trantor 0.18.7 → 0.18.9

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.7",
+  "version": "0.18.9",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/app.mjs

@@ -77,9 +77,21 @@ await pipeline(Readable.fromWeb(dl.body), createWriteStream(dmg));
 
 let mount = "";
 try {
-  // -nobrowse keeps the volume out of Finder; mount point is the last tab-field of the last line.
-  const out = sh("hdiutil", ["attach", "-nobrowse", "-readonly", dmg]);
-  mount = (out.trim().split("\n").pop() || "").split("\t").pop().trim();
+  // diskutil first: on macOS 26 the deprecated hdiutil shim IGNORES -nobrowse, so the mounted
+  // volume popped a Finder window mid-update and read as an install prompt (2026-08-27). Parse
+  // the mount point as everything after the last " at " — volume names can contain spaces.
+  try {
+    // real output (verified 2026-08-27): tab-separated, same shape as hdiutil —
+    // "/dev/disk12s1\tApple_HFS            \t/Volumes/Trantor" — last tab field is the mount.
+    const out = sh("diskutil", ["image", "attach", "--mountOptions", "nobrowse", "--readOnly", dmg]);
+    const line = out.trim().split("\n").filter(l => l.includes("/Volumes/")).pop() || "";
+    mount = line.split("\t").pop().trim();
+    if (!mount.startsWith("/Volumes/")) throw new Error("no mount point in diskutil output");
+  } catch {
+    // older macOS: the original hdiutil path, tab-field parse (robust to spaces)
+    const out = sh("hdiutil", ["attach", "-nobrowse", "-readonly", dmg]);
+    mount = (out.trim().split("\n").pop() || "").split("\t").pop().trim();
+  }
   const src = join(mount, "Trantor.app");
   if (!mount.startsWith("/Volumes/") || !existsSync(src)) throw new Error(`unexpected DMG layout (mount: ${mount || "none"})`);
   if (existsSync(APP)) { console.log(`replacing ${APP} (was ${have || "unknown"})`); rmSync(APP, { recursive: true, force: true }); }
@@ -91,6 +103,9 @@ try {
 } catch (e) {
   console.error(`install failed: ${e.message}`); process.exitCode = 1;
 } finally {
-  if (mount) try { sh("hdiutil", ["detach", mount, "-quiet"]); } catch {}
+  if (mount) {
+    try { sh("diskutil", ["eject", mount]); }
+    catch { try { sh("hdiutil", ["detach", mount, "-quiet"]); } catch {} }
+  }
   try { rmSync(dmg, { force: true }); } catch {}
 }

package/bin/crew-runner.mjs

@@ -9,7 +9,7 @@
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
 import { execSync, spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles } from "../lib/project.mjs";
@@ -24,6 +24,41 @@ const DIR = process.argv[3] || process.cwd();
 // back to the git-repo-root basename — never a loose dir basename that could
 // fork the host's "builtbetter.ai" into a separate "builtbetter" lane.
 const PROJ = process.env.RELAY_PROJECT || resolveProject(DIR);
+
+function safePathSegment(s) {
+  return String(s).replace(/\.{2,}/g, "_").replace(/[^A-Za-z0-9_.-]/g, "_");
+}
+
+function gitOut(args, cwd = DIR) {
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 8000 });
+  return r.status === 0 ? String(r.stdout || "").trim() : "";
+}
+
+function ensureSeatWorktree(sourceDir) {
+  if (process.env.TRANTOR_NO_WORKTREE === "1") return sourceDir;
+  const root = gitOut(["-C", sourceDir, "rev-parse", "--show-toplevel"], sourceDir);
+  if (!root) return sourceDir;
+
+  spawnSync("git", ["-C", root, "worktree", "prune"], { stdio: "ignore", timeout: 8000 });
+  const seatDir = join(homedir(), ".agent-bus", "worktrees", safePathSegment(PROJ), safePathSegment(AGENT));
+  const branch = `seat/${AGENT}`;
+  if (existsSync(seatDir)) {
+    const ok = gitOut(["-C", seatDir, "rev-parse", "--is-inside-work-tree"], seatDir) === "true";
+    if (ok) return seatDir;
+    console.log(`\x1b[33m[runner]\x1b[0m worktree path exists but is not a git worktree: ${seatDir} — using ${sourceDir}`);
+    return sourceDir;
+  }
+
+  try { mkdirSync(join(homedir(), ".agent-bus", "worktrees", safePathSegment(PROJ)), { recursive: true }); } catch {}
+  const r = spawnSync("git", ["-C", root, "worktree", "add", "-B", branch, seatDir, "HEAD"], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
+  });
+  if (r.status === 0) return seatDir;
+  console.log(`\x1b[33m[runner]\x1b[0m could not create ${branch} worktree — using ${sourceDir}`);
+  return sourceDir;
+}
+
+const TURN_DIR = ensureSeatWorktree(DIR);
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
@@ -53,7 +88,6 @@ process.on("uncaughtException", (e) => { console.log(`\x1b[31m[runner] UNCAUGHT:
 process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLED REJECTION: ${e?.stack || e}\x1b[0m`); });
 const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${s}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
-import { mkdirSync } from "node:fs";
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = 0;
 const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
@@ -278,7 +312,9 @@ async function notifyAssigners(pairs, text) {
     seen.add(f);
     // `re` threads this outcome to the exact contract it answers, so the sender's ledger closes the
     // right one instead of guessing from timing.
-    await api("/send", { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ, ...(id ? { re: id } : {}) }).catch(() => {});
+    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ };
+    if (id) payload.re = id;
+    await api("/send", payload).catch(() => {});
   }
   if (seen.size) log(`reported outcome to ${[...seen].join(", ")}`);
 }
@@ -325,7 +361,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // substitution) so bash waits for tee to flush before we read the file back.
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
-    cwd: DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
+    cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
       //

package/bin/crew.sh

@@ -46,11 +46,19 @@ HAVE_TMUX=0; command -v tmux >/dev/null 2>&1 && HAVE_TMUX=1
 # Events) — NOT the control socket — so it needs NO socket password (the socket denies external processes
 # by default; AppleScript bypasses that, exactly like we already script Terminal.app).
 HAVE_CMUX=0; [ -d "/Applications/cmux.app" ] && HAVE_CMUX=1
-# explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal forces the grouping UI.
+# herdr (https://herdr.dev — a server-held terminal runtime: panes live in its background server, so a
+# crew survives the launcher exiting) is OPT-IN ONLY, never auto-detected — a machine with herdr
+# installed keeps its default cmux→tmux→terminal dispatch untouched. CREW_MUX=herdr is the explicit
+# switch; opting in without the binary is a HARD ERROR, because a silent fallback would defeat the ask.
+HAVE_HERDR=0
+# explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal|herdr forces the grouping UI.
 case "${CREW_MUX:-}" in
   cmux)     HAVE_CMUX=1; HAVE_TMUX=0 ;;
   tmux)     HAVE_CMUX=0; HAVE_TMUX=1 ;;
   terminal) HAVE_CMUX=0; HAVE_TMUX=0 ;;
+  herdr)    HAVE_CMUX=0; HAVE_TMUX=0
+            command -v herdr >/dev/null 2>&1 || { echo "CREW_MUX=herdr but herdr is not installed — user-local (no sudo): curl -fsSL https://herdr.dev/install.sh | sh — see https://herdr.dev"; exit 1; }
+            HAVE_HERDR=1 ;;
 esac
 SEATDIR="$HOME/.agent-bus/seats"; mkdir -p "$SEATDIR"
 DRY="${CREW_DRY_RUN:-0}"
@@ -136,6 +144,137 @@ end tell
 OSA
 }
 
+# ── herdr helpers (active ONLY under the explicit CREW_MUX=herdr opt-in) ────────────────────────────
+# herdr's creation commands print JSON ids — capture them, never predict (herdr.dev/docs). All parsing
+# tolerates a bare array or a .result wrapper, and a failed/empty parse yields "" (the caller records
+# the empty handle and crew-verify flags the dead seat on the bus — the spawn is not the truth).
+_herdr() { herdr "$@"; }
+_herdr_ws_create() {   # $1=cwd $2=label → "workspace_id<TAB>root_pane_id"
+  _herdr workspace create --cwd "$1" --label "$2" --no-focus 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(d.slice(d.search(/[\[{]/))).result)||{};
+process.stdout.write((((r.workspace||{}).workspace_id)||"")+"\t"+(((r.root_pane||{}).pane_id)||""))}catch(e){}})'
+}
+_herdr_split() {   # $1=pane id ("" = UI-focused pane)  $2=right|down → new pane id
+  local a=(pane split); [ -n "$1" ] && a+=("$1"); a+=(--direction "$2" --no-focus)
+  _herdr "${a[@]}" 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const r=(JSON.parse(d.slice(d.search(/[\[{]/))).result)||{};
+process.stdout.write(((r.pane||{}).pane_id)||"")}catch(e){}})'
+}
+_herdr_ws_live() {   # workspace list → "ids<TABnewline>names" (names \x01-wrapped+joined, like cmux)
+  _herdr workspace list 2>/dev/null | node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));
+const a=Array.isArray(o)?o:(o.workspaces||((o.result||{}).workspaces)||[]);
+console.log(a.map(x=>x.workspace_id||x.id||"").filter(Boolean).join(" "));
+console.log("\u0001"+a.map(x=>x.label||x.name||x.custom_title||"").filter(Boolean).join("\u0001")+"\u0001")}catch(e){}})'
+}
+# Teardown works regardless of CREW_MUX: you must never need to remember the flag to tear a crew down.
+_herdr_close_ws()   { [ "$DRY" = "1" ] && { echo "[dry] herdr workspace close $1"; return 0; }; _herdr workspace close "$1" >/dev/null 2>&1; }
+_herdr_close_pane() { [ "$DRY" = "1" ] && { echo "[dry] herdr pane close $1";    return 0; }; _herdr pane close    "$1" >/dev/null 2>&1; }
+
+# ── herdr spawn: ONE workspace `trantor:$PROJ`, one named pane per seat ─────────────────────────────
+# Topology = workspace create (its root pane runs seat 1) + pane split for the rest, same ceil(√N) grid
+# doctrine as cmux; pane rename labels each seat; pane run submits the seat command (bracketed-paste
+# safe, sends Enter). Same replace-never-stack doctrine: REUSE the newest tracked workspace for this
+# project, close older stacked ones, adopt one untracked live trantor:$PROJ workspace.
+spawn_herdr() {   # $@ = specs
+  local REUSE_WS="" line w
+  local stale_ws=()
+  if [ -f "$STATE" ]; then
+    while IFS= read -r line; do
+      [ -n "$line" ] || continue
+      _parse_row "$line"
+      { [ "$RP" = "$PROJ" ] && [ "$RK" = "herdrws" ]; } || continue
+      [ -n "$REUSE_WS" ] && stale_ws+=("$REUSE_WS")
+      REUSE_WS="$RH"
+    done < "$STATE"
+  fi
+  if [ "${#stale_ws[@]}" -gt 0 ]; then
+    for w in "${stale_ws[@]}"; do
+      echo "  → closing stale stacked crew workspace for $PROJ ($w)"
+      _herdr_close_ws "$w"; _state_drop "$PROJ" "herdrws" "" "$w"
+    done
+    prune_dead_state    # the closed workspaces' seat rows just died with them
+  fi
+  # Untracked strays: LIVE workspaces labeled trantor:$proj that STATE doesn't know. Adopt one as the
+  # reuse target if we have none; close the rest. (Skipped in DRY: read-only drills seed STATE instead.)
+  if [ "$DRY" != "1" ]; then
+    local named nid
+    named="$(_herdr workspace list 2>/dev/null | WSNAME="trantor:$PROJ" node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=Array.isArray(o)?o:(o.workspaces||((o.result||{}).workspaces)||[]);console.log(a.filter(x=>x.label===process.env.WSNAME||x.name===process.env.WSNAME||x.custom_title===process.env.WSNAME).map(x=>x.workspace_id||x.id||"").filter(Boolean).join(" "))}catch(e){}})')"
+    for nid in $named; do
+      [ "$nid" = "$REUSE_WS" ] && continue
+      [ -f "$STATE" ] && grep -qF "$nid" "$STATE" && continue     # tracked → handled above
+      if [ -z "$REUSE_WS" ]; then
+        echo "  → adopting existing untracked crew workspace for $PROJ ($nid)"
+        REUSE_WS="$nid"; record_state "$PROJ" "herdrws" "__ws__" "$nid"
+      else
+        echo "  → closing stray crew workspace for $PROJ ($nid)"
+        _herdr_close_ws "$nid"
+      fi
+    done
+  fi
+  # Grid tiling (identical math to cmux): row 0 splits RIGHT off the previous column, later rows split
+  # DOWN from the pane directly above. In REUSE mode a replaced seat splits off its OWN old pane —
+  # keeping its spot — and added seats split right off the previous new pane.
+  local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
+  local SPEC wsid="" surf i=0
+  local surfs=()
+  [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
+  for SPEC in "$@"; do
+    resolve_spec "$SPEC"
+    local cmd; cmd="$(RUN_CMD)"
+    if [ -n "$REUSE_WS" ]; then
+      # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
+      # then close the old pane — split-first so the workspace never dips to zero panes mid-swap.
+      local OLD_SURF=""
+      if [ -f "$STATE" ]; then
+        while IFS= read -r line; do
+          [ -n "$line" ] || continue
+          _parse_row "$line"
+          [ "$RP" = "$PROJ" ] && [ "$RK" = "herdr" ] && [ "$RA" = "$AGENT" ] && OLD_SURF="$RH"
+        done < "$STATE"
+      fi
+      local t=""
+      [ -n "$OLD_SURF" ] && t="$OLD_SURF"
+      { [ -z "$t" ] && [ "$i" -gt 0 ]; } && t="${surfs[$(( i - 1 ))]}"
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: reuse workspace $wsid — pane split for $AGENT${OLD_SURF:+ (replacing $OLD_SURF)}"
+        surf="%DRYT$i"
+        [ -n "$OLD_SURF" ] && _herdr_close_pane "$OLD_SURF"
+      else
+        surf="$(_herdr_split "$t" right)"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+        if [ -n "$OLD_SURF" ]; then _herdr_close_pane "$OLD_SURF"; _state_drop "$PROJ" "herdr" "$AGENT" ""; fi
+      fi
+    elif [ "$i" = "0" ]; then
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: workspace create (cwd $DIR) --label 'trantor:$PROJ' → root pane + run '$cmd'"
+        wsid="%DRYWS"; surf="%DRYT0"
+      else
+        local pair; pair="$(_herdr_ws_create "$DIR" "trantor:$PROJ")"
+        wsid="${pair%%$'\t'*}"; surf="${pair##*$'\t'}"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+      fi
+      record_state "$PROJ" "herdrws" "__ws__" "$wsid"
+    else
+      local dir target
+      if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${surfs[$(( i - 1 ))]}"
+      else dir="down"; target="${surfs[$(( i - COLS ))]}"; fi
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] herdr: pane split ${target:-<focused>} --direction $dir + run '$cmd'"
+        surf="%DRYT$i"
+      else
+        surf="$(_herdr_split "$target" "$dir")"
+        [ -n "$surf" ] && { _herdr pane rename "$surf" "$AGENT · $PROJ" >/dev/null 2>&1; _herdr pane run "$surf" "$cmd" >/dev/null 2>&1; }
+      fi
+    fi
+    surfs+=("$surf")
+    record_state "$PROJ" "herdr" "$AGENT" "$surf"
+    echo "  → $AGENT seat in herdr workspace ($PROJ)"
+    i=$(( i + 1 ))
+  done
+  echo "— crew grouped in herdr: ONE workspace for $PROJ, seats as named panes in its server. Teardown (this project only): trantor down —"
+}
+
 # surgical STATE row removal: drop every row matching PROJECT+KIND (+AGENT/+HANDLE when given).
 # Empty $3/$4 = wildcard. Callers beware: uses _parse_row, which clobbers the RP/RK/RA/RH globals.
 _state_drop() {   # $1=project $2=kind $3=agent(''=any) $4=handle(''=any)
@@ -202,7 +341,7 @@ down() {
       [ "$match" = "1" ] || continue
     fi
     scoped+=("$RP|$RK|$RA|$RH")
-    case "$RK" in attach|cmuxws) continue ;; esac       # infra rows (attach window / cmux workspace) — not seats
+    case "$RK" in attach|cmuxws|herdrws) continue ;; esac       # infra rows (attach/cmux/herdr workspace) — not seats
     killlist="$killlist  • ${RP:-<legacy>} · $RA ($RK)"$'\n'
   done < "$STATE"
 
@@ -220,6 +359,8 @@ down() {
     case "$K2" in
       cmuxws) [ "${#AGENTS[@]}" -gt 0 ] || _cmux_close_tab "$H2" ;;   # whole workspace (no specific seats)
       cmux)   [ "${#AGENTS[@]}" -gt 0 ] && _cmux_close_term "$H2" ;;  # a single seat's pane
+      herdrws) [ "${#AGENTS[@]}" -gt 0 ] || _herdr_close_ws "$H2" ;;  # whole workspace (no specific seats)
+      herdr)   [ "${#AGENTS[@]}" -gt 0 ] && _herdr_close_pane "$H2" ;;# a single seat's pane
       tmux)
         if [ "${#AGENTS[@]}" -gt 0 ]; then run "tmux kill-pane -t '$H2' 2>/dev/null"      # per-seat
         else
@@ -228,7 +369,7 @@ down() {
         fi ;;
       win|attach) { [ "${#AGENTS[@]}" -gt 0 ] && [ "$K2" = "attach" ]; } && continue; _kill_win "$H2" ;;
     esac
-    case "$K2" in cmuxws|attach) : ;; *) _kill_seat_procs "$P2" "$A2" ;; esac
+    case "$K2" in cmuxws|attach|herdrws) : ;; *) _kill_seat_procs "$P2" "$A2" ;; esac
   done
 
   # rewrite STATE minus the rows we tore down (leaves OTHER projects' rows intact)
@@ -268,6 +409,15 @@ prune_dead_state() {
     CLIVE="$(printf '%s' "$pair" | sed -n 1p)"
     CLIVE_NAMES="$(printf '%s' "$pair" | sed -n 2p)"
   fi
+  # herdr liveness is queried ONLY under the explicit opt-in (CREW_MUX=herdr): a default run never
+  # invokes herdr at all. Same keep-when-unprovable doctrine as cmux — no answer ⇒ rows are KEPT.
+  local HLIVE="" HLIVE_NAMES=""
+  if [ "$HAVE_HERDR" = "1" ]; then
+    local hpair
+    hpair="$(_herdr_ws_live)"
+    HLIVE="$(printf '%s' "$hpair" | sed -n 1p)"
+    HLIVE_NAMES="$(printf '%s' "$hpair" | sed -n 2p)"
+  fi
   local tmp="$STATE.tmp" line alive
   : > "$tmp"
   while IFS= read -r line; do
@@ -283,6 +433,12 @@ prune_dead_state() {
     elif [ "$RK" = "cmux" ]; then
       # seat row lives exactly as long as its project still has a live crew workspace
       if [ -n "$CLIVE" ]; then case "$CLIVE_NAMES" in *$'\x01'"trantor:$RP"$'\x01'*) : ;; *) alive=0 ;; esac; fi
+    elif [ "$RK" = "herdrws" ]; then
+      if [ -n "$HLIVE" ]; then case " $HLIVE " in *" $RH "*) : ;; *) alive=0 ;; esac; fi
+    elif [ "$RK" = "herdr" ]; then
+      # seat row lives exactly as long as its project still has a live crew workspace — validated at
+      # WORKSPACE granularity, never per pane (the cmux 0.17.61 lesson generalized)
+      if [ -n "$HLIVE" ]; then case "$HLIVE_NAMES" in *$'\x01'"trantor:$RP"$'\x01'*) : ;; *) alive=0 ;; esac; fi
     fi
     [ "$alive" = "1" ] && printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
   done < "$STATE"
@@ -690,8 +846,9 @@ OSA
   echo "— crew grouped in cmux (AppleScript): ONE workspace tab for $PROJ, seats tiled. Teardown: trantor down —"
 }
 
-spawn_crew() {   # dispatch: cmux (preferred) → tmux → Terminal grid
-  if [ "$HAVE_CMUX" = "1" ]; then spawn_cmux "$@"
+spawn_crew() {   # dispatch: herdr (explicit opt-in) → cmux → tmux → Terminal grid
+  if [ "$HAVE_HERDR" = "1" ]; then spawn_herdr "$@"
+  elif [ "$HAVE_CMUX" = "1" ]; then spawn_cmux "$@"
   elif [ "$HAVE_TMUX" = "1" ]; then spawn_tmux "$@"
   else
     echo "— no cmux/tmux → per-agent Terminal windows. For ONE grouped, named window per crew (and"
@@ -729,7 +886,7 @@ fi
 
 spec_for_agent() { local want="$1"; shift; local s; for s in "$@"; do [ "${s%%:*}" = "$want" ] && { printf '%s' "$s"; return; }; done; printf '%s' "$want"; }
 
-CREW_UI="Terminal windows"; [ "$HAVE_TMUX" = "1" ] && CREW_UI="tmux"; [ "$HAVE_CMUX" = "1" ] && CREW_UI="cmux"
+CREW_UI="Terminal windows"; [ "$HAVE_TMUX" = "1" ] && CREW_UI="tmux"; [ "$HAVE_CMUX" = "1" ] && CREW_UI="cmux"; [ "$HAVE_HERDR" = "1" ] && CREW_UI="herdr"
 echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
 spawn_crew "$@"

package/hub.mjs

@@ -343,32 +343,46 @@ function overseerTick() {
   overseerLastTick = t;
   const pol = overseerPolicy();
   const seen = new Set();
+  // Hand each party the others' session ids at the moment coordination is warranted. Telling two
+  // sessions to "coordinate over the bus" is useless if neither knows the other's id, and the
+  // warning alone went only to the duty seat and the log — so coordination needed a human to carry
+  // the ids across. Shared by the episode-start branch (all parties) and the standing branch
+  // (newcomers only): existing members never re-hear it, so a standing condition must not re-wake
+  // every party every tick.
+  const intro = (c, me, others) => {
+    const rest = others.filter(p => p !== me);
+    if (rest.length === 0) return;
+    hubSend(me,
+      `🤝 OVERSEER ${c.kind}: you and ${rest.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${rest[0]} — and split the work between you. No human needs to relay this.`,
+      c.project);
+  };
   for (const c of collisions) {
-    const key = `${c.project} ${c.kind} ${(c.sessions || []).join(",")} ${(c.files || []).join(",")}`;
+    // Episode identity is the CONDITION (project+kind+files), never the session list (#5350):
+    // membership is volatile — a third seat bouncing in and out of a standing collision minted a
+    // fresh key, so a fresh episode, so a fresh warn (+ duty wake + party intros) per permutation.
+    // Sessions are participants, not identity; current membership still rides every warn payload.
+    const key = `${c.project} ${c.kind} ${(c.files || []).join(",")}`;
     c.key = key;
     seen.add(key);
+    const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
     const standing = overseerActive.get(key);
-    if (standing) { standing.lastTick = t; c.since = standing.since; continue; }   // holds — stay quiet
-    overseerActive.set(key, { since: t, lastTick: t });
+    if (standing) {
+      // The episode HOLDS — no new warn. But a NEWCOMER to a standing collision still needs the
+      // intro: it was not present when the episode started, so it never learned the others' ids.
+      // Diff the current membership against the set the episode has already introduced, hand the
+      // intro only to newly arrived sessions, and remember them so they are not re-introduced.
+      standing.lastTick = t;
+      c.since = standing.since;
+      for (const me of parties) if (!standing.sessions.has(me)) intro(c, me, parties);
+      for (const me of parties) standing.sessions.add(me);
+      continue;
+    }
+    overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
     c.since = t;
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
     if (DUTY_SESSION) hubSend(DUTY_SESSION, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
-    // INTRODUCE the parties to each other. Telling two sessions to "coordinate over the bus" is
-    // useless if neither knows the other's session id, and until now the warning went only to the
-    // duty seat and the log — so coordination needed a human to carry the ids across. Hand each
-    // party the others' ids at the moment coordination is warranted. This sits inside the
-    // episode-start branch, so it fires ONCE per episode, not once per tick: a standing condition
-    // must not re-wake two sessions every 30 seconds.
-    const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
-    if (parties.length > 1) {
-      for (const me of parties) {
-        const others = parties.filter(p => p !== me);
-        hubSend(me,
-          `🤝 OVERSEER ${c.kind}: you and ${others.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${others[0]} — and split the work between you. No human needs to relay this.`,
-          c.project);
-      }
-    }
+    if (parties.length > 1) for (const me of parties) intro(c, me, parties);
     const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
     if (level >= 3 && c.kind === "file-conflict") {
       const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),

package/lib/project.mjs

@@ -21,6 +21,20 @@ export function gitRoot(dir) {
 export function resolveProject(cwd = process.cwd()) {
   if (process.env.RELAY_PROJECT) return process.env.RELAY_PROJECT.slice(0, 80);
   const root = gitRoot(cwd);
+  // A LINKED WORKTREE must resolve to its MAIN repo's name, not its own directory name. Seat
+  // worktrees live at ~/.agent-bus/worktrees/<project>/<agent>, so the old basename rule named the
+  // project after the AGENT — codex's seat registered as codex:codex the first time a worktree crew
+  // came up (2026-08-27), because codex spawns its MCP with a sanitized env, so the RELAY_PROJECT
+  // guard above never arrives there. git-common-dir points at the main repo's .git from any
+  // worktree; in the main repo it equals its own .git, so this is a no-op for normal checkouts.
+  if (root) {
+    try {
+      const common = execSync("git rev-parse --path-format=absolute --git-common-dir", {
+        cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000,
+      }).trim();
+      if (common.endsWith("/.git")) return basename(dirname(common)).slice(0, 80);
+    } catch {}
+  }
   return basename(root || cwd).slice(0, 80);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.7",
+  "version": "0.18.9",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [