trantor 0.18.61 → 0.18.62

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.61",
+  "version": "0.18.62",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -150,8 +150,13 @@ the brain
 Fix the `→` lines (each CLI's own sign-in happens once, in that CLI) and re-run `trantor doctor`
 until it's clean.
 
-Provider API keys (e.g. `DEEPSEEK_API_KEY`) live in one file: **`~/.agent-bus/.env`** — the
-crew runners source it automatically, and it wins over anything Scrooge has.
+Provider API keys (e.g. `DEEPSEEK_API_KEY`) start in one file, **`~/.agent-bus/.env`**, and on
+macOS they belong in the keychain: `trantor secrets migrate` moves every key there and leaves a
+`# NAME -> keychain` stub in its place, `trantor secrets list` shows which layer holds each key
+(never a value), and `printf '%s' "$KEY" | trantor secrets set NAME` adds one. The crew runner
+reads the store at every turn and hands the keys to the seat in its environment, so nothing is
+copied to disk; a key still in `.env` keeps working as the fallback, and `trantor doctor` names it.
+The store wins over `.env`, which wins over anything Scrooge has.
 
 That precedence is the point. Scrooge (the cheap-model router) keeps its own keys in
 `~/.token-scrooge/.env`, and if the crew has no key of its own it falls through to Scrooge's. That
@@ -304,7 +309,10 @@ STALE with an "aged out" note instead of rotting silently, and todo tiles wear a
 day 7. A commit closes the session's focus card and the two link both ways. `trantor doctor`
 cross-checks every hub you know about against the per-project pins and reports any **split-brain**
 (a project live on two hubs) with the exact fix — and `trantor adopt <project>` migrates a project
-between hubs in one verified step, telling stale sessions to restart.
+between hubs in one verified step, telling stale sessions to restart. A project's identity lives
+in its checkout (`.trantor/project.json`, written by `trantor new`, `trantor connect` or
+`trantor project <id>`), so renaming the directory keeps the board, the pin and the sessions; the
+doctor names an orphaned identity and the one command that reclaims it.
 
 Crew output is gated mechanically, too: `bin/slop-gate.mjs` runs the vendored
 [anti-slop](https://github.com/dmmulroy/anti-slop) Oxlint rules over an agent's **changed files
@@ -397,7 +405,7 @@ rate, not work rate.
 | `relay_task_add(title, …, difficulty, model, deps, note?, project?)` | Cards with difficulty/model badges + DAG edges; `note` seeds the card's **permanent log**; `project` targets another board when you orchestrate from elsewhere |
 | `relay_task_move(id, status, note?)` | `todo → doing → testing → done` (the gate), `failed`, `blocked` — moves to testing/done should carry a `note`: what you did + the evidence, stored on the card forever |
 | `relay_task_check(id, index, done?)` | Tick one acceptance item on a card's checklist (seeded via `relay_task_add`'s `checklist`) — checked/total is the card's one honest progress denominator |
-| `relay_board` | The project's full board, as text |
+| `relay_board` | The project's full board, as text — or `card:<id>` for one card, or `mine: true` for the calling session's own open cards (doing/testing/todo, newest first) |
 | `relay_scrooge(prompt, task?, difficulty?)` | Fractal cheap-model delegation, with the ledger receipt |
 | `relay_lesson(text, scope?)` | Record a failure lesson — auto-injected into all future crews |
 | `relay_handoff(summary)` | Full-window session succession |

package/bin/adopt.mjs

@@ -13,9 +13,9 @@
 // newest, rather than asserting which one is yours.
 import { readdirSync, statSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { join, dirname } from "node:path";
+import { join, dirname, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject, writeOrchSession } from "../lib/project.mjs";
+import { resolveProject, writeOrchSession, checkoutFor, devRootFor, readOrchSession } from "../lib/project.mjs";
 
 const D = "\x1b[2m", B = "\x1b[1m", Y = "\x1b[33m", G = "\x1b[32m", R = "\x1b[0m";
 const args = process.argv.slice(2);
@@ -23,29 +23,44 @@ const flag = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : n
 
 const project = args.find(a => !a.startsWith("--") && args[args.indexOf(a) - 1] !== "--session")
   || resolveProject(process.cwd());
-const devRoot = process.env.TRANTOR_DEV_ROOT || join(homedir(), "development");
-const dir = join(devRoot, project);
-if (!existsSync(dir)) {
-  console.error(`no local checkout for ${project} (looked in ${devRoot})`);
+// The checkout is found by the project's ID (#6724): a renamed directory still answers.
+const dir = checkoutFor(project);
+if (!dir) {
+  console.error(`no local checkout for ${project} (looked in ${devRootFor()})`);
   process.exit(1);
 }
 
 /** claude keeps a project's transcripts under a slug of its working directory. */
 const slug = dir.replace(/[/.]/g, "-");
-const tdir = join(homedir(), ".claude", "projects", slug);
-if (!existsSync(tdir)) {
+const projectsDir = join(homedir(), ".claude", "projects");
+const tdir = join(projectsDir, slug);
+// A session that was running when the directory was renamed keeps writing under the OLD path's
+// slug (#6724: "no transcript in the last hour" while the thread was 9 minutes fresh). The
+// recorded orchestrator sid names that transcript wherever its slug lives, so it stays a candidate.
+const recordedSid = readOrchSession(project);
+const recordedTranscript = (() => {
+  if (!recordedSid) return "";
+  try {
+    for (const d of readdirSync(projectsDir)) {
+      const t = join(projectsDir, d, `${recordedSid}.jsonl`);
+      if (existsSync(t)) return t;
+    }
+  } catch {}
+  return "";
+})();
+if (!existsSync(tdir) && !recordedTranscript) {
   console.error(`no claude sessions have ever run in ${dir}`);
   process.exit(1);
 }
 
 const RECENT_MS = 60 * 60 * 1000;
 const now = Date.now();
-const candidates = readdirSync(tdir)
-  .filter(f => f.endsWith(".jsonl"))
-  .map(f => {
-    const p = join(tdir, f);
+const transcripts = existsSync(tdir) ? readdirSync(tdir).filter(f => f.endsWith(".jsonl")).map(f => join(tdir, f)) : [];
+if (recordedTranscript && !transcripts.includes(recordedTranscript)) transcripts.push(recordedTranscript);
+const candidates = transcripts
+  .map(p => {
     const st = statSync(p);
-    return { id: f.replace(/\.jsonl$/, ""), mtime: st.mtimeMs, size: st.size };
+    return { id: basename(p, ".jsonl"), mtime: st.mtimeMs, size: st.size };
   })
   .filter(c => now - c.mtime < RECENT_MS)
   .sort((a, b) => b.mtime - a.mtime);

package/bin/advise.mjs

@@ -1,15 +1,8 @@
 #!/usr/bin/env node
-// The Advisor — the brain's front door. Given work packages, decide HOW to execute:
-// solo | scrooge | crew | hybrid — from task shape × plan economics × context horizon.
-//
+// The Advisor — the brain's front door: given work packages, decide HOW to execute (solo |
+// scrooge | crew | hybrid) from task difficulty × plan economics × context horizon.
 //   echo '{"task":"build X","packages":[{"title":"engine","difficulty":"hard"},…]}' | node bin/advise.mjs
-//   node bin/advise.mjs --demo            # canned example
-//
-// Reads (all read-only):
-//   ~/.agent-bus/profile.json             — the user's declared plans (bin/profile.mjs)
-//   ~/.token-scrooge/registry.json        — Scrooge's models {cost_in, cost_out, good_for}
-//   ~/.token-scrooge/capabilities.json    — per-model quality scores
-// Exposed to agents as the MCP tool `relay_advise`; the crew skill calls it at kickoff.
+// Reads profile.json and Scrooge's registry + capabilities (read-only); exposed as `relay_advise`.
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -18,23 +11,15 @@ import { pathToFileURL } from "node:url";
 import { busDir, readConfig, resolveProject } from "../lib/project.mjs";
 import { loadCatalog, lookup as catalogLookup, effortParams, UNCATALOGUED_STATUS } from "../lib/model-catalog.mjs";
 import { benchedAt, loadSeatRecord } from "../lib/seat-record.mjs";
+import { openStore } from "../lib/secrets.mjs";
 
 const H = homedir();
 const read = (p, fb) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return fb; } };
 
 // ---- crew roster: BUILT-IN seats + ANY opencode provider the user has brought (BYOM) ----
-// Each seat: the CLI binary that must exist (`cli`) · the `trantor up` LAUNCH spec · the bus
-// SESSION label (its identity on the board) · the profile PROVIDER key (tier/cost) · for
-// opencode-driven seats, the opencode PROVIDER id (`providerOc`) used to enumerate models + auth.
-//
-// GEMINI is deliberately absent: Google retired the free CLI seat (2026-06-18) → `gemini --yolo`
-// crashes exit 1. Its replacement is GLM via opencode.
-//
-// The opencode-driven seats are the BYOM substrate: opencode is a UNIVERSAL adapter, so any
-// provider the user configures in opencode (or declares in their profile) becomes a crew seat
-// with ZERO code change here — `buildRoster()` discovers them at runtime. The built-ins below are
-// just the curated defaults + the two opencode seats with non-obvious mappings (glm: profile key
-// `zai` ↔ opencode provider `zai-coding-plan`).
+// Each seat: the CLI binary (`cli`), the `trantor up` LAUNCH spec, the bus SESSION label, the
+// profile PROVIDER key and, for opencode seats, the opencode provider id (`providerOc`). Gemini is
+// absent (its free CLI seat was retired; GLM via opencode replaced it); buildRoster() finds the rest.
 export const BUILTIN_ROSTER = {
   codex:      { cli: "codex",    launch: "codex",                   session: "codex",      provider: "codex" },
   kimi:       { cli: "kimi",     launch: "kimi",                    session: "kimi",       provider: "kimi" },
@@ -47,11 +32,10 @@ export const BUILTIN_ROSTER = {
 const BUILTIN_OC = new Set(Object.values(BUILTIN_ROSTER).filter(s => s.providerOc).map(s => s.providerOc));
 const NEVER_DISCOVER = new Set(["claude", "codex", "kimi", "gemini", "zai", "opencode"]);
 
-// Discover opencode providers the user has configured — from opencode.json `provider` keys AND
-// from profile providers declared via `trantor provider add` — that aren't already built-in. Each
-// becomes an opencode-driven seat under its OWN bus label (distinct session, no collisions). THIS
-// is what lets a brought provider (Inception, a Japanese model, any opencode vendor) light up a
-// seat with no code edit. T2's capability ingestion then makes it route well by difficulty.
+// Discover opencode providers the user configured (opencode.json `provider` keys and profile
+// providers from `trantor provider add`) that aren't built in. Each becomes an opencode-driven
+// seat under its OWN bus label, so a brought provider lights up a seat with no code edit; T2's
+// capability ingestion then makes it route well by difficulty.
 export function discoverSeats(profile, ocConfig) {
   const out = {};
   const provKeys = new Set([...Object.keys(ocConfig?.provider || {}), ...Object.keys(profile?.providers || {})]);
@@ -83,7 +67,7 @@ export function loadWorld() {
   const opencodeKey = (prov) => !!ocConfig?.provider?.[prov]?.options?.apiKey;
   // a key the user already has for Scrooge counts too — the opencode runner sources these .env
   // files, so e.g. OPENROUTER_API_KEY in ~/.token-scrooge/.env lights up the seat with no extra setup.
-  const envHasKey = (k) => !!process.env[k] || [join(H, ".token-scrooge", ".env"), join(H, ".agent-bus", ".env")]
+  const envHasKey = (k) => !!process.env[k] || openStore().has(k) || [join(H, ".token-scrooge", ".env"), join(H, ".agent-bus", ".env")]
     .some(f => { try { return readFileSync(f, "utf8").includes(k); } catch { return false; } });
   // a seat is available only if its CLI exists AND (for opencode-driven seats) the provider is
   // actually set up — a present binary with a dead/missing seat must NOT be recommended.

package/bin/app.mjs

@@ -1,24 +1,18 @@
 #!/usr/bin/env node
-// trantor app — install/update the Trantor DESKTOP APP (Tauri) from GitHub Releases.
-//
-// The npm package deliberately does NOT ship desktop/ (a 6MB DMG has no business in node_modules);
-// the app travels as a GitHub Release asset instead. This command is the whole distribution story
-// for a teammate: `npm i -g trantor && trantor app install` → latest DMG lands in /Applications.
-//
-//   trantor app            status: installed version vs latest release
-//   trantor app install    download the latest release DMG and install to /Applications
-//   trantor app update     same as install (re-pulls whatever is latest)
-//
+// trantor app — install/update the Trantor DESKTOP APP (Tauri) from GitHub Releases. The npm
+// package does not ship desktop/ (a 6MB DMG has no business in node_modules); the app travels as
+// a GitHub Release asset, so `npm i -g trantor && trantor app install` is the whole story.
+
 // Release side (maintainer): build the DMG (cd desktop && npm run tauri build), then
 //   gh release create app-v<ver> desktop/src-tauri/target/release/bundle/dmg/Trantor_<ver>_aarch64.dmg
-// Any release whose assets include a Trantor_*.dmg is an app release; the newest one wins, so app
-// releases interleave freely with code (npm) releases.
-import { execFileSync } from "node:child_process";
+// Any release whose assets include a Trantor_*.dmg is an app release; the newest one wins.
+import { execFileSync, spawn } from "node:child_process";
 import { createWriteStream, existsSync, rmSync } from "node:fs";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { cleanLaunchEnv } from "../lib/launch-env.mjs";
 
 const REPO = "sashabogi/trantor";
 const APP = "/Applications/Trantor.app";
@@ -27,11 +21,39 @@ const cmd = process.argv[2] || "status";
 
 if (process.platform !== "darwin") { console.error("trantor app: the desktop app is macOS-only for now"); process.exit(1); }
 if (!["status", "install", "update"].includes(cmd)) {
-  console.error("usage: trantor app [status|install|update]"); process.exit(1);
+  console.error([
+    "usage: trantor app [status|install|update]",
+    "  status   installed version vs latest release (default)",
+    "  install  download the latest release DMG and install to /Applications",
+    "  update   same as install, then relaunch the app from a clean env",
+  ].join("\n"));
+  process.exit(1);
 }
 
 function sh(file, args) { return execFileSync(file, args, { encoding: "utf8" }); }
 
+function appRunning() {
+  try { return sh("/usr/bin/pgrep", ["-x", "Trantor"]).trim() !== ""; }
+  catch { return false; }
+}
+
+function pause(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
+
+// `open` hands the caller's environment to the app, so an update run from a badged crew pane would
+// badge every child the new app spawns and its hand-offs would reattach to the wrong project (#7414).
+function relaunch(wasRunning) {
+  if (wasRunning) {
+    try { sh("/usr/bin/osascript", ["-e", 'tell application "Trantor" to quit']); } catch {}
+    const deadline = Date.now() + 10000;
+    while (appRunning() && Date.now() < deadline) pause(200);
+    if (appRunning()) { try { sh("/usr/bin/pkill", ["-x", "Trantor"]); } catch {} pause(500); }
+  }
+  const child = spawn("/usr/bin/open", ["-a", APP], { env: cleanLaunchEnv(), stdio: "ignore", detached: true });
+  child.on("error", e => console.error(`relaunch failed: ${e.message}`));
+  child.unref();
+  console.log(`↻ ${wasRunning ? "quit the old app and " : ""}launched ${APP} from a clean env`);
+}
+
 function installedVersion() {
   try { return sh("plutil", ["-extract", "CFBundleShortVersionString", "raw", join(APP, "Contents/Info.plist")]).trim(); }
   catch { return ""; }
@@ -76,12 +98,14 @@ if (!dl.ok || !dl.body) { console.error(`download failed: HTTP ${dl.status}`); p
 await pipeline(Readable.fromWeb(dl.body), createWriteStream(dmg));
 
 let mount = "";
+let installed = false;
+const wasRunning = appRunning();
 try {
   // diskutil first: on macOS 26 the deprecated hdiutil shim IGNORES -nobrowse, so the mounted
-  // volume popped a Finder window mid-update and read as an install prompt (2026-08-27). Parse
+  // volume popped a Finder window mid-update and read as an install prompt. Parse
   // the mount point as everything after the last " at " — volume names can contain spaces.
   try {
-    // real output (verified 2026-08-27): tab-separated, same shape as hdiutil —
+    // real output (verified live): tab-separated, same shape as hdiutil —
     // "/dev/disk12s1\tApple_HFS            \t/Volumes/Trantor" — last tab field is the mount.
     const out = sh("diskutil", ["image", "attach", "--mountOptions", "nobrowse", "--readOnly", dmg]);
     const line = out.trim().split("\n").filter(l => l.includes("/Volumes/")).pop() || "";
@@ -100,6 +124,7 @@ try {
   // Gatekeeper doesn't refuse the unsigned build on first launch.
   try { sh("xattr", ["-dr", "com.apple.quarantine", APP]); } catch {}
   console.log(`✓ Trantor.app ${installedVersion() || rel.version} installed → ${APP}`);
+  installed = true;
 } catch (e) {
   console.error(`install failed: ${e.message}`); process.exitCode = 1;
 } finally {
@@ -109,3 +134,5 @@ try {
   }
   try { rmSync(dmg, { force: true }); } catch {}
 }
+// A replaced app keeps running its deleted binary until relaunched; `update` always relaunches.
+if (installed && (cmd === "update" || wasRunning)) relaunch(wasRunning);

package/bin/cli.mjs

@@ -23,6 +23,7 @@ switch (cmd) {
   case "connect": run("bin/connect.mjs"); break;
   case "profile": run("bin/profile.mjs"); break;
   case "provider": case "providers": run("bin/provider.mjs"); break;
+  case "secrets": run("bin/secrets.mjs"); break;
   case "models": run("bin/models.mjs"); break;
   case "advise":  run("bin/advise.mjs"); break;
   case "verify":  run("bin/crew-verify.mjs"); break;
@@ -71,6 +72,34 @@ switch (cmd) {
     }
     run("hub.mjs"); break;
   }
+  case "project": {
+    // The checkout's identity (#6724): show where this project's name comes from, or record an id
+    // in .trantor/project.json so a directory rename cannot orphan the pin, board and sessions.
+    const { resolveProjectInfo, resolveHubInfo, gitRoot, readProjectId, writeProjectId, isProjectId, PROJECT_MARKER } = await import(join(ROOT, "lib/project.mjs"));
+    const { basename } = await import("node:path");
+    const id = args.find(a => !a.startsWith("--"));
+    const root = gitRoot(process.cwd()) || process.cwd();
+    const label = basename(root);
+    if (!id) {
+      const { project, via } = resolveProjectInfo(process.cwd());
+      const hub = resolveHubInfo(project);
+      const marked = readProjectId(root);
+      console.log(`project:   ${project}  (via ${via})`);
+      console.log(`directory: ${label}${marked && marked !== label ? "  (a label — the id is recorded in the checkout)" : ""}`);
+      console.log(`marker:    ${marked ? `${PROJECT_MARKER} → ${marked}` : `none — trantor project ${project} records one, so a rename cannot orphan the identity`}`);
+      console.log(`hub:       ${hub.url}  (via ${hub.via})`);
+      break;
+    }
+    if (!isProjectId(id)) { console.error(`error: "${id}" is not a project id (letters, digits, . _ - ; 80 max)`); process.exit(1); }
+    const current = readProjectId(root);
+    if (current && current !== id && !args.includes("--force")) {
+      console.error(`refused: ${root} is recorded as "${current}" — pass --force to re-claim it as "${id}" (the old name's board, pin and session rows will NOT follow)`);
+      process.exit(1);
+    }
+    const p = writeProjectId(root, id, "trantor project");
+    console.log(`${id} recorded in ${p}${current === id ? " (unchanged)" : ""} — commit it so worktrees and clones carry the identity`);
+    break;
+  }
   case "watch":   run("bin/relay-watch.mjs"); break;
   case "catchup": run("bin/catchup.mjs"); break;
   case "agents":  run("bin/agents.mjs"); break;
@@ -202,6 +231,7 @@ switch (cmd) {
   trantor connect     (re)wire every installed AI CLI to the bus
   trantor profile     declare your plans:  trantor profile set claude=max codex=plus deepseek=api
   trantor provider    bring ANY model (BYOM): list · status [--json] · verify <name> --key … · add <name> --key … · remove <name>
+  trantor secrets     provider keys in the OS keychain: list · set <NAME> (stdin) · remove <NAME> · migrate [--dry-run]
   trantor models      browse live models behind each seat + the router's pick per difficulty
   trantor up …        spawn a crew here:   trantor up codex kimi deepseek:deepseek glm:zai-coding-plan
   trantor open        host THIS session as the project's orchestrator pane (trantor down spares it)
@@ -227,6 +257,7 @@ switch (cmd) {
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)
   trantor advise      ask the Advisor directly (JSON on stdin; --demo to see it)
+  trantor project     this checkout's identity: project [<id>] — records .trantor/project.json so a directory rename cannot orphan the board, pin and sessions
   trantor hub         run the hub in the foreground (setup installs it as a service instead)
                       …or manage per-project hub pins: hub list · hub set <project> <url> · hub unset <project>
                       seats: which project lives in which directory — seats · seats add · seats up · seats login install

package/bin/connect.mjs

@@ -7,7 +7,7 @@ import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { resolveProject, resolveHubInfo } from "../lib/project.mjs";
+import { resolveProjectInfo, resolveHubInfo, gitRoot, writeProjectId, PROJECT_MARKER } from "../lib/project.mjs";
 
 const DRY = process.argv.includes("--dry-run");
 const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
@@ -15,7 +15,8 @@ const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
 // to and the hub THAT project resolves to. Some CLIs spawn MCP with a scrubbed env where even `git`
 // is missing, so the stamp is the belt; the worktree path rule in lib/project.mjs stays primary.
 // Env wins in resolveHubInfo, so these keys are REFRESHED on every connect run — re-run after a pin change.
-const PROJECT_AT_CONNECT = resolveProject(process.cwd());
+const PROJECT_INFO = resolveProjectInfo(process.cwd());
+const PROJECT_AT_CONNECT = PROJECT_INFO.project;
 const URL_ = resolveHubInfo(PROJECT_AT_CONNECT).url;
 // Graft (github.com/NanoNets/context-graph-engine): local Tree-sitter dependency graph over MCP,
 // wired next to `relay` so a seat locates code in one call; the graph refreshes itself per query
@@ -260,6 +261,17 @@ ${HAS_GRAFT ? `    - id: trantor-graft
 }
 
 const found = out.length;
+// The checkout records its id at connect time (#6724) when the name came from the directory, so a
+// later rename carries the pin, board and sessions along. Never from RELAY_PROJECT or a seat
+// worktree path: a badge must not stamp its name into somebody else's repo.
+{
+  const root = gitRoot(process.cwd());
+  if (PROJECT_INFO.via === "marker") report("project", `id ${PROJECT_AT_CONNECT} already recorded in ${PROJECT_MARKER}`);
+  else if (root && PROJECT_INFO.via === "git") {
+    if (!DRY) writeProjectId(root, PROJECT_AT_CONNECT, "trantor connect");
+    report("project", `id ${PROJECT_AT_CONNECT} recorded in ${PROJECT_MARKER} — commit it so worktrees and clones carry the identity`, root);
+  }
+}
 console.log(`trantor connect${DRY ? " (dry run)" : ""} — project: ${PROJECT_AT_CONNECT}, hub: ${URL_}`);
 for (const r of out) console.log(`  ${r.cli.padEnd(9)} ${r.status}${r.detail ? `  (${r.detail})` : ""}`);
 if (!found) console.log("  no supported CLIs found on PATH (claude, codex, gemini, kimi, opencode, dsh)");

package/bin/crew/worktrees.mjs

@@ -1,6 +1,7 @@
 import { basename, join } from "node:path";
 import { existsSync } from "node:fs";
 import { call } from "./core.mjs";
+import { checkoutFor, readProjectId } from "../../lib/project.mjs";
 
 function gitRoot(dir) {
   const result = call("git", ["-C", dir, "rev-parse", "--show-toplevel"]);
@@ -11,7 +12,8 @@ export function resolveOrchestratorDir(ctx, projectArg) {
   const target = projectArg || ctx.project;
   const badge = ctx.env.TRANTOR_ORCH || ctx.env.TRANTOR_SEAT || "";
   const root = gitRoot(ctx.dir);
-  const here = root ? basename(root) : "";
+  // The checkout's recorded id outranks its directory name (#6724): a renamed dir is the same project.
+  const here = root ? (readProjectId(root) || basename(root)) : "";
   if (badge && badge !== target) {
     throw new Error(`trantor open: refused — this shell is badged for '${badge}', not '${target}'; open it from the target project's shell`);
   }
@@ -19,13 +21,13 @@ export function resolveOrchestratorDir(ctx, projectArg) {
     throw new Error(`trantor open: refused — cwd belongs to project '${here}', not '${target}'; cd to the target checkout first`);
   }
   if (!projectArg || target === here) return { dir: ctx.dir, project: target };
-  const devRoot = ctx.env.TRANTOR_DEV_ROOT || join(ctx.home, "development");
-  const targetDir = join(devRoot, target);
-  if (existsSync(targetDir)) {
+  // By the project's id (#6724): a renamed checkout carries its marker and still answers.
+  const targetDir = checkoutFor(target, { ...ctx.env, HOME: ctx.home });
+  if (targetDir) {
     console.error(`— opening ${target} in its checkout: ${targetDir} —`);
     return { dir: targetDir, project: target };
   }
-  throw new Error(`trantor open: '${target}' has no checkout at ${targetDir} — cd into the project first`);
+  throw new Error(`trantor open: '${target}' has no checkout under ${ctx.env.TRANTOR_DEV_ROOT || join(ctx.home, "development")} — cd into the project first`);
 }
 
 function linkedByTest(env, badge, project) {