trantor 0.18.29 → 0.18.31

package/bin/cli.mjs

@@ -209,7 +209,7 @@ switch (cmd) {
   trantor gates       verification gates: "must verify before shipping" claims that survive handoffs — [--all] [--json]
   trantor backfill    card past GIT work onto the board (solo commits that were never carded) — [--since "14 days ago"] [--dry-run]
   trantor init-hooks  install a git post-commit hook so EVERY commit auto-cards on the board (reliable solo-work backstop) — [--uninstall]
-  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json] — makes the dir, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
+  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
   trantor balances    how much credit is left on each CONFIGURED provider (from your profile) — refill before you stall — [--json]
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)

package/bin/crew-runner.mjs

@@ -16,6 +16,12 @@ import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
+import { redactKeys } from "../lib/redact.mjs";
+import {
+  AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
+  verdictFor,
+  readPromptText, stripPromptEcho,
+} from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 
 const AGENT = process.argv[2];
@@ -127,7 +133,7 @@ if (!enrolment.ok && enrolment.reason !== "hub-unreachable") {
 }
 process.on("uncaughtException", (e) => { console.log(`\x1b[31m[runner] UNCAUGHT: ${e?.stack || e}\x1b[0m`); });
 process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLED REJECTION: ${e?.stack || e}\x1b[0m`); });
-const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${s}`);
+const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${redactKeys(String(s))}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = 0;
@@ -337,30 +343,19 @@ function loadPending() {
 
 // Auth-failure markers in TURN OUTPUT. opencode prints its auth error ("401 Unauthorized" /
 // "Invalid API key") and STILL exits 0, so a bare 0 from the CLI is not proof the turn ran
-// (card #5405). This regex gates the exit-0 path in runTurn; kept tighter than
-// classifyFailure's set (no bare /expired/) so a healthy transcript never trips it.
-const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
-
-function classifyFailure(exit, errText, emptyOutput = false) {
-  // #5481: silence with a clean exit is a failure shape, not success — see lastEmptyOutput.
-  if (emptyOutput) return "empty-output";
-  const t = (errText || "").toLowerCase();
-  if (exit === 127) return "missing-cli";
-  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
-  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
-  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
-  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
-  if (/unexpected status (404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/.test(t)) return "backend-error";
-  // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
-  // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
-  if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|reached your [^.\n]*limit|usage limit|out of (credit|quota)/.test(t)) return "exhausted";
-  if (/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/.test(t)) return "auth";
-  return "crashed";
+// (card #5405). The rules live in lib/classify-failure.mjs (#5868) so they are testable against
+// the real specimens; classify() wraps them with the one-line verdict the seat log carries, and
+// runTurn judges only the CLI's OWN output (the prompt echo is replay, not speech — the rules
+// line "…deleting failing tests is forbidden." once classified healthy codex turns as auth).
+function classify(exit) {
+  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput);
+  log(`classified ${reason} because ${matched}`);
+  return reason;
 }
 
 async function reportFailure(exit, trigger, undelivered = 0) {
   consecFails++;
-  const reason = classifyFailure(exit, lastErrText, lastEmptyOutput);
+  const reason = classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
   await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
@@ -377,9 +372,10 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   // The count of messages this seat is HOLDING is the operator-actionable half of a failure: a
   // crashed pulse costs nothing, a crashed turn sitting on three escalations is someone waiting.
   const held = undelivered ? ` · holding ${undelivered} undelivered message${undelivered > 1 ? "s" : ""} (will retry)` : "";
-  const text = down
+  // #5869: the broadcast quotes failure context; keys never ride the bus.
+  const text = redactKeys(down
     ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}${held}`
-    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`;
+    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`);
   // Announce a CHANGE of state, never the continuation of one. The registered status above already
   // carries "down: exhausted · N fails" for anyone who looks, which is state and costs nobody a
   // turn; the broadcast is the event, and an unchanged state is not an event.
@@ -400,6 +396,23 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
 }
 
+// ---- activity truth (#5965): the RUNNER is the source for this seat ----------------
+// The app pulses a seat from its hub peer status. The runner is what actually knows when a
+// turn starts and ends, so it reports the boundaries: `working · <trigger>` the moment a turn
+// begins and `idle` the instant it lands clean. herdr's screen detection cannot see a
+// runner-driven CLI mid-turn (it sets screen_detection_skipped for those panes), which is why
+// seats used to read as idle while genuinely working — the desktop's herdr row is unreliable
+// for runner seats, so it falls back to this hub status. Bounded 5s so a slow hub never delays
+// the very turn it is reporting; one HTTP call per transition, never a poll.
+async function registerStatus(status) {
+  const url = HUB + "/register";
+  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL });
+  try {
+    const opts = { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body };
+    await fetch(url, { ...opts, headers: { ...opts.headers, ...signedHeaders(identity, url, opts) }, signal: AbortSignal.timeout(5000) });
+  } catch {}
+}
+
 // ---- telling the ASSIGNER, mechanically ------------------------------------
 // A seat used to finish its contract and say nothing. Completion lived only in the RULES prompt
 // ("report on the bus"), so a cheap model that did the work and ended its turn left the
@@ -410,6 +423,7 @@ async function reportFailure(exit, trigger, undelivered = 0) {
 // So: whoever sent the message that woke this seat gets told DIRECTLY what became of it. Direct
 // messages wake; that is the whole difference. Kept short, like every other bus line.
 async function notifyAssigners(pairs, text) {
+  text = redactKeys(text);   // #5869: the "asked" excerpt quotes the wake message — keys stay off the bus
   const seen = new Set();
   for (const { from: f, id } of pairs) {
     // `hub:*` senders are the hub's own pseudo-ids (hub:duty, the overseer), not sessions: nothing
@@ -438,12 +452,20 @@ async function reportHealthy() {
 }
 
 let sid = "";
-function runTurn(prompt, isFirst, trigger = "kickoff") {
+async function runTurn(prompt, isFirst, trigger = "kickoff") {
   TURN++; banner(trigger);
   const t0 = Date.now();
+  // #5965 — TURN START. The hub peer row is where the app reads activity from, and the runner is
+  // the only one who knows a turn is starting, so say so before the CLI spawn (awaited: the spawn
+  // below blocks the loop, an unawaited fetch would not leave the machine until the turn ended).
+  await registerStatus(`working · ${trigger}`);
   const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
+  // #5868: where HEAD stood when the turn began. A turn that moved it shipped real work, and an
+  // exit-0 turn with real output must never be re-labelled "auth" by the #5405 escalation — the
+  // qwen specimen committed aa3c340 while its captured stream still tripped the auth regex.
+  const headBefore = gitOut(["rev-parse", "HEAD"], TURN_DIR);
   let cmd = (isFirst || (cli.sid && !sid)) ? cli.first : cli.next;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
   cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid);
@@ -470,7 +492,13 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // `crashed` and nobody knew to swap it. sid seats already fold stdout into the ERRF stream via
   // `tee /dev/stderr`; the rest now tee straight into ERRF. A real pipeline (not a process
   // substitution) so bash waits for tee to flush before we read the file back.
-  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
+  // #5869: redaction rides IN the pipeline — lib/redact.mjs is a tee replacement that echoes
+  // stdin verbatim to the live window and appends only REDACTED bytes to ERRF, so a CLI that
+  // echoes its environment never parks a provider key in a file every seat can read. The tee
+  // topology is load-bearing (#5481): stdout+stderr must still BOTH land in ERRF, and the sid
+  // path still folds stdout in via /dev/stderr → the --tee2 hop below.
+  const SCRUB = `node ${join(import.meta.dirname, "..", "lib", "redact.mjs")}`;
+  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | ${SCRUB} --tee ${ERRF}`;
   // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
   // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
   // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
@@ -482,7 +510,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
       { detached: true, stdio: "ignore" });
     wd.unref();
   } catch {}
-  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
+  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF})`], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
@@ -499,18 +527,36 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
     maxBuffer: 16 * 1024 * 1024,
   });
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }
+  // #5869: scrub AT REST, synchronously, before anything reads the file back. The stderr hop is
+  // a process substitution bash does not wait for, so this pass also catches its tail — the
+  // auth classifier and the empty-output check below must judge REDACTED text and a settled file.
+  try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
+  // #5868: classify only what the CLI itself said. The transcript replays the whole turn prompt
+  // (rules, lessons, the wake text) — and those lines once classified healthy codex turns as
+  // auth ("…is forbidden.") and exhausted ("retries burn quota"). Prompt lines are stripped
+  // before anything downstream looks at the text.
+  let ownOut = "";
+  try { ownOut = stripPromptEcho(readFileSync(ERRF, "utf8"), readPromptText(pf)); } catch { ownOut = ""; }
+  lastErrText = ownOut.slice(-4000);
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   const realExit = r.status;
   // A zero exit is NOT proof the turn ran: opencode prints "401 Unauthorized" / "Invalid API key"
   // and exits 0, so a bare 0 made the runner ack "✅ done", clear the pending queue and heartbeat
   // green through an auth outage (card #5405). Cross-check the turn output and treat an
-  // exit-0-with-auth turn as FAILED. Telemetry keeps the REAL exit; the returned code is the
-  // effective one every call site branches on (kickoff, pulse, deliverWake).
+  // exit-0-with-auth turn as FAILED — but ONLY when the CLI's own output is short enough to be
+  // just the error (#5868): a long output is a real answer, and a warning inside it must not
+  // fail the turn. Telemetry keeps the REAL exit; the returned code is the effective one every
+  // call site branches on (kickoff, pulse, deliverWake).
   let effExit = realExit;
-  if (realExit === 0 && AUTH_MARKER_RE.test(lastErrText)) {
+  let authHit = "";
+  // #5868: a NEW commit since turn start is real work, and an exit-0 turn with real output is
+  // never re-labelled auth — the qwen specimen exited 0 with a shipped commit (aa3c340) while a
+  // short capture of echoed contract text tripped the regex.
+  const newCommit = !!headBefore && gitOut(["rev-parse", "HEAD"], TURN_DIR) !== headBefore;
+  if (realExit === 0 && looksLikeAuthDeath(ownOut, newCommit)) {
     effExit = 1;
-    log("\x1b[31mexit 0 but turn output shows an auth failure — treating as FAILED (auth)\x1b[0m");
+    authHit = AUTH_MARKER_RE.exec(ownOut)[0];
+    log(`\x1b[31mexit 0 but the turn output IS an auth failure — treating as FAILED (auth, "${authHit}")\x1b[0m`);
   }
   // #5481: the Inception/Mercury trap — exit 0 with a NULL completion. ERRF is the TOTAL output
   // capture, not just stderr: every seat's stdout is tee'd into it (`| tee -a ERRF` for the
@@ -519,14 +565,22 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // real CLI prints something on success (drill C pins that), so silence is the trap, not a
   // quiet victory. (Integration note: this was nearly "fixed" into stdout-only detection that
   // never fired — the tee topology is the load-bearing fact; keep this comment with it.)
+  // The judgment now runs on the ECHO-STRIPPED text (#5868): a CLI that replays the prompt but
+  // does no work has still produced nothing of its own.
   if (realExit === 0 && effExit === 0 && !lastErrText.trim()) {
     effExit = 1;
     lastEmptyOutput = true;
     log("\x1b[31mexit 0 but the turn produced NO output — treating as FAILED (empty-output)\x1b[0m");
   }
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput });
+  // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
+  // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
+  const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut);
+  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict });
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
+  // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
+  // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
+  if (realExit === 0 && effExit === 0) await registerStatus("idle");
   return effExit;
 }
 
@@ -592,7 +646,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
-  const ec0 = runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
+  const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
   let lastTurnAt = Date.now();
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
@@ -602,7 +656,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
-      const ecp = runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
+      const ecp = await runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
       if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
       lastTurnAt = Date.now();
       log("parked — waiting for the next message or pulse");
@@ -694,7 +748,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
       rulesText: RULES, lessons,
     });
-    const ec = runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    const ec = await runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
     const secs = Math.round((Date.now() - tStart) / 1000);
     if (ec) {
       deliveryFails++;
@@ -704,7 +758,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       await reportFailure(ec, "message", pendingWake.length);
       // The room hears the broadcast above; the one who is actually blocked hears it directly.
       await notifyAssigners(assigners,
-        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${classifyFailure(ec, lastErrText)}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
+        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${classify(ec)}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
       log(`\x1b[31m${pendingWake.length} message(s) still UNDELIVERED — next attempt in ${Math.round(wait / 1000)}s\x1b[0m`);
     } else {
       pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;

package/bin/crew.sh

@@ -733,7 +733,8 @@ echo "[crew] hub for $PROJ: $HUB_URL (baked into every seat; CREW_HUB=<url> over
 SCROOGE="$BUS_DIR/engine/bin/scrooge"
 [ -f "$SCROOGE" ] || SCROOGE="$(command -v scrooge 2>/dev/null || echo scrooge)"
 
-# resolve_model <agent> <provider> <task> <diff> -> echoes a runner-ready model id, or empty (→ CLI default).
+# resolve_model <agent> <provider> <task> <diff> -> echoes a provider-qualified model id.
+# A provider seat must never fall through to opencode's unrelated global default.
 resolve_model() {
   local agent="$1" provider="$2" task="$3" diff="$4" cands="" out=""
   cands="$(opencode models "$provider" 2>/dev/null | tr '\n' ' ')"
@@ -742,10 +743,16 @@ resolve_model() {
   else
     out="$(python3 "$SCROOGE" route --provider "$provider" -t "$task" -d "$diff" --json 2>/dev/null)"
   fi
-  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — CLI default" >&2; return 0; }
-  printf '%s' "$out" | python3 -c 'import json,sys
+  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — refusing opencode global default" >&2; return 1; }
+  out="$(printf '%s' "$out" | python3 -c 'import json,sys
 try: print(json.load(sys.stdin).get("qualified") or "")
-except Exception: pass' 2>/dev/null
+except Exception: pass' 2>/dev/null)"
+  [ -n "$out" ] || { echo "[crew] router returned no model for $agent:$provider — refusing opencode global default" >&2; return 1; }
+  [ "${out%%/*}" = "$provider" ] || {
+    echo "[crew] router selected $out outside $provider — refusing cross-provider fallback" >&2
+    return 1
+  }
+  printf '%s' "$out"
 }
 
 epoch_ms() { python3 -c 'import time;print(int(time.time()*1000))'; }
@@ -760,13 +767,21 @@ resolve_spec() {
   # into the launcher string. AGENT is set above and DIR is fixed, so this is the earliest safe point.
   reap_seat
   FIELD=""; [ "$SPEC" != "$AGENT" ] && FIELD="${SPEC#*:}"
-  [ "$AGENT" = "openrouter" ] && [ -z "$FIELD" ] && FIELD="openrouter"
+  # Bare native seats use their own CLI defaults. Bare opencode-hosted seats MUST name their
+  # provider implicitly: glm is the one non-obvious alias; every discovered/BYOM seat's label is
+  # its provider id. Leaving FIELD empty is what handed qwen/glm to opencode's global DeepSeek.
+  if [ -z "$FIELD" ]; then
+    case "$AGENT" in
+      codex|kimi|claude|gemini|dsh|opencode) ;;
+      glm) FIELD="zai-coding-plan" ;;
+      *) FIELD="$AGENT" ;;
+    esac
+  fi
   if [ -n "$FIELD" ]; then
     case "$FIELD" in
       */*) MODEL="$FIELD" ;;
-      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")"
-           if [ -n "$MODEL" ]; then echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)"
-           else echo "  → $AGENT: '$FIELD' live selection unavailable — CLI default"; fi ;;
+      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || exit 1
+           echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)" ;;
     esac
   fi
 }

package/bin/new.mjs

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 // trantor new — project genesis, the CLI half (#5862). One command stands a project up:
 //
-//   trantor new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json]
+//   trantor new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json]
 //
-// It makes the directory under the dev root (TRANTOR_DEV_ROOT or ~/development), starts git on
-// main (or clones --from, or adopts an existing folder with --adopt), seeds CLAUDE.md from the
+// It makes the project directory at <parent>/<name> — --dir names the PARENT, never the project
+// directory itself (default parent: TRANTOR_DEV_ROOT or ~/development). The name is always
+// appended under it, so `--dir P` with name N creates P/N. Starts git on main (or clones --from,
+// or adopts an existing folder with --adopt), seeds CLAUDE.md from the
 // brief (verbatim brief + the trantor conventions block), installs the same auto-card hook as
 // `trantor init-hooks`, posts the brief as the hub project brief (POST /project — the same call
 // relay_project_brief makes), and opens the first card "genesis: <name>" on the new board.
@@ -17,8 +19,10 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, append
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ensureEnrolled, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
-import { resolveHub } from "../lib/project.mjs";
+import { ensureEnrolled as enrollTofu, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
+import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
+import { setAutonomy } from "../lib/autonomy.mjs";
+import { resolveHub, setProjectHub } from "../lib/project.mjs";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 
@@ -51,7 +55,7 @@ const flag = (n) => { const i = args.indexOf("--" + n); return i >= 0 ? args[i +
 const has = (n) => args.includes("--" + n);
 const json = has("json");
 const name = args.find(a => !a.startsWith("--"));
-if (!name) die("usage: trantor new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json]");
+if (!name) die("usage: trantor new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — project lands at <parent>/<name>");
 if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) die(`invalid project name "${name}" — letters, digits, dot, dash, underscore`);
 const from = flag("from");
 const briefFile = flag("brief");
@@ -104,17 +108,32 @@ if (existsSync(claude)) {
 const hook = spawnSync(process.execPath, [join(ROOT, "bin", "init-hooks.mjs")], { cwd: dir, encoding: "utf8" });
 if (hook.status !== 0) die(`hook install failed: ${(hook.stderr || "").trim()}`);
 
-// ── the hub: brief + first card, signed like every other client ─────────────────────────────────
+// A new project is a new trust boundary. Pin its harness dial even when the machine-wide default
+// is bypass, so opening it can never inherit another project's permission choice.
+setAutonomy(name, { harness: "prompt" });
+
+// ── the hub: pin + brief + first card, signed like every other client ──────────────────────────
 const hub = resolveHub(name);
+// Pin the new project to the hub it posts to (#5862 residual): without the pin, the first
+// session in the dir falls back to the global default and wears the "not pinned to a hub"
+// warning even though genesis chose this hub deliberately. Same persistence as `trantor hub set`.
+setProjectHub(name, hub);
 const session = process.env.RELAY_SESSION || `genesis:${name}`;
 const identity = loadIdentity(session);
 let card = null;
 let hubError = null;
 try {
-  await ensureEnrolled(session, identity, name);
+  // The genesis identity is BRAND NEW — it cannot write to a project on an enforce hub until the
+  // hub knows it. TOFU /enroll only works on a local loopback hub; a remote enforce hub refuses it
+  // (403 "tofu enrollment refused") and the genesis silently records nothing (#6049). So enroll the
+  // way crew seats do: the operator's owner key mints a project-scoped write invite and the genesis
+  // identity spends it. Only when NO owner key is configured (a loopback hub with no owner identity)
+  // do we fall back to the plain TOFU enroll.
+  const viaOwner = await enrollViaOwnerInvite(hub, identity, name, { timeoutMs: 8000 });
+  if (!viaOwner.ok && viaOwner.reason === "no-owner-key") await enrollTofu(session, identity, name);
   const briefForHub = (brief || `Genesis of ${name} — created by trantor new.`).slice(0, 600);
   const r1 = await signedPost("/project", { project: name, brief: briefForHub, by: session }, { session, project: name, timeoutMs: 8000 });
-  if (!r1.ok) throw new Error(`hub ${r1.status} on /project`);
+  if (!r1.ok) throw new Error(`hub ${r1.status} on /project${r1.json?.error ? `: ${r1.json.error}` : ""}`);
   const r2 = await signedPost("/task", {
     project: name,
     title: `genesis: ${name}`,
@@ -122,7 +141,7 @@ try {
     by: session,
     note: "project genesis — created by trantor new",
   }, { session, project: name, timeoutMs: 8000 });
-  if (!r2.ok) throw new Error(`hub ${r2.status} on /task`);
+  if (!r2.ok) throw new Error(`hub ${r2.status} on /task${r2.json?.error ? `: ${r2.json.error}` : ""}`);
   card = r2.json?.task?.id ?? null;
 } catch (e) {
   hubError = e instanceof Error ? e.message : String(e);
@@ -130,8 +149,10 @@ try {
 }
 
 // ── report ──────────────────────────────────────────────────────────────────────────────────────
+// dir is the created project directory <parent>/<name>; parent is the --dir (or default) root the
+// name was appended under — the two together state the parent contract explicitly.
 if (json) {
-  console.log(JSON.stringify({ name, dir, branch, hub, card }));
+  console.log(JSON.stringify({ name, parent: devRoot, dir, branch, hub, card }));
 } else {
   console.log(`✓ ${dir} (${branch}${from ? ", cloned" : adopt ? ", adopted" : ""})`);
   console.log(`✓ CLAUDE.md seeded${brief ? " from the brief" : " (no brief — add the project's what/why/goal)"}`);

package/bin/patrol.mjs

@@ -43,6 +43,11 @@ function rowMatchesRunner(row, runner) {
   return !rp || rp === runnerProject(runner);
 }
 
+function seatProvider(agent) {
+  if (["codex", "kimi", "claude", "gemini", "dsh", "opencode"].includes(agent)) return null;
+  return agent === "glm" ? "zai-coding-plan" : agent;
+}
+
 function sortedProjects(projects) {
   return [...projects].sort((a, b) => displayProject(a).localeCompare(displayProject(b)));
 }
@@ -76,6 +81,7 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
   const workspaceIds = new Set(workspaces.map(w => String(w?.id || "")).filter(Boolean));
   const orphans = [];
   const ambiguous = [];
+  const warnings = [];
 
   for (const runner of runners) {
     if (isBusInternalRunner(runner, bus)) continue;
@@ -85,6 +91,18 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
     } else if (!rows.some(row => rowMatchesRunner(row, runner))) {
       orphans.push({ type: "live-runner-without-row", project: p, agent: runner.agent, pid: runner.pid, dir: runner.dir });
     }
+    const expectedProvider = seatProvider(String(runner?.agent || ""));
+    const actualProvider = String(runner?.model || "").split("/")[0];
+    if (expectedProvider && actualProvider && actualProvider !== expectedProvider) {
+      warnings.push({
+        type: "seat-model-provider-mismatch",
+        project: p,
+        agent: runner.agent,
+        model: runner.model,
+        expectedProvider,
+        pid: runner.pid,
+      });
+    }
   }
 
   for (const ws of workspaces) {
@@ -124,7 +142,7 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
     };
   }
 
-  return { projects: out, orphans, ambiguous, reaped };
+  return { projects: out, orphans, ambiguous, warnings, reaped };
 }
 
 function oldEnough(path, now, maxAgeMs) {
@@ -196,6 +214,10 @@ export function formatHuman(report) {
   for (const item of report.orphans) lines.push(`  - ${item.type}: ${displayProject(item.project)} ${item.agent || item.title || item.handle || item.id || ""}`.trimEnd());
   lines.push(`ambiguous: ${report.ambiguous.length}`);
   for (const item of report.ambiguous) lines.push(`  - ${item.type}: ${item.agent || item.title || item.dir || item.id || ""}`.trimEnd());
+  lines.push(`warnings: ${report.warnings?.length || 0}`);
+  for (const item of report.warnings || []) {
+    lines.push(`  - ${item.type}: ${displayProject(item.project)} ${item.agent} runs ${item.model}; expected ${item.expectedProvider}/*`);
+  }
   lines.push(`reaped: ${report.reaped.length}`);
   for (const item of report.reaped) lines.push(`  - ${item.type}: ${item.path || item.output || ""}`.trimEnd());
   return `${lines.join("\n")}\n`;

package/bin/profile.mjs

@@ -43,7 +43,12 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   if (cmd === "set") {
     for (const a of args) {
       const [prov, plan] = a.split("=");
-      if (!prov || !plan) { console.error(`bad arg '${a}' — use provider=plan`); process.exit(1); }
+      // A flag in the provider position (`set --help=api`) is a usage mistake, not a provider —
+      // die before the write, or profile.json grows a '--help' entry (#5998). 'help' likewise.
+      if (!prov || !plan || prov.startsWith("--") || prov === "help") {
+        console.error(`bad arg '${a}' — use provider=plan`);
+        process.exit(1);
+      }
       prof.providers[prov.toLowerCase()] = { plan: plan.toLowerCase(), tier: TIER(plan) };
     }
     prof.updated = new Date().toISOString().slice(0, 10);

package/bin/provider.mjs

@@ -70,7 +70,14 @@ function listSeats() {
 }
 
 function addProvider(name, opts) {
-  if (!name) { console.error("usage: trantor provider add <name> [--key sk-…] [--plan api] [--label <bus-name>] [--base-url <url> [--models m1,m2]]"); process.exit(1); }
+  // A flag left in the name position (`provider add --help`) is a usage question, not a provider
+  // name (#5998): the old path minted a '--help' provider into profile.json and a __HELP_API_KEY
+  // line into .env, then announced "Seat ready." The literal 'help' is guarded too — it is never
+  // a provider name. Both die HERE, before .env, profile.json or opencode.json are touched.
+  if (!name || name.startsWith("--") || name === "help") {
+    console.error("usage: trantor provider add <name> [--key sk-…] [--plan api] [--label <bus-name>] [--base-url <url> [--models m1,m2]]");
+    process.exit(1);
+  }
   const provider = name.toLowerCase();
   const label = (opts.label || provider).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   const plan = (opts.plan || "api").toLowerCase();
@@ -117,7 +124,11 @@ function addProvider(name, opts) {
 }
 
 function removeProvider(name) {
-  if (!name) { console.error("usage: trantor provider remove <name>"); process.exit(1); }
+  // Same guard as add (#5998): a flag-like name is a usage question, not a provider.
+  if (!name || name.startsWith("--") || name === "help") {
+    console.error("usage: trantor provider remove <name>");
+    process.exit(1);
+  }
   const FILE = join(H, ".agent-bus", "profile.json");
   const prof = read(FILE, { providers: {} });
   if (prof.providers && prof.providers[name.toLowerCase()]) {

package/hooks/lib/resources.mjs

@@ -22,6 +22,16 @@ const TIMEOUT = 2000;                                            // contract: ev
 
 const busDir = () => process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus");
 
+function opencodeDefaultModel() {
+  try {
+    const home = process.env.HOME || homedir();
+    const configDir = process.env.XDG_CONFIG_HOME || join(home, ".config");
+    const config = JSON.parse(readFileSync(join(configDir, "opencode", "opencode.json"), "utf8"));
+    const model = config?.model;
+    return /^[^\s/]+\/[^\s/]+$/.test(model) ? String(model) : "";
+  } catch { return ""; }
+}
+
 // Run a subprocess, return stdout; "" on ANY failure (missing binary, nonzero exit, timeout).
 function run(cmd, args, env = {}) {
   try {
@@ -75,7 +85,7 @@ function psTable() {
   return rows;
 }
 
-// Live crew-runner processes → [{pid,agent,dir}]. Runner argv (crew.sh RUN_CMD) is
+// Live crew-runner processes → [{pid,agent,dir,model}]. Runner argv (crew.sh RUN_CMD) is
 // `node …/crew-runner.mjs <agent> <dir>` — dir is the LAST argument, so the regex is anchored
 // on end-of-string. project=null → all runners; project given → only runners whose dir resolves
 // to that project. Resolution is the lib/project.mjs walk (git-root basename, else dir basename)
@@ -84,6 +94,7 @@ function psTable() {
 export function liveRunners(project = null) {
   try {
     const out = [];
+    const globalModel = opencodeDefaultModel();
     for (const { pid, cmd } of psTable()) {
       const m = cmd.match(/crew-runner\.mjs\s+(\S+)\s+(\S+)\s*$/);
       if (!m) continue;
@@ -92,7 +103,13 @@ export function liveRunners(project = null) {
         const name = basename(gitRoot(dir) || dir);
         if (name !== project) continue;
       }
-      out.push({ pid, agent, dir });
+      // CREW_MODEL is fixed for the runner lifetime. Read only that named environment field —
+      // never return the rest of `ps eww`, which can contain provider credentials.
+      const envLine = run("ps", ["eww", "-p", String(pid), "-o", "command="]);
+      const pinnedModel = (envLine.match(/(?:^|\s)CREW_MODEL=([^\s]*)/) || [])[1] || "";
+      const model = pinnedModel || globalModel;
+      const modelSource = pinnedModel ? "crew" : (globalModel ? "opencode-global" : "");
+      out.push({ pid, agent, dir, model, modelSource });
     }
     return out;
   } catch { return []; }

package/lib/classify-failure.mjs

@@ -0,0 +1,107 @@
+// Failure classification for crew seats (#5868) — split out of crew-runner.mjs so the rules are
+// unit-testable against the REAL specimens that misfired.
+//
+// EVIDENCE (err-codex-trantor.txt + logs/codex-trantor.jsonl, 2026-09-02): the codex seat sat
+// "DOWN — 44 consecutive failures (exhausted)" while every telemetry row read exit:0 and the
+// transcript showed real work ("tokens used 4,387", Stop hooks, a delivered answer). Both labels
+// were echoes of the seat's own PROMPT: the rules line "…deleting failing tests is forbidden."
+// matched AUTH_MARKER_RE's bare "forbidden", and the codex lesson "retries burn quota" matched
+// the exhausted rule. Three fixes, one per failure mode:
+//   · stripPromptEcho — a prompt line reappearing in the err stream is the CLI REPLAYING what it
+//     was told, not the CLI speaking; classification sees only the CLI's own output. The exact-
+//     match version (9b28036) caught nothing in the wild: the qwen specimen (turn 9, 2026-09-02,
+//     card #5868) echoed its CONTRACT — the #6049 wake text is ABOUT a hub 401, dense with "401",
+//     "unknown identity", "credentials" — wrapped in CLI framing no prompt line equals verbatim.
+//     The strip now normalizes (ANSI off, whitespace collapsed) and drops a line that CONTAINS a
+//     prompt line or is a wrapped FRAGMENT of one, so replay is caught however the CLI frames it.
+//   · looksLikeAuthDeath — the #5405 exit-0 escalation fires only on a SHORT error-only output
+//     (the opencode "401 Unauthorized" specimen is a couple of lines); a long output is a real
+//     answer, and a warning inside it must not fail the turn. AND never when the turn produced
+//     REAL WORK (a new commit): the qwen specimen exited 0, committed aa3c340, and its captured
+//     stream still held under 400 bytes of contract echo carrying "401" — a short capture is not
+//     proof of a dead turn, but a shipped commit is proof of a live one.
+//   · classifyFailure — "exhausted" demands an explicit quota/rate-limit message; the broad bare
+//     words ("credit", "balance", bare "insufficient") labelled ordinary prose on a dead turn and
+//     sent the operator to wait out a window that did not exist.
+import { readFileSync } from "node:fs";
+
+export const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
+
+/** Prompt lines (≥40 chars — a short line carries no signature) echoed back by the CLI are
+ *  replay, not speech. Echoes are rarely byte-identical (CLI framing, terminal wrapping, ANSI
+ *  colors — the exact-match strip caught nothing in the qwen #6049 specimen), so both sides are
+ *  normalized (ANSI stripped, whitespace collapsed) and a long line is dropped when it CONTAINS
+ *  a prompt line, IS a fragment of one, or contains a ≥40-char RUN of one — terminal wrapping
+ *  breaks the line but preserves long runs inside each wrapped piece. */
+const ECHO_RUN = 40;
+export function stripPromptEcho(errText, promptText) {
+  const text = String(errText || "");
+  if (!promptText) return text;
+  const norm = (l) => String(l).replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\s+/g, " ").trim();
+  const prompts = String(promptText).split("\n").map(norm).filter(l => l.length >= 40);
+  if (!prompts.length) return text;
+  const hasRun = (p, n) => {
+    for (let i = 0; i + ECHO_RUN <= p.length; i++) if (n.includes(p.slice(i, i + ECHO_RUN))) return true;
+    return false;
+  };
+  return text.split("\n").filter(line => {
+    const n = norm(line);
+    // Short lines survive — no signature, nothing to match against.
+    if (n.length < 40) return true;
+    return !prompts.some(p => n.includes(p) || p.includes(n) || hasRun(p, n));
+  }).join("\n");
+}
+
+/** A real answer is long; an auth death is a couple of lines. The opencode specimen (#5405)
+ *  printed its whole failure in under a hundred characters and produced nothing else. */
+export const OWN_OUTPUT_ANSWER_MIN = 400;
+
+/** The #5405 rule, refined twice by #5868: exit 0 + an auth-shaped marker means FAILED only when
+ *  the CLI's own output is short enough to be JUST the error — and NEVER when the turn did real
+ *  work (newCommit, checked by the runner via git): a shipped commit is a live turn, whatever the
+ *  captured stream happens to hold. */
+export function looksLikeAuthDeath(ownText, realWork = false) {
+  if (realWork) return false;
+  return String(ownText || "").length < OWN_OUTPUT_ANSWER_MIN && AUTH_MARKER_RE.test(ownText);
+}
+
+/** The one-line verdict the seat's jsonl carries (#5868): why the runner judged the turn the way
+ *  it did, phrased exactly like the runner's own "classified X because Y" log — so a pane that
+ *  scrolls away loses nothing that the telemetry row needs to say. */
+export function verdictFor(realExit, effExit, emptyOutput, ownText) {
+  if (realExit === 0 && effExit === 0) return "classified success because exit 0 with CLI output";
+  if (realExit === 0 && effExit === 1) {
+    if (emptyOutput) return "classified empty-output because exit 0 with no output on either stream";
+    const m = AUTH_MARKER_RE.exec(String(ownText || ""));
+    return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
+  }
+  const { reason, matched } = classifyFailure(realExit, String(ownText || ""), emptyOutput);
+  return `classified ${reason} because ${matched}`;
+}
+
+/** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
+ *  runner logs, so the next misclassification is diagnosable from the seat log alone. */
+export function classifyFailure(exit, errText, emptyOutput = false) {
+  // #5481: silence with a clean exit is a failure shape, not success — see lastEmptyOutput.
+  if (emptyOutput) return { reason: "empty-output", matched: "exit 0 with no output on either stream" };
+  const t = String(errText || "").toLowerCase();
+  if (exit === 127) return { reason: "missing-cli", matched: "exit 127 — command not found" };
+  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
+  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
+  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
+  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  let m = t.match(/unexpected status (?:404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/);
+  if (m) return { reason: "backend-error", matched: m[0] };
+  // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
+  // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
+  m = t.match(/quota|payment required|402|429|too many requests|rate.?limit|usage limit|exceeded your|reached your [^.\n]*limit|insufficient (?:credits?|funds)|out of (?:credits?|quota)/);
+  if (m) return { reason: "exhausted", matched: m[0] };
+  m = t.match(/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/);
+  if (m) return { reason: "auth", matched: m[0] };
+  return { reason: "crashed", matched: `exit ${exit} with no known failure pattern` };
+}
+
+/** Read the prompt file if it exists (the turn prompt the CLI may echo into its transcript). */
+export function readPromptText(pf) {
+  try { return readFileSync(pf, "utf8"); } catch { return ""; }
+}

package/lib/redact.mjs

@@ -0,0 +1,62 @@
+// #5869 — key-material redaction for everything a seat runner writes at rest.
+//
+// A CLI that echoes its environment or dumps a config puts live provider keys into the seat's
+// err log (err-<agent>-<project>.txt), and any seat on the machine can read ~/.agent-bus. So the
+// runner scrubs known key shapes to `<redacted:NAME>` before the bytes land:
+//
+//   sk-… / sk-sp-… / sk-ws-…   → <redacted:SK>      (every OpenAI-style prefix is sk-)
+//   AIza…                      → <redacted:AIZA>    (Google)
+//   xai-…                      → <redacted:XAI>     (xAI)
+//   ghp_…                      → <redacted:GHP>     (GitHub PAT)
+//   <VAR>_KEY=… / <VAR>_TOKEN=… with a 32+-char hex/base64 value
+//                              → <VAR>=<redacted:VAR>  (the variable NAME is not secret)
+//   Authorization: Bearer …    → Authorization: Bearer <redacted:BEARER>
+//
+// Ordinary lines are byte-identical: every rule anchors on a key prefix or a KEY=/TOKEN=/Bearer
+// position, never on "looks long". The function is idempotent (already-redacted text passes
+// through unchanged), so callers can scrub in the write path AND again on read-back.
+const RULES = [
+  // VAR=value first, so the surviving name is the env var and short values after KEY=/TOKEN=
+  // still fall through to the bare-prefix rules below.
+  { re: /\b([A-Za-z0-9_.-]*(?:KEY|TOKEN))=(["']?)[A-Za-z0-9+/_=-]{32,}\2/g, sub: (m, name, q) => `${name}=${q}<redacted:${name}>` },
+  { re: /\bsk-[A-Za-z0-9][A-Za-z0-9_-]{7,}/g, sub: () => "<redacted:SK>" },
+  { re: /\bAIza[0-9A-Za-z_-]{30,}/g, sub: () => "<redacted:AIZA>" },
+  { re: /\bxai-[A-Za-z0-9][A-Za-z0-9_-]{9,}/g, sub: () => "<redacted:XAI>" },
+  { re: /\bghp_[A-Za-z0-9]{20,}/g, sub: () => "<redacted:GHP>" },
+  { re: /(Authorization:\s*Bearer\s+)[A-Za-z0-9._+/=-]{16,}/gi, sub: (m, p) => `${p}<redacted:BEARER>` },
+];
+
+export function redactKeys(text) {
+  if (text == null) return text;
+  let out = String(text);
+  for (const { re, sub } of RULES) out = out.replace(re, sub);
+  return out;
+}
+
+// The runner's tee replacement. Modes:
+//   --tee  <file>  stdin → STDOUT verbatim (the live window), redacted → <file> (append)
+//   --tee2 <file>  stdin → STDERR verbatim (the live window), redacted → <file> (append)
+// The redacted append is LINE-BUFFERED: chunks can split a match mid-token (a 100-char bearer
+// JWT straddling a 64KB read boundary would otherwise leak its tail), but keys never span LINES.
+// Complete lines go out redacted; a partial trailing line waits for its newline. Every byte is
+// appended exactly once, in order, so the file stays verbatim apart from redactions.
+if (process.argv[1] && process.argv[1].endsWith("redact.mjs") && (process.argv[2] === "--tee" || process.argv[2] === "--tee2")) {
+  const { appendFileSync } = await import("node:fs");
+  const target = process.argv[3];
+  const passthrough = process.argv[2] === "--tee"
+    ? (c) => process.stdout.write(c)
+    : (c) => process.stderr.write(c);
+  let carry = "";
+  process.stdin.on("data", (chunk) => {
+    passthrough(chunk);
+    const lines = (carry + chunk.toString("utf8")).split("\n");
+    carry = lines.pop();   // the partial trailing line — or "" when the chunk ended on a newline
+    if (lines.length) {
+      try { appendFileSync(target, redactKeys(lines.join("\n")) + "\n"); } catch {}
+    }
+  });
+  process.stdin.on("end", () => {
+    if (carry) { try { appendFileSync(target, redactKeys(carry)); } catch {} }
+  });
+  process.stdin.resume();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.29",
+  "version": "0.18.31",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [