trantor 0.18.78 → 0.18.79

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.78",
+  "version": "0.18.79",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/cmux.mjs

@@ -55,6 +55,7 @@ function tracked(ctx) {
 
 function prepare(ctx, prune) {
   const result = tracked(ctx);
+  if (ctx.swap) return result.reuse;
   for (const id of result.stale) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);
@@ -178,6 +179,7 @@ function spawnAppleScript(ctx, specs, resolve) {
 function prepareAppleScriptWorkspace(ctx) {
   const ids = readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmuxws").map(row => row.handle);
   const reuse = ids.at(-1) || "";
+  if (ctx.swap) return reuse;
   for (const id of ids.slice(0, -1)) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);

package/bin/crew/core.mjs

@@ -146,8 +146,9 @@ export function runnerCommand(ctx, agent, model = "", effort = null) {
     .join("");
   // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
   // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
+  const swapEnv = ctx.swap ? ` CREW_SWAP_STAGE=${shellQuote(ctx.swap.path)} CREW_SWAP_LABEL=${shellQuote(ctx.swap.label)} CREW_SWAP_AGENT=${shellQuote(ctx.swap.agent)} CREW_SWAP_DRIVER=${shellQuote(ctx.swap.driver || "")}` : "";
   const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv}${swapEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -121,6 +121,7 @@ function orchPaneWorkspaces(ctx) {
 
 function prepareWorkspace(ctx, prune) {
   const tracked = trackedWorkspace(ctx);
+  if (ctx.swap) return tracked.reuse;
   const orchSpaces = orchPaneWorkspaces(ctx);
   for (const id of tracked.stale) {
     // #7285: never close reuse itself, nor a workspace hosting the tracked orch pane — `up` once

package/bin/crew/models.mjs

@@ -1,7 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { call } from "./core.mjs";
-import { reapSeat } from "./state.mjs";
 import { resolveEffort } from "../../lib/model-catalog.mjs";
 
 function routeModel(ctx, provider, candidates, task, difficulty) {
@@ -21,7 +20,8 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
   const candidates = result.ok ? result.stdout.split(/\s+/).filter(Boolean).join(" ") : "";
   let model = routeModel(ctx, provider, candidates, task, difficulty);
   if (!model && candidates) {
-    model = `${provider}/${candidates.split(" ")[0]}`;
+    const first = candidates.split(" ")[0];
+    model = first.startsWith(`${provider}/`) ? first : `${provider}/${first}`;
     console.error(`[crew] router unavailable for ${agent}:${provider} — using the provider's own catalog head (${model})`);
   }
   if (!model) throw new Error(`[crew] live model selection failed for ${agent}:${provider} — no router and no catalog; refusing opencode global default`);
@@ -31,7 +31,6 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
 
 export function resolveSpec(ctx, spec, task, difficulty, skipped) {
   const [agent, ...rest] = spec.split(":");
-  reapSeat(ctx, agent);
   let field = rest.join(":");
   if (!field) {
     if (agent === "glm") field = "zai-coding-plan";

package/bin/crew/processes.mjs

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { call } from "./core.mjs";
+
+export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
+
+export function seatProcesses(ctx, project, agent) {
+  if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
+  let label = agent, dir = ctx.dir;
+  try {
+    const record = JSON.parse(readFileSync(runnerRecord(ctx, project, agent), "utf8"));
+    label = record.label;
+    dir = record.dir;
+  } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+    const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
+    return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
+  }).filter(Boolean);
+  const ids = new Set(rows.filter(row => row.command.endsWith(`crew-runner.mjs ${label} ${dir}`)).map(row => row.pid));
+  let before;
+  do { before = ids.size; for (const row of rows) if (ids.has(row.parent)) ids.add(row.pid); } while (ids.size > before);
+  return [...ids];
+}
+
+export function signalProcesses(pids, signal) {
+  for (const pid of pids) {
+    try { process.kill(pid, signal); } catch (error) { if (error.code !== "ESRCH") throw error; }
+  }
+}

package/bin/crew/stage.mjs

@@ -0,0 +1,28 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { setTimeout } from "node:timers/promises";
+import { loadOrCreate } from "../../lib/identity.mjs";
+import { ensureEnrolled } from "../../lib/enroll.mjs";
+import { sfetchJson } from "../../lib/signed-fetch.mjs";
+
+// A replacement registers before it touches the old runner's worktree or queue.
+export async function awaitSwapRelease(env = process.env) {
+  if (!env.CREW_SWAP_STAGE) return;
+  const stage = env.CREW_SWAP_STAGE;
+  const session = `${env.CREW_SWAP_LABEL}:${env.RELAY_PROJECT}`;
+  const identity = loadOrCreate(session, "agent");
+  const enrollment = await ensureEnrolled(env.RELAY_URL, identity, env.RELAY_PROJECT);
+  if (!enrollment.ok) throw new Error(`replacement enrollment failed: ${enrollment.reason}`);
+  const response = await sfetchJson(`${env.RELAY_URL}/register`, {
+    identity, payload: { session, project: env.RELAY_PROJECT, kind: "agent", status: "replacement ready; awaiting handoff" },
+    signal: AbortSignal.timeout(8000),
+  });
+  if (!response.ok) throw new Error(`replacement registration failed: ${response.status}`);
+  writeFileSync(`${stage}.ready`, JSON.stringify({ pid: process.pid, session }));
+  const deadline = Date.now() + 120000;
+  while (!existsSync(`${stage}.release`)) {
+    if (Date.now() > deadline) throw new Error("swap handoff timed out; replacement stopped before taking work");
+    await setTimeout(100);
+  }
+  const handoff = JSON.parse(readFileSync(`${stage}.release`, "utf8"));
+  if (handoff.agent !== env.CREW_SWAP_AGENT) throw new Error("swap release names a different seat");
+}

package/bin/crew/state.mjs

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
@@ -61,6 +62,7 @@ async function stopSeatContainers(ctx, project, agent) {
 async function killSeatProcesses(ctx, project, agent) {
   if (ctx.env.CREW_NO_PROC_KILL === "1" || !project || !agent) return;
   await stopSeatContainers(ctx, project, agent);
+  if (!ctx.dry) signalProcesses(seatProcesses(ctx, project, agent), "SIGKILL");
   const patterns = [`seats/${project}-${agent}\\.sh`, `crew-runner\\.mjs ${agent} .*/${project}$`];
   for (const pattern of patterns) {
     for (const pid of listPids(pattern)) run(ctx, "kill", ["-9", pid], { rendered: `kill -9 ${pid} 2>/dev/null` });

package/bin/crew/swap.mjs

@@ -0,0 +1,163 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
+import { call, commandExists } from "./core.mjs";
+import { resolveSpec } from "./models.mjs";
+import { runnerRecord, seatProcesses, signalProcesses } from "./processes.mjs";
+import { down, readRows, writeRows } from "./state.mjs";
+import { providerStatus } from "../../lib/providers.mjs";
+import { lookup } from "../../lib/model-catalog.mjs";
+import { resolveKeys } from "../../lib/provider-keys.mjs";
+import { resolveSecrets } from "../../lib/secrets.mjs";
+import { signedGet, signedPost } from "../../hooks/lib/api.mjs";
+
+const NATIVE = new Set(["codex", "kimi", "claude", "gemini", "dsh"]);
+
+export function swapOptions(args) {
+  const positional = [];
+  const options = { task: "code", difficulty: "medium", provider: "", model: "" };
+  for (let i = 0; i < args.length; i++) {
+    const key = { "--task": "task", "--difficulty": "difficulty", "--diff": "difficulty", "--provider": "provider", "--model": "model" }[args[i]];
+    if (key) {
+      if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`missing value for ${args[i]}`);
+      options[key] = args[++i];
+    } else if (args[i].startsWith("--")) throw new Error(`unknown swap flag ${args[i]}`);
+    else positional.push(args[i]);
+  }
+  const [from, replacement = options.provider ? from : ""] = positional;
+  if (!from || !replacement || positional.length > 2) throw new Error("usage: trantor swap <old> [new[:provider/model]] [--provider P] [--model M] [--json]");
+  const agent = replacement.split(":")[0];
+  if (![from, agent].every(value => /^[A-Za-z0-9_-]+$/.test(value))) throw new Error("invalid seat name");
+  return { ...options, from, replacement, agent };
+}
+
+export async function validateReplacement(ctx, options, status = providerStatus) {
+  const explicit = options.provider;
+  const field = options.replacement.split(":").slice(1).join(":");
+  const native = NATIVE.has(options.agent) && !explicit;
+  const provider = native ? options.agent : (explicit || field.split("/")[0] || (options.agent === "glm" ? "zai-coding-plan" : options.agent));
+  const binary = native ? options.agent : "opencode";
+  if (!commandExists(binary, ctx.env)) throw new Error(`${binary} CLI not found on PATH; old seat unchanged`);
+  const registryName = provider === "zai-coding-plan" ? "zai" : provider;
+  const env = resolveKeys(ctx.env, [join(ctx.home, ".token-scrooge/.env"), join(ctx.home, ".agent-bus/.env")], resolveSecrets(ctx.env));
+  const rows = await status({ env, path: env.PATH, only: [registryName] });
+  const row = rows[0];
+  if (!row || row.state !== "connected") throw new Error(`${provider}: ${row?.reason || "no credential validator available"}; old seat unchanged`);
+  const spec = explicit ? `${options.agent}-provider:${provider}${options.model ? `/${options.model}` : ""}` : options.model ? `${options.agent}:${options.model}` : options.replacement;
+  const skipped = [];
+  const seat = resolveSpec({ ...ctx, env }, spec, options.task, options.difficulty, skipped);
+  if (!seat) throw new Error(skipped.join("; "));
+  if (native && seat.model && !lookup(seat.model).found) {
+    let models = [];
+    const cache = join(ctx.home, ".codex/models_cache.json");
+    if (options.agent === "codex" && existsSync(cache)) models = JSON.parse(readFileSync(cache, "utf8")).models || [];
+    if (!models.some(model => model.slug === seat.model)) throw new Error(`cannot validate native model ${seat.model}; old seat unchanged`);
+  }
+  if (!native) {
+    const catalog = call("opencode", ["models", provider], { env });
+    const models = catalog.stdout.split(/\s+/).filter(Boolean).map(m => m.startsWith(`${provider}/`) ? m : `${provider}/${m}`);
+    if (!catalog.ok || !models.includes(seat.model)) throw new Error(`model ${seat.model} is not in ${provider}'s available catalog; old seat unchanged`);
+  }
+  return { ...seat, agent: options.agent, driver: native ? "" : "opencode" };
+}
+
+export function pendingPath(ctx, agent) { return join(ctx.home, ".agent-bus", `pending-${agent}-${ctx.project}.json`); }
+
+function readPending(ctx, agent) {
+  const file = pendingPath(ctx, agent);
+  if (!existsSync(file)) return { wake: [], bcast: [], seen: [], ask: 0, askTo: "" };
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+
+function savePending(ctx, agent, pending) {
+  const file = pendingPath(ctx, agent);
+  writeFileSync(`${file}.swap`, JSON.stringify({ ...pending, agent, project: ctx.project, ts: Date.now() }));
+  renameSync(`${file}.swap`, file);
+}
+
+async function hubRequest(ctx, path, body) {
+  const response = body
+    ? await signedPost(`${ctx.hub}${path}`, body, { project: ctx.project })
+    : await signedGet(`${ctx.hub}${path}`, { project: ctx.project });
+  if (!response.ok || !response.json?.ok) throw new Error(response.json?.error || response.reason || `hub handoff failed (${response.status})`);
+  return response.json;
+}
+
+export function swapRuntime(ctx, adapters, spawn) {
+  let pids = [];
+  let replacementPid;
+  return {
+    validate: options => {
+      if (options.agent !== options.from && readRows(ctx).some(row => row.project === ctx.project && row.agent === options.agent)) throw new Error(`replacement seat ${options.agent} already exists; old seat unchanged`);
+      return validateReplacement(ctx, options);
+    },
+    async start(seat, stage) {
+      const staged = { ...ctx, swap: { ...stage, agent: seat.agent, driver: seat.driver } };
+      spawn(staged, { ...seat, agent: stage.label });
+    },
+    async ready(stage) {
+      const deadline = Date.now() + 30000;
+      while (!existsSync(`${stage.path}.ready`)) {
+        if (Date.now() > deadline) throw new Error("replacement did not join the bus within 30s; old seat unchanged");
+        await setTimeout(100);
+      }
+      const ready = JSON.parse(readFileSync(`${stage.path}.ready`, "utf8"));
+      const response = await signedGet(`${ctx.hub}/peers?project=${encodeURIComponent(ctx.project)}`, { project: ctx.project });
+      if (!response.ok || !response.json?.peers?.some(p => p.session === ready.session)) throw new Error("replacement registration is not visible on the bus");
+      process.kill(ready.pid, 0);
+      replacementPid = ready.pid;
+      return ready.session;
+    },
+    freeze(agent) { pids = seatProcesses(ctx, ctx.project, agent); signalProcesses(pids, "SIGSTOP"); },
+    resume() { signalProcesses(pids, "SIGCONT"); },
+    transfer: body => hubRequest(ctx, "/contracts/transfer", body),
+    async stop(agent) {
+      process.kill(replacementPid, 0);
+      await down(ctx, [agent], adapters);
+      signalProcesses(pids, "SIGKILL");
+    },
+    async cancel(stage) { await down(ctx, [stage.label], adapters); },
+    release(stage, agent, cursor) {
+      writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.agent === stage.label ? { ...row, agent } : row));
+      writeFileSync(runnerRecord(ctx, ctx.project, agent), JSON.stringify({ label: stage.label, dir: ctx.dir }));
+      writeFileSync(`${stage.path}.release`, JSON.stringify({ agent, cursor }));
+    },
+  };
+}
+
+export async function performSwap(ctx, options, runtime) {
+  const result = { ok: false, action: "swap", seat: options.from, to: options.agent, moved: [] };
+  let stage, frozen = false, transferred = false;
+  try {
+    const seat = await runtime.validate(options);
+    const label = `${options.agent}-swap-${randomUUID().slice(0, 8)}`;
+    mkdirSync(ctx.seatDir, { recursive: true });
+    stage = { label, path: join(ctx.seatDir, label) };
+    await runtime.start(seat, stage);
+    const readySession = await runtime.ready(stage);
+    frozen = true;
+    await runtime.freeze(options.from);
+    const pending = readPending(ctx, options.from);
+    const target = options.agent === options.from ? pending : readPending(ctx, options.agent);
+    const from = `${options.from}:${ctx.project}`, to = `${options.agent}:${ctx.project}`;
+    const handoff = await runtime.transfer({ from, to, project: ctx.project, readySession, _op: `swap-${stage.label}`, heldAsk: pending.ask || 0, pendingIds: pending.wake.map(m => m.id) });
+    transferred = true;
+    result.moved = [...new Set([...pending.wake.map(m => m.id), ...handoff.moved])];
+    const wake = new Map([...target.wake, ...pending.wake, ...handoff.messages].map(m => [m.id, { ...m, to }]));
+    savePending(ctx, options.agent, { ...target, wake: [...wake.values()], bcast: [...new Map([...target.bcast, ...pending.bcast].map(m => [m.id, m])).values()], ask: handoff.messages.some(m => m.re === pending.ask) ? 0 : pending.ask || target.ask, askTo: pending.askTo || target.askTo });
+    await runtime.stop(options.from);
+    frozen = false;
+    if (options.agent !== options.from) savePending(ctx, options.from, { ...pending, wake: [], bcast: [], ask: 0, askTo: "" });
+    await runtime.release(stage, options.agent, handoff.cursor);
+    return { ...result, ok: true };
+  } catch (error) {
+    if (!transferred) {
+      if (frozen) await runtime.resume();
+      if (stage) await runtime.cancel(stage);
+    }
+    result.reason = error.message;
+    if (transferred) result.reason += "; handoff recorded on hub; old seat held for recovery";
+    return result;
+  }
+}

package/bin/crew-runner.mjs

@@ -41,7 +41,10 @@ import {
 import { costLine } from "../lib/state/cost.mjs";
 import { resolveStateFlags } from "../lib/state/flags.mjs";
 
-const AGENT = process.argv[2];
+import { awaitSwapRelease } from "./crew/stage.mjs";
+
+await awaitSwapRelease();
+const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
 // RELAY_PROJECT is inherited from crew.mjs (the host's resolved key); else fall
@@ -241,7 +244,8 @@ const CLI = {
 // <label>:<provider>` for any opencode vendor the user configured — run with no per-provider code
 // here; its model id arrives pre-qualified (`<provider>/<model>`) as CREW_MODEL.
 const NATIVE = new Set(["codex", "gemini", "kimi", "claude", "dsh"]);
-const cli = CLI[AGENT] || (NATIVE.has(AGENT) ? null : CLI.opencode);
+const DRIVER = process.env.CREW_SWAP_DRIVER || AGENT;
+const cli = CLI[DRIVER] || (NATIVE.has(AGENT) ? null : CLI.opencode);
 if (!cli) { console.error(`unknown agent '${AGENT}' (native: ${[...NATIVE].join(", ")}; any other name = an opencode provider seat)`); process.exit(1); }
 if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an opencode provider (BYOM)`);
 
@@ -250,7 +254,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 // parameters the CLI can carry (codex -c model_reasoning_effort / claude --effort / opencode
 // --variant) and logs ONE line saying what it set — or that the model is uncatalogued.
 const EFFORT = (() => { try { return JSON.parse(process.env.CREW_EFFORT || "null"); } catch { return null; } })();
-const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: "" };
+const EFFORT_FLAG = EFFORT ? cliEffortFlag(DRIVER, EFFORT) : { flag: "", text: "" };
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
@@ -617,6 +621,7 @@ const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-$
 const STATE_MODE = (() => {
   if (!STATE_FLAG_ON) return false;
   if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
+  if (DRIVER !== "claude") return false;
   const probe = hasJsonSchemaFlag((bin, args) => spawnSync(bin, args, { encoding: "utf8", timeout: 20000 }));
   if (!probe) { log(`\x1b[33m${STATE_ENV}=1 but this claude CLI has no --json-schema — state mode stays OFF (TDD §6)\x1b[0m`); return false; }
   try {
@@ -1304,7 +1309,8 @@ async function resolveWakeCard(messages, { session }) {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
-  try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
+  if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
+  else try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
   // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
   // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an

package/bin/crew.mjs

@@ -5,7 +5,9 @@ import { createCmuxAdapter, spawnCmux } from "./crew/cmux.mjs";
 import { createHerdrAdapter, spawnHerdr } from "./crew/herdr.mjs";
 import { resolveSpec, reportSkipped } from "./crew/models.mjs";
 import { openOrchestrator } from "./crew/open.mjs";
-import { down, prune } from "./crew/state.mjs";
+import { performSwap, swapOptions, swapRuntime } from "./crew/swap.mjs";
+import { redactKeys } from "../lib/redact.mjs";
+import { reapSeat, down, prune } from "./crew/state.mjs";
 import { spawnTerminal, spawnTmux } from "./crew/tmux.mjs";
 import { epochMs, failedAgents, verifyCrew } from "./crew/verify.mjs";
 import { guardCrossProjectUp } from "./crew/worktrees.mjs";
@@ -13,10 +15,21 @@ import { preflightFirstSeat } from "./crew/preflight.mjs";
 import { resolveAgentLaunchSpecs } from "../lib/agent-preferences.mjs";
 import { readConfig } from "../lib/project.mjs";
 
-const [command = "up", ...rawArgs] = process.argv.slice(2);
+const [command = "up", ...inputArgs] = process.argv.slice(2);
+const jsonMode = inputArgs.includes("--json");
+const rawArgs = inputArgs.filter(arg => arg !== "--json");
+const output = console.log.bind(console);
+const diagnostics = [];
+if (jsonMode) console.log = (...parts) => {
+  const line = redactKeys(parts.join(" "));
+  diagnostics.push(line);
+  console.error(line);
+};
+const jsonResult = (code, extra = {}) => ({ ok: code === 0, action: command, seat: resultSeat, moved: [], ...extra });
+let resultSeat = rawArgs.filter(a => !a.startsWith("--")).join(",");
 let ctx;
 try { ctx = createContext(command); }
-catch (error) { console.error(error.message); process.exit(1); }
+catch (error) { if (jsonMode) output(JSON.stringify(jsonResult(1, { reason: redactKeys(error.message) }))); else console.error(error.message); process.exit(1); }
 
 const adapters = {
   cmux: createCmuxAdapter(ctx),
@@ -39,7 +52,11 @@ function parseUpArgs(args) {
 }
 
 function spawnCrew(options, skipped) {
-  const resolve = spec => resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+  const resolve = spec => {
+    const seat = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+    if (seat) reapSeat(ctx, seat.agent);
+    return seat;
+  };
   const pruneNow = () => prune(ctx, adapters);
   if (ctx.mux === "herdr") spawnHerdr(ctx, options.specs, resolve, pruneNow);
   else if (ctx.mux === "cmux") spawnCmux(ctx, options.specs, resolve, pruneNow);
@@ -56,6 +73,7 @@ async function runUp(args, verify = true) {
   const options = parseUpArgs(args);
   const requested = resolveAgentLaunchSpecs(options.specs, readConfig());
   options.specs = requested.specs;
+  resultSeat = options.specs.map(spec => spec.split(":")[0]).join(",");
   if (!options.specs.length) {
     console.log("usage: crew.mjs up [--task K --difficulty D] codex glm kimi deepseek (or set a default in Settings → Agents)");
     return 1;
@@ -95,25 +113,42 @@ async function runUp(args, verify = true) {
   return reportSkipped(skipped);
 }
 
+function spawnReplacement(context, seat) {
+  const resolve = () => seat;
+  const specs = [seat.agent];
+  const noPrune = () => {};
+  if (context.mux === "herdr") spawnHerdr(context, specs, resolve, noPrune);
+  else if (context.mux === "cmux") spawnCmux(context, specs, resolve, noPrune);
+  else if (context.mux === "tmux") spawnTmux(context, specs, resolve);
+  else spawnTerminal(context, specs, resolve);
+}
+
 async function swap(args) {
-  const [oldAgent, replacement, ...flags] = args;
-  if (!oldAgent || !replacement) {
-    console.log("usage: trantor swap <oldAgent> <newAgent[:provider[/model]]> [--task K --difficulty D]");
-    return 1;
-  }
-  console.log(`— tearing down old seat '${oldAgent}' in ${ctx.project} —`);
-  await down(ctx, [oldAgent], adapters);
-  console.log(`— spawning replacement: ${replacement} —`);
-  const code = await runUp([...flags, replacement]);
-  if (!code) console.log(`— swapped. RESEND the contract to '${replacement.split(":")[0]}' (it joined fresh with no context). —`);
-  return code;
+  const options = swapOptions(args);
+  resultSeat = options.from;
+  if (resolveAgentLaunchSpecs([options.replacement], readConfig()).disabled.length) throw new Error(`replacement ${options.agent} is disabled in agent settings`);
+  if (!guardCrossProjectUp(ctx)) throw new Error("cross-project swap refused");
+  if (ctx.dry) throw new Error("swap requires a live bus; dry-run cannot verify a handoff");
+  return performSwap(ctx, options, swapRuntime(ctx, adapters, spawnReplacement));
 }
 
 let code = 0;
-if (command === "down") code = await down(ctx, rawArgs, adapters);
-else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
-else if (command === "open") code = openOrchestrator(ctx, rawArgs);
-else if (command === "swap") code = await swap(rawArgs);
-else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
-else { usage(); code = 1; }
+let result;
+try {
+  if (command === "down") code = await down(ctx, rawArgs, adapters);
+  else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
+  else if (command === "open") code = openOrchestrator(ctx, rawArgs);
+  else if (command === "swap") { result = await swap(rawArgs); code = result.ok ? 0 : 1; }
+  else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
+  else { usage(); code = 1; }
+} catch (error) {
+  code = 1;
+  result = jsonResult(code, { reason: redactKeys(error.message) });
+}
+if (!result) result = jsonResult(code);
+if (!result.ok && !result.reason) result.reason = diagnostics.at(-1) || `${command} failed; see stderr`;
+if (result.reason) result.reason = redactKeys(result.reason);
+if (jsonMode) output(JSON.stringify(result));
+else if (result.reason) console.error(result.reason);
+else if (command === "swap") console.log(`— swapped ${result.seat} → ${result.to}; moved contracts: ${result.moved.join(", ") || "none"} —`);
 process.exit(code);

package/hub/routes/cards.mjs

@@ -6,6 +6,15 @@ const SLIM_DROP = new Set(["log", "history", "checklist"]);
 // #7968: the shape hollow-move.mjs posts — { base, changed[], unindexed[], dependents } or
 // { unavailable: true }; anything else is dropped so a stray payload cannot bloat the log.
 const BLAST_PATHS_MAX = 40;
+// #11142: the fleet-wide cap evicts done/stale cards oldest-first, never an open one.
+const TASK_CAP = 2000, TASK_TRIM_TO = 1750;
+const EVICTABLE = new Set(["done", "stale"]);
+function trimTasks(state) {
+  if (state.tasks.length <= TASK_CAP) return;
+  let drop = state.tasks.length - TASK_TRIM_TO;
+  state.tasks = state.tasks.filter(t => drop <= 0 || !EVICTABLE.has(t.status) || (drop--, false));
+}
+
 function cleanBlast(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return null;
   if (v.unavailable) return { unavailable: true };
@@ -153,7 +162,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           by: b.by || "", ts: ts0, updated: ts0, history: [{ to: target, by: b.by || "", ts: ts0 }] };
         if (bgId) bt._aid = bgId; if (b.agentType) bt._atype = String(b.agentType).slice(0, 40);
         appendTaskNote(bt, b, ts0);
-        state.tasks.push(bt); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+        state.tasks.push(bt); trimTasks(state);
         appendCardEvent("created", bt, b.by, null, target);
         markDirty(); return json(res, 200, { ok: true, task: bt, created: true });
       }
@@ -180,7 +189,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       { const dr = cleanDrill(b.drill); if (dr) t.drill = dr; }                        // #6452 — the card's drill line, rides `extra`
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       appendTaskNote(t, b, ts0);
-      state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+      state.tasks.push(t); trimTasks(state);
       appendCardEvent("created", t, b.by, null, st0);
       // A COMMIT closes the focus. A focus card says "this session is working on X right now"; the
       // commit is X arriving, so the card that was rolling forever now completes with the commit
@@ -330,7 +339,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
         if (seen.has(t.todoKey) || t.status === "done") continue;   // keep accomplished work on the board
         state.tasks = state.tasks.filter(x => x.id !== t.id); appendCardEvent("deleted", t, session, null, null); markDirty();
       }
-      if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+      trimTasks(state);
       return json(res, 200, { ok: true, count: todos.length });
     }
     // A REGULAR session's live "focus" card — what THIS session is working on right now, set from each
@@ -375,7 +384,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           history: [{ to: "doing", by: session, ts: now() }] };
         state.tasks.push(t); appendCardEvent("created", t, session, null, "doing");
         appendEvent("focus", project, session, { taskId: t.id, title, shift: false });
-        if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+        trimTasks(state);
       }
       markDirty(); return json(res, 200, { ok: true, id: t.id, task: t });
     }

package/hub/routes/contract-transfer.mjs

@@ -0,0 +1,58 @@
+function heldMessages(ctx, source, project, pendingIds) {
+  const ids = new Set(pendingIds);
+  const senders = new Set(ctx.state.messages.filter(m => m.to === source && m.project === project).map(m => m.from));
+  for (const sender of senders) {
+    for (const contract of ctx.contractsFor(sender, { project, windowMs: Number.MAX_SAFE_INTEGER })) {
+      if (contract.to !== source) continue;
+      if (!contract.answered && !["ack", "superseded"].includes(contract.disposition)) ids.add(contract.id);
+    }
+  }
+  return ctx.state.messages.filter(m => ids.has(m.id) && m.to === source && m.project === project);
+}
+
+export async function routeContractTransfer({ req, res, q, P, auth, ctx }) {
+  if (P !== "/contracts/transfer") return false;
+  if (!["GET", "POST"].includes(req.method)) return ctx.json(res, 405, { error: "GET or POST required" });
+  const b = req.method === "POST" ? await ctx.body(req) : q;
+  const { from, to, project } = b;
+  if (!project || !from || !to || !from.endsWith(`:${project}`) || !to.endsWith(`:${project}`)) {
+    return ctx.json(res, 400, { error: "source and replacement must belong to the named project" });
+  }
+  const signer = auth?.identity?.name;
+  if (signer && !signer.endsWith(`:${project}`) && auth.identity.kind !== "human") {
+    return ctx.json(res, 403, { error: "swap must be requested from its project" });
+  }
+  // #11221: a seat may never move another seat's work; only the orchestrator or a human swaps.
+  if (signer && auth.identity.kind !== "human" && ctx.state.peers[signer]?.kind !== "orch") {
+    return ctx.json(res, 403, { error: "only the project's orchestrator or a human can swap seats" });
+  }
+  const messages = heldMessages(ctx, from, project, b.pendingIds || []);
+  if (req.method === "GET") return ctx.json(res, 200, { ok: true, messages });
+  if (!ctx.state.peers[b.readySession]?.lastSeen || ctx.state.peers[b.readySession].project !== project) {
+    return ctx.json(res, 409, { error: "replacement has not registered on this project's bus" });
+  }
+  // IDs and original senders survive the move, so replies settle the assigner's original ledger.
+  for (const message of messages) message.to = to;
+  const ids = new Set(messages.map(m => m.id));
+  for (const message of ctx.state.messages) {
+    if (message.project !== project) continue;
+    if (message.kind === "ask" && message.from === from && (ids.has(message.re) || message.id === b.heldAsk)) {
+      message.from = to;
+      for (const answer of ctx.state.messages) {
+        if (answer.re !== message.id || answer.to !== from) continue;
+        answer.to = to;
+        if (!ids.has(answer.id)) { messages.push(answer); ids.add(answer.id); }
+      }
+    }
+  }
+  for (const card of ctx.state.tasks) {
+    if (card.project !== project || card.assignee !== from || !["todo", "doing", "testing", "blocked", "failed"].includes(card.status)) continue;
+    card.assignee = to;
+    card.updated = ctx.now();
+    ctx.appendTaskLog(card, signer || from, `swap reassigned ${from} → ${to}`);
+    ctx.appendCardEvent("updated", card, signer || from);
+  }
+  ctx.appendEvent("crew.swap", project, signer || from, { from, to, moved: [...ids] });
+  ctx.markDirty();
+  return ctx.json(res, 200, { ok: true, moved: [...ids], messages, cursor: ctx.state.seq });
+}

package/hub/routes/messages.mjs

@@ -1,7 +1,9 @@
 /* oxlint-disable anti-slop/no-conditional-empty-object-spread -- SAFETY: Optional message fields must remain absent, not undefined; preserving the existing spread keeps the signed wire shape identical. */
+import { routeContractTransfer } from "./contract-transfer.mjs";
 import { setTimeout, setInterval, clearInterval } from "node:timers";
 
 export async function routeMessages({ req, res, q, P, auth, ctx }) {
+  if (await routeContractTransfer({ req, res, q, P, auth, ctx })) return true;
   const {
     state, body, json, stripNulText, crossProjectGuard, touch, pushToStreams,
     appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.78",
+  "version": "0.18.79",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"