trantor 0.18.38 → 0.18.40

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.38",
+  "version": "0.18.40",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -539,6 +539,15 @@ let inFollowUp = false;
 let sessionCard = 0;
 
 let sid = "";
+// #6206: the watchdog is DETACHED, so a runner that dies without ending it leaves an orphan
+// sleeping toward a false alarm against whatever runner comes next (22 found on 2026-09-03).
+// Every exit path therefore kills it, and the stamp carries this runner's instance id so any
+// survivor that outlives the kill still refuses to speak for a runner it never belonged to.
+const RUNNER_ID = `${process.pid}.${Date.now()}`;
+let WD_CHILD = null;
+function killWatchdog() { if (WD_CHILD) { try { WD_CHILD.kill("SIGTERM"); } catch {} WD_CHILD = null; } }
+process.on("exit", killWatchdog);
+
 async function runTurn(prompt, isFirst, trigger = "kickoff") {
   TURN++; banner(trigger);
   const t0 = Date.now();
@@ -593,17 +602,25 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | ${SCRUB} --tee ${ERRF}`;
   // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
   // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
-  // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
-  const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS || 15 * 60 * 1000);
+  // the window with no activity (transcript, worktree, or stderr — #6206: stdout silence alone
+  // is never a stall) earns ONE direct stall report to the foreman, never a kill.
+  // #6206: the window's floor is 10 minutes and is never derived from TRANTOR_TURN_MAX_MS —
+  // a 1-minute alarm is a false alarm by construction. The env override exists for drills.
+  const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS) || 10 * 60 * 1000;
   const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  // #6206: where the CLI appends its session transcript (claude's project dir; other CLIs may
+  // not have one — the watchdog treats a missing dir as a quiet channel). Also exported to the
+  // CLI's env so a drill's fake CLI can write transcript lines the watchdog will see.
+  const TRANSCRIPT_DIR = join(homedir(), ".claude", "projects", TURN_DIR.replace(/[^a-zA-Z0-9]/g, "-"));
   // Written by the shell's own time box (below) and read back here — the only honest signal that
   // the turn was CUT rather than that the CLI failed on its own. Cleared before every turn.
   const CUTF = join(homedir(), ".agent-bus", `turncut-${AGENT}-${PROJ}`);
   try { unlinkSync(CUTF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now() }));
-    const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB],
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID }));
+    const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR],
       { detached: true, stdio: "ignore" });
+    WD_CHILD = wd;
     wd.unref();
   } catch {}
   // Preserve the CLI's exit before waiting for the stderr process substitution. Without the
@@ -663,7 +680,10 @@ exit $turn_exit`;
       // Observed on the duty seat: handoff records at 17:24 and 18:59 on 2026-08-24, and two stray
       // `claude` processes in ~/.agent-bus/trantor-duty started at 17:24:57 and 18:59:50, still
       // sitting there days later. To the operator that reads as "why are there two duty agents".
-      TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
+      TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1",
+      // #6206: the seat's transcript dir — a real CLI ignores it, a drill's fake CLI writes
+      // its transcript lines there so the watchdog sees the liveness a real claude shows.
+      TRANTOR_TRANSCRIPT_DIR: TRANSCRIPT_DIR },
     maxBuffer: 16 * 1024 * 1024,
   };
   // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
@@ -671,7 +691,8 @@ exit $turn_exit`;
   // is the point: the shell kills while the tree is still walkable, node cannot.
   if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
-  try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
+  killWatchdog();                        // #6206: turn over — the watchdog dies NOW, it does not sleep on
+  try { unlinkSync(STAMPF); } catch {}   // disarm any survivor: the stamp is gone
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed.
   const boxed = existsSync(CUTF);

package/bin/crew.sh

@@ -201,7 +201,7 @@ let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(
 process.stdout.write((((r.workspace||{}).workspace_id)||"")+"\t"+(((r.root_pane||{}).pane_id)||""))}catch(e){}})'
 }
 _herdr_split() {   # $1=pane id ("" = UI-focused pane)  $2=right|down  $3=cwd (optional) → new pane id
-  local a=(pane split); [ -n "$1" ] && a+=("$1"); a+=(--direction "$2" --no-focus); [ -n "$3" ] && a+=(--cwd "$3")
+  local a=(pane split); [ -n "$1" ] && a+=("$1"); a+=(--direction "$2" --no-focus); [ -n "${3:-}" ] && a+=(--cwd "$3")
   _herdr "${a[@]}" 2>/dev/null | node -e '
 let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(d.slice(d.search(/[\[{]/))).result)||{};
 process.stdout.write(((r.pane||{}).pane_id)||"")}catch(e){}})'

package/bin/turn-watchdog.mjs

@@ -1,36 +1,92 @@
 #!/usr/bin/env node
-// Turn watchdog (#5684). runTurn is spawnSync — the runner cannot watch its own turn — so this
-// DETACHED helper does: armed at turn start, disarmed by turn end (the stamp file vanishes or
-// its turn number moves on). A turn that runs past the window with NO output growth earns ONE
-// direct stall report to the foreman (episode, never a timer storm), and the turn is never
-// killed — reporting is the whole job. The operator's 2026-08-31 complaint is the incident:
-// seats sat visibly dead in their panes while every signal channel stayed quiet.
+// Turn watchdog (#5684, reworked #6206). runTurn is spawnSync — the runner cannot watch its own
+// turn — so this DETACHED helper does: armed at turn start, disarmed by turn end. A turn past
+// the window with NO new activity earns ONE direct stall report to the foreman (episode, never a
+// timer storm), and the turn is never killed — reporting is the whole job.
 //
-//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl>
-import { readFileSync, existsSync, statSync } from "node:fs";
+// #6206: stdout silence is NOT a stall — `claude -p` prints nothing until the turn ends by
+// design, so a seat editing five files was reported STALLED while its transcript advanced.
+// Liveness is new activity in the seat's transcript (the CLI's session file), its worktree, or
+// stderr growth; silence on ALL of them for a whole window is the only thing reported. And a
+// watchdog never speaks for a runner it does not belong to: the stamp carries the runner's
+// instance id, so a survivor of a replaced runner exits on mismatch or runner death instead of
+// re-matching the NEW runner's turn number (the 09:47 false alarm was exactly that orphan).
+//
+//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir>
+import { readFileSync, statSync, readdirSync } from "node:fs";
+import { join } from "node:path";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
 
-const [stampFile, errFile, windowMsRaw, session, project, hub] = process.argv.slice(2);
-const windowMs = Number(windowMsRaw) || 15 * 60 * 1000;   // no floor: drills pass tiny windows, and one report per turn caps the damage anyway
+const [stampFile, errFile, windowMsRaw, session, project, hub, transcriptDir = "", workDir = ""] = process.argv.slice(2);
+// SAFETY: the 10-minute floor lives in crew-runner.mjs (the default when TRANTOR_TURN_WATCHDOG_MS
+// is unset); this fallback only covers a missing argument. Drills pass tiny windows on purpose.
+const windowMs = Number(windowMsRaw) || 10 * 60 * 1000;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 const readStamp = () => { try { return JSON.parse(readFileSync(stampFile, "utf8")); } catch { return null; } };
 const errSize = () => { try { return statSync(errFile).size; } catch { return 0; } };
 
+// Newest mtime under a directory, .git/node_modules skipped, entry-capped so a big tree cannot
+// wedge a detached helper. A missing directory scores 0 (a codex seat has no claude transcript
+// dir) — liveness needs only ONE channel to move, absence of some channels is fine.
+const SCAN_CAP = 20000;
+function newestMtime(dir) {
+  let best = 0, seen = 0;
+  const walk = (d) => {
+    if (seen > SCAN_CAP) return;
+    let rows = [];
+    try { rows = readdirSync(d, { withFileTypes: true }); } catch { return; }
+    for (const e of rows) {
+      if (++seen > SCAN_CAP || e.name === ".git" || e.name === "node_modules") continue;
+      const p = join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else { try { best = Math.max(best, statSync(p).mtimeMs); } catch {} }
+    }
+  };
+  walk(dir);
+  return best;
+}
+
 const armed = readStamp();
 if (!armed) process.exit(0);
-let baseline = errSize();
+// The runner instance that armed us (pid + boot ts, so a recycled pid cannot impersonate it).
+// A stamp without a runner id (only possible mid-upgrade) skips the liveness check; the id
+// match in the loop still guards it.
+const runnerPid = Number(String(armed.runner || "").split(".")[0]) || 0;
+const runnerAlive = () => {
+  if (!runnerPid) return true;
+  try { process.kill(runnerPid, 0); return true; } catch { return false; }
+};
+
+// One observation of every liveness channel: stderr growth, transcript mtime, worktree mtime.
+const ago = (t) => (t > 0 ? `${Math.max(1, Math.round((Date.now() - t) / 60000))}m ago` : "never");
+const describeLast = (b) => {
+  const parts = [];
+  if (b.wk) parts.push(`worktree ${ago(b.wk)}`);
+  if (b.tr) parts.push(`transcript ${ago(b.tr)}`);
+  return parts.length ? parts.join(", ") : "nothing";
+};
+let baseErr = errSize();
+const armedAt = armed.startedAt || Date.now();
+const SLACK = 2000;   // timestamp granularity + scheduler drift under load
 
 for (;;) {
   await sleep(windowMs);
   const s = readStamp();
-  if (!s || s.turn !== armed.turn) process.exit(0);          // turn ended — nothing to say
-  const size = errSize();
-  if (size > baseline + 200) { baseline = size; continue; }  // producing output: working, re-arm
-  const mins = Math.round((Date.now() - (s.startedAt || Date.now())) / 60000);
+  if (!s || s.turn !== armed.turn || (armed.runner && s.runner !== armed.runner)) process.exit(0); // turn ended, or a NEWER runner owns the stamp now
+  if (!runnerAlive()) process.exit(0);                       // our runner is gone — never speak for it
+  // Activity that counts: anything changed DURING the turn (after arm) and within the window —
+  // the checklist semantics verbatim: "no new activity for the window". Pre-turn files never
+  // count (they predate arm), and absolute freshness cannot drift the way a probe-to-probe
+  // delta does when the seat writes coarsely or the machine loads (the +1130ms false alarm).
+  const freshCut = Math.max(armedAt, Date.now() - windowMs - SLACK);
+  const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
+  const wk = workDir ? newestMtime(workDir) : 0;
+  if (errSize() > baseErr + 200 || tr > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
+  const mins = Math.round((Date.now() - armedAt) / 60000);
   const orch = `${hostId()}:${project}`;
-  const text = `⏱ ${session} turn STALLED — running ${mins}m with no output (turn ${s.turn}). Not killed; check its pane, or \`trantor swap\`.`;
+  const text = `⏱ ${session} turn STALLED — running ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}). Not killed; check its pane, or \`trantor swap\`.`;
   // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
   const to = orch === session ? "all" : orch;
   try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}

package/hooks/sessionstart.mjs

@@ -15,8 +15,9 @@ import { resolveProject, hostId, resolveHubInfo, knownProjects, nonSeatReason, h
 import { formatSubagentManifest } from "../lib/subagent-manifest.mjs";
 import { updateAvailable, maybeNotifyDesktop, readConfig } from "./lib/update-check.mjs";
 import { maybeCheckBalances } from "./lib/balance-check.mjs";
-import { getJSON, signedGet, signedPost } from "./lib/api.mjs";
+import { getJSON, signedGet, signedPost, loadIdentity } from "./lib/api.mjs";
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
+import { ensureEnrolled } from "../lib/enroll.mjs";
 
 // Load the most recent UNCONSUMED handoff for this project (written by precompact.mjs
 // / the heartbeat early-warning). `claim` marks it consumed so exactly one session
@@ -221,6 +222,33 @@ try {
   // instead of silently routing to the default.
   const { url, via: hubVia } = resolveHubInfo(project);
 
+  // Self-enrol on an enforce hub BEFORE the first read/write, the way bin/crew-runner.mjs does for
+  // crew seats (#6270). A session started via `trantor open` (or any Claude session not spawned by
+  // the runner) never went through that path: hooks/lib/api.mjs's own ensureEnrolled POSTs /enroll
+  // with no invite token, which a non-loopback enforce hub refuses — and refuses SILENTLY, because
+  // that helper is fail-open by design. The identity then sits registered-looking (whoami works,
+  // it has a keypair) but unknown to the hub, and every read 401s for as long as nobody notices
+  // (crebral-com sat like this for 20 minutes). lib/enroll.mjs's ensureEnrolled is the real fix: it
+  // mints a one-shot invite with the OPERATOR's owner key and spends it as this identity, exactly
+  // like a crew seat enrols itself. Never silent on failure — the reason lands in both the user
+  // banner and the model's context, not just a stderr line nobody reads.
+  const orchIdentity = loadIdentity(session);
+  const enrolment = orchIdentity
+    ? await ensureEnrolled(url, orchIdentity, project).catch((e) => ({ ok: false, reason: "error:" + String(e?.message || e).slice(0, 40) }))
+    : { ok: false, reason: "no-identity" };
+  if (!enrolment.ok && enrolment.reason !== "hub-unreachable") {
+    const O = "\x1b[1;38;5;208m", R = "\x1b[0m";
+    const line = `🟠 ${O}Not enrolled on ${url}${R} (${enrolment.reason}) — reads/writes may 401. `
+      + `Fix: set an owner key (RELAY_OWNER_IDENTITY or ~/.agent-bus/config.json ownerIdentity) that can mint invites on this hub.`;
+    userBanner = userBanner ? `${userBanner}\n${line}` : line;
+    additionalContext += `<trantor-not-enrolled hub="${sanitize(url)}" reason="${sanitize(enrolment.reason)}">\n`;
+    additionalContext += `⚠️ **This session's identity (\`${sanitize(session)}\`) is NOT enrolled on \`${sanitize(url)}\`** (reason: ${sanitize(enrolment.reason)}). `;
+    additionalContext += `On an enforce hub this means board reads/writes will 401 until enrolment succeeds. This is not "the hub is down" — the hub is answering, it just does not recognize this identity yet. `;
+    additionalContext += `Tell the user: the operator's owner key needs to be able to mint invites on this hub (RELAY_OWNER_IDENTITY env or \`ownerIdentity\` in ~/.agent-bus/config.json), then restart this session.\n`;
+    additionalContext += `</trantor-not-enrolled>\n`;
+    process.stderr.write(`[trantor] WARNING: ${session} not enrolled on ${url} (${enrolment.reason})\n`);
+  }
+
   // register self + post an initial presence status (no LLM turn — instant for others to read).
   // kind "orch" when `trantor open` badged THIS session as the project's orchestrator pane
   // (#6075): the peer row's kind is the hub's own record of what a session is — the overseer's
@@ -229,7 +257,9 @@ try {
   // carries no name, so it stamps nothing. Absent kind is preserved by /register, so the MCP's
   // kindless heartbeats never erase this.
   const orchBadge = process.env.TRANTOR_ORCH || "";
-  await jpost(`${url}/register`, { session, project, status: `active in ${project}`, ...(orchBadge === project ? { kind: "orch" } : {}) }, session).catch(() => {});
+  const registerBody = { session, project, status: `active in ${project}` };
+  if (orchBadge === project) registerBody.kind = "orch";
+  await jpost(`${url}/register`, registerBody, session).catch(() => {});
 
   // fetch roster of OTHER online sessions
   let peers = [], hubAnswered = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.38",
+  "version": "0.18.40",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-prd-review.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-enroll.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-prd-review.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [