trantor 0.18.8 → 0.18.10

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.8",
+  "version": "0.18.10",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/app.mjs

@@ -77,9 +77,21 @@ await pipeline(Readable.fromWeb(dl.body), createWriteStream(dmg));
 
 let mount = "";
 try {
-  // -nobrowse keeps the volume out of Finder; mount point is the last tab-field of the last line.
-  const out = sh("hdiutil", ["attach", "-nobrowse", "-readonly", dmg]);
-  mount = (out.trim().split("\n").pop() || "").split("\t").pop().trim();
+  // diskutil first: on macOS 26 the deprecated hdiutil shim IGNORES -nobrowse, so the mounted
+  // volume popped a Finder window mid-update and read as an install prompt (2026-08-27). Parse
+  // the mount point as everything after the last " at " — volume names can contain spaces.
+  try {
+    // real output (verified 2026-08-27): tab-separated, same shape as hdiutil —
+    // "/dev/disk12s1\tApple_HFS            \t/Volumes/Trantor" — last tab field is the mount.
+    const out = sh("diskutil", ["image", "attach", "--mountOptions", "nobrowse", "--readOnly", dmg]);
+    const line = out.trim().split("\n").filter(l => l.includes("/Volumes/")).pop() || "";
+    mount = line.split("\t").pop().trim();
+    if (!mount.startsWith("/Volumes/")) throw new Error("no mount point in diskutil output");
+  } catch {
+    // older macOS: the original hdiutil path, tab-field parse (robust to spaces)
+    const out = sh("hdiutil", ["attach", "-nobrowse", "-readonly", dmg]);
+    mount = (out.trim().split("\n").pop() || "").split("\t").pop().trim();
+  }
   const src = join(mount, "Trantor.app");
   if (!mount.startsWith("/Volumes/") || !existsSync(src)) throw new Error(`unexpected DMG layout (mount: ${mount || "none"})`);
   if (existsSync(APP)) { console.log(`replacing ${APP} (was ${have || "unknown"})`); rmSync(APP, { recursive: true, force: true }); }
@@ -91,6 +103,9 @@ try {
 } catch (e) {
   console.error(`install failed: ${e.message}`); process.exitCode = 1;
 } finally {
-  if (mount) try { sh("hdiutil", ["detach", mount, "-quiet"]); } catch {}
+  if (mount) {
+    try { sh("diskutil", ["eject", mount]); }
+    catch { try { sh("hdiutil", ["detach", mount, "-quiet"]); } catch {} }
+  }
   try { rmSync(dmg, { force: true }); } catch {}
 }

package/bin/crew.sh

@@ -46,11 +46,21 @@ HAVE_TMUX=0; command -v tmux >/dev/null 2>&1 && HAVE_TMUX=1
 # Events) — NOT the control socket — so it needs NO socket password (the socket denies external processes
 # by default; AppleScript bypasses that, exactly like we already script Terminal.app).
 HAVE_CMUX=0; [ -d "/Applications/cmux.app" ] && HAVE_CMUX=1
+# PRESENCE vs PREFERENCE: HAVE_* answer "which mux do NEW crews get" and are stomped by CREW_MUX and
+# the herdr auto-preference below. *_PRESENT answer "is this mux on the machine at all" and are what
+# PRUNE keys on — a row is validated by ITS OWN kind's liveness, never by which mux new crews prefer.
+# Conflating them let a dead cmux row survive prune the moment herdr became the preferred default.
+CMUX_PRESENT=$HAVE_CMUX
+HERDR_PRESENT=0; command -v herdr >/dev/null 2>&1 && HERDR_PRESENT=1
 # herdr (https://herdr.dev — a server-held terminal runtime: panes live in its background server, so a
-# crew survives the launcher exiting) is OPT-IN ONLY, never auto-detected — a machine with herdr
-# installed keeps its default cmux→tmux→terminal dispatch untouched. CREW_MUX=herdr is the explicit
-# switch; opting in without the binary is a HARD ERROR, because a silent fallback would defeat the ask.
+# crew survives the launcher exiting) is the PREFERRED mux when its binary is installed: it is the
+# only backend the desktop app's Workspace pane can render, so an auto-detected herdr means every
+# `trantor up` on every project shows up live in the app with no flag. (It was opt-in for exactly one
+# wave; the first thing the operator noticed was that other projects' crews stayed invisible.)
+# CREW_MUX=cmux|tmux|terminal still forces the old dispatch; CREW_MUX=herdr without the binary stays
+# a HARD ERROR, because an explicit ask must never silently fall back.
 HAVE_HERDR=0
+[ -z "${CREW_MUX:-}" ] && command -v herdr >/dev/null 2>&1 && { HAVE_HERDR=1; HAVE_CMUX=0; HAVE_TMUX=0; }
 # explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal|herdr forces the grouping UI.
 case "${CREW_MUX:-}" in
   cmux)     HAVE_CMUX=1; HAVE_TMUX=0 ;;
@@ -100,7 +110,7 @@ _cmux() { CMUX_QUIET=1 "$CMUX_BIN" "$@"; }            # quiet CLI wrapper (suppr
 _CMUX_OK=""                                          # cached: does the control socket accept us (allowAll)?
 _cmux_ok() {
   [ -n "$_CMUX_OK" ] && { [ "$_CMUX_OK" = "1" ] && return 0 || return 1; }
-  if [ "$HAVE_CMUX" = "1" ] && _cmux ping >/dev/null 2>&1; then _CMUX_OK=1; return 0; fi
+  if [ "$CMUX_PRESENT" = "1" ] && _cmux ping >/dev/null 2>&1; then _CMUX_OK=1; return 0; fi
   _CMUX_OK=0; return 1
 }
 # resolve a freshly-created workspace REF (workspace:N) → its stable UUID (survives index shifts).
@@ -409,10 +419,11 @@ prune_dead_state() {
     CLIVE="$(printf '%s' "$pair" | sed -n 1p)"
     CLIVE_NAMES="$(printf '%s' "$pair" | sed -n 2p)"
   fi
-  # herdr liveness is queried ONLY under the explicit opt-in (CREW_MUX=herdr): a default run never
-  # invokes herdr at all. Same keep-when-unprovable doctrine as cmux — no answer ⇒ rows are KEPT.
+  # herdr liveness is queried whenever the BINARY is present (herdr rows deserve validation no
+  # matter which mux new crews prefer). Same keep-when-unprovable doctrine as cmux — no answer,
+  # or no binary at all ⇒ rows are KEPT.
   local HLIVE="" HLIVE_NAMES=""
-  if [ "$HAVE_HERDR" = "1" ]; then
+  if [ "$HERDR_PRESENT" = "1" ]; then
     local hpair
     hpair="$(_herdr_ws_live)"
     HLIVE="$(printf '%s' "$hpair" | sed -n 1p)"

package/hub.mjs

@@ -343,32 +343,46 @@ function overseerTick() {
   overseerLastTick = t;
   const pol = overseerPolicy();
   const seen = new Set();
+  // Hand each party the others' session ids at the moment coordination is warranted. Telling two
+  // sessions to "coordinate over the bus" is useless if neither knows the other's id, and the
+  // warning alone went only to the duty seat and the log — so coordination needed a human to carry
+  // the ids across. Shared by the episode-start branch (all parties) and the standing branch
+  // (newcomers only): existing members never re-hear it, so a standing condition must not re-wake
+  // every party every tick.
+  const intro = (c, me, others) => {
+    const rest = others.filter(p => p !== me);
+    if (rest.length === 0) return;
+    hubSend(me,
+      `🤝 OVERSEER ${c.kind}: you and ${rest.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${rest[0]} — and split the work between you. No human needs to relay this.`,
+      c.project);
+  };
   for (const c of collisions) {
-    const key = `${c.project} ${c.kind} ${(c.sessions || []).join(",")} ${(c.files || []).join(",")}`;
+    // Episode identity is the CONDITION (project+kind+files), never the session list (#5350):
+    // membership is volatile — a third seat bouncing in and out of a standing collision minted a
+    // fresh key, so a fresh episode, so a fresh warn (+ duty wake + party intros) per permutation.
+    // Sessions are participants, not identity; current membership still rides every warn payload.
+    const key = `${c.project} ${c.kind} ${(c.files || []).join(",")}`;
     c.key = key;
     seen.add(key);
+    const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
     const standing = overseerActive.get(key);
-    if (standing) { standing.lastTick = t; c.since = standing.since; continue; }   // holds — stay quiet
-    overseerActive.set(key, { since: t, lastTick: t });
+    if (standing) {
+      // The episode HOLDS — no new warn. But a NEWCOMER to a standing collision still needs the
+      // intro: it was not present when the episode started, so it never learned the others' ids.
+      // Diff the current membership against the set the episode has already introduced, hand the
+      // intro only to newly arrived sessions, and remember them so they are not re-introduced.
+      standing.lastTick = t;
+      c.since = standing.since;
+      for (const me of parties) if (!standing.sessions.has(me)) intro(c, me, parties);
+      for (const me of parties) standing.sessions.add(me);
+      continue;
+    }
+    overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
     c.since = t;
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
     if (DUTY_SESSION) hubSend(DUTY_SESSION, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
-    // INTRODUCE the parties to each other. Telling two sessions to "coordinate over the bus" is
-    // useless if neither knows the other's session id, and until now the warning went only to the
-    // duty seat and the log — so coordination needed a human to carry the ids across. Hand each
-    // party the others' ids at the moment coordination is warranted. This sits inside the
-    // episode-start branch, so it fires ONCE per episode, not once per tick: a standing condition
-    // must not re-wake two sessions every 30 seconds.
-    const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
-    if (parties.length > 1) {
-      for (const me of parties) {
-        const others = parties.filter(p => p !== me);
-        hubSend(me,
-          `🤝 OVERSEER ${c.kind}: you and ${others.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${others[0]} — and split the work between you. No human needs to relay this.`,
-          c.project);
-      }
-    }
+    if (parties.length > 1) for (const me of parties) intro(c, me, parties);
     const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
     if (level >= 3 && c.kind === "file-conflict") {
       const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),

package/lib/project.mjs

@@ -21,6 +21,20 @@ export function gitRoot(dir) {
 export function resolveProject(cwd = process.cwd()) {
   if (process.env.RELAY_PROJECT) return process.env.RELAY_PROJECT.slice(0, 80);
   const root = gitRoot(cwd);
+  // A LINKED WORKTREE must resolve to its MAIN repo's name, not its own directory name. Seat
+  // worktrees live at ~/.agent-bus/worktrees/<project>/<agent>, so the old basename rule named the
+  // project after the AGENT — codex's seat registered as codex:codex the first time a worktree crew
+  // came up (2026-08-27), because codex spawns its MCP with a sanitized env, so the RELAY_PROJECT
+  // guard above never arrives there. git-common-dir points at the main repo's .git from any
+  // worktree; in the main repo it equals its own .git, so this is a no-op for normal checkouts.
+  if (root) {
+    try {
+      const common = execSync("git rev-parse --path-format=absolute --git-common-dir", {
+        cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000,
+      }).trim();
+      if (common.endsWith("/.git")) return basename(dirname(common)).slice(0, 80);
+    } catch {}
+  }
   return basename(root || cwd).slice(0, 80);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.8",
+  "version": "0.18.10",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"