trantor 0.18.60 → 0.18.62

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.60",
+  "version": "0.18.62",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -150,8 +150,13 @@ the brain
 Fix the `→` lines (each CLI's own sign-in happens once, in that CLI) and re-run `trantor doctor`
 until it's clean.
 
-Provider API keys (e.g. `DEEPSEEK_API_KEY`) live in one file: **`~/.agent-bus/.env`** — the
-crew runners source it automatically, and it wins over anything Scrooge has.
+Provider API keys (e.g. `DEEPSEEK_API_KEY`) start in one file, **`~/.agent-bus/.env`**, and on
+macOS they belong in the keychain: `trantor secrets migrate` moves every key there and leaves a
+`# NAME -> keychain` stub in its place, `trantor secrets list` shows which layer holds each key
+(never a value), and `printf '%s' "$KEY" | trantor secrets set NAME` adds one. The crew runner
+reads the store at every turn and hands the keys to the seat in its environment, so nothing is
+copied to disk; a key still in `.env` keeps working as the fallback, and `trantor doctor` names it.
+The store wins over `.env`, which wins over anything Scrooge has.
 
 That precedence is the point. Scrooge (the cheap-model router) keeps its own keys in
 `~/.token-scrooge/.env`, and if the crew has no key of its own it falls through to Scrooge's. That
@@ -304,7 +309,10 @@ STALE with an "aged out" note instead of rotting silently, and todo tiles wear a
 day 7. A commit closes the session's focus card and the two link both ways. `trantor doctor`
 cross-checks every hub you know about against the per-project pins and reports any **split-brain**
 (a project live on two hubs) with the exact fix — and `trantor adopt <project>` migrates a project
-between hubs in one verified step, telling stale sessions to restart.
+between hubs in one verified step, telling stale sessions to restart. A project's identity lives
+in its checkout (`.trantor/project.json`, written by `trantor new`, `trantor connect` or
+`trantor project <id>`), so renaming the directory keeps the board, the pin and the sessions; the
+doctor names an orphaned identity and the one command that reclaims it.
 
 Crew output is gated mechanically, too: `bin/slop-gate.mjs` runs the vendored
 [anti-slop](https://github.com/dmmulroy/anti-slop) Oxlint rules over an agent's **changed files
@@ -397,7 +405,7 @@ rate, not work rate.
 | `relay_task_add(title, …, difficulty, model, deps, note?, project?)` | Cards with difficulty/model badges + DAG edges; `note` seeds the card's **permanent log**; `project` targets another board when you orchestrate from elsewhere |
 | `relay_task_move(id, status, note?)` | `todo → doing → testing → done` (the gate), `failed`, `blocked` — moves to testing/done should carry a `note`: what you did + the evidence, stored on the card forever |
 | `relay_task_check(id, index, done?)` | Tick one acceptance item on a card's checklist (seeded via `relay_task_add`'s `checklist`) — checked/total is the card's one honest progress denominator |
-| `relay_board` | The project's full board, as text |
+| `relay_board` | The project's full board, as text — or `card:<id>` for one card, or `mine: true` for the calling session's own open cards (doing/testing/todo, newest first) |
 | `relay_scrooge(prompt, task?, difficulty?)` | Fractal cheap-model delegation, with the ledger receipt |
 | `relay_lesson(text, scope?)` | Record a failure lesson — auto-injected into all future crews |
 | `relay_handoff(summary)` | Full-window session succession |

package/bin/adopt.mjs

@@ -13,9 +13,9 @@
 // newest, rather than asserting which one is yours.
 import { readdirSync, statSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { join, dirname } from "node:path";
+import { join, dirname, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject, writeOrchSession } from "../lib/project.mjs";
+import { resolveProject, writeOrchSession, checkoutFor, devRootFor, readOrchSession } from "../lib/project.mjs";
 
 const D = "\x1b[2m", B = "\x1b[1m", Y = "\x1b[33m", G = "\x1b[32m", R = "\x1b[0m";
 const args = process.argv.slice(2);
@@ -23,29 +23,44 @@ const flag = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : n
 
 const project = args.find(a => !a.startsWith("--") && args[args.indexOf(a) - 1] !== "--session")
   || resolveProject(process.cwd());
-const devRoot = process.env.TRANTOR_DEV_ROOT || join(homedir(), "development");
-const dir = join(devRoot, project);
-if (!existsSync(dir)) {
-  console.error(`no local checkout for ${project} (looked in ${devRoot})`);
+// The checkout is found by the project's ID (#6724): a renamed directory still answers.
+const dir = checkoutFor(project);
+if (!dir) {
+  console.error(`no local checkout for ${project} (looked in ${devRootFor()})`);
   process.exit(1);
 }
 
 /** claude keeps a project's transcripts under a slug of its working directory. */
 const slug = dir.replace(/[/.]/g, "-");
-const tdir = join(homedir(), ".claude", "projects", slug);
-if (!existsSync(tdir)) {
+const projectsDir = join(homedir(), ".claude", "projects");
+const tdir = join(projectsDir, slug);
+// A session that was running when the directory was renamed keeps writing under the OLD path's
+// slug (#6724: "no transcript in the last hour" while the thread was 9 minutes fresh). The
+// recorded orchestrator sid names that transcript wherever its slug lives, so it stays a candidate.
+const recordedSid = readOrchSession(project);
+const recordedTranscript = (() => {
+  if (!recordedSid) return "";
+  try {
+    for (const d of readdirSync(projectsDir)) {
+      const t = join(projectsDir, d, `${recordedSid}.jsonl`);
+      if (existsSync(t)) return t;
+    }
+  } catch {}
+  return "";
+})();
+if (!existsSync(tdir) && !recordedTranscript) {
   console.error(`no claude sessions have ever run in ${dir}`);
   process.exit(1);
 }
 
 const RECENT_MS = 60 * 60 * 1000;
 const now = Date.now();
-const candidates = readdirSync(tdir)
-  .filter(f => f.endsWith(".jsonl"))
-  .map(f => {
-    const p = join(tdir, f);
+const transcripts = existsSync(tdir) ? readdirSync(tdir).filter(f => f.endsWith(".jsonl")).map(f => join(tdir, f)) : [];
+if (recordedTranscript && !transcripts.includes(recordedTranscript)) transcripts.push(recordedTranscript);
+const candidates = transcripts
+  .map(p => {
     const st = statSync(p);
-    return { id: f.replace(/\.jsonl$/, ""), mtime: st.mtimeMs, size: st.size };
+    return { id: basename(p, ".jsonl"), mtime: st.mtimeMs, size: st.size };
   })
   .filter(c => now - c.mtime < RECENT_MS)
   .sort((a, b) => b.mtime - a.mtime);

package/bin/advise.mjs

@@ -1,38 +1,25 @@
 #!/usr/bin/env node
-// The Advisor — the brain's front door. Given work packages, decide HOW to execute:
-// solo | scrooge | crew | hybrid — from task shape × plan economics × context horizon.
-//
+// The Advisor — the brain's front door: given work packages, decide HOW to execute (solo |
+// scrooge | crew | hybrid) from task difficulty × plan economics × context horizon.
 //   echo '{"task":"build X","packages":[{"title":"engine","difficulty":"hard"},…]}' | node bin/advise.mjs
-//   node bin/advise.mjs --demo            # canned example
-//
-// Reads (all read-only):
-//   ~/.agent-bus/profile.json             — the user's declared plans (bin/profile.mjs)
-//   ~/.token-scrooge/registry.json        — Scrooge's models {cost_in, cost_out, good_for}
-//   ~/.token-scrooge/capabilities.json    — per-model quality scores
-// Exposed to agents as the MCP tool `relay_advise`; the crew skill calls it at kickoff.
+// Reads profile.json and Scrooge's registry + capabilities (read-only); exposed as `relay_advise`.
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import { busDir, readConfig } from "../lib/project.mjs";
+import { busDir, readConfig, resolveProject } from "../lib/project.mjs";
+import { loadCatalog, lookup as catalogLookup, effortParams, UNCATALOGUED_STATUS } from "../lib/model-catalog.mjs";
+import { benchedAt, loadSeatRecord } from "../lib/seat-record.mjs";
+import { openStore } from "../lib/secrets.mjs";
 
 const H = homedir();
 const read = (p, fb) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return fb; } };
 
 // ---- crew roster: BUILT-IN seats + ANY opencode provider the user has brought (BYOM) ----
-// Each seat: the CLI binary that must exist (`cli`) · the `trantor up` LAUNCH spec · the bus
-// SESSION label (its identity on the board) · the profile PROVIDER key (tier/cost) · for
-// opencode-driven seats, the opencode PROVIDER id (`providerOc`) used to enumerate models + auth.
-//
-// GEMINI is deliberately absent: Google retired the free CLI seat (2026-06-18) → `gemini --yolo`
-// crashes exit 1. Its replacement is GLM via opencode.
-//
-// The opencode-driven seats are the BYOM substrate: opencode is a UNIVERSAL adapter, so any
-// provider the user configures in opencode (or declares in their profile) becomes a crew seat
-// with ZERO code change here — `buildRoster()` discovers them at runtime. The built-ins below are
-// just the curated defaults + the two opencode seats with non-obvious mappings (glm: profile key
-// `zai` ↔ opencode provider `zai-coding-plan`).
+// Each seat: the CLI binary (`cli`), the `trantor up` LAUNCH spec, the bus SESSION label, the
+// profile PROVIDER key and, for opencode seats, the opencode provider id (`providerOc`). Gemini is
+// absent (its free CLI seat was retired; GLM via opencode replaced it); buildRoster() finds the rest.
 export const BUILTIN_ROSTER = {
   codex:      { cli: "codex",    launch: "codex",                   session: "codex",      provider: "codex" },
   kimi:       { cli: "kimi",     launch: "kimi",                    session: "kimi",       provider: "kimi" },
@@ -45,11 +32,10 @@ export const BUILTIN_ROSTER = {
 const BUILTIN_OC = new Set(Object.values(BUILTIN_ROSTER).filter(s => s.providerOc).map(s => s.providerOc));
 const NEVER_DISCOVER = new Set(["claude", "codex", "kimi", "gemini", "zai", "opencode"]);
 
-// Discover opencode providers the user has configured — from opencode.json `provider` keys AND
-// from profile providers declared via `trantor provider add` — that aren't already built-in. Each
-// becomes an opencode-driven seat under its OWN bus label (distinct session, no collisions). THIS
-// is what lets a brought provider (Inception, a Japanese model, any opencode vendor) light up a
-// seat with no code edit. T2's capability ingestion then makes it route well by difficulty.
+// Discover opencode providers the user configured (opencode.json `provider` keys and profile
+// providers from `trantor provider add`) that aren't built in. Each becomes an opencode-driven
+// seat under its OWN bus label, so a brought provider lights up a seat with no code edit; T2's
+// capability ingestion then makes it route well by difficulty.
 export function discoverSeats(profile, ocConfig) {
   const out = {};
   const provKeys = new Set([...Object.keys(ocConfig?.provider || {}), ...Object.keys(profile?.providers || {})]);
@@ -81,7 +67,7 @@ export function loadWorld() {
   const opencodeKey = (prov) => !!ocConfig?.provider?.[prov]?.options?.apiKey;
   // a key the user already has for Scrooge counts too — the opencode runner sources these .env
   // files, so e.g. OPENROUTER_API_KEY in ~/.token-scrooge/.env lights up the seat with no extra setup.
-  const envHasKey = (k) => !!process.env[k] || [join(H, ".token-scrooge", ".env"), join(H, ".agent-bus", ".env")]
+  const envHasKey = (k) => !!process.env[k] || openStore().has(k) || [join(H, ".token-scrooge", ".env"), join(H, ".agent-bus", ".env")]
     .some(f => { try { return readFileSync(f, "utf8").includes(k); } catch { return false; } });
   // a seat is available only if its CLI exists AND (for opencode-driven seats) the provider is
   // actually set up — a present binary with a dead/missing seat must NOT be recommended.
@@ -119,7 +105,7 @@ const FORECAST = { easy: 0.3e6, medium: 1.5e6, hard: 6e6 };  // tokens
 const CREW_PREF = { hard: ["codex", "glm", "kimi", "deepseek", "openrouter"], medium: ["kimi", "glm", "codex", "deepseek", "openrouter"], easy: ["deepseek", "kimi", "glm", "codex", "openrouter"] };
 
 export function advise(input, world = loadWorld()) {
-  const { profile, registry, caps, agents, scrooge, roster = BUILTIN_ROSTER } = world;
+  const { profile, registry, caps, agents, scrooge, roster = BUILTIN_ROSTER, record } = world;
   // brought (discovered) opencode providers extend the preference list — appended LAST in every
   // tier (unknown strength a priori, like openrouter), so they fill once the curated seats are
   // taken, and are the only option for a user who brought nothing but a custom provider.
@@ -148,17 +134,39 @@ export function advise(input, world = loadWorld()) {
 
   // ---- routing per package ----
   const used = {};
+  // #7762: seats benched by the record ride along so the recommendation says WHO was benched,
+  // at which difficulty, and what their producing nothing already cost (tokens the crew burned).
+  const seatFeedback = [];
   const routing = pkgs.map(p => {
     if ((mode === "hybrid" || mode === "scrooge") && p.difficulty === "easy" && scrooge) {
       const m = scroogeModelFor(registry, caps, p.kind, p.difficulty);
       const tok = FORECAST.easy;
       const cost = m ? +(tok * 0.6 * m.cost_in / 1e6 + tok * 0.4 * m.cost_out / 1e6).toFixed(3) : null;
-      return { ...p, executor: "scrooge", model: m?.model, pool: "api", est_cost_usd: cost,
+      // #7777: scores pick WHICH model; the catalog says HOW to call it — attach the per-difficulty
+      // request parameters so the executor does not have to look them up again.
+      const catEntry = catalogLookup(m?.model);
+      const catParams = catEntry.found ? effortParams(m.model, p.difficulty, "openai-chat") : null;
+      const effort = catEntry.found
+        ? { found: true, difficulty: p.difficulty, api: "openai-chat", params: catParams || {} }
+        : { found: false, difficulty: p.difficulty, params: null, status: UNCATALOGUED_STATUS };
+      return { ...p, executor: "scrooge", model: m?.model, pool: "api", est_cost_usd: cost, effort,
         reason: `easy + stateless → cheapest capable model (${m?.model}); not worth a crew seat` };
     }
     if (p.owner === "self") return { ...p, executor: "orchestrator", pool: tierOf(profile, "claude"), reason: "architect-owned (foundation/integration doctrine) — the orchestrator keeps the shared contract in its own hands" };
     if (mode === "solo") return { ...p, executor: "orchestrator", pool: tierOf(profile, "claude"), reason: "small enough to do inline" };
-    const pref = [...CREW_PREF[p.difficulty], ...broughtPref].filter(a => agents.includes(a));
+    const prefAll = [...CREW_PREF[p.difficulty], ...broughtPref].filter(a => agents.includes(a));
+    // #7762 feedback loop: a seat whose last 3 cards AT THIS DIFFICULTY in THIS project were
+    // empty/bounced is benched at that difficulty — the redone work counts against it, so it
+    // stops being "the cheap option". A bench never empties the pool (better a struck seat
+    // than no seat), and the record is per project — never global.
+    const struck = prefAll.map(a => [a, benchedAt(record, a, p.difficulty)]).filter(([, b]) => b);
+    const eligible = prefAll.filter(a => !benchedAt(record, a, p.difficulty));
+    const pref = eligible.length ? eligible : prefAll;
+    for (const [s, b] of struck) {
+      const wasted = b.wastedTokens ? ` ≈${(b.wastedTokens / 1e6).toFixed(1)}M tok burned` : "";
+      seatFeedback.push({ seat: s, difficulty: p.difficulty, streak: b.streak, cardIds: b.cardIds, wastedTokens: b.wastedTokens,
+        note: `${s} benched at ${p.difficulty}: last ${b.streak.length} cards ${b.streak.join("/")} (#${b.cardIds.join(" #")})${wasted}` });
+    }
     const agent = pref.sort((a, b) => (used[a] || 0) - (used[b] || 0))[0] || agents[0] || "deepseek";
     used[agent] = (used[agent] || 0) + 1;
     const pool = tierOf(profile, roster[agent]?.provider || agent);
@@ -176,6 +184,7 @@ export function advise(input, world = loadWorld()) {
     // has scored it (AA scores + price proxy + per-difficulty cost weighting → hard escalates to a
     // strong model, easy stays cheap). If it hasn't been run, routing falls back to cost-only.
     if (agent === "openrouter" && p.difficulty === "hard") why_r += ` — OpenRouter ranks capability×cost; run \`scrooge-capabilities\` to keep the catalog scored (or pin openrouter:openrouter/<vendor>/<model>)`;
+    if (struck.length && !struck.some(([s]) => s === agent)) why_r += ` — ${struck.map(([s]) => s).join("/")} benched at ${p.difficulty} here (last 3 cards empty/bounced; seat_feedback)`;
     return { ...p, executor: agent, pool, est_cost_usd: est, reason: why_r };
   });
   // crew-size rationale: seats are EMERGENT from the work, and we say so
@@ -188,11 +197,14 @@ export function advise(input, world = loadWorld()) {
 
   const apiCost = +(routing.reduce((s, r) => s + (r.est_cost_usd || 0), 0)).toFixed(2);
   const pools = [...new Set(routing.map(r => `${r.executor}:${r.pool}`))];
+  // One bench line per seat+difficulty, however many packages tripped it.
+  const feedback = [...new Map(seatFeedback.map(f => [`${f.seat}@${f.difficulty}`, f])).values()];
   const summary =
     `Recommendation: ${mode.toUpperCase()}. ${why.join("; ")}. ` +
     (mode === "crew" || mode === "hybrid"
       ? `Routing: ${routing.map(r => `${r.title}→${r.executor}${r.model ? `(${r.model})` : ""}`).join(", ")}. ` +
-        `Estimated real-money cost ≈ $${apiCost} (everything on a subscription pool is $0 marginal — quota pooling across ${pools.length} pools).`
+        `Estimated real-money cost ≈ $${apiCost} (everything on a subscription pool is $0 marginal — quota pooling across ${pools.length} pools).` +
+        (feedback.length ? ` Seat record (this project): ${feedback.map(f => f.note).join("; ")}.` : "")
       : "");
   const table = ["| package | diff | executor (model) | pool | est $ | reason |", "|---|---|---|---|---|---|",
     ...routing.map(r => `| ${r.title} | ${r.difficulty} | ${r.executor}${r.model ? ` (${r.model})` : ""} | ${r.pool} | ${r.est_cost_usd ?? "—"} | ${r.reason} |`)].join("\n");
@@ -221,7 +233,12 @@ export function advise(input, world = loadWorld()) {
       ? routing.map((x, j) => j + 1).filter(j => j !== i + 1)
       : (r.executor !== "orchestrator" ? foundationIdx.filter(f => f !== i + 1) : []) };
   });
-  return { mode, why, crew, routing, routing_table_md: table, card_args: cards, est_api_cost_usd: apiCost, quota_pools: pools, summary, orchestrator_tier: orchTier, agents_available: agents };
+  // #7777: crew-bound packages get their catalog effort attached at SPAWN, when the live model is
+  // known (bin/crew/models.mjs resolveSpec → CREW_EFFORT); the advisor only records that it is deferred.
+  const catalogMeta = (() => { const c = loadCatalog(); return { version: c.version, models: Object.keys(c.models).length, source: "configs/model-catalog.json" }; })();
+  const recommendation = { mode, why, crew, routing, routing_table_md: table, card_args: cards, est_api_cost_usd: apiCost, quota_pools: pools, summary, orchestrator_tier: orchTier, agents_available: agents, catalog: catalogMeta };
+  if (feedback.length) recommendation.seat_feedback = feedback;
+  return recommendation;
 }
 
 // ---- CLI ----
@@ -238,6 +255,10 @@ if (import.meta.url === pathToFileURL(process.argv[1]).href) {
     const stdin = readFileSync(0, "utf8").trim();
     input = stdin ? JSON.parse(stdin) : { packages: [] };
   }
-  const out = advise(input);
+  const world = loadWorld();
+  // #7762: fold this project's seat record into the routing (fail-open — no hub, no record,
+  // and the advice is exactly what it was before the feedback loop existed).
+  try { world.record = await loadSeatRecord({ project: resolveProject(process.cwd()) }); } catch {}
+  const out = advise(input, world);
   console.log(JSON.stringify(out, null, 2));
 }

package/bin/app.mjs

@@ -1,24 +1,18 @@
 #!/usr/bin/env node
-// trantor app — install/update the Trantor DESKTOP APP (Tauri) from GitHub Releases.
-//
-// The npm package deliberately does NOT ship desktop/ (a 6MB DMG has no business in node_modules);
-// the app travels as a GitHub Release asset instead. This command is the whole distribution story
-// for a teammate: `npm i -g trantor && trantor app install` → latest DMG lands in /Applications.
-//
-//   trantor app            status: installed version vs latest release
-//   trantor app install    download the latest release DMG and install to /Applications
-//   trantor app update     same as install (re-pulls whatever is latest)
-//
+// trantor app — install/update the Trantor DESKTOP APP (Tauri) from GitHub Releases. The npm
+// package does not ship desktop/ (a 6MB DMG has no business in node_modules); the app travels as
+// a GitHub Release asset, so `npm i -g trantor && trantor app install` is the whole story.
+
 // Release side (maintainer): build the DMG (cd desktop && npm run tauri build), then
 //   gh release create app-v<ver> desktop/src-tauri/target/release/bundle/dmg/Trantor_<ver>_aarch64.dmg
-// Any release whose assets include a Trantor_*.dmg is an app release; the newest one wins, so app
-// releases interleave freely with code (npm) releases.
-import { execFileSync } from "node:child_process";
+// Any release whose assets include a Trantor_*.dmg is an app release; the newest one wins.
+import { execFileSync, spawn } from "node:child_process";
 import { createWriteStream, existsSync, rmSync } from "node:fs";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { cleanLaunchEnv } from "../lib/launch-env.mjs";
 
 const REPO = "sashabogi/trantor";
 const APP = "/Applications/Trantor.app";
@@ -27,11 +21,39 @@ const cmd = process.argv[2] || "status";
 
 if (process.platform !== "darwin") { console.error("trantor app: the desktop app is macOS-only for now"); process.exit(1); }
 if (!["status", "install", "update"].includes(cmd)) {
-  console.error("usage: trantor app [status|install|update]"); process.exit(1);
+  console.error([
+    "usage: trantor app [status|install|update]",
+    "  status   installed version vs latest release (default)",
+    "  install  download the latest release DMG and install to /Applications",
+    "  update   same as install, then relaunch the app from a clean env",
+  ].join("\n"));
+  process.exit(1);
 }
 
 function sh(file, args) { return execFileSync(file, args, { encoding: "utf8" }); }
 
+function appRunning() {
+  try { return sh("/usr/bin/pgrep", ["-x", "Trantor"]).trim() !== ""; }
+  catch { return false; }
+}
+
+function pause(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
+
+// `open` hands the caller's environment to the app, so an update run from a badged crew pane would
+// badge every child the new app spawns and its hand-offs would reattach to the wrong project (#7414).
+function relaunch(wasRunning) {
+  if (wasRunning) {
+    try { sh("/usr/bin/osascript", ["-e", 'tell application "Trantor" to quit']); } catch {}
+    const deadline = Date.now() + 10000;
+    while (appRunning() && Date.now() < deadline) pause(200);
+    if (appRunning()) { try { sh("/usr/bin/pkill", ["-x", "Trantor"]); } catch {} pause(500); }
+  }
+  const child = spawn("/usr/bin/open", ["-a", APP], { env: cleanLaunchEnv(), stdio: "ignore", detached: true });
+  child.on("error", e => console.error(`relaunch failed: ${e.message}`));
+  child.unref();
+  console.log(`↻ ${wasRunning ? "quit the old app and " : ""}launched ${APP} from a clean env`);
+}
+
 function installedVersion() {
   try { return sh("plutil", ["-extract", "CFBundleShortVersionString", "raw", join(APP, "Contents/Info.plist")]).trim(); }
   catch { return ""; }
@@ -76,12 +98,14 @@ if (!dl.ok || !dl.body) { console.error(`download failed: HTTP ${dl.status}`); p
 await pipeline(Readable.fromWeb(dl.body), createWriteStream(dmg));
 
 let mount = "";
+let installed = false;
+const wasRunning = appRunning();
 try {
   // diskutil first: on macOS 26 the deprecated hdiutil shim IGNORES -nobrowse, so the mounted
-  // volume popped a Finder window mid-update and read as an install prompt (2026-08-27). Parse
+  // volume popped a Finder window mid-update and read as an install prompt. Parse
   // the mount point as everything after the last " at " — volume names can contain spaces.
   try {
-    // real output (verified 2026-08-27): tab-separated, same shape as hdiutil —
+    // real output (verified live): tab-separated, same shape as hdiutil —
     // "/dev/disk12s1\tApple_HFS            \t/Volumes/Trantor" — last tab field is the mount.
     const out = sh("diskutil", ["image", "attach", "--mountOptions", "nobrowse", "--readOnly", dmg]);
     const line = out.trim().split("\n").filter(l => l.includes("/Volumes/")).pop() || "";
@@ -100,6 +124,7 @@ try {
   // Gatekeeper doesn't refuse the unsigned build on first launch.
   try { sh("xattr", ["-dr", "com.apple.quarantine", APP]); } catch {}
   console.log(`✓ Trantor.app ${installedVersion() || rel.version} installed → ${APP}`);
+  installed = true;
 } catch (e) {
   console.error(`install failed: ${e.message}`); process.exitCode = 1;
 } finally {
@@ -109,3 +134,5 @@ try {
   }
   try { rmSync(dmg, { force: true }); } catch {}
 }
+// A replaced app keeps running its deleted binary until relaunched; `update` always relaunches.
+if (installed && (cmd === "update" || wasRunning)) relaunch(wasRunning);

package/bin/cli.mjs

@@ -23,6 +23,7 @@ switch (cmd) {
   case "connect": run("bin/connect.mjs"); break;
   case "profile": run("bin/profile.mjs"); break;
   case "provider": case "providers": run("bin/provider.mjs"); break;
+  case "secrets": run("bin/secrets.mjs"); break;
   case "models": run("bin/models.mjs"); break;
   case "advise":  run("bin/advise.mjs"); break;
   case "verify":  run("bin/crew-verify.mjs"); break;
@@ -71,6 +72,34 @@ switch (cmd) {
     }
     run("hub.mjs"); break;
   }
+  case "project": {
+    // The checkout's identity (#6724): show where this project's name comes from, or record an id
+    // in .trantor/project.json so a directory rename cannot orphan the pin, board and sessions.
+    const { resolveProjectInfo, resolveHubInfo, gitRoot, readProjectId, writeProjectId, isProjectId, PROJECT_MARKER } = await import(join(ROOT, "lib/project.mjs"));
+    const { basename } = await import("node:path");
+    const id = args.find(a => !a.startsWith("--"));
+    const root = gitRoot(process.cwd()) || process.cwd();
+    const label = basename(root);
+    if (!id) {
+      const { project, via } = resolveProjectInfo(process.cwd());
+      const hub = resolveHubInfo(project);
+      const marked = readProjectId(root);
+      console.log(`project:   ${project}  (via ${via})`);
+      console.log(`directory: ${label}${marked && marked !== label ? "  (a label — the id is recorded in the checkout)" : ""}`);
+      console.log(`marker:    ${marked ? `${PROJECT_MARKER} → ${marked}` : `none — trantor project ${project} records one, so a rename cannot orphan the identity`}`);
+      console.log(`hub:       ${hub.url}  (via ${hub.via})`);
+      break;
+    }
+    if (!isProjectId(id)) { console.error(`error: "${id}" is not a project id (letters, digits, . _ - ; 80 max)`); process.exit(1); }
+    const current = readProjectId(root);
+    if (current && current !== id && !args.includes("--force")) {
+      console.error(`refused: ${root} is recorded as "${current}" — pass --force to re-claim it as "${id}" (the old name's board, pin and session rows will NOT follow)`);
+      process.exit(1);
+    }
+    const p = writeProjectId(root, id, "trantor project");
+    console.log(`${id} recorded in ${p}${current === id ? " (unchanged)" : ""} — commit it so worktrees and clones carry the identity`);
+    break;
+  }
   case "watch":   run("bin/relay-watch.mjs"); break;
   case "catchup": run("bin/catchup.mjs"); break;
   case "agents":  run("bin/agents.mjs"); break;
@@ -99,6 +128,7 @@ switch (cmd) {
   case "state": run("bin/state.mjs"); break;
   case "seats": case "seat": run("bin/seats.mjs"); break;
   case "seat-why": case "why": run("bin/seat-why.mjs"); break;
+  case "seat-record": run("bin/seat-record.mjs"); break;
   case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
@@ -201,6 +231,7 @@ switch (cmd) {
   trantor connect     (re)wire every installed AI CLI to the bus
   trantor profile     declare your plans:  trantor profile set claude=max codex=plus deepseek=api
   trantor provider    bring ANY model (BYOM): list · status [--json] · verify <name> --key … · add <name> --key … · remove <name>
+  trantor secrets     provider keys in the OS keychain: list · set <NAME> (stdin) · remove <NAME> · migrate [--dry-run]
   trantor models      browse live models behind each seat + the router's pick per difficulty
   trantor up …        spawn a crew here:   trantor up codex kimi deepseek:deepseek glm:zai-coding-plan
   trantor open        host THIS session as the project's orchestrator pane (trantor down spares it)
@@ -226,11 +257,13 @@ switch (cmd) {
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)
   trantor advise      ask the Advisor directly (JSON on stdin; --demo to see it)
+  trantor project     this checkout's identity: project [<id>] — records .trantor/project.json so a directory rename cannot orphan the board, pin and sessions
   trantor hub         run the hub in the foreground (setup installs it as a service instead)
                       …or manage per-project hub pins: hub list · hub set <project> <url> · hub unset <project>
                       seats: which project lives in which directory — seats · seats add · seats up · seats login install
   trantor state       a seat's working memory: show <seat> <card> [--json] · validate · reset --force · gc [--apply]
   trantor seat-why    WHY a seat is down (err file, logs, pids): seat-why <agent> [--json] — quota, auth, crash, or just no pane
+  trantor seat-record the per-project seat record the advisor benches from (✓/∅/↩ per difficulty) — [--project p] [--reset <seat>] [--json]
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]
   trantor policy      the autonomy ladder: show | set <project> <1-4> | link <a> <b> --reason "<why>"

package/bin/connect.mjs

@@ -7,7 +7,7 @@ import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { resolveProject, resolveHubInfo } from "../lib/project.mjs";
+import { resolveProjectInfo, resolveHubInfo, gitRoot, writeProjectId, PROJECT_MARKER } from "../lib/project.mjs";
 
 const DRY = process.argv.includes("--dry-run");
 const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
@@ -15,7 +15,8 @@ const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
 // to and the hub THAT project resolves to. Some CLIs spawn MCP with a scrubbed env where even `git`
 // is missing, so the stamp is the belt; the worktree path rule in lib/project.mjs stays primary.
 // Env wins in resolveHubInfo, so these keys are REFRESHED on every connect run — re-run after a pin change.
-const PROJECT_AT_CONNECT = resolveProject(process.cwd());
+const PROJECT_INFO = resolveProjectInfo(process.cwd());
+const PROJECT_AT_CONNECT = PROJECT_INFO.project;
 const URL_ = resolveHubInfo(PROJECT_AT_CONNECT).url;
 // Graft (github.com/NanoNets/context-graph-engine): local Tree-sitter dependency graph over MCP,
 // wired next to `relay` so a seat locates code in one call; the graph refreshes itself per query
@@ -110,15 +111,28 @@ if (has("gemini")) {
   }), p);
 }
 
-// ---- Kimi CLI ----  (same refresh: the stale entry that caused #7893 was {RELAY_AGENT: kimi} only)
-if (has("kimi")) {
-  const p = join(homedir(), ".kimi", "mcp.json");
-  report("kimi", patchJson(p, d => {
-    d.mcpServers ||= {};
-    d.mcpServers.relay ||= { command: "node", args: [MCP], env: {} };
-    d.mcpServers.relay.env = { ...d.mcpServers.relay.env, ...relayEnv("kimi") };
-    if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
-  }), p);
+// ---- Kimi CLI + kimi-code ----  (same refresh: the stale entry that caused #7893 was {RELAY_AGENT: kimi} only)
+// kimi-code is a separate install reading ~/.kimi-code/mcp.json — wiring only the old file left the
+// running kimi seat on a hard-coded stale hub (#7938). Same shape and stamp; the dir is detected by
+// config.toml presence — existsSync only, the config itself is never read.
+const kimiRelay = (cli, p) => report(cli, patchJson(p, d => {
+  d.mcpServers ||= {};
+  d.mcpServers.relay ||= { command: "node", args: [MCP], env: {} };
+  d.mcpServers.relay.env = { ...d.mcpServers.relay.env, ...relayEnv("kimi") };
+  if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
+}), p);
+const kimiPaths = [join(homedir(), ".kimi", "mcp.json"), join(homedir(), ".kimi-code", "mcp.json")];
+const kimiWritten = new Set();
+if (has("kimi")) { kimiRelay("kimi", kimiPaths[0]); kimiWritten.add(kimiPaths[0]); }
+if (existsSync(join(homedir(), ".kimi-code", "config.toml"))) { kimiRelay("kimi-code", kimiPaths[1]); kimiWritten.add(kimiPaths[1]); }
+// A kimi-family config this run did NOT write still names a hub of its own; if it disagrees with
+// the pin, say so — one CLI of the pair would keep registering on a different bus (#7938).
+for (const p of kimiPaths) {
+  if (kimiWritten.has(p) || !existsSync(p)) continue;
+  try {
+    const u = JSON.parse(readFileSync(p, "utf8"))?.mcpServers?.relay?.env?.RELAY_URL;
+    if (u && u !== URL_) report("kimi", `WARN: ${p} still points at ${u} — re-run connect or refresh it by hand`);
+  } catch {}
 }
 
 // ---- OpenCode ----
@@ -247,6 +261,17 @@ ${HAS_GRAFT ? `    - id: trantor-graft
 }
 
 const found = out.length;
+// The checkout records its id at connect time (#6724) when the name came from the directory, so a
+// later rename carries the pin, board and sessions along. Never from RELAY_PROJECT or a seat
+// worktree path: a badge must not stamp its name into somebody else's repo.
+{
+  const root = gitRoot(process.cwd());
+  if (PROJECT_INFO.via === "marker") report("project", `id ${PROJECT_AT_CONNECT} already recorded in ${PROJECT_MARKER}`);
+  else if (root && PROJECT_INFO.via === "git") {
+    if (!DRY) writeProjectId(root, PROJECT_AT_CONNECT, "trantor connect");
+    report("project", `id ${PROJECT_AT_CONNECT} recorded in ${PROJECT_MARKER} — commit it so worktrees and clones carry the identity`, root);
+  }
+}
 console.log(`trantor connect${DRY ? " (dry run)" : ""} — project: ${PROJECT_AT_CONNECT}, hub: ${URL_}`);
 for (const r of out) console.log(`  ${r.cli.padEnd(9)} ${r.status}${r.detail ? `  (${r.detail})` : ""}`);
 if (!found) console.log("  no supported CLIs found on PATH (claude, codex, gemini, kimi, opencode, dsh)");

package/bin/crew/cmux.mjs

@@ -109,7 +109,7 @@ export function spawnCmux(ctx, specs, resolve, prune) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
     const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
     let pane = "";
     if (reuse) {
@@ -149,7 +149,7 @@ function spawnAppleScript(ctx, specs, resolve) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
     const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
     let pane;
     if (!tab && index === 0) {

package/bin/crew/core.mjs

@@ -141,12 +141,15 @@ export function gridColumns(size) {
 // file that was never written and a runner still on the transcript path.
 const FORWARDED_ENV = ["TRANTOR_STATE", "TRANTOR_STATE_ASSEMBLE", "TRANTOR_STATE_HANDOFF", "TRANTOR_STATE_GATE"];
 
-export function runnerCommand(ctx, agent, model = "") {
+export function runnerCommand(ctx, agent, model = "", effort = null) {
   const forwarded = FORWARDED_ENV
     .filter((name) => process.env[name])
     .map((name) => `${name}=${shellQuote(process.env[name])} `)
     .join("");
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
+  // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
+  const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -165,7 +165,7 @@ function replacementPane(ctx, workspace, spec, hostPane, resolve) {
     pane = `%DRYT${spec.index}`;
   } else {
     pane = splitPane(ctx, hostPane, "right", ctx.dir);
-    runSeat(ctx, pane, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    runSeat(ctx, pane, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
   }
   if (old) {
     closePane(ctx, old);
@@ -202,7 +202,7 @@ export function spawnHerdr(ctx, specs, resolve, prune) {
 function freshPane(ctx, workspace, spec, panes, columns, resolve) {
   const seat = resolve(spec.value);
   if (!seat) return null;
-  const command = runnerCommand(ctx, seat.agent, seat.model);
+  const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort);
   let pane = "";
   if (spec.index === 0) {
     if (ctx.dry) {