trantor 0.18.11 → 0.18.13

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.11",
+  "version": "0.18.13",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/advise.mjs

@@ -90,14 +90,19 @@ export function loadWorld() {
 
 const tierOf = (profile, prov) => profile?.providers?.[prov]?.tier || "api";
 
+const FLASH_TIER = /(flash|turbo|lite|mini|highspeed|small)/i;
+
 // pick the cheapest Scrooge model that clears the difficulty floor for a task kind
 export function scroogeModelFor(registry, caps, kind = "code", difficulty = "easy") {
   const floor = { easy: 0, medium: 35, hard: 55 }[difficulty] ?? 0;
   const cands = Object.entries(registry.models || {})
     .filter(([, m]) => (m.good_for || []).includes(kind))
-    .filter(([id]) => (caps[id]?.coding ?? caps[id]?.intelligence ?? 40) >= floor)
-    .sort((a, b) => (a[1].cost_in + a[1].cost_out) - (b[1].cost_in + b[1].cost_out));
-  return cands[0] ? { model: cands[0][0], cost_in: cands[0][1].cost_in, cost_out: cands[0][1].cost_out } : null;
+    .filter(([id]) => (caps[id]?.coding ?? caps[id]?.intelligence ?? 40) >= floor);
+  const hard = difficulty === "hard";
+  const strong = hard ? cands.filter(([id]) => !FLASH_TIER.test(id)) : cands;
+  const pool = strong.length > 0 ? strong : cands;
+  pool.sort((a, b) => (a[1].cost_in + a[1].cost_out) - (b[1].cost_in + b[1].cost_out));
+  return pool[0] ? { model: pool[0][0], cost_in: pool[0][1].cost_in, cost_out: pool[0][1].cost_out } : null;
 }
 
 // crude per-package token forecast (input+output through the executor)

package/bin/baton.mjs

@@ -35,6 +35,13 @@ const transcript = findTranscript();
 const sessionId = transcript ? basename(transcript, ".jsonl") : "";
 const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger: "manual-cli", force: true });   // manual = intentional, bypass the storm guard
 console.log(`📋 handoff saved for ${project}: ${file}`);
+// --write-only: the in-app flow (#5509). The app ends the pane's session itself and reopens it
+// through `trantor open`, which claims this handoff — a Terminal window here would be exactly the
+// wrong surface, so the flag writes, announces, and stops.
+if (process.argv.includes("--write-only")) {
+  console.log(`🔄 write-only: no window spawned — the pane takeover (trantor open) claims it next.`);
+  process.exit(0);
+}
 const { spawned, armed, windowId } = spawnBaton({ projectDir: cwd, handoffFile: file });
 console.log(spawned
   ? `🔄 baton: a fresh session is opening (it'll recap the handoff)${armed ? ` — this window (${windowId}) closes once it takes over` : " — couldn't detect this window; close it yourself once the new one is up"}`

package/bin/cli.mjs

@@ -73,6 +73,7 @@ switch (cmd) {
   case "recost": run("bin/recost.mjs"); break;
   case "handoff": run("bin/baton.mjs"); break;
   case "adopt": run("bin/adopt.mjs"); break;
+  case "takeover": run("bin/takeover.mjs"); break;
   case "summarize": run("bin/summarize.mjs"); break;
   case "policy": run("bin/policy.mjs"); break;
   case "proposals": case "proposal": run("bin/proposals.mjs"); break;
@@ -195,6 +196,7 @@ switch (cmd) {
   trantor herdr       install|remove|status the login agent that keeps panes alive across a reboot
   trantor autonomy    how much Trantor may do unasked: seats, your harness, commit/push/deploy
   trantor adopt       take over a session already running in a Terminal, then open it here
+  trantor takeover    the whole move in one command: idle-gate the Terminal session, end it gracefully, adopt, open in the pane — [--force] [--session <id>] [--dry-run]
   trantor integrate   collect the crew's work, merge it, verify it, push it (--dry-run to rehearse)
   trantor down        tear the crew down (kills processes, closes windows, no dialogs)
   trantor prune       drop dead crew-window tracking rows (ghost workspaces/panes) without spawning anything

package/bin/crew-runner.mjs

@@ -44,7 +44,22 @@ function ensureSeatWorktree(sourceDir) {
   const branch = `seat/${AGENT}`;
   if (existsSync(seatDir)) {
     const ok = gitOut(["-C", seatDir, "rev-parse", "--is-inside-work-tree"], seatDir) === "true";
-    if (ok) return seatDir;
+    if (ok) {
+      // #5403: a worktree created once builds against THAT day's main forever — every wave since
+      // has needed a hand fast-forward. Refresh only when it is CLEAN: a dirty tree is a seat's
+      // unintegrated work and a diverged branch is a decision, and refreshing must never eat
+      // either. Failure to refresh is loud but non-fatal: stale beats broken.
+      const dirty = gitOut(["-C", seatDir, "status", "--porcelain"], seatDir);
+      if (dirty === "") {
+        const head = gitOut(["-C", root, "rev-parse", "HEAD"], root);
+        const ff = head && spawnSync("git", ["-C", seatDir, "merge", "--ff-only", head], { stdio: "ignore", timeout: 15000 });
+        if (ff && ff.status === 0) console.log(`\x1b[2m[runner]\x1b[0m ${branch} worktree refreshed to ${head.slice(0, 7)}`);
+        else console.log(`\x1b[33m[runner]\x1b[0m ${branch} worktree diverged from main HEAD — left as-is (integrate or reset it)`);
+      } else {
+        console.log(`\x1b[33m[runner]\x1b[0m ${branch} worktree has uncommitted work — not refreshed`);
+      }
+      return seatDir;
+    }
     console.log(`\x1b[33m[runner]\x1b[0m worktree path exists but is not a git worktree: ${seatDir} — using ${sourceDir}`);
     return sourceDir;
   }

package/bin/models.mjs

@@ -25,9 +25,14 @@ const liveModels = (providerOc) => {
   catch { return []; }
 };
 
+const FLASH_TIER = /(flash|turbo|lite|mini|highspeed|small)/i;
+
 function routePick(candList, diff) {
   try {
-    const out = execSync(`python3 ${SCROOGE} route --candidates ${JSON.stringify(candList.join(" "))} -t code -d ${diff} --json 2>/dev/null`, { encoding: "utf8" });
+    const hard = diff === "hard";
+    const strong = hard ? candList.filter(id => !FLASH_TIER.test(id)) : candList;
+    const pool = strong.length > 0 ? strong : candList;
+    const out = execSync(`python3 ${SCROOGE} route --candidates ${JSON.stringify(pool.join(" "))} -t code -d ${diff} --json 2>/dev/null`, { encoding: "utf8" });
     return JSON.parse(out).qualified || "?";
   } catch { return "?"; }
 }

package/bin/takeover.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// `trantor takeover` — one command from "the conversation lives in a Terminal window" to "it
+// lives in the pane" (#5495, design: docs/DESIGN-takeover-visibility.md).
+//
+// The chain: inventory → idle gate → graceful end → adopt → open. CLI-first on purpose: the
+// app's button shells THIS command (takeover_now), so the terminal user and the button share one
+// tested implementation — the handoff_now pattern.
+//
+// What this must never do, from the design:
+// - never end a session that wrote its transcript seconds ago without --force (in-flight work);
+// - never pick silently between two live candidates (refuse and show both; --session decides);
+// - never leave the operator with nothing: if open fails after the terminal claude exited, print
+//   the exact `claude --resume <sid>` that recovers the thread by hand.
+import { readdirSync, statSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { execFileSync, spawnSync } from "node:child_process";
+import { resolveProject } from "../lib/project.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const args = process.argv.slice(2);
+const flag = (n) => args.includes(n);
+const opt = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const JSON_OUT = flag("--json");
+const stages = [];
+const say = (s) => { stages.push(s); if (!JSON_OUT) console.log(s); };
+const out = (ok, extra = {}) => {
+  if (JSON_OUT) console.log(JSON.stringify({ ok, stages, ...extra }));
+  process.exit(ok ? 0 : 2);
+};
+
+const project = args.find(a => !a.startsWith("--") && args[args.indexOf(a) - 1] !== "--session")
+  || resolveProject(process.cwd());
+const devRoot = process.env.TRANTOR_DEV_ROOT || join(homedir(), "development");
+const dir = join(devRoot, project);
+if (!existsSync(dir)) { say(`no local checkout for ${project} (looked in ${devRoot})`); out(false, { reason: "no-checkout" }); }
+
+// The idle gate: a transcript written this recently means the session is MID-TURN, and ending it
+// would eat in-flight work. Overridable for drills and deliberate --force.
+export const IDLE_GATE_SEC = Number(process.env.TRANTOR_TAKEOVER_IDLE_SEC || 15);
+
+/** The decision table, pure so it can be drilled without processes (test-takeover.mjs). */
+export function decide({ terminalPids, candidates, sessionFlag, force, idleGateSec = IDLE_GATE_SEC }) {
+  if (!terminalPids.length) return { action: "open", reason: "no terminal session — plain open (start or reopen the pane)" };
+  if (terminalPids.length > 1) {
+    return { action: "refuse", reason: `${terminalPids.length} claude sessions run in this directory (pids ${terminalPids.join(", ")}) — close the extras first; a takeover must know which conversation it is adopting` };
+  }
+  if (!candidates.length) return { action: "refuse", reason: "a claude runs here but no transcript has been written in the last hour — nothing safe to adopt" };
+  const chosen = sessionFlag ? candidates.find(c => c.id === sessionFlag) : candidates[0];
+  if (sessionFlag && !chosen) return { action: "refuse", reason: `${sessionFlag} is not among the recent transcripts here` };
+  if (!sessionFlag && candidates.length > 1) {
+    const list = candidates.slice(0, 4).map(c => `${c.id} (${c.ageSec}s ago)`).join(" · ");
+    return { action: "refuse", reason: `two live conversations here — pick one with --session <id>: ${list}` };
+  }
+  if (chosen.ageSec < idleGateSec && !force) {
+    return { action: "refuse", reason: `looks MID-TURN (transcript written ${chosen.ageSec}s ago, gate ${idleGateSec}s) — wait for the turn to finish, or --force` };
+  }
+  return { action: "takeover", sid: chosen.id, pid: terminalPids[0] };
+}
+
+// ---- inventory (process + filesystem truth only) ----------------------------------------------
+function paneForegroundPgid() {
+  try {
+    const rows = execFileSync("cat", [join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "crew-windows.txt")], { encoding: "utf8" });
+    const pane = rows.split("\n").map(l => l.split("\t")).find(f => f[0] === project && f[1] === "orch")?.[3];
+    if (!pane) return 0;
+    const info = execFileSync("herdr", ["pane", "process-info", "--pane", pane], { encoding: "utf8", timeout: 6000 });
+    return Number(JSON.parse(info.slice(info.search(/[[{]/)))?.result?.process_info?.foreground_process_group_id) || 0;
+  } catch { return 0; }
+}
+
+function terminalClaudePids() {
+  let pids = [];
+  try { pids = execFileSync("/usr/bin/pgrep", ["-x", "claude"], { encoding: "utf8" }).split("\n").filter(Boolean); } catch { return []; }
+  const panePgid = paneForegroundPgid();
+  const mine = [];
+  for (const pid of pids) {
+    if (Number(pid) === panePgid) continue;   // the pane's own claude is not a "terminal session"
+    try {
+      const cwd = execFileSync("/usr/sbin/lsof", ["-a", "-d", "cwd", "-p", pid, "-Fn"], { encoding: "utf8" })
+        .split("\n").find(l => l.startsWith("n"))?.slice(1);
+      if (cwd === dir) mine.push(Number(pid));
+    } catch { /* raced away */ }
+  }
+  return mine;
+}
+
+function recentCandidates() {
+  const slug = dir.replace(/[/.]/g, "-");
+  const tdir = join(process.env.TRANTOR_CLAUDE_DIR || join(homedir(), ".claude", "projects"), slug);
+  if (!existsSync(tdir)) return [];
+  const now = Date.now();
+  return readdirSync(tdir).filter(f => f.endsWith(".jsonl"))
+    .map(f => { const st = statSync(join(tdir, f)); return { id: f.replace(/\.jsonl$/, ""), ageSec: Math.round((now - st.mtimeMs) / 1000) }; })
+    .filter(c => c.ageSec < 3600)
+    .sort((a, b) => a.ageSec - b.ageSec);
+}
+
+// ---- the chain --------------------------------------------------------------------------------
+// Run the chain ONLY when this file is the entrypoint. The first cut used
+// argv[1].endsWith("takeover.mjs"), which is also true for test-takeover.mjs — importing the
+// decision table from the drill file executed a real (luckily idempotent) pane open.
+import { basename as _bn } from "node:path";
+if (process.argv[1] && _bn(process.argv[1]) === "takeover.mjs") {
+  const d = decide({ terminalPids: terminalClaudePids(), candidates: recentCandidates(), sessionFlag: opt("--session"), force: flag("--force") });
+  if (flag("--dry-run")) { say(`dry-run: ${d.action}${d.reason ? ` — ${d.reason}` : ""}${d.sid ? ` (sid ${d.sid}, pid ${d.pid})` : ""}`); out(true, { decision: d }); }
+  if (d.action === "refuse") { say(d.reason); out(false, { reason: d.reason }); }
+
+  if (d.action === "takeover") {
+    say(`ending Terminal session pid ${d.pid} (idle ${IDLE_GATE_SEC}s gate passed)`);
+    try { process.kill(d.pid, "SIGTERM"); } catch {}
+    const deadline = Date.now() + 8000;
+    let alive = true;
+    while (alive && Date.now() < deadline) {
+      try { process.kill(d.pid, 0); spawnSync("sleep", ["0.3"]); } catch { alive = false; }
+    }
+    if (alive) { try { process.kill(d.pid, "SIGKILL"); } catch {} say("did not exit in 8s — killed"); }
+    else say("session ended cleanly");
+
+    const adopt = spawnSync(process.execPath, [join(HERE, "adopt.mjs"), project, "--session", d.sid], { encoding: "utf8", timeout: 20000 });
+    if (adopt.status !== 0) { say(`adopt failed: ${(adopt.stderr || adopt.stdout || "").trim().slice(0, 200)}`); out(false, { reason: "adopt-failed", sid: d.sid }); }
+    say(`adopted ${d.sid} as ${project}'s orchestrator thread`);
+  }
+
+  const open = spawnSync("bash", [join(HERE, "crew.sh"), "open", project], { cwd: dir, encoding: "utf8", timeout: 120000 });
+  if (open.status !== 0) {
+    say(`open failed: ${(open.stderr || "").trim().slice(0, 200)}`);
+    if (d.sid) say(`the conversation is safe on disk — recover by hand: claude --resume ${d.sid}`);
+    out(false, { reason: "open-failed", sid: d.sid || null });
+  }
+  say(`pane hosted: ${(open.stdout || "").trim().split("\n").pop()}`);
+  out(true, { sid: d.sid || null });
+}

package/hooks/lib/handoff.mjs

@@ -423,6 +423,10 @@ export function maybeSpawn(projectDir, conf = readConfig()) {
     if (process.platform !== "darwin") return false;
     if (process.env.TRANTOR_NO_HANDOFF_SPAWN === "1") return false;
     if (conf.autoHandoffPrompt === false) return false;
+    if (hasOrchPane(basename(projectDir))) {
+      process.stderr.write(`[trantor] orch pane hosts ${basename(projectDir)} — no Terminal window; the pane claims the handoff on its next open\n`);
+      return false;
+    }
     const script = join(HERE, "..", "..", "bin", "handoff-prompt.sh");
     if (!existsSync(script)) { process.stderr.write(`[trantor] handoff-prompt.sh missing\n`); return false; }
     const timeout = String(conf.handoffPromptTimeout || 25);
@@ -446,9 +450,26 @@ export function spawnSuppressed() {
   return process.env.TRANTOR_NO_HANDOFF_SPAWN === "1" || process.env.TRANTOR_NO_BATON_SPAWN === "1";
 }
 
+// Does this project have a hosted orchestrator pane? When it does, the PANE is the successor
+// surface: `trantor open` claims the handoff there, and spawning a Terminal window would put the
+// fresh session on exactly the surface the operator is trying to leave (#5509 W1). The tracked
+// row is the signal — rows are recorded by open and dropped by teardown/prune, and a stale row
+// costs only a skipped window, never a lost handoff (the handoff waits, held for the pane).
+export function hasOrchPane(projectName) {
+  try {
+    const state = join(process.env.AGENT_BUS_DIR || process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus"), "crew-windows.txt");
+    if (!existsSync(state)) return false;
+    return readFileSync(state, "utf8").split("\n").some(l => {
+      const f = l.split("\t");
+      return f[0] === projectName && f[1] === "orch";
+    });
+  } catch { return false; }
+}
+
 export function spawnFresh(projectDir) {
   try {
     if (process.platform !== "darwin" || spawnSuppressed()) return false;
+    if (hasOrchPane(basename(projectDir))) return false;   // the pane is the successor surface (#5509)
     const script = join(HERE, "..", "..", "bin", "open-session.sh");
     if (!existsSync(script)) return false;
     const child = spawn("/bin/bash", [script, projectDir, RECAP_CMD], { detached: true, stdio: "ignore" });

package/hub.mjs

@@ -752,6 +752,31 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
     if (c.ageMs < CONTRACT_ABANDON_MS) continue;
     if (c.ts < (newestAnswered.get(c.to) || 0)) c.disposition = "superseded";
   }
+  // ---- superseded by a later DIRECT reply: the morning case (#11047/#11048) --------------------
+  // A row can be unanswerable by a seat that is perfectly healthy: its later replies all carry `re`
+  // for NEWER contracts (a re-dispatch, or an "ack by reference" threaded to the newer id), so
+  // neither byRe nor the loose fallback ever claims the old row — the two matchers above only ever
+  // see replies aimed at the NEWER work. The row then sits WAITING forever: it can never be
+  // answered, it can never be abandoned (the seat is alive), and the newestAnswered rule above
+  // misses it whenever the newer work was dispatched under a peer identity the old row never shares.
+  //
+  // The signal both matchers ignored is the DIRECT reply itself: if the assignee has sent this
+  // session ANY message after the row was dispatched, the assignee is alive, reachable, and has
+  // demonstrably moved on to later work — an older row that has then sat unanswered past the
+  // abandon window is dead weight, not in flight. Age still gates it, so honest out-of-order
+  // completion (a seat that answered a newer job while still working an older one) is never
+  // punished — the older row stays open until the window that any genuine in-flight job would have
+  // reported within has passed.
+  const latestDirectReply = new Map();
+  for (const r of replies) {
+    if (r.ts > (latestDirectReply.get(r.from) || 0)) latestDirectReply.set(r.from, r.ts);
+  }
+  for (const c of out) {
+    if (c.answered || c.disposition === "abandoned") continue;
+    if (c.ageMs < CONTRACT_ABANDON_MS) continue;
+    const latest = latestDirectReply.get(c.to);
+    if (latest != null && c.ts < latest) c.disposition = "superseded";
+  }
   return out;
 }
 
@@ -1821,6 +1846,13 @@ const server = http.createServer(async (req, res) => {
         (t.history ||= []).push({ from: t.status, to: b.status, by: b.by || "", ts: now() });
         if (t.history.length > 40) t.history.splice(0, 10);
         t.status = b.status;
+        // WHO is actually working this card — the SIGNED mover, not the assignee. A card filed by
+        // the orchestrator and built by a seat wore the orchestrator's face on every board
+        // (2026-08-28, operator caught it: "they all say claude"). The assignee stays intent;
+        // workedBy is evidence, stamped only on real work moves and never from a self-asserted by.
+        if (["doing","testing","done"].includes(b.status) && auth?.identity?.name) {
+          t.workedBy = String(auth.identity.name).slice(0, 120);
+        }
       }
       if (b.difficulty && ["easy","medium","hard"].includes(b.difficulty)) t.difficulty = b.difficulty;
       if (b.model !== undefined) t.model = String(b.model).slice(0, 60);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.11",
+  "version": "0.18.13",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"