trantor 0.17.52 → 0.17.55

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + context-handoff for independent AI coding agents (Claude, Codex, Gemini, …)",
-    "version": "0.17.52"
+    "version": "0.17.54"
   },
   "plugins": [
     {
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.52",
+      "version": "0.17.55",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.52",
+  "version": "0.17.55",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -39,6 +39,35 @@ claude plugin marketplace add sashabogi/trantor
 claude plugin install trantor
 ```
 
+**Kimi Code CLI as orchestrator** (same capabilities — the `relay_*` MCP tools, the crew/handoff/
+research skills, and the full hook set: session registration, focus cards, todo mirroring,
+heartbeats, inbox delivery, handoff/baton pass, sub-agent cards):
+
+1. Register the relay MCP server in `~/.kimi-code/mcp.json`:
+
+   ```json
+   {
+     "mcpServers": {
+       "relay": {
+         "command": "node",
+         "args": ["<absolute-path-to-trantor>/mcp.mjs"],
+         "env": { "RELAY_URL": "http://127.0.0.1:4477", "RELAY_AGENT": "kimi" },
+         "startupTimeoutMs": 15000,
+         "toolTimeoutMs": 150000
+       }
+     }
+   }
+   ```
+
+2. In the Kimi TUI: `/plugins install <absolute-path-to-trantor>` (or the GitHub URL), then
+   `/reload`, then start a new session.
+
+Notes: Kimi plugin installs are **snapshots** (`~/.kimi-code/plugins/managed/trantor/`) — after
+updating trantor, re-run `/plugins install` to refresh the skills/hooks. The MCP entry above always
+runs your live checkout, so the relay server itself never goes stale. Invoke the skills with
+`/skill:crew`, `/skill:handoff`, `/skill:research`. Set `TRANTOR_DEBUG_HOOKS=1` on the `kimi`
+process to dump raw hook payloads to `~/.agent-bus/kimi-hook-debug.jsonl`.
+
 That's it. (Prefer source? `git clone https://github.com/sashabogi/trantor && cd trantor &&
 npm install && bash deploy/setup.sh` — identical result.)
 

package/bin/adopt.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+// trantor adopt — graduate a project from the machine-local hub to a remote hub, in ONE command.
+//
+//   trantor adopt <project> [--hub <url>] [--dry] [--force]
+//
+// The crm-platform lesson: a new project is born unpinned, lives on the local hub (by design —
+// TDD §12.1's fallback), and moving it to the shared hub was three separate ceremonies (enroll
+// identities, migrate data, write the pin) spread across two machines. This collapses them:
+//
+//   1. read the project's rows off the LOCAL hub state (tasks/events/messages)
+//   2. enroll this machine's identities for the project on the target hub (owner-signed invites):
+//      the orchestrator (<host>:<project>) as owner, every existing seat key as write
+//   3. POST /import (owner-signed) — the hub merges, remapping colliding card ids itself
+//   4. verify the count round-trip, THEN write the routing pin
+//
+// No ssh, no direct Postgres access: the hub's /import endpoint is the migration surface.
+// Live sessions keep their old routing until restarted — adopt SAYS so rather than pretending.
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { hostId } from "../lib/project.mjs";
+import { loadOrCreate, signRequest } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+
+const argv = process.argv.slice(2);
+const PROJECT = argv.find(a => !a.startsWith("--")) || "";
+const arg = (k) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? (argv[i + 1] ?? "") : ""; };
+const has = (k) => argv.includes(`--${k}`);
+if (!PROJECT) { console.error("usage: trantor adopt <project> [--hub <url>] [--dry] [--force]"); process.exit(1); }
+
+const BUS_DIR = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+const CONFIG_PATH = join(BUS_DIR, "config.json");
+let config = {}; try { config = JSON.parse(readFileSync(CONFIG_PATH, "utf8")); } catch {}
+const LOCAL = config.url || "http://127.0.0.1:4477";
+
+// target: --hub wins; else the hub most of the fleet already lives on
+const pinCounts = {};
+for (const u of Object.values(config.hubs || {})) if (!/127\.0\.0\.1|localhost/.test(u)) pinCounts[u] = (pinCounts[u] || 0) + 1;
+const TARGET = arg("hub") || Object.entries(pinCounts).sort((a, b) => b[1] - a[1])[0]?.[0] || "";
+if (!TARGET) { console.error("no remote hub known — pass --hub <url> (no non-local pins exist to infer one from)"); process.exit(1); }
+if ((config.hubs || {})[PROJECT] === TARGET) { console.log(`${PROJECT} is already pinned to ${TARGET} — nothing to do.`); process.exit(0); }
+
+// 1. the project's rows, straight from the local hub's state file (full fidelity, no pagination)
+const statePath = process.env.RELAY_STATE || join(BUS_DIR, "bus.json");
+let local = {}; try { local = JSON.parse(readFileSync(statePath, "utf8")); } catch {}
+const tasks = (local.tasks || []).filter(t => t.project === PROJECT);
+const events = (local.events || []).filter(e => e.project === PROJECT);
+const messages = (local.messages || []).filter(m => (m.project || "") === PROJECT);
+const livePeers = Object.entries(local.peers || {}).filter(([, p]) => p.project === PROJECT && Date.now() - (p.lastSeen || 0) < 5 * 60 * 1000);
+
+const owner = String(config.ownerIdentity || "");
+if (!owner) { console.error("config.ownerIdentity is not set — enrolments need an owner to sign invites"); process.exit(1); }
+
+// identities: the orchestrator as owner + every seat key that already exists for this project
+const safe = (s) => s.replace(/[^A-Za-z0-9_.-]/g, "_");
+const keyFiles = (() => { try { return readdirSync(join(BUS_DIR, "keys")); } catch { return []; } })();
+const orchestrator = `${hostId()}:${PROJECT}`;
+const seats = keyFiles
+  .filter(f => f.endsWith(`_${safe(PROJECT)}.json`))
+  .map(f => f.replace(/\.json$/, "").replace(`_${safe(PROJECT)}`, `:${PROJECT}`))
+  .filter(n => n !== safe(orchestrator).replace(`_${safe(PROJECT)}`, `:${PROJECT}`) && n !== orchestrator);
+
+console.log(`adopt    : ${PROJECT}`);
+console.log(`from     : ${LOCAL} (${tasks.length} cards · ${events.length} events · ${messages.length} messages)`);
+console.log(`to       : ${TARGET}`);
+console.log(`enroll   : ${orchestrator} (owner)${seats.length ? ` + ${seats.join(", ")} (write)` : ""}`);
+if (livePeers.length) console.log(`⚠ LIVE   : ${livePeers.map(([s]) => s).join(", ")} — they keep the OLD routing until restarted`);
+if (has("dry")) { console.log("\n[dry run] nothing changed."); process.exit(0); }
+
+const ownerId = loadOrCreate(owner, "human");
+async function enroll(name, role) {
+  const invBody = JSON.stringify({ scopes: [{ project: PROJECT, role }], ttlSec: 600 });
+  const invSig = signRequest(ownerId, { method: "POST", path: "/invite", body: invBody });
+  const inv = await (await fetch(`${TARGET}/invite`, { method: "POST", headers: { "content-type": "application/json", ...invSig }, body: invBody, signal: AbortSignal.timeout(8000) })).json();
+  if (!inv.token) throw new Error(`invite for ${name}: ${inv.error || "no token"}`);
+  const id = loadOrCreate(name, "agent");
+  const body = JSON.stringify({ token: inv.token, name, pubkey: id.pubkey, kind: "agent" });
+  const sig = signRequest(id, { method: "POST", path: "/enroll", body });
+  const r = await (await fetch(`${TARGET}/enroll`, { method: "POST", headers: { "content-type": "application/json", ...sig }, body, signal: AbortSignal.timeout(8000) })).json();
+  if (!r.ok) throw new Error(`enroll ${name}: ${r.error || "failed"}`);
+  console.log(`  ✓ enrolled ${name} (${role})`);
+}
+
+try {
+  await enroll(orchestrator, "owner");
+  for (const s of seats) await enroll(s, "write");
+
+  const imp = await sfetchJson(`${TARGET}/import`, {
+    identity: ownerId,
+    payload: { project: PROJECT, tasks, events, messages, by: owner, force: has("force") },
+    signal: AbortSignal.timeout(60000),
+  });
+  const impJson = await imp.json();
+  if (!impJson.ok) throw new Error(`import: ${impJson.error || imp.status}${impJson.existing ? ` (${impJson.existing} cards already there — --force to merge anyway)` : ""}`);
+  console.log(`imported : ${impJson.tasks} cards · ${impJson.events} events · ${impJson.messages} messages${impJson.remapped ? ` · ${impJson.remapped} card id(s) remapped` : ""}`);
+
+  // verify BEFORE pinning — a pin pointing at a hub that doesn't have the data is a data outage
+  const check = await (await sfetchJson(`${TARGET}/tasks?project=${encodeURIComponent(PROJECT)}`, { method: "GET", identity: ownerId })).json();
+  const remoteCount = (check.tasks || []).length;
+  if (remoteCount < tasks.length) throw new Error(`verify: target has ${remoteCount} cards, local has ${tasks.length} — NOT pinning`);
+  console.log(`verified : ${remoteCount} cards on target`);
+
+  config.hubs = config.hubs || {};
+  config.hubs[PROJECT] = TARGET;
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
+  console.log(`pinned   : ${PROJECT} → ${TARGET}`);
+  if (livePeers.length) {
+    console.log(`\n⚠ live sessions still route to the OLD hub until restarted:`);
+    for (const [s] of livePeers) console.log(`    ${s}`);
+    console.log(`  crew seats: trantor down && trantor up · Claude sessions: restart them when convenient.`);
+  }
+  console.log(`\n✓ adopted. New sessions on ${PROJECT} land on ${TARGET}.`);
+} catch (e) {
+  console.error(`\n✗ adopt failed: ${e.message}`);
+  console.error("nothing was pinned — routing is unchanged.");
+  process.exit(1);
+}

package/bin/cli.mjs

@@ -25,7 +25,36 @@ switch (cmd) {
   case "up":      process.argv.splice(2, 1); spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "up", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "down":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "down", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "swap":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "swap", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
-  case "hub":     run("hub.mjs"); break;
+  case "hub": {
+    const sub = args[0];
+    // Per-project hub routing (TDD §12.1): a project lives on exactly ONE hub; codependent
+    // projects MUST share one. The mapping lives in ~/.agent-bus/config.json `hubs`.
+    if (sub === "list" || sub === "set" || sub === "unset") {
+      const { readConfig, setProjectHub, unsetProjectHub, resolveProject, resolveHub, DEFAULT_HUB_URL } = await import(join(ROOT, "lib/project.mjs"));
+      if (sub === "list") {
+        const cfg = readConfig();
+        const here = resolveProject();
+        console.log(`global default: ${cfg.url || DEFAULT_HUB_URL}${cfg.url ? "" : " (built-in)"}`);
+        const hubs = cfg.hubs && typeof cfg.hubs === "object" ? Object.entries(cfg.hubs) : [];
+        if (!hubs.length) console.log("no per-project pins — every project uses the global default");
+        for (const [p, u] of hubs) console.log(`${p === here ? "*" : " "} ${p} → ${u}`);
+        console.log(`effective hub for this project (${here}): ${resolveHub(here)}`);
+      } else if (sub === "set") {
+        const [, project, url] = args;
+        if (!project || !url) { console.error("usage: trantor hub set <project> <url>"); process.exit(1); }
+        try { setProjectHub(project, url); }
+        catch (e) { console.error(`error: ${e.message}`); process.exit(1); }
+        console.log(`${project} → ${String(url).replace(/\/+$/, "")} (pinned in ~/.agent-bus/config.json)`);
+      } else {
+        const project = args[1];
+        if (!project) { console.error("usage: trantor hub unset <project>"); process.exit(1); }
+        const had = unsetProjectHub(project);
+        console.log(had ? `${project} unpinned — falls back to the global default` : `${project} had no per-project pin`);
+      }
+      break;
+    }
+    run("hub.mjs"); break;
+  }
   case "watch":   run("bin/relay-watch.mjs"); break;
   case "catchup": run("bin/catchup.mjs"); break;
   case "agents":  run("bin/agents.mjs"); break;
@@ -37,6 +66,69 @@ switch (cmd) {
   case "balances": case "balance": case "credits": run("bin/balances.mjs"); break;
   case "recost": run("bin/recost.mjs"); break;
   case "handoff": run("bin/baton.mjs"); break;
+  case "adopt": run("bin/adopt.mjs"); break;
+  case "summarize": run("bin/summarize.mjs"); break;
+  case "identity": {
+    const { load, publicView, generate, keyPath } = await import(join(ROOT, "lib/identity.mjs"));
+    const sub = args[0], name = args[1] || "human";
+    if (sub === "show") {
+      const id = load(name);
+      if (!id) { console.error(`No identity found for "${name}".`); process.exit(1); }
+      console.log(JSON.stringify(publicView(id), null, 2));
+    } else if (sub === "rotate") {
+      const { writeFileSync, chmodSync, renameSync, mkdirSync } = await import("node:fs");
+      const { randomBytes } = await import("node:crypto");
+      const { pubkey, privkey } = generate();
+      const nId = { name: String(name), kind: "human", pubkey, privkey, createdAt: Date.now() };
+      const f = keyPath(name);
+      mkdirSync(join(f, ".."), { recursive: true, mode: 0o700 });
+      try { chmodSync(join(f, ".."), 0o700); } catch {}
+      const tmp = `${f}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+      writeFileSync(tmp, JSON.stringify(nId), { mode: 0o600 });
+      renameSync(tmp, f);
+      chmodSync(f, 0o600);
+      console.log(JSON.stringify({ name: String(name), pubkey, rotated: true }, null, 2));
+    } else {
+      console.error("usage: trantor identity <show|rotate> [name]");
+      process.exit(1);
+    }
+    break;
+  }
+  case "invite": {
+    const { loadOrCreate, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+    const nameIdx = args.indexOf("--name"), scopeIdx = args.indexOf("--scope");
+    const name = nameIdx >= 0 ? args[nameIdx + 1] : "";
+    const scopeRaw = scopeIdx >= 0 ? (args[scopeIdx + 1] || "") : "";
+    if (!name || !scopeRaw) { console.error("usage: trantor invite --name <name> --scope <project>:<role>"); process.exit(1); }
+    const [project, role = "write"] = scopeRaw.split(":");
+    let hub = "http://127.0.0.1:4477";
+    try { hub = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || hub; } catch {}
+    const id = loadOrCreate("admin", "human");
+    const payload = { scopes: [{ project, role }], ttlSec: 86400 };
+    const body = JSON.stringify(payload);
+    const sig = signRequest(id, { method: "POST", path: "/invite", body });
+    const r = await fetch(`${hub}/invite`, { method: "POST", headers: { "content-type": "application/json", ...sig }, body });
+    const j = await r.json();
+    if (r.ok) console.log(`Invite token: ${j.token}\nShare this with the new member: trantor enroll ${j.token}`);
+    else console.error(`Invite failed: ${j.error || r.statusText}`);
+    break;
+  }
+  case "enroll": {
+    const token = args[0];
+    if (!token) { console.error("usage: trantor enroll <token>"); process.exit(1); }
+    let hub = "http://127.0.0.1:4477";
+    try { hub = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || hub; } catch {}
+    const { loadOrCreate, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+    const id = loadOrCreate("human", "human");
+    const payload = { token, name: "human", pubkey: id.pubkey, kind: "human" };
+    const body = JSON.stringify(payload);
+    const sig = signRequest(id, { method: "POST", path: "/enroll", body });
+    const r = await fetch(`${hub}/enroll`, { method: "POST", headers: { "content-type": "application/json", ...sig }, body });
+    const j = await r.json();
+    if (r.ok) console.log(`Enrolled! Pubkey: ${id.pubkey.slice(0, 16)}…`);
+    else console.error(`Enrollment failed: ${j.error || r.statusText}`);
+    break;
+  }
   case "ui": {
     let url = "http://127.0.0.1:4477";
     try { url = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || url; } catch {}
@@ -68,6 +160,7 @@ switch (cmd) {
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)
   trantor advise      ask the Advisor directly (JSON on stdin; --demo to see it)
   trantor hub         run the hub in the foreground (setup installs it as a service instead)
+                      …or manage per-project hub pins: hub list · hub set <project> <url> · hub unset <project>
   trantor watch       live bus feed in the terminal
 
 Claude Code plugin (the orchestrator side):

package/bin/crew-runner.mjs

@@ -12,7 +12,10 @@ import { execSync, spawnSync } from "node:child_process";
 import { readFileSync, existsSync, appendFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject } from "../lib/project.mjs";
+import { resolveProject, resolveHub } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { signedHeaders } from "../lib/signed-fetch.mjs";
+import { ensureEnrolled } from "../lib/enroll.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -22,14 +25,27 @@ const DIR = process.argv[3] || process.cwd();
 // fork the host's "builtbetter.ai" into a separate "builtbetter" lane.
 const PROJ = process.env.RELAY_PROJECT || resolveProject(DIR);
 const SESSION = `${AGENT}:${PROJ}`;
+// One keypair per seat, so `deepseek:crebral` and `deepseek:trantor` are genuinely different
+// identities on the bus rather than one shared string label.
+const identity = loadOrCreate(SESSION, "agent");
 if (!AGENT) { console.error("usage: crew-runner.mjs <agent> [project-dir]"); process.exit(1); }
 
+// Per-project routing (TDD §12.1): a seat MUST reach the same hub as the project it serves. Reading
+// only the global default sent seats on a migrated project to the local hub while their orchestrator
+// talked to the remote one — the crew would look alive and record onto a different board entirely.
 function hubUrl() {
   if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const u = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).url; if (u) return u; } catch {}
+  try { return resolveHub(PROJ); } catch {}
   return "http://127.0.0.1:4477";
 }
 const HUB = hubUrl();
+// On an authenticated hub a freshly-created seat keypair is an UNKNOWN identity, so every call 401s
+// and the seat goes silently quiet (we fail open by design). Self-enrol first, using the operator's
+// owner key to mint a short-lived project-scoped invite the seat immediately spends.
+const enrolment = await ensureEnrolled(HUB, identity, PROJ);
+if (!enrolment.ok && enrolment.reason !== "hub-unreachable") {
+  console.log(`\x1b[33m[runner]\x1b[0m not enrolled on ${HUB} (${enrolment.reason}) — cards may not record`);
+}
 process.on("uncaughtException", (e) => { console.log(`\x1b[31m[runner] UNCAUGHT: ${e?.stack || e}\x1b[0m`); });
 process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLED REJECTION: ${e?.stack || e}\x1b[0m`); });
 const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${s}`);
@@ -46,7 +62,11 @@ async function api(path, body) {
   const opts = body
     ? { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body: JSON.stringify(body) }
     : { headers: { connection: "close" } };   // fresh socket per call — long-polls on stale keep-alive sockets reset
-  const r = await fetch(HUB + path, opts);
+  // Sign as THIS seat. Unsigned calls are 401 on an enforce hub, and because the runner fails open
+  // that shows up as a seat that quietly records nothing rather than one that errors.
+  const url = HUB + path;
+  const sig = signedHeaders(identity, url, opts);
+  const r = await fetch(url, { ...opts, headers: { ...opts.headers, ...sig } });
   return r.json();
 }
 
@@ -59,7 +79,12 @@ const CMUX_BIN = process.env.CMUX_BIN
 const inCmux = () => !!process.env.CMUX_SURFACE_ID;
 function cmuxStatus(value, color, icon = "robot") {
   if (!inCmux()) return;
-  try { spawnSync(CMUX_BIN, ["set-status", "trantor", value, "--color", color, "--icon", icon], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
+  // Label with the REAL seat identity, not a literal. This was hardcoded to "trantor", so every seat
+  // in every project reported under one name — four different agents (and their duplicates) rendered
+  // identically in the sidebar, which is why a runner leak looked like mystery sessions instead of
+  // obvious duplicates. Note this is the DISPLAY path; two previous fixes to the crossed-label
+  // symptom both landed on the *bus* identity and never touched this line.
+  try { spawnSync(CMUX_BIN, ["set-status", SESSION, value, "--color", color, "--icon", icon], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
 }
 function cmuxLog(message, level = "info") {
   if (!inCmux()) return;
@@ -129,7 +154,7 @@ async function reportFailure(exit, trigger) {
   const reason = classifyFailure(exit, lastErrText);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
-  await api("/register", { session: SESSION, project: PROJ, status }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "auth" ? " — check credentials"
     : reason === "missing-cli" ? " — CLI not on PATH" : "";
@@ -144,7 +169,7 @@ async function reportFailure(exit, trigger) {
 async function reportHealthy() {
   if (consecFails === 0) return;        // already healthy — don't spam
   consecFails = 0;
-  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}` }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check");
 }
@@ -184,7 +209,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
 
 // ---- main loop ----
 const KICKOFF = process.env.CREW_KICKOFF ||
-  `You just joined. 1) relay_send to "all": "${AGENT} reporting — ready for a contract". 2) relay_inbox — if a contract for you is already waiting, do it now per the Rules. 3) End your turn.\n\n${RULES}`;
+  `You just joined (your arrival was already announced on the bus). 1) relay_inbox — if a contract for you is already waiting, do it now per the Rules. 2) End your turn.\n\n${RULES}`;
 
 let LESSONS = "";
 async function loadLessons() {
@@ -199,7 +224,19 @@ async function loadLessons() {
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
   try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
-  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", llm: AGENT, model: MODEL }).catch(() => {});
+  // Announce runner-side, signed as THIS seat. Asking the seat to announce itself sent glm's hello
+  // out under deepseek's identity whenever opencode seats shared one MCP daemon (lesson on the bus,
+  // 2026-07-29): the runner process is per-seat by construction, so its signature cannot be borrowed.
+  try {
+    const { sfetchJson } = await import("../lib/signed-fetch.mjs");
+    const { loadOrCreate } = await import("../lib/identity.mjs");
+    await sfetchJson(`${HUB}/send`, {
+      identity: loadOrCreate(SESSION, "agent"),
+      payload: { from: SESSION, to: "all", project: PROJ, text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
+      signal: AbortSignal.timeout(2500),
+    });
+  } catch {}
 
   let pendingBcast = [];
   const ec0 = runTurn(KICKOFF + LESSONS, true, "kickoff");

package/bin/crew.sh

@@ -266,6 +266,10 @@ AGENT=""; MODEL=""
 resolve_spec() {
   local SPEC="$1" FIELD
   AGENT="${SPEC%%:*}"; MODEL=""
+  # Replace, never stack. Reaps here — as a plain statement — because the alternative home, RUN_CMD,
+  # is always invoked as `cmd="$(RUN_CMD)"`, and command substitution would swallow run()'s output
+  # into the launcher string. AGENT is set above and DIR is fixed, so this is the earliest safe point.
+  reap_seat
   FIELD=""; [ "$SPEC" != "$AGENT" ] && FIELD="${SPEC#*:}"
   [ "$AGENT" = "openrouter" ] && [ -z "$FIELD" ] && FIELD="openrouter"
   if [ -n "$FIELD" ]; then
@@ -277,6 +281,29 @@ resolve_spec() {
     esac
   fi
 }
+# Kill any runner ALREADY serving this exact agent+project before starting another.
+#
+# Without this, `trantor up <agent>` ADDS a runner instead of replacing one — and every duplicate
+# long-polls the SAME inbox, so a single contract wakes N runners and each burns a full CLI turn on
+# the same card, racing to edit the same files. Observed 2026-07-29 on one project: codex x2, glm x3,
+# deepseek x3; three byte-identical "#3931 doing" broadcasts seconds apart; an OpenRouter key at $55
+# against a $20 cap; a seat blowing its context window at 362k tokens. It read as heavy usage. It was
+# duplicated usage.
+#
+# Scoped to agent+project on purpose: re-firing one seat must not disturb its siblings, and a crew in
+# another project is never ours to touch.
+reap_seat() {
+  local pid
+  # Anchored: the runner's argv ends with DIR, and without the $ a reap for …/proj also matches a
+  # runner in …/proj2 — killing a SIBLING project's seat on a directory-name prefix collision.
+  for pid in $(pgrep -f "crew-runner\.mjs $AGENT $DIR"'$' 2>/dev/null); do
+    run "kill -9 $pid 2>/dev/null"
+  done
+}
+# RUN_CMD must stay PURE: every caller invokes it as `cmd="$(RUN_CMD)"`, i.e. command substitution,
+# which captures ALL stdout. Anything that prints — including run()'s `[dry]` echo — would be swallowed
+# into the command string and end up inside the launcher. The reap therefore lives in resolve_spec(),
+# which every spawn path calls as a plain statement immediately before this.
 RUN_CMD() { printf 'cd %q && CREW_MODEL=%q RELAY_PROJECT=%q node %q %q %q' "$DIR" "$MODEL" "$PROJ" "$BUS_DIR/bin/crew-runner.mjs" "$AGENT" "$DIR"; }
 
 # ── tmux spawn: ONE session `trantor:$PROJ`, one named pane per seat, one Terminal window attached ────
@@ -368,12 +395,17 @@ spawn_cmux() {   # $@ = specs
     echo "  ~/.config/cmux/cmux.json (cmux auto-reloads). —"
     spawn_cmux_applescript "$@"; return
   fi
-  local first=1 SPEC wsid="" surf="" i=0
-  local dirs=(down right down right down right down right)
+  # Grid tiling: COLS = ceil(sqrt(N)) → 2 seats side-by-side, 4 = 2×2, 6 = 3×2. Row 0 is built with
+  # RIGHT splits off the previous column; each later row splits DOWN from the pane directly above it.
+  # Every split TARGETS a recorded surface id (--surface) — never "whatever pane happens to be focused",
+  # which is what produced the old staircase layout.
+  local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
+  local SPEC wsid="" surf="" i=0
+  local surfs=()
   for SPEC in "$@"; do
     resolve_spec "$SPEC"
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
-    if [ "$first" = "1" ]; then
+    if [ "$i" = "0" ]; then
       if [ "$DRY" = "1" ]; then
         echo "[dry] cmux: new-workspace (cwd $DIR) --command 'bash $launcher' → rename 'trantor:$PROJ'"
         wsid="%DRYWS"; surf="%DRYT0"
@@ -384,16 +416,19 @@ spawn_cmux() {   # $@ = specs
         surf="$(_cmux list-pane-surfaces --workspace "$wsid" --id-format uuids --json 2>/dev/null | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=o.surfaces||o.panes||o||[];const s=Array.isArray(a)?a[0]:null;process.stdout.write((s&&(s.id||s.surface_id))||"")}catch(e){}})')"
       fi
       record_state "$PROJ" "cmuxws" "__ws__" "$wsid"
-      first=0
     else
-      local dir="${dirs[$(( i % ${#dirs[@]} ))]}"
+      local dir target
+      if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${surfs[$(( i - 1 ))]}"
+      else dir="down"; target="${surfs[$(( i - COLS ))]}"; fi
       if [ "$DRY" = "1" ]; then
-        echo "[dry] cmux: new-split $dir + send 'bash $launcher'"; surf="%DRYT$i"
+        echo "[dry] cmux: new-split $dir --surface ${target:-<focused>} + send 'bash $launcher'"; surf="%DRYT$i"
       else
-        surf="$(_cmux new-split "$dir" --workspace "$wsid" --id-format uuids --json 2>/dev/null | _cmux_surf_json)"
+        local tflag=(); [ -n "$target" ] && [ "${target#\%DRY}" = "$target" ] && tflag=(--surface "$target")
+        surf="$(_cmux new-split "$dir" --workspace "$wsid" "${tflag[@]}" --id-format uuids --json 2>/dev/null | _cmux_surf_json)"
         [ -n "$surf" ] && { _cmux send --surface "$surf" "bash $launcher" >/dev/null 2>&1; _cmux send-key --surface "$surf" enter >/dev/null 2>&1; }
       fi
     fi
+    surfs+=("$surf")
     record_state "$PROJ" "cmux" "$AGENT" "$surf"
     echo "  → $AGENT seat in cmux workspace ($PROJ)"
     i=$(( i + 1 ))
@@ -404,12 +439,15 @@ spawn_cmux() {   # $@ = specs
 
 # AppleScript fallback (cmux control socket off): same one-tab-per-project layout, minus native sidebar status.
 spawn_cmux_applescript() {   # $@ = specs
-  local first=1 SPEC tabid="" termid="" i=0
-  local dirs=(down right down right down right down right)
+  # Same grid math as spawn_cmux: COLS = ceil(sqrt(N)); row 0 splits RIGHT off the previous column,
+  # later rows split DOWN from the terminal directly above — targeted by stable terminal id.
+  local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
+  local SPEC tabid="" termid="" i=0
+  local terms=()
   for SPEC in "$@"; do
     resolve_spec "$SPEC"
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
-    if [ "$first" = "1" ]; then
+    if [ "$i" = "0" ]; then
       if [ "$DRY" = "1" ]; then
         echo "[dry] cmux(AppleScript): new tab (trantor:$PROJ) + run 'bash $launcher'"; tabid="%DRYTAB"; termid="%DRYT0"
       else
@@ -431,11 +469,12 @@ OSA
         tabid="${out%%|*}"; termid="${out##*|}"
       fi
       record_state "$PROJ" "cmuxws" "__ws__" "$tabid"
-      first=0
     else
-      local dir="${dirs[$(( i % ${#dirs[@]} ))]}"
+      local dir target
+      if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${terms[$(( i - 1 ))]}"
+      else dir="down"; target="${terms[$(( i - COLS ))]}"; fi
       if [ "$DRY" = "1" ]; then
-        echo "[dry] cmux(AppleScript): split $dir + run 'bash $launcher'"; termid="%DRYT$i"
+        echo "[dry] cmux(AppleScript): split $dir from ${target:-<focused>} + run 'bash $launcher'"; termid="%DRYT$i"
       else
         termid="$(osascript 2>/dev/null <<OSA
 tell application "cmux"
@@ -446,7 +485,12 @@ tell application "cmux"
     end repeat
   end repeat
   if theTab is missing value then return "ERR"
-  set newterm to (split (focused terminal of theTab) direction $dir)
+  set srcTerm to missing value
+  repeat with tm in terminals of theTab
+    if (id of tm) is "$target" then set srcTerm to tm
+  end repeat
+  if srcTerm is missing value then set srcTerm to (focused terminal of theTab)
+  set newterm to (split srcTerm direction $dir)
   delay 0.25
   input text ("bash $launcher" & return) to newterm
   return (id of newterm)
@@ -455,6 +499,7 @@ OSA
 )"
       fi
     fi
+    terms+=("$termid")
     record_state "$PROJ" "cmux" "$AGENT" "$termid"
     echo "  → $AGENT seat in cmux workspace ($PROJ)"
     i=$(( i + 1 ))

package/bin/doctor.mjs

@@ -13,14 +13,23 @@ const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const has = (c) => { try { execSync(`command -v ${c}`, { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } };
 const read = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
-const ok = (m) => console.log(`  ✓ ${m}`);
-const warn = (m, fix) => { console.log(`  ✗ ${m}`); if (fix) console.log(`      → ${fix}`); issues++; };
+// --json makes the SAME engine feed the desktop app. Without it the app would have to re-implement
+// detection (or parse this text), and the two would drift — the CLI would say a seat is wired while
+// the app said otherwise, with no way to tell which was right.
+const JSON_MODE = process.argv.includes("--json");
+const REPORT = { ok: [], issues: [], notes: [], sections: [] };
+let SECTION = "";
+const say = (line) => { if (!JSON_MODE) console.log(line); };
+const section = (name) => { SECTION = name; REPORT.sections.push(name); say((REPORT.sections.length > 1 ? "\n" : "") + name); };
+const ok = (m) => { REPORT.ok.push({ section: SECTION, message: m }); say(`  ✓ ${m}`); };
+const warn = (m, fix) => { REPORT.issues.push({ section: SECTION, message: m, fix: fix || null }); say(`  ✗ ${m}`); if (fix) say(`      → ${fix}`); issues++; };
+const note = (m) => { REPORT.notes.push({ section: SECTION, message: m }); say(`  – ${m}`); };
 let issues = 0;
 
-console.log("TRANTOR DOCTOR\n");
+say("TRANTOR DOCTOR\n");
 
 // runtime + hub + client version
-console.log("core");
+section("core");
 Number(process.versions.node.split(".")[0]) >= 18 ? ok(`node ${process.versions.node}`) : warn(`node ${process.versions.node} too old`, "install node >= 18");
 const cfg = read(join(H, ".agent-bus", "config.json")) || {};
 const HUB = process.env.RELAY_URL || cfg.url || "http://127.0.0.1:4477";
@@ -41,7 +50,7 @@ if (pkg?.version) {
 } else warn("could not read trantor version", "reinstall: npm install -g trantor");
 
 // claude plugin
-console.log("\nclaude (the orchestrator)");
+section("claude (the orchestrator)");
 if (!has("claude")) warn("claude CLI not found", "install Claude Code: https://claude.com/claude-code");
 else {
   const st = read(join(H, ".claude", "settings.json")) || {};
@@ -51,7 +60,7 @@ else {
 }
 
 // crew CLIs: installed / wired / authenticated
-console.log("\ncrew CLIs (install any subset — seats follow the work)");
+section("crew CLIs (install any subset — seats follow the work)");
 const CLIS = [
   { name: "codex",  bin: "codex",    wired: () => (readFileSync(join(H, ".codex", "config.toml"), "utf8")).includes("[mcp_servers.relay]"), auth: () => existsSync(join(H, ".codex", "auth.json")), login: "codex   (sign in with your ChatGPT account on first run)" },
   // Gemini CLI was retired 2026-06-18 for free/Pro/Ultra (Google → Antigravity `agy`). Kept as an
@@ -68,7 +77,7 @@ const CLIS = [
 ];
 let installed = 0;
 for (const c of CLIS) {
-  if (!has(c.bin)) { console.log(`  – ${c.name}: not installed (optional)`); continue; }
+  if (!has(c.bin)) { note(`${c.name}: not installed (optional)`); continue; }
   installed++;
   let wired = false; try { wired = c.wired(); } catch {}
   wired ? ok(`${c.name}: wired to the bus`) : warn(`${c.name}: installed but not wired`, `node ${join(ROOT, "bin", "connect.mjs")}`);
@@ -78,7 +87,7 @@ for (const c of CLIS) {
 if (!installed) warn("no crew CLIs found", "install at least one of: codex, gemini, kimi, opencode — Trantor orchestrates whatever you have");
 
 // brain
-console.log("\nthe brain");
+section("the brain");
 has("scrooge") || existsSync(join(H, ".local", "bin", "scrooge"))
   ? ok("economics engine installed (routing + cost ledger active)")
   : warn("economics engine missing — Advisor runs without live pricing; relay_scrooge dormant", "trantor setup   (installs it automatically)");
@@ -87,5 +96,7 @@ prof?.providers && Object.keys(prof.providers).length
   ? ok(`quota profile set (${Object.entries(prof.providers).map(([k, v]) => `${k}=${v.plan}`).join(", ")})`)
   : warn("quota profile not set — the Advisor will assume API billing everywhere", `node ${join(ROOT, "bin", "profile.mjs")} set claude=max codex=plus deepseek=api …  (use YOUR real plans)`);
 
-console.log(issues ? `\n${issues} issue(s) — fix the → lines above, then re-run the doctor.` : "\nAll clear — open a claude session in any project and say: \"fire up the crew\".");
+say(issues ? `\n${issues} issue(s) — fix the → lines above, then re-run the doctor.` : "\nAll clear — open a claude session in any project and say: \"fire up the crew\".");
+// Must come BEFORE the exit — process.exit() here truncated the report entirely.
+if (JSON_MODE) console.log(JSON.stringify({ ...REPORT, issueCount: issues }));
 process.exit(issues ? 1 : 0);