trantor 0.18.40 → 0.18.41

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.40",
+  "version": "0.18.41",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -41,6 +41,9 @@ switch (cmd) {
         const cfg = readConfig();
         const here = resolveProject();
         console.log(`global default: ${cfg.url || DEFAULT_HUB_URL}${cfg.url ? "" : " (built-in)"}`);
+        // SAFETY: cfg.hubs is the config.json hubs map decoded by JSON.parse; the check separates
+        // "a pin map" (any object, even field-less) from primitives/null (no pins to list).
+        // oxlint-disable-next-line anti-slop/no-runtime-typeof
         const hubs = cfg.hubs && typeof cfg.hubs === "object" ? Object.entries(cfg.hubs) : [];
         if (!hubs.length) console.log("no per-project pins — every project uses the global default");
         for (const [p, u] of hubs) console.log(`${p === here ? "*" : " "} ${p} → ${u}`);
@@ -192,7 +195,7 @@ switch (cmd) {
   trantor doctor      where do I stand? hub/plugin/CLIs/auth/keys/profile, with copy-paste fixes
   trantor connect     (re)wire every installed AI CLI to the bus
   trantor profile     declare your plans:  trantor profile set claude=max codex=plus deepseek=api
-  trantor provider    bring ANY model (BYOM): list seats · add <name> --key … · remove <name>
+  trantor provider    bring ANY model (BYOM): list · status [--json] · verify <name> --key … · add <name> --key … · remove <name>
   trantor models      browse live models behind each seat + the router's pick per difficulty
   trantor up …        spawn a crew here:   trantor up codex kimi deepseek:deepseek glm:zai-coding-plan
   trantor open        host THIS session as the project's orchestrator pane (trantor down spares it)

package/bin/crew-runner.mjs

@@ -534,6 +534,10 @@ async function reportHealthy() {
 const TURN_MAX_MS = Math.max(0, Number(process.env.TRANTOR_TURN_MAX_MS || 20 * 60 * 1000));
 const TIME_BOX_PROMPT = "your previous turn was cut at the time box; commit what is done, move the card with a note, report in one line";
 let inFollowUp = false;
+// #6289: whether the turn that just ended was CUT at the time box. The follow-up recursion
+// overwrites it with its own state, so a caller reading it after the chain sees the state of the
+// LAST turn — which is what decides whether a failed chain died to the box or to the API.
+let lastTurnCut = false;
 // The card the CURRENT CLI session belongs to (#6134). 0 = the kickoff session, which belongs to
 // no card, so the first contract that names one starts a session of its own.
 let sessionCard = 0;
@@ -703,6 +707,7 @@ exit $turn_exit`;
     try { unlinkSync(CUTF); } catch {}
     log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
+  lastTurnCut = cut;
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
   // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
   try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
@@ -757,8 +762,11 @@ exit $turn_exit`;
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   const tokens = parseTurnTokens(ownOut);
-  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict };
-  if (tokens) telemetryRow.tokens = tokens;
+  // #6289: every ledger row names in ONE field what happened to the turn — cut (the box ended it),
+  // api-error (the CLI failed), completed — and what it cost in tokens, even when this CLI printed
+  // no usage line (0 means "not reported", never "free"). `cut` stays too: the drills read it.
+  const outcome = cut ? "cut" : (effExit !== 0 ? "api-error" : "completed");
+  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict, outcome, tokens };
   if (cut) telemetryRow.cut = true;
   telemetry(telemetryRow);
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
@@ -988,8 +996,13 @@ function askedExcerpt(message) {
     // #6228: a wake naming another project (its sender's home project, not this seat's, and the
     // two are not `trantor policy link`ed) is dropped without acting — never queued, never folded
     // into context. One report goes back to the sender so it does not just look like silence.
+    // The hub's OWN agents (`hub:duty` et al.) are exempt: they speak for this hub's projects,
+    // not a foreign one, and fencing them made every seat deaf to #5760's actionable
+    // file-conflict warnings — the same class of pseudo-id notifyAssigners already treats
+    // specially. Found by test-failure.mjs (#6301): the fence refused the drill's duty-agent
+    // wake exactly as it refused real cross-project traffic.
     const links = wakeCandidates.length ? await currentLinks() : [];
-    const crossProject = wakeCandidates.filter(m => !isLinkedProject(senderProjectOf(m.from), PROJ, links));
+    const crossProject = wakeCandidates.filter(m => !String(m.from || "").startsWith("hub:") && !isLinkedProject(senderProjectOf(m.from), PROJ, links));
     for (const m of crossProject) {
       const sp = senderProjectOf(m.from) || "?";
       log(`\x1b[33mcross-project wake dropped\x1b[0m — ${m.from} (${sp}) is not ${PROJ}'s project and the two are not linked`);
@@ -1072,10 +1085,18 @@ function askedExcerpt(message) {
       }
       savePending(pendingWake, pendingBcast);
       await reportFailure(ec, "message", pendingWake.length, reason);
-      if (PARKING_REASONS.has(reason)) {
-        retryAt = await parkSeat(reason, pendingWake.length, quotaReset);
+      // #6289: TWO consecutive exit-1 turns on one contract PARK the seat — no third attempt.
+      // The burn this stops (card #6270, 2026-09-03): an exit-1 turn rode the redelivery ladder,
+      // and every rung re-sent the SAME contract as a fresh full turn — the seat re-read and
+      // re-did finished work, then died to the same API error or the box again; five cycles,
+      // 4.7h, for a 34-line change. The first failure still retries; the second parks with a
+      // reason (time-box when the chain died to box cuts, api-error otherwise), holds the queue,
+      // and is woken again only by `trantor up` (a restart).
+      const parkReason = PARKING_REASONS.has(reason) ? reason : (lastTurnCut ? "time-box" : "api-error");
+      if (PARKING_REASONS.has(reason) || deliveryFails >= 2) {
+        retryAt = await parkSeat(parkReason, pendingWake.length, quotaReset);
         await notifyAssigners(assigners,
-          `⛔ your contract is PARKED on ${SESSION} (${reason}) — not retrying · asked: "${asked}"`);
+          `⛔ your contract is PARKED on ${SESSION} (${parkReason}) — not retrying · asked: "${asked}"`);
         lastTurnAt = Date.now();
         return;
       }

package/bin/crew.sh

@@ -238,21 +238,29 @@ _herdr_close_pane() { [ "$DRY" = "1" ] && { echo "[dry] herdr pane close $1";
 # So the project gets ONE claude session id, chosen by us and remembered. First open starts claude
 # under it; every later open resumes it. Discovering the id afterwards would be guesswork, and
 # `--continue` would grab whatever ran last in this directory, which may be a different window.
-# A NAMED project must open in ITS checkout, wherever the caller stands (2026-08-31: the app ran
-# `trantor open crebral-health` from the Tauri process cwd and claude booted THERE — a trust
-# prompt for a folder the operator never chose, transcripts under the wrong slug, no project
-# memory, ACTIVE NOW blind). Resolution mirrors the app's project_dir: $TRANTOR_DEV_ROOT
-# (default ~/development)/<name>. Unknown name from an unrelated cwd → refuse loudly rather
-# than open somewhere silly.
-_orch_resolve_dir() {   # $1=cwd $2=project-arg → dir to open in (stdout); fails when unresolvable
-  local herebase; herebase="$(basename "$(git -C "$1" rev-parse --show-toplevel 2>/dev/null || echo "$1")")"
-  if [ -z "$2" ] || [ "$2" = "$herebase" ]; then printf '%s' "$1"; return 0; fi
+# A NAMED project must open in ITS checkout (2026-08-31: the app ran `trantor open crebral-health`
+# from the Tauri cwd and claude booted THERE). A caller already inside another git root or carrying
+# another pane badge is a crossed identity, not permission to relocate silently (2026-09-03 twins).
+# An unbadged caller outside a repo may resolve through $TRANTOR_DEV_ROOT (default ~/development).
+_orch_resolve_dir() {   # $1=cwd $2=project-arg → dir to open in (stdout); fails on crossed identity
+  local target="${2:-$PROJ}" badge="${TRANTOR_ORCH:-${TRANTOR_SEAT:-}}" gitroot="" herebase=""
+  gitroot="$(git -C "$1" rev-parse --show-toplevel 2>/dev/null || true)"
+  [ -n "$gitroot" ] && herebase="$(basename "$gitroot")"
+  if [ -n "$badge" ] && [ "$badge" != "$target" ]; then
+    echo "trantor open: refused — this shell is badged for '$badge', not '$target'; open it from the target project's shell" >&2
+    return 1
+  fi
+  if [ -n "$herebase" ] && [ "$herebase" != "$target" ]; then
+    echo "trantor open: refused — cwd belongs to project '$herebase', not '$target'; cd to the target checkout first" >&2
+    return 1
+  fi
+  if [ -z "$2" ] || [ "$target" = "$herebase" ]; then printf '%s' "$1"; return 0; fi
   local devroot="${TRANTOR_DEV_ROOT:-$HOME/development}"
-  if [ -d "$devroot/$2" ]; then
-    echo "— opening $2 in its checkout: $devroot/$2 —" >&2
-    printf '%s' "$devroot/$2"; return 0
+  if [ -d "$devroot/$target" ]; then
+    echo "— opening $target in its checkout: $devroot/$target —" >&2
+    printf '%s' "$devroot/$target"; return 0
   fi
-  echo "trantor open: '$2' has no checkout at $devroot/$2 and this is '$herebase' — cd into the project first" >&2
+  echo "trantor open: '$target' has no checkout at $devroot/$target — cd into the project first" >&2
   return 1
 }
 

package/bin/doctor.mjs

@@ -189,6 +189,24 @@ for (const c of CLIS) {
 }
 if (!installed) warn("no crew CLIs found", "install at least one of: codex, gemini, kimi, opencode — Trantor orchestrates whatever you have");
 
+// ── providers: READY, not merely installed (#6390) ──────────────────────────────────────────
+// The crew-CLI rows above say installed/wired. lib/providers.mjs says READY: one live usage call
+// per provider (the SAME probes lib/balances.mjs serves the bar — no second detector), each
+// answering with a state + reason, so "authenticated" never quietly means "expired" or "dry".
+section("providers");
+{
+  const { providerStatus } = await import("../lib/providers.mjs");
+  let rows = [];
+  try { rows = await providerStatus(); }
+  catch (e) { note(`provider registry could not run (${e?.message || e})`); }
+  for (const r of rows) {
+    const line = `${r.provider}: ${r.state} — ${r.reason}`;
+    if (r.state === "connected") ok(line);
+    else if (r.state === "unknown") note(line);
+    else warn(line, r.actions.includes("paste-key") ? `probe the key first: trantor provider verify ${r.provider} --key sk-…` : null);
+  }
+}
+
 // ---- key attribution: WHICH key does each surface actually spend on? ------------------------
 // Provider keys resolve through a LAYERED lookup and nothing ever showed which layer won. On
 // 2026-08-25 a $14 DeepSeek day could not be explained: ~/.token-scrooge/.env held the only
@@ -226,6 +244,9 @@ const crewUsesVar = (v) => {
   const provider = SEAT_ENV_VARS[v];
   if (!provider) return false;
   const configured = OPENCODE_CFG?.provider?.[provider]?.options?.apiKey;
+  // SAFETY: configured is the opencode.json apiKey field decoded by JSON.parse; the check
+  // separates "a {env:VAR} template string" from any other shape (literal key / absent).
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof
   if (typeof configured === "string" && configured.includes("{env:")) return true;   // resolves from env at run time
   return !configured;                                                                 // a LITERAL key bypasses the env layer
 };

package/bin/provider.mjs

@@ -2,10 +2,13 @@
 // trantor provider — bring ANY model to the crew (BYOM). opencode is a universal adapter, so a
 // provider you configure there (or declare here) becomes a crew seat with no code change.
 //
-//   trantor provider                 # list seats: built-in + discovered, with availability + tier
+//   trantor provider                 # seats (built-in + discovered) + the provider status board
+//   trantor provider status [--json] # the registry: state + reason per provider (#6390)
+//   trantor provider login <name>    # run the CLI's own login command (the pane's "login" action)
+//   trantor provider verify <name> --key sk-… [--json]   # probe a CANDIDATE key, write nothing
 //   trantor provider add <name> [--key sk-…] [--plan api|coding-plan|max] [--label <bus-name>]
 //                       [--base-url <url> [--models m1,m2]]   # wire a CUSTOM OpenAI-compatible endpoint
-//   trantor provider remove <name>   # drop it from your profile (leaves the key in place)
+//   trantor provider remove <name> [--credentials]   # drop it from your profile (--credentials: also the key)
 //
 // `add` writes <NAME>_API_KEY to ~/.agent-bus/.env (if --key given), declares the plan in your
 // quota profile, verifies opencode can see the provider's models, and prints the seat spec. For a
@@ -15,9 +18,10 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { buildRoster, loadWorld } from "./advise.mjs";
+import { providerStatus, providerVerify, PROVIDERS } from "../lib/providers.mjs";
 
 const H = homedir();
 const ENV = join(H, ".agent-bus", ".env");
@@ -69,6 +73,55 @@ function listSeats() {
   console.log(`${C.dim}browse models:${C.off} trantor models [<provider>]`);
 }
 
+// The status board (#6390) — the human face of lib/providers.mjs. Same rows the --json contract
+// and the desktop pane render; every row carries a state AND a reason, so nothing can show blank.
+const STATE_MARK = {
+  connected:      (c) => `${C.grn}●${c.off}`,
+  over_quota:     (c) => `${C.red}✗${c.off}`,
+  expired:        (c) => `${C.red}✗${c.off}`,
+  not_installed:  (c) => `${C.dim}○${c.off}`,
+  not_logged_in:  (c) => `${C.dim}○${c.off}`,
+  unknown:        (c) => `${C.yel}?${c.off}`,
+};
+
+function printStatusRows(rows) {
+  console.log("PROVIDERS — state + reason per provider (detail: trantor provider status --json)\n");
+  for (const r of rows) {
+    const mark = (STATE_MARK[r.state] || STATE_MARK.unknown)(C);
+    console.log(`  ${mark} ${r.provider.padEnd(12)} ${r.state.padEnd(14)} ${C.dim}${r.reason}${C.off}`);
+  }
+}
+
+async function statusCmd(opts) {
+  const rows = await providerStatus();
+  if (opts.json) { console.log(JSON.stringify(rows, null, 2)); return; }
+  printStatusRows(rows);
+  const fixable = rows.filter((r) => r.actions.includes("login") || r.actions.includes("paste-key"));
+  if (fixable.length) {
+    console.log(`\n${C.dim}fix one:${C.off} ${fixable.map((r) => r.provider).join(", ")}`);
+    console.log(`${C.dim}probe a key before saving it:${C.off} trantor provider verify <name> --key sk-…`);
+  }
+}
+
+// The pre-save verify seam (#6391's ask): probe a CANDIDATE key through the SAME registry probe
+// the status board uses, and write nothing anywhere — .env, profile.json and opencode.json are
+// only touched later, by `provider add`, once the key is known live.
+async function verifyCmd(name, opts) {
+  if (!name || name.startsWith("--") || name === "help" || !opts.key) {
+    console.error("usage: trantor provider verify <name> --key sk-… [--json]");
+    process.exit(1);
+  }
+  let r;
+  try { r = await providerVerify(name, opts.key); }
+  catch (e) { console.error(String(e?.message || e)); process.exit(1); }
+  if (opts.json) { console.log(JSON.stringify(r, null, 2)); return; }
+  const mark = (STATE_MARK[r.state] || STATE_MARK.unknown)(C);
+  console.log(`  ${mark} ${r.provider.padEnd(12)} ${r.state.padEnd(14)} ${C.dim}${r.reason}${C.off}`);
+  console.log(r.state === "connected"
+    ? `\n${C.grn}Key is live.${C.off} Nothing was written — commit it: trantor provider add ${r.provider} --key …`
+    : `\n${C.dim}Nothing was written.${C.off} Fix the state above, then: trantor provider add ${r.provider} --key …`);
+}
+
 function addProvider(name, opts) {
   // A flag left in the name position (`provider add --help`) is a usage question, not a provider
   // name (#5998): the old path minted a '--help' provider into profile.json and a __HELP_API_KEY
@@ -123,10 +176,10 @@ function addProvider(name, opts) {
   console.log(`${C.dim}For difficulty-aware routing across its catalog, score it once (weekly):${C.off} scrooge-capabilities`);
 }
 
-function removeProvider(name) {
+function removeProvider(name, opts = {}) {
   // Same guard as add (#5998): a flag-like name is a usage question, not a provider.
   if (!name || name.startsWith("--") || name === "help") {
-    console.error("usage: trantor provider remove <name>");
+    console.error("usage: trantor provider remove <name> [--credentials]");
     process.exit(1);
   }
   const FILE = join(H, ".agent-bus", "profile.json");
@@ -138,6 +191,49 @@ function removeProvider(name) {
   } else {
     console.log(`'${name}' is not in your profile.`);
   }
+  // The Accounts pane's "remove" affordance (#6391) passes --credentials: drop the key line too,
+  // so removing a provider from the UI doesn't leave a live secret in the crew's .env.
+  if (opts.credentials) {
+    const k = envKeyName(name);
+    if (existsSync(ENV)) {
+      const cur = readFileSync(ENV, "utf8");
+      const next = cur.split("\n").filter((l) => !l.startsWith(`${k}=`)).join("\n");
+      if (next !== cur) {
+        writeFileSync(ENV, next);
+        try { chmodSync(ENV, 0o600); } catch {}
+        console.log(`${C.grn}✓${C.off} removed ${k} from ~/.agent-bus/.env`);
+      } else {
+        console.log(`${C.dim}${k} was not in ~/.agent-bus/.env${C.off}`);
+      }
+    }
+  }
+}
+
+// `provider login <name>` — the pane's "login" action (#6391): run the CLI's OWN login command
+// in the foreground (stdio inherited — OAuth flows print QR codes/URLs and need real stdin),
+// then point at the status board for the live re-check. api-key providers have no login to run;
+// the hint is the paste-key path.
+function loginProvider(name) {
+  if (!name || name.startsWith("--") || name === "help") {
+    console.error("usage: trantor provider login <name>");
+    process.exit(1);
+  }
+  const p = PROVIDERS.find((x) => x.provider === name.toLowerCase());
+  if (!p) { console.error(`unknown provider '${name}' — one of: ${PROVIDERS.map((x) => x.provider).join(", ")}`); process.exit(1); }
+  if (!p.loginRun) {
+    console.log(`${p.label} authenticates by API key — no login flow to run.`);
+    console.log(`${C.dim}probe a candidate key first, then commit it:${C.off}`);
+    console.log(`  trantor provider verify ${p.provider} --key sk-…`);
+    console.log(`  trantor provider add ${p.provider} --key sk-…`);
+    return;
+  }
+  console.log(`${C.dim}running:${C.off} ${p.loginRun.join(" ")}  ${C.dim}(the CLI's own login — sign in there)${C.off}`);
+  const r = spawnSync(p.loginRun[0], p.loginRun.slice(1), { stdio: "inherit" });
+  if (r.error || (r.status !== 0 && r.status !== null)) {
+    console.error(`\n${p.loginRun[0]} exited ${r.status ?? "?"} — install it first, then re-run: trantor provider login ${p.provider}`);
+    process.exit(1);
+  }
+  console.log(`\n${C.dim}re-check it live:${C.off} trantor provider status`);
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
@@ -149,10 +245,22 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     else if (rest[i] === "--label") opts.label = rest[++i];
     else if (rest[i] === "--base-url" || rest[i] === "--baseurl") opts.baseUrl = rest[++i];
     else if (rest[i] === "--models") opts.models = rest[++i];
+    else if (rest[i] === "--json") opts.json = true;
+    else if (rest[i] === "--credentials") opts.credentials = true;
     else pos.push(rest[i]);
   }
-  if (!sub || sub === "list") listSeats();
+  // The default list leads with the seats roster and closes with the provider status board —
+  // one command answers both "what can I launch" and "what is actually alive" (#6390).
+  const defaultList = async () => {
+    listSeats();
+    console.log("");
+    printStatusRows(await providerStatus());
+  };
+  if (!sub || sub === "list") await defaultList();
+  else if (sub === "status") await statusCmd(opts);
+  else if (sub === "verify") await verifyCmd(pos[0], opts);
+  else if (sub === "login") loginProvider(pos[0]);
   else if (sub === "add") addProvider(pos[0], opts);
-  else if (sub === "remove" || sub === "rm") removeProvider(pos[0]);
-  else { console.error(`unknown subcommand '${sub}' — use: list | add | remove`); process.exit(1); }
+  else if (sub === "remove" || sub === "rm") removeProvider(pos[0], opts);
+  else { console.error(`unknown subcommand '${sub}' — use: list | status | verify | login | add | remove`); process.exit(1); }
 }

package/hooks/file-claim.mjs

@@ -36,7 +36,9 @@ function readStdin() {
 }
 
 function fileOf(toolName, input) {
-  if (!input || typeof input !== "object") return "";
+  // Only the tool input's own path fields are read; a truthy non-object input has neither, and
+  // String(undefined || "") is "" exactly like the old object guard returned.
+  if (!input) return "";
   if (toolName === "NotebookEdit") return String(input.notebook_path || "");
   return String(input.file_path || "");
 }

package/hooks/lib/api.mjs

@@ -63,7 +63,9 @@ function projectFromQuery(pathOrUrl) {
 }
 function projectOf(explicit, payload, pathOrUrl) {
   if (explicit) return explicit;
-  if (payload && typeof payload === "object" && payload.project) return String(payload.project);
+  // Only the payload's own project field is read; a truthy non-object payload has no such field
+  // and falls through to the query string exactly as the old object guard made it do.
+  if (payload && payload.project) return String(payload.project);
   return projectFromQuery(pathOrUrl);
 }
 // The signing identity for a request about `project`. An explicit RELAY_SESSION/RELAY_AGENT still

package/hooks/lib/balance-check.mjs

@@ -16,7 +16,9 @@ const CAP_MS = 4000;
 
 function thresholds() {
   let t = DEFAULT_LOW, q = DEFAULT_LOW_QUOTA_PCT;
-  try { const c = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")); if (c.lowBalance) t = { ...DEFAULT_LOW, ...c.lowBalance }; if (typeof c.lowQuotaPct === "number") q = c.lowQuotaPct; } catch {}
+  // JSON.parse is the boundary: config.json can hold any JSON number but never NaN/Infinity,
+  // so Number.isFinite accepts exactly the numeric lowQuotaPct values the old typeof did.
+  try { const c = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")); if (c.lowBalance) t = { ...DEFAULT_LOW, ...c.lowBalance }; if (Number.isFinite(c.lowQuotaPct)) q = c.lowQuotaPct; } catch {}
   return { t, q };
 }
 

package/hooks/lib/handoff.mjs

@@ -203,6 +203,10 @@ function collectTurns(transcriptPath) {
     if (!(r.type === "user" || r.type === "assistant") || !r.message) continue;
     const c = r.message.content;
     let text = "";
+    // SAFETY: this IS the transcript I/O boundary — the jsonl row was JSON.parse'd above and
+    // Claude message content is documented as a string or an array of typed blocks; the two
+    // branches decode exactly those shapes, anything else stays "".
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof
     if (typeof c === "string") text = c;
     else if (Array.isArray(c)) text = c.filter(b => b?.type === "text").map(b => b.text).join("\n");
     text = (text || "").trim();

package/hooks/lib/subagent-cost-lib.mjs

@@ -15,5 +15,7 @@ export function isSubagentTranscript(p) {
 export const SUSPECT_CACHE_READ = 50e6;
 export const SUSPECT_USD = 50;
 export function isImplausibleCost({ usd = null, cacheRead = 0 } = {}) {
-  return (cacheRead || 0) > SUSPECT_CACHE_READ || (typeof usd === "number" && usd > SUSPECT_USD);
+  // usd's contract is number|null (computed token cost); the null check keeps the absent case
+  // from comparing, and non-numbers outside that contract never fire the suspicion either way.
+  return (cacheRead || 0) > SUSPECT_CACHE_READ || (usd !== null && usd > SUSPECT_USD);
 }

package/hooks/overseer-warn.mjs

@@ -37,7 +37,10 @@ try {
   if (!ctx.project) silent();
 
   const r = await signedGet(`${relayUrl(ctx.project)}/overseer/context?project=${encodeURIComponent(ctx.project)}`, { session: ctx.session });
-  if (!r.ok || !r.json || typeof r.json !== "object") silent();
+  // The response envelope is decoded by the field guards below: any truthy shape that is not the
+  // expected object falls out at `level < 2` (or the nothing-to-say check) and lands in silent()
+  // exactly like this guard used to — malformed payloads narrate nothing.
+  if (!r.ok || !r.json) silent();
   const c = r.json;
 
   const level = Number(c.level || 1);

package/hooks/statusline.mjs

@@ -19,6 +19,10 @@ async function main() {
   for await (const c of process.stdin) raw += c;
   const j = JSON.parse(raw);
   const rl = j.rate_limits;
+  // SAFETY: rate_limits is the Claude statusline envelope decoded by JSON.parse above; the check
+  // separates "tick carries a rate_limits envelope" (any object, even field-less — it refreshes
+  // the stamp below) from "no envelope" (primitives/null — a free exit).
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof
   if (!rl || typeof rl !== "object") return;               // most ticks carry none — free exit
   const sid = String(j.session_id || j.sessionId || "nosession").replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 80);
   const dir = join(homedir(), ".agent-bus");

package/hooks/subagent-cost.mjs

@@ -58,6 +58,10 @@ function usageRows(file) {
       let r; try { r = JSON.parse(line); } catch { continue; }
       if (!firstUserText && r.type === "user" && r.message) {
         const c = r.message.content;
+        // SAFETY: this IS the transcript I/O boundary — the Claude messages.jsonl line was
+        // JSON.parse'd above, and message content is documented as a string or an array of
+        // typed blocks; the two branches decode exactly those shapes, anything else is "".
+        // oxlint-disable-next-line anti-slop/no-runtime-typeof
         firstUserText = (typeof c === "string" ? c : Array.isArray(c) ? c.filter(b => b?.type === "text").map(b => b.text).join(" ") : "").trim();
       }
       const u = r?.message?.usage;

package/hub.mjs

@@ -32,9 +32,9 @@ const PEER_TTL_MS = Math.max(Number.isFinite(_peerTtlRaw) ? _peerTtlRaw : PEER_T
 // git post-commit, SubagentStart/Stop, focus hook); the instant a channel breaks — a crew seat torn down
 // mid-flight, a fork that crashed, a session that died uncleanly — the card is orphaned in whatever lane it
 // was in and NOTHING ever swept it (prunePeers only ever closed the ONE focus card, and only after 6h).
-// The reaper is the general safety net: a doing/testing card whose OWNER is OFFLINE past this grace window
-// moves to "stale" (a distinct terminal lane you triage by hand). Only fires on an OFFLINE owner, so a live
-// long-running task is never touched — the owner-alive-but-idle case is handled by the manual /sweep path.
+// The reaper is the general safety net: a doing card whose OWNER is OFFLINE past this grace window moves to
+// "stale" (a distinct terminal lane you triage by hand). Testing is the operator's queue, so owner presence
+// is irrelevant there and the reaper never touches it. The owner-alive-but-idle case stays with manual /sweep.
 const REAP_GRACE_MS = Number(process.env.RELAY_REAP_GRACE_MS || 15 * 60 * 1000);    // 15m offline + untouched
 // Supersession lapse. The baton claim was documented "never unset", which is right while the claimant
 // lives and wrong the moment it dies: a session that consumed a handoff, went quiet and was killed left
@@ -778,9 +778,22 @@ function cardOwnerOnline(t, cutoff) {
   }
   return false;
 }
+function cardOwnerLastSeen(t) {
+  let latest = 0;
+  for (const k of new Set([t.assignee, t.parent, t.by].filter(Boolean))) {
+    latest = Math.max(latest, state.peers[k]?.lastSeen || 0);
+  }
+  return latest;
+}
+function appendReaperStaleLog(t, reason, ts) {
+  const seen = cardOwnerLastSeen(t);
+  const lastSeen = seen ? `${humanMs(ts - seen)} ago` : "never";
+  appendTaskLog(t, "reaper", `${reason}; owner last seen ${lastSeen}`, ts);
+}
 // The general stale-card reaper prunePeers never was. Every 60s:
 //  (a) close a focus card once its session has been OFFLINE past FOCUS_OFFLINE_MS (not the old 6h peer TTL).
-//  (b) move an OFFLINE-owner doing/testing card to "stale" once it's untouched past REAP_GRACE_MS.
+//  (b) move an OFFLINE-owner doing card to "stale" once it's untouched past REAP_GRACE_MS.
+// Testing is waiting for the operator's verdict and is therefore outside the reaper's authority.
 // It NEVER touches a card whose owner is still online, so a live long task is safe; the owner-alive-but-idle
 // "forgot its card" case is left to the explicit /sweep path (preview + confirm).
 function reapStaleCards() {
@@ -791,15 +804,17 @@ function reapStaleCards() {
   let changed = false;
   for (const t of state.tasks) {
     if (t.status === "done" || t.status === "stale") continue;
+    if (t.status === "testing") continue;
     if (t.status === "todo" && (t.updated || t.ts || 0) < now() - TODO_STALE_MS) {
       const from = t.status;
       const untouchedAt = t.updated || t.ts || 0;
       const agedDays = Math.floor((now() - untouchedAt) / 86400000);
-      (t.history ||= []).push({ from, to: "stale", by: "reaper", ts: now() });
+      const reapedAt = now();
+      (t.history ||= []).push({ from, to: "stale", by: "reaper", ts: reapedAt });
       if (t.history.length > 60) t.history.splice(0, 20);
-      appendTaskLog(t, "reaper", `todo aged out after ${agedDays}d untouched`);
+      appendReaperStaleLog(t, `todo aged out after ${agedDays}d untouched`, reapedAt);
       appendCardEvent("moved", t, "reaper", from, "stale");
-      t.status = "stale"; t.updated = now(); t._reaped = true; changed = true;
+      t.status = "stale"; t.updated = reapedAt; t._reaped = true; changed = true;
       continue;
     }
     if (t.source === "session") {                                  // (a) focus cards → done when session offline
@@ -811,13 +826,15 @@ function reapStaleCards() {
       if (peerGone || longIdle) { if (closeFocusCard(t, peerGone ? t.assignee : "reaper")) changed = true; }
       continue;
     }
-    if ((t.status === "doing" || t.status === "testing")           // (b) offline-owner work cards → stale
+    if (t.status === "doing"                                      // (b) offline-owner work cards → stale
         && (t.updated || t.ts || 0) < graceCut
         && !cardOwnerOnline(t, onCut)) {
-      (t.history ||= []).push({ from: t.status, to: "stale", by: "reaper", ts: now() });
+      const reapedAt = now();
+      (t.history ||= []).push({ from: t.status, to: "stale", by: "reaper", ts: reapedAt });
       if (t.history.length > 60) t.history.splice(0, 20);
+      appendReaperStaleLog(t, "owner offline → stale", reapedAt);
       appendCardEvent("moved", t, "reaper", t.status, "stale");
-      t.status = "stale"; t.updated = now(); t._reaped = true; changed = true;
+      t.status = "stale"; t.updated = reapedAt; t._reaped = true; changed = true;
     }
   }
   if (changed) dirty = true;

package/lib/balances.mjs

@@ -331,7 +331,9 @@ export function fmtBalance(e) {
   return `${e.label}: ${sym}${amt} ${e.currency} left`;
 }
 
-function fmtReset(t) {
+// exported for the provider registry (#6390): state reasons append the same reset short-form
+// the balances rows print, so status and balances can never disagree about a reset date.
+export function fmtReset(t) {
   const ms = Number.isFinite(t) ? t : Date.parse(t);
   if (!ms || isNaN(ms)) return "";
   const hrs = (ms - Date.now()) / 3600e3;

package/lib/providers.mjs

@@ -0,0 +1,332 @@
+// trantor provider registry — ONE truth for "is this provider ready to seat?" (#6390), built the
+// way Orca does onboarding (stablyai/orca: src/main/providers + src/main/claude-accounts): a
+// registry per agent with a PATH detect (`command -v`), the CLI's own login command, the CLI's own
+// credential artifact, and "connected" = a LIVE usage call succeeded — never "file exists".
+// Consumers: `trantor provider status [--json]`, `trantor provider verify` (pre-save key check),
+// the desktop provider_status/provider_verify Tauri commands (they shell the CLI — one renderer),
+// and `trantor doctor`. The JSON row shape is FROZEN (the Accounts pane #6391 and wizard #6392
+// build against it):
+//   [{ provider, label, kind, connect, binary:{name,installed,path}, auth:{artifact,present,mode},
+//      state, reason, usage:{...balances row}, actions:["login"|"paste-key"|"recheck"|"remove"] }]
+// state ∈ connected | not_installed | not_logged_in | expired | over_quota | unknown — ALWAYS with
+// a non-empty reason. The kimi row that used to render a blank "plan" in the bar is the bug this
+// fixes: no row exists without a state and a reason.
+//
+// PROBES ARE NOT DUPLICATED: every live check is lib/balances.mjs — the ADAPTERS (kimi/zai/qwen/
+// deepseek/openrouter/moonshot/claude) plus fetchBalances' codex block. This module only decides
+// WHAT to ask and maps the answer to a state.
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { homedir } from "node:os";
+import { fetchBalances, fmtBalance, fmtReset } from "./balances.mjs";
+import { resolveKeys } from "./provider-keys.mjs";
+
+export const STATES = ["connected", "not_installed", "not_logged_in", "expired", "over_quota", "unknown"];
+export const ACTIONS = ["login", "paste-key", "recheck", "remove"];
+
+const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+const envKeyName = (p) => `${String(p).toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
+
+// Orca's detectCmd: a PATH probe, aliases included, first hit wins. Injectable PATH keeps the
+// drills hermetic (opts.path) — a fake bin dir can make `kimi` exist without the real CLI.
+// The shell itself is /bin/sh ABSOLUTE: a relative "sh" would be resolved through the very PATH
+// we are overriding, and a drill PATH without /bin would read as "no CLIs installed".
+function detectBinary(names, opts = {}) {
+  const path = opts.path || process.env.PATH;
+  for (const n of names.filter(Boolean)) {
+    try {
+      const p = execFileSync("/bin/sh", ["-c", `command -v ${n}`], { encoding: "utf8", env: { ...process.env, PATH: path } }).trim();
+      if (p) return { name: n, installed: true, path: p };
+    } catch { /* not on PATH — try the next alias */ }
+  }
+  return { name: names[0] || null, installed: false, path: null };
+}
+
+// The opencode.json provider block key, decoded once at this boundary: a LITERAL key comes back
+// as `literal` (feedable to a probe), the "{env:VAR}" template comes back as `template` (the seat
+// resolves it at run time, so only the env decides presence here).
+function opencodeKey(home, provider) {
+  const cfg = readJson(join(home, ".config", "opencode", "opencode.json"));
+  const v = cfg?.provider?.[provider]?.options?.apiKey;
+  // SAFETY: v is the opencode.json apiKey field decoded by JSON.parse above; the check separates
+  // "a string key" (literal, or the {env:VAR} template) from "any other shape" (ignored — a
+  // non-string is never fed to a probe).
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof
+  if (!v || typeof v !== "string") return { literal: null, template: null };
+  const m = /^\{env:([A-Z0-9_]+)\}$/.exec(v);
+  return m ? { literal: null, template: m[1] } : { literal: v, template: null };
+}
+
+// Claude Code keeps its OAuth token in ~/.claude/.credentials.json (or $CLAUDE_CONFIG_DIR),
+// then the macOS keychain item "Claude Code-credentials". Attribute-only keychain lookup (no -w,
+// doctor's rule): a health read must never raise a GUI secret prompt. The keychain is tried ONLY
+// when the caller did not inject a home (ctx.allowKeychain) — drills stay hermetic and never
+// touch the operator's real secrets.
+function claudeAuth(home, env, ctx = {}) {
+  const dirs = [];
+  const cfgDir = env.CLAUDE_CONFIG_DIR;
+  if (cfgDir) dirs.push(isAbsolute(cfgDir) ? cfgDir : join(home, cfgDir));
+  dirs.push(join(home, ".claude"));
+  for (const dir of dirs) {
+    const j = readJson(join(dir, ".credentials.json"));
+    const tok = j?.claudeAiOauth;
+    if (tok?.accessToken) {
+      const exp = Date.parse(tok.expiresAt);
+      return { artifact: `${dir.replace(home, "~")}/.credentials.json`, present: true, mode: "oauth", expiresAt: Number.isFinite(exp) ? exp : null };
+    }
+  }
+  // The keychain is skipped when the caller injected a home (drill) or set TRANTOR_NO_KEYCHAIN=1
+  // (CLI drill: fake $HOME isolates the FILES, but the login keychain is machine-wide — a drill
+  // must never read, or even attribute-probe, the operator's real secrets).
+  if (ctx.allowKeychain && ctx.env.TRANTOR_NO_KEYCHAIN !== "1" && process.platform === "darwin") {
+    try {
+      execFileSync("/usr/bin/security", ["find-generic-password", "-s", "Claude Code-credentials"], { stdio: "ignore", timeout: 4000 });
+      return { artifact: "keychain: Claude Code-credentials", present: true, mode: "oauth", expiresAt: null };
+    } catch { /* no keychain item → fall through to absent */ }
+  }
+  return { artifact: "~/.claude/.credentials.json", present: false, mode: null, expiresAt: null };
+}
+
+// Codex auth.json modes (Orca): tokens present → "chatgpt" (OAuth); OPENAI_API_KEY → "apikey".
+// The id_token's `email` claim names the account — reason text only, tokens never leave here.
+function codexAuth(home) {
+  const j = readJson(join(home, ".codex", "auth.json"));
+  if (j?.tokens?.access_token) {
+    let email = null;
+    try {
+      const payload = JSON.parse(Buffer.from(String(j.tokens.id_token || "").split(".")[1] || "", "base64url").toString("utf8"));
+      email = payload?.email || null;
+    } catch { /* a malformed id_token costs the reason its email, never the row */ }
+    return { artifact: "~/.codex/auth.json", present: true, mode: "chatgpt", email };
+  }
+  if (j?.OPENAI_API_KEY) return { artifact: "~/.codex/auth.json", present: true, mode: "apikey", email: null };
+  return { artifact: "~/.codex/auth.json", present: false, mode: null, email: null };
+}
+
+// api-key providers: env first (the layered resolveKeys the crew itself uses), then a LITERAL key
+// wired into opencode.json. A "{env:VAR}" template defers to the env by design.
+function apiKeyAuth(home, env, { envKeys, ocProvider, artifact }) {
+  for (const k of envKeys) {
+    if (env[k]) return { artifact: `env ${k}`, present: true, mode: "api-key", key: env[k], expiresAt: null };
+  }
+  if (ocProvider) {
+    const oc = opencodeKey(home, ocProvider);
+    if (oc.literal) return { artifact: "~/.config/opencode/opencode.json", present: true, mode: "api-key", key: oc.literal, expiresAt: null };
+    if (oc.template && env[oc.template]) return { artifact: `env ${oc.template}`, present: true, mode: "api-key", key: env[oc.template], expiresAt: null };
+  }
+  return { artifact, present: false, mode: null, key: null, expiresAt: null };
+}
+
+const fileAuth = (home, file, mode = "oauth") => {
+  const rel = file.replace(home, "~");
+  return existsSync(file)
+    ? { artifact: rel, present: true, mode, key: null, expiresAt: null }
+    : { artifact: rel, present: false, mode: null, key: null, expiresAt: null };
+};
+
+// PROBE_VIA: providers whose live check rides ANOTHER adapter — dsh bills through DeepSeek's API,
+// so its probe IS the deepseek adapter (rebranded on the way out). agy has no balances adapter.
+const PROBE_VIA = { dsh: "deepseek" };
+
+export const PROVIDERS = [
+  { provider: "claude", label: "Claude", kind: "windows", connect: "cli-login",
+    binary: ["claude"], loginCmd: "claude", loginRun: ["claude"], envKeys: [], probe: "balances",
+    auth: claudeAuth,
+    hint: "sign in with your Anthropic account on first run" },
+  { provider: "codex", label: "Codex", kind: "windows", connect: "cli-login",
+    binary: ["codex"], loginCmd: "codex login", loginRun: ["codex", "login"], envKeys: [], probe: "balances",
+    auth: (home) => codexAuth(home),
+    hint: "sign in with your ChatGPT account" },
+  { provider: "kimi", label: "Kimi Code", kind: "quota", connect: "cli-login",
+    binary: ["kimi"], loginCmd: "kimi (then /login)", loginRun: ["kimi", "login"], envKeys: ["KIMI_API_KEY"], probe: "balances",
+    auth: (home, env) => (env.KIMI_API_KEY
+      ? { artifact: "env KIMI_API_KEY", present: true, mode: "api-key", key: env.KIMI_API_KEY, expiresAt: null }
+      : fileAuth(home, join(home, ".kimi", "credentials"))),
+    hint: "Kimi account or Moonshot API key" },
+  { provider: "zai", label: "Z.ai (GLM)", kind: "quota", connect: "api-key",
+    binary: ["opencode"], loginCmd: "trantor provider add zai --key …", loginRun: null, envKeys: ["ZAI_API_KEY", "GLM_API_KEY"], probe: "balances",
+    auth: (home, env) => apiKeyAuth(home, env, { envKeys: ["ZAI_API_KEY", "GLM_API_KEY"], ocProvider: "zai-coding-plan", artifact: "env ZAI_API_KEY" }),
+    hint: "get a coding-plan key at z.ai, then trantor provider add zai --key …" },
+  { provider: "qwen", label: "Qwen", kind: "quota", connect: "cli-login",
+    binary: ["qwen"], loginCmd: "qwen", loginRun: ["qwen"], envKeys: ["QWEN_API_KEY"], probe: "balances",
+    auth: (home, env) => (env.QWEN_API_KEY
+      ? { artifact: "env QWEN_API_KEY", present: true, mode: "api-key", key: env.QWEN_API_KEY, expiresAt: null }
+      : fileAuth(home, join(home, ".qwen", "oauth_creds.json"))),
+    hint: "run qwen once — its OAuth flow opens on first start" },
+  { provider: "deepseek", label: "DeepSeek", kind: "prepaid", connect: "api-key",
+    binary: ["opencode"], loginCmd: "trantor provider add deepseek --key …", loginRun: null, envKeys: ["DEEPSEEK_API_KEY"], probe: "balances",
+    auth: (home, env) => apiKeyAuth(home, env, { envKeys: ["DEEPSEEK_API_KEY"], ocProvider: "deepseek", artifact: "env DEEPSEEK_API_KEY" }),
+    hint: "get a key at platform.deepseek.com, then trantor provider add deepseek --key …" },
+  { provider: "openrouter", label: "OpenRouter", kind: "prepaid", connect: "api-key",
+    binary: ["opencode"], loginCmd: "trantor provider add openrouter --key …", loginRun: null, envKeys: ["OPENROUTER_API_KEY"], probe: "balances",
+    auth: (home, env) => apiKeyAuth(home, env, { envKeys: ["OPENROUTER_API_KEY"], ocProvider: "openrouter", artifact: "env OPENROUTER_API_KEY" }),
+    hint: "get a key at openrouter.ai/keys — one key fronts hundreds of models" },
+  { provider: "moonshot", label: "Moonshot", kind: "prepaid", connect: "api-key",
+    binary: [], loginCmd: "trantor provider add moonshot --key …", loginRun: null, envKeys: ["MOONSHOT_API_KEY"], probe: "balances",
+    auth: (home, env) => apiKeyAuth(home, env, { envKeys: ["MOONSHOT_API_KEY"], ocProvider: null, artifact: "env MOONSHOT_API_KEY" }),
+    hint: "Moonshot platform key (api.moonshot.ai) — distinct from the Kimi Code login" },
+  { provider: "agy", label: "Antigravity (agy)", kind: "unknown", connect: "cli-login",
+    binary: ["agy"], loginCmd: "agy", loginRun: ["agy"], envKeys: [], probe: null,
+    auth: () => ({ artifact: null, present: false, mode: null, key: null, expiresAt: null }),
+    hint: "Antigravity CLI — Google sign-in on first run" },
+  { provider: "dsh", label: "DeepSeek Harness", kind: "prepaid", connect: "api-key",
+    binary: ["dsh"], loginCmd: "npm i -g @deepseek-ai/dsh && trantor connect", loginRun: null, envKeys: ["DEEPSEEK_API_KEY"], probe: "balances",
+    auth: (home, env) => apiKeyAuth(home, env, { envKeys: ["DEEPSEEK_API_KEY"], ocProvider: null, artifact: "env DEEPSEEK_API_KEY" }),
+    hint: "API-billed via DEEPSEEK_API_KEY — the same key the deepseek seat uses" },
+];
+
+const REG = Object.fromEntries(PROVIDERS.map((p) => [p.provider, p]));
+
+// The probe, for real: lib/balances.mjs IS the probe surface (card rule — reuse, never duplicate).
+// `only: [via]` hits exactly one adapter; dsh's row is rebranded on the way out so usage stays a
+// true balances row under the dsh provider name. `fetch` is the drill seam — tests hand a stub
+// instead of the real fetchBalances, no module mocking involved.
+async function balancesProbe(name, env, fetch = fetchBalances) {
+  const via = PROBE_VIA[name] || name;
+  const rows = await fetch(env, { only: [via] });
+  const row = (rows || []).find((r) => r.provider === via);
+  if (!row) return null;
+  return via === name ? row : { ...row, provider: name, label: REG[name].label };
+}
+// Named export for drills: the rebrand/via mapping is part of the probe contract (dsh rides the
+// deepseek adapter), and the drill asserts it with a stubbed `fetch`, never the real network.
+export { balancesProbe as balancesProbeForDrills };
+
+// Reason from a healthy balances row: the detail line when the adapter wrote one (qwen's
+// console-only note, kimi's window line), else fmtBalance's text minus the "Label: " prefix.
+// This is the kimi fix: `remainingPct: null` no longer blanks the row — the detail IS the reason.
+function reasonFromUsage(row) {
+  if (row.detail) return row.detail;
+  const s = fmtBalance(row);
+  const at = s.indexOf(": ");
+  return at > -1 ? s.slice(at + 2) : s;
+}
+
+const shortError = (e) => String(e ?? "unknown error").slice(0, 160);
+
+// Probe outcome → (state, reason). Orca's rule: a live authenticated call that ANSWERED is
+// connected, whatever the numbers; the exceptions are explicit.
+function stateFromProbe(p, row) {
+  if (!row) {
+    return { state: "unknown", reason: "live probe returned nothing — the provider is not configured for probing" };
+  }
+  if (!row.ok) {
+    const err = shortError(row.error);
+    if (/429|insufficient_quota|quota exceeded/i.test(err)) {
+      return { state: "over_quota", reason: `provider reports quota exhausted — ${err}` };
+    }
+    if (/401|403|invalid|unauthorized|rejected|expired/i.test(err)) {
+      return p.connect === "cli-login"
+        ? { state: "expired", reason: `login token rejected (${err}) — run: ${p.loginCmd}` }
+        : { state: "not_logged_in", reason: `API key rejected (${err}) — paste a fresh key` };
+    }
+    if (/no .*token|credentials/i.test(err)) {
+      return { state: "not_logged_in", reason: `no usable credential (${err}) — run: ${p.loginCmd}` };
+    }
+    return { state: "unknown", reason: `live probe failed — ${err}` };
+  }
+  // A spent quota plan ANSWERS ok with 0% left (qwen's wall: ok:true, remainingPct: 0).
+  if (row.kind === "quota" && row.remainingPct === 0) {
+    const reset = row.resetTime ? ` · resets ${fmtReset(row.resetTime)}` : "";
+    return { state: "over_quota", reason: `${row.detail || "quota spent"}${reset}` };
+  }
+  const who = row.plan ? `${row.plan} — ` : "";
+  return { state: "connected", reason: `${who}${reasonFromUsage(row)}` };
+}
+
+// actions are derived, never stored, so they can never contradict the state.
+function actionsFor(p, state) {
+  const base = ["recheck"];
+  if (state !== "not_installed") base.push("remove");
+  if (state === "not_logged_in" || state === "expired") base.unshift(p.connect === "cli-login" ? "login" : "paste-key");
+  else if (state === "not_installed" && p.connect === "api-key") base.unshift("paste-key");
+  return ACTIONS.filter((a) => base.includes(a));
+}
+
+function row(p, { binary, auth, state, reason, usage }) {
+  return {
+    provider: p.provider, label: p.label, kind: p.kind, connect: p.connect,
+    binary, auth: { artifact: auth.artifact, present: !!auth.present, mode: auth.mode },
+    state, reason: reason || state,   // never a blank reason — the kimi-bar rule, enforced at the seam
+    usage: usage || { ok: false, error: `not probed — ${state}` },
+    actions: actionsFor(p, state),
+  };
+}
+
+async function buildRow(p, ctx) {
+  const binary = detectBinary(p.binary, ctx);
+  const auth = p.auth(ctx.home, ctx.env, ctx);
+  // 1) an explicitly-expired artifact is decided WITHOUT a network round trip.
+  if (auth.present && Number.isFinite(auth.expiresAt) && auth.expiresAt < ctx.now) {
+    return row(p, { binary, auth, state: "expired",
+      reason: `credential expired ${new Date(auth.expiresAt).toISOString().slice(0, 10)} — run: ${p.loginCmd}` });
+  }
+  // 2) no auth AND no binary → nothing to seat and nothing to probe: not_installed. But a
+  //    provider WITH a credential (an env key on a machine without the CLI, qwen's API key on
+  //    an opencode-only machine) still gets its LIVE check: the account state is what the bar,
+  //    the pane and the wizard act on, and binary.installed is its own contract field.
+  if (!auth.present && !binary.installed && p.binary.length) {
+    const what = p.connect === "cli-login" ? `${binary.name} CLI not found on PATH` : `${binary.name} not found on PATH — the seat needs it`;
+    return row(p, { binary, auth, state: "not_installed", reason: `${what} — install it first (run: ${p.loginCmd})` });
+  }
+  // 3) no auth at a KNOWN location → not_logged_in, naming the artifact and the fix. The probe
+  //    would only echo this back with a slower error, so it is skipped, not trusted. But a
+  //    provider whose artifact we cannot read (agy: no reader exists) can never claim this
+  //    honestly — "ran once, invisible to us" would read the same as "never ran" — so with no
+  //    artifact AND no probe the row is unknown, with the how-to-check in the reason.
+  if (!auth.present && auth.artifact) {
+    return row(p, { binary, auth, state: "not_logged_in",
+      reason: `no credential at ${auth.artifact} — run: ${p.loginCmd}` });
+  }
+  if (!auth.present && !p.probe) {
+    return row(p, { binary, auth, state: "unknown",
+      reason: `installed, no credential reader and no live probe — run ${p.binary[0]} once to log in, then recheck` });
+  }
+  // 4) the live check. probe === null means no balances adapter exists (agy): say unknown and
+  //    how to check, rather than reading "binary exists" as connected (Orca's rule).
+  if (!p.probe) {
+    return row(p, { binary, auth, state: "unknown",
+      reason: `installed, no live probe wired — run ${p.binary[0]} once to confirm the login, then recheck` });
+  }
+  const probeEnv = auth.key && p.envKeys[0] ? { ...ctx.env, [p.envKeys[0]]: auth.key } : ctx.env;
+  try {
+    const usage = await ctx.probe(p.provider, probeEnv);
+    const { state, reason } = stateFromProbe(p, usage);
+    // Codex signs in by account, not by key — the id_token's email claim names WHO is connected
+    // (the operator runs several). Reason text only; the token itself never leaves the reader.
+    const full = state === "connected" && auth.email ? `signed in as ${auth.email} · ${reason}` : reason;
+    return row(p, { binary, auth, state, reason: full, usage: usage || undefined });
+  } catch (e) {
+    return row(p, { binary, auth, state: "unknown", reason: `live probe failed — ${shortError(e?.message || e)}` });
+  }
+}
+
+// The frozen contract. opts: { env, home, path, now, probe } — everything a drill needs to stay
+// hermetic: env defaults to the LAYERED crew resolution (process.env ∪ ~/.token-scrooge/.env ∪
+// ~/.agent-bus/.env), home to the real one (which also unlocks the keychain read), probe to the
+// balances-backed one.
+export async function providerStatus(opts = {}) {
+  const home = opts.home || homedir();
+  const ctx = {
+    home,
+    allowKeychain: !opts.home,   // an injected home is a drill — never touch the operator keychain
+    env: opts.env ?? resolveKeys(opts.env || process.env, [join(home, ".token-scrooge", ".env"), join(home, ".agent-bus", ".env")]),
+    path: opts.path,
+    now: opts.now || Date.now(),
+    probe: opts.probe || balancesProbe,
+  };
+  return Promise.all(PROVIDERS.map((p) => buildRow(p, ctx)));
+}
+
+// The pre-save seam (#6391's ask): run the registry's OWN probe against a CANDIDATE key and write
+// nothing anywhere. The row is the normal status row for that provider computed with the candidate
+// injected — connected means the key is live BEFORE `provider add --key` commits it to .env.
+export async function providerVerify(name, candidateKey, opts = {}) {
+  const p = REG[String(name || "").toLowerCase()];
+  if (!p) throw new Error(`unknown provider '${name}' — one of: ${PROVIDERS.map((x) => x.provider).join(", ")}`);
+  const home = opts.home || homedir();
+  const baseEnv = opts.env ?? resolveKeys(opts.env || process.env, [join(home, ".token-scrooge", ".env"), join(home, ".agent-bus", ".env")]);
+  const env = candidateKey && p.envKeys[0] ? { ...baseEnv, [p.envKeys[0]]: candidateKey } : baseEnv;
+  return buildRow(p, { home, allowKeychain: !opts.home, env, path: opts.path, now: opts.now || Date.now(), probe: opts.probe || balancesProbe });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.40",
+  "version": "0.18.41",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"