSON.stringify(osa)}`: a single -e arg keeps the
+  // newlines as literal "\n" (JSON escapes them, the shell's double-quotes don't expand them), so
+  // osascript saw `…"Terminal"\n  repeat…` and died with "27:28: Expected end of line but found unknown
+  // token". stdin gives it real newlines. (This silently returned "" for years → callers always fell
+  // through to frontTerminalWindow, which after a spawn grabs the WRONG window.)
+  try { return execSync(`osascript`, { input: osa, encoding: "utf8", timeout: 3000 }).trim(); } catch { return ""; }
 }
 
 // Arm the baton-close watcher: a DETACHED process that waits until the fresh session consumes the
@@ -301,14 +306,28 @@ export function frontTerminalWindow() {
   } catch { return { id: "", tty: "" }; }
 }
 
-// MANUAL one-command baton: spawn the fresh session (no dialog) + arm the close of THIS window once the
-// fresh one consumes the handoff. Window detection: controlling tty first (if invoked with one), else
-// Terminal's front window. Returns { spawned, armed }.
-export function spawnBaton({ projectDir, handoffFile, conf = readConfig() }) {
-  const spawned = spawnFresh(projectDir);
-  if (!spawned) return { spawned: false, armed: false };
+// Resolve the ORIGINAL window (id + tty) to close on takeover. Controlling tty first (if we were
+// invoked with one — heartbeat/precompact have it), else the CURRENT front window (a manual baton
+// runs through the headless Bash tool with no tty; the session you're looking at is frontmost).
+// MUST be called BEFORE spawning the fresh session — once the new window opens it becomes frontmost
+// and this would capture IT instead.
+export function resolveOriginalWindow() {
   let tty = controllingTty(), windowId = tty ? terminalWindowForTty(tty) : "";
   if (!windowId) { const f = frontTerminalWindow(); windowId = f.id; tty = f.tty; }
-  const armed = windowId ? armBatonClose(handoffFile, windowId, tty, conf) : false;
+  return { windowId, tty };
+}
+
+// MANUAL one-command baton: spawn the fresh session (no dialog) + arm the close of THIS window once the
+// fresh one consumes the handoff. Returns { spawned, armed, windowId }.
+// ORDER IS LOAD-BEARING: resolve the original window BEFORE spawning. Reversing it is the
+// "successor closes ITSELF" bug — the just-opened window is frontmost, the front-window fallback
+// captures it, and baton-close then kills the FRESH session the moment it takes over. The seams
+// (_resolveWindow/_spawnFresh/_armClose) exist so the ordering can be regression-tested headlessly.
+export function spawnBaton({ projectDir, handoffFile, conf = readConfig(),
+  _resolveWindow = resolveOriginalWindow, _spawnFresh = spawnFresh, _armClose = armBatonClose }) {
+  const { windowId, tty } = _resolveWindow();   // original window FIRST, while it's still frontmost
+  const spawned = _spawnFresh(projectDir);
+  if (!spawned) return { spawned: false, armed: false, windowId: "" };
+  const armed = windowId ? _armClose(handoffFile, windowId, tty, conf) : false;
   return { spawned, armed, windowId };
 }

package/hooks/sessionstart.mjs

@@ -21,7 +21,17 @@ function loadPendingHandoff(projectName, { claim = true } = {}) {
   try {
     const dir = join(homedir(), ".agent-bus", "handoffs");
     if (!existsSync(dir)) return null;
-    const files = readdirSync(dir).filter(f => f.startsWith(projectName + "-") && f.endsWith(".json")).sort().reverse();
+    // Match ONLY this project's handoffs: "<projectName>-<numeric stamp>.json".
+    // NOT a loose startsWith() — that also caught leaked test fixtures like
+    // "trantor-handoff-61385-….json" for project "trantor". And sort by the numeric
+    // stamp (newest first), NOT lexicographically — string sort ranks a letter prefix
+    // ("…-handoff-…") above a digit one, so it could pick a stale/wrong handoff.
+    const re = new RegExp("^" + projectName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "-(\\d+)\\.json$");
+    const files = readdirSync(dir)
+      .map(f => { const m = re.exec(f); return m ? { f, stamp: Number(m[1]) } : null; })
+      .filter(Boolean)
+      .sort((a, b) => b.stamp - a.stamp)
+      .map(x => x.f);
     for (const f of files) {
       const p = join(dir, f);
       const rec = JSON.parse(readFileSync(p, "utf8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.23",
+  "version": "0.17.25",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"