@cmgmyr/hive 1.10.0 → 1.11.0

package/dist/leadState.js

@@ -1,5 +1,7 @@
+import { liveBackgroundTasks } from "./backgroundTasks.js";
 import { db } from "./db.js";
 import { FIRST_MESSAGE_SHA_ENV, firstMessageDigest } from "./firstMessage.js";
+import { postponeGrace, readActiveHandoff } from "./leadHandoffState.js";
 export function readLeadTurnState(agentId) {
     return db.prepare("SELECT * FROM lead_turn_state WHERE agent_id = ?").get(agentId) ?? null;
 }
@@ -9,7 +11,23 @@ export function leadSessionEnded(row, ownership) {
     const turn = readLeadTurnState(row.id);
     return turn?.last_event === "session_end" && turn.pane_pid === row.pane_pid ? { ended_at: turn.changed_at } : null;
 }
-function isHiveFirstMessage(payload) {
+// The hive-authored prompt shapes conversationHoldsWake excludes, as SQL over an agent_state_log
+// payload column. isHumanPrompt below is its JS twin; a parity test keeps them in step.
+export function humanPromptSql(col) {
+    const p = `CASE WHEN json_valid(${col}) THEN COALESCE(json_extract(${col}, '$.prompt'), ${col}) ELSE ${col} END`;
+    return (`${p} NOT LIKE '%[hive wake #%' AND ${p} NOT LIKE '[hive:%' AND ${p} NOT LIKE '<task-notification>%' ` +
+        `AND ${p} NOT LIKE '<cross-session-message from="%" from-name="hive">' || char(10) || '[hive:worker %] [message #%,%' || char(10) || '</cross-session-message>%'`);
+}
+// Includes SQLite LIKE's ASCII case-insensitivity.
+export function isHumanPrompt(prompt) {
+    const p = prompt.toLowerCase();
+    if (p.includes("[hive wake #") || p.startsWith("[hive:") || p.startsWith("<task-notification>"))
+        return false;
+    return !/^<cross-session-message from="[\s\S]*" from-name="hive">\n\[hive:worker [\s\S]*\] \[message #[\s\S]*,[\s\S]*\n<\/cross-session-message>/.test(p);
+}
+// The agent_state_log state label on hive's own first message to a lead; conversationHoldsWake skips it.
+export const FIRST_MESSAGE_LOG_STATE = "first_message";
+export function isHiveFirstMessage(payload) {
     if (typeof payload.prompt !== "string")
         return false;
     const prompt = payload.prompt.trim();
@@ -41,24 +59,86 @@ export function nextLeadTurn(cur, panePid, event, payload, subagentsLive) {
             return null;
     }
 }
-const applyInTransaction = db.transaction((agentId, panePid, event, payload, subagentsLive) => {
-    const cur = readLeadTurnState(agentId);
-    const next = nextLeadTurn(cur, panePid, event, payload, subagentsLive);
-    if (next === null)
+export function readLeadSafetySnapshot(agentId) {
+    return (db.prepare("SELECT * FROM lead_turn_state WHERE agent_id = ?").get(agentId) ?? null);
+}
+function applySnapshot(agentId, panePid, event, payload) {
+    const row = readLeadSafetySnapshot(agentId);
+    const sessionId = typeof payload.session_id === "string" ? payload.session_id : "";
+    if (row === null || sessionId === "" || row.pane_pid !== panePid || row.session_id !== sessionId)
         return;
-    if (cur !== null &&
-        cur.pane_pid === next.pane_pid &&
-        cur.session_id === next.session_id &&
-        cur.state === next.state &&
-        cur.idle_seq === next.idle_seq &&
-        (event !== "session_end" || cur.last_event === "session_end")) {
+    const fresh = row.snapshot_pane_pid !== panePid || row.snapshot_session_id !== sessionId;
+    const snap = {
+        prompt_seq: fresh ? 0 : row.prompt_seq,
+        human_prompt_seq: fresh ? 0 : row.human_prompt_seq,
+        human_prompt_at: fresh ? null : row.human_prompt_at,
+        transcript_path: fresh ? "" : row.transcript_path,
+        stop_prompt_seq: fresh ? null : row.stop_prompt_seq,
+        stop_background: fresh ? null : row.stop_background,
+        stop_at: fresh ? null : row.stop_at,
+    };
+    if (typeof payload.transcript_path === "string" && payload.transcript_path !== "") {
+        snap.transcript_path = payload.transcript_path;
+    }
+    const now = db.prepare("SELECT strftime('%Y-%m-%d %H:%M:%f', 'now') AS now").get().now;
+    switch (event) {
+        case "prompt":
+            snap.prompt_seq += 1;
+            if (typeof payload.prompt === "string" && !isHiveFirstMessage(payload) && isHumanPrompt(payload.prompt.trim())) {
+                snap.human_prompt_seq += 1;
+                snap.human_prompt_at = now;
+                // A human prompt during grace postpones that attempt at once; the grace owner sees it too.
+                const active = readActiveHandoff(agentId);
+                if (active?.state === "grace" && active.predecessor_session_id === sessionId) {
+                    postponeGrace(active, { predecessor_session_id: sessionId }, "a human prompt arrived during grace", true);
+                }
+            }
+            break;
+        case "stop":
+            snap.stop_prompt_seq = snap.prompt_seq;
+            snap.stop_at = now;
+            // No background_tasks in the payload is unknown evidence, never an empty list.
+            snap.stop_background = payload.background_tasks === undefined
+                ? null
+                : JSON.stringify(liveBackgroundTasks(payload.background_tasks));
+            break;
+    }
+    db.prepare(`UPDATE lead_turn_state SET snapshot_pane_pid = ?, snapshot_session_id = ?, prompt_seq = ?, human_prompt_seq = ?,
+       human_prompt_at = ?, transcript_path = ?, stop_prompt_seq = ?, stop_background = ?, stop_at = ?
+     WHERE agent_id = ?`).run(panePid, sessionId, snap.prompt_seq, snap.human_prompt_seq, snap.human_prompt_at, snap.transcript_path, snap.stop_prompt_seq, snap.stop_background, snap.stop_at, agentId);
+}
+// The states after a respawn claim, in which the predecessor's session is no longer the lead.
+export const HANDED_OFF_STATES_SQL = "('respawning', 'started', 'completed', 'ambiguous')";
+// A predecessor-session hook is fenced from the respawn claim until the handoff completes or fails;
+// the pane pid cannot tell a dying predecessor from an in-pane /resume, so the row's state decides.
+export function predecessorFence(agentId, sessionId) {
+    if (typeof sessionId !== "string" || sessionId === "")
+        return false;
+    return (db
+        .prepare(`SELECT 1 AS hit FROM lead_handoffs WHERE lead_agent_id = ? AND predecessor_session_id = ?
+           AND state IN ('respawning', 'started', 'ambiguous')`)
+        .get(agentId, sessionId) !== undefined);
+}
+const applyInTransaction = db.transaction((agentId, panePid, event, payload, subagentsLive, fenced) => {
+    if (fenced)
         return;
+    const cur = readLeadTurnState(agentId);
+    const next = nextLeadTurn(cur, panePid, event, payload, subagentsLive);
+    const unchanged = next === null ||
+        (cur !== null &&
+            cur.pane_pid === next.pane_pid &&
+            cur.session_id === next.session_id &&
+            cur.state === next.state &&
+            cur.idle_seq === next.idle_seq &&
+            (event !== "session_end" || cur.last_event === "session_end"));
+    if (!unchanged) {
+        db.prepare(`INSERT INTO lead_turn_state (agent_id, pane_pid, session_id, state, idle_seq, last_event, changed_at)
+         VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%d %H:%M:%f', 'now'))
+         ON CONFLICT(agent_id) DO UPDATE SET pane_pid = excluded.pane_pid, session_id = excluded.session_id,
+           state = excluded.state, idle_seq = excluded.idle_seq, last_event = excluded.last_event,
+           changed_at = excluded.changed_at`).run(agentId, next.pane_pid, next.session_id, next.state, next.idle_seq, event);
     }
-    db.prepare(`INSERT INTO lead_turn_state (agent_id, pane_pid, session_id, state, idle_seq, last_event, changed_at)
-       VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%d %H:%M:%f', 'now'))
-       ON CONFLICT(agent_id) DO UPDATE SET pane_pid = excluded.pane_pid, session_id = excluded.session_id,
-         state = excluded.state, idle_seq = excluded.idle_seq, last_event = excluded.last_event,
-         changed_at = excluded.changed_at`).run(agentId, next.pane_pid, next.session_id, next.state, next.idle_seq, event);
+    applySnapshot(agentId, panePid, event, payload);
 });
 export function applyLeadHook(actorId, event, payload, subagentsLive) {
     const lead = db
@@ -66,5 +146,6 @@ export function applyLeadHook(actorId, event, payload, subagentsLive) {
         .get(actorId);
     if (!lead)
         return;
-    applyInTransaction.immediate(lead.id, lead.pane_pid, event, payload, subagentsLive);
+    const fenced = predecessorFence(lead.id, payload.session_id);
+    applyInTransaction.immediate(lead.id, lead.pane_pid, event, payload, subagentsLive, fenced);
 }

package/dist/portfolio.js

@@ -3,6 +3,7 @@ import { listProjects } from "./context.js";
 import { existsSync } from "node:fs";
 import { parseTags } from "./result.js";
 import { OPEN_BLOCKERS_SQL } from "./tools/todos.js";
+import { pendingQuestionCount } from "./questions.js";
 import { leadSessionEnded, readLeadTurnState } from "./leadState.js";
 import { liveTargets, ownershipLiveness, rowOwnership } from "./tmux.js";
 export const PORTFOLIO_REASONS = [
@@ -191,6 +192,7 @@ function projectRow(project, now, snapshot) {
         workers,
         todos,
         needs_human: tagged.length,
+        questions_pending: pendingQuestionCount(project.id),
         needs_human_items: tagged.slice(0, NEEDS_HUMAN_ITEM_CAP).map((t) => ({
             todo_id: t.id,
             title: t.title,

package/dist/projectRemove.js

@@ -10,6 +10,7 @@ export const PROJECT_OWNER_TABLES = [
     "agents",
     "wakes",
     "command_trust",
+    "questions",
 ];
 const COUNTED_TABLES = [
     ...PROJECT_OWNER_TABLES.map((t) => [t, `SELECT COUNT(*) AS n FROM ${t} WHERE project_id = ?`]),

package/dist/projectYml.js

@@ -180,7 +180,14 @@ function applyLayer(root, path, source, config, sources, warnings) {
         }
         else if (isMapping(value) && typeof value.warn === "number" && Number.isInteger(value.warn) && value.warn > 0 &&
             typeof value.stop === "number" && Number.isInteger(value.stop) && value.stop > value.warn) {
-            config.lead_turn_budget = { warn: value.warn, stop: value.stop };
+            const budget = { warn: value.warn, stop: value.stop };
+            if (value.auto_handoff !== undefined) {
+                if (typeof value.auto_handoff === "boolean")
+                    budget.auto_handoff = value.auto_handoff;
+                else
+                    warn(`lead_turn_budget.auto_handoff must be true or false; ignoring "${String(value.auto_handoff)}", so automatic handoff stays off.`);
+            }
+            config.lead_turn_budget = budget;
             sources.lead_turn_budget = source;
         }
         else {

package/dist/questions.js

@@ -0,0 +1,254 @@
+import { db } from "./db.js";
+import { HUMAN_ACTOR_PREFIX } from "./context.js";
+import { assertSafeWakeBody, resolveWakeDelivery } from "./tools/wakes.js";
+const QUESTION_STATE_CONFLICT = "QUESTION_STATE_CONFLICT";
+const HEADER_MAX_CHARS = 12;
+const MIN_OPTIONS = 2;
+const MAX_OPTIONS = 4;
+function toRecord(row) {
+    const { ref_kind, ref_number, options, ...rest } = row;
+    return {
+        ...rest,
+        options: options === null ? null : JSON.parse(options),
+        ref: ref_kind === null || ref_number === null ? null : { kind: ref_kind, number: ref_number },
+    };
+}
+const blank = (s) => typeof s !== "string" || s.trim() === "";
+function validateRef(ref) {
+    if (ref === undefined)
+        return;
+    if (ref.kind !== "todo" && ref.kind !== "pr")
+        throw new Error(`ref.kind must be "todo" or "pr", got ${JSON.stringify(ref.kind)}.`);
+    if (!Number.isSafeInteger(ref.number) || ref.number <= 0)
+        throw new Error("ref.number must be a positive safe integer.");
+}
+function validateInput(input) {
+    if (input.kind !== "choice" && input.kind !== "free_text") {
+        throw new Error(`kind must be "choice" or "free_text", got ${JSON.stringify(input.kind)}.`);
+    }
+    if (blank(input.question))
+        throw new Error("question cannot be blank.");
+    if (blank(input.header))
+        throw new Error("header cannot be blank.");
+    if ([...input.header].length > HEADER_MAX_CHARS) {
+        throw new Error(`header is ${[...input.header].length} characters; the limit is ${HEADER_MAX_CHARS}.`);
+    }
+    if (blank(input.default_answer))
+        throw new Error("default_answer cannot be blank: every question carries its default.");
+    validateRef(input.ref);
+    const wakeBound = [input.question, input.header, input.default_answer];
+    if (input.kind === "free_text") {
+        if (input.options !== undefined)
+            throw new Error("a free_text question takes no options.");
+    }
+    else {
+        const options = input.options;
+        if (!Array.isArray(options) || options.length < MIN_OPTIONS || options.length > MAX_OPTIONS) {
+            throw new Error(`a choice question needs ${MIN_OPTIONS} to ${MAX_OPTIONS} options, got ${Array.isArray(options) ? options.length : 0}.`);
+        }
+        const labels = new Set();
+        for (const o of options) {
+            if (blank(o.label))
+                throw new Error("an option label cannot be blank.");
+            if (blank(o.description))
+                throw new Error(`option "${o.label}" needs a description.`);
+            if (labels.has(o.label))
+                throw new Error(`option label "${o.label}" is duplicated; labels must be distinct.`);
+            labels.add(o.label);
+            wakeBound.push(o.label, o.description);
+        }
+        const recommended = options.filter((o) => o.recommended);
+        if (recommended.length !== 1) {
+            throw new Error(`exactly one option must be recommended, got ${recommended.length}.`);
+        }
+        if (input.default_answer !== recommended[0].label) {
+            throw new Error(`default_answer must be the recommended option's label ("${recommended[0].label}").`);
+        }
+    }
+    for (const text of wakeBound)
+        assertSafeWakeBody(text);
+}
+const tokensOf = (text) => new Set((text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? []).filter((t) => [...t].length >= 4));
+const normalized = (text) => text.trim().replace(/\s+/g, " ").toLowerCase();
+export function looksSimilar(a, b) {
+    if (normalized(a) === normalized(b))
+        return true;
+    const ta = tokensOf(a);
+    const tb = tokensOf(b);
+    let shared = 0;
+    for (const t of ta)
+        if (tb.has(t))
+            shared++;
+    const union = ta.size + tb.size - shared;
+    return union > 0 && shared / union >= 0.5;
+}
+function similarPendingIds(projectId, selfId, question) {
+    const rows = db
+        .prepare("SELECT id, question FROM questions WHERE project_id = ? AND state = 'pending' AND id != ? ORDER BY id")
+        .all(projectId, selfId);
+    return rows.filter((r) => looksSimilar(question, r.question)).map((r) => r.id);
+}
+function runningAgentOf(projectId, actor) {
+    const row = db
+        .prepare("SELECT id FROM agents WHERE project_id = ? AND actor_id = ? AND status = 'running' ORDER BY id DESC LIMIT 1")
+        .get(projectId, actor);
+    return row?.id ?? null;
+}
+const optionsJson = (input) => (input.kind === "choice" ? JSON.stringify(input.options) : null);
+function pendingIdForRef(projectId, ref) {
+    const row = db
+        .prepare("SELECT id FROM questions WHERE project_id = ? AND ref_kind = ? AND ref_number = ? AND state = 'pending'")
+        .get(projectId, ref.kind, ref.number);
+    return row?.id;
+}
+const upsertQuestion = db.transaction((projectId, actor, input, askerChecked) => {
+    if (input.ref) {
+        const existing = pendingIdForRef(projectId, input.ref);
+        if (existing !== undefined) {
+            db.prepare(`UPDATE questions SET kind = ?, question = ?, header = ?, options = ?, default_answer = ?,
+             updated_at = datetime('now'), updated_by = ? WHERE id = ?`).run(input.kind, input.question, input.header, optionsJson(input), input.default_answer, actor, existing);
+            return { id: existing, created: false };
+        }
+    }
+    if (!askerChecked) {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: the pending question for this ref changed while it was being asked; ask again.`);
+    }
+    const row = db
+        .prepare(`INSERT INTO questions (project_id, asker, kind, question, header, options, default_answer,
+           ref_kind, ref_number, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id`)
+        .get(projectId, actor, input.kind, input.question, input.header, optionsJson(input), input.default_answer, input.ref?.kind ?? null, input.ref?.number ?? null, actor);
+    return { id: row.id, created: true };
+});
+export function askQuestion(projectId, actor, input) {
+    validateInput(input);
+    const refTaken = input.ref !== undefined && pendingIdForRef(projectId, input.ref) !== undefined;
+    let askerChecked = false;
+    if (!refTaken) {
+        resolveWakeDelivery(projectId);
+        askerChecked = runningAgentOf(projectId, actor) !== null;
+        if (!askerChecked) {
+            throw new Error("This session has no running hive agent row, so an answer could never be woken back to it; a question needs an asker that can be woken.");
+        }
+    }
+    const { id, created } = upsertQuestion.immediate(projectId, actor, input, askerChecked);
+    return { question_id: id, created, similar_question_ids: similarPendingIds(projectId, id, input.question) };
+}
+function fetchRow(projectId, id) {
+    const row = db.prepare("SELECT * FROM questions WHERE project_id = ? AND id = ?").get(projectId, id);
+    if (!row)
+        throw new Error(`No question ${id} in this project. Call question_list.`);
+    return row;
+}
+export function getQuestion(projectId, id) {
+    return toRecord(fetchRow(projectId, id));
+}
+export function listQuestions(projectId) {
+    const rows = db
+        .prepare("SELECT * FROM questions WHERE project_id = ? AND state IN ('pending', 'defaulted') ORDER BY (state = 'defaulted'), id")
+        .all(projectId);
+    return rows.map(toRecord);
+}
+export function pendingQuestionCount(projectId) {
+    return db.prepare("SELECT COUNT(*) AS n FROM questions WHERE project_id = ? AND state = 'pending'").get(projectId).n;
+}
+const TEXT_PATCH_KEYS = ["question", "header", "options", "default_answer"];
+const patchQuestion = db.transaction((projectId, actor, id, patch) => {
+    const current = toRecord(fetchRow(projectId, id));
+    const editsText = TEXT_PATCH_KEYS.some((k) => patch[k] !== undefined);
+    if (editsText && current.state !== "pending") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is ${current.state}; only a pending question's text can be edited.`);
+    }
+    if (patch.state !== undefined) {
+        if (patch.state !== "defaulted" && patch.state !== "withdrawn") {
+            throw new Error(`state must be "defaulted" or "withdrawn", got ${JSON.stringify(patch.state)}.`);
+        }
+        const allowed = patch.state === "withdrawn" ? ["pending", "defaulted"] : ["pending"];
+        if (!allowed.includes(current.state)) {
+            throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is ${current.state} and cannot become ${patch.state}.`);
+        }
+        if (actor !== current.asker && !actor.startsWith(HUMAN_ACTOR_PREFIX)) {
+            throw new Error(`Only the asking session (${current.asker}) or the human can mark question ${id} ${patch.state}.`);
+        }
+    }
+    let merged = null;
+    if (editsText) {
+        if (current.kind === "free_text" && patch.options !== undefined)
+            throw new Error("a free_text question takes no options.");
+        const base = {
+            question: patch.question ?? current.question,
+            header: patch.header ?? current.header,
+            default_answer: patch.default_answer ?? current.default_answer,
+            ...(current.ref ? { ref: current.ref } : {}),
+        };
+        merged =
+            current.kind === "choice"
+                ? { kind: "choice", ...base, options: patch.options ?? current.options }
+                : { kind: "free_text", ...base };
+        validateInput(merged);
+    }
+    const sets = ["updated_at = datetime('now')", "updated_by = ?"];
+    const params = [actor];
+    if (merged) {
+        sets.push("question = ?", "header = ?", "options = ?", "default_answer = ?");
+        params.push(merged.question, merged.header, optionsJson(merged), merged.default_answer);
+    }
+    if (patch.state !== undefined) {
+        sets.push("state = ?");
+        params.push(patch.state);
+    }
+    db.prepare(`UPDATE questions SET ${sets.join(", ")} WHERE id = ?`).run(...params, id);
+    return { question_id: id, state: patch.state ?? current.state };
+});
+export function updateQuestion(projectId, actor, id, patch) {
+    if (Object.keys(patch).filter((k) => patch[k] !== undefined).length === 0) {
+        throw new Error("an empty patch changes nothing; pass at least one field to change.");
+    }
+    return patchQuestion.immediate(projectId, actor, id, patch);
+}
+export function answerWakeBody(id, question, answer, notes) {
+    const head = `Question #${id} answered.\nQuestion: ${question}\nAnswer: ${answer}`;
+    return notes !== null && notes.trim() !== "" ? `${head}\nNotes: ${notes}` : head;
+}
+function planAnswerWake(projectId, row, actor) {
+    if (actor === row.asker)
+        return { skipped: "answered by the asker" };
+    const agentId = runningAgentOf(projectId, row.asker);
+    if (agentId === null)
+        return { skipped: `the asker ${row.asker} has no running agent` };
+    try {
+        return { delivery: resolveWakeDelivery(projectId, agentId) };
+    }
+    catch (e) {
+        return { skipped: e instanceof Error ? e.message : String(e) };
+    }
+}
+const commitAnswer = db.transaction((projectId, actor, id, answer, notes, plan) => {
+    const row = fetchRow(projectId, id);
+    if (row.state !== "pending" && row.state !== "defaulted") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is already ${row.state}.`);
+    }
+    db.prepare(`UPDATE questions SET state = 'answered', answer = ?, notes = ?, answered_by = ?, updated_by = ?,
+         updated_at = datetime('now') WHERE id = ?`).run(answer, notes, actor, actor, id);
+    if ("skipped" in plan)
+        return { question_id: id, wake_id: null, wake_skipped: plan.skipped };
+    const wake = db
+        .prepare(`INSERT INTO wakes (project_id, owner, body, kind, deliver_actor, deliver_pane, due_at)
+         VALUES (?, ?, ?, 'delay', ?, ?, datetime('now')) RETURNING id`)
+        .get(projectId, actor, answerWakeBody(id, row.question, answer, notes), plan.delivery.actor, plan.delivery.pane);
+    return { question_id: id, wake_id: wake.id };
+});
+export function answerQuestion(projectId, actor, id, answer, notes) {
+    if (blank(answer))
+        throw new Error("answer cannot be blank.");
+    const storedNotes = notes === undefined || notes.trim() === "" ? null : notes;
+    assertSafeWakeBody(answer);
+    if (storedNotes !== null)
+        assertSafeWakeBody(storedNotes);
+    const row = fetchRow(projectId, id);
+    if (row.state !== "pending" && row.state !== "defaulted") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is already ${row.state}.`);
+    }
+    const plan = planAnswerWake(projectId, row, actor);
+    return commitAnswer.immediate(projectId, actor, id, answer, storedNotes, plan);
+}

package/dist/scheduler.js

@@ -18,7 +18,9 @@ import { evaluateLeadWatch, leadSubscription } from "./leadWatch.js";
 import { describeLiveTasks, describeOneTask, liveBackgroundTasks, STALL_BOUND_SECONDS, } from "./backgroundTasks.js";
 import { MESSAGE_MAX_ROWS, MESSAGE_RETENTION } from "./leadMessage.js";
 import { CROSS_SESSION_CLOSE, postClaudeWake, senderAddress, SOCKET_WAKE_FOOTER } from "./claudeWake.js";
-import { readLeadTurnState } from "./leadState.js";
+import { driveLeadHandoff } from "./leadHandoff.js";
+import { handoffHoldsWake, HELD_REASON_HANDOFF } from "./leadHandoffState.js";
+import { FIRST_MESSAGE_LOG_STATE, humanPromptSql, readLeadTurnState } from "./leadState.js";
 import { retryQuietLeadMessages } from "./leadMessageDelivery.js";
 import { harnessFor, hasTranscriptSignal, paneClassifierFor, screenClassifiable, transcriptDirFor } from "./harnesses.js";
 import { transcriptDir, readContextFill } from "./transcript.js";
@@ -481,6 +483,17 @@ export function checkConfirmations() {
     catch {
     }
 }
+// Only the lead's own server drives its handoff; every server honours the hold it produces.
+function driveOwnLeadHandoff() {
+    const actor = process.env.HIVE_AGENT_ID;
+    if (!actor || !isLeadActorId(actor))
+        return;
+    try {
+        driveLeadHandoff(actor, (path) => loadProjectYml(path).config?.lead_turn_budget ?? null);
+    }
+    catch {
+    }
+}
 export async function tick(snapshot) {
     if (ticking)
         return;
@@ -496,6 +509,7 @@ export async function tick(snapshot) {
         janitor(snapshot);
         if (snapshot)
             reportRunningBuildChange(snapshot);
+        driveOwnLeadHandoff();
         checkConfirmations();
         pruneStateLog();
         maybeBackupHourly(db, dataDir);
@@ -667,11 +681,9 @@ function conversationHoldsWake(timer, snapshot) {
             return false;
     }
     return (stmt(`SELECT 1 AS hit FROM agent_state_log
-        WHERE actor_id = ? AND event = 'prompt' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '%[hive wake #%' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '[hive:%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<task-notification>%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<cross-session-message from="%" from-name="hive">' || char(10) || '[hive:worker %] [message #%,%' || char(10) || '</cross-session-message>%'
+        WHERE actor_id = ? AND event = 'prompt' AND state != ? AND ${humanPromptSql("payload")}
           AND created_at >= datetime('now', ?)
-        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, CONVERSATION_HOLD_TTL) !== undefined);
+        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, FIRST_MESSAGE_LOG_STATE, CONVERSATION_HOLD_TTL) !== undefined);
 }
 function heldTarget(timer) {
     const row = stmt(`SELECT id, name, kind, COALESCE(state_changed_at, '') AS blocked_since FROM agents WHERE actor_id = ?
@@ -1530,6 +1542,10 @@ function deliverable(timer, snapshot, choices) {
     else {
         owner = { rowId: row.deliver_row_id, identity: deliveryIdentity(row) };
     }
+    if (handoffHoldsWake(timer.id, row.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return { ok: false };
+    }
     // Above both pane reads: this population must not be captured at all, and the verdicts would be
     // wrong in opposite directions if they were.
     if (!screenClassifiable(timer.deliver_command)) {
@@ -1609,6 +1625,10 @@ async function withPaneClaim(timer, fn) {
     }
 }
 async function fireDelay(timer, snapshot, choices) {
+    if (handoffHoldsWake(timer.id, timer.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return;
+    }
     const disposition = noticeDisposition(timer);
     if (disposition === "aged") {
         try {

package/dist/spawn.js

@@ -4,7 +4,7 @@ import { preservedRolloutPath, reapCodexHome } from "./codexHome.js";
 import { getProject } from "./context.js";
 import { dataDir, db } from "./db.js";
 import { loadProjectYml } from "./projectYml.js";
-import { applyLayout, claimInitialWindow, createWindow, DEFAULT_LAYOUT, ensureSession, crossServerRefusal, findProcessesWindow, findProjectWindow, isPaneTarget, panePidForRecord, paneWindow, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, retainOnExitArgs, rowLive, sessionName, setPaneTitle, makeProcessesWindow, tmux, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, windowOwner, windowTitle, rowOwnership, } from "./tmux.js";
+import { applyLayout, claimInitialWindow, createWindow, DEFAULT_LAYOUT, ensureSession, crossServerRefusal, findProcessesWindow, findProjectWindow, isPaneTarget, paneProcessExited, paneWindow, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, retainOnExitArgs, rowLive, sessionName, setPaneTitle, setRemainOnExit, makeProcessesWindow, tmux, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, windowOwner, windowTitle, rowOwnership, } from "./tmux.js";
 export function withWindowClaim(claim) {
     if (db.inTransaction) {
         throw new Error("withWindowClaim was called from inside an already-open transaction. better-sqlite3 nests a " +
@@ -56,13 +56,21 @@ function recordPane(agentId, target, socket, pid) {
         .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ? WHERE id = ? AND status = 'running'")
         .run(target, socket, pid, agentId).changes > 0);
 }
-function readPidOrDiscard(target) {
-    const pid = panePidForRecord(target);
-    if (pid !== "")
+// The creation pid proves the pane existed, not that its process still runs. A retained pane is
+// left to the caller's readiness wait, which reports the exit with its tail.
+function refuseIfExitedImmediately(target, retained) {
+    if (retained || paneProcessExited(target) !== true)
+        return;
+    discardOrphanedPane(target);
+    throw new Error(`The command exited immediately, so its pane ${target} was discarded rather than recorded as running. ` +
+        "Check the command and its arguments, then retry.");
+}
+export function createdPidOrDiscard(target, pid) {
+    if (/^\d+$/.test(pid))
         return pid;
     discardOrphanedPane(target);
-    throw new Error(`tmux did not report a process id for the new pane ${target} (asked twice), so it was discarded rather than ` +
-        "recorded: a row with no pane pid can never be verified as owning its pane. Retry.");
+    throw new Error(`tmux did not report a process id for the new pane ${target} when it created it, so it was discarded rather ` +
+        "than recorded: a row with no pane pid can never be verified as owning its pane. Retry.");
 }
 // Two callers, one meaning: whatever is left in the window re-tiles to the layout it was arranged
 // with. agent_close kills a worker's pane through this; stopProcess (src/processes.ts) is the only
@@ -116,10 +124,11 @@ export function upsertActor(actorId, name, kind) {
     db.prepare(`INSERT INTO actors (id, name, kind) VALUES (?, ?, ?)
      ON CONFLICT(id) DO UPDATE SET name = excluded.name, last_seen_at = datetime('now')`).run(actorId, name, kind);
 }
-function placeAgentPane(session, spec, envFlags, commandString, title) {
+function placeAgentPane(session, spec, envFlags, commandString, title, onRetainArmed = () => { }) {
     let landedInProjectId = null;
     let layoutApplied = false;
     let inProcessesWindow = false;
+    let pid = "";
     const target = withWindowClaim(() => {
         const windowName = spec.placement === "split" ? spec.projectName : title;
         const windowOwnerId = spec.placement === "split" ? spec.projectId : null;
@@ -127,10 +136,14 @@ function placeAgentPane(session, spec, envFlags, commandString, title) {
         if (started.created) {
             // Deliberate for placement "processes" too: this pane IS the new session's initial window, so it
             // takes that window rather than a tile. The caller reports it; `hive hide` moves it in later.
+            pid = started.pid;
             return claimInitialWindow(started, windowName, windowOwnerId).pane;
         }
         const splitInto = (window, layout) => {
-            const pane = tmux("split-window", "-d", "-P", "-F", "#{pane_id}", "-t", window, "-c", spec.cwd, ...envFlags, commandString, ...(spec.retainOnExit ? retainOnExitArgs(window) : []));
+            const [pane, created = ""] = tmux("split-window", "-d", "-P", "-F", "#{pane_id}\t#{pane_pid}", "-t", window, "-c", spec.cwd, ...envFlags, commandString, ...(spec.retainOnExit ? retainOnExitArgs(window) : [])).split("\t");
+            pid = created;
+            if (spec.retainOnExit)
+                onRetainArmed(window);
             applyLayout(window, layout);
             layoutApplied = true;
             return pane;
@@ -143,6 +156,9 @@ function placeAgentPane(session, spec, envFlags, commandString, title) {
             }
             else {
                 const made = createWindow(session, processesWindowName(spec.projectName), spec.cwd, envFlags, commandString, null, true, spec.retainOnExit ?? false);
+                pid = made.pid;
+                if (spec.retainOnExit)
+                    onRetainArmed(made.window);
                 makeProcessesWindow(made.window, spec.projectId);
                 pane = made.pane;
             }
@@ -160,9 +176,13 @@ function placeAgentPane(session, spec, envFlags, commandString, title) {
                 return pane;
             }
         }
-        return createWindow(session, windowName, spec.cwd, envFlags, commandString, windowOwnerId, true, spec.retainOnExit ?? false).pane;
+        const made = createWindow(session, windowName, spec.cwd, envFlags, commandString, windowOwnerId, true, spec.retainOnExit ?? false);
+        pid = made.pid;
+        if (spec.retainOnExit)
+            onRetainArmed(made.window);
+        return made.pane;
     });
-    return { target, landedInProjectId, layoutApplied, inProcessesWindow };
+    return { target, pid, landedInProjectId, layoutApplied, inProcessesWindow };
 }
 export function launchAgent(spec) {
     if (untrustedTmuxServer())
@@ -183,6 +203,7 @@ export function launchAgent(spec) {
     const agentId = Number(info.lastInsertRowid);
     const actorId = `${spec.kind}:${agentId}`;
     let paneUp = false;
+    let retainedWindow = null;
     try {
         const commandString = typeof spec.commandString === "string" ? spec.commandString : spec.commandString({ agentId, actorId });
         db.prepare("UPDATE agents SET actor_id = ?, command = ? WHERE id = ?").run(actorId, commandString, agentId);
@@ -193,16 +214,22 @@ export function launchAgent(spec) {
             : spec.env;
         const envFlags = buildEnvFlags(env);
         const title = windowTitle(spec.projectName, spec.name);
-        const { target, landedInProjectId, layoutApplied, inProcessesWindow } = placeAgentPane(session, spec, envFlags, commandString, title);
-        const pid = readPidOrDiscard(target);
+        const placed = placeAgentPane(session, spec, envFlags, commandString, title, (window) => {
+            retainedWindow = window;
+        });
+        const { target, landedInProjectId, layoutApplied, inProcessesWindow } = placed;
+        const pid = createdPidOrDiscard(target, placed.pid);
+        refuseIfExitedImmediately(target, spec.retainOnExit ?? false);
         paneUp = true;
         if (!recordPane(agentId, target, socket, pid)) {
             discardOrphanedPane(target);
             throw paneRacedRetirement(agentId);
         }
-        return { agentId, actorId, target, landedInProjectId, layoutApplied, inProcessesWindow };
+        return { agentId, actorId, target, landedInProjectId, layoutApplied, inProcessesWindow, retainedWindow };
     }
     catch (e) {
+        if (retainedWindow)
+            setRemainOnExit(retainedWindow, false);
         if (paneUp)
             throw e;
         db.prepare("DELETE FROM agents WHERE id = ?").run(agentId);
@@ -269,8 +296,10 @@ export function resumeAgent(spec) {
         });
         const session = sessionName();
         const title = windowTitle(spec.projectName, spec.name);
-        const { target, landedInProjectId } = placeAgentPane(session, spec, envFlags, spec.commandString, title);
-        const pid = readPidOrDiscard(target);
+        const placed = placeAgentPane(session, spec, envFlags, spec.commandString, title);
+        const { target, landedInProjectId } = placed;
+        const pid = createdPidOrDiscard(target, placed.pid);
+        refuseIfExitedImmediately(target, false);
         paneUp = true;
         if (!recordPane(spec.agentId, target, socket, pid)) {
             discardOrphanedPane(target);