trantor 0.18.21 → 0.18.23

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "trantor",
-  "version": "0.18.21",
-  "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
+  "version": "0.18.23",
+  "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {
       "command": "node",

package/README.md

@@ -364,6 +364,11 @@ model-authored handoff instead of superseding it; the successor is injected a ca
 being spoken to; and a session hosted in a Workspace pane is replaced in place by a detached
 driver — the same chain the app's [Hand off now] button runs.
 
+Waking works the same way from the other end: hover a sleeping project in the app's sidebar and
+**Wake** hosts its session as an in-app pane — `trantor open` under the hood, opened in the
+project's own checkout wherever it is called from, handoff-beats-resume, and the same kickoff
+prompt so the woken session catches up (handoff, board, memory) and recaps on its own.
+
 Why crews never exhaust the orchestrator: bus messages are **by reference** (~70 tokens),
 work products stay in each agent's own context — the orchestrator burns at coordination
 rate, not work rate.

package/bin/bridge.mjs

@@ -110,7 +110,10 @@ async function tick() {
     if (differs && (aMoved || bMoved)) {
       const aWins = aMoved && bMoved ? p.origin === "A" : aMoved;
       const [src, dstHub, dstId] = aWins ? [ta, TO, p.bId] : [tb, FROM, p.aId];
-      const r = await call(dstHub, "POST", "/task/update", { id: dstId, status: src.status, assignee: src.assignee || "", by: src.by || "bridge" });
+      // reassign:true — the bridge REPLICATES a hand-change that already happened on the source
+      // hub; without the explicit marker the #5406 assignee-immutability guard would 409 every
+      // cross-hub sync whose assignee moved (deepseek flagged this at review, 2026-08-31).
+      const r = await call(dstHub, "POST", "/task/update", { id: dstId, status: src.status, assignee: src.assignee || "", reassign: true, by: src.by || "bridge" });
       if (aWins) { p.lastA = ta.updated || 0; p.lastB = r.task.updated || 0; }
       else { p.lastB = tb.updated || 0; p.lastA = r.task.updated || 0; }
       synced++;

package/bin/crew.sh

@@ -194,6 +194,24 @@ _herdr_close_pane() { [ "$DRY" = "1" ] && { echo "[dry] herdr pane close $1";
 # So the project gets ONE claude session id, chosen by us and remembered. First open starts claude
 # under it; every later open resumes it. Discovering the id afterwards would be guesswork, and
 # `--continue` would grab whatever ran last in this directory, which may be a different window.
+# A NAMED project must open in ITS checkout, wherever the caller stands (2026-08-31: the app ran
+# `trantor open crebral-health` from the Tauri process cwd and claude booted THERE — a trust
+# prompt for a folder the operator never chose, transcripts under the wrong slug, no project
+# memory, ACTIVE NOW blind). Resolution mirrors the app's project_dir: $TRANTOR_DEV_ROOT
+# (default ~/development)/<name>. Unknown name from an unrelated cwd → refuse loudly rather
+# than open somewhere silly.
+_orch_resolve_dir() {   # $1=cwd $2=project-arg → dir to open in (stdout); fails when unresolvable
+  local herebase; herebase="$(basename "$(git -C "$1" rev-parse --show-toplevel 2>/dev/null || echo "$1")")"
+  if [ -z "$2" ] || [ "$2" = "$herebase" ]; then printf '%s' "$1"; return 0; fi
+  local devroot="${TRANTOR_DEV_ROOT:-$HOME/development}"
+  if [ -d "$devroot/$2" ]; then
+    echo "— opening $2 in its checkout: $devroot/$2 —" >&2
+    printf '%s' "$devroot/$2"; return 0
+  fi
+  echo "trantor open: '$2' has no checkout at $devroot/$2 and this is '$herebase' — cd into the project first" >&2
+  return 1
+}
+
 _orch_sid() {   # $1=project → the project's session uuid, minting one on first use
   local f="${STATE%/*}/orch-sessions.txt" p sid
   if [ -f "$f" ]; then
@@ -601,6 +619,7 @@ open_orchestrator() {
     --*) echo "trantor open: unknown flag '$a'"; usage_open; return 1 ;;
     *) PROJ="$a" ;;
   esac; done
+  DIR="$(_orch_resolve_dir "$DIR" "$PROJ")" || exit 1
   command -v herdr >/dev/null 2>&1 || { echo "trantor open needs herdr (the pane host) — install: curl -fsSL https://herdr.dev/install.sh | sh"; exit 1; }
   local wsid="" orch="" live_ids="" live_names="" pair="" line fresh=0
   local sid; sid="$(_orch_sid "$PROJ")" || { echo "trantor open: could not mint a session id (uuidgen missing?)" >&2; exit 1; }
@@ -635,6 +654,8 @@ open_orchestrator() {
     if _herdr pane rename "$orch" "orchestrator · $PROJ" >/dev/null 2>&1; then
       if _herdr_pane_has_agent "$orch"; then
         echo "herdr:${wsid:-?}/$orch"
+        # CONTRACT: the app's orchestrator_open (desktop terminal.rs) matches this exact phrase
+        # to SKIP its kickoff prompt — a reattach is a live conversation, never to be typed into.
         echo "— orchestrator already hosted: reattached to herdr:${wsid:-?}/$orch —" >&2
         return 0
       fi

package/hooks/sessionstart.mjs

@@ -369,6 +369,23 @@ try {
     }
   } catch {}
 
+  // THE ORCHESTRATOR ROLE (2026-08-31 — the operator had to say it by hand, twice in one day:
+  // "your job is to oversee and be a project manager, not a coder"). A session opened by
+  // `trantor open` carries TRANTOR_ORCH=<project>; every such session gets the doctrine at
+  // boot, so the role survives wakes, handoffs and restarts without anyone restating it.
+  try {
+    if (project && (process.env.TRANTOR_ORCH || "") === project) {
+      additionalContext += `<trantor-orchestrator-role project="${sanitize(project)}">\n` +
+        `🎛️ **You are this project's ORCHESTRATOR — a project manager, not a coder** (operator ruling, 2026-08-31).\n` +
+        `- Building goes to the CREW: invoke the trantor:crew skill (Advisor → \`trantor up\` seats → contracts over the bus), or relay_scrooge for grunt one-shots.\n` +
+        `- Spend your own tokens on design, contracts, supervision, integration and VERIFICATION — run the seats' tests yourself; bounce hollow dones.\n` +
+        `- Write code yourself ONLY for small one-head seam work that needs this session's full context — and say so when you do.\n` +
+        `- Check relay_inbox and the board before asking the operator anything a peer may already have answered.\n` +
+        `</trantor-orchestrator-role>\n`;
+      process.stderr.write(`[trantor] injected orchestrator-role doctrine for ${project}\n`);
+    }
+  } catch {}
+
   // Update available? Surface it the way a terminal tool should — an in-terminal `systemMessage`
   // line the USER sees at session start (NOT a macOS desktop popup, which macOS misattributes to
   // Script Editor and which fires off-screen). It shows every session while an update is pending and

package/hub.mjs

@@ -435,7 +435,12 @@ setTimeout(overseerTick, 2000).unref?.();
 // Env still wins at boot (an operator's declared config beats a seat's claim); otherwise the last
 // registered seat is restored from state, so a hub restart doesn't silently end the duty feed.
 let DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || state.dutySession || "");
-const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
+// 2 MINUTES, not 10 (2026-08-31): scribe DMed the woken crebral-health session at 16:11 and the
+// operator hand-relayed at 16:21:58 — beating the old 10m escalation by seconds. Two agents
+// actively collaborating cannot wait ten minutes; with duty's direct-wake the full chain
+// (escalate → duty nudge → target's hooks poll) now lands in ~3m. Duty's own batch rules
+// (one nudge per recipient per batch, consumed on activity) keep the shorter window from nagging.
+const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 2 * 60 * 1000);
 const dutyEscalated = new Set();
 // #5686: the janitor died 08-27 and NOTHING noticed for 4 days — the hub kept escalating to a
 // corpse. Duty liveness is now a first-class state: dark = configured but no heartbeat inside
@@ -1908,6 +1913,22 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
       const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
       if (!t) return json(res, 404, { error: "no such task" });
+      // Board integrity (#5406): a card can never change hands silently. The assignee is frozen once
+      // set; a mutation is legitimate only as a HANDOFF (the current assignee reassigning to someone
+      // else) or an EXPLICIT reassign (reassign:true — e.g. the orchestrator re-routing work after a
+      // seat dies). A silent third-party overwrite 409s so the caller knows the board refused to move.
+      // Runs BEFORE any other field mutation so a refused steal cannot half-apply a status move.
+      if (b.assignee !== undefined) {
+        const want = String(b.assignee).slice(0, 60);
+        if (want !== t.assignee) {
+          const mover = String(auth?.identity?.name || b.by || "").slice(0, 120);
+          const isOwner = !!t.assignee && mover === t.assignee;
+          const explicit = b.reassign === true;
+          if (!isOwner && !explicit) {
+            return json(res, 409, { error: "assignee is immutable", id: t.id, assignee: t.assignee });
+          }
+        }
+      }
       let eventType = "updated", eventFrom = null, eventTo = null;
       if (b.status && ["todo","doing","testing","failed","done","blocked","stale"].includes(b.status) && b.status !== t.status) {
         eventType = "moved"; eventFrom = t.status; eventTo = b.status;
@@ -1925,7 +1946,13 @@ const server = http.createServer(async (req, res) => {
       if (b.difficulty && ["easy","medium","hard"].includes(b.difficulty)) t.difficulty = b.difficulty;
       if (b.model !== undefined) t.model = String(b.model).slice(0, 60);
       if (Array.isArray(b.deps)) t.deps = [...new Set(b.deps.map(Number).filter(n => Number.isInteger(n) && n > 0 && n !== t.id))].slice(0, 20);
-      if (b.assignee !== undefined) t.assignee = b.assignee;
+      if (b.assignee !== undefined && String(b.assignee).slice(0, 60) !== t.assignee) {
+        const prev = t.assignee || "(none)";
+        const mover = String(auth?.identity?.name || b.by || "").slice(0, 120);
+        t.assignee = String(b.assignee).slice(0, 60);
+        // the handover is part of the card's story, not a silent overwrite
+        appendTaskLog(t, mover, `reassigned ${prev} → ${t.assignee}${b.reassign === true ? " (explicit)" : " (handoff)"}`, now());
+      }
       if (b.title !== undefined) t.title = String(b.title).slice(0,200);
       // the narrative line a human reads on the board ("assigned — did"), written by the cheap
       // summarizer; rides the tasks.extra column, so it survives restarts everywhere

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.21",
+  "version": "0.18.23",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -13,7 +13,7 @@
   "scripts": {
     "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
-  "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
+  "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [
     "hub.mjs",
     "mcp.mjs",