@cmgmyr/hive 1.10.1 → 1.11.0

package/dist/leadState.js

@@ -1,5 +1,7 @@
+import { liveBackgroundTasks } from "./backgroundTasks.js";
 import { db } from "./db.js";
 import { FIRST_MESSAGE_SHA_ENV, firstMessageDigest } from "./firstMessage.js";
+import { postponeGrace, readActiveHandoff } from "./leadHandoffState.js";
 export function readLeadTurnState(agentId) {
     return db.prepare("SELECT * FROM lead_turn_state WHERE agent_id = ?").get(agentId) ?? null;
 }
@@ -9,7 +11,23 @@ export function leadSessionEnded(row, ownership) {
     const turn = readLeadTurnState(row.id);
     return turn?.last_event === "session_end" && turn.pane_pid === row.pane_pid ? { ended_at: turn.changed_at } : null;
 }
-function isHiveFirstMessage(payload) {
+// The hive-authored prompt shapes conversationHoldsWake excludes, as SQL over an agent_state_log
+// payload column. isHumanPrompt below is its JS twin; a parity test keeps them in step.
+export function humanPromptSql(col) {
+    const p = `CASE WHEN json_valid(${col}) THEN COALESCE(json_extract(${col}, '$.prompt'), ${col}) ELSE ${col} END`;
+    return (`${p} NOT LIKE '%[hive wake #%' AND ${p} NOT LIKE '[hive:%' AND ${p} NOT LIKE '<task-notification>%' ` +
+        `AND ${p} NOT LIKE '<cross-session-message from="%" from-name="hive">' || char(10) || '[hive:worker %] [message #%,%' || char(10) || '</cross-session-message>%'`);
+}
+// Includes SQLite LIKE's ASCII case-insensitivity.
+export function isHumanPrompt(prompt) {
+    const p = prompt.toLowerCase();
+    if (p.includes("[hive wake #") || p.startsWith("[hive:") || p.startsWith("<task-notification>"))
+        return false;
+    return !/^<cross-session-message from="[\s\S]*" from-name="hive">\n\[hive:worker [\s\S]*\] \[message #[\s\S]*,[\s\S]*\n<\/cross-session-message>/.test(p);
+}
+// The agent_state_log state label on hive's own first message to a lead; conversationHoldsWake skips it.
+export const FIRST_MESSAGE_LOG_STATE = "first_message";
+export function isHiveFirstMessage(payload) {
     if (typeof payload.prompt !== "string")
         return false;
     const prompt = payload.prompt.trim();
@@ -41,24 +59,86 @@ export function nextLeadTurn(cur, panePid, event, payload, subagentsLive) {
             return null;
     }
 }
-const applyInTransaction = db.transaction((agentId, panePid, event, payload, subagentsLive) => {
-    const cur = readLeadTurnState(agentId);
-    const next = nextLeadTurn(cur, panePid, event, payload, subagentsLive);
-    if (next === null)
+export function readLeadSafetySnapshot(agentId) {
+    return (db.prepare("SELECT * FROM lead_turn_state WHERE agent_id = ?").get(agentId) ?? null);
+}
+function applySnapshot(agentId, panePid, event, payload) {
+    const row = readLeadSafetySnapshot(agentId);
+    const sessionId = typeof payload.session_id === "string" ? payload.session_id : "";
+    if (row === null || sessionId === "" || row.pane_pid !== panePid || row.session_id !== sessionId)
         return;
-    if (cur !== null &&
-        cur.pane_pid === next.pane_pid &&
-        cur.session_id === next.session_id &&
-        cur.state === next.state &&
-        cur.idle_seq === next.idle_seq &&
-        (event !== "session_end" || cur.last_event === "session_end")) {
+    const fresh = row.snapshot_pane_pid !== panePid || row.snapshot_session_id !== sessionId;
+    const snap = {
+        prompt_seq: fresh ? 0 : row.prompt_seq,
+        human_prompt_seq: fresh ? 0 : row.human_prompt_seq,
+        human_prompt_at: fresh ? null : row.human_prompt_at,
+        transcript_path: fresh ? "" : row.transcript_path,
+        stop_prompt_seq: fresh ? null : row.stop_prompt_seq,
+        stop_background: fresh ? null : row.stop_background,
+        stop_at: fresh ? null : row.stop_at,
+    };
+    if (typeof payload.transcript_path === "string" && payload.transcript_path !== "") {
+        snap.transcript_path = payload.transcript_path;
+    }
+    const now = db.prepare("SELECT strftime('%Y-%m-%d %H:%M:%f', 'now') AS now").get().now;
+    switch (event) {
+        case "prompt":
+            snap.prompt_seq += 1;
+            if (typeof payload.prompt === "string" && !isHiveFirstMessage(payload) && isHumanPrompt(payload.prompt.trim())) {
+                snap.human_prompt_seq += 1;
+                snap.human_prompt_at = now;
+                // A human prompt during grace postpones that attempt at once; the grace owner sees it too.
+                const active = readActiveHandoff(agentId);
+                if (active?.state === "grace" && active.predecessor_session_id === sessionId) {
+                    postponeGrace(active, { predecessor_session_id: sessionId }, "a human prompt arrived during grace", true);
+                }
+            }
+            break;
+        case "stop":
+            snap.stop_prompt_seq = snap.prompt_seq;
+            snap.stop_at = now;
+            // No background_tasks in the payload is unknown evidence, never an empty list.
+            snap.stop_background = payload.background_tasks === undefined
+                ? null
+                : JSON.stringify(liveBackgroundTasks(payload.background_tasks));
+            break;
+    }
+    db.prepare(`UPDATE lead_turn_state SET snapshot_pane_pid = ?, snapshot_session_id = ?, prompt_seq = ?, human_prompt_seq = ?,
+       human_prompt_at = ?, transcript_path = ?, stop_prompt_seq = ?, stop_background = ?, stop_at = ?
+     WHERE agent_id = ?`).run(panePid, sessionId, snap.prompt_seq, snap.human_prompt_seq, snap.human_prompt_at, snap.transcript_path, snap.stop_prompt_seq, snap.stop_background, snap.stop_at, agentId);
+}
+// The states after a respawn claim, in which the predecessor's session is no longer the lead.
+export const HANDED_OFF_STATES_SQL = "('respawning', 'started', 'completed', 'ambiguous')";
+// A predecessor-session hook is fenced from the respawn claim until the handoff completes or fails;
+// the pane pid cannot tell a dying predecessor from an in-pane /resume, so the row's state decides.
+export function predecessorFence(agentId, sessionId) {
+    if (typeof sessionId !== "string" || sessionId === "")
+        return false;
+    return (db
+        .prepare(`SELECT 1 AS hit FROM lead_handoffs WHERE lead_agent_id = ? AND predecessor_session_id = ?
+           AND state IN ('respawning', 'started', 'ambiguous')`)
+        .get(agentId, sessionId) !== undefined);
+}
+const applyInTransaction = db.transaction((agentId, panePid, event, payload, subagentsLive, fenced) => {
+    if (fenced)
         return;
+    const cur = readLeadTurnState(agentId);
+    const next = nextLeadTurn(cur, panePid, event, payload, subagentsLive);
+    const unchanged = next === null ||
+        (cur !== null &&
+            cur.pane_pid === next.pane_pid &&
+            cur.session_id === next.session_id &&
+            cur.state === next.state &&
+            cur.idle_seq === next.idle_seq &&
+            (event !== "session_end" || cur.last_event === "session_end"));
+    if (!unchanged) {
+        db.prepare(`INSERT INTO lead_turn_state (agent_id, pane_pid, session_id, state, idle_seq, last_event, changed_at)
+         VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%d %H:%M:%f', 'now'))
+         ON CONFLICT(agent_id) DO UPDATE SET pane_pid = excluded.pane_pid, session_id = excluded.session_id,
+           state = excluded.state, idle_seq = excluded.idle_seq, last_event = excluded.last_event,
+           changed_at = excluded.changed_at`).run(agentId, next.pane_pid, next.session_id, next.state, next.idle_seq, event);
     }
-    db.prepare(`INSERT INTO lead_turn_state (agent_id, pane_pid, session_id, state, idle_seq, last_event, changed_at)
-       VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%d %H:%M:%f', 'now'))
-       ON CONFLICT(agent_id) DO UPDATE SET pane_pid = excluded.pane_pid, session_id = excluded.session_id,
-         state = excluded.state, idle_seq = excluded.idle_seq, last_event = excluded.last_event,
-         changed_at = excluded.changed_at`).run(agentId, next.pane_pid, next.session_id, next.state, next.idle_seq, event);
+    applySnapshot(agentId, panePid, event, payload);
 });
 export function applyLeadHook(actorId, event, payload, subagentsLive) {
     const lead = db
@@ -66,5 +146,6 @@ export function applyLeadHook(actorId, event, payload, subagentsLive) {
         .get(actorId);
     if (!lead)
         return;
-    applyInTransaction.immediate(lead.id, lead.pane_pid, event, payload, subagentsLive);
+    const fenced = predecessorFence(lead.id, payload.session_id);
+    applyInTransaction.immediate(lead.id, lead.pane_pid, event, payload, subagentsLive, fenced);
 }

package/dist/portfolio.js

@@ -3,6 +3,7 @@ import { listProjects } from "./context.js";
 import { existsSync } from "node:fs";
 import { parseTags } from "./result.js";
 import { OPEN_BLOCKERS_SQL } from "./tools/todos.js";
+import { pendingQuestionCount } from "./questions.js";
 import { leadSessionEnded, readLeadTurnState } from "./leadState.js";
 import { liveTargets, ownershipLiveness, rowOwnership } from "./tmux.js";
 export const PORTFOLIO_REASONS = [
@@ -191,6 +192,7 @@ function projectRow(project, now, snapshot) {
         workers,
         todos,
         needs_human: tagged.length,
+        questions_pending: pendingQuestionCount(project.id),
         needs_human_items: tagged.slice(0, NEEDS_HUMAN_ITEM_CAP).map((t) => ({
             todo_id: t.id,
             title: t.title,

package/dist/projectRemove.js

@@ -10,6 +10,7 @@ export const PROJECT_OWNER_TABLES = [
     "agents",
     "wakes",
     "command_trust",
+    "questions",
 ];
 const COUNTED_TABLES = [
     ...PROJECT_OWNER_TABLES.map((t) => [t, `SELECT COUNT(*) AS n FROM ${t} WHERE project_id = ?`]),

package/dist/projectYml.js

@@ -180,7 +180,14 @@ function applyLayer(root, path, source, config, sources, warnings) {
         }
         else if (isMapping(value) && typeof value.warn === "number" && Number.isInteger(value.warn) && value.warn > 0 &&
             typeof value.stop === "number" && Number.isInteger(value.stop) && value.stop > value.warn) {
-            config.lead_turn_budget = { warn: value.warn, stop: value.stop };
+            const budget = { warn: value.warn, stop: value.stop };
+            if (value.auto_handoff !== undefined) {
+                if (typeof value.auto_handoff === "boolean")
+                    budget.auto_handoff = value.auto_handoff;
+                else
+                    warn(`lead_turn_budget.auto_handoff must be true or false; ignoring "${String(value.auto_handoff)}", so automatic handoff stays off.`);
+            }
+            config.lead_turn_budget = budget;
             sources.lead_turn_budget = source;
         }
         else {

package/dist/questions.js

@@ -0,0 +1,254 @@
+import { db } from "./db.js";
+import { HUMAN_ACTOR_PREFIX } from "./context.js";
+import { assertSafeWakeBody, resolveWakeDelivery } from "./tools/wakes.js";
+const QUESTION_STATE_CONFLICT = "QUESTION_STATE_CONFLICT";
+const HEADER_MAX_CHARS = 12;
+const MIN_OPTIONS = 2;
+const MAX_OPTIONS = 4;
+function toRecord(row) {
+    const { ref_kind, ref_number, options, ...rest } = row;
+    return {
+        ...rest,
+        options: options === null ? null : JSON.parse(options),
+        ref: ref_kind === null || ref_number === null ? null : { kind: ref_kind, number: ref_number },
+    };
+}
+const blank = (s) => typeof s !== "string" || s.trim() === "";
+function validateRef(ref) {
+    if (ref === undefined)
+        return;
+    if (ref.kind !== "todo" && ref.kind !== "pr")
+        throw new Error(`ref.kind must be "todo" or "pr", got ${JSON.stringify(ref.kind)}.`);
+    if (!Number.isSafeInteger(ref.number) || ref.number <= 0)
+        throw new Error("ref.number must be a positive safe integer.");
+}
+function validateInput(input) {
+    if (input.kind !== "choice" && input.kind !== "free_text") {
+        throw new Error(`kind must be "choice" or "free_text", got ${JSON.stringify(input.kind)}.`);
+    }
+    if (blank(input.question))
+        throw new Error("question cannot be blank.");
+    if (blank(input.header))
+        throw new Error("header cannot be blank.");
+    if ([...input.header].length > HEADER_MAX_CHARS) {
+        throw new Error(`header is ${[...input.header].length} characters; the limit is ${HEADER_MAX_CHARS}.`);
+    }
+    if (blank(input.default_answer))
+        throw new Error("default_answer cannot be blank: every question carries its default.");
+    validateRef(input.ref);
+    const wakeBound = [input.question, input.header, input.default_answer];
+    if (input.kind === "free_text") {
+        if (input.options !== undefined)
+            throw new Error("a free_text question takes no options.");
+    }
+    else {
+        const options = input.options;
+        if (!Array.isArray(options) || options.length < MIN_OPTIONS || options.length > MAX_OPTIONS) {
+            throw new Error(`a choice question needs ${MIN_OPTIONS} to ${MAX_OPTIONS} options, got ${Array.isArray(options) ? options.length : 0}.`);
+        }
+        const labels = new Set();
+        for (const o of options) {
+            if (blank(o.label))
+                throw new Error("an option label cannot be blank.");
+            if (blank(o.description))
+                throw new Error(`option "${o.label}" needs a description.`);
+            if (labels.has(o.label))
+                throw new Error(`option label "${o.label}" is duplicated; labels must be distinct.`);
+            labels.add(o.label);
+            wakeBound.push(o.label, o.description);
+        }
+        const recommended = options.filter((o) => o.recommended);
+        if (recommended.length !== 1) {
+            throw new Error(`exactly one option must be recommended, got ${recommended.length}.`);
+        }
+        if (input.default_answer !== recommended[0].label) {
+            throw new Error(`default_answer must be the recommended option's label ("${recommended[0].label}").`);
+        }
+    }
+    for (const text of wakeBound)
+        assertSafeWakeBody(text);
+}
+const tokensOf = (text) => new Set((text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? []).filter((t) => [...t].length >= 4));
+const normalized = (text) => text.trim().replace(/\s+/g, " ").toLowerCase();
+export function looksSimilar(a, b) {
+    if (normalized(a) === normalized(b))
+        return true;
+    const ta = tokensOf(a);
+    const tb = tokensOf(b);
+    let shared = 0;
+    for (const t of ta)
+        if (tb.has(t))
+            shared++;
+    const union = ta.size + tb.size - shared;
+    return union > 0 && shared / union >= 0.5;
+}
+function similarPendingIds(projectId, selfId, question) {
+    const rows = db
+        .prepare("SELECT id, question FROM questions WHERE project_id = ? AND state = 'pending' AND id != ? ORDER BY id")
+        .all(projectId, selfId);
+    return rows.filter((r) => looksSimilar(question, r.question)).map((r) => r.id);
+}
+function runningAgentOf(projectId, actor) {
+    const row = db
+        .prepare("SELECT id FROM agents WHERE project_id = ? AND actor_id = ? AND status = 'running' ORDER BY id DESC LIMIT 1")
+        .get(projectId, actor);
+    return row?.id ?? null;
+}
+const optionsJson = (input) => (input.kind === "choice" ? JSON.stringify(input.options) : null);
+function pendingIdForRef(projectId, ref) {
+    const row = db
+        .prepare("SELECT id FROM questions WHERE project_id = ? AND ref_kind = ? AND ref_number = ? AND state = 'pending'")
+        .get(projectId, ref.kind, ref.number);
+    return row?.id;
+}
+const upsertQuestion = db.transaction((projectId, actor, input, askerChecked) => {
+    if (input.ref) {
+        const existing = pendingIdForRef(projectId, input.ref);
+        if (existing !== undefined) {
+            db.prepare(`UPDATE questions SET kind = ?, question = ?, header = ?, options = ?, default_answer = ?,
+             updated_at = datetime('now'), updated_by = ? WHERE id = ?`).run(input.kind, input.question, input.header, optionsJson(input), input.default_answer, actor, existing);
+            return { id: existing, created: false };
+        }
+    }
+    if (!askerChecked) {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: the pending question for this ref changed while it was being asked; ask again.`);
+    }
+    const row = db
+        .prepare(`INSERT INTO questions (project_id, asker, kind, question, header, options, default_answer,
+           ref_kind, ref_number, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id`)
+        .get(projectId, actor, input.kind, input.question, input.header, optionsJson(input), input.default_answer, input.ref?.kind ?? null, input.ref?.number ?? null, actor);
+    return { id: row.id, created: true };
+});
+export function askQuestion(projectId, actor, input) {
+    validateInput(input);
+    const refTaken = input.ref !== undefined && pendingIdForRef(projectId, input.ref) !== undefined;
+    let askerChecked = false;
+    if (!refTaken) {
+        resolveWakeDelivery(projectId);
+        askerChecked = runningAgentOf(projectId, actor) !== null;
+        if (!askerChecked) {
+            throw new Error("This session has no running hive agent row, so an answer could never be woken back to it; a question needs an asker that can be woken.");
+        }
+    }
+    const { id, created } = upsertQuestion.immediate(projectId, actor, input, askerChecked);
+    return { question_id: id, created, similar_question_ids: similarPendingIds(projectId, id, input.question) };
+}
+function fetchRow(projectId, id) {
+    const row = db.prepare("SELECT * FROM questions WHERE project_id = ? AND id = ?").get(projectId, id);
+    if (!row)
+        throw new Error(`No question ${id} in this project. Call question_list.`);
+    return row;
+}
+export function getQuestion(projectId, id) {
+    return toRecord(fetchRow(projectId, id));
+}
+export function listQuestions(projectId) {
+    const rows = db
+        .prepare("SELECT * FROM questions WHERE project_id = ? AND state IN ('pending', 'defaulted') ORDER BY (state = 'defaulted'), id")
+        .all(projectId);
+    return rows.map(toRecord);
+}
+export function pendingQuestionCount(projectId) {
+    return db.prepare("SELECT COUNT(*) AS n FROM questions WHERE project_id = ? AND state = 'pending'").get(projectId).n;
+}
+const TEXT_PATCH_KEYS = ["question", "header", "options", "default_answer"];
+const patchQuestion = db.transaction((projectId, actor, id, patch) => {
+    const current = toRecord(fetchRow(projectId, id));
+    const editsText = TEXT_PATCH_KEYS.some((k) => patch[k] !== undefined);
+    if (editsText && current.state !== "pending") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is ${current.state}; only a pending question's text can be edited.`);
+    }
+    if (patch.state !== undefined) {
+        if (patch.state !== "defaulted" && patch.state !== "withdrawn") {
+            throw new Error(`state must be "defaulted" or "withdrawn", got ${JSON.stringify(patch.state)}.`);
+        }
+        const allowed = patch.state === "withdrawn" ? ["pending", "defaulted"] : ["pending"];
+        if (!allowed.includes(current.state)) {
+            throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is ${current.state} and cannot become ${patch.state}.`);
+        }
+        if (actor !== current.asker && !actor.startsWith(HUMAN_ACTOR_PREFIX)) {
+            throw new Error(`Only the asking session (${current.asker}) or the human can mark question ${id} ${patch.state}.`);
+        }
+    }
+    let merged = null;
+    if (editsText) {
+        if (current.kind === "free_text" && patch.options !== undefined)
+            throw new Error("a free_text question takes no options.");
+        const base = {
+            question: patch.question ?? current.question,
+            header: patch.header ?? current.header,
+            default_answer: patch.default_answer ?? current.default_answer,
+            ...(current.ref ? { ref: current.ref } : {}),
+        };
+        merged =
+            current.kind === "choice"
+                ? { kind: "choice", ...base, options: patch.options ?? current.options }
+                : { kind: "free_text", ...base };
+        validateInput(merged);
+    }
+    const sets = ["updated_at = datetime('now')", "updated_by = ?"];
+    const params = [actor];
+    if (merged) {
+        sets.push("question = ?", "header = ?", "options = ?", "default_answer = ?");
+        params.push(merged.question, merged.header, optionsJson(merged), merged.default_answer);
+    }
+    if (patch.state !== undefined) {
+        sets.push("state = ?");
+        params.push(patch.state);
+    }
+    db.prepare(`UPDATE questions SET ${sets.join(", ")} WHERE id = ?`).run(...params, id);
+    return { question_id: id, state: patch.state ?? current.state };
+});
+export function updateQuestion(projectId, actor, id, patch) {
+    if (Object.keys(patch).filter((k) => patch[k] !== undefined).length === 0) {
+        throw new Error("an empty patch changes nothing; pass at least one field to change.");
+    }
+    return patchQuestion.immediate(projectId, actor, id, patch);
+}
+export function answerWakeBody(id, question, answer, notes) {
+    const head = `Question #${id} answered.\nQuestion: ${question}\nAnswer: ${answer}`;
+    return notes !== null && notes.trim() !== "" ? `${head}\nNotes: ${notes}` : head;
+}
+function planAnswerWake(projectId, row, actor) {
+    if (actor === row.asker)
+        return { skipped: "answered by the asker" };
+    const agentId = runningAgentOf(projectId, row.asker);
+    if (agentId === null)
+        return { skipped: `the asker ${row.asker} has no running agent` };
+    try {
+        return { delivery: resolveWakeDelivery(projectId, agentId) };
+    }
+    catch (e) {
+        return { skipped: e instanceof Error ? e.message : String(e) };
+    }
+}
+const commitAnswer = db.transaction((projectId, actor, id, answer, notes, plan) => {
+    const row = fetchRow(projectId, id);
+    if (row.state !== "pending" && row.state !== "defaulted") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is already ${row.state}.`);
+    }
+    db.prepare(`UPDATE questions SET state = 'answered', answer = ?, notes = ?, answered_by = ?, updated_by = ?,
+         updated_at = datetime('now') WHERE id = ?`).run(answer, notes, actor, actor, id);
+    if ("skipped" in plan)
+        return { question_id: id, wake_id: null, wake_skipped: plan.skipped };
+    const wake = db
+        .prepare(`INSERT INTO wakes (project_id, owner, body, kind, deliver_actor, deliver_pane, due_at)
+         VALUES (?, ?, ?, 'delay', ?, ?, datetime('now')) RETURNING id`)
+        .get(projectId, actor, answerWakeBody(id, row.question, answer, notes), plan.delivery.actor, plan.delivery.pane);
+    return { question_id: id, wake_id: wake.id };
+});
+export function answerQuestion(projectId, actor, id, answer, notes) {
+    if (blank(answer))
+        throw new Error("answer cannot be blank.");
+    const storedNotes = notes === undefined || notes.trim() === "" ? null : notes;
+    assertSafeWakeBody(answer);
+    if (storedNotes !== null)
+        assertSafeWakeBody(storedNotes);
+    const row = fetchRow(projectId, id);
+    if (row.state !== "pending" && row.state !== "defaulted") {
+        throw new Error(`${QUESTION_STATE_CONFLICT}: question ${id} is already ${row.state}.`);
+    }
+    const plan = planAnswerWake(projectId, row, actor);
+    return commitAnswer.immediate(projectId, actor, id, answer, storedNotes, plan);
+}

package/dist/scheduler.js

@@ -18,7 +18,9 @@ import { evaluateLeadWatch, leadSubscription } from "./leadWatch.js";
 import { describeLiveTasks, describeOneTask, liveBackgroundTasks, STALL_BOUND_SECONDS, } from "./backgroundTasks.js";
 import { MESSAGE_MAX_ROWS, MESSAGE_RETENTION } from "./leadMessage.js";
 import { CROSS_SESSION_CLOSE, postClaudeWake, senderAddress, SOCKET_WAKE_FOOTER } from "./claudeWake.js";
-import { readLeadTurnState } from "./leadState.js";
+import { driveLeadHandoff } from "./leadHandoff.js";
+import { handoffHoldsWake, HELD_REASON_HANDOFF } from "./leadHandoffState.js";
+import { FIRST_MESSAGE_LOG_STATE, humanPromptSql, readLeadTurnState } from "./leadState.js";
 import { retryQuietLeadMessages } from "./leadMessageDelivery.js";
 import { harnessFor, hasTranscriptSignal, paneClassifierFor, screenClassifiable, transcriptDirFor } from "./harnesses.js";
 import { transcriptDir, readContextFill } from "./transcript.js";
@@ -481,6 +483,17 @@ export function checkConfirmations() {
     catch {
     }
 }
+// Only the lead's own server drives its handoff; every server honours the hold it produces.
+function driveOwnLeadHandoff() {
+    const actor = process.env.HIVE_AGENT_ID;
+    if (!actor || !isLeadActorId(actor))
+        return;
+    try {
+        driveLeadHandoff(actor, (path) => loadProjectYml(path).config?.lead_turn_budget ?? null);
+    }
+    catch {
+    }
+}
 export async function tick(snapshot) {
     if (ticking)
         return;
@@ -496,6 +509,7 @@ export async function tick(snapshot) {
         janitor(snapshot);
         if (snapshot)
             reportRunningBuildChange(snapshot);
+        driveOwnLeadHandoff();
         checkConfirmations();
         pruneStateLog();
         maybeBackupHourly(db, dataDir);
@@ -667,11 +681,9 @@ function conversationHoldsWake(timer, snapshot) {
             return false;
     }
     return (stmt(`SELECT 1 AS hit FROM agent_state_log
-        WHERE actor_id = ? AND event = 'prompt' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '%[hive wake #%' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '[hive:%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<task-notification>%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<cross-session-message from="%" from-name="hive">' || char(10) || '[hive:worker %] [message #%,%' || char(10) || '</cross-session-message>%'
+        WHERE actor_id = ? AND event = 'prompt' AND state != ? AND ${humanPromptSql("payload")}
           AND created_at >= datetime('now', ?)
-        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, CONVERSATION_HOLD_TTL) !== undefined);
+        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, FIRST_MESSAGE_LOG_STATE, CONVERSATION_HOLD_TTL) !== undefined);
 }
 function heldTarget(timer) {
     const row = stmt(`SELECT id, name, kind, COALESCE(state_changed_at, '') AS blocked_since FROM agents WHERE actor_id = ?
@@ -1530,6 +1542,10 @@ function deliverable(timer, snapshot, choices) {
     else {
         owner = { rowId: row.deliver_row_id, identity: deliveryIdentity(row) };
     }
+    if (handoffHoldsWake(timer.id, row.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return { ok: false };
+    }
     // Above both pane reads: this population must not be captured at all, and the verdicts would be
     // wrong in opposite directions if they were.
     if (!screenClassifiable(timer.deliver_command)) {
@@ -1609,6 +1625,10 @@ async function withPaneClaim(timer, fn) {
     }
 }
 async function fireDelay(timer, snapshot, choices) {
+    if (handoffHoldsWake(timer.id, timer.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return;
+    }
     const disposition = noticeDisposition(timer);
     if (disposition === "aged") {
         try {

package/dist/staleServers.js

@@ -0,0 +1,122 @@
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_DATA_DIR } from "./dataDir.js";
+export const STALE_SERVER_BOUNDARY_SLACK_MS = 3000;
+const serverEntrypoint = resolve(dirname(fileURLToPath(import.meta.url)), "index.js");
+export function elapsedSeconds(value) {
+    const dayForm = /^(\d+)-(\d{1,2}):(\d{2}):(\d{2})$/.exec(value);
+    const fields = dayForm ? dayForm.slice(2).map(Number) : value.split(":").map(Number);
+    if ((!dayForm && fields.length !== 2 && fields.length !== 3) || fields.some((field) => !Number.isSafeInteger(field) || field < 0)) {
+        return null;
+    }
+    let total;
+    if (dayForm) {
+        const [hours, minutes, seconds] = fields;
+        if (hours > 23 || minutes > 59 || seconds > 59)
+            return null;
+        total = (Number(dayForm[1]) * 24 + hours) * 3600 + minutes * 60 + seconds;
+    }
+    else if (fields.length === 2) {
+        const [minutes, seconds] = fields;
+        if (seconds > 59)
+            return null;
+        total = minutes * 60 + seconds;
+    }
+    else {
+        const [hours, minutes, seconds] = fields;
+        if (minutes > 59 || seconds > 59)
+            return null;
+        total = hours * 3600 + minutes * 60 + seconds;
+    }
+    return Number.isSafeInteger(total) ? total : null;
+}
+function appliedAtInstant(appliedAt) {
+    if (!/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(appliedAt))
+        return null;
+    const instant = Date.parse(`${appliedAt.replace(" ", "T")}Z`);
+    return Number.isFinite(instant) ? instant : null;
+}
+function runsThisServer(command) {
+    const escapedPath = serverEntrypoint.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const script = new RegExp(`(?:^|\\s|["'])${escapedPath}(?=$|\\s|["'])`).exec(command);
+    if (!script)
+        return false;
+    const executable = command.slice(0, script.index + script[0].indexOf(serverEntrypoint)).trim();
+    return /(?:^|[\\/])node(?:\.exe)?$/.test(executable);
+}
+function canonicalDataDir(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+export function processUsesDataDir(psOutput, dataDir) {
+    if (psOutput.trim() === "")
+        return false;
+    if (!runsThisServer(psOutput))
+        return false;
+    const store = /(?:^|\s)HIVE_DATA_DIR=(.*?)(?=\s+[A-Za-z_][A-Za-z0-9_]*=|$)/.exec(psOutput);
+    const path = store ? store[1].trim() || DEFAULT_DATA_DIR : /(?:^|\s)PATH=/.test(psOutput) ? DEFAULT_DATA_DIR : null;
+    if (path === null)
+        return null;
+    return canonicalDataDir(path) === canonicalDataDir(dataDir);
+}
+export function parseStaleHiveServers(psOutput, appliedAt, observedAt = Date.now()) {
+    const newestMigration = appliedAtInstant(appliedAt);
+    if (newestMigration === null)
+        return { skipped: "the newest migration time is unavailable or invalid" };
+    if (!Number.isFinite(observedAt))
+        return { skipped: "the process snapshot time is invalid" };
+    const rows = [];
+    for (const line of psOutput.split(/\r?\n/)) {
+        if (line.trim() === "")
+            continue;
+        const row = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.+?)\s*$/.exec(line);
+        if (!row)
+            return { skipped: "ps returned a row that could not be parsed" };
+        const elapsed = elapsedSeconds(row[3]);
+        if (elapsed === null)
+            return { skipped: "ps returned an invalid elapsed time" };
+        rows.push({ pid: Number(row[1]), ppid: Number(row[2]), elapsed, command: row[4] });
+    }
+    const commands = new Map(rows.map((row) => [row.pid, row.command]));
+    const servers = rows
+        .map((row) => ({ ...row, started: observedAt - row.elapsed * 1000 }))
+        .filter((row) => row.started < newestMigration - STALE_SERVER_BOUNDARY_SLACK_MS && runsThisServer(row.command))
+        .map(({ elapsed: _elapsed, ...row }) => ({
+        ...row,
+        startedAt: new Date(row.started).toISOString(),
+        parentCommand: commands.get(row.ppid) ?? null,
+    }));
+    return { servers };
+}
+export function staleHiveServers(appliedAt, dataDir = DEFAULT_DATA_DIR) {
+    if (appliedAt === null)
+        return { skipped: "the newest migration time is unavailable" };
+    try {
+        const psOutput = execFileSync("ps", ["-eo", "pid=,ppid=,etime=,command="], { encoding: "utf8" });
+        const parsed = parseStaleHiveServers(psOutput, appliedAt, Date.now());
+        if ("skipped" in parsed)
+            return parsed;
+        const servers = [];
+        for (const server of parsed.servers) {
+            const envOutput = execFileSync("ps", ["eww", "-p", String(server.pid), "-o", "command="], {
+                encoding: "utf8",
+            });
+            const sameStore = processUsesDataDir(envOutput, dataDir);
+            if (sameStore === null)
+                return { skipped: "ps returned environment output that could not be parsed" };
+            if (sameStore)
+                servers.push(server);
+        }
+        return { servers };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return { skipped: `ps could not be run: ${reason}` };
+    }
+}

package/dist/tools/meta.js

@@ -36,6 +36,9 @@ export const ACTOR_OWNER_COLUMNS = [
     ["wakes", "owner"],
     ["wakes", "deliver_actor"],
     ["agent_state_log", "actor_id"],
+    ["questions", "asker"],
+    ["questions", "updated_by"],
+    ["questions", "answered_by"],
 ];
 function actorOwnsRows(actorId) {
     return ACTOR_OWNER_COLUMNS.some(([table, column]) => existsWhere(table, column, actorId));
@@ -139,7 +142,7 @@ export function registerMeta(server) {
         inputSchema: { project_id: idParam },
     }, ({ project_id }) => run(() => selectProjectById(project_id)));
     server.registerTool("project_prune", {
-        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. With project_id AND confirm_name (the project's exact name), removes that one project even when it owns rows: it takes a snapshot first, refuses while a running row owns a live pane or its pane ownership cannot be verified (agent_close row_only retires the latter), then deletes the project with everything it owns (todos, comments, pads, kv, leases, agents, wakes, trust, agent messages) in one transaction and reports per-table counts and the snapshot path. queen_audit rows naming it are kept, and so are other projects' lead-idle subscriptions that target it, so a watch on its lead ends with a named reason. confirm_name without project_id is refused, and there is no forced sweep. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
+        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust, questions), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. With project_id AND confirm_name (the project's exact name), removes that one project even when it owns rows: it takes a snapshot first, refuses while a running row owns a live pane or its pane ownership cannot be verified (agent_close row_only retires the latter), then deletes the project with everything it owns (todos, comments, pads, kv, leases, agents, wakes, trust, questions, agent messages) in one transaction and reports per-table counts and the snapshot path. queen_audit rows naming it are kept, and so are other projects' lead-idle subscriptions that target it, so a watch on its lead ends with a named reason. confirm_name without project_id is refused, and there is no forced sweep. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,