@cmgmyr/hive 1.10.1 → 1.11.1

package/dist/scheduler.js

@@ -18,7 +18,9 @@ import { evaluateLeadWatch, leadSubscription } from "./leadWatch.js";
 import { describeLiveTasks, describeOneTask, liveBackgroundTasks, STALL_BOUND_SECONDS, } from "./backgroundTasks.js";
 import { MESSAGE_MAX_ROWS, MESSAGE_RETENTION } from "./leadMessage.js";
 import { CROSS_SESSION_CLOSE, postClaudeWake, senderAddress, SOCKET_WAKE_FOOTER } from "./claudeWake.js";
-import { readLeadTurnState } from "./leadState.js";
+import { driveLeadHandoff } from "./leadHandoff.js";
+import { handoffHoldsWake, HELD_REASON_HANDOFF } from "./leadHandoffState.js";
+import { FIRST_MESSAGE_LOG_STATE, humanPromptSql, readLeadTurnState } from "./leadState.js";
 import { retryQuietLeadMessages } from "./leadMessageDelivery.js";
 import { harnessFor, hasTranscriptSignal, paneClassifierFor, screenClassifiable, transcriptDirFor } from "./harnesses.js";
 import { transcriptDir, readContextFill } from "./transcript.js";
@@ -481,6 +483,17 @@ export function checkConfirmations() {
     catch {
     }
 }
+// Only the lead's own server drives its handoff; every server honours the hold it produces.
+function driveOwnLeadHandoff() {
+    const actor = process.env.HIVE_AGENT_ID;
+    if (!actor || !isLeadActorId(actor))
+        return;
+    try {
+        driveLeadHandoff(actor, (path) => loadProjectYml(path).config?.lead_turn_budget ?? null);
+    }
+    catch {
+    }
+}
 export async function tick(snapshot) {
     if (ticking)
         return;
@@ -496,6 +509,7 @@ export async function tick(snapshot) {
         janitor(snapshot);
         if (snapshot)
             reportRunningBuildChange(snapshot);
+        driveOwnLeadHandoff();
         checkConfirmations();
         pruneStateLog();
         maybeBackupHourly(db, dataDir);
@@ -667,11 +681,9 @@ function conversationHoldsWake(timer, snapshot) {
             return false;
     }
     return (stmt(`SELECT 1 AS hit FROM agent_state_log
-        WHERE actor_id = ? AND event = 'prompt' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '%[hive wake #%' AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '[hive:%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<task-notification>%'
-          AND CASE WHEN json_valid(payload) THEN COALESCE(json_extract(payload, '$.prompt'), payload) ELSE payload END NOT LIKE '<cross-session-message from="%" from-name="hive">' || char(10) || '[hive:worker %] [message #%,%' || char(10) || '</cross-session-message>%'
+        WHERE actor_id = ? AND event = 'prompt' AND state != ? AND ${humanPromptSql("payload")}
           AND created_at >= datetime('now', ?)
-        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, CONVERSATION_HOLD_TTL) !== undefined);
+        ORDER BY id DESC LIMIT 1`).get(timer.deliver_actor, FIRST_MESSAGE_LOG_STATE, CONVERSATION_HOLD_TTL) !== undefined);
 }
 function heldTarget(timer) {
     const row = stmt(`SELECT id, name, kind, COALESCE(state_changed_at, '') AS blocked_since FROM agents WHERE actor_id = ?
@@ -1530,6 +1542,10 @@ function deliverable(timer, snapshot, choices) {
     else {
         owner = { rowId: row.deliver_row_id, identity: deliveryIdentity(row) };
     }
+    if (handoffHoldsWake(timer.id, row.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return { ok: false };
+    }
     // Above both pane reads: this population must not be captured at all, and the verdicts would be
     // wrong in opposite directions if they were.
     if (!screenClassifiable(timer.deliver_command)) {
@@ -1609,6 +1625,10 @@ async function withPaneClaim(timer, fn) {
     }
 }
 async function fireDelay(timer, snapshot, choices) {
+    if (handoffHoldsWake(timer.id, timer.deliver_row_id)) {
+        holdTimer(timer, HELD_REASON_HANDOFF);
+        return;
+    }
     const disposition = noticeDisposition(timer);
     if (disposition === "aged") {
         try {

package/dist/staleServers.js

@@ -0,0 +1,135 @@
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_DATA_DIR } from "./dataDir.js";
+export const STALE_SERVER_BOUNDARY_SLACK_MS = 3000;
+export function readProcessEnvironment(pid) {
+    try {
+        return execFileSync("ps", ["eww", "-p", String(pid), "-o", "command="], { encoding: "utf8" });
+    }
+    catch (error) {
+        if (typeof error === "object" && error !== null && "status" in error && error.status === 1 &&
+            "stdout" in error && String(error.stdout ?? "").trim() === "" &&
+            "stderr" in error && (String(error.stderr ?? "").trim() === "" || /no such process|process id .* (?:not found|does not exist)/i.test(String(error.stderr)))) {
+            return null;
+        }
+        throw error;
+    }
+}
+const serverEntrypoint = resolve(dirname(fileURLToPath(import.meta.url)), "index.js");
+export function elapsedSeconds(value) {
+    const dayForm = /^(\d+)-(\d{1,2}):(\d{2}):(\d{2})$/.exec(value);
+    const fields = dayForm ? dayForm.slice(2).map(Number) : value.split(":").map(Number);
+    if ((!dayForm && fields.length !== 2 && fields.length !== 3) || fields.some((field) => !Number.isSafeInteger(field) || field < 0)) {
+        return null;
+    }
+    let total;
+    if (dayForm) {
+        const [hours, minutes, seconds] = fields;
+        if (hours > 23 || minutes > 59 || seconds > 59)
+            return null;
+        total = (Number(dayForm[1]) * 24 + hours) * 3600 + minutes * 60 + seconds;
+    }
+    else if (fields.length === 2) {
+        const [minutes, seconds] = fields;
+        if (seconds > 59)
+            return null;
+        total = minutes * 60 + seconds;
+    }
+    else {
+        const [hours, minutes, seconds] = fields;
+        if (minutes > 59 || seconds > 59)
+            return null;
+        total = hours * 3600 + minutes * 60 + seconds;
+    }
+    return Number.isSafeInteger(total) ? total : null;
+}
+function appliedAtInstant(appliedAt) {
+    if (!/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(appliedAt))
+        return null;
+    const instant = Date.parse(`${appliedAt.replace(" ", "T")}Z`);
+    return Number.isFinite(instant) ? instant : null;
+}
+function runsThisServer(command) {
+    const escapedPath = serverEntrypoint.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const script = new RegExp(`(?:^|\\s|["'])${escapedPath}(?=$|\\s|["'])`).exec(command);
+    if (!script)
+        return false;
+    const executable = command.slice(0, script.index + script[0].indexOf(serverEntrypoint)).trim();
+    return /(?:^|[\\/])node(?:\.exe)?$/.test(executable);
+}
+function canonicalDataDir(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+export function processUsesDataDir(psOutput, dataDir) {
+    if (psOutput.trim() === "")
+        return false;
+    if (!runsThisServer(psOutput))
+        return false;
+    const store = /(?:^|\s)HIVE_DATA_DIR=(.*?)(?=\s+[A-Za-z_][A-Za-z0-9_]*=|$)/.exec(psOutput);
+    const path = store ? store[1].trim() || DEFAULT_DATA_DIR : /(?:^|\s)PATH=/.test(psOutput) ? DEFAULT_DATA_DIR : null;
+    if (path === null)
+        return null;
+    return canonicalDataDir(path) === canonicalDataDir(dataDir);
+}
+export function parseStaleHiveServers(psOutput, appliedAt, observedAt = Date.now()) {
+    const newestMigration = appliedAtInstant(appliedAt);
+    if (newestMigration === null)
+        return { skipped: "the newest migration time is unavailable or invalid" };
+    if (!Number.isFinite(observedAt))
+        return { skipped: "the process snapshot time is invalid" };
+    const rows = [];
+    for (const line of psOutput.split(/\r?\n/)) {
+        if (line.trim() === "")
+            continue;
+        const row = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.+?)\s*$/.exec(line);
+        if (!row)
+            return { skipped: "ps returned a row that could not be parsed" };
+        const elapsed = elapsedSeconds(row[3]);
+        if (elapsed === null)
+            return { skipped: "ps returned an invalid elapsed time" };
+        rows.push({ pid: Number(row[1]), ppid: Number(row[2]), elapsed, command: row[4] });
+    }
+    const commands = new Map(rows.map((row) => [row.pid, row.command]));
+    const servers = rows
+        .map((row) => ({ ...row, started: observedAt - row.elapsed * 1000 }))
+        .filter((row) => row.started < newestMigration - STALE_SERVER_BOUNDARY_SLACK_MS && runsThisServer(row.command))
+        .map(({ elapsed: _elapsed, ...row }) => ({
+        ...row,
+        startedAt: new Date(row.started).toISOString(),
+        parentCommand: commands.get(row.ppid) ?? null,
+    }));
+    return { servers };
+}
+export function staleHiveServers(appliedAt, dataDir = DEFAULT_DATA_DIR, readEnvironment = readProcessEnvironment) {
+    if (appliedAt === null)
+        return { skipped: "the newest migration time is unavailable" };
+    try {
+        const psOutput = execFileSync("ps", ["-eo", "pid=,ppid=,etime=,command="], { encoding: "utf8" });
+        const parsed = parseStaleHiveServers(psOutput, appliedAt, Date.now());
+        if ("skipped" in parsed)
+            return parsed;
+        const servers = [];
+        for (const server of parsed.servers) {
+            const envOutput = readEnvironment(server.pid);
+            if (envOutput === null)
+                continue;
+            const sameStore = processUsesDataDir(envOutput, dataDir);
+            if (sameStore === null)
+                return { skipped: "ps returned environment output that could not be parsed" };
+            if (sameStore)
+                servers.push(server);
+        }
+        return { servers };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return { skipped: `ps could not be run: ${reason}` };
+    }
+}

package/dist/tools/agents.js

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { db } from "../db.js";
 import { confirmQueenWrite } from "../queenAudit.js";
-import { captureQueenWriteIdentity } from "../context.js";
+import { captureQueenWriteIdentity, resolveQueenLeadTarget } from "../context.js";
 import { agentBriefPath, mergedBriefVars, readAgentBrief, workerBrief, workerCommandString, writeAgentBrief, } from "../brief.js";
 import { codexHomeDir, codexInstructionsPhrase, codexLaunchArgs, ensureCodexHome, ensureCodexHooksFile, refreshCodexMcpEnv } from "../codexHome.js";
 import { currentActor, findProjectForDir, getProject, linkedWorktreePrimaryRoot, resolveProject } from "../context.js";
@@ -1171,7 +1171,7 @@ export function registerAgents(server) {
         },
     }, (args) => run(async () => {
         const project = resolveProject(args.project_id);
-        const agent = findAgent(project.id, args);
+        const agent = resolveQueenLeadTarget("agent_send", project.id, args.agent_id ?? args.name, () => findAgent(project.id, args));
         requireLive(agent);
         const target = agent.tmux_target;
         const auditIdentity = captureQueenWriteIdentity(project.id);

package/dist/tools/meta.js

@@ -36,6 +36,9 @@ export const ACTOR_OWNER_COLUMNS = [
     ["wakes", "owner"],
     ["wakes", "deliver_actor"],
     ["agent_state_log", "actor_id"],
+    ["questions", "asker"],
+    ["questions", "updated_by"],
+    ["questions", "answered_by"],
 ];
 function actorOwnsRows(actorId) {
     return ACTOR_OWNER_COLUMNS.some(([table, column]) => existsWhere(table, column, actorId));
@@ -139,7 +142,7 @@ export function registerMeta(server) {
         inputSchema: { project_id: idParam },
     }, ({ project_id }) => run(() => selectProjectById(project_id)));
     server.registerTool("project_prune", {
-        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. With project_id AND confirm_name (the project's exact name), removes that one project even when it owns rows: it takes a snapshot first, refuses while a running row owns a live pane or its pane ownership cannot be verified (agent_close row_only retires the latter), then deletes the project with everything it owns (todos, comments, pads, kv, leases, agents, wakes, trust, agent messages) in one transaction and reports per-table counts and the snapshot path. queen_audit rows naming it are kept, and so are other projects' lead-idle subscriptions that target it, so a watch on its lead ends with a named reason. confirm_name without project_id is refused, and there is no forced sweep. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
+        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust, questions), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. With project_id AND confirm_name (the project's exact name), removes that one project even when it owns rows: it takes a snapshot first, refuses while a running row owns a live pane or its pane ownership cannot be verified (agent_close row_only retires the latter), then deletes the project with everything it owns (todos, comments, pads, kv, leases, agents, wakes, trust, questions, agent messages) in one transaction and reports per-table counts and the snapshot path. queen_audit rows naming it are kept, and so are other projects' lead-idle subscriptions that target it, so a watch on its lead ends with a named reason. confirm_name without project_id is refused, and there is no forced sweep. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,

package/dist/tools/queenAudit.js

@@ -3,7 +3,7 @@ import { run } from "../result.js";
 import { idParam, limitParam } from "./params.js";
 export function registerQueenAudit(server) {
     server.registerTool("queen_audit_list", {
-        description: "List confirmed queen writes into other projects, newest first. The queen may read all targets; other callers see only their own project. Default 20, maximum 100 entries. History is retained for 30 days with a 20,000 id-range backstop. A crash between a completed terminal send and its audit insert can leave that send unrecorded.",
+        description: "List confirmed queen writes and refused cross-project guard calls, newest first. Refusal rows include outcome=refused and the problem. The queen may read all targets; other callers see only their own project. Default 20, maximum 100 entries. History is retained for 30 days with a 20,000 id-range backstop. A crash between a completed terminal send and its audit insert can leave that send unrecorded.",
         annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
         inputSchema: {
             project_id: idParam.optional().describe("Filter by the target project id. Only the queen may name another project."),

package/dist/tools/questions.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+import { currentActor, effectiveProjectId } from "../context.js";
+import { run } from "../result.js";
+import { answerQuestion, askQuestion, getQuestion, listQuestions, updateQuestion, } from "../questions.js";
+import { idParam } from "./params.js";
+const optionParam = z.strictObject({
+    label: z.string().describe("Short choice label; distinct within the question."),
+    description: z.string().describe("What choosing this means."),
+    recommended: z.boolean().describe("Exactly one option is recommended; it is the default."),
+});
+const refParam = z.strictObject({
+    kind: z.enum(["todo", "pr"]),
+    number: idParam.describe("A todo id or PR number. An identifier, not looked up."),
+});
+const stateParam = z.enum(["answered", "defaulted", "pending", "withdrawn"]);
+const noWrites = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
+const writes = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false };
+export function registerQuestions(server) {
+    server.registerTool("question_ask", {
+        description: "Record an open question for the human, keyed to this project and to you as the asker. kind=choice takes 2-4 options (each label, description, recommended; exactly one recommended) and a header of 12 characters or fewer; kind=free_text takes just the question and header. Every question carries default_answer: for a choice it is the recommended option's label. Pass ref (a todo id or PR number) to dedupe: asking again with a ref that already has a PENDING question in this project updates that row instead of adding one. The receipt lists other pending questions in this project that look similar (same normalized text, or at least half their longer words shared), so you can question_update one instead. The record is only stored: put the question to the human yourself, in your own turn. You must be a session an answer can be woken back to. When the question is answered, an ordinary wake carrying the answer is queued to you; read the record with question_get.",
+        annotations: writes,
+        inputSchema: {
+            kind: z.enum(["choice", "free_text"]),
+            question: z.string(),
+            header: z.string().describe("12 characters or fewer."),
+            options: z.array(optionParam).optional().describe("Required for choice, forbidden for free_text."),
+            default_answer: z.string().describe("What you do if unanswered. For a choice, the recommended label."),
+            ref: refParam.optional(),
+        },
+        outputSchema: {
+            question_id: idParam,
+            created: z.boolean(),
+            similar_question_ids: z.array(idParam),
+        },
+    }, (args) => run(() => {
+        const projectId = effectiveProjectId();
+        const input = {
+            kind: args.kind,
+            question: args.question,
+            header: args.header,
+            default_answer: args.default_answer,
+            ...(args.options !== undefined ? { options: args.options } : {}),
+            ...(args.ref !== undefined ? { ref: args.ref } : {}),
+        };
+        return askQuestion(projectId, currentActor(), input);
+    }));
+    server.registerTool("question_get", {
+        description: "Read one question in this project by id, in any state, with its answer and notes once answered.",
+        annotations: noWrites,
+        inputSchema: { question_id: idParam },
+    }, (args) => run(() => getQuestion(effectiveProjectId(), args.question_id)));
+    server.registerTool("question_list", {
+        description: "List this project's pending questions, then its defaulted ones (acted on by default, still open to reversal), oldest first within each group. Answered and withdrawn questions are not listed; read one by id with question_get.",
+        annotations: noWrites,
+        inputSchema: {},
+    }, () => run(() => ({ questions: listQuestions(effectiveProjectId()) })));
+    server.registerTool("question_update", {
+        description: "Edit a pending question's text (question, header, options, default_answer; the whole result is revalidated) or move it out of pending with state=defaulted (you acted on your default) or state=withdrawn (moot). A defaulted question can still be withdrawn. Moving state needs the asking session or the human; an answered or withdrawn question cannot be changed. The ref, asker and wake target never change.",
+        annotations: writes,
+        inputSchema: {
+            question_id: idParam,
+            question: z.string().optional(),
+            header: z.string().optional(),
+            options: z.array(optionParam).optional(),
+            default_answer: z.string().optional(),
+            state: z.enum(["defaulted", "withdrawn"]).optional(),
+        },
+        outputSchema: { question_id: idParam, state: stateParam },
+    }, (args) => run(() => {
+        const { question_id, ...patch } = args;
+        return updateQuestion(effectiveProjectId(), currentActor(), question_id, patch);
+    }));
+    server.registerTool("question_answer", {
+        description: "Record the human's answer to a pending or defaulted question in this project, plus optional notes. The answer may be a picked option label or free text, including text outside the offered labels. The answer update comes first; the answer and any wake commit together, and the answer stays readable with `question_get`. An answered or withdrawn question refuses with `QUESTION_STATE_CONFLICT`. A queued wake carries the question, answer and notes verbatim. When you are the asker, skip with `wake_id: null` and `wake_skipped`; otherwise, queue a wake to the running asker or, if the asker has no running row, to the project's running lead with `wake_rerouted_to`. Skip that fallback with `wake_id: null` and `wake_skipped` if no lead runs or the lead is the answerer. `wake_id` means queued, not delivered.",
+        annotations: writes,
+        inputSchema: {
+            question_id: idParam,
+            answer: z.string(),
+            notes: z.string().optional(),
+        },
+        outputSchema: {
+            question_id: idParam,
+            wake_id: idParam.nullable(),
+            wake_skipped: z.string().optional(),
+            wake_rerouted_to: z.string().optional(),
+        },
+    }, (args) => run(() => answerQuestion(effectiveProjectId(), currentActor(), args.question_id, args.answer, args.notes)));
+}

package/dist/tools/wakes.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { db } from "../db.js";
 import { commitQueenStateWrite } from "../queenAudit.js";
-import { currentActor, effectiveProjectId, getProject, isQueenLead } from "../context.js";
+import { captureQueenWriteIdentity, currentActor, effectiveProjectId, getProject, isQueenLead, resolveQueenLeadTarget, } from "../context.js";
 import { run } from "../result.js";
 import { findAgent, observeOwnership, notOwnedError, summaryLiveness } from "./agents.js";
 import { ACTIVE_TIMER_WHERE, LOG_RETENTION, OWNED_BY_WATCH, WATCH_SCOPE_PROJECT, seedGoneCursor, } from "../scheduler.js";
@@ -35,9 +35,11 @@ function refuseUnclassifiableTarget(agent) {
         "error you can read now. Drive this pane with agent_send(keys: [...]) instead, which is unguarded for " +
         "exactly this reason.");
 }
-function resolveDelivery(projectId, deliverTo) {
+export function resolveWakeDelivery(projectId, deliverTo, queenOperation) {
     if (deliverTo != null) {
-        const agent = resolveAgentRef(projectId, deliverTo);
+        const agent = queenOperation
+            ? resolveQueenLeadTarget(queenOperation, projectId, deliverTo, () => resolveAgentRef(projectId, deliverTo))
+            : resolveAgentRef(projectId, deliverTo);
         // Before the liveness probe: the harness is a durable fact about the row, while liveness is a
         // question about right now, so a dead bash worker should say what is actually wrong with it.
         refuseUnclassifiableTarget(agent);
@@ -52,18 +54,24 @@ function resolveDelivery(projectId, deliverTo) {
     const own = db
         .prepare("SELECT * FROM agents WHERE actor_id = ? AND status = 'running' ORDER BY id DESC LIMIT 1")
         .get(actor);
+    if (queenOperation && !own && captureQueenWriteIdentity(projectId)) {
+        resolveQueenLeadTarget(queenOperation, projectId, deliverTo, () => {
+            throw new Error("the calling session has no running agent row to receive this wake");
+        });
+    }
     // Checked on the ROW, not behind the liveness probe: isLive is three-state, and letting a null
     // fall through to the TMUX_PANE branch below accepts a wake the scheduler will then hold forever
     // against that same row's command - the never-firing timer this refusal exists to prevent.
-    if (own)
-        refuseUnclassifiableTarget(own);
-    if (own) {
-        const ownership = observeOwnership(own);
+    const target = own && queenOperation ? resolveQueenLeadTarget(queenOperation, projectId, deliverTo, () => own) : own;
+    if (target)
+        refuseUnclassifiableTarget(target);
+    if (target) {
+        const ownership = observeOwnership(target);
         if (ownership === "live")
-            return { actor, pane: own.tmux_target };
+            return { actor, pane: target.tmux_target };
         // Unknown never falls through to the ambient pane: that would bind this row's actor to a pane it may not own.
         if (ownership === "unknown")
-            throw notOwnedError(own, ownership);
+            throw notOwnedError(target, ownership);
     }
     const pane = process.env.TMUX_PANE;
     if (pane)
@@ -130,7 +138,7 @@ function deliveredByNote(t) {
         : null;
 }
 export const truncateBody = (body) => body.length > 120 ? `${cutToUnitBudget(body, 120)}…` : body;
-function rejectUnsafeBody(body) {
+export function assertSafeWakeBody(body) {
     const bad = findUnsafeControlChar(body, TEXT_ALLOWED_CONTROL_CHARS);
     if (bad) {
         throw new Error(`body cannot contain ${bad.label} at offset ${bad.index}: it is typed literally into the target pane ` +
@@ -173,7 +181,7 @@ const openStandingWatch = db.transaction((projectId, owner, body, deliverActor,
     return row;
 });
 function createStandingWatch(projectId, args) {
-    const delivery = resolveDelivery(projectId, args.deliver_to);
+    const delivery = resolveWakeDelivery(projectId, args.deliver_to);
     const maxWait = args.max_wait_seconds ?? STANDING_WATCH_LIFETIME_SECONDS;
     const row = openStandingWatch.immediate(projectId, currentActor(), args.body, delivery.actor, delivery.pane, maxWait);
     const crew = db
@@ -261,7 +269,7 @@ function createLeadWatch(leadProjectId, args) {
             note: `Project ${leadProjectId}'s lead has already ended its turn; nothing was scheduled. Read it now.`,
         };
     }
-    const delivery = resolveDelivery(home);
+    const delivery = resolveWakeDelivery(home);
     const maxWait = args.max_wait_seconds ?? 900;
     const row = openLeadWatch.immediate(home, args.body, mode, delivery, maxWait, {
         projectId: leadProjectId,
@@ -329,9 +337,9 @@ export function registerWakes(server) {
             repeating: z.boolean(),
         },
     }, (args) => run(() => {
-        rejectUnsafeBody(args.body);
+        assertSafeWakeBody(args.body);
         const projectId = effectiveProjectId(args.project_id);
-        const delivery = resolveDelivery(projectId, args.deliver_to);
+        const delivery = resolveWakeDelivery(projectId, args.deliver_to, "wake_set");
         return commitQueenStateWrite("wake_set", projectId, args, () => {
             const row = db
                 .prepare(`INSERT INTO wakes (project_id, owner, body, kind, deliver_actor, deliver_pane, due_at, repeat_every_ms)
@@ -407,7 +415,7 @@ export function registerWakes(server) {
             note: z.string().optional(),
         },
     }, (args) => run(() => {
-        rejectUnsafeBody(args.body);
+        assertSafeWakeBody(args.body);
         const projectId = effectiveProjectId(args.project_id);
         const selectors = [
             args.agents != null && "agents",
@@ -441,7 +449,7 @@ export function registerWakes(server) {
                 "reported as a timeout instead of the failure it actually is. A lead's turn has its own channel, " +
                 "which only the queen may watch, with lead_project_id=<that lead's project id>.");
         }
-        const delivery = resolveDelivery(projectId, args.deliver_to);
+        const delivery = resolveWakeDelivery(projectId, args.deliver_to, "wake_when_idle");
         const snapshot = liveTargets();
         if (mode === "all") {
             const allIdle = watched.every((a) => {
@@ -577,7 +585,7 @@ export function registerWakes(server) {
         const sets = [];
         const params = [];
         if (args.body != null) {
-            rejectUnsafeBody(args.body);
+            assertSafeWakeBody(args.body);
             sets.push("body = ?");
             params.push(args.body);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmgmyr/hive",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "Run a crew of Claude Code and Codex workers from one lead session: visible tmux panes, exact state from hooks, one local SQLite store.",
   "type": "module",
   "bin": {