trantor 0.17.56 → 0.17.57

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.56",
+      "version": "0.17.57",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.56",
+  "version": "0.17.57",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/balances.mjs

@@ -18,11 +18,8 @@ const noPush = args.includes("--no-push");
 // Only check providers the user configured in `trantor profile` — never stray keys in the ambient env.
 const configured = Object.keys(loadProfile().providers || {});
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST rejected under enforce.
+import { signedPost } from "../hooks/lib/api.mjs";
 let _qpct = DEFAULT_LOW_QUOTA_PCT;
 function thresholds() {
   try { const c = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")); if (typeof c.lowQuotaPct === "number") _qpct = c.lowQuotaPct; if (c.lowBalance && typeof c.lowBalance === "object") return { ...DEFAULT_LOW, ...c.lowBalance }; } catch {}
@@ -35,8 +32,7 @@ const low = thresholds();
 // push the snapshot to the hub (best-effort) so the dashboard + warning line can use it
 if (!noPush) {
   try {
-    await fetch(`${relayUrl()}/balances`, { method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ balances, ts: Date.now() }), signal: AbortSignal.timeout(2500) });
+    await signedPost("/balances", { balances, ts: Date.now() }, { timeoutMs: 2500 });
   } catch {}
 }
 

package/bin/catchup.mjs

@@ -10,19 +10,20 @@ import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): hand-rolled relayUrl missed the
+// per-project hubs map; unsigned reads 401 under enforce. signedGet resolves + signs per call.
+import { relayUrl, signedGet } from "../hooks/lib/api.mjs";
 const haveScrooge = () => { try { execSync("command -v scrooge", { stdio: "ignore" }); return true; } catch { return false; } };
 
 const dir = process.cwd();
 const project = resolveProject(dir);
-const url = relayUrl();
+const url = relayUrl(project);
 
 let cu = null;
-try { cu = await (await fetch(`${url}/catchup?project=${encodeURIComponent(project)}`, { signal: AbortSignal.timeout(4000) })).json(); } catch (e) { console.error(`could not reach hub at ${url}: ${e.message}`); }
+{
+  const r = await signedGet(`/catchup?project=${encodeURIComponent(project)}`, { timeoutMs: 4000 });
+  if (r.ok) cu = r.json; else console.error(`could not reach hub at ${url} (status ${r.status})`);
+}
 let gitlog = "";
 try { gitlog = execSync(`git -C ${JSON.stringify(dir)} log --oneline -12 2>/dev/null`, { encoding: "utf8" }).trim(); } catch {}
 

package/bin/crew-verify.mjs

@@ -24,12 +24,13 @@ const SINCE = si >= 0 ? Number(args.splice(si, 2)[1]) : NaN;
 const [PROJ, ...AGENTS] = args;
 if (!PROJ || !AGENTS.length) { console.error("usage: crew-verify.mjs <project> <agent...> [--timeout 30] [--since <ms>]"); process.exit(2); }
 
-function hubUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const u = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).url; if (u) return u; } catch {}
-  return "http://127.0.0.1:4477";
-}
-const HUB = hubUrl();
+// Signed + per-project hub (2026-07-31, agent-UX audit): unsigned /peers is a dead 401 under
+// enforce — crew verification would report every seat missing while the crew was fine.
+import { resolveHub, hostId } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+const HUB = process.env.RELAY_URL || resolveHub(PROJ);
+const VERIFY_ID = loadOrCreate(process.env.RELAY_SESSION || `${hostId()}:${PROJ}`, "agent");
 // Two distinct clocks, deliberately separate:
 //  - FRESH_SINCE: the freshness threshold. A registration counts only if lastSeen >= this.
 //    Prefer the launcher's pre-spawn epoch (so an early "booting" beat counts); else our start.
@@ -43,7 +44,7 @@ const FRESH_SINCE = Number.isFinite(SINCE) ? SINCE : Date.now();
   const up = new Set();
   while (Date.now() < DEADLINE && up.size < want.size) {
     try {
-      const { peers } = await (await fetch(`${HUB}/peers`)).json();
+      const { peers } = await (await sfetchJson(`${HUB}/peers`, { method: "GET", identity: VERIFY_ID })).json();
       for (const p of peers) if (want.has(p.session) && p.lastSeen >= FRESH_SINCE) up.add(p.session);
     } catch {}
     if (up.size < want.size) await new Promise(s => setTimeout(s, 1500));

package/bin/gates.mjs

@@ -11,21 +11,20 @@ const args = process.argv.slice(2);
 const all = args.includes("--all");
 const asJson = args.includes("--json");
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const u = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).url; if (u) return u; } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): the hand-rolled relayUrl here
+// missed the per-project hubs map AND sent unsigned (401 under enforce). relayUrl/signedGet from
+// hooks/lib/api.mjs resolve the cwd project's hub and sign as this session.
+import { relayUrl, signedGet } from "../hooks/lib/api.mjs";
 
 const project = resolveProject(process.cwd());
-const url = `${relayUrl()}/verify-gates?project=${encodeURIComponent(project)}${all ? "&all=1" : ""}`;
 let gates = [];
-try {
-  const r = await fetch(url, { signal: AbortSignal.timeout(2500) });
-  gates = (await r.json()).gates || [];
-} catch {
-  console.error(`could not reach the hub at ${relayUrl()} — is it running? (trantor setup / trantor hub)`);
-  process.exit(1);
+{
+  const r = await signedGet(`/verify-gates?project=${encodeURIComponent(project)}${all ? "&all=1" : ""}`, { timeoutMs: 2500 });
+  if (!r.ok) {
+    console.error(`could not reach the hub at ${relayUrl(project)} (status ${r.status}) — is it running? (trantor setup / trantor hub)`);
+    process.exit(1);
+  }
+  gates = r.json?.gates || [];
 }
 
 if (asJson) { process.stdout.write(JSON.stringify(gates, null, 2) + "\n"); process.exit(0); }

package/bin/git-backfill.mjs

@@ -11,18 +11,16 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST /task was rejected
+// under enforce; hand-rolled relayUrl missed the per-project hubs map.
+import { relayUrl, signedGet, signedPost } from "../hooks/lib/api.mjs";
 const args = process.argv.slice(2);
 const arg = (name, def) => { const i = args.indexOf("--" + name); return i >= 0 ? args[i + 1] : def; };
 const dir = process.cwd();
 const project = arg("project", resolveProject(dir));
 const since = arg("since", "14 days ago");
 const dry = args.includes("--dry-run");
-const url = relayUrl();
+const url = relayUrl(project);
 const me = `${hostId()}:${project}`;
 
 const themeOf = (s) => {
@@ -53,7 +51,7 @@ for (const r of rows) {
 }
 
 let existing = new Set();
-try { const t = (await (await fetch(`${url}/tasks?project=${encodeURIComponent(project)}`)).json()).tasks || []; existing = new Set(t.map(x => x.title)); } catch {}
+try { const r = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { session: me }); const t = r.json?.tasks || []; existing = new Set(t.map(x => x.title)); } catch {}
 
 const ents = [...groups.entries()].sort((a, b) => a[1].latest - b[1].latest);
 let posted = 0, skipped = 0;
@@ -68,8 +66,7 @@ for (const [theme, g] of ents) {
   if (existing.has(title)) { skipped++; continue; }
   if (dry) { console.log(`+ [${new Date(g.latest).toISOString().slice(0, 10)}] ${theme.padEnd(20)} ${g.commits.length}c  ${title.slice(0, 64)}`); posted++; continue; }
   try {
-    await fetch(`${url}/task`, { method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ project, title, status: "done", phase: theme, source: "git", ts: g.latest, assignee: me, by: me }) });
+    await signedPost("/task", { project, title, status: "done", phase: theme, source: "git", ts: g.latest, assignee: me, by: me }, { session: me });
     posted++;
   } catch (e) { console.error(`post failed for "${title}": ${e.message}`); }
 }

package/bin/reconcile.mjs

@@ -14,11 +14,10 @@ import { homedir } from "node:os";
 import { execSync, spawnSync } from "node:child_process";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): the unsigned POST /task/update was
+// rejected outright under enforce and merely flagged under warn; the hand-rolled relayUrl missed
+// the per-project hubs map. signedGet/signedPost resolve the cwd project's hub + sign per call.
+import { relayUrl, signedGet, signedPost } from "../hooks/lib/api.mjs";
 function parseDur(s, def) {
   if (!s) return def;
   const m = String(s).match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i);
@@ -38,16 +37,16 @@ const doIt = has("--yes", "-y");
 const difficulty = ["easy", "medium", "hard"].includes(val("--difficulty", "-d")) ? val("--difficulty", "-d") : "medium";
 const dir = process.cwd();
 const project = resolveProject(dir);
-const url = relayUrl();
+const url = relayUrl(project);
 
 async function tasks() {
-  const r = await fetch(`${url}/tasks?project=${encodeURIComponent(project)}`, { signal: AbortSignal.timeout(6000) });
-  const j = await r.json();
-  return Array.isArray(j) ? j : (j.tasks || j.cards || []);
+  const r = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { timeoutMs: 6000 });
+  if (!r.ok) return [];
+  const j = r.json;
+  return Array.isArray(j) ? j : (j?.tasks || j?.cards || []);
 }
 async function move(id, status) {
-  await fetch(`${url}/task/update`, { method: "POST", headers: { "content-type": "application/json" },
-    body: JSON.stringify({ id, status, by: "reconcile" }), signal: AbortSignal.timeout(4000) }).catch(() => {});
+  await signedPost("/task/update", { id, status, by: "reconcile" }, { timeoutMs: 4000 }).catch(() => {});
 }
 // the memory record for THIS project (Claude Code stores it per encoded-cwd); optional context.
 function memoryExcerpt() {

package/bin/recost.mjs

@@ -10,11 +10,8 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { scanSubagentCosts } from "../lib/subagent-scan.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST rejected under enforce.
+import { relayUrl, signedPost } from "../hooks/lib/api.mjs";
 
 const dry = process.argv.includes("--dry-run");
 const asJson = process.argv.includes("--json");
@@ -35,10 +32,11 @@ if (dry) {
 }
 
 let result;
-try {
-  result = await fetch(`${relayUrl()}/subagent-recost`, { method: "POST", headers: { "content-type": "application/json" },
-    body: JSON.stringify({ entries: allEntries }), signal: AbortSignal.timeout(15000) }).then(x => x.json());
-} catch (e) { console.error(`recost failed: ${e.message}`); process.exit(1); }
+{
+  const r = await signedPost("/subagent-recost", { entries: allEntries }, { timeoutMs: 15000 });
+  if (!r.ok) { console.error(`recost failed: hub ${r.status} at ${relayUrl()}`); process.exit(1); }
+  result = r.json;
+}
 
 const projs = (result?.projects || []);
 const seeded = projs.filter(p => !p.skipped);

package/bin/relay-watch.mjs

@@ -2,22 +2,24 @@
 // relay-watch — a live feed of the bus via SSE (true push, no polling). Run in a terminal
 // to watch sessions talk in real time, or to monitor a presence/status board.
 //   node bin/relay-watch.mjs [session]   (default: "all" — see every message)
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
+// Signed + per-project hub (2026-07-31, agent-UX audit): the hand-rolled relayUrl() here read
+// only the global config `url` (wrong hub for a migrated project) and fetched unsigned (dead
+// 401 under RELAY_AUTH=enforce). Now: canonical resolver + this session's keypair on every call.
+import { resolveProject, hostId, resolveHub } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetch, sfetchJson } from "../lib/signed-fetch.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
-const URL_BASE = relayUrl();
+const PROJECT = resolveProject(process.cwd());
+const ME = process.env.RELAY_SESSION
+  || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${PROJECT}` : `${hostId()}:${PROJECT}`);
+const identity = loadOrCreate(ME, "agent");
+const URL_BASE = resolveHub(PROJECT);
 const SESSION = process.argv[2] || "all";
 const t = () => new Date().toLocaleTimeString();
 
 async function showPeers() {
   try {
-    const { peers } = await (await fetch(`${URL_BASE}/peers`)).json();
+    const { peers } = await (await sfetchJson(`${URL_BASE}/peers`, { method: "GET", identity })).json();
     const live = peers.filter(p => p.online);
     console.log(`\n  live sessions (${live.length}):`);
     for (const p of live) console.log(`   🟢 ${p.session}${p.status ? `  — ${p.status}` : ""}`);
@@ -30,7 +32,7 @@ async function watch() {
   await showPeers();
   for (;;) {
     try {
-      const r = await fetch(`${URL_BASE}/stream?session=${encodeURIComponent(SESSION)}`, { headers: { accept: "text/event-stream" } });
+      const r = await sfetch(`${URL_BASE}/stream?session=${encodeURIComponent(SESSION)}`, { headers: { accept: "text/event-stream" } }, identity);
       if (!r.ok || !r.body) throw new Error(`stream ${r.status}`);
       let buf = "";
       const dec = new TextDecoder();

package/bin/statusline.mjs

@@ -8,19 +8,18 @@ import { readFileSync, existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir, hostname } from "node:os";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): unsigned /peers is a dead 401
+// under enforce, which painted "trantor offline" while the hub was fine.
+import { sessionContext, signedGet } from "../hooks/lib/api.mjs";
 async function main() {
   let stdin = ""; try { for await (const c of process.stdin) stdin += c; } catch {}
   let cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   try { const j = JSON.parse(stdin || "{}"); cwd = j.cwd || j.workspace?.current_dir || cwd; } catch {}
-  const me = process.env.RELAY_SESSION || `${hostname()}:${basename(cwd)}`;
+  const me = process.env.RELAY_SESSION || sessionContext(cwd).session;
   try {
-    const r = await fetch(`${relayUrl()}/peers`, { signal: AbortSignal.timeout(800) });
-    const { peers } = await r.json();
+    const r = await signedGet("/peers", { timeoutMs: 800, session: me });
+    if (!r.ok) throw new Error(`hub ${r.status}`);
+    const { peers } = r.json;
     const live = peers.filter(p => p.online && p.session !== me).length;
     process.stdout.write(`\x1b[38;5;43m● trantor\x1b[0m \x1b[2m· ${live} other${live === 1 ? "" : "s"} live\x1b[0m`);
   } catch {

package/bin/sweep.mjs

@@ -12,11 +12,11 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed as the OWNER (2026-07-31, agent-UX audit): /sweep is an owner endpoint — an unsigned
+// POST is rejected under enforce. Sign with config.ownerIdentity, same pattern as bin/policy.mjs.
+import { relayUrl } from "../hooks/lib/api.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
 function parseDur(s, def) {
   if (!s) return def;
   const m = String(s).match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i);
@@ -33,12 +33,15 @@ const olderMs = parseDur(val("--older", "-o"), 30 * 60 * 1000);
 const doIt = has("--yes", "-y");
 const allProjects = has("--all-projects", "--all");
 const project = allProjects ? null : resolveProject(process.cwd());
-const url = relayUrl();
+const url = relayUrl(project || undefined);
+let ownerName = "admin";
+try { ownerName = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).ownerIdentity || "admin"; } catch {}
+const ownerId = loadOrCreate(ownerName, "human");
 
 async function sweep(dryRun) {
   const body = { olderMs, dryRun, by: "cli-sweep" };
   if (project) body.project = project;
-  const r = await fetch(`${url}/sweep`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal: AbortSignal.timeout(6000) });
+  const r = await sfetchJson(`${url}/sweep`, { identity: ownerId, payload: body, signal: AbortSignal.timeout(6000) });
   return r.json();
 }
 

package/hooks/inbox-deliver.mjs

@@ -24,7 +24,7 @@ import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
-import { getJSON } from "./lib/api.mjs";
+import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T1 delivery is silently dead
 
 const POLL_MS = Number(process.env.RELAY_INBOX_POLL_MS || 4000);
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
@@ -34,7 +34,7 @@ const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
 function sanitize(s) { return String(s == null ? "" : s).replace(/[\x00-\x1f\x7f-\x9f]/g, " "); }
 
 async function getInbox(session, since) {
-  const { ok, json } = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS });
+  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session });
   if (!ok || !json) throw new Error("hub unreachable");
   return json;   // { messages: [...], cursor }
 }

package/hooks/sessionstart.mjs

@@ -71,11 +71,14 @@ function readStdin() {
     process.stdin.on("data", c => (d += c)); process.stdin.on("end", () => res(d));
     setTimeout(() => res(d), 100); });
 }
-// Hub reads/writes through the shared client (TDD §8). Writes are SIGNED (Ed25519, via signedPost);
-// reads go unsigned for now (see api.mjs:getJSON — pending the hub's DM scope-filtering fix). Each
-// resolves to {ok,status,json}; a down hub returns {ok:false,json:null} and the caller's catch keeps
-// the session alive (fail-open contract, acceptance §9 #10).
-async function jget(u, session) { const r = await getJSON(u, { timeoutMs: 2500 }); return r.ok ? (r.json || {}) : {}; }
+// Hub reads/writes through the shared client (TDD §8), ALL signed (Ed25519). Writes via signedPost
+// close the self-asserted `from` hole; reads via signedGet survive RELAY_AUTH=enforce, which 401s
+// unsigned reads (unsigned, the roster/handoff injection was silently dead on the remote hub — the
+// 2026-07-30 agent-UX gap). The hub scope-filters signed reads to this identity's grants; for a
+// session reading its own project + declared links that is the intended shape. Each resolves to
+// {ok,status,json}; a down hub returns {ok:false,json:null} and the caller's catch keeps the
+// session alive (fail-open contract, acceptance §9 #10).
+async function jget(u, session) { const r = await signedGet(u, { timeoutMs: 2500, session }); return r.ok ? (r.json || {}) : {}; }
 async function jpost(u, b, session) { return (await signedPost(u, b, { session, timeoutMs: 2500 })).ok; }
 
 // Strip control chars from untrusted injected text so the hook's JSON stdout (which

package/hooks/stop-inbox.mjs

@@ -25,7 +25,7 @@ import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
-import { getJSON } from "./lib/api.mjs";
+import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_STOP_TIMEOUT_MS || 1500);
 
@@ -75,7 +75,7 @@ async function main() {
   let messages = [];
   try {
     // PEEK: look without claiming delivery. We may yet decide to let the stop through.
-    const peek = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS });
+    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session });
     if (!peek.ok) return allow();
     messages = peek.json?.messages || [];
   } catch { return allow(); }        // hub down — never trap the session
@@ -86,7 +86,7 @@ async function main() {
   // Committed now: claim delivery for real so neither inbox-deliver nor the deferred waker repeats it.
   let next = cursor;
   try {
-    const claim = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS });
+    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session });
     if (claim.ok) next = claim.json?.cursor || cursor;
   } catch {}
   try { writeFileSync(cursorFile, String(next)); } catch {}

package/mcp.mjs

@@ -21,7 +21,7 @@ const PROJECT = resolveProject(process.env.CLAUDE_PROJECT_DIR || process.cwd());
 // Hub URL is PER-PROJECT (TDD §12.1): RELAY_URL env → config.json hubs[PROJECT] → legacy
 // global `url` → local default. A project lives on exactly one hub; codependent projects
 // must share one, so both are pinned to the same hub via `trantor hub set`.
-const URL_BASE = resolveHub(PROJECT);
+const URL_BASE = resolveHub(PROJECT);   // boot-time snapshot: startup log only — every api() call re-resolves
 // Identity: RELAY_SESSION wins; else RELAY_AGENT ("codex", "kimi", …) brands the session per-project
 // (set it once in the CLI's global MCP config — works in every project); else hostname:project.
 const SESSION = process.env.RELAY_SESSION
@@ -63,7 +63,7 @@ const server = new McpServer({ name: "trantor", version: "0.1.0" });
 
 server.tool("relay_whoami", "Show this session's relay identity, project, and the hub URL.", {}, async () => {
   await api("POST", "/register", { session: SESSION, project: PROJECT }).catch(() => {});
-  return { content: [{ type: "text", text: `session=${SESSION}\nproject=${PROJECT}\nhub=${URL_BASE}` }] };
+  return { content: [{ type: "text", text: `session=${SESSION}\nproject=${PROJECT}\nhub=${resolveHub(PROJECT)}` }] };
 });
 
 server.tool("relay_task_add", "Add a Kanban card to a project's board on the dashboard (what you're about to work on). Defaults: THIS project, assigned to you, status 'todo'. Pass `project` to target another board — e.g. when you orchestrate a crew that runs in a different directory than the one you launched Claude from. Keep the team's progress visible.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.56",
+  "version": "0.17.57",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"