trantor 0.18.36 → 0.18.37

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.36",
+  "version": "0.18.37",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/baton.mjs

@@ -17,6 +17,10 @@ import { writeHandoff, spawnBaton, resolveHandoffSurface } from "../hooks/lib/ha
 const cwd = process.cwd();
 const resolved = resolveHandoffSurface({ projectDir: process.env.CLAUDE_PROJECT_DIR || cwd, sessionId: process.env.CLAUDE_SESSION_ID || "" });
 const project = resolved.project;
+// #6218 — the transcript is found under the RESOLVED session directory (CLAUDE_PROJECT_DIR, the
+// dir the session was launched in — how Claude itself names ~/.claude/projects), never a shell
+// cwd that cd'd somewhere else: a handoff record must carry the transcript it was written from.
+const sessionDir = resolved.projectDir;
 
 // Model-authored handoffs ride THIS binary too (`trantor handoff` — always the global install's
 // CURRENT code, never the plugin-cache copy a session booted with, the stale-0.18.20 bug). A piped
@@ -38,10 +42,10 @@ if (stdinIsPipe() || process.argv.includes("--latest")) {
   autoBaton();
 }
 
-// The active session's transcript = newest *.jsonl directly in this project's Claude dir
-// (~/.claude/projects/<cwd-with-slashes-as-dashes>/), excluding the subagents/ subtree.
+// The active session's transcript = newest *.jsonl directly in the session dir's Claude dir
+// (~/.claude/projects/<sessionDir-with-slashes-as-dashes>/), excluding the subagents/ subtree.
 function findTranscript() {
-  const dashed = cwd.replace(/\//g, "-");
+  const dashed = sessionDir.replace(/\//g, "-");
   const base = join(homedir(), ".claude", "projects");
   let best = "", bestM = 0;
   let dirs = []; try { dirs = readdirSync(base).filter(d => d === dashed || d.endsWith(dashed)); } catch {}

package/bin/crew-runner.mjs

@@ -24,7 +24,8 @@ import {
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 import {
-  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, PARKING_REASONS,
+  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
+  senderProjectOf, isLinkedProject,
 } from "../lib/turn-policy.mjs";
 
 const AGENT = process.argv[2];
@@ -304,7 +305,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse (Scape's Lloyd/Argus loop, Trantor-shaped) --------------------
 // A message-driven seat is DEAF between messages. An orchestrator seat with a mission needs a
@@ -435,8 +436,10 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
 // redelivered to. So those two reasons PARK — the queue is kept, the ladder stops, and the room is
 // told once, with the reset time when the CLI printed one. `trantor up` (a restart) resumes.
 let parkAnnounced = false;
-async function parkSeat(reason, undelivered) {
-  const resetAt = parseResetAt(lastErrText);
+async function parkSeat(reason, undelivered, resetHint = 0) {
+  // A seat that went QUIET printed no wall message to parse (#6131), so its own balance row is the
+  // only place the reset time exists. Output first when there is any: it is this turn's evidence.
+  const resetAt = parseResetAt(lastErrText) || resetHint;
   const when = resetAt ? new Date(resetAt).toLocaleString() : "";
   if (!parkAnnounced) {
     parkAnnounced = true;
@@ -456,8 +459,12 @@ async function parkSeat(reason, undelivered) {
 async function balanceRows() {
   try {
     const { fetchBalances } = await import("../lib/balances.mjs");
+    // Same key sources the crew itself uses: QWEN_API_KEY (and most others) live in
+    // ~/.agent-bus/.env, not in the runner's inherited environment — reading bare process.env
+    // here would report "no key" and quietly leave every silent turn classified as a crash.
+    const { resolveKeys } = await import("../lib/provider-keys.mjs");
     return await Promise.race([
-      fetchBalances(process.env, { only: [AGENT] }),
+      fetchBalances(resolveKeys(process.env), { only: [AGENT] }),
       new Promise((r) => setTimeout(() => r([]), 4000)),
     ]);
   } catch { return []; }
@@ -630,7 +637,7 @@ wait $job; turn_exit=$?
 [ -n "$boxpid" ] && kill $boxpid 2>/dev/null
 wait
 exit $turn_exit`;
-  const r = spawnSync("/bin/bash", ["-c", shell], {
+  const spawnOpts = {
     // detached: bash leads its OWN process group, so the time box can kill the CLI and everything
     // it spawned with one signal instead of orphaning the model process behind a dead shell.
     // stdin is /dev/null for every seat (it already was for codex/kimi/dsh via `< /dev/null`):
@@ -638,12 +645,14 @@ exit $turn_exit`;
     // takes SIGTTIN and stops forever. Nothing here runs interactively — every CLI is in -p /
     // exec / run mode — so closing stdin is what makes the group safe.
     detached: true,
-    // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
-    // still ends the turn. When the in-shell box works — the normal path — this never fires, which
-    // is the point: the shell kills while the tree is still walkable, node cannot.
-    ...(TURN_MAX_MS ? { timeout: TURN_MAX_MS + 30000, killSignal: "SIGKILL" } : {}),
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : ["ignore", "inherit", "inherit"],
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
+      // #6228: badges this seat's env as belonging to PROJ, distinctly from a one-off RELAY_PROJECT
+      // override (bin/crew.sh's own tests, and any deliberate `RELAY_PROJECT=x trantor up` from a
+      // plain shell, set RELAY_PROJECT alone and must keep working — only THIS marker means "the
+      // env I'm running in already has a project home"). crew.sh's `up` guard refuses to bring up a
+      // DIFFERENT project's crew from a shell carrying this badge, same as it refuses TRANTOR_ORCH.
+      TRANTOR_SEAT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
       //
       // The handoff machinery exists for an INTERACTIVE session: near its context limit it writes a
@@ -656,7 +665,12 @@ exit $turn_exit`;
       // sitting there days later. To the operator that reads as "why are there two duty agents".
       TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
-  });
+  };
+  // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
+  // still ends the turn. When the in-shell box works — the normal path — this never fires, which
+  // is the point: the shell kills while the tree is still walkable, node cannot.
+  if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed.
@@ -722,7 +736,10 @@ exit $turn_exit`;
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   const tokens = parseTurnTokens(ownOut);
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict, ...(tokens ? { tokens } : {}), ...(cut ? { cut: true } : {}) });
+  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict };
+  if (tokens) telemetryRow.tokens = tokens;
+  if (cut) telemetryRow.cut = true;
+  telemetry(telemetryRow);
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
@@ -827,6 +844,20 @@ function shouldWake(message) {
     && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
 }
 
+// #6228: the operator's declared project links, cached briefly so a burst of wakes doesn't hit
+// /policy per message. Fails CLOSED on an unreachable hub (keeps whatever was last known, empty
+// on a cold start) — the mechanical fence the hub enforces at write time must not go soft just
+// because the read-side cache call happened to miss.
+let linksCache = { at: 0, links: [] };
+async function currentLinks() {
+  if (Date.now() - linksCache.at < 60000) return linksCache.links;
+  try {
+    const r = await api("/policy");
+    linksCache = { at: Date.now(), links: Array.isArray(r?.links) ? r.links : [] };
+  } catch {}
+  return linksCache.links;
+}
+
 function askedExcerpt(message) {
   let text = String(message?.text || "").replace(/\s+/g, " ").trim();
   const nested = text.search(/\s+[·|]\s*asked\s*:/i);
@@ -932,7 +963,19 @@ function askedExcerpt(message) {
     // deafness problem: the seat would never learn what it was told (#6134).
     const bcast = [...rest.filter(m => !direct.includes(m) && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
-    const wake = [...direct, ...mentions];
+    const wakeCandidates = [...direct, ...mentions];
+    // #6228: a wake naming another project (its sender's home project, not this seat's, and the
+    // two are not `trantor policy link`ed) is dropped without acting — never queued, never folded
+    // into context. One report goes back to the sender so it does not just look like silence.
+    const links = wakeCandidates.length ? await currentLinks() : [];
+    const crossProject = wakeCandidates.filter(m => !isLinkedProject(senderProjectOf(m.from), PROJ, links));
+    for (const m of crossProject) {
+      const sp = senderProjectOf(m.from) || "?";
+      log(`\x1b[33mcross-project wake dropped\x1b[0m — ${m.from} (${sp}) is not ${PROJ}'s project and the two are not linked`);
+      api("/send", { from: SESSION, to: m.from, project: sp, kind: "status",
+        text: `⛔ cross-project: ${SESSION} is ${PROJ}'s seat, not ${sp}'s — dropped without acting. Link them first: trantor policy link ${PROJ} ${sp} --reason "<why>"` }).catch(() => {});
+    }
+    const wake = wakeCandidates.filter(m => !crossProject.includes(m));
     if (!wake.length) { if (bcast.length) { savePending(pendingWake, pendingBcast); log(`${bcast.length} broadcast(s) batched (no wake) — ${pendingBcast.length} pending`); } continue; }
     // Queue BEFORE running the turn, and persist immediately. Everything between here and a clean
     // exit 0 — the CLI dying, the machine losing power — now leaves a record of what this seat owes.
@@ -998,11 +1041,18 @@ function askedExcerpt(message) {
       // #6131: a silent turn on a seat whose plan reads spent is exhaustion wearing a crash's
       // clothes. Only that one reason is ever re-read, and only from the seat's own balance rows.
       let reason = classify(ec);
-      if (reason === "empty-output") reason = reasonWithBalances(reason, await balanceRows());
+      let quotaReset = 0;
+      if (reason === "empty-output") {
+        const rows = await balanceRows();
+        reason = reasonWithBalances(reason, rows);
+        // The rows that just proved the plan is spent also carry when it lifts — a park that names
+        // the reset is a wait, a park that cannot is a seat the operator has to remember by hand.
+        if (reason === "exhausted") quotaReset = quotaResetAt(rows);
+      }
       savePending(pendingWake, pendingBcast);
       await reportFailure(ec, "message", pendingWake.length, reason);
       if (PARKING_REASONS.has(reason)) {
-        retryAt = await parkSeat(reason, pendingWake.length);
+        retryAt = await parkSeat(reason, pendingWake.length, quotaReset);
         await notifyAssigners(assigners,
           `⛔ your contract is PARKED on ${SESSION} (${reason}) — not retrying · asked: "${asked}"`);
         lastTurnAt = Date.now();

package/bin/crew.sh

@@ -76,6 +76,40 @@ SEATDIR="$HOME/.agent-bus/seats"; mkdir -p "$SEATDIR"
 DRY="${CREW_DRY_RUN:-0}"
 run() { if [ "$DRY" = "1" ]; then echo "[dry] $*"; else eval "$*"; fi; }
 
+# ── cross-project guard (#6228) ────────────────────────────────────────────────────────────────────
+# The pr-os incident: an orchestrator pane badged TRANTOR_ORCH=pr-os ran `trantor up` while cd'd into
+# the crebral-com worktree and brought up seats there under its OWN session. TRANTOR_ORCH (set once by
+# `trantor open`, never per-invocation) and TRANTOR_SEAT (set once by crew-runner.mjs on every seat it
+# spawns, see bin/crew-runner.mjs) are both STABLE badges of "this shell already has a project home" —
+# unlike RELAY_PROJECT alone, which this same script's own tests legitimately override per-invocation
+# to name a target explicitly (a bare `RELAY_PROJECT=x trantor up` from an unbadged shell is the
+# operator, not a breach, and must keep working). A badged shell whose badge disagrees with the `up`
+# target refuses mechanically — the CLI belt to the hub's own 403 (hub.mjs crossProjectGuard).
+# A declared `trantor policy link` opens the door, same exception the hub and runner honor — so this
+# belt must check, not just refuse on sight. `policy.mjs check` asks the hub; CREW_TEST_POLICY_LINKS
+# is a hermetic override for test-crew.sh (comma-separated `a:b` pairs) so the drill never depends on
+# a real hub being reachable, or on nothing already listening on the default loopback port.
+if [ "$CMD" = "up" ]; then
+  BADGE="${TRANTOR_ORCH:-${TRANTOR_SEAT:-}}"
+  if [ -n "$BADGE" ] && [ "$BADGE" != "$PROJ" ]; then
+    LINKED=0
+    if [ -n "${CREW_TEST_POLICY_LINKS+x}" ]; then
+      case ",${CREW_TEST_POLICY_LINKS}," in
+        *",$BADGE:$PROJ,"*|*",$PROJ:$BADGE,"*) LINKED=1 ;;
+      esac
+    elif node "$BUS_DIR/bin/policy.mjs" check "$BADGE" "$PROJ" >/dev/null 2>&1; then
+      LINKED=1
+    fi
+    if [ "$LINKED" != "1" ]; then
+      echo "trantor: refused — this shell is badged for '$BADGE', not '$PROJ'." >&2
+      echo "  Cross-project action is a breach unless the operator linked the projects." >&2
+      echo "  Run: trantor policy link $BADGE $PROJ --reason \"<why>\"" >&2
+      exit 1
+    fi
+    echo "trantor: '$BADGE' ↔ '$PROJ' is policy-linked — proceeding." >&2
+  fi
+fi
+
 # ── STATE helpers ──────────────────────────────────────────────────────────────────────────────────
 # Row schema (TSV): PROJECT <TAB> KIND <TAB> AGENT <TAB> HANDLE
 #   KIND=win    HANDLE=Terminal window id           (one row per agent)

package/bin/policy.mjs

@@ -2,7 +2,10 @@
 // trantor policy — the autonomy ladder's admin surface (PRD §6): show levels + links,
 // set a project's level, declare that two projects are codependent.
 //   trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b>
+//   trantor policy check <a> <b>   — exit 0 (prints "yes") if linked or identical, else exit 1 ("no")
 // Drafted by scrooge (deepseek-v4-flash), integrated by the orchestrator.
+// `check` is what bin/crew.sh's cross-project guard (#6228) shells out to: the CLI belt needs to
+// know whether the operator already linked the two projects before it refuses `trantor up`.
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -30,7 +33,7 @@ const post = async (hub, payload) => {
 
 const legend = { 1: "1 observe", 2: "2 warn", 3: "3 gate", 4: "4 auto" };
 function usage() {
-  console.log('usage: trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b>');
+  console.log('usage: trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b> | check <a> <b>');
   process.exit(1);
 }
 
@@ -80,4 +83,21 @@ if (cmd === "unlink") {
   process.exit(0);
 }
 
+if (cmd === "check") {
+  if (!arg1 || !arg2) usage();
+  if (arg1 === arg2) { console.log("yes"); process.exit(0); }
+  let linked = false;
+  for (const hub of hubs) {
+    try {
+      const data = await get(hub);
+      if ((data.links || []).some((l) => {
+        const ps = (l.projects || []).map((p) => String(p).toLowerCase());
+        return ps.includes(arg1.toLowerCase()) && ps.includes(arg2.toLowerCase());
+      })) { linked = true; break; }
+    } catch { /* unreachable hub: fails closed, not linked */ }
+  }
+  console.log(linked ? "yes" : "no");
+  process.exit(linked ? 0 : 1);
+}
+
 usage();

package/bin/slop-gate.mjs

@@ -43,6 +43,21 @@ if (SURFACE) {
 // excluded legacy files (hub.mjs, mcp.mjs) stay excluded here too.
 const r = spawnSync("npx", ["oxlint", ...args], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
 const out = (r.stdout || "") + (r.stderr || "");
+// A gate that cannot run must not read as clean. Witnessed 2026-09-03: a seat worktree with no
+// node_modules made `npx oxlint` die with an npm error, the empty output had zero hits, and
+// "slop-gate clean" rode into main on 23 real anti-slop errors. the exit contract below is the
+// only proof it ran; without it, exit 2 and say so.
+// oxlint prints no run summary here (diagnostics only), so "it ran" is read from its exit
+// contract: 0 = clean, 1 = diagnostics printed. An npm error, a launch error, an exit code oxlint
+// never uses, a 1 with no diagnostic line, or "No files found" is not a verdict.
+const diag = /:\d+:\d+: (error|warning)\b/.test(out);
+const ran = !r.error && !/^npm (error|ERR!)/m.test(out) && !/No files found to lint/.test(out)
+  && (r.status === 0 || (r.status === 1 && diag));
+if (!ran) {
+  console.error(out.trim().split("\n").slice(-6).join("\n"));
+  console.error("\nslop-gate: could not run oxlint, so there is no verdict and this is NOT clean. Install deps in this checkout (pnpm install) and rerun.");
+  process.exit(2);
+}
 const hits = out.split("\n").filter(l => /error\s+anti-slop\(/.test(l));
 
 if (hits.length) {

package/hooks/lib/handoff.mjs

@@ -11,7 +11,7 @@
 // wall when we know the window size. Both paths share a per-session guard so we
 // never write/spawn twice for the same context window.
 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, openSync, readSync, fstatSync, closeSync, rmSync } from "node:fs";
-import { join, basename, dirname } from "node:path";
+import { join, basename, dirname, sep } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -621,18 +621,52 @@ export function orchProjectForSession(sid) {
   return "";
 }
 
+// Does the cwd actually lie inside THIS project's ground (#6218)? Two true homes: a directory
+// named for the project (the project root or anything below it — the #6074 subfolder case), and
+// the project's agent-bus worktrees (<bus>/worktrees/<project>/<seat>). Pure + exported so the
+// drill can pin both without touching the operator's disk layout.
+export function cwdInsideProject(projectName, dir, bus = process.env.AGENT_BUS_DIR || process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus")) {
+  if (!projectName || !dir) return false;
+  const wt = join(bus, "worktrees", projectName);
+  if (dir === wt || dir.startsWith(wt + sep)) return true;
+  let cur = dir;
+  for (;;) {
+    if (basename(cur) === projectName) return true;
+    const parent = dirname(cur);
+    if (parent === cur) return false;
+    cur = parent;
+  }
+}
+
 // The one resolver. Returns { project, projectDir, pane, surface }:
 //   pane    — the session's own pane id ("" when it is not a hosted pane)
 //   surface — "pane" (the baton MUST take the pane leg) or "window" (today's behavior)
 //   project — the REGISTERED project name; a subfolder cwd never renames it
+// #6218 — the badge wins only where it is TRUE. Witnessed 2026-09-03: a run from a
+// trantor-badged shell in ~/development/tiny-timer wrote "handoff saved for trantor" with
+// tiny-timer's transcript inside. #6074's registration-before-cwd rule was written for a
+// subfolder cwd of the SAME project; a FOREIGN project dir is a different case and must not be
+// silently relabeled. So the badge (and the rest of the registration chain behind it) claims
+// this handoff only when the cwd lies inside the named project's directory or one of its
+// worktrees; a badged shell sitting elsewhere resolves from the cwd, and ONE warning line names
+// both — the badge that lied and the project the record actually went to.
 export function resolveHandoffSurface({ projectDir, sessionId, env = process.env } = {}) {
   const dir = projectDir || env.CLAUDE_PROJECT_DIR || process.cwd();
   const badge = String(env.TRANTOR_ORCH || "").trim();
   let project = "";
-  if (badge && badge !== "1") project = badge;                       // `trantor open` badge carries the name
-  if (!project && env.RELAY_PROJECT) project = String(env.RELAY_PROJECT).trim();
-  if (!project) project = orchProjectForSession(sessionId);
-  if (!project) project = resolveProject(dir);                       // last resort: cwd (git-root aware)
+  let foreignBadge = "";
+  if (badge && badge !== "1") {                                      // `trantor open` badge carries the name
+    if (cwdInsideProject(badge, dir)) project = badge;
+    else foreignBadge = badge;                                       // the badge lies about this cwd
+  }
+  if (!project && !foreignBadge && env.RELAY_PROJECT) project = String(env.RELAY_PROJECT).trim();
+  if (!project && !foreignBadge) project = orchProjectForSession(sessionId);
+  // Last resort: the cwd (git-root aware). With a foreign badge, the shell's own RELAY_PROJECT
+  // is scrubbed from the fallback's env — it is the same registration that just lied (#6218).
+  if (!project) project = resolveProject(dir, foreignBadge ? { ...env, RELAY_PROJECT: "" } : env);
+  if (foreignBadge) {
+    console.error(`trantor handoff: TRANTOR_ORCH=${foreignBadge} but the working directory (${dir}) is not inside ${foreignBadge}'s project or its worktrees — saving the handoff for ${project} (resolved from the cwd)`);
+  }
   return { project, projectDir: dir, pane: paneSurfaceEnv(env), surface: paneSurfaceEnv(env) ? "pane" : "window" };
 }
 

package/hub.mjs

@@ -1101,6 +1101,61 @@ function projectFromRequest(P, q, b) {
   }
   return canon(String(b?.project || q?.project || "").slice(0, 80));
 }
+// --- Cross-project guard (#6228) -----------------------------------------------------------
+// scopeAllows/canRead answer "can this identity touch project P at all" — and most identities
+// are minted project:"*" role:"owner" by defaultScopesFor (any non-agent kind: an orchestrator,
+// genesis, a human). That is not a project fence; it is exactly the loophole the pr-os
+// orchestrator walked through to register seats and post contracts into crebral-com from its
+// own session, nothing it was ever working. This is the fence: does the CALLER's own project
+// (its identity name's "kind:project" suffix, the same convention defaultScopesFor reads) match
+// the project the request ACTS on. Only a declared `trantor policy link` (state.orgPolicy.links,
+// the same store /policy reads and writes — POST /policy is itself OWNER_ENDPOINTS-gated) or the
+// operator's own identity (kind "human", the key /instance/supersede already treats as owner)
+// opens the door. Applies to the five endpoints that reach across sessions or mint access:
+// /send, /task, /task/update, /register, /invite.
+const CROSS_PROJECT_ENDPOINTS = new Set(["/send", "/task", "/task/update", "/register", "/invite"]);
+function projectsLinked(a, b) {
+  if (!a || !b || a === b) return true;
+  return overseerPolicy().links.some(l => {
+    const ps = (l.projects || []).map(p => canon(p));
+    return ps.includes(a) && ps.includes(b);
+  });
+}
+// The caller's home project, by the SAME "name suffix after the colon" rule defaultScopesFor
+// uses to mint a fresh identity's default scope. An identity with no colon in its name (a bare
+// human alias, or a tool identity never given a project) has no home to fence — nothing to check.
+function callerProject(auth) {
+  const name = String(auth?.identity?.name || "");
+  return name.includes(":") ? canon(name.slice(name.lastIndexOf(":") + 1)) : "";
+}
+function crossProjectTarget(P, b) {
+  if (P === "/send") {
+    if (!b?.to || b.to === "all") return "";   // broadcast: existing hub-wide behavior, untouched
+    const to = String(b.to);
+    return canon(state.peers[to]?.project || (to.includes(":") ? to.slice(to.lastIndexOf(":") + 1) : ""));
+  }
+  if (P === "/task" || P === "/register") return canon(String(b?.project || "").slice(0, 80));
+  if (P === "/task/update") {
+    const t = state.tasks.find(x => x.id === Number(b?.id));
+    return t?.project || "";
+  }
+  if (P === "/invite") {
+    // an invite MINTS access into whatever project(s) its scopes name — a wildcard scope names none.
+    const scopes = Array.isArray(b?.scopes) ? b.scopes : [];
+    return scopes.map(s => canon(String(s?.project || ""))).find(p => p && p !== "*") || "";
+  }
+  return "";
+}
+function crossProjectGuard(auth, P, b) {
+  if (!CROSS_PROJECT_ENDPOINTS.has(P) || AUTH_MODE === "off" || !auth?.identity) return { ok: true };
+  if (auth.identity.kind === "human") return { ok: true };   // the operator's own key
+  const home = callerProject(auth);
+  if (!home) return { ok: true };
+  const target = crossProjectTarget(P, b);
+  if (!target || target === home || projectsLinked(home, target)) return { ok: true };
+  return { ok: false, code: 403,
+    error: `cross-project: ${home} may not act on ${target} — cross-project action is a breach unless the operator linked the projects. Run: trantor policy link ${home} ${target} --reason "<why>"` };
+}
 // Is a stored baton claim still worth honouring? The claim names the instance it spared
 // (`exceptInstanceId`), so we defer to THAT instance only while it is still being seen. A claimant
 // that died stops muzzling its twins; one that comes back starts again. Records claimed before
@@ -1516,6 +1571,8 @@ const server = http.createServer(async (req, res) => {
       }
       const scopes = (Array.isArray(bi.scopes) ? bi.scopes : []).map(cleanScope).filter(Boolean).slice(0, 20);
       if (!scopes.length) return json(res, 400, { error: "scopes required" });
+      const cpg = crossProjectGuard(auth, P, { scopes });
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       // Honour the requested TTL. A 60s FLOOR here silently inflated `ttlSec: 1` to a minute, so a
       // token the caller asked to expire in a second stayed valid — and an expired-token test passed
       // a live token straight through /enroll. Cap the ceiling, never the floor.
@@ -1530,7 +1587,10 @@ const server = http.createServer(async (req, res) => {
     const authz = authorize(auth, req.method, P, projectFromRequest(P, q, b0));
     if (!authz.ok) return json(res, authz.code || 403, { error: authz.error || "forbidden" });
     if (req.method === "POST" && P === "/register") {
-      const b = await body(req); touch(b.session, b.status, b.project, b.hookVersion, auth);
+      const b = await body(req);
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
+      touch(b.session, b.status, b.project, b.hookVersion, auth);
       // WHO is this, really: the LLM brand + the exact model currently loaded. In-memory like the
       // rest of presence — the next heartbeat re-supplies it after a restart.
       const pr = state.peers[b.session];
@@ -1932,7 +1992,10 @@ const server = http.createServer(async (req, res) => {
     }
     // --- Kanban tasks ---
     if (req.method === "POST" && P === "/task") {           // create a card
-      const b = await body(req); touch(b.by, undefined, b.project, undefined, auth);
+      const b = await body(req);
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
+      touch(b.by, undefined, b.project, undefined, auth);
       if (b.title !== undefined) b.title = stripNulText(b.title);
       if (b.note !== undefined) b.note = stripNulText(b.note);
       const st0 = ["todo","doing","testing","failed","done","blocked"].includes(b.status) ? b.status : "todo";
@@ -2088,6 +2151,8 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
       const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
       if (!t) return json(res, 404, { error: "no such task" });
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       if (b.title !== undefined) b.title = stripNulText(b.title);
       if (b.note !== undefined) b.note = stripNulText(b.note);
       // Board integrity (#5406): a card can never change hands silently. The assignee is frozen once
@@ -2790,6 +2855,8 @@ const server = http.createServer(async (req, res) => {
       const secretCheck = assertNoSecrets(text);
       if (!secretCheck.ok) return json(res, 400, { error: "secret detected", kinds: secretCheck.kinds || [] });
       if (auth?.identity && String(b.from) !== String(auth.identity.name || "")) return json(res, 403, { error: "from must match signer" });
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       touch(b.from, undefined, undefined, undefined, auth);
       // attribute the message to a project so the dashboard can show it in that project's lane.
       // explicit b.project wins; else the sender's known project; else parsed from a "host:project" id.

package/lib/balances.mjs

@@ -152,8 +152,61 @@ export const ADAPTERS = [
       return { remainingPct, plan, resetTime: head?.nextResetTime || null, detail: "" };
     },
   },
+  {
+    // #6131. The token plan's graded remaining-% lives ONLY behind the QwenCloud console's
+    // cookie-authenticated API (platform-api.qianwenai.com/tokenplan/personal/api/v2/usage — the
+    // console SPA calls it with a browser session; an API key gets the login page back). What the
+    // KEY can read is the plan's WALL: the inference gateway answers 429 insufficient_quota with a
+    // retry-after and the reset time the moment the 7-day plan is spent. That is exactly the state
+    // this row exists for — a seat that is about to go quiet — so it reads the wall, not the gauge,
+    // and says "unknown" rather than inventing a percentage it never measured.
+    //
+    // The probe consumes NO tokens. `messages: []` is an invalid request the model never sees, but
+    // the quota gate runs BEFORE that validation. Captured live 2026-09-03 against the spent plan:
+    // a real model + empty messages → the same 429 as a real completion; an unknown model → 404
+    // model_not_found; a bad key → 401 invalid_api_key. So the gate sits between model lookup and
+    // request validation, and an empty-messages probe is the cheapest thing that can trip it.
+    provider: "qwen", label: "Qwen", kind: "quota", match: ["qwen"], envKeys: ["QWEN_API_KEY"],
+    async fetch(key, env = {}) {
+      const base = String(env.QWEN_BASE_URL || "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1").replace(/\/+$/, "");
+      // Ask the plan which models it has rather than hard-coding an id that a rename would break
+      // (and this doubles as the auth check: a rejected key 401s here, before the probe).
+      const model = ((await getJSON(`${base}/models`, key)).data || [])[0]?.id;
+      if (!model) throw new Error("token plan lists no models");
+      const r = await fetch(`${base}/chat/completions`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${key}`, "content-type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ model, messages: [] }),
+        signal: AbortSignal.timeout(TIMEOUT),
+      });
+      let body; try { body = JSON.parse(await r.text()); } catch { body = null; }
+      const err = body?.error || {};
+      if (r.status === 401 || err.code === "invalid_api_key") throw new Error("invalid API key");
+      if (r.status === 429 || err.code === "insufficient_quota") {
+        // retry-after is authoritative (seconds, exact); the message carries the same instant as
+        // "MM-DD HH:MM:SS UTC" with no year, so it is only the fallback.
+        const secs = num(r.headers.get("retry-after"));
+        const resetTime = secs > 0 ? Date.now() + secs * 1000 : qwenResetFromMessage(err.message);
+        return { remainingPct: 0, plan: "token plan", resetTime, detail: "7-day token plan exhausted" };
+      }
+      // The gate let the request through, so the plan still has room — but how much is console-only.
+      return { remainingPct: null, plan: "token plan", resetTime: null, detail: "plan active (remaining % is console-only)" };
+    },
+  },
 ];
 
+/// "The quota will reset at 09-09 14:32:00 UTC." — Qwen omits the year, so assume the current one
+/// and roll forward when that lands in the past (the plan resets ahead of now, never behind it).
+export function qwenResetFromMessage(msg, now = Date.now()) {
+  const m = /reset at (\d{2})-(\d{2}) (\d{2}):(\d{2})(?::(\d{2}))? UTC/i.exec(String(msg || ""));
+  if (!m) return null;
+  const [, mo, d, h, mi, s] = m;
+  const at = (year) => Date.UTC(year, Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s || 0));
+  const year = new Date(now).getUTCFullYear();
+  const t = at(year);
+  return Number.isFinite(t) ? (t >= now ? t : at(year + 1)) : null;
+}
+
 // thresholds: prepaid by currency, quota by percent-remaining. Override via config.json `lowBalance`
 // (currency keys) and `lowQuotaPct`.
 export const DEFAULT_LOW = { USD: 5, CNY: 35, EUR: 5 };
@@ -203,7 +256,8 @@ export async function fetchBalances(env = process.env, opts = {}) {
     const envKey = a.envKeys.find((k) => env[k]);
     if (!envKey && !a.keyless) return null;                      // configured but no key in env → can't query
     const base = { provider: a.provider, label: a.label, kind: a.kind, via: envKey || "oauth" };
-    try { return { ...base, ok: true, ...(await a.fetch(envKey ? env[envKey] : undefined)) }; }
+    // `env` rides along for adapters that read more than a key (Qwen's base URL); the rest ignore it.
+    try { return { ...base, ok: true, ...(await a.fetch(envKey ? env[envKey] : undefined, env)) }; }
     catch (e) { return { ...base, ok: false, error: String(e?.message || e) }; }
   });
   const rows = (await Promise.all(jobs)).filter(Boolean);
@@ -278,7 +332,7 @@ export function fmtBalance(e) {
 }
 
 function fmtReset(t) {
-  const ms = typeof t === "number" ? t : Date.parse(t);
+  const ms = Number.isFinite(t) ? t : Date.parse(t);
   if (!ms || isNaN(ms)) return "";
   const hrs = (ms - Date.now()) / 3600e3;
   if (hrs < 0) return "soon";

package/lib/project.mjs

@@ -18,8 +18,11 @@ export function gitRoot(dir) {
 }
 
 // Stable project key for a working directory. RELAY_PROJECT > git-root basename > cwd basename.
-export function resolveProject(cwd = process.cwd()) {
-  if (process.env.RELAY_PROJECT) return process.env.RELAY_PROJECT.slice(0, 80);
+// The env comes in as a parameter (#6218): the handoff resolver must be able to resolve the cwd
+// WITHOUT the shell's RELAY_PROJECT — a badge that lied about the cwd must not get a second
+// voice through the fallback's own env read.
+export function resolveProject(cwd = process.cwd(), env = process.env) {
+  if (env.RELAY_PROJECT) return env.RELAY_PROJECT.slice(0, 80);
   const root = gitRoot(cwd);
   // A LINKED WORKTREE must resolve to its MAIN repo's name, not its own directory name. Seat
   // worktrees live at ~/.agent-bus/worktrees/<project>/<agent>, so the old basename rule named the

package/lib/turn-policy.mjs

@@ -109,6 +109,42 @@ export function reasonWithBalances(reason, rows) {
   return reason === "empty-output" && quotaSpent(rows) ? "exhausted" : reason;
 }
 
+/// #6131: when the seat said nothing, its balance row is the only place the reset time exists —
+/// `parseResetAt` had no output to read. The EARLIEST spent row wins, because the seat is usable
+/// again the moment the first of its walls lifts. 0 when no spent row named a time.
+export function quotaResetAt(rows, now = Date.now()) {
+  const times = (Array.isArray(rows) ? rows : []).flatMap((r) => {
+    if (!r || !r.ok) return [];
+    if (r.kind === "quota") return r.remainingPct != null && r.remainingPct <= 0 ? [r.resetTime] : [];
+    if (r.kind === "windows") {
+      return (r.windows || []).filter((w) => w.locked || (w.usedPct != null && w.usedPct >= 100)).map((w) => w.resetsAt);
+    }
+    return [];
+  }).map((t) => (Number.isFinite(t) ? t : Date.parse(t))).filter((t) => Number.isFinite(t) && t > now);
+  return times.length ? Math.min(...times) : 0;
+}
+
 /// Seats that park rather than retry. A backend error is the provider having a bad minute and the
 /// ladder is exactly right for it; a spent plan or a rejected key will not fix itself on a timer.
 export const PARKING_REASONS = new Set(["exhausted", "auth"]);
+
+/// #6228: the sender's home project, by the same "name suffix after the last colon" convention
+/// every crew/orch identity is minted with (isRunnerSession in crew-runner.mjs uses the mirror
+/// check). A session id with no colon (a bare human alias) has no home project to fence.
+export function senderProjectOf(session) {
+  const s = String(session || "");
+  return s.includes(":") ? s.slice(s.lastIndexOf(":") + 1) : "";
+}
+
+/// #6228: is a wake from `senderProject` allowed to reach a seat whose own project is
+/// `seatProject`? Same project always is; a declared `trantor policy link` (the hub's own
+/// state.orgPolicy.links, mirrored to every seat via GET /policy) opens the door for two named
+/// projects; anything else is a cross-project wake and must be dropped, never worked — the
+/// runner's half of the guard the hub enforces at write time.
+export function isLinkedProject(senderProject, seatProject, links) {
+  if (!senderProject || !seatProject || senderProject === seatProject) return true;
+  return (Array.isArray(links) ? links : []).some((l) => {
+    const ps = (l?.projects || []).map((p) => String(p || "").toLowerCase());
+    return ps.includes(String(senderProject).toLowerCase()) && ps.includes(String(seatProject).toLowerCase());
+  });
+}

package/mcp.mjs

@@ -380,7 +380,7 @@ server.tool("relay_peers", "Find who you can talk to: the live agent sessions on
   return { content: [{ type: "text", text: lines.join("\n") || "no peers yet" }] };
 });
 
-server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project sends are allowed.",
+server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project action is a breach unless the operator linked the projects (`trantor policy link <a> <b> --reason \"<why>\"`) — the hub answers 403 for a send into an unlinked project.",
   { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body"),
     wake: z.boolean().optional().describe("false = context, not a contract: the message batches into the target's next turn instead of buying it a whole CLI session. Use it for acks, FYIs and queue notes; leave it unset for anything you expect worked on.") },
   async ({ to, text, wake }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.36",
+  "version": "0.18.37",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"

package/skills/crew/SKILL.md

@@ -46,6 +46,16 @@ explicit EVENT/INTERFACE CONTRACT — cross-agent bugs come from contract drift.
    request natively, which is the whole reason it exists. If it is missing: `trantor app install`.
 
 ## Phase 2 — fire up the crew (with the Advisor's models)
+**Cross-project action is a breach unless the operator linked the projects.** `trantor up` only
+ever targets the project you are already IN — never bring up seats in, register a seat into, or
+send a card/contract to a DIFFERENT project because an instruction reads that way ("build it where
+the answers are stored" is not a project name). If the work genuinely belongs to another project,
+name it and ask the operator once; do not infer it and do not route around the refusal. The hub
+403s a cross-project `/send`, `/task`, `/task/update`, `/register` or `/invite` on its own
+(`trantor policy link <a> <b> --reason "<why>"` is the only door), and a badged shell's `trantor up`
+refuses the same way — this is belt and braces, not the first line of defense; get the target
+project right before dispatching.
+
 **Each crew card from `relay_advise` carries a `launch` spec — run it VERBATIM; never invent a
 CLI invocation or run an agent "in a terminal" yourself.** Spawn every seat in one call:
 `trantor up <launch> <launch> … --task <kind> --difficulty <diff>`. The live roster + the

package/skills/prd-review/SKILL.md

@@ -149,6 +149,14 @@ The PRD card is done. Now one author writes the design and the same reviewers re
 
 The confirmed TDD is the gate. Do not ask the operator again merely to open its build cards.
 
+**But confirm the TARGET PROJECT before dispatching, always.** An ambiguous instruction ("build it
+where the answers are stored") is not a project name — it does not license bringing up seats in, or
+sending contracts into, a DIFFERENT project than the one you are reviewing. Name the project and ask
+the operator once if the brief points anywhere but here. Cross-project action is a breach unless the
+operator linked the projects (`trantor policy link <a> <b> --reason "<why>"`), and the hub, the
+`trantor up` CLI, and every seat's runner all refuse it mechanically — belt and braces, not a
+substitute for getting the target right in the first place.
+
 1. Move the TDD card through `testing` to `done` with the tally and the decision.
 2. `relay_advise` with the work breakdown's packages, then one `relay_task_add` per package:
    phase `build`, the advisor's assignee and `model`, its `difficulty`, `deps` on the packages it