trantor 0.18.43 → 0.18.47

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.43",
+  "version": "0.18.47",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/balances.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: config.json is user-editable external input; thresholds validates its optional number/object fields at that I/O boundary. */
 // trantor balances — show how much credit is left on each prepaid provider (DeepSeek, Kimi, OpenRouter…)
 // so you can refill BEFORE a build stalls. Reads keys from the environment, queries each provider's
 // balance API, prints them, and pushes the snapshot to the hub so the dashboard + other sessions see it.
@@ -8,6 +9,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { fetchBalances, isLow, fmtBalance, DEFAULT_LOW, DEFAULT_LOW_QUOTA_PCT } from "../lib/balances.mjs";
+import { detectedCliBalanceRows } from "../lib/providers.mjs";
 import { loadProfile } from "./profile.mjs";
 import { resolveKeys } from "../lib/provider-keys.mjs";
 
@@ -15,7 +17,8 @@ const args = process.argv.slice(2);
 const asJson = args.includes("--json");
 const noPush = args.includes("--no-push");
 
-// Only check providers the user configured in `trantor profile` — never stray keys in the ambient env.
+// API-key providers stay profile-scoped so ambient keys are never scraped. Claude and Codex are
+// machine CLI logins: the registry admits them from binary + credential + live-probe detection.
 const configured = Object.keys(loadProfile().providers || {});
 
 // Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST rejected under enforce.
@@ -26,7 +29,10 @@ function thresholds() {
   return DEFAULT_LOW;
 }
 
-const balances = await fetchBalances(resolveKeys(process.env), { only: configured });
+const env = resolveKeys(process.env);
+const detected = await detectedCliBalanceRows({ env });
+const profileScoped = await fetchBalances(env, { only: configured.filter((provider) => provider !== "claude" && provider !== "codex") });
+const balances = [...detected, ...profileScoped];
 const low = thresholds();
 
 // push the snapshot to the hub (best-effort) so the dashboard + warning line can use it.

package/bin/baton.mjs

@@ -8,7 +8,7 @@ import { join, basename, dirname } from "node:path";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { writeHandoff, spawnBaton, resolveHandoffSurface } from "../hooks/lib/handoff.mjs";
+import { writeHandoff, spawnBaton, resolveHandoffSurface, armBaton, contextUsage, controllingTty, turnInFlight, armMaxMs } from "../hooks/lib/handoff.mjs";
 
 // #6074: the skill path (write-handoff.mjs) and this CLI path must share ONE resolution of which
 // project this is and where the session lives. Both call resolveHandoffSurface; the name comes
@@ -64,7 +64,34 @@ function autoBaton() {
   // The transcript's filename IS the writing session's id — record it, or an orchestrator-thread
   // handoff carries no writer and the baton-hold + map-follow logic in sessionstart.mjs can't fire.
   const sessionId = transcript ? basename(transcript, ".jsonl") : "";
-  const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger: "manual-cli", force: true, projectName: project });   // manual = intentional, bypass the storm guard
+  // #6528: WHO pulled the trigger. A TTY stdin means a human typed `trantor handoff` at a prompt;
+  // the app chain (lib.rs handoff_now) and hooks spawn this binary with piped stdio. The operator's
+  // own typed command keeps the storm-guard bypass (force:true — "manual = intentional"); every
+  // invoked path goes through the boundary gate and the hub's storm guard like any auto handoff.
+  // --reason rides through from the app (`--reason clicked|countdown|unattended`) so the RECORD
+  // finally names the real trigger instead of laundering every banner fire into "manual-cli".
+  const reasonArg = (() => {
+    const i = process.argv.indexOf("--reason");
+    const v = i >= 0 ? String(process.argv[i + 1] || "").trim() : "";
+    return v && !v.startsWith("--") ? v : "";
+  })();
+  const operatorTyped = !!process.stdin.isTTY;
+  const trigger = reasonArg || "manual-cli";
+  // --force: the hard-cap leg (#6528). The app's boundary wait timed out (or an operator typed it
+  // mid-turn on purpose) — write NOW, gate or no gate, and say that is what happened. Without it,
+  // a turn still in flight ARMS instead of writing: no record, no spawn, and the session's own
+  // Stop hook fires the baton at the boundary, where the summary describes finished work.
+  const force = process.argv.includes("--force");
+  if (!force && turnInFlight(transcript)) {
+    armBaton(sessionId, {
+      projectDir: cwd,
+      transcript, reason: trigger, windowId: "", tty: controllingTty(),
+      tokens: contextUsage(transcript)?.tokens || 0,
+    });
+    console.log(`⏸ handoff armed — it fires when this turn finishes (hard cap ${Math.round(armMaxMs() / 60000)}m: the next tool boundary fires it). No record written yet.`);
+    process.exit(0);
+  }
+  const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger, force, projectName: project });   // operator-typed = intentional, bypass the storm guard
   console.log(`📋 handoff saved for ${project}: ${file}`);
   // --write-only: the in-app flow (#5509). The app ends the pane's session itself and reopens it
   // through `trantor open`, which claims this handoff — a Terminal window here would be exactly the

package/bin/cli.mjs

@@ -30,6 +30,7 @@ switch (cmd) {
   case "open":    runCrew(); break;
   case "herdr":   spawn(process.execPath, [join(ROOT, "bin/herdr-agent.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "autonomy": spawn(process.execPath, [join(ROOT, "bin/autonomy.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "agent-settings": run("bin/agent-settings.mjs"); break;
   case "adopt":   spawn(process.execPath, [join(ROOT, "bin/adopt.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "integrate": spawn(process.execPath, [join(ROOT, "bin/integrate.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "down":    runCrew(); break;

package/bin/provider.mjs

@@ -19,7 +19,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFi
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync, spawnSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { buildRoster, loadWorld } from "./advise.mjs";
 import { providerStatus, providerVerify, PROVIDERS } from "../lib/providers.mjs";
 
@@ -31,6 +31,7 @@ const C = { dim: "\x1b[2m", grn: "\x1b[32m", red: "\x1b[31m", yel: "\x1b[33m", g
 const envKeyName = (p) => `${String(p).toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
 
 const OC_CONFIG = join(H, ".config", "opencode", "opencode.json");
+const PROFILE_BIN = join(dirname(fileURLToPath(import.meta.url)), "profile.mjs");
 // Wire a CUSTOM OpenAI-compatible provider into opencode.json (matching opencode's schema +
 // the existing providers' `options.apiKey` style). Merges, never clobbers other providers.
 // `configPath` is injectable so it can be unit-tested against a temp file.
@@ -152,7 +153,8 @@ function addProvider(name, opts) {
 
   // 2) declare the plan in the quota profile (drives the Advisor's tier/cost reasoning)
   try {
-    execSync(`node ${join(dirname(new URL(import.meta.url).pathname), "profile.mjs")} set ${provider}=${plan}`, { stdio: "ignore" });
+    const declared = spawnSync(process.execPath, [PROFILE_BIN, "set", `${provider}=${plan}`], { stdio: "ignore" });
+    if (declared.error || declared.status !== 0) throw declared.error || new Error(`profile exited ${declared.status}`);
     console.log(`${C.grn}✓${C.off} profile: ${provider}=${plan}`);
   } catch (e) { console.log(`${C.yel}⚠${C.off} could not set profile (run: trantor profile set ${provider}=${plan})`); }
 
@@ -242,10 +244,22 @@ function loginProvider(name) {
   }
   console.log(`${C.dim}running:${C.off} ${p.loginRun.join(" ")}  ${C.dim}(the CLI's own login — sign in there)${C.off}`);
   const r = spawnSync(p.loginRun[0], p.loginRun.slice(1), { stdio: "inherit" });
-  if (r.error || (r.status !== 0 && r.status !== null)) {
+  if (r.error || r.status !== 0) {
     console.error(`\n${p.loginRun[0]} exited ${r.status ?? "?"} — install it first, then re-run: trantor provider login ${p.provider}`);
     process.exit(1);
   }
+  const profile = read(join(H, ".agent-bus", "profile.json"), { providers: {} });
+  const plan = profile.providers?.[p.provider]?.plan || "subscription";
+  const declared = spawnSync(process.execPath, [PROFILE_BIN, "set", `${p.provider}=${plan}`], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (declared.error || declared.status !== 0) {
+    const detail = String(declared.stderr || declared.error?.message || "").trim();
+    console.error(`\nlogin succeeded, but ${p.provider} could not be restored to the quota profile${detail ? ` — ${detail}` : ""}`);
+    process.exit(1);
+  }
+  console.log(`${C.grn}✓${C.off} profile: ${p.provider}=${plan}`);
   console.log(`\n${C.dim}re-check it live:${C.off} trantor provider status`);
 }
 

package/hooks/ask-sidecar.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// Export a live AskUserQuestion before Claude's transcript flushes it (#6533).
+import {
+  mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { sessionContext } from "./lib/api.mjs";
+
+function readStdin() {
+  return new Promise(res => {
+    let d = ""; process.stdin.setEncoding("utf8");
+    process.stdin.on("data", c => { d += c; });
+    process.stdin.on("end", () => res(d));
+    setTimeout(() => res(d), 400);
+  });
+}
+
+const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+
+function sidecarPath(sessionId) {
+  const sid = String(sessionId ?? "").trim();
+  if (!sid || sid === "." || sid === ".." || !/^[A-Za-z0-9._-]+$/.test(sid)) return null;
+  return join(busDir(), "asks", `${sid}.json`);
+}
+
+function toolUseId(input) {
+  const id = input?.tool_use_id;
+  return id === undefined || id === null || String(id).trim() === "" ? null : String(id);
+}
+
+function existingOpen(path, sessionId) {
+  try {
+    const stored = JSON.parse(readFileSync(path, "utf8"));
+    return String(stored.session_id ?? "") === String(sessionId) ? stored : null;
+  } catch {
+    return null;
+  }
+}
+
+function sameOpen(left, right) {
+  return left.session_id === right.session_id && left.project === right.project &&
+    left.cwd === right.cwd && (left.tool_use_id ?? null) === right.tool_use_id &&
+    left.event === right.event && (left.visible_ts ?? null) === right.visible_ts &&
+    JSON.stringify(left.questions) === JSON.stringify(right.questions);
+}
+
+function writeOpen(input, path) {
+  if (String(input.tool_name ?? "") !== "AskUserQuestion") return;
+  const questions = input.tool_input?.questions;
+  if (!Array.isArray(questions)) return;
+  const cwd = String(input.cwd ?? "");
+  const ctx = sessionContext(cwd);
+  const stored = existingOpen(path, input.session_id);
+  const incomingId = toolUseId(input);
+  const now = Date.now();
+  const permissionVisible = String(input.hook_event_name ?? "") === "PermissionRequest";
+  const visibleTs = stored?.visible_ts ?? (permissionVisible ? now : null);
+  const payload = {
+    session_id: String(input.session_id),
+    project: ctx.project,
+    cwd,
+    tool_use_id: incomingId ?? stored?.tool_use_id ?? null,
+    questions,
+    event: visibleTs === null ? "PreToolUse" : "PermissionRequest",
+    visible_ts: visibleTs,
+    ts: stored?.ts ?? now,
+  };
+  if (stored && sameOpen(stored, payload)) return;
+  const dir = join(busDir(), "asks");
+  mkdirSync(dir, { recursive: true });
+  const tmp = join(dir, `.${String(input.session_id)}.${process.pid}.${Date.now()}.tmp`);
+  try {
+    writeFileSync(tmp, JSON.stringify(payload), { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch (error) {
+    try { unlinkSync(tmp); } catch {}
+    throw error;
+  }
+}
+
+function closeTool(input, path) {
+  const stored = JSON.parse(readFileSync(path, "utf8"));
+  const storedId = stored.tool_use_id ?? null;
+  if (storedId === null || storedId === toolUseId(input)) unlinkSync(path);
+}
+
+try {
+  const raw = await readStdin();
+  const input = JSON.parse(raw || "{}");
+  const path = sidecarPath(input?.session_id);
+  if (path) {
+    const event = String(input.hook_event_name ?? "");
+    if (event === "PreToolUse" || event === "PermissionRequest") writeOpen(input, path);
+    else if (event === "PostToolUse" || event === "PostToolUseFailure") closeTool(input, path);
+    else if (event === "Stop") {
+      try { unlinkSync(path); } catch {}
+    }
+  }
+} catch {}
+
+// Informational state only: never approve, deny, answer, or inject context.
+process.stdout.write("{}");

package/hooks/githooks/pre-push

@@ -1,8 +1,9 @@
 #!/bin/bash
 # #6446 (BUILD-DOCTRINE.md rule 2, "red blocks merge"): branch protection gates PR merges, but
 # the orchestrator's merges are LOCAL pushes to main, which a required check cannot gate. This
-# pre-push hook runs the fast subset (slop-gate + test.mjs) and refuses the push on red. The full
-# suite still runs in CI on every push. Deliberate bypass: git push --no-verify.
+# pre-push hook runs the fast subset (slop-gate + the hermetic sessionstart drill) and refuses
+# the push on red. The full suite is `npm test` → test/run.mjs (#6447) and runs in CI on every
+# push. Deliberate bypass: git push --no-verify.
 set -u
 ROOT="$(git rev-parse --show-toplevel)" || exit 1
 cd "$ROOT" || exit 1
@@ -21,7 +22,7 @@ while read -r _ local_ref _ _; do
     echo "trantor pre-push: slop-gate RED — push refused. Fix it, or bypass with --no-verify (CI still gates the PR)." >&2
     exit 1
   fi
-  if ! node test.mjs; then
+  if ! node test/hooks/test.mjs; then
     echo "trantor pre-push: test.mjs RED — push refused. Fix it, or bypass with --no-verify (CI still gates the PR)." >&2
     exit 1
   fi

package/hooks/heartbeat.mjs

@@ -18,14 +18,14 @@ import { join, basename, dirname } from "node:path";
 import { homedir, hostname } from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { armBaton, readArm, clearArm, readConfig, contextUsage, warnFrac, alreadyHandedOff, markHandedOff, controllingTty, terminalWindowForTty, subagentsActive } from "./lib/handoff.mjs";
+import { armBaton, readArm, clearArm, readConfig, contextUsage, warnFrac, alreadyHandedOff, markHandedOff, controllingTty, terminalWindowForTty, subagentsActive, armMaxMs } from "./lib/handoff.mjs";
 import { resolveProject, hostId } from "../lib/project.mjs";
 import { installedVersion } from "./lib/update-check.mjs";   // report our hook version so the hub can flag stale sessions
 import { signedPost } from "./lib/api.mjs";
 
 const HEARTBEAT_MS = Number(process.env.RELAY_HEARTBEAT_MS || 60 * 1000);
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_HEARTBEAT_TIMEOUT_MS || 1500);
-const ARM_MAX_MS = Number(process.env.TRANTOR_BATON_ARM_MAX_MS || 15 * 60 * 1000);
+const ARM_MAX_MS = armMaxMs();   // #6528: one source for the hard cap (shared with bin/baton.mjs's printed promise)
 const INFLIGHT_MS = 5 * 60 * 1000;
 const HERE = dirname(fileURLToPath(import.meta.url));
 

package/hooks/hooks.json

@@ -45,6 +45,26 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/file-claim.mjs"
           }
         ]
+      },
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
+          }
+        ]
       }
     ],
     "SubagentStart": [
@@ -85,6 +105,26 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/todo-sync.mjs"
           }
         ]
+      },
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
+          }
+        ]
       }
     ],
     "PreCompact": [
@@ -121,6 +161,15 @@
       }
     ],
     "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
+          }
+        ]
+      },
       {
         "matcher": "",
         "hooks": [

package/hooks/lib/handoff.mjs

@@ -163,8 +163,25 @@ export function armPath(sessionId) {
   const safe = String(sessionId || "s").replace(/[^A-Za-z0-9_.-]/g, "_");
   return join(process.env.AGENT_BUS_DIR || process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus"), `handoff-armed-${safe}.json`);
 }
+// The hard cap on an arm (#6528): a session that never reaches a Stop must still hand off —
+// the heartbeat fires at the next tool boundary once the arm is this old. One source for the
+// number, because the CLI (bin/baton.mjs) prints it in its armed message and the heartbeat
+// enforces it; two copies would drift and the printed promise would be a lie.
+export function armMaxMs() {
+  const n = Number(process.env.TRANTOR_BATON_ARM_MAX_MS);
+  return Number.isFinite(n) && n > 0 ? n : 15 * 60 * 1000;
+}
 export function armBaton(sessionId, payload) {
-  try { writeFileSync(armPath(sessionId), JSON.stringify({ ts: Date.now(), ...payload })); return true; } catch { return false; }
+  try {
+    // Re-arming must NOT refresh the timestamp (#6528): the banner can re-fire the request
+    // every few seconds, and a slid-forward ts would starve the hard cap forever — an arm
+    // that is always brand-new never ages into the heartbeat's fire-anyway backstop. The
+    // FIRST arm's ts is the arm's age; later writes only refresh the payload.
+    const prior = readArm(sessionId);
+    const ts = prior?.ts || Date.now();
+    writeFileSync(armPath(sessionId), JSON.stringify({ ts, ...payload }));
+    return true;
+  } catch { return false; }
 }
 export function readArm(sessionId) {
   try { const p = armPath(sessionId); if (!existsSync(p)) return null; return JSON.parse(readFileSync(p, "utf8")); } catch { return null; }
@@ -194,6 +211,59 @@ export function subagentsActive(transcriptPath, withinMs = 90_000) {
   } catch { return false; }
 }
 
+// ---- #6528: THE ONE GATE — is this session's turn still in flight? --------------------------
+// Two signals, both read from artifacts the session itself already writes:
+//   1. subagentsActive() — a spawned sub-agent wrote its transcript recently. The 90s mtime
+//      window is a false-idle risk (a sub-agent in a long model stretch writes nothing for
+//      minutes — that is exactly how orca-onboarding-map went unseen on #6528), but widening
+//      it only ever DEFERS a handoff, never fires one early — the safe direction.
+//   2. the transcript TAIL — the last real row tells where the turn stands. A user row
+//      carrying tool_result means the model is about to continue (mid-turn). An assistant
+//      row carrying tool_use means a result is still owed (mid-turn). Only an assistant row
+//      that is plain text (the turn's closing words) reads as idle — the same state the Stop
+//      hook fires on.
+// Every path that can WRITE+SPAWN a handoff (heartbeat backstop, Stop hook, `trantor handoff`)
+// asks this before firing; only an operator's own typed command or the explicit hard-cap leg
+// (--force) may bypass it.
+const TAIL_BYTES = 262_144;
+function transcriptTailRows(transcriptPath) {
+  const fd = openSync(transcriptPath, "r");
+  try {
+    const size = fstatSync(fd).size;
+    const want = Math.min(size, TAIL_BYTES);
+    const b = Buffer.alloc(want);
+    readSync(fd, b, 0, want, size - want);
+    // Drop the first (possibly partial) line, then parse what follows.
+    return b.toString("utf8").split("\n").slice(1).filter(Boolean);
+  } finally { closeSync(fd); }
+}
+export function lastRowMidTurn(transcriptPath) {
+  try {
+    if (!transcriptPath || !existsSync(transcriptPath)) return false;
+    const rows = transcriptTailRows(transcriptPath);
+    for (let i = rows.length - 1; i >= 0; i--) {
+      let r; try { r = JSON.parse(rows[i]); } catch { continue; }
+      if (r?.type !== "assistant" && r?.type !== "user") continue;   // metadata rows say nothing
+      const c = r?.message?.content;
+      if (r.type === "assistant") {
+        const blocks = Array.isArray(c) ? c : [];
+        if (blocks.some(b => b?.type === "tool_use")) return true;   // a result is still owed
+        return false;                                                // text-only → turn said its piece
+      }
+      // user row: #6528 follow-up — a trailing user row of ANY kind means in flight. A
+      // tool_result is the model mid-cycle, and a PLAIN prompt is the model WORKING on that
+      // prompt: Claude Code does not flush the assistant turn until it ends, so the assistant
+      // row's absence is not idle evidence. The only idle evidence is the text-only assistant
+      // row above, or the Stop hook itself.
+      return true;
+    }
+    return false;
+  } catch { return false; }
+}
+export function turnInFlight(transcriptPath) {
+  return subagentsActive(transcriptPath) || lastRowMidTurn(transcriptPath);
+}
+
 // ---- whole-session summary --------------------------------------------------
 function collectTurns(transcriptPath) {
   const rows = readFileSync(transcriptPath, "utf8").split("\n").filter(Boolean)
@@ -275,7 +345,7 @@ export function buildSummary(transcriptPath) {
   let convo = "";
   try { convo = digest(collectTurns(transcriptPath)); } catch { convo = ""; }
   if (!convo) return "*(transcript unreadable)*";
-  const sys = "You are writing a SESSION HANDOFF so a fresh Claude Code session can take over without losing context. The text spans an entire (possibly multi-hour) session: opening turns, an even sample of the middle, and the recent tail. Produce a concise but COMPLETE markdown handoff with these sections: TASK (what we're doing + the goal), STATE (done / in-progress), KEY DECISIONS, OPEN THREADS & NEXT STEPS (concrete actions), KEY FILES & locations (exact paths). Be specific. Cover the whole arc, not just the end. Do not pad.";
+  const sys = "You are writing a SESSION HANDOFF so a fresh Claude Code session can take over without losing context. The text spans an entire (possibly multi-hour) session: opening turns, an even sample of the middle, and the recent tail. Produce a concise but COMPLETE markdown handoff with these sections: TASK (what we're doing + the goal), STATE (done / in-progress), KEY DECISIONS, OPEN THREADS & NEXT STEPS (concrete actions), KEY FILES & locations (exact paths). Be specific. Cover the whole arc, not just the end. The finished handoff must fit ~3500 characters — anything longer is capped with an elision marker and the elided middle (usually STATE) is exactly what the successor needed (#6528), so compress the arc, never drop a section. Do not pad.";
   // Cut the raw tail on a TURN boundary. A blind slice(-12000) opens mid-sentence, which is how the
   // 2026-08-24 handoff began, and a successor cannot tell a truncated thought from a complete one.
   const tail = (n) => {

package/hooks/prompt-focus.mjs

@@ -69,6 +69,9 @@ try {
   const trimmed = prompt.replace(/\s+/g, " ").trim();
   // skip empties, tiny continuations, and pure acks — they're not a new focus
   if (!trimmed || trimmed.length < 12 || ACK.test(trimmed)) { emitAndExit(); }
+  // The Accounts ask drill launches a real Claude session, so its scripted prompt traverses this
+  // hook just like operator work. It is harness traffic, though, and must never become a focus card.
+  if (/\bTRANTOR ASK DRILL\b/.test(trimmed)) { emitAndExit(); }
   // HARNESS-INJECTED prompts are not a human's focus. Task notifications, hook system-reminders and
   // protocol frames arrive through the same UserPromptSubmit channel, and carding one titled a board
   // card "<task-notification> <task-id>bavlqfmzq</task-id>…" — pure noise a human cannot read.

package/hooks/stop-inbox.mjs

@@ -29,7 +29,7 @@ import { homedir } from "node:os";
 import { resolveProject, hostId, handoffDir, busDir } from "../lib/project.mjs";
 import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
-import { readArm, clearArm, markHandedOff, appendHandoffState } from "./lib/handoff.mjs";
+import { readArm, clearArm, markHandedOff, appendHandoffState, subagentsActive } from "./lib/handoff.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -169,9 +169,16 @@ async function main() {
   // finished work rather than a session thirty seconds from its own conclusions. Fired detached and
   // never awaited, and the arming is cleared FIRST so a crash in the worker cannot re-fire it on
   // every subsequent Stop.
+  // #6528: a boundary is only a boundary when NOTHING is still running. CC's Stop fires while a
+  // backgrounded sub-agent (fork, teammate, workflow leg) can still be mid-flight — firing then
+  // hands the baton to a successor that yanks the work's parent out from under it. The arm STAYS:
+  // the next Stop fires it, and the heartbeat's hard cap (armMaxMs, next tool boundary) keeps a
+  // never-idle session from being armed forever.
   try {
     const armed = readArm(input.session_id || "");
-    if (armed) {
+    if (armed && armed.transcript && subagentsActive(armed.transcript)) {
+      process.stderr.write("[trantor] turn boundary reached but sub-agents are still active — the armed baton stays armed for the next boundary\n");
+    } else if (armed) {
       clearArm(input.session_id || "");
       const kid = spawn(process.execPath, [join(HERE, "handoff-now.mjs"),
         armed.projectDir || projectDir, String(input.session_id || ""), armed.transcript || "",

package/hub/routes/admin.mjs

@@ -335,23 +335,23 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       const canonP = p => ALIAS[p] || p;
       let prof = {}; try { prof = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "profile.json"), "utf8")).providers || {}; } catch {}
       const profByCanon = {}; for (const [p, v] of Object.entries(prof)) profByCanon[canonP(p)] = v;
-      // Server-side profile scoping (defense in depth): only surface providers the user CONFIGURED in
-      // their profile — never a stray key a client scraped from the ambient env (a dev's .env may hold
-      // OpenRouter/OpenAI/etc. keys for unrelated projects). Filters even a stale/old-client snapshot.
-      // If no profile is set, show nothing (better empty than wrong).
+      const detectedCli = new Set(["claude", "codex"]);
+      // API-key rows remain profile-scoped so a stray ambient key never appears. Claude and Codex
+      // instead arrive only after the client registry detects their binary, auth artifact and probe;
+      // a missing quota declaration must not hide those machine-login rows from the bottom bar.
       // a prepaid entry that ERRORED but whose provider is a subscription per profile is really a
       // subscription (some plan keys have no balance endpoint → the 401 is expected, not a problem).
       const isSub = (t) => !!t && t !== "api";   // capped-sub / high-sub → a subscription (nothing to refill)
-      const entries = (state.balances?.entries || []).filter(e => profByCanon[canonP(e.provider)]).map(e => {
+      const entries = (state.balances?.entries || []).filter(e => detectedCli.has(e.provider) || profByCanon[canonP(e.provider)]).map(e => {
         const pv = profByCanon[canonP(e.provider)];
         if (!e.ok && isSub(pv?.tier)) return { provider: e.provider, label: e.label, kind: "subscription", plan: pv.plan, ok: true, remaining: null, low: false };
         return { ...e, low: lowOf(e) };
       });
-      // list EVERY configured subscription provider not already fetched (claude/codex/gemini etc.) so the
-      // dashboard shows the full configured crew, not just the ones with a queryable balance/quota.
+      // List configured non-CLI subscriptions not already fetched. Claude/Codex may only come from
+      // live registry detection above; a stale profile declaration cannot manufacture either row.
       const known = new Set(entries.map(e => canonP(e.provider)));
       const subs = Object.entries(prof)
-        .filter(([p, v]) => isSub(v?.tier) && !known.has(canonP(p)))
+        .filter(([p, v]) => !detectedCli.has(p) && isSub(v?.tier) && !known.has(canonP(p)))
         .map(([p, v]) => ({ provider: p, label: p, kind: "subscription", plan: v.plan, ok: true, remaining: null, low: false }));
       return json(res, 200, { ts: state.balances?.ts || 0, by: state.balances?.by || "", thresholds: low,
         entries: [...entries, ...subs], lowCount: entries.filter(e => e.low).length, stale: (now() - (state.balances?.ts || 0)) > 6 * 3600e3 });

package/lib/providers.mjs

@@ -24,6 +24,7 @@ import { resolveKeys } from "./provider-keys.mjs";
 
 export const STATES = ["connected", "not_installed", "not_logged_in", "expired", "over_quota", "unknown"];
 export const ACTIONS = ["login", "paste-key", "recheck", "remove"];
+const DETECTED_BALANCE_PROVIDERS = new Set(["claude", "codex"]);
 
 const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
 const envKeyName = (p) => `${String(p).toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
@@ -316,7 +317,20 @@ export async function providerStatus(opts = {}) {
     now: opts.now || Date.now(),
     probe: opts.probe || balancesProbe,
   };
-  return Promise.all(PROVIDERS.map((p) => buildRow(p, ctx)));
+  const only = opts.only ? new Set(opts.only.map((name) => String(name).toLowerCase())) : null;
+  const providers = only ? PROVIDERS.filter((provider) => only.has(provider.provider)) : PROVIDERS;
+  return Promise.all(providers.map((p) => buildRow(p, ctx)));
+}
+
+// Claude and Codex are machine logins, not manually-wired API providers. Their balance rows are
+// therefore admitted by the registry's full detection result (binary + auth artifact + live probe),
+// never by the optional quota profile. API-key providers remain profile-scoped in fetchBalances.
+export async function detectedCliBalanceRows(opts = {}) {
+  const statuses = await providerStatus({ ...opts, only: [...DETECTED_BALANCE_PROVIDERS] });
+  return statuses
+    .filter((status) => status.binary.installed && status.auth.present
+      && status.usage && !String(status.usage.error || "").startsWith("not probed"))
+    .map((status) => status.usage);
 }
 
 // The pre-save seam (#6391's ask): run the registry's OWN probe against a CANDIDATE key and write

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.43",
+  "version": "0.18.47",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-enroll.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-prd-review.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node test/run.mjs"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [