trantor 0.18.118 → 0.18.119

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.118",
+  "version": "0.18.119",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -169,15 +169,15 @@ switch (cmd) {
     break;
   }
   case "invite": {
-    const { loadOrCreate, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+    const { resolveOwnerIdentity, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
     const nameIdx = args.indexOf("--name"), scopeIdx = args.indexOf("--scope");
     const name = nameIdx >= 0 ? args[nameIdx + 1] : "";
     const scopeRaw = scopeIdx >= 0 ? (args[scopeIdx + 1] || "") : "";
     if (!name || !scopeRaw) { console.error("usage: trantor invite --name <name> --scope <project>:<role>"); process.exit(1); }
     const [project, role = "write"] = scopeRaw.split(":");
-    let hub = "http://127.0.0.1:4477";
-    try { hub = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || hub; } catch {}
-    const id = loadOrCreate("admin", "human");
+    const { resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
+    const hub = resolveHubInfo().url;
+    const id = await resolveOwnerIdentity(hub);
     const payload = { scopes: [{ project, role }], ttlSec: 86400 };
     const body = JSON.stringify(payload);
     const sig = signRequest(id, { method: "POST", path: "/invite", body });

package/bin/pair.mjs

@@ -21,15 +21,23 @@ if (!role || role.startsWith("--")) {
   process.exit(1);
 }
 
-const { load, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+const { resolveOwnerIdentity, phoneHubAddress, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
 const { resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
 
 const hub = resolveHubInfo().url.replace(/\/+$/, "");
-// The operator's owner key, the same one the desktop app signs with (hub.rs owner_identity).
-// Loaded, never minted: a fresh key is unknown to the hub and every invite would 401.
-const owner = process.env.TRANTOR_IDENTITY || "sasha@mac";
-const id = load(owner);
-if (!id) { console.error(`error: no key for the owner identity "${owner}". Set TRANTOR_IDENTITY, or run \`trantor keys status\``); process.exit(1); }
+let id, used;
+try {
+  const response = await fetch(`${hub}/health`, { signal: AbortSignal.timeout(8000) });
+  if (!response.ok) throw new Error(`hub health returned HTTP ${response.status}`);
+  const health = await response.json();
+  used = phoneHubAddress(hub, String(health.publicUrl || ""), forceTailnet);
+  id = await resolveOwnerIdentity(hub);
+} catch (error) {
+  const message = `Pairing failed: ${error.message}. Hub: ${hub}`;
+  if (asJson) console.log(JSON.stringify({ error: message }));
+  else console.error(message);
+  process.exit(1);
+}
 
 const payload = { scopes: [{ project: "*", role }], ttlSec: 600, kind: "human" };
 const body = JSON.stringify(payload);
@@ -64,21 +72,6 @@ if (!r.ok) {
   process.exit(1);
 }
 
-// v1.4: the link carries the hub's public address (Tailscale Funnel) so the phone pairs without
-// Tailscale. /invite itself always goes to the tailnet hub — owner routes never answer in public.
-// /health reports publicUrl; --tailnet forces the tailnet address. No publicUrl (or /health
-// unreachable — the invite already minted) falls back to the tailnet hub.
-const linkHub = (async () => {
-  if (forceTailnet) return { hub, public: false };
-  try {
-    const h = await fetch(`${hub}/health`).then((r) => r.json()).catch(() => ({}));
-    const pub = String(h.publicUrl || "").trim().replace(/\/+$/, "");
-    if (pub) return { hub: pub, public: true };
-  } catch {}
-  return { hub, public: false };
-})();
-
-const used = await linkHub;
 const link = `trantor://enroll?hub=${encodeURIComponent(used.hub)}&token=${j.token}`;
 const expiresAt = Number(j.expiresAt) || Date.now() + 600000;
 const mins = Math.max(0, Math.round((expiresAt - Date.now()) / 60000));

package/lib/identity.mjs

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSy
 import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { isIP } from "node:net";
 import { isTestIdentity } from "./test-identity-names.mjs";
 import { asFunction, asString } from "./decode.mjs";
 
@@ -207,6 +208,71 @@ export function publicView(identity) {
   return { name: identity.name, kind: identity.kind, pubkey: identity.pubkey, createdAt: identity.createdAt };
 }
 
+function loopbackHost(host) {
+  return ["localhost", "localhost.", "[::1]"].includes(host) || (isIP(host) === 4 && host.startsWith("127."));
+}
+
+export function loopbackHub(base) {
+  const url = new URL(base);
+  if (!/^https?:$/.test(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") return false;
+  return loopbackHost(url.hostname);
+}
+
+export function phoneHubAddress(base, publicUrl = "", forceTailnet = false) {
+  const hub = String(!forceTailnet && publicUrl || base).trim().replace(/\/+$/, "");
+  const url = new URL(hub);
+  if (!/^https?:$/.test(url.protocol) || loopbackHost(url.hostname) || ["0.0.0.0", "[::]"].includes(url.hostname)) {
+    throw new Error(`Your phone cannot reach ${hub}: this address only works on this Mac. Use Tailscale on the Mac and iPhone and configure the hub with the Mac's Tailscale address (then use trantor pair --tailnet), or configure a public hub URL.`);
+  }
+  return { hub, public: !forceTailnet && !!publicUrl };
+}
+
+// The hub's owner-only read verifies a candidate without minting an invite or changing scopes.
+export async function resolveOwnerIdentity(base) {
+  let config = {};
+  try { config = JSON.parse(readFileSync(join(busDir(), "config.json"), "utf8")); } catch {}
+  const explicit = process.env.TRANTOR_IDENTITY || process.env.RELAY_OWNER_IDENTITY || config.ownerIdentity;
+  const names = explicit ? [explicit] : listKeyNames().flatMap(file => {
+    try {
+      const record = JSON.parse(readFileSync(join(keysDir(), `${file}.json`), "utf8"));
+      return record.kind === "human" && record.name ? [record.name] : [];
+    } catch { return []; }
+  });
+  const request = async (id, path, payload) => {
+    const method = payload ? "POST" : "GET";
+    const body = payload ? JSON.stringify(payload) : undefined;
+    return fetch(`${base.replace(/\/+$/, "")}${path}`, {
+      method, body, redirect: "error", headers: { "content-type": "application/json", ...signRequest(id, { method, path, body }) },
+      signal: AbortSignal.timeout(8000),
+    });
+  };
+  let unavailable = "";
+  for (const name of names) {
+    const id = load(name);
+    if (!id) {
+      unavailable = `The key for "${name}" is unavailable on this Mac. Unlock the identity Keychain or restore this identity's key.`;
+      continue;
+    }
+    const response = await request(id, "/keys/usage");
+    if (response.ok) return id;
+    if (response.status === 401 && loopbackHub(base)) {
+      const error = await response.json();
+      if (error.error === "unknown identity") {
+        const enrolled = await request(id, "/enroll", { name: id.name, kind: "human" });
+        if (enrolled.ok && (await request(id, "/keys/usage")).ok) return id;
+      }
+    }
+  }
+  if (!names.length && loopbackHub(base)) {
+    const id = loadOrCreate("human", "human");
+    if (!id) throw new Error("The local human identity exists, but its key is unavailable. Unlock the identity Keychain or restore its key.");
+    const enrolled = await request(id, "/enroll", { name: id.name, kind: "human" });
+    if (enrolled.ok && (await request(id, "/keys/usage")).ok) return id;
+    throw new Error("The local hub refused owner enrollment. Ask its owner for an invite or configure the existing owner identity.");
+  }
+  throw new Error(unavailable || `No local owner identity is authorized on ${base}. Enroll this Mac with an owner invite, or select its existing owner key with TRANTOR_IDENTITY.`);
+}
+
 // --- migrate + status (`trantor keys …`) ---------------------------------------------------------
 // One <safe-name>.json per durable identity; the instances/ subdir holds per-session subkeys that
 // die with the session and stay files by design.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.118",
+  "version": "0.18.119",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"