trantor 0.17.65 → 0.17.67

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + context-handoff for independent AI coding agents (Claude, Codex, Gemini, …)",
-    "version": "0.17.54"
+    "version": "0.17.67"
   },
   "plugins": [
     {
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.60",
+      "version": "0.17.67",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.65",
+  "version": "0.17.67",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -147,7 +147,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
 
 // ---- failure visibility ----------------------------------------------------
 // A turn's CLI can fail (credits exhausted, auth, crash) and the runner would just
@@ -161,7 +161,9 @@ const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
 function classifyFailure(exit, errText) {
   const t = (errText || "").toLowerCase();
   if (exit === 127) return "missing-cli";
-  if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|out of (credit|quota)/.test(t)) return "exhausted";
+  // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
+  // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
+  if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|reached your [^.\n]*limit|usage limit|out of (credit|quota)/.test(t)) return "exhausted";
   if (/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/.test(t)) return "auth";
   return "crashed";
 }
@@ -210,7 +212,12 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   try { appendFileSync(ERRF, "", { flag: "w" }); } catch {}
   // pipefail: without it the sid-capture `| tee` makes a FAILED turn exit 0 (tee's status),
   // so the failure reporter never fires and a dead seat heartbeats green on the bus.
-  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : cmd;
+  // A CLI's own explanation for quitting often goes to STDOUT, not stderr — Claude's usage-limit
+  // notice is the case that bit us: ERRF stayed empty, so a plainly exhausted seat was reported as
+  // `crashed` and nobody knew to swap it. sid seats already fold stdout into the ERRF stream via
+  // `tee /dev/stderr`; the rest now tee straight into ERRF. A real pipeline (not a process
+  // substitution) so bash waits for tee to flush before we read the file back.
+  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
     cwd: DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ },

package/bin/doctor.mjs

@@ -12,6 +12,13 @@ import { fileURLToPath } from "node:url";
 const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const has = (c) => { try { execSync(`command -v ${c}`, { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } };
+// Claude Code keeps its credentials in the macOS Keychain. Attribute-only lookup (no -w, no -g), so
+// it never reads the secret and never raises an access prompt — a GUI prompt from a health check
+// would be worse than the unknown it answers.
+const keychainHas = (svc) => {
+  if (process.platform !== "darwin") return false;
+  try { execSync(`security find-generic-password -s ${JSON.stringify(svc)}`, { stdio: "ignore" }); return true; } catch { return false; }
+};
 const read = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
 // --json makes the SAME engine feed the desktop app. Without it the app would have to re-implement
 // detection (or parse this text), and the two would drift — the CLI would say a seat is wired while
@@ -62,7 +69,15 @@ else {
 // crew CLIs: installed / wired / authenticated
 section("crew CLIs (install any subset — seats follow the work)");
 const CLIS = [
-  { name: "codex",  bin: "codex",    wired: () => (readFileSync(join(H, ".codex", "config.toml"), "utf8")).includes("[mcp_servers.relay]"), auth: () => existsSync(join(H, ".codex", "auth.json")), login: "codex   (sign in with your ChatGPT account on first run)" },
+  // Claude is a SEAT, not only the orchestrator — crew-runner.mjs has a `claude` entry and the fleet
+  // duty agent runs on it. It was checked only under "claude (the orchestrator)", which the Agents
+  // view filters out, so the one harness that is always present had no card. Wired = the plugin,
+  // since that is what carries the relay MCP server into the session.
+  { name: "claude", bin: "claude",
+    wired: () => Object.keys((read(join(H, ".claude", "settings.json")) || {}).enabledPlugins || {}).some(k => k.startsWith("agent-bus@") || k.startsWith("trantor@")),
+    auth: () => !!process.env.ANTHROPIC_API_KEY || existsSync(join(H, ".claude", ".credentials.json")) || keychainHas("Claude Code-credentials"),
+    login: "claude   (sign in with your Anthropic account on first run)" },
+  { name: "codex",  bin: "codex",  wired: () => (readFileSync(join(H, ".codex", "config.toml"), "utf8")).includes("[mcp_servers.relay]"), auth: () => existsSync(join(H, ".codex", "auth.json")), login: "codex   (sign in with your ChatGPT account on first run)" },
   // Gemini CLI was retired 2026-06-18 for free/Pro/Ultra (Google → Antigravity `agy`). Kept as an
   // optional seat for enterprise/paid-key holders; for everyone else the seat moved to GLM/opencode,
   // and Gemini lives on only as a Scrooge cheap-model via GEMINI_API_KEY (the API/models aren't retired).

package/bin/duty.mjs

@@ -63,6 +63,22 @@ async function ensureFleetIdentity(hub) {
   return true;
 }
 
+// Tell the hub which seat is on duty. Printing "set RELAY_DUTY_SESSION=… on the hub service" was
+// advice nobody could act on: the fleet hub is usually REMOTE, so no local env var reaches it, and
+// the hub read that var once at boot anyway. The seat knows it came up, so the seat says so.
+async function registerDutySeat(hub, session) {
+  const r = await sfetchJson(`${hub}/overseer/duty`, {
+    identity: loadOrCreate(SESSION, "agent"), payload: { session }, signal: AbortSignal.timeout(5000),
+  }).catch((e) => ({ ok: false, status: 0, _err: e?.message || String(e) }));
+  if (r?.ok) return true;
+  const why = r?.status === 404
+    ? `that hub predates /overseer/duty — redeploy it, or set RELAY_DUTY_SESSION=${session} on the hub service`
+    : (r?._err || `HTTP ${r?.status}`);
+  console.error(`  ⚠️  hub did NOT register the duty seat: ${why}`);
+  console.error("     the seat is running, but the hub will not feed it undelivered DMs or overseer warnings.");
+  return false;
+}
+
 function alivePid() {
   try {
     const pid = Number(readFileSync(PIDF, "utf8"));
@@ -88,8 +104,9 @@ if (cmd === "up") {
   child.unref();
   writeFileSync(PIDF, String(child.pid));
   console.log(`— duty agent up: ${SESSION} (pid ${child.pid}) watching ${hub} — log: ${LOGF}`);
-  console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings — set RELAY_DUTY_SESSION=${SESSION} on the hub service.`);
-  process.exit(0);
+  const fed = await registerDutySeat(hub, SESSION);
+  if (fed) console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings.`);
+  process.exit(0);   // the seat IS up; a hub that won't feed it is a warning, not a failed start
 }
 
 if (cmd === "down") {
@@ -98,6 +115,9 @@ if (cmd === "down") {
   else console.log("no duty seat running");
   try { execSync(`pkill -f "crew-runner.mjs ${AGENT} ${DIR}"`, { stdio: "ignore" }); } catch {}
   try { rmSync(PIDF, { force: true }); } catch {}
+  // Clear the hub's pointer too — escalations aimed at a seat that no longer exists are messages
+  // sent into a hole, and the hub has no other way to learn the seat went away.
+  await registerDutySeat(fleetHub(), "");
   process.exit(0);
 }
 
@@ -105,6 +125,15 @@ if (cmd === "down") {
 {
   const pid = alivePid();
   console.log(pid ? `duty seat RUNNING (pid ${pid}) as ${SESSION}` : "duty seat NOT running");
+  // A running seat the hub isn't feeding looks identical to a working one from the outside — which
+  // is the whole failure mode this command exists to make visible. So ask the hub, don't assume.
+  const hub = fleetHub();
+  const ov = await sfetchJson(`${hub}/overseer/status`, { method: "GET", identity: loadOrCreate(SESSION, "agent"), signal: AbortSignal.timeout(5000) })
+    .then((r) => (r?.ok ? r.json() : null)).catch(() => null);
+  if (!ov) console.log(`hub feed: UNKNOWN — could not read ${hub}/overseer/status`);
+  else if (!ov.dutySession) console.log(`hub feed: NOT WIRED — ${hub} has no duty seat registered; run \`trantor duty up\``);
+  else if (ov.dutySession !== SESSION) console.log(`hub feed: pointed at ${ov.dutySession}, NOT ${SESSION} — another seat owns duty on ${hub}`);
+  else console.log(`hub feed: wired — ${hub} escalates to ${SESSION}`);
   try {
     const lines = readFileSync(join(BUS, "logs", `${AGENT}-fleet.jsonl`), "utf8").trim().split("\n").slice(-3);
     console.log("last turns:"); for (const l of lines) console.log(`  ${l}`);

package/hub.mjs

@@ -86,7 +86,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {} };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "" };
 }
 
 function normalizeState(loaded = {}) {
@@ -111,6 +111,7 @@ function normalizeState(loaded = {}) {
   s.instances = loaded.instances && typeof loaded.instances === "object" ? loaded.instances : {};
   s.focus = loaded.focus && typeof loaded.focus === "object" ? loaded.focus : {};
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
+  s.dutySession = String(loaded.dutySession || "");
   for (const [session, v] of Object.entries(loaded.peers || {})) {
     // migrate old numeric form
     s.peers[session] = typeof v === "number"
@@ -212,8 +213,16 @@ async function reloadFromStore() {
 let _overseer = null;
 import("./lib/overseer.mjs").then(m => { _overseer = m; }).catch(() => {});
 const OVERSEER_TICK_MS = Number(process.env.RELAY_OVERSEER_TICK_MS || 30 * 1000);
-const OVERSEER_DEDUP_MS = Number(process.env.RELAY_OVERSEER_DEDUP_MS || 10 * 60 * 1000);
-const overseerWarned = new Map();   // dedup key -> ts
+// How long a condition must be ABSENT before we consider the episode over. This is NOT a re-warn
+// timer: see overseerTick.
+const OVERSEER_CLEAR_MS = Number(process.env.RELAY_OVERSEER_CLEAR_MS || process.env.RELAY_OVERSEER_DEDUP_MS || 10 * 60 * 1000);
+// Standing conditions, keyed by collision identity -> { since, lastTick }. A collision is a STATE,
+// not an event: it persists. Emitting on a 10-minute timer turned the watcher into a metronome —
+// 500 events for 4 distinct conditions (2026-08-12 audit), each one also waking the duty seat for a
+// full turn. Now an episode fires ONCE when it starts and stays quiet while it holds; the entry is
+// forgotten only after the condition has been gone for OVERSEER_CLEAR_MS, so a genuine recurrence
+// warns again.
+const overseerActive = new Map();
 // Heartbeat for the WATCHER itself: /overseer/status must distinguish "fleet is clear" from "the
 // overseer stopped ticking" — a monitor that cannot prove it is alive reads as clear when dead.
 let overseerLastTick = 0;
@@ -240,17 +249,36 @@ function overseerTick() {
   if (!_overseer?.detectCollisions) return;
   let collisions = [];
   try { collisions = _overseer.detectCollisions(overseerInputs()) || []; } catch { return; }
-  overseerLastTick = now(); overseerLastCollisions = collisions;
-  const cut = now() - OVERSEER_DEDUP_MS;
-  for (const [k, ts] of overseerWarned) if (ts < cut) overseerWarned.delete(k);
+  const t = now();
+  overseerLastTick = t;
   const pol = overseerPolicy();
+  const seen = new Set();
   for (const c of collisions) {
     const key = `${c.project} ${c.kind} ${(c.sessions || []).join(",")} ${(c.files || []).join(",")}`;
-    if (overseerWarned.has(key)) continue;
-    overseerWarned.set(key, now());
+    c.key = key;
+    seen.add(key);
+    const standing = overseerActive.get(key);
+    if (standing) { standing.lastTick = t; c.since = standing.since; continue; }   // holds — stay quiet
+    overseerActive.set(key, { since: t, lastTick: t });
+    c.since = t;
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
     if (DUTY_SESSION) hubSend(DUTY_SESSION, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+    // INTRODUCE the parties to each other. Telling two sessions to "coordinate over the bus" is
+    // useless if neither knows the other's session id, and until now the warning went only to the
+    // duty seat and the log — so coordination needed a human to carry the ids across. Hand each
+    // party the others' ids at the moment coordination is warranted. This sits inside the
+    // episode-start branch, so it fires ONCE per episode, not once per tick: a standing condition
+    // must not re-wake two sessions every 30 seconds.
+    const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
+    if (parties.length > 1) {
+      for (const me of parties) {
+        const others = parties.filter(p => p !== me);
+        hubSend(me,
+          `🤝 OVERSEER ${c.kind}: you and ${others.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${others[0]} — and split the work between you. No human needs to relay this.`,
+          c.project);
+      }
+    }
     const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
     if (level >= 3 && c.kind === "file-conflict") {
       const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),
@@ -260,8 +288,18 @@ function overseerTick() {
       appendEvent("verify.gate.opened", c.project, "overseer", { gateId: g.id, claim: g.claim, why: g.why });
     }
   }
+  // Episode end: a condition gone for the whole clear window is over, so a LATER recurrence is a
+  // new episode and warns again. Without this the map would grow forever and nothing could re-fire.
+  for (const [k, v] of overseerActive) {
+    if (!seen.has(k) && t - v.lastTick > OVERSEER_CLEAR_MS) overseerActive.delete(k);
+  }
+  overseerLastCollisions = collisions;
 }
 setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
+// setInterval waits a FULL period before its first call, so for 30s after every restart the watcher
+// had no lastTick and honestly reported itself stalled. Tick once shortly after boot (the delay lets
+// the lazy lib import land) so a restarted hub proves it is alive immediately.
+setTimeout(overseerTick, 2000).unref?.();
 
 // --- the DUTY AGENT feed (deterministic escalation; the seat itself is bin/duty.mjs) -----------
 // RELAY_DUTY_SESSION names the always-on triage seat (e.g. "claude:fleet"). The hub DMs it when:
@@ -270,7 +308,11 @@ setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 //   2. the overseer emits a warning (wired inside overseerTick below).
 // Escalations are hub-authored ("hub:duty") — they never impersonate a session — and dedup per
 // message id so a standing outage escalates once, not every tick.
-const DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || "");
+// Settable at runtime via POST /overseer/duty, because the seat is the only party that knows it
+// came up — and it often enrolls with a REMOTE hub, where no local env var could ever reach.
+// Env still wins at boot (an operator's declared config beats a seat's claim); otherwise the last
+// registered seat is restored from state, so a hub restart doesn't silently end the duty feed.
+let DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || state.dutySession || "");
 const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
 const dutyEscalated = new Set();
 function hubSend(to, text, project) {
@@ -613,6 +655,31 @@ function filterReadable(auth, rows, projectOf) {
   if (AUTH_MODE !== "enforce" && !auth?.identity) return rows;
   return rows.filter(row => canRead(auth, projectOf(row)));
 }
+// DISCOVERY follows declared links, and is deliberately wider than read.
+//
+// Sending across projects was never blocked: /send authorizes against the SENDER's project, so any
+// session can DM any session id it happens to know. Only the ROSTER was scoped — which meant two
+// sessions the operator had explicitly declared codependent could not learn each other's ids. The
+// overseer would tell both of them to "coordinate over the bus" and neither could find the other,
+// so the only remaining channel was the human. That is the exact traffic-cop role this project
+// exists to delete.
+//
+// A link is an operator declaration that two projects share resources. Treating it as mutual
+// discovery grants nothing a linked pair wasn't already told to do.
+function canDiscover(auth, project) {
+  if (canRead(auth, project)) return true;
+  const proj = canon(project || "");
+  if (!proj) return false;
+  for (const l of overseerPolicy().links) {
+    const ps = (l.projects || []).map(p => canon(p));
+    if (ps.includes(proj) && ps.some(p => p !== proj && canRead(auth, p))) return true;
+  }
+  return false;
+}
+function filterDiscoverable(auth, rows, projectOf) {
+  if (AUTH_MODE !== "enforce" && !auth?.identity) return rows;
+  return rows.filter(row => canDiscover(auth, projectOf(row)));
+}
 function inboxReadable(auth, msg, session) {
   if (msg.to === session) return !auth?.identity || String(auth.identity.name || "") === String(session || "");
   return canRead(auth, msg.project || "");
@@ -1030,7 +1097,7 @@ const server = http.createServer(async (req, res) => {
         engine: !!_overseer?.detectCollisions,
         lastTickTs: overseerLastTick,
         tickMs: OVERSEER_TICK_MS,
-        dedupMs: OVERSEER_DEDUP_MS,
+        clearMs: OVERSEER_CLEAR_MS,
         dutySession: DUTY_SESSION || "",
         watching: {
           sessions: livePeers.length,
@@ -1040,8 +1107,10 @@ const server = http.createServer(async (req, res) => {
         },
         autonomy: pol.autonomy,
         links: pol.links,
-        warnings: overseerLastCollisions,
-        warnedRecent: overseerWarned.size,
+        // `since` turns a detection into a duration — "standing 4h" reads very differently from
+        // "just started", and that distinction is the whole point of episode-based warning.
+        warnings: overseerLastCollisions.map(c => ({ ...c, since: c.since || 0 })),
+        standing: overseerActive.size,
       });
     }
     if (req.method === "GET" && P === "/overseer/context") {
@@ -1087,6 +1156,15 @@ const server = http.createServer(async (req, res) => {
       if (flipped) dirty = true;
       return json(res, 200, { ok: true, superseded: flipped });
     }
+    if (req.method === "POST" && P === "/overseer/duty") {
+      const b = await body(req);
+      if (b.session === undefined) return json(res, 400, { error: "session required (send \"\" to clear the duty seat)" });
+      const session = String(b.session).slice(0, 120);
+      DUTY_SESSION = session;
+      state.dutySession = session;
+      dirty = true;
+      return json(res, 200, { ok: true, dutySession: DUTY_SESSION });
+    }
     if (req.method === "POST" && P === "/overseer/narrate") {
       const b = await body(req);
       const ev = state.events.find(e => e.id === Number(b.eventId) && e.type === "overseer.warn");
@@ -1126,7 +1204,7 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "GET" && P === "/peers") {
       prunePeers();
       const cutoff = now() - ONLINE_MS;
-      const peerRows = filterReadable(auth, Object.entries(state.peers), ([, v]) => v.project || "");
+      const peerRows = filterDiscoverable(auth, Object.entries(state.peers), ([, v]) => v.project || "");
       return json(res, 200, { hubVersion: HUB_VERSION, authMode: AUTH_MODE, peers: peerRows.map(([s, v]) => ({ session: s, lastSeen: v.lastSeen, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status), project: v.project || "",
         pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "",
         llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });

package/lib/overseer.mjs

@@ -1,5 +1,12 @@
-const PEER_LIVE_MS = 5 * 60 * 1000;
-const CLAIM_LIVE_MS = 10 * 60 * 1000;
+// Windows are read from env ONCE at load (calls stay pure): without an override, a test cannot
+// observe a condition CLEARING — peers stay "live" for five minutes no matter what the test does,
+// so the episode-recurrence path was untestable and therefore unproven.
+const PEER_LIVE_MS = Number(process.env.RELAY_OVERSEER_PEER_LIVE_MS || 5 * 60 * 1000);
+const CLAIM_LIVE_MS = Number(process.env.RELAY_OVERSEER_CLAIM_LIVE_MS || 10 * 60 * 1000);
+// "Actively executing", not merely "window open" — the same 90s bar the desktop app calls `busy`
+// (the heartbeat fires on tool calls, so a fresher-than-90s peer is mid-turn). Presence alone is
+// too weak a signal to call a collision: see the linked-activity note below.
+const WORK_LIVE_MS = Number(process.env.RELAY_OVERSEER_WORK_LIVE_MS || 90 * 1000);
 
 const KINDS = new Set(["same-project-sessions", "file-conflict", "linked-activity"]);
 
@@ -119,18 +126,40 @@ export function detectCollisions({ peers = [], claims = [], links = [], autonomy
     });
   }
 
+  // A link is DECLARED — the operator already told us these projects move together. Warning merely
+  // because both have a session OPEN restates that declaration, and it stays true for hours:
+  // crebral-health ↔ crebral-scribe produced 468 identical warnings across 8 days (2026-08-12
+  // audit), which is how a monitor teaches you to ignore it. The signal worth raising is
+  // CONCURRENT WORK — each side actually executing (heartbeat inside WORK_LIVE_MS) or holding a
+  // fresh file claim. Two idle-open windows are not a collision.
+  const workingByProject = new Map();
+  for (const peer of livePeers) {
+    if (!isFresh(peer?.lastSeen, at, WORK_LIVE_MS)) continue;
+    const sessions = workingByProject.get(peer.project) ?? [];
+    sessions.push(peer.session);
+    workingByProject.set(peer.project, sessions);
+  }
+  for (const claim of asArray(claims)) {
+    const project = clean(claim?.project);
+    const session = clean(claim?.session);
+    if (!project || !session || !isFresh(claim?.ts, at, CLAIM_LIVE_MS)) continue;
+    const sessions = workingByProject.get(project) ?? [];
+    sessions.push(session);
+    workingByProject.set(project, sessions);
+  }
+
   for (const link of asArray(links)) {
     const projects = sortedStrings(link?.projects ?? []);
     if (projects.length < 2) continue;
-    const activeProjects = projects.filter((project) => (sessionsByProject.get(project) ?? []).length > 0);
+    const activeProjects = projects.filter((project) => (workingByProject.get(project) ?? []).length > 0);
     if (activeProjects.length < 2) continue;
-    const sessions = sortedStrings(activeProjects.flatMap((project) => sessionsByProject.get(project) ?? []));
+    const sessions = sortedStrings(activeProjects.flatMap((project) => workingByProject.get(project) ?? []));
     pushCollision(out, {
       project: activeProjects[0],
       kind: "linked-activity",
       sessions,
       files: [],
-      detail: `Linked projects ${activeProjects.join(", ")} have live sessions ${sessions.join(", ")}.`,
+      detail: `Linked projects ${activeProjects.join(", ")} are being worked on at the same time by ${sessions.join(", ")}.`,
     });
   }
 

package/mcp.mjs

@@ -3,17 +3,62 @@
 // tools to talk to OTHER live agent sessions through the relay hub. Loaded per-session
 // via the agent's MCP config. Identity + hub URL come from env (RELAY_SESSION, RELAY_URL).
 // Loading this server AUTO-REGISTERS the session — so presence works on every agent.
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { join, basename } from "node:path";
+import { join, basename, dirname } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { advise } from "./bin/advise.mjs";
 import { resolveProject, hostId, resolveHub } from "./lib/project.mjs";
 import { signedPost, signedGet } from "./hooks/lib/api.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
-import { z } from "zod";
+
+// ---- runtime dep resolution -------------------------------------------------
+// `claude plugin install` snapshots the REPO, not an npm tarball, so a GitHub-sourced
+// plugin ships no node_modules — and a static `import "@modelcontextprotocol/sdk/..."`
+// then dies with ERR_MODULE_NOT_FOUND before a single line runs. The failure is silent
+// from the user's side: every relay tool just disappears. So resolve these two ourselves.
+// Normal path is untouched (plain `import(spec)`, ESM build, deps present); only when that
+// comes back NOT_FOUND do we borrow the tree from the globally installed `trantor`, which
+// npm always gives real dependencies at the same version as the plugin.
+const HERE = dirname(fileURLToPath(import.meta.url));
+const req = createRequire(import.meta.url);
+
+let fallbackRoots = null;
+function borrowRoots() {
+  if (fallbackRoots) return fallbackRoots;
+  const roots = [];
+  const add = (p) => { if (p && !roots.includes(p)) roots.push(p); };
+  // Cheap guesses first — every one of these is a string join, no process spawn.
+  if (process.env.npm_config_prefix) add(join(process.env.npm_config_prefix, "lib", "node_modules"));
+  add(join(dirname(process.execPath), "..", "lib", "node_modules"));   // homebrew, nvm, volta, asdf
+  // Only shell out if the guesses missed — `npm root -g` costs ~0.5s of MCP startup.
+  if (!roots.some((r) => existsSync(join(r, "trantor")))) {
+    try { add(execSync("npm root -g", { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim()); } catch {}
+  }
+  fallbackRoots = roots.flatMap((r) => [join(r, "trantor"), r]);
+  return fallbackRoots;
+}
+
+async function dep(spec) {
+  try {
+    return await import(spec);
+  } catch (err) {
+    if (err?.code !== "ERR_MODULE_NOT_FOUND" && err?.code !== "ERR_PACKAGE_PATH_NOT_EXPORTED") throw err;
+  }
+  for (const path of [HERE, ...borrowRoots()]) {
+    try { return await import(pathToFileURL(req.resolve(spec, { paths: [path] })).href); } catch {}
+  }
+  throw new Error(
+    `[trantor-mcp] cannot resolve '${spec}'. This plugin snapshot has no node_modules and no global ` +
+    `trantor install was found to borrow from. Fix: npm i -g trantor  (or: cd ${HERE} && npm install --omit=dev)`,
+  );
+}
+
+const { McpServer } = await dep("@modelcontextprotocol/sdk/server/mcp.js");
+const { StdioServerTransport } = await dep("@modelcontextprotocol/sdk/server/stdio.js");
+const { z } = await dep("zod");
 
 // Stable project key: RELAY_PROJECT > git-repo-root basename > cwd basename. Keying by
 // the git root (not a loose cwd basename) stops one repo fragmenting into several lanes.
@@ -166,7 +211,7 @@ server.tool("relay_board", "Show a project's Kanban board (all cards + their sta
   return { content: [{ type: "text", text: `${proj} board\n${cols.join("\n")}` }] };
 });
 
-server.tool("relay_peers", "List other Claude sessions connected to the relay (online in last 5 min).", {}, async () => {
+server.tool("relay_peers", "Find who you can talk to: the live agent sessions on the relay (online in last 5 min), including sessions in projects linked to yours. Call this BEFORE concluding you have no way to reach someone — the session ids it returns are what relay_send takes.", {}, async () => {
   const { peers } = await api("GET", "/peers");
   const lines = peers.map(p => {
     // health surfaces a failing-but-alive agent (runner-reported) — not a green lie
@@ -177,7 +222,7 @@ server.tool("relay_peers", "List other Claude sessions connected to the relay (o
   return { content: [{ type: "text", text: lines.join("\n") || "no peers yet" }] };
 });
 
-server.tool("relay_send", "Send a live message to another Claude session (or 'all' to broadcast).",
+server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project sends are allowed.",
   { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body") },
   async ({ to, text }) => {
     // The event log is append-only — a secret in it is unrecoverable, so refuse BEFORE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.65",
+  "version": "0.17.67",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [