trantor 0.18.5 → 0.18.7

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -4,7 +4,7 @@
 import { spawn } from "node:child_process";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const [, , cmd, ...args] = process.argv;
@@ -138,9 +138,37 @@ switch (cmd) {
     else console.error(`Enrollment failed: ${j.error || r.statusText}`);
     break;
   }
+  // A BROWSER CANNOT READ AN ENFORCE-MODE HUB. The page itself is served (200), but every data
+  // endpoint answers 401 to an unsigned request — /projects, /tasks, /peers — because a browser has
+  // no keypair and nothing in a webview can safely hold one. So the dashboard renders as an empty
+  // shell with no projects, which reads as "the hub is broken" when the hub is fine and refusing
+  // correctly. That is exactly what happened to a crew launch on 2026-08-26.
+  //
+  // The desktop app is the surface that works: it signs every request in Rust, which is also why
+  // the webview never touches a key. Prefer it, and when it is missing say plainly why the browser
+  // will look empty rather than opening one and letting the operator draw the wrong conclusion.
   case "ui": {
-    let url = "http://127.0.0.1:4477";
-    try { url = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || url; } catch {}
+    const { resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
+    const { resolveProject } = await import(join(ROOT, "lib/project.mjs"));
+    const url = resolveHubInfo(resolveProject(process.cwd())).url;
+
+    let authMode = "";
+    try {
+      const r = await fetch(`${url}/health`, { signal: AbortSignal.timeout(5000) });
+      authMode = String((await r.json()).authMode || "");
+    } catch { /* hub unreachable — fall through and let the browser show that */ }
+
+    const hasApp = process.platform === "darwin" && existsSync("/Applications/Trantor.app");
+    if (authMode === "enforce" && hasApp) {
+      spawn("open", ["-a", "Trantor"], { stdio: "ignore", detached: true }).unref();
+      console.log(`dashboard → Trantor.app (${url} is auth:enforce — a browser cannot sign, so it would show an empty board)`);
+      break;
+    }
+    if (authMode === "enforce") {
+      console.log(`⚠ ${url} is auth:enforce. A browser cannot sign its requests, so the board will be EMPTY —`);
+      console.log(`  every data endpoint returns 401. Install the desktop app instead: trantor app install`);
+      console.log(`  Opening it anyway so you can see for yourself…`);
+    }
     spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore", detached: true }).unref();
     console.log(`dashboard → ${url}`);
     break;

package/bin/crew-runner.mjs

@@ -326,7 +326,18 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
     cwd: DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
-    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ },
+    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
+      // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
+      //
+      // The handoff machinery exists for an INTERACTIVE session: near its context limit it writes a
+      // handoff and opens a fresh window to carry on. A seat has no use for that — the runner is its
+      // lifecycle manager and wakes it per event — so the spawn just leaks an unmanaged interactive
+      // session into a window nobody asked for.
+      //
+      // Observed on the duty seat: handoff records at 17:24 and 18:59 on 2026-08-24, and two stray
+      // `claude` processes in ~/.agent-bus/trantor-duty started at 17:24:57 and 18:59:50, still
+      // sitting there days later. To the operator that reads as "why are there two duty agents".
+      TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
   });
   try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }

package/bin/duty.mjs

@@ -116,6 +116,47 @@ function alivePid() {
   return 0;
 }
 
+// The cmux workspace this seat owns. One name, so `up` can find and replace its predecessor and
+// `down` can take the surface away with the process.
+const CMUX_WS_NAME = "trantor-duty";
+
+// Surface override, same variable and same values bin/crew.sh already uses for crew seats:
+//   CREW_MUX=terminal  force a Terminal window (what the window-content drills assert on)
+//   CREW_MUX=cmux      require cmux
+//   unset / anything else = auto: cmux when it answers, Terminal otherwise.
+const SURFACE = String(process.env.CREW_MUX || "auto").toLowerCase();
+
+function cmuxBinary() {
+  if (SURFACE === "terminal") return "";
+  for (const c of ["cmux", "/Applications/cmux.app/Contents/Resources/bin/cmux"]) {
+    try { execSync(`${c} ping`, { stdio: "ignore", timeout: 3000 }); return c; } catch {}
+  }
+  return "";
+}
+
+/** Close every workspace this seat owns. No-op when cmux is absent or its socket is off. */
+function closeDutyWorkspace() {
+  const bin = cmuxBinary();
+  if (!bin) return 0;
+  let closed = 0;
+  try {
+    const listed = JSON.parse(execSync(`${bin} workspace list --id-format both --json`,
+      { encoding: "utf8", timeout: 5000, env: { ...process.env, CMUX_QUIET: "1" } }));
+    for (const w of listed.workspaces || []) {
+      const title = w.custom_title || w.title || "";
+      // Title AND directory. Matching on title alone makes this global: a duty instance running
+      // with a temp HOME (which is exactly what test-duty-seat.mjs does) would close the REAL
+      // seat's workspace and take the production seat down with it. That happened once, on
+      // 2026-08-26, and the operator found their duty agent simply gone. Only ever close a
+      // workspace that belongs to THIS seat's bus directory.
+      if (title === CMUX_WS_NAME && w.id && w.current_directory === DIR) {
+        try { execSync(`${bin} close-workspace --workspace ${w.id}`, { stdio: "ignore", timeout: 5000 }); closed++; } catch {}
+      }
+    }
+  } catch {}
+  return closed;
+}
+
 if (cmd === "up") {
   const hub = fleetHub();
   mkdirSync(DIR, { recursive: true });
@@ -144,9 +185,35 @@ if (cmd === "up") {
     const exports = Object.entries(env).map(([k, v]) =>
       `export ${k}=$(cat <<'TRANTOR_${k}_EOF'\n${v}\nTRANTOR_${k}_EOF\n)`).join("\n");
     writeFileSync(launcher, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
-    const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
-    try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
-    catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    // PREFER CMUX. Terminal.app was the only surface here, and a plain window is stacking by
+    // construction: every `duty up` opens another one and nothing closes the last, so restarts
+    // accumulate windows that all look like live duty agents. cmux gives the seat ONE named
+    // workspace that gets REPLACED on each up — the same "replace, never stack" rule bin/crew.sh
+    // already applies to crew seats, which is why they never pile up and this did.
+    //
+    // Terminal remains the fallback: no cmux, or its control socket off, and nothing changes.
+    const cmuxBin = cmuxBinary();
+
+    let openedInCmux = false;
+    if (cmuxBin) {
+      try {
+        // Replace, never stack: take the previous duty workspace away before opening this one.
+        // Closing first is safe here (unlike a crew pane swap) — the seat is a single surface with
+        // nothing to preserve.
+        closeDutyWorkspace();
+        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${launcher}`)} --focus false`,
+          { stdio: "ignore", timeout: 8000, env: { ...process.env, CMUX_QUIET: "1" } });
+        openedInCmux = true;
+      } catch (e) {
+        console.error(`cmux launch failed (${e?.message || e}) — falling back to a Terminal window`);
+      }
+    }
+
+    if (!openedInCmux) {
+      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
+      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
+      catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    }
     // The runner lives inside Terminal, so its pid is not ours to know: find it the same way `down`
     // does. Poll briefly, since Terminal takes a moment to start the shell.
     for (let i = 0; i < 25 && !pid; i++) {
@@ -163,7 +230,7 @@ if (cmd === "up") {
     pid = child.pid;
   }
   writeFileSync(PIDF, String(pid));
-  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a Terminal window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
+  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
   const fed = await registerDutySeat(hub, SESSION);
   if (fed) console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings.`);
   process.exit(0);   // the seat IS up; a hub that won't feed it is a warning, not a failed start
@@ -174,6 +241,10 @@ if (cmd === "down") {
   if (pid) { try { process.kill(pid); } catch {} console.log(`— duty seat stopped (pid ${pid}) —`); }
   else console.log("no duty seat running");
   try { execSync(`pkill -f "crew-runner.mjs ${AGENT} ${DIR}"`, { stdio: "ignore" }); } catch {}
+  // Close the seat's cmux workspace too. Killing the process leaves the surface behind, and a dead
+  // pane titled trantor-duty is indistinguishable from a live one at a glance — which is the exact
+  // confusion this whole change is about.
+  closeDutyWorkspace();
   try { rmSync(PIDF, { force: true }); } catch {}
   // Clear the hub's pointer too — escalations aimed at a seat that no longer exists are messages
   // sent into a hole, and the hub has no other way to learn the seat went away.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"

package/skills/crew/SKILL.md

@@ -36,7 +36,11 @@ explicit EVENT/INTERFACE CONTRACT — cross-agent bugs come from contract drift.
 2. One card per package: `relay_task_add(title, assignee, difficulty, model)` — set `model`
    to the advisor-routed model (or the CLI's default name); difficulty + model show as badges
    on the card. Assignees: `codex:<project>` etc. Keep one for yourself.
-3. Open the dashboard: `trantor ui` (or `open -na "Google Chrome" --args --new-window <hub-url>`)
+3. Open the dashboard: **`trantor ui`** — which opens the **desktop app**, not a browser.
+   Do NOT open the hub URL in a browser. A remote hub runs `auth:enforce`, and a browser cannot
+   sign its requests: the page loads but `/projects`, `/tasks` and `/peers` all return 401, so the
+   board renders EMPTY. That looks like a broken hub and is not one. The desktop app signs every
+   request natively, which is the whole reason it exists. If it is missing: `trantor app install`.
 
 ## Phase 2 — fire up the crew (with the Advisor's models)
 **Each crew card from `relay_advise` carries a `launch` spec — run it VERBATIM; never invent a