trantor 0.18.6 → 0.18.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.6",
+  "version": "0.18.8",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -9,7 +9,7 @@
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
 import { execSync, spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles } from "../lib/project.mjs";
@@ -24,6 +24,41 @@ const DIR = process.argv[3] || process.cwd();
 // back to the git-repo-root basename — never a loose dir basename that could
 // fork the host's "builtbetter.ai" into a separate "builtbetter" lane.
 const PROJ = process.env.RELAY_PROJECT || resolveProject(DIR);
+
+function safePathSegment(s) {
+  return String(s).replace(/\.{2,}/g, "_").replace(/[^A-Za-z0-9_.-]/g, "_");
+}
+
+function gitOut(args, cwd = DIR) {
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 8000 });
+  return r.status === 0 ? String(r.stdout || "").trim() : "";
+}
+
+function ensureSeatWorktree(sourceDir) {
+  if (process.env.TRANTOR_NO_WORKTREE === "1") return sourceDir;
+  const root = gitOut(["-C", sourceDir, "rev-parse", "--show-toplevel"], sourceDir);
+  if (!root) return sourceDir;
+
+  spawnSync("git", ["-C", root, "worktree", "prune"], { stdio: "ignore", timeout: 8000 });
+  const seatDir = join(homedir(), ".agent-bus", "worktrees", safePathSegment(PROJ), safePathSegment(AGENT));
+  const branch = `seat/${AGENT}`;
+  if (existsSync(seatDir)) {
+    const ok = gitOut(["-C", seatDir, "rev-parse", "--is-inside-work-tree"], seatDir) === "true";
+    if (ok) return seatDir;
+    console.log(`\x1b[33m[runner]\x1b[0m worktree path exists but is not a git worktree: ${seatDir} — using ${sourceDir}`);
+    return sourceDir;
+  }
+
+  try { mkdirSync(join(homedir(), ".agent-bus", "worktrees", safePathSegment(PROJ)), { recursive: true }); } catch {}
+  const r = spawnSync("git", ["-C", root, "worktree", "add", "-B", branch, seatDir, "HEAD"], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
+  });
+  if (r.status === 0) return seatDir;
+  console.log(`\x1b[33m[runner]\x1b[0m could not create ${branch} worktree — using ${sourceDir}`);
+  return sourceDir;
+}
+
+const TURN_DIR = ensureSeatWorktree(DIR);
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
@@ -53,7 +88,6 @@ process.on("uncaughtException", (e) => { console.log(`\x1b[31m[runner] UNCAUGHT:
 process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLED REJECTION: ${e?.stack || e}\x1b[0m`); });
 const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${s}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
-import { mkdirSync } from "node:fs";
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = 0;
 const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
@@ -278,7 +312,9 @@ async function notifyAssigners(pairs, text) {
     seen.add(f);
     // `re` threads this outcome to the exact contract it answers, so the sender's ledger closes the
     // right one instead of guessing from timing.
-    await api("/send", { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ, ...(id ? { re: id } : {}) }).catch(() => {});
+    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ };
+    if (id) payload.re = id;
+    await api("/send", payload).catch(() => {});
   }
   if (seen.size) log(`reported outcome to ${[...seen].join(", ")}`);
 }
@@ -325,8 +361,19 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // substitution) so bash waits for tee to flush before we read the file back.
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
-    cwd: DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
-    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ },
+    cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
+    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
+      // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
+      //
+      // The handoff machinery exists for an INTERACTIVE session: near its context limit it writes a
+      // handoff and opens a fresh window to carry on. A seat has no use for that — the runner is its
+      // lifecycle manager and wakes it per event — so the spawn just leaks an unmanaged interactive
+      // session into a window nobody asked for.
+      //
+      // Observed on the duty seat: handoff records at 17:24 and 18:59 on 2026-08-24, and two stray
+      // `claude` processes in ~/.agent-bus/trantor-duty started at 17:24:57 and 18:59:50, still
+      // sitting there days later. To the operator that reads as "why are there two duty agents".
+      TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
   });
   try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }

package/bin/crew.sh

@@ -46,11 +46,19 @@ HAVE_TMUX=0; command -v tmux >/dev/null 2>&1 && HAVE_TMUX=1
 # Events) — NOT the control socket — so it needs NO socket password (the socket denies external processes
 # by default; AppleScript bypasses that, exactly like we already script Terminal.app).
 HAVE_CMUX=0; [ -d "/Applications/cmux.app" ] && HAVE_CMUX=1
-# explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal forces the grouping UI.
+# herdr (https://herdr.dev — a server-held terminal runtime: panes live in its background server, so a
+# crew survives the launcher exiting) is OPT-IN ONLY, never auto-detected — a machine with herdr
+# installed keeps its default cmux→tmux→terminal dispatch untouched. CREW_MUX=herdr is the explicit
+# switch; opting in without the binary is a HARD ERROR, because a silent fallback would defeat the ask.
+HAVE_HERDR=0
+# explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal|herdr forces the grouping UI.
 case "${CREW_MUX:-}" in
   cmux)     HAVE_CMUX=1; HAVE_TMUX=0 ;;
   tmux)     HAVE_CMUX=0; HAVE_TMUX=1 ;;
   terminal) HAVE_CMUX=0; HAVE_TMUX=0 ;;
+  herdr)    HAVE_CMUX=0; HAVE_TMUX=0
+            command -v herdr >/dev/null 2>&1 || { echo "CREW_MUX=herdr but herdr is not installed — user-local (no sudo): curl -fsSL https://herdr.dev/install.sh | sh — see https://herdr.dev"; exit 1; }
+            HAVE_HERDR=1 ;;
 esac
 SEATDIR="$HOME/.agent-bus/seats"; mkdir -p "$SEATDIR"
 DRY="${CREW_DRY_RUN:-0}"
@@ -136,6 +144,137 @@ end tell
 OSA
 }
 
+# ── herdr helpers (active ONLY under the explicit CREW_MUX=herdr opt-in) ────────────────────────────
+# herdr's creation commands print JSON ids — capture them, never predict (herdr.dev/docs). All parsing
+# tolerates a bare array or a .result wrapper, and a failed/empty parse yields "" (the caller records
+# the empty handle and crew-verify flags the dead seat on the bus — the spawn is not the truth).
+_herdr() { herdr "$@"; }
+_herdr_ws_create() {   # $1=cwd $2=label → "workspace_id<TAB>root_pane_id"
+  _herdr workspace create --cwd "$1" --label "$2" --no-focus 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(d.slice(d.search(/[\[{]/))).result)||{};
+process.stdout.write((((r.workspace||{}).workspace_id)||"")+"\t"+(((r.root_pane||{}).pane_id)||""))}catch(e){}})'
+}
+_herdr_split() {   # $1=pane id ("" = UI-focused pane)  $2=right|down → new pane id
+  local a=(pane split); [ -n "$1" ] && a+=("$1"); a+=(--direction "$2" --no-focus)
+  _herdr "${a[@]}" 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(d.slice(d.search(/[\[{]/))).result)||{};
+process.stdout.write(((r.pane||{}).pane_id)||"")}catch(e){}})'
+}
+_herdr_ws_live() {   # workspace list → "ids<TABnewline>names" (names \x01-wrapped+joined, like cmux)
+  _herdr workspace list 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));
+const a=Array.isArray(o)?o:(o.workspaces||((o.result||{}).workspaces)||[]);
+console.log(a.map(x=>x.workspace_id||x.id||"").filter(Boolean).join(" "));
+console.log("\u0001"+a.map(x=>x.label||x.name||x.custom_title||"").filter(Boolean).join("\u0001")+"\u0001")}catch(e){}})'
+}
+# Teardown works regardless of CREW_MUX: you must never need to remember the flag to tear a crew down.
+_herdr_close_ws()   { [ "$DRY" = "1" ] && { echo "[dry] herdr workspace close $1"; return 0; }; _herdr workspace close "$1" >/dev/null 2>&1; }
+_herdr_close_pane() { [ "$DRY" = "1" ] && { echo "[dry] herdr pane close $1";    return 0; }; _herdr pane close    "$1" >/dev/null 2>&1; }
+
+# ── herdr spawn: ONE workspace `trantor:$PROJ`, one named pane per seat ─────────────────────────────
+# Topology = workspace create (its root pane runs seat 1) + pane split for the rest, same ceil(√N) grid
+# doctrine as cmux; pane rename labels each seat; pane run submits the seat command (bracketed-paste
+# safe, sends Enter). Same replace-never-stack doctrine: REUSE the newest tracked workspace for this
+# project, close older stacked ones, adopt one untracked live trantor:$PROJ workspace.
+spawn_herdr() {   # $@ = specs
+  local REUSE_WS="" line w
+  local stale_ws=()
+  if [ -f "$STATE" ]; then
+    while IFS= read -r line; do
+      [ -n "$line" ] || continue
+      _parse_row "$line"
+      { [ "$RP" = "$PROJ" ] && [ "$RK" = "herdrws" ]; } || continue
+      [ -n "$REUSE_WS" ] && stale_ws+=("$REUSE_WS")
+      REUSE_WS="$RH"
+    done < "$STATE"
+  fi
+  if [ "${#stale_ws[@]}" -gt 0 ]; then
+    for w in "${stale_ws[@]}"; do
+      echo "  → closing stale stacked crew workspace for $PROJ ($w)"
+      _herdr_close_ws "$w"; _state_drop "$PROJ" "herdrws" "" "$w"
+    done
+    prune_dead_state    # the closed workspaces' seat rows just died with them
+  fi
+  # Untracked strays: LIVE workspaces labeled trantor:$proj that STATE doesn't know. Adopt one as the
+  # reuse target if we have none; close the rest. (Skipped in DRY: read-only drills seed STATE instead.)
+  if [ "$DRY" != "1" ]; then
+    local named nid
+    named="$(_herdr workspace list 2>/dev/null | WSNAME="trantor:$PROJ" node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=Array.isArray(o)?o:(o.workspaces||((o.result||{}).workspaces)||[]);console.log(a.filter(x=>x.label===process.env.WSNAME||x.name===process.env.WSNAME||x.custom_title===process.env.WSNAME).map(x=>x.workspace_id||x.id||"").filter(Boolean).join(" "))}catch(e){}})')"
+    for nid in $named; do
+      [ "$nid" = "$REUSE_WS" ] && continue
+      [ -f "$STATE" ] && grep -qF "$nid" "$STATE" && continue     # tracked → handled above
+      if [ -z "$REUSE_WS" ]; then
+        echo "  → adopting existing untracked crew workspace for $PROJ ($nid)"
+        REUSE_WS="$nid"; record_state "$PROJ" "herdrws" "__ws__" "$nid"
+      else
+        echo "  → closing stray crew workspace for $PROJ ($nid)"
+        _herdr_close_ws "$nid"
+      fi
+    done
+  fi
+  # Grid tiling (identical math to cmux): row 0 splits RIGHT off the previous column, later rows split
+  # DOWN from the pane directly above. In REUSE mode a replaced seat splits off its OWN old pane —
+  # keeping its spot — and added seats split right off the previous new pane.
+  local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
+  local SPEC wsid="" surf i=0
+  local surfs=()
+  [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
+  for SPEC in "$@"; do
+    resolve_spec "$SPEC"
+    local cmd; cmd="$(RUN_CMD)"
+    if [ -n "$REUSE_WS" ]; then
+      # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
+      # then close the old pane — split-first so the workspace never dips to zero panes mid-swap.
+      local OLD_SURF=""
+      if [ -f "$STATE" ]; then
+        while IFS= read -r line; do
+          [ -n "$line" ] || continue
+          _parse_row "$line"
+          [ "$RP" = "$PROJ" ] && [ "$RK" = "herdr" ] && [ "$RA" = "$AGENT" ] && OLD_SURF="$RH"
+        done < "$STATE"
+      fi
+      local t=""
+      [ -n "$OLD_SURF" ] && t="$OLD_SURF"
+      { [ -z "$t" ] && [ "$i" -gt 0 ]; } && t="${surfs[$(( i - 1 ))]}"
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: reuse workspace $wsid — pane split for $AGENT${OLD_SURF:+ (replacing $OLD_SURF)}"
+        surf="%DRYT$i"
+        [ -n "$OLD_SURF" ] && _herdr_close_pane "$OLD_SURF"
+      else
+        surf="$(_herdr_split "$t" right)"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+        if [ -n "$OLD_SURF" ]; then _herdr_close_pane "$OLD_SURF"; _state_drop "$PROJ" "herdr" "$AGENT" ""; fi
+      fi
+    elif [ "$i" = "0" ]; then
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: workspace create (cwd $DIR) --label 'trantor:$PROJ' → root pane + run '$cmd'"
+        wsid="%DRYWS"; surf="%DRYT0"
+      else
+        local pair; pair="$(_herdr_ws_create "$DIR" "trantor:$PROJ")"
+        wsid="${pair%%$'\t'*}"; surf="${pair##*$'\t'}"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+      fi
+      record_state "$PROJ" "herdrws" "__ws__" "$wsid"
+    else
+      local dir target
+      if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${surfs[$(( i - 1 ))]}"
+      else dir="down"; target="${surfs[$(( i - COLS ))]}"; fi
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: pane split ${target:-<focused>} --direction $dir + run '$cmd'"
+        surf="%DRYT$i"
+      else
+        surf="$(_herdr_split "$target" "$dir")"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+      fi
+    fi
+    surfs+=("$surf")
+    record_state "$PROJ" "herdr" "$AGENT" "$surf"
+    echo "  → $AGENT seat in herdr workspace ($PROJ)"
+    i=$(( i + 1 ))
+  done
+  echo "— crew grouped in herdr: ONE workspace for $PROJ, seats as named panes in its server. Teardown (this project only): trantor down —"
+}
+
 # surgical STATE row removal: drop every row matching PROJECT+KIND (+AGENT/+HANDLE when given).
 # Empty $3/$4 = wildcard. Callers beware: uses _parse_row, which clobbers the RP/RK/RA/RH globals.
 _state_drop() {   # $1=project $2=kind $3=agent(''=any) $4=handle(''=any)
@@ -202,7 +341,7 @@ down() {
       [ "$match" = "1" ] || continue
     fi
     scoped+=("$RP|$RK|$RA|$RH")
-    case "$RK" in attach|cmuxws) continue ;; esac       # infra rows (attach window / cmux workspace) — not seats
+    case "$RK" in attach|cmuxws|herdrws) continue ;; esac       # infra rows (attach/cmux/herdr workspace) — not seats
     killlist="$killlist  • ${RP:-<legacy>} · $RA ($RK)"$'\n'
   done < "$STATE"
 
@@ -220,6 +359,8 @@ down() {
     case "$K2" in
       cmuxws) [ "${#AGENTS[@]}" -gt 0 ] || _cmux_close_tab "$H2" ;;   # whole workspace (no specific seats)
       cmux)   [ "${#AGENTS[@]}" -gt 0 ] && _cmux_close_term "$H2" ;;  # a single seat's pane
+      herdrws) [ "${#AGENTS[@]}" -gt 0 ] || _herdr_close_ws "$H2" ;;  # whole workspace (no specific seats)
+      herdr)   [ "${#AGENTS[@]}" -gt 0 ] && _herdr_close_pane "$H2" ;;# a single seat's pane
       tmux)
         if [ "${#AGENTS[@]}" -gt 0 ]; then run "tmux kill-pane -t '$H2' 2>/dev/null"      # per-seat
         else
@@ -228,7 +369,7 @@ down() {
         fi ;;
       win|attach) { [ "${#AGENTS[@]}" -gt 0 ] && [ "$K2" = "attach" ]; } && continue; _kill_win "$H2" ;;
     esac
-    case "$K2" in cmuxws|attach) : ;; *) _kill_seat_procs "$P2" "$A2" ;; esac
+    case "$K2" in cmuxws|attach|herdrws) : ;; *) _kill_seat_procs "$P2" "$A2" ;; esac
   done
 
   # rewrite STATE minus the rows we tore down (leaves OTHER projects' rows intact)
@@ -268,6 +409,15 @@ prune_dead_state() {
     CLIVE="$(printf '%s' "$pair" | sed -n 1p)"
     CLIVE_NAMES="$(printf '%s' "$pair" | sed -n 2p)"
   fi
+  # herdr liveness is queried ONLY under the explicit opt-in (CREW_MUX=herdr): a default run never
+  # invokes herdr at all. Same keep-when-unprovable doctrine as cmux — no answer ⇒ rows are KEPT.
+  local HLIVE="" HLIVE_NAMES=""
+  if [ "$HAVE_HERDR" = "1" ]; then
+    local hpair
+    hpair="$(_herdr_ws_live)"
+    HLIVE="$(printf '%s' "$hpair" | sed -n 1p)"
+    HLIVE_NAMES="$(printf '%s' "$hpair" | sed -n 2p)"
+  fi
   local tmp="$STATE.tmp" line alive
   : > "$tmp"
   while IFS= read -r line; do
@@ -283,6 +433,12 @@ prune_dead_state() {
     elif [ "$RK" = "cmux" ]; then
       # seat row lives exactly as long as its project still has a live crew workspace
       if [ -n "$CLIVE" ]; then case "$CLIVE_NAMES" in *$'\x01'"trantor:$RP"$'\x01'*) : ;; *) alive=0 ;; esac; fi
+    elif [ "$RK" = "herdrws" ]; then
+      if [ -n "$HLIVE" ]; then case " $HLIVE " in *" $RH "*) : ;; *) alive=0 ;; esac; fi
+    elif [ "$RK" = "herdr" ]; then
+      # seat row lives exactly as long as its project still has a live crew workspace — validated at
+      # WORKSPACE granularity, never per pane (the cmux 0.17.61 lesson generalized)
+      if [ -n "$HLIVE" ]; then case "$HLIVE_NAMES" in *$'\x01'"trantor:$RP"$'\x01'*) : ;; *) alive=0 ;; esac; fi
     fi
     [ "$alive" = "1" ] && printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
   done < "$STATE"
@@ -690,8 +846,9 @@ OSA
   echo "— crew grouped in cmux (AppleScript): ONE workspace tab for $PROJ, seats tiled. Teardown: trantor down —"
 }
 
-spawn_crew() {   # dispatch: cmux (preferred) → tmux → Terminal grid
-  if [ "$HAVE_CMUX" = "1" ]; then spawn_cmux "$@"
+spawn_crew() {   # dispatch: herdr (explicit opt-in) → cmux → tmux → Terminal grid
+  if [ "$HAVE_HERDR" = "1" ]; then spawn_herdr "$@"
+  elif [ "$HAVE_CMUX" = "1" ]; then spawn_cmux "$@"
   elif [ "$HAVE_TMUX" = "1" ]; then spawn_tmux "$@"
   else
     echo "— no cmux/tmux → per-agent Terminal windows. For ONE grouped, named window per crew (and"
@@ -729,7 +886,7 @@ fi
 
 spec_for_agent() { local want="$1"; shift; local s; for s in "$@"; do [ "${s%%:*}" = "$want" ] && { printf '%s' "$s"; return; }; done; printf '%s' "$want"; }
 
-CREW_UI="Terminal windows"; [ "$HAVE_TMUX" = "1" ] && CREW_UI="tmux"; [ "$HAVE_CMUX" = "1" ] && CREW_UI="cmux"
+CREW_UI="Terminal windows"; [ "$HAVE_TMUX" = "1" ] && CREW_UI="tmux"; [ "$HAVE_CMUX" = "1" ] && CREW_UI="cmux"; [ "$HAVE_HERDR" = "1" ] && CREW_UI="herdr"
 echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
 spawn_crew "$@"

package/bin/duty.mjs

@@ -116,6 +116,47 @@ function alivePid() {
   return 0;
 }
 
+// The cmux workspace this seat owns. One name, so `up` can find and replace its predecessor and
+// `down` can take the surface away with the process.
+const CMUX_WS_NAME = "trantor-duty";
+
+// Surface override, same variable and same values bin/crew.sh already uses for crew seats:
+//   CREW_MUX=terminal  force a Terminal window (what the window-content drills assert on)
+//   CREW_MUX=cmux      require cmux
+//   unset / anything else = auto: cmux when it answers, Terminal otherwise.
+const SURFACE = String(process.env.CREW_MUX || "auto").toLowerCase();
+
+function cmuxBinary() {
+  if (SURFACE === "terminal") return "";
+  for (const c of ["cmux", "/Applications/cmux.app/Contents/Resources/bin/cmux"]) {
+    try { execSync(`${c} ping`, { stdio: "ignore", timeout: 3000 }); return c; } catch {}
+  }
+  return "";
+}
+
+/** Close every workspace this seat owns. No-op when cmux is absent or its socket is off. */
+function closeDutyWorkspace() {
+  const bin = cmuxBinary();
+  if (!bin) return 0;
+  let closed = 0;
+  try {
+    const listed = JSON.parse(execSync(`${bin} workspace list --id-format both --json`,
+      { encoding: "utf8", timeout: 5000, env: { ...process.env, CMUX_QUIET: "1" } }));
+    for (const w of listed.workspaces || []) {
+      const title = w.custom_title || w.title || "";
+      // Title AND directory. Matching on title alone makes this global: a duty instance running
+      // with a temp HOME (which is exactly what test-duty-seat.mjs does) would close the REAL
+      // seat's workspace and take the production seat down with it. That happened once, on
+      // 2026-08-26, and the operator found their duty agent simply gone. Only ever close a
+      // workspace that belongs to THIS seat's bus directory.
+      if (title === CMUX_WS_NAME && w.id && w.current_directory === DIR) {
+        try { execSync(`${bin} close-workspace --workspace ${w.id}`, { stdio: "ignore", timeout: 5000 }); closed++; } catch {}
+      }
+    }
+  } catch {}
+  return closed;
+}
+
 if (cmd === "up") {
   const hub = fleetHub();
   mkdirSync(DIR, { recursive: true });
@@ -144,9 +185,35 @@ if (cmd === "up") {
     const exports = Object.entries(env).map(([k, v]) =>
       `export ${k}=$(cat <<'TRANTOR_${k}_EOF'\n${v}\nTRANTOR_${k}_EOF\n)`).join("\n");
     writeFileSync(launcher, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
-    const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
-    try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
-    catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    // PREFER CMUX. Terminal.app was the only surface here, and a plain window is stacking by
+    // construction: every `duty up` opens another one and nothing closes the last, so restarts
+    // accumulate windows that all look like live duty agents. cmux gives the seat ONE named
+    // workspace that gets REPLACED on each up — the same "replace, never stack" rule bin/crew.sh
+    // already applies to crew seats, which is why they never pile up and this did.
+    //
+    // Terminal remains the fallback: no cmux, or its control socket off, and nothing changes.
+    const cmuxBin = cmuxBinary();
+
+    let openedInCmux = false;
+    if (cmuxBin) {
+      try {
+        // Replace, never stack: take the previous duty workspace away before opening this one.
+        // Closing first is safe here (unlike a crew pane swap) — the seat is a single surface with
+        // nothing to preserve.
+        closeDutyWorkspace();
+        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${launcher}`)} --focus false`,
+          { stdio: "ignore", timeout: 8000, env: { ...process.env, CMUX_QUIET: "1" } });
+        openedInCmux = true;
+      } catch (e) {
+        console.error(`cmux launch failed (${e?.message || e}) — falling back to a Terminal window`);
+      }
+    }
+
+    if (!openedInCmux) {
+      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
+      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
+      catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    }
     // The runner lives inside Terminal, so its pid is not ours to know: find it the same way `down`
     // does. Poll briefly, since Terminal takes a moment to start the shell.
     for (let i = 0; i < 25 && !pid; i++) {
@@ -163,7 +230,7 @@ if (cmd === "up") {
     pid = child.pid;
   }
   writeFileSync(PIDF, String(pid));
-  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a Terminal window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
+  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
   const fed = await registerDutySeat(hub, SESSION);
   if (fed) console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings.`);
   process.exit(0);   // the seat IS up; a hub that won't feed it is a warning, not a failed start
@@ -174,6 +241,10 @@ if (cmd === "down") {
   if (pid) { try { process.kill(pid); } catch {} console.log(`— duty seat stopped (pid ${pid}) —`); }
   else console.log("no duty seat running");
   try { execSync(`pkill -f "crew-runner.mjs ${AGENT} ${DIR}"`, { stdio: "ignore" }); } catch {}
+  // Close the seat's cmux workspace too. Killing the process leaves the surface behind, and a dead
+  // pane titled trantor-duty is indistinguishable from a live one at a glance — which is the exact
+  // confusion this whole change is about.
+  closeDutyWorkspace();
   try { rmSync(PIDF, { force: true }); } catch {}
   // Clear the hub's pointer too — escalations aimed at a seat that no longer exists are messages
   // sent into a hole, and the hub has no other way to learn the seat went away.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.6",
+  "version": "0.18.8",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [