trantor 0.18.0 → 0.18.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -151,7 +151,15 @@ Fix the `→` lines (each CLI's own sign-in happens once, in that CLI) and re-ru
 until it's clean.
 
 Provider API keys (e.g. `DEEPSEEK_API_KEY`) live in one file: **`~/.agent-bus/.env`** — the
-crew runners source it automatically.
+crew runners source it automatically, and it wins over anything Scrooge has.
+
+That precedence is the point. Scrooge (the cheap-model router) keeps its own keys in
+`~/.token-scrooge/.env`, and if the crew has no key of its own it falls through to Scrooge's. That
+still works, but then one key authenticates both and your provider bill cannot tell them apart —
+a crew seat and a batch of grunt summaries land on the same line item. Give the crew **separate
+keys**, minted in the provider console rather than copied, and each shows up on its own line and
+can be capped independently. `trantor doctor` reports which key each surface resolves to, masked,
+under "provider keys".
 
 ## Your first build
 

package/bin/crew-runner.mjs

@@ -12,7 +12,7 @@ import { execSync, spawnSync } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject, resolveHub } from "../lib/project.mjs";
+import { resolveProject, resolveHub, withEnvFiles } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -301,8 +301,16 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   let cmd = (isFirst || (cli.sid && !sid)) ? cli.first : cli.next;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
   cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid);
+  // PRECEDENCE, and it is easy to get backwards — this is the second time.
+  // Each file is PREPENDED, so the one prepended LAST runs FIRST, and in shell the file that runs
+  // LAST wins. To make ~/.agent-bus/.env (the CREW layer) win it must be prepended FIRST, i.e.
+  // iterate the list in its written order — highest priority first. A `.reverse()` here inverted it
+  // and handed every seat Scrooge's key instead of the crew's, which is why one key was paying for
+  // both and no provider bill could tell them apart. `.reverse()` also mutated the array in place.
+  // Verified by test-crew-env.mjs, which runs the real shell rather than reading this comment.
+  // Priority order: the CREW layer first, the agent's own fallback (Scrooge's .env) after it.
   const envs = [join(homedir(), ".agent-bus", ".env"), cli.env].filter(f => f && existsSync(f));
-  for (const f of envs.reverse()) cmd = `set -a; source ${f}; set +a; ${cmd}`;   // ~/.agent-bus/.env wins
+  cmd = withEnvFiles(cmd, envs);
   log(`turn starting (${isFirst ? "fresh session" : "resume"})${MODEL ? ` · model=${MODEL}` : ""}`);
   cmuxStatus("building", "#4a90d9", "hammer", { priority: 50 });
   // inherit stdio so the window shows the agent working live; also capture for sid-parsing.

package/bin/doctor.mjs

@@ -139,6 +139,58 @@ for (const c of CLIS) {
 }
 if (!installed) warn("no crew CLIs found", "install at least one of: codex, gemini, kimi, opencode — Trantor orchestrates whatever you have");
 
+// ---- key attribution: WHICH key does each surface actually spend on? ------------------------
+// Provider keys resolve through a LAYERED lookup and nothing ever showed which layer won. On
+// 2026-08-25 a $14 DeepSeek day could not be explained: ~/.token-scrooge/.env held the only
+// DEEPSEEK_API_KEY, so Scrooge's `dev-infra` key was ALSO authenticating every crew seat (the
+// runner sources that file). Scrooge turned out to be 0.15% of the tokens on that key and the
+// crew was the other 99.85%, but the bill could not say so — one key, two jobs, one line item.
+//
+// The layers, highest priority first — this MIRRORS bin/crew-runner.mjs, which sources
+// ~/.agent-bus/.env last so it wins:
+//   1. the process environment
+//   2. ~/.agent-bus/.env      — the CREW layer (seats: opencode/deepseek/openrouter/dsh)
+//   3. ~/.token-scrooge/.env  — the SCROOGE layer (cheap-model grunt routing)
+section("provider keys (who spends on what)");
+const KEY_VARS = ["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY", "MOONSHOT_API_KEY", "ZAI_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "XAI_API_KEY"];
+const CREW_ENV = join(H, ".agent-bus", ".env");
+const SCROOGE_ENV = join(H, ".token-scrooge", ".env");
+const readEnvFile = (f) => {
+  const out = {};
+  try {
+    for (const line of readFileSync(f, "utf8").split("\n")) {
+      const m = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+      if (m) out[m[1]] = m[2].trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {}
+  return out;
+};
+// Never print a key. The suffix is enough to match a line item in a provider console.
+const mask = (v) => (!v ? "" : v.length <= 12 ? "****" : `${v.slice(0, 5)}…${v.slice(-4)}`);
+const crewEnv = readEnvFile(CREW_ENV), scroogeEnv = readEnvFile(SCROOGE_ENV);
+let anyKey = false, shared = 0; const sharedVars = [];
+for (const v of KEY_VARS) {
+  const crew = process.env[v] || crewEnv[v] || "";
+  const scrooge = process.env[v] || scroogeEnv[v] || "";
+  if (!crew && !scrooge) continue;
+  anyKey = true;
+  const crewSrc = process.env[v] ? "process env" : crewEnv[v] ? "~/.agent-bus/.env (crew)" : scroogeEnv[v] ? "~/.token-scrooge/.env (FALLBACK)" : "none";
+  const crewKey = crew || scrooge;
+  const scroogeFileKey = scroogeEnv[v] || "";
+  if (crewKey && scroogeFileKey && crewKey === scroogeFileKey) {
+    shared++; sharedVars.push(v);
+    note(`${v}: crew + Scrooge share ONE key ${mask(crewKey)} — spend is indistinguishable on the bill`);
+  } else {
+    ok(`${v}: crew ${mask(crewKey)} via ${crewSrc}${scroogeFileKey && scroogeFileKey !== crewKey ? ` · scrooge ${mask(scroogeFileKey)} via ~/.token-scrooge/.env` : ""}`);
+  }
+}
+if (!anyKey) note("no provider API keys found in env, ~/.agent-bus/.env or ~/.token-scrooge/.env");
+else if (!shared) ok("crew and Scrooge spend on separate keys — each shows up as its own line item");
+else {
+  warn(`${shared} provider key(s) do double duty (${sharedVars.join(", ")}) — a spike on the bill cannot be attributed to the crew or to Scrooge`,
+    `mint a second key per provider and give the CREW its own, e.g.: echo 'DEEPSEEK_API_KEY=<new-crew-key>' >> ~/.agent-bus/.env   (Scrooge keeps ~/.token-scrooge/.env; the runner sources ~/.agent-bus/.env last, so it wins)`);
+}
+
 // brain
 section("the brain");
 has("scrooge") || existsSync(join(H, ".local", "bin", "scrooge"))

package/lib/project.mjs

@@ -152,6 +152,21 @@ export function unsetProjectHub(project) {
 // to ~/.agent-bus/machine-id so it never drifts: RELAY_HOST_ID > persisted id > macOS LocalHostName
 // (stable, no domain) > hostname() without its domain suffix.
 let _hostId = null;
+// Wrap a command so it runs with the seat's provider keys loaded, highest-priority file FIRST.
+//
+// The ordering is the whole point and it has been wrong twice. Each file is PREPENDED, so the one
+// prepended LAST runs FIRST — and in shell, whichever runs LAST wins. Therefore the highest-priority
+// file must be prepended FIRST. Callers pass files in priority order (crew layer, then fallbacks).
+//
+// Getting it backwards silently handed every crew seat Scrooge's API key, so one key authenticated
+// both and no provider bill could attribute a spend spike to either. test-crew-env.mjs proves this
+// against a REAL shell, because the last time it was wrong the comment above it said it was right.
+export function withEnvFiles(cmd, files = []) {
+  let out = cmd;
+  for (const f of files) if (f) out = `set -a; source ${f}; set +a; ${out}`;
+  return out;
+}
+
 export function hostId() {
   if (_hostId) return _hostId;
   if (process.env.RELAY_HOST_ID) return (_hostId = process.env.RELAY_HOST_ID.slice(0, 60));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [