trantor 0.18.82 → 0.18.86

package/bin/crew.mjs

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { seatProcesses } from "./crew/processes.mjs";
+import { allocatePersona } from "../lib/persona.mjs";
 import { join } from "node:path";
 import { call, createContext } from "./crew/core.mjs";
 import { createCmuxAdapter, spawnCmux } from "./crew/cmux.mjs";
@@ -7,7 +9,7 @@ import { resolveSpec, reportSkipped } from "./crew/models.mjs";
 import { openOrchestrator } from "./crew/open.mjs";
 import { performSwap, swapOptions, swapRuntime } from "./crew/swap.mjs";
 import { redactKeys } from "../lib/redact.mjs";
-import { reapSeat, down, prune } from "./crew/state.mjs";
+import { reapSeat, down, prune, readRows } from "./crew/state.mjs";
 import { spawnTerminal, spawnTmux } from "./crew/tmux.mjs";
 import { epochMs, failedAgents, verifyCrew } from "./crew/verify.mjs";
 import { guardCrossProjectUp } from "./crew/worktrees.mjs";
@@ -46,17 +48,16 @@ function parseUpArgs(args) {
     const arg = args[index];
     if (arg === "--task") result.task = args[++index] || "code";
     else if (arg === "--difficulty" || arg === "--diff") result.difficulty = args[++index] || "medium";
-    else result.specs.push(arg);
+    else if (arg === "--as") {
+      result.persona = args[++index];
+      if (!result.persona) throw new Error("--as requires a persona name");
+    } else result.specs.push(arg);
   }
   return result;
 }
 
 function spawnCrew(options, skipped) {
-  const resolve = spec => {
-    const seat = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
-    if (seat) reapSeat(ctx, seat.agent);
-    return seat;
-  };
+  const resolve = seat => { reapSeat(ctx, seat.persona); return seat; };
   const pruneNow = () => prune(ctx, adapters);
   if (ctx.mux === "herdr") spawnHerdr(ctx, options.specs, resolve, pruneNow);
   else if (ctx.mux === "cmux") spawnCmux(ctx, options.specs, resolve, pruneNow);
@@ -73,6 +74,7 @@ async function runUp(args, verify = true) {
   const options = parseUpArgs(args);
   const requested = resolveAgentLaunchSpecs(options.specs, readConfig());
   options.specs = requested.specs;
+  if (options.persona && options.specs.length !== 1) throw new Error("--as requires exactly one agent");
   resultSeat = options.specs.map(spec => spec.split(":")[0]).join(",");
   if (!options.specs.length) {
     console.log("usage: crew.mjs up [--task K --difficulty D] codex glm kimi deepseek (or set a default in Settings → Agents)");
@@ -87,8 +89,18 @@ async function runUp(args, verify = true) {
   console.log(`[crew] hub for ${ctx.project}: ${ctx.hub} (baked into every seat; CREW_HUB=<url> overrides)`);
   console.log(`— bringing up crew for ${ctx.project} (${ctx.mux === "terminal" ? "Terminal windows" : ctx.mux}) —`);
   // #7760: build once in the first seat's worktree before any seat gets a contract.
-  if (!ctx.dry) await preflightFirstSeat(ctx, options.specs[0].split(":")[0]);
   const skipped = [];
+  const occupied = readRows(ctx).filter(row => row.project === ctx.project).map(row => row.persona);
+  options.specs = options.specs.map(spec => {
+    const resolved = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+    if (!resolved) return null;
+    if (seatProcesses(ctx, ctx.project, resolved.agent).length && !occupied.includes(resolved.agent)) occupied.push(resolved.agent);
+    const seat = allocatePersona({ dir: join(ctx.home, ".agent-bus"), project: ctx.project, ...resolved, name: options.persona, occupied, dry: ctx.dry });
+    occupied.push(seat.persona);
+    return { ...resolved, ...seat };
+  }).filter(Boolean);
+  resultSeat = options.specs.map(seat => seat.persona).join(",");
+  if (!ctx.dry && options.specs.length) await preflightFirstSeat(ctx, options.specs[0].persona);
   const started = epochMs();
   spawnCrew(options, skipped);
   if (ctx.dry || !verify) {
@@ -96,9 +108,9 @@ async function runUp(args, verify = true) {
     return reportSkipped(skipped);
   }
   console.log("— verifying on the bus (the spawn is not the truth; the bus is) —");
-  let failed = failedAgents(verifyCrew(ctx, options.specs.map(spec => spec.split(":")[0]), started));
+  let failed = failedAgents(verifyCrew(ctx, options.specs.map(seat => seat.persona), started));
   if (failed.length) {
-    const retry = options.specs.filter(spec => failed.includes(spec.split(":")[0]));
+    const retry = options.specs.filter(seat => failed.includes(seat.persona));
     console.log(`— retrying failed spawns: ${retry.join(" ")} —`);
     options.specs = retry;
     spawnCrew(options, skipped);

package/bin/cut-snapshot.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// The shell calls this before every destructive turn sweep (#10497).
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+export function snapshotBeforeCut(workDir, reason = "stall") {
+  const git = args => {
+    const r = spawnSync("git", args, { cwd: workDir, encoding: "utf8", timeout: 20000 });
+    if (r.status !== 0) throw new Error(String(r.stderr || r.error || "git failed").trim());
+    return r.stdout;
+  };
+  try {
+    // Never capture a parent checkout when a CLI was launched in a nested scratch directory.
+    const top = git(["rev-parse", "--show-toplevel"]).trim();
+    if (realpathSync(top) !== realpathSync(workDir)) return { ok: true, files: 0 };
+    const branch = git(["symbolic-ref", "--short", "HEAD"]).trim();
+    const status = git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+    if (!status) return { ok: true, files: 0 };
+    if (!branch.startsWith("seat/")) return { ok: false, error: `dirty branch ${branch} is not a seat branch` };
+    let files = 0;
+    const rows = status.split("\0");
+    for (let i = 0; i < rows.length; i++) {
+      if (!rows[i]) continue;
+      files++;
+      if (/^[RC]|^.[RC]/.test(rows[i])) i++;
+    }
+    git(["add", "-A"]);
+    git(["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "commit", "-m", `wip: cut at ${reason}, ${files} files`]);
+    return { ok: true, files, sha: git(["rev-parse", "HEAD"]).trim() };
+  } catch (e) { return { ok: false, error: e.message }; }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const result = snapshotBeforeCut(process.argv[2], process.argv[3]);
+  if (!result.ok) console.error(`cut snapshot failed: ${result.error}`);
+  process.exit(result.ok ? 0 : 1);
+}

package/bin/gate.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+import { resolveProject } from "../lib/project.mjs";
+import { relayUrl } from "../hooks/lib/api.mjs";
+
+const [status, rawId] = process.argv.slice(2);
+const id = Number(rawId);
+if (!["go", "nogo"].includes(status) || !Number.isInteger(id) || id <= 0) {
+  console.error("usage: trantor gate go|nogo <id>");
+  process.exit(1);
+}
+let config = {};
+try { config = JSON.parse(readFileSync(join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "config.json"), "utf8")); } catch {}
+const identity = loadOrCreate(config.ownerIdentity || "admin", "human");
+try {
+  const project = resolveProject(process.cwd());
+  const r = await sfetchJson(`${relayUrl(project)}/hold/decide`, {
+    method: "POST", identity, payload: { id, status, project }, signal: AbortSignal.timeout(8000),
+  });
+  const result = await r.json();
+  if (!r.ok) throw new Error(result.error || `HTTP ${r.status}`);
+  console.log(`#${id}: ${status} — ${result.hold.file}`);
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}

package/bin/keys.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// trantor keys — identity private keys in the macOS Keychain instead of plaintext files (#11370).
+//   status [--json] · migrate [--dry-run] [--json]
+// migrate copies each file-held key into the Keychain (service trantor-identity), proves a
+// signature round-trip, and only then rewrites the file as a pubkey-only stub. Keys are never printed.
+import { migrateKeysToKeychain, keyLocationReport, IDENTITY_SERVICE } from "../lib/identity.mjs";
+
+const args = process.argv.slice(2);
+const verb = args[0] || "status";
+const JSON_MODE = args.includes("--json");
+const C = { dim: "\x1b[2m", grn: "\x1b[32m", yel: "\x1b[33m", red: "\x1b[31m", off: "\x1b[0m" };
+const usage = () => {
+  console.error("usage: trantor keys status [--json] | migrate [--dry-run] [--json]");
+  process.exit(1);
+};
+const tilde = (p) => String(p).replace(process.env.HOME || "", "~");
+const shortPub = (p) => (p ? `${p.slice(0, 16)}…` : "(unreadable)");
+
+function status() {
+  const rows = keyLocationReport();
+  if (JSON_MODE) { console.log(JSON.stringify({ service: IDENTITY_SERVICE, rows }, null, 2)); return; }
+  if (!rows.length) { console.log(`${C.dim}no identities yet (~/.agent-bus/keys is empty)${C.off}`); return; }
+  console.log(`identity keys (keychain service: ${IDENTITY_SERVICE}):`);
+  for (const r of rows) {
+    const mark = r.where === "keychain" ? `${C.grn}✓${C.off}` : r.fileKey ? `${C.yel}•${C.off}` : `${C.red}✗${C.off}`;
+    console.log(`  ${mark} ${r.name.padEnd(28)} ${shortPub(r.pubkey).padEnd(19)} ${r.where}`);
+  }
+  const plaintext = rows.filter((r) => r.fileKey);
+  if (plaintext.length) console.log(`\n${plaintext.length} key(s) still in plaintext files → trantor keys migrate`);
+}
+
+function migrate() {
+  const dryRun = args.includes("--dry-run");
+  const r = migrateKeysToKeychain({ dryRun });
+  if (JSON_MODE) { console.log(JSON.stringify(r, null, 2)); return; }
+  if (!r.usable) {
+    console.log("no Keychain on this platform (or TRANTOR_NO_KEYCHAIN=1) — identity keys stay in files; nothing to do");
+    return;
+  }
+  const did = dryRun ? "would move" : "moved";
+  console.log(`${dryRun ? `${C.dim}dry run${C.off} · ` : ""}keychain service: ${r.service}`);
+  for (const n of r.moved) console.log(`  ${C.grn}✓${C.off} ${did} ${n}${dryRun ? "" : " (file is now a pubkey-only stub)"}`);
+  for (const n of r.already) console.log(`  ${C.dim}already in the keychain: ${n}${C.off}`);
+  for (const f of r.failed) console.log(`  ${C.red}✗${C.off} ${f.name}: ${f.reason} — the file was left untouched`);
+  if (!r.moved.length && !r.failed.length && !r.already.length) console.log(`  ${C.dim}nothing to move${C.off}`);
+  if (r.failed.length) process.exit(1);
+}
+
+switch (verb) {
+  case "status": status(); break;
+  case "migrate": migrate(); break;
+  default: usage();
+}

package/bin/turn-watchdog.mjs

@@ -5,6 +5,7 @@
 //   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile] [turnStateFile]
 import { readFileSync, writeFileSync, appendFileSync, statSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { sessionActivityReader } from "../lib/session-liveness.mjs";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
 import { refreshTurnLiveness } from "../lib/turnstate.mjs";
@@ -41,6 +42,7 @@ function newestMtime(dir) {
 
 const armed = readStamp();
 if (!armed) process.exit(0);
+const sessionActivity = armed.activity ? sessionActivityReader(armed.activity) : () => 0;
 // The runner instance that armed us (pid + boot ts, so a recycled pid cannot impersonate it).
 // A stamp without a runner id (only possible mid-upgrade) skips the liveness check; the id
 // match in the loop still guards it.
@@ -56,6 +58,7 @@ const describeLast = (b) => {
   const parts = [];
   if (b.wk) parts.push(`worktree ${ago(b.wk)}`);
   if (b.tr) parts.push(`transcript ${ago(b.tr)}`);
+  if (b.cli) parts.push(`CLI session ${ago(b.cli)}`);
   return parts.length ? parts.join(", ") : "nothing";
 };
 let baseErr = errSize();
@@ -109,24 +112,25 @@ if (stallFile) {
     const size = errSize();
     if (size > baseErr + 200) { baseErr = size; lastErrAt = now; }   // new bytes: alive
     const freshCut = Math.max(armedAt, now - windowMs - SLACK);
-    const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
+    const tr = transcriptDir && !armed.activity ? newestMtime(transcriptDir) : 0;
+    const cli = sessionActivity();
     const wk = workDir ? newestMtime(workDir) : 0;
-    reportLiveness(now, tr);
-    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
+    reportLiveness(now, Math.max(tr, cli));
+    if (tr > freshCut || cli > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
       if (box && extensions < Number(box.extensionsMax) && now + poll + SLACK >= deadline) {
         extensions++;
         deadline += Number(box.extendMs);
         try { writeFileSync(box.deadlineFile, String(Math.floor(deadline / 1000))); } catch {}
         try { appendFileSync(box.extFile, JSON.stringify({ n: extensions, at: now, until: deadline }) + "\n"); } catch {}
         const card = Number(box.card) > 0 ? ` on #${box.card}` : "";
-        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
+        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk, cli })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
       }
       continue;
     }
     try { writeFileSync(stallFile, ""); } catch {}
     const mins = Math.round((now - armedAt) / 60000);
     const orch = `${hostId()}:${project}`;
-    const text = `⏱ ${session} turn STALLED — ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}); ending the turn at the stall window, not the box.`;
+    const text = `⏱ ${session} turn STALLED — ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk, cli })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}); ending the turn at the stall window, not the box.`;
     // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
     const to = orch === session ? "all" : orch;
     try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}
@@ -144,13 +148,14 @@ for (;;) {
   // count (they predate arm), and absolute freshness cannot drift the way a probe-to-probe
   // delta does when the seat writes coarsely or the machine loads (the +1130ms false alarm).
   const freshCut = Math.max(armedAt, Date.now() - windowMs - SLACK);
-  const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
+  const tr = transcriptDir && !armed.activity ? newestMtime(transcriptDir) : 0;
+  const cli = sessionActivity();
   const wk = workDir ? newestMtime(workDir) : 0;
-  reportLiveness(Date.now(), tr);
-  if (errSize() > baseErr + 200 || tr > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
+  reportLiveness(Date.now(), Math.max(tr, cli));
+  if (errSize() > baseErr + 200 || tr > freshCut || cli > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
   const mins = Math.round((Date.now() - armedAt) / 60000);
   const orch = `${hostId()}:${project}`;
-  const text = `⏱ ${session} turn STALLED — running ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}). Not killed; check its pane, or \`trantor swap\`.`;
+  const text = `⏱ ${session} turn STALLED — running ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk, cli })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}). Not killed; check its pane, or \`trantor swap\`.`;
   // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
   const to = orch === session ? "all" : orch;
   try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}

package/bin/wake-nudge.mjs

@@ -23,7 +23,8 @@ import { load } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { busDir, hostId, readConfig } from "../lib/project.mjs";
 import { ledgerPaths } from "../hooks/lib/inbox-ledger.mjs";
-import { dutyEscalations, claimDutyNudges, auditDutyNudges } from "../lib/duty-nudges.mjs";
+import { dutyEscalations, claimDutyNudges, auditDutyNudges, releaseDutyNudgeClaims } from "../lib/duty-nudges.mjs";
+import { reserveNudgeIds, releaseNudgeIds } from "../lib/nudge-ledger.mjs";
 import { recipientPanes } from "../lib/duty-recipient.mjs";
 
 const SELF = fileURLToPath(import.meta.url);
@@ -107,7 +108,7 @@ export function postNudge({ socketPath, token, sid }, ids, timeoutMs = 1500) {
   });
 }
 
-export async function wakeOnce({ api, bus = busDir(), resolver = recipient => resolveRecipient(recipient, { bus }), verifyMs = 10000, now = Date.now(), attempted = new Set(), cursor = { id: 0, ts: 0 } }) {
+export async function wakeOnce({ api, bus = busDir(), resolver = recipient => resolveRecipient(recipient, { bus }), verifyMs = 10000, now = Date.now(), attempted = new Set(), cursor = { id: 0, ts: 0 }, log = m => console.error(m) }) {
   const feed = await api(`/events?type=message&by=hub%3Aduty&since=${cursor.id}${cursor.id ? "" : "&limit=2000"}`);
   if (Number.isFinite(feed.latest) && feed.latest < cursor.id) {
     cursor.id = 0; cursor.ts = 0;
@@ -132,6 +133,18 @@ export async function wakeOnce({ api, bus = busDir(), resolver = recipient => re
     const peer = await api(`/peer?session=${encodeURIComponent(recipient)}`);
     return Number(peer.deliveredUpTo || 0) >= Number(id);
   } });
+  // #11355: the shared pre-send ledger — the duty path stamps the same files, so of the two
+  // orchestrator-wake nudgers exactly one send per unread id lands; the loser logs and stands down.
+  const skipped = [];
+  for (const target of plan.targets) {
+    const reserve = await reserveNudgeIds({ recipient: target.recipient, ids: target.ids, owner: `wake:${process.pid}`, bus, log });
+    target.ids = reserve.allowed;
+    skipped.push(...reserve.skipped.map(s => s.id));
+  }
+  plan.items = plan.items.filter(item => !skipped.includes(item.id));
+  plan.targets = plan.targets.filter(target => target.ids.length);
+  await releaseDutyNudgeClaims({ ids: skipped, statePath, owner: plan.owner });
+  if (!plan.targets.length) return { nudged: [], missing: [] };
   const observedIds = new Set();
   let result;
   try {
@@ -150,6 +163,12 @@ export async function wakeOnce({ api, bus = busDir(), resolver = recipient => re
         await sleep(100);
       }
     }));
+    // #11355: a tick that ends with unverified sends releases their stamps — the ledger must
+    // mirror the claim release below, or a failed send would silence the duty path for the TTL.
+    for (const target of plan.targets) {
+      const unverified = target.ids.filter(id => !observedIds.has(id));
+      if (unverified.length) await releaseNudgeIds({ recipient: target.recipient, ids: unverified, owner: plan.owner, bus });
+    }
   } finally {
     // #7429: release unverified claims so the duty seat retains its triage path.
     result = await auditDutyNudges({ plan, observedIds, statePath, reportFailure: async () => {} });

package/hooks/file-claim.mjs

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
 // trantor PreToolUse file-claim — before every file edit the session posts a claim and the hub answers
 // with any LIVE claim on the same file by another session, handed to the model as context.
 // Informational, never blocking: a lock server that fails open is worse than no lock. Fail-open and
 // cheap: tight timeout, per-(session,file) stamp throttles re-claims; the FIRST touch always goes out.
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, relative, isAbsolute } from "node:path";
+import { join, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { relayUrl, sessionContext, signedPost } from "./lib/api.mjs";
+import { writeOverseerLevel } from "./lib/overseer-level-cache.mjs";
+import { overlapsFor } from "../lib/remote-overlap.mjs";
 
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_CLAIM_TIMEOUT_MS || 900);
 const RECLAIM_MS = Number(process.env.RELAY_RECLAIM_MS || 60 * 1000);
@@ -41,26 +44,35 @@ try {
   const ctx = sessionContext(input.cwd);
   if (!ctx.project) allow();
   // claims compare by path, and absolute paths differ per machine — store repo-relative
-  const file = isAbsolute(abs) && !relative(ctx.projectDir, abs).startsWith("..")
-    ? relative(ctx.projectDir, abs)
-    : abs;
+  const gitRoot = gitCheckoutRoot(ctx.projectDir);
+  const absolute = resolve(ctx.projectDir, abs);
+  const rel = relative(gitRoot || ctx.projectDir, absolute);
+  const file = !rel.startsWith("..") ? rel : absolute;
 
   // throttle re-claims of the same file; never throttle its first touch
   const stampDir = join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "claims");
-  const stamp = join(stampDir, `${ctx.session} ${file}`.replace(/[^A-Za-z0-9_.-]/g, "_"));
+  const stamp = join(stampDir, `${ctx.session} ${gitRoot} ${file}`.replace(/[^A-Za-z0-9_.-]/g, "_"));
   try {
     const last = Number(readFileSync(stamp, "utf8"));
     if (Date.now() - last < RECLAIM_MS) allow();
   } catch {}
 
+  // #11311: open-PR evidence, computed HERE from this session's own checkout (the hub's gh is not
+  // logged in and its cwd is the wrong repo). Cache file makes the normal call a stat+read; off
+  // when gh is missing. Fail-open like everything else in this hook.
+  let remote = [];
+  try { remote = overlapsFor({ gitRoot, files: [file] }); } catch {}
+
   const r = await signedPost(`${relayUrl(ctx.project)}/claim`,
-    { project: ctx.project, file, session: ctx.session },
+    { project: ctx.project, file, session: ctx.session, gitRoot, remote },
     { timeoutMs: FETCH_TIMEOUT_MS, session: ctx.session });
 
   try { mkdirSync(stampDir, { recursive: true }); writeFileSync(stamp, String(Date.now())); } catch {}
 
+  if (r.ok) writeOverseerLevel({ project: ctx.project, hub: relayUrl(ctx.project) }, r.json?.level);
+
   const conflicts = r.ok ? r.json?.conflicts ?? [] : [];
-  if (!conflicts.length) allow();
+  if (Number(r.json?.level ?? 2) < 2 || !conflicts.length) allow();
 
   const who = conflicts.map(c => `${c.session} (${ago(c.agoSec)} ago)`).join(", ");
   // NO permissionDecision on purpose: additionalContext reaches the model on its own, and an "allow"

package/hooks/file-hold.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
+import { relative, resolve } from "node:path";
+import { relayUrl, sessionContext, signedPost } from "./lib/api.mjs";
+import { readOverseerLevel, writeOverseerLevel } from "./lib/overseer-level-cache.mjs";
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+    hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason,
+  } }));
+}
+
+function unavailable() {
+  process.stderr.write("trantor: file hold could not be checked; allowing this edit.\n");
+  process.stdout.write("{}");
+}
+
+try {
+  let raw = "";
+  for await (const chunk of process.stdin) raw += chunk;
+  const input = JSON.parse(raw || "{}");
+  const path = input.tool_name === "NotebookEdit" ? input.tool_input?.notebook_path : input.tool_input?.file_path;
+  const ctx = sessionContext(input.cwd);
+  if (!path || !ctx.project) process.stdout.write("{}");
+  else {
+    const cache = { project: ctx.project, hub: relayUrl(ctx.project) };
+    const level = readOverseerLevel(cache);
+    if (level !== null && level < 3) {
+      process.stdout.write("{}");
+      process.exit(0);
+    }
+    const gitRoot = gitCheckoutRoot(ctx.projectDir);
+    const absolute = resolve(ctx.projectDir, path);
+    const rel = relative(gitRoot || ctx.projectDir, absolute);
+    const file = !rel.startsWith("..") ? rel : absolute;
+    // Register and check atomically: parallel PreToolUse hooks cannot race the first claim.
+    const r = await signedPost(`${cache.hub}/hold/check`,
+      { project: ctx.project, file, session: ctx.session, gitRoot },
+      { timeoutMs: 2500, session: ctx.session });
+    if (!r.ok || !r.json?.ok) unavailable();
+    else {
+      writeOverseerLevel(cache, r.json.level);
+      if (r.json.hold) deny(r.json.hold.reason);
+      else process.stdout.write("{}");
+    }
+  }
+} catch {
+  unavailable();
+}

package/hooks/heartbeat.mjs

@@ -12,6 +12,7 @@ import { armBaton, readArm, clearArm, readConfig, contextUsage, warnFrac, alread
 import { resolveProject, hostId } from "../lib/project.mjs";
 import { installedVersion } from "./lib/update-check.mjs";   // report our hook version so the hub can flag stale sessions
 import { signedPost } from "./lib/api.mjs";
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
 
 const HEARTBEAT_MS = Number(process.env.RELAY_HEARTBEAT_MS || 60 * 1000);
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_HEARTBEAT_TIMEOUT_MS || 1500);
@@ -161,7 +162,7 @@ async function main(stdinRaw) {
   // strict test sessionstart.mjs uses), "agent" when the runner's TRANTOR_SEAT says crew seat.
   const beatKind = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === project ? "orch"
     : process.env.TRANTOR_SEAT ? "agent" : "";
-  const beatBody = { session, project,
+  const beatBody = { session, project, gitRoot: gitCheckoutRoot(projectDir),
     llm: process.env.RELAY_LLM || (process.env.RELAY_AGENT ? process.env.RELAY_AGENT.replace(/-orch$/, "") : "claude"),
     model: modelFromTranscript(stdinRaw),
     hookVersion: (() => { try { return installedVersion(); } catch { return ""; } })() };

package/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "trantor — auto-register each session + inject live roster + overseer landscape warning: linked projects, live peers, files in flight, collisions (SessionStart); turn each substantive user prompt into the session's live 'focus' card so a regular session's own work shows IN PROGRESS (UserPromptSubmit); post an in-flight 'doing' card when a sub-agent is dispatched + claim each file edit on the bus and hand the model a warning when ANOTHER live session is touching the same file (PreToolUse) and enrich it with the native agent_id + parent session when the sub-agent spawns (SubagentStart); heartbeat presence on every tool call + deliver unread bus messages to a busy session mid-turn + mirror the session's TodoWrite list onto the board as cards (PostToolUse); write a handoff before compaction (PreCompact); surface CC's own background/child agents (fork/--agent/subtask) on the board when they need input or complete (Notification); card each sub-agent's notional API cost when it finishes (SubagentStop); refuse to go idle while a peer's DIRECT message sits unread, handing it to the model instead (Stop)",
+  "description": "trantor \u2014 auto-register each session + inject live roster + overseer landscape warning: linked projects, live peers, files in flight, collisions (SessionStart); turn each substantive user prompt into the session's live 'focus' card so a regular session's own work shows IN PROGRESS (UserPromptSubmit); post an in-flight 'doing' card when a sub-agent is dispatched + claim each file edit on the bus and hand the model a warning when ANOTHER live session is touching the same file (PreToolUse) and enrich it with the native agent_id + parent session when the sub-agent spawns (SubagentStart); heartbeat presence on every tool call + deliver unread bus messages to a busy session mid-turn + mirror the session's TodoWrite list onto the board as cards (PostToolUse); write a handoff before compaction (PreCompact); surface CC's own background/child agents (fork/--agent/subtask) on the board when they need input or complete (Notification); card each sub-agent's notional API cost when it finishes (SubagentStop); refuse to go idle while a peer's DIRECT message sits unread, handing it to the model instead (Stop)",
   "hooks": {
     "SessionStart": [
       {
@@ -81,6 +81,15 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/file-hold.mjs"
+          }
+        ]
       }
     ],
     "PermissionRequest": [

package/hooks/lib/git-checkout.mjs

@@ -0,0 +1,10 @@
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+
+export function gitCheckoutRoot(directory) {
+  try {
+    const root = execFileSync("git", ["-C", directory, "rev-parse", "--show-toplevel"],
+      { encoding: "utf8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return realpathSync(root);
+  } catch { return ""; }
+}

package/hooks/lib/overseer-level-cache.mjs

@@ -0,0 +1,25 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const cacheDir = busDir => join(busDir || process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "overseer-levels");
+const cacheFile = ({ project, hub, busDir }) => join(cacheDir(busDir), createHash("sha256").update(JSON.stringify([hub, project])).digest("hex") + ".json");
+
+export function readOverseerLevel(context) {
+  try {
+    const { level: cachedLevel, ts } = JSON.parse(readFileSync(cacheFile(context), "utf8"));
+    const level = cachedLevel ?? 2;
+    const age = Date.now() - ts;
+    return [1, 2, 3, 4].includes(level) && age >= 0 && age < 60_000 ? level : null;
+  } catch { return null; }
+}
+
+export function writeOverseerLevel(context, level = 2) {
+  level ??= 2;
+  if (![1, 2, 3, 4].includes(level)) return;
+  try {
+    mkdirSync(cacheDir(context.busDir), { recursive: true });
+    writeFileSync(cacheFile(context), JSON.stringify({ level, ts: Date.now() }));
+  } catch { /* A cache write failure must not affect the edit decision. */ }
+}

package/hooks/overseer-warn.mjs

@@ -31,7 +31,7 @@ try {
   if (!r.ok || !r.json) silent();
   const c = r.json;
 
-  const level = Number(c.level || 1);
+  const level = Number(c.level ?? 2);
   const warnings = Array.isArray(c.warnings) ? c.warnings : [];
   const inflight = Array.isArray(c.inflight) ? c.inflight : [];
   const links = Array.isArray(c.links) ? c.links : [];

package/hub/auth.mjs

@@ -117,18 +117,7 @@ function projectFromRequest(P, q, b) {
   }
   return canon(String(b?.project || q?.project || "").slice(0, 80));
 }
-// --- Cross-project guard (#6228) -----------------------------------------------------------
-// scopeAllows/canRead answer "can this identity touch project P at all" — and most identities
-// are minted project:"*" role:"owner" by defaultScopesFor (any non-agent kind: an orchestrator,
-// genesis, a human). That is not a project fence; it is exactly the loophole the pr-os
-// orchestrator walked through to register seats and post contracts into crebral-com from its
-// own session, nothing it was ever working. This is the fence: does the CALLER's own project
-// (its identity name's "kind:project" suffix, the same convention defaultScopesFor reads) match
-// the project the request ACTS on. Only a declared `trantor policy link` (state.orgPolicy.links,
-// the same store /policy reads and writes — POST /policy is itself OWNER_ENDPOINTS-gated) or the
-// operator's own identity (kind "human", the key /instance/supersede already treats as owner)
-// opens the door. Applies to the five endpoints that reach across sessions or mint access:
-// /send, /task, /task/update, /register, /invite.
+// Cross-project actions require a declared link or the operator identity, even with wildcard scopes (#6228).
 const CROSS_PROJECT_ENDPOINTS = new Set(["/send", "/task", "/task/update", "/register", "/invite"]);
 function projectsLinked(a, b) {
   if (!a || !b || a === b) return true;
@@ -139,7 +128,7 @@ function projectsLinked(a, b) {
 }
 function overseerPolicy() {
   const policy = state.orgPolicy && typeof state.orgPolicy === "object" ? state.orgPolicy : {};
-  return { autonomy: { "*": 1, ...(policy.autonomy || {}) }, links: Array.isArray(policy.links) ? policy.links : [] };
+  return { autonomy: { "*": 2, ...(policy.autonomy || {}) }, links: Array.isArray(policy.links) ? policy.links : [] };
 }
 // "projPair-a" is an INSTANCE of "projPair", not a different project: the shorter name is a prefix
 // of the longer and the remainder starts with a separator, not another project's first letter.
@@ -147,18 +136,7 @@ function instanceOfProject(a, b) {
   const [lo, hi] = a.length <= b.length ? [a, b] : [b, a];
   return hi.length > lo.length && hi.startsWith(lo) && !/[a-z0-9]/i.test(hi[lo.length]);
 }
-// The caller's home project, by the SAME "name suffix after the colon" rule defaultScopesFor
-// uses to mint a fresh identity's default scope. An identity with no colon in its name (a bare
-// human alias, or a tool identity never given a project) has no home to fence — nothing to check.
-//
-// The suffix is a CONVENTION, not a fact: session ids routinely carry an instance marker after the
-// project — "agent:projPair-a" is session -a OF projPair, the same shape as the fleet's per-seat
-// session ids — and reading that whole suffix as a home project fenced a session against its OWN
-// project's register/send (#6446, red since 3e18faf). So when the identity's own scopes name
-// exactly one concrete project (what /enroll bound at enrollment, and what /invite granted), that
-// enrolled project is the home — unless the suffix names a DIFFERENT project, in which case the
-// stricter suffix wins. Wildcard-scope identities (the fence's original target: a "*" owner like
-// an orchestrator or genesis) keep the pure suffix rule unchanged.
+// Enrollment identifies instance sessions; a conflicting suffix stays stricter. Wildcard identities keep the suffix fence (#6446).
 function callerProject(auth) {
   const name = String(auth?.identity?.name || "");
   const suffix = name.includes(":") ? canon(name.slice(name.lastIndexOf(":") + 1)) : "";
@@ -197,15 +175,7 @@ function crossProjectGuard(auth, P, b) {
   return { ok: false, code: 403,
     error: `cross-project: ${home} may not act on ${target} — cross-project action is a breach unless the operator linked the projects. Run: trantor policy link ${home} ${target} --reason "<why>"` };
 }
-// Is a stored baton claim still worth honouring? The claim names the instance it spared
-// (`exceptInstanceId`), so we defer to THAT instance only while it is still being seen. A claimant
-// that died stops muzzling its twins; one that comes back starts again. Records claimed before
-// `supersededBy` existed carry no claimant, so they fall back to "is any OTHER live instance of this
-// name still carrying it?" — an orphaned flag must not outlive every possible carrier.
-// NOTE lastSeen only advances on a request, and the heartbeat is PostToolUse, so an alive-but-idle
-// claimant reads as gone after the grace window. That is the intended trade: the only session that
-// ever asks this question is one a human is actively driving right now, and deferring to a claimant
-// that has been silent for longer than the window is worse than letting the driven session work.
+// Supersession lasts while its claimant is live, with startup grace; legacy claims defer to another live instance.
 function supersessionActive(rec) {
   if (!rec?.superseded) return false;
   const cut = now() - SUPERSEDE_GRACE_MS;
@@ -231,12 +201,7 @@ async function authenticate(req, path) {
     return { ok: false, code: 401, error: "signature required" };
   }
   const raw = req.method === "GET" || req.method === "HEAD" ? undefined : await rawBody(req);
-  // WARN MODE NEVER BLOCKS — it annotates. That is its entire contract: an observation period
-  // where the hub records what WOULD fail under enforce. The restarted local hub proved the
-  // failure mode: signed requests from a not-yet-enrolled identity got 401 "unknown identity"
-  // while UNSIGNED requests passed — punishing exactly the clients that already do the right
-  // thing. Under warn: bad signature, replay and unknown identity all pass with a warning;
-  // under enforce they are the hard failures they should be.
+  // Auth warn mode annotates signature, replay and enrollment failures; enforce mode rejects them.
   const soft = (warning) => AUTH_MODE === "warn"
     ? { ok: true, mode: AUTH_MODE, trusted: false, warning }
     : { ok: false, code: 401, error: warning };
@@ -287,17 +252,7 @@ function filterReadable(auth, rows, projectOf) {
   if (AUTH_MODE !== "enforce" && !auth?.identity) return rows;
   return rows.filter(row => canRead(auth, projectOf(row)));
 }
-// DISCOVERY follows declared links, and is deliberately wider than read.
-//
-// Sending across projects was never blocked: /send authorizes against the SENDER's project, so any
-// session can DM any session id it happens to know. Only the ROSTER was scoped — which meant two
-// sessions the operator had explicitly declared codependent could not learn each other's ids. The
-// overseer would tell both of them to "coordinate over the bus" and neither could find the other,
-// so the only remaining channel was the human. That is the exact traffic-cop role this project
-// exists to delete.
-//
-// A link is an operator declaration that two projects share resources. Treating it as mutual
-// discovery grants nothing a linked pair wasn't already told to do.
+// Declared links permit mutual roster discovery without granting broader read or write access.
 function canDiscover(auth, project) {
   if (canRead(auth, project)) return true;
   const proj = canon(project || "");
@@ -375,7 +330,7 @@ const seenNonces = new Map();
     const guard = crossProjectGuard(auth, P, { scopes });
     if (!guard.ok) return json(res, guard.code, { error: guard.error });
     const ttlSec = Math.min(Math.max(Number(b0.ttlSec) || 86400, 1), 30 * 86400);
-    const token = randomBytes(24).toString("hex");
+    const token = randomBytes(32).toString("hex");
     state.inviteTokens[token] = { scopes, kind: invitedKind, expiresAt: now() + ttlSec * 1000, used: false,
       createdBy: auth.identity?.pubkey || "", createdAt: now() };
     markDirty();