trantor 0.17.99 → 0.18.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.99",
+  "version": "0.18.1",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -151,7 +151,15 @@ Fix the `→` lines (each CLI's own sign-in happens once, in that CLI) and re-ru
 until it's clean.
 
 Provider API keys (e.g. `DEEPSEEK_API_KEY`) live in one file: **`~/.agent-bus/.env`** — the
-crew runners source it automatically.
+crew runners source it automatically, and it wins over anything Scrooge has.
+
+That precedence is the point. Scrooge (the cheap-model router) keeps its own keys in
+`~/.token-scrooge/.env`, and if the crew has no key of its own it falls through to Scrooge's. That
+still works, but then one key authenticates both and your provider bill cannot tell them apart —
+a crew seat and a batch of grunt summaries land on the same line item. Give the crew **separate
+keys**, minted in the provider console rather than copied, and each shows up on its own line and
+can be capped independently. `trantor doctor` reports which key each surface resolves to, masked,
+under "provider keys".
 
 ## Your first build
 

package/bin/doctor.mjs

@@ -139,6 +139,58 @@ for (const c of CLIS) {
 }
 if (!installed) warn("no crew CLIs found", "install at least one of: codex, gemini, kimi, opencode — Trantor orchestrates whatever you have");
 
+// ---- key attribution: WHICH key does each surface actually spend on? ------------------------
+// Provider keys resolve through a LAYERED lookup and nothing ever showed which layer won. On
+// 2026-08-25 a $14 DeepSeek day could not be explained: ~/.token-scrooge/.env held the only
+// DEEPSEEK_API_KEY, so Scrooge's `dev-infra` key was ALSO authenticating every crew seat (the
+// runner sources that file). Scrooge turned out to be 0.15% of the tokens on that key and the
+// crew was the other 99.85%, but the bill could not say so — one key, two jobs, one line item.
+//
+// The layers, highest priority first — this MIRRORS bin/crew-runner.mjs, which sources
+// ~/.agent-bus/.env last so it wins:
+//   1. the process environment
+//   2. ~/.agent-bus/.env      — the CREW layer (seats: opencode/deepseek/openrouter/dsh)
+//   3. ~/.token-scrooge/.env  — the SCROOGE layer (cheap-model grunt routing)
+section("provider keys (who spends on what)");
+const KEY_VARS = ["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY", "MOONSHOT_API_KEY", "ZAI_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "XAI_API_KEY"];
+const CREW_ENV = join(H, ".agent-bus", ".env");
+const SCROOGE_ENV = join(H, ".token-scrooge", ".env");
+const readEnvFile = (f) => {
+  const out = {};
+  try {
+    for (const line of readFileSync(f, "utf8").split("\n")) {
+      const m = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+      if (m) out[m[1]] = m[2].trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {}
+  return out;
+};
+// Never print a key. The suffix is enough to match a line item in a provider console.
+const mask = (v) => (!v ? "" : v.length <= 12 ? "****" : `${v.slice(0, 5)}…${v.slice(-4)}`);
+const crewEnv = readEnvFile(CREW_ENV), scroogeEnv = readEnvFile(SCROOGE_ENV);
+let anyKey = false, shared = 0; const sharedVars = [];
+for (const v of KEY_VARS) {
+  const crew = process.env[v] || crewEnv[v] || "";
+  const scrooge = process.env[v] || scroogeEnv[v] || "";
+  if (!crew && !scrooge) continue;
+  anyKey = true;
+  const crewSrc = process.env[v] ? "process env" : crewEnv[v] ? "~/.agent-bus/.env (crew)" : scroogeEnv[v] ? "~/.token-scrooge/.env (FALLBACK)" : "none";
+  const crewKey = crew || scrooge;
+  const scroogeFileKey = scroogeEnv[v] || "";
+  if (crewKey && scroogeFileKey && crewKey === scroogeFileKey) {
+    shared++; sharedVars.push(v);
+    note(`${v}: crew + Scrooge share ONE key ${mask(crewKey)} — spend is indistinguishable on the bill`);
+  } else {
+    ok(`${v}: crew ${mask(crewKey)} via ${crewSrc}${scroogeFileKey && scroogeFileKey !== crewKey ? ` · scrooge ${mask(scroogeFileKey)} via ~/.token-scrooge/.env` : ""}`);
+  }
+}
+if (!anyKey) note("no provider API keys found in env, ~/.agent-bus/.env or ~/.token-scrooge/.env");
+else if (!shared) ok("crew and Scrooge spend on separate keys — each shows up as its own line item");
+else {
+  warn(`${shared} provider key(s) do double duty (${sharedVars.join(", ")}) — a spike on the bill cannot be attributed to the crew or to Scrooge`,
+    `mint a second key per provider and give the CREW its own, e.g.: echo 'DEEPSEEK_API_KEY=<new-crew-key>' >> ~/.agent-bus/.env   (Scrooge keeps ~/.token-scrooge/.env; the runner sources ~/.agent-bus/.env last, so it wins)`);
+}
+
 // brain
 section("the brain");
 has("scrooge") || existsSync(join(H, ".local", "bin", "scrooge"))

package/hub.mjs

@@ -111,7 +111,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "", contractReap: {} };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "", contractReap: {}, eventSeq: 0 };
 }
 
 const CARD_LOG_MAX = 40;
@@ -188,6 +188,14 @@ function normalizeState(loaded = {}) {
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
   s.dutySession = String(loaded.dutySession || "");
   s.contractReap = loaded.contractReap && typeof loaded.contractReap === "object" ? loaded.contractReap : {};
+  // The event id high-water mark. Seeded from the store's own MAX(id) where it supplied one, and
+  // otherwise from the largest id in the array — never from the array TAIL, which is exactly the
+  // assumption that let a clobbered id mint colliding event ids and kill the log.
+  s.eventSeq = Math.max(
+    Number(loaded.eventSeq || 0),
+    ...s.events.map(e => Number(e?.id) || 0),
+    0,
+  );
   for (const [session, v] of Object.entries(loaded.peers || {})) {
     // migrate old numeric form
     s.peers[session] = typeof v === "number"
@@ -203,6 +211,11 @@ if (STORE_KIND === "pg" || STORE_KIND === "postgres") {
   try {
     const { createPgStore } = await import("./lib/store-pg.mjs");
     durableStore = createPgStore({ url: PG_URL });
+    // An event insert that hits ON CONFLICT DO NOTHING is a LOST append, not a no-op. Silence here
+    // hid a dead log for 18 days. Never let it be quiet again.
+    durableStore.onDroppedEvent = ({ id, type }) => {
+      process.stderr.write(`[trantor] EVENT DROPPED: id ${id} (${type}) already exists — the append-only log is not appending. This is a bug, not routine.\n`);
+    };
     await durableStore.init();
     if (ORG_ID !== DEFAULT_ORG) await durableStore.createOrg({ id: ORG_ID, name: ORG_ID, ownerPubkey: "local-owner" });
     state = normalizeState(await durableStore.loadSnapshot(ORG_ID));
@@ -1039,8 +1052,13 @@ const CARD_TYPES = new Set(["created", "moved", "updated"]);
 const isCardEvent = e => CARD_TYPES.has(e?.type);
 
 function appendEvent(type, project, by, extra = {}) {
+  // The id comes from a monotonic high-water mark, NOT from the tail of the array. Trusting the tail
+  // meant one bad id anywhere in the log made every future append collide, and ON CONFLICT DO NOTHING
+  // then dropped them all without a word. `extra` is spread FIRST so a stray id in a payload can
+  // never take over the event's own identity.
   const last = state.events[state.events.length - 1];
-  const ev = { id: (last?.id || 0) + 1, ts: now(), type, project: project || "", by: by || "", ...extra };
+  state.eventSeq = Math.max(Number(state.eventSeq || 0), Number(last?.id) || 0) + 1;
+  const ev = { ...extra, id: state.eventSeq, ts: now(), type, project: project || "", by: by || "" };
   state.events.push(ev);
   if (state.events.length > EVENT_CAP) state.events.splice(0, state.events.length - EVENT_CAP);
   pushEventToStreams(ev);
@@ -1307,7 +1325,11 @@ const server = http.createServer(async (req, res) => {
       }
       for (const e of (Array.isArray(b.events) ? b.events : [])) {
         const last = state.events[state.events.length - 1];
-        const ev = { ...e, id: (last?.id || 0) + 1, project: proj };
+        // Spread the incoming event FIRST, then stamp OUR id and project over it. The incoming `id`
+        // belongs to the other hub's log and must not survive in any form: carried into the payload
+        // it comes back on load and overwrites the real row id.
+        state.eventSeq = Math.max(Number(state.eventSeq || 0), Number(last?.id) || 0) + 1;
+        const ev = { ...e, id: state.eventSeq, project: proj };
         if (ev.taskId != null && remap.has(Number(ev.taskId))) ev.taskId = remap.get(Number(ev.taskId));
         state.events.push(ev); added.events++;
       }
@@ -2426,13 +2448,20 @@ const server = http.createServer(async (req, res) => {
       const windowMs = Math.max(60000, Number(q.windowMs || CONTRACT_WINDOW_MS));
       const rawOverdue = q.overdueMs === undefined || q.overdueMs === "" ? null : Number(q.overdueMs);
       const overdueMs = Number.isFinite(rawOverdue) ? Math.max(0, rawOverdue) : null;
-      const out = contractsFor(session, { project: String(q.project || ""), windowMs, overdueMs });
-      const by = (d) => out.filter(c => c.disposition === d).length;
-      // `open` stays the count a caller has to DO something about, which is what it always meant.
-      // Abandoned ones are reported separately: they are the ledger's record of what died, not work.
+      const all = contractsFor(session, { project: String(q.project || ""), windowMs, overdueMs });
+      const by = (d) => all.filter(c => c.disposition === d).length;
+      // Abandoned contracts leave `contracts` entirely and ride in their own key.
+      //
+      // Not cosmetic. A session's hooks are PINNED at session start, so an older stop hook iterates
+      // `contracts` with its own predicate and knows nothing about `disposition` — it kept blocking on
+      // ghosts no matter what the hub called them. Keeping them in the array meant the fix only
+      // reached sessions that restarted, and a live one nagged its operator every single turn.
+      // Splitting them out fixes every running session the moment the hub redeploys, and the ledger
+      // still shows what died via `abandonedContracts`.
+      const out = all.filter(c => c.disposition !== "abandoned");
       return json(res, 200, {
-        session, contracts: out,
-        open: out.filter(c => !c.answered && c.disposition !== "abandoned").length,
+        session, contracts: out, abandonedContracts: all.filter(c => c.disposition === "abandoned"),
+        open: out.filter(c => !c.answered).length,
         waiting: by("waiting"), stalled: by("stalled"), abandoned: by("abandoned"), answered: by("answered"),
       });
     }

package/lib/store-pg.mjs

@@ -10,24 +10,34 @@ const ms = (v, fallback = Date.now()) => {
 };
 const num = (v) => (v == null ? v : Number(v));
 
+const EVENT_COLUMN_KEYS = ["id", "ts", "type", "project", "by", "by_session", "taskId", "task_id", "payload"];
 function stripEventPayload(evt = {}) {
   const payload = { ...(evt.payload && typeof evt.payload === "object" ? evt.payload : {}) };
+  // The nested payload gets the same treatment as the top level. It used to be copied in wholesale,
+  // so a column key riding inside it (an `id` from an imported event) was stored and then clobbered
+  // the real column on the way back out.
+  for (const k of EVENT_COLUMN_KEYS) delete payload[k];
   for (const [k, v] of Object.entries(evt)) {
-    if (["id", "ts", "type", "project", "by", "by_session", "taskId", "task_id", "payload"].includes(k)) continue;
+    if (EVENT_COLUMN_KEYS.includes(k)) continue;
     payload[k] = v;
   }
   return payload;
 }
 
+// The COLUMNS are the truth; the payload is only the fields that have no column. Spreading payload
+// LAST let a stored `id` overwrite the row id, and that silently killed the append-only log for 18
+// days: 1198 rows (8706..9903 on the production hub) carried a shadow payload id, so on load the
+// array tail reported id 4655 instead of 9903, appendEvent then minted 4656 and every insert after
+// that hit ON CONFLICT (id) DO NOTHING. Payload first, columns after: a column can never be clobbered.
 function eventFromRow(row) {
   const payload = row.payload && typeof row.payload === "object" ? row.payload : {};
   const ev = {
+    ...payload,
     id: Number(row.id),
     ts: Number(row.ts),
     type: row.type,
     project: row.project || "",
     by: row.by_session || "",
-    ...payload,
   };
   if (row.task_id != null) ev.taskId = Number(row.task_id);
   return ev;
@@ -129,6 +139,7 @@ function kvFromState(state) {
       verifyGateSeq: Number(state.verifyGateSeq || 0),
       proposalSeq: Number(state.proposalSeq || 0),
       cardEventsBackfilled: !!state.cardEventsBackfilled,
+      eventSeq: Number(state.eventSeq || 0),
       inviteTokens: state.inviteTokens || {},
       instances: state.instances || {},
     },
@@ -542,12 +553,18 @@ export class PgStore {
       }
       if (tasks.deletes.length) await c.query("DELETE FROM tasks WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, tasks.deletes]);
       for (const e of events.upserts) {
-        await c.query(
+        const r = await c.query(
           `INSERT INTO events(id, org_id, ts, type, project, by_session, task_id, payload)
            VALUES($1,$2,$3,$4,$5,$6,$7,$8::jsonb)
            ON CONFLICT (id) DO NOTHING`,
           [Number(e.id), orgId, ms(e.ts), e.type || "", e.project || "", e.by || "", e.taskId ?? null, JSON.stringify(stripEventPayload(e))],
         );
+        // DO NOTHING protects a foreign row, but it also swallows a REAL append when the id collides.
+        // That is what hid the dead log for 18 days: every event was dropped and nothing said a word.
+        // A conflict here is never routine, so say so.
+        if (r?.rowCount === 0) {
+          this.onDroppedEvent?.({ id: Number(e.id), type: e.type || "", orgId });
+        }
       }
       if (events.deletes.length) await c.query("DELETE FROM events WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, events.deletes]);
       if (events.upserts.length) await c.query("SELECT setval(pg_get_serial_sequence('events','id'), GREATEST((SELECT COALESCE(MAX(id),0) FROM events), 1), true)");
@@ -634,13 +651,18 @@ export class PgStore {
   }
 
   async loadSnapshot(orgId) {
-    const [tasks, peersRows, eventsRows, messagesRows, identitiesRows, kvRows] = await Promise.all([
+    const [tasks, peersRows, eventsRows, messagesRows, identitiesRows, kvRows, eventMaxRow] = await Promise.all([
       this.pool.query("SELECT * FROM tasks WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM peers WHERE org_id=$1 ORDER BY session ASC", [orgId]),
       this.pool.query("SELECT * FROM events WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM messages WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM identities WHERE org_id=$1 ORDER BY created_at ASC", [orgId]),
       this.pool.query("SELECT key, value FROM kv WHERE org_id=$1", [orgId]),
+      // The authoritative high-water mark for event ids. Deriving it from the loaded array is what
+      // broke: a clobbered tail reported a lower id than the table actually held. Ask the table.
+      // Deliberately NOT scoped to org: the events primary key is (id) alone, so the id space is
+      // global and a per-org max would still collide across orgs.
+      this.pool.query("SELECT COALESCE(MAX(id),0) AS max_id FROM events"),
     ]);
     const kv = Object.fromEntries(kvRows.rows.map(r => [r.key, r.value]));
     const peers = {};
@@ -683,6 +705,7 @@ export class PgStore {
       focus: kv.focus && typeof kv.focus === "object" ? kv.focus : {},
       orgPolicy: kv.orgPolicy && typeof kv.orgPolicy === "object" ? kv.orgPolicy : {},
       contractReap: kv.contractReap && typeof kv.contractReap === "object" ? kv.contractReap : {},
+      eventSeq: Math.max(Number(eventMaxRow?.rows?.[0]?.max_id || 0), Number(meta.eventSeq || 0)),
     };
   }
 }

package/mcp.mjs

@@ -141,7 +141,9 @@ server.tool("relay_contracts", "What you dispatched and are still owed. Lists ev
     let r;
     try { r = await api("GET", `/contracts?session=${encodeURIComponent(SESSION)}&project=${encodeURIComponent(PROJECT)}`); }
     catch (e) { return { content: [{ type: "text", text: `could not reach the hub: ${e?.message || e}` }] }; }
-    const all = r?.contracts || [];
+    // The hub keeps abandoned contracts in their own key so older stop hooks stop blocking on them.
+    // The ledger still wants to SHOW them, so put the two halves back together here.
+    const all = [...(r?.contracts || []), ...(r?.abandonedContracts || [])].sort((a, b) => a.ts - b.ts);
     if (!all.length) return { content: [{ type: "text", text: "You have not dispatched any contracts in the last 24h." }] };
     // Fall back to the pre-disposition shape when talking to an older hub.
     const disp = (c) => c.disposition || (c.answered ? "answered" : (c.assigneeOnline ? "waiting" : "stalled"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.99",
+  "version": "0.18.1",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"