@cmgmyr/hive 1.2.2 → 1.4.0

package/dist/codexHome.js

@@ -172,6 +172,21 @@ function localOverrideHeading(path) {
 export function codexInstructionsPhrase(layers) {
     return layers.length ? `instructions: ${layers.join(", ")}` : undefined;
 }
+// Empty values are dropped: an unset variable and an empty one read the same to the server.
+function mcpEnvTable(env) {
+    const entries = Object.entries(env).filter(([k, v]) => k.startsWith("HIVE_") && v !== "");
+    return [`[mcp_servers.hive.env]`, ...entries.map(([k, v]) => `${k} = ${tomlString(v)}`), ""];
+}
+// Resume reuses a home written at spawn, so its env table can predate a rename or this fix itself.
+export function refreshCodexMcpEnv(key, env) {
+    const path = join(codexHomeDir(key), "config.toml");
+    if (!existsSync(path))
+        return;
+    const table = mcpEnvTable(env).join("\n") + "\n";
+    const current = readFileSync(path, "utf8");
+    const existing = /^\[mcp_servers\.hive\.env\]\n(?:(?!\[).*\n)*/m;
+    writeFileSync(path, existing.test(current) ? current.replace(existing, table) : current + "\n" + table);
+}
 // Must be written before any [section] header, or TOML nests it inside whichever table precedes it -
 // accepted silently, delivered to nobody. See tmux-and-panes.md, "the brief-delivery TOML trap".
 function configToml(input) {
@@ -190,28 +205,27 @@ function configToml(input) {
         `trust_level = "trusted"`,
         "",
         `[mcp_servers.hive]`,
+        `default_tools_approval_mode = "approve"`,
         `command = ${tomlString(input.nodeBin)}`,
         `args = [${tomlString(input.indexJs)}]`,
         "",
-        `[mcp_servers.hive.env]`,
-        `HIVE_AGENT_ID = ${tomlString(input.actorId)}`,
-        "",
+        ...mcpEnvTable(input.serverEnv),
         // Only accepted under [tui]; a top-level status_line is an unknown field to --strict-config.
         `[tui]`,
         `status_line = ${tomlStringArray(input.statusLine)}`,
     ].join("\n") + "\n");
 }
 // Pure on purpose: agent_resume reuses it against an EXISTING home, so it must not write.
-export function codexLaunchArgs(cwd) {
+export function codexLaunchArgs(cwd, readOnly = false) {
     const root = gitPrimaryRoot(cwd);
     const commonDir = root ? join(root, ".git") : null;
     return [
         // Declining review of hive's OWN generated hooks.json, not a stranger's - see the reference.
         "--dangerously-bypass-hook-trust",
         // NOT parity with claude's posture, and --add-dir is NOT containment - see the reference.
-        "--dangerously-bypass-approvals-and-sandbox",
+        ...(readOnly ? ["--sandbox", "read-only", "-c", 'approval_policy="never"'] : ["--dangerously-bypass-approvals-and-sandbox"]),
         // Inert alongside the flag above, kept because its value seeds [projects.<root>] trust.
-        ...(commonDir ? ["--add-dir", commonDir] : []),
+        ...(commonDir && !readOnly ? ["--add-dir", commonDir] : []),
     ];
 }
 export function ensureCodexHooksFile(key, options) {
@@ -287,11 +301,12 @@ export function ensureCodexHome(input) {
         projectRoot,
         nodeBin: process.execPath,
         indexJs,
-        actorId: input.actorId,
+        serverEnv: { ...input.serverEnv, HIVE_AGENT_ID: input.actorId },
         statusLine,
+        readOnly: input.readOnly,
         modelContextWindow,
         modelAutoCompactTokenLimit,
     }));
     const instructionLayers = [...(hasGlobal ? ["global"] : []), ...(localOverride ? ["local"] : [])];
-    return { extraArgs: codexLaunchArgs(input.cwd), hooksWired, instructionLayers };
+    return { extraArgs: codexLaunchArgs(input.cwd, input.readOnly), hooksWired, instructionLayers };
 }

package/dist/config.js

@@ -1,72 +1,19 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { storeDir } from "./dataDir.js";
-export const ATTACH_MODES = ["auto", "raw", "control"];
-export function isAttachMode(value) {
-    return ATTACH_MODES.includes(value);
-}
-export const AUTO_ATTACH_MODES = ["auto", "on", "off"];
-export function isAutoAttach(value) {
-    return AUTO_ATTACH_MODES.includes(value);
-}
-function configPath() {
-    return join(storeDir(), "config.json");
-}
-function readConfig() {
-    const path = configPath();
-    let raw;
-    try {
-        raw = readFileSync(path, "utf8");
-    }
-    catch {
-        return {};
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        return parsed !== null && typeof parsed === "object" ? parsed : {};
-    }
-    catch {
-        return {};
-    }
-}
-function envAttachMode() {
-    const value = process.env.HIVE_ATTACH_MODE;
-    return isAttachMode(value) ? value : null;
-}
-function envAutoAttach() {
-    const value = process.env.HIVE_AUTO_ATTACH;
-    if (value === "0")
-        return "off";
-    return isAutoAttach(value) ? value : null;
-}
+import { readGlobalConfig, resolveAttachSetting, writeGlobalConfigKey } from "./globalConfig.js";
+export { ATTACH_MODES, AUTO_ATTACH_MODES, isAttachMode, isAutoAttach, migrateLegacyConfig, } from "./globalConfig.js";
 export function resolvedAttachMode() {
-    const fromEnv = envAttachMode();
-    if (fromEnv)
-        return { mode: fromEnv, source: "env" };
-    const value = readConfig().attach;
-    return isAttachMode(value) ? { mode: value, source: "config" } : { mode: "auto", source: "detection" };
+    const global = readGlobalConfig();
+    return resolveAttachSetting("attach", global.root, global.legacy, global.warnings);
 }
 export function attachMode() {
     return resolvedAttachMode().mode;
 }
 export function resolvedAutoAttach() {
-    const fromEnv = envAutoAttach();
-    if (fromEnv)
-        return { value: fromEnv, source: "env" };
-    const value = readConfig().autoAttach;
-    return isAutoAttach(value)
-        ? { value, source: "config" }
-        : { value: "auto", source: "detection" };
+    const global = readGlobalConfig();
+    return resolveAttachSetting("autoAttach", global.root, global.legacy, global.warnings);
 }
 export function setAttachMode(mode) {
-    const config = readConfig();
-    config.attach = mode;
-    mkdirSync(storeDir(), { recursive: true });
-    writeFileSync(configPath(), `${JSON.stringify(config, null, 2)}\n`);
+    writeGlobalConfigKey("attach", mode);
 }
 export function setAutoAttach(value) {
-    const config = readConfig();
-    config.autoAttach = value;
-    mkdirSync(storeDir(), { recursive: true });
-    writeFileSync(configPath(), `${JSON.stringify(config, null, 2)}\n`);
+    writeGlobalConfigKey("autoAttach", value);
 }

package/dist/context.js

@@ -1,8 +1,10 @@
 import { execFileSync } from "node:child_process";
-import { realpathSync } from "node:fs";
+import { lstatSync, realpathSync } from "node:fs";
 import { userInfo } from "node:os";
-import { basename, dirname, resolve, sep } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
+import { storeDir } from "./dataDir.js";
 import { db } from "./db.js";
+import { LEAD_KIND } from "./spawn.js";
 let selectedId = null;
 let cachedActorId = null;
 let lastTouchMs = 0;
@@ -254,3 +256,190 @@ export function trySelectedProject() {
         return null;
     }
 }
+export const QUEEN_PROFILE = "queen";
+export function queenHomeDir() {
+    return join(storeDir(), "queen");
+}
+function queenHomeProject() {
+    const home = queenHomeDir();
+    try {
+        if (lstatSync(home).isSymbolicLink())
+            return null;
+        return getProjectByPath(realpathSync(home)) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function queenProjectId() {
+    if (projectLock)
+        return null;
+    const actorId = process.env.HIVE_AGENT_ID;
+    if (!actorId)
+        return null;
+    const home = queenHomeProject();
+    if (!home)
+        return null;
+    const row = db
+        .prepare("SELECT 1 FROM agents WHERE actor_id = ? AND project_id = ? AND kind = ? AND status = 'running'")
+        .get(actorId, home.id, LEAD_KIND);
+    return row ? home.id : null;
+}
+export function isQueenLead() {
+    return queenProjectId() !== null;
+}
+export function captureQueenWriteIdentity(targetProjectId) {
+    const home = queenProjectId();
+    if (home === null || home === targetProjectId)
+        return null;
+    return { actor_id: process.env.HIVE_AGENT_ID, home_project_id: home };
+}
+export const QUEEN_REACH = {
+    whoami: "read",
+    help: "read",
+    project_list: "read",
+    pad_list: "read",
+    pad_read: "read",
+    todo_list: "read",
+    todo_get: "read",
+    kv_get: "read",
+    kv_list: "read",
+    wake_get: "read",
+    wake_list: "read",
+    agent_list: "read",
+    agent_status: "read",
+    agent_output: "read",
+    agent_message_get: "read",
+    queen_audit_list: "read",
+    todo_create: "todo",
+    todo_comment: "todo",
+    wake_set: "lead_wake",
+    wake_when_idle: "lead_wake",
+    wake_update: "owned_lead_wake",
+    wake_cancel: "owned_lead_wake",
+    agent_send: "lead_text",
+    pad_write: "home",
+    pad_append: "home",
+    pad_edit: "home",
+    pad_archive: "home",
+    pad_delete: "home",
+    todo_update: "home",
+    todo_archive: "home",
+    todo_complete: "home",
+    todo_block: "home",
+    todo_unblock: "home",
+    kv_set: "home",
+    kv_delete: "home",
+    lease_acquire: "home",
+    lease_release: "home",
+    agent_spawn: "home",
+    agent_resume: "home",
+    agent_park: "home",
+    agent_rename: "home",
+    agent_close: "home",
+    project_select: "select",
+    project_add: "global",
+    project_prune: "global",
+    actor_prune: "global",
+    "hive lead": "spin_up",
+    "hive queen-audit": "read",
+    "hive init": "home",
+    "hive attach": "home",
+    "hive next": "home",
+    "hive start": "home",
+    "hive stop": "home",
+    "hive show": "home",
+    "hive hide": "home",
+    "hive pad --save": "home",
+};
+export const QUEEN_REFUSAL = "QUEEN_CROSS_PROJECT_WRITE_REFUSED";
+function runningLead(projectId) {
+    return db
+        .prepare("SELECT id, actor_id, name FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id LIMIT 1")
+        .get(projectId, LEAD_KIND);
+}
+function namesLead(ref, lead) {
+    return typeof ref === "number" ? ref === lead.id : ref === lead.name;
+}
+function foreignWriteProblem(reach, targetProjectId, args) {
+    switch (reach) {
+        case "spin_up":
+        case "todo":
+            return null;
+        case "lead_wake": {
+            if (args.scope !== undefined)
+                return "a standing watch in another project belongs to its lead";
+            const lead = runningLead(targetProjectId);
+            if (!lead)
+                return "that project has no running lead to address";
+            if (!namesLead(args.deliver_to, lead)) {
+                return `deliver_to must name that project's running lead ("${lead.name}" or agent id ${lead.id})`;
+            }
+            return null;
+        }
+        case "owned_lead_wake": {
+            const lead = runningLead(targetProjectId);
+            if (!lead)
+                return "that project has no running lead, so no wake of yours there is still addressed to one";
+            const wake = db
+                .prepare("SELECT owner, deliver_actor FROM wakes WHERE id = ? AND project_id = ?")
+                .get(args.wake_id, targetProjectId);
+            if (!wake || wake.owner !== process.env.HIVE_AGENT_ID || wake.deliver_actor !== lead.actor_id) {
+                return "only a wake you set there, addressed to that project's current running lead, can be changed";
+            }
+            return null;
+        }
+        case "lead_text": {
+            if (args.keys !== undefined)
+                return "keys can interrupt a lead mid-turn; send text instead";
+            const lead = runningLead(targetProjectId);
+            if (!lead)
+                return "that project has no running lead to address";
+            if (!namesLead(args.agent_id ?? args.name, lead)) {
+                return `the recipient must be that project's running lead ("${lead.name}" or agent id ${lead.id})`;
+            }
+            return null;
+        }
+        case "home":
+            return "that belongs to the project's own lead";
+        case "select":
+            return "a selection would redirect every later call that omits project_id; pass project_id on each call instead";
+    }
+}
+// targetProjectId null means the operation has no single project (a store-wide sweep, an unregistered path).
+export function assertQueenCrossProjectWrite(operation, targetProjectId, args) {
+    const home = queenProjectId();
+    if (home === null)
+        return;
+    const reach = QUEEN_REACH[operation];
+    if (reach === "read")
+        return;
+    const problem = reach === undefined
+        ? "hive has not classified this operation for the queen, so it refuses by default"
+        : reach === "global"
+            ? "it changes the whole store, not one project"
+            : targetProjectId === home
+                ? null
+                : targetProjectId === null
+                    ? "it names no registered project"
+                    : foreignWriteProblem(reach, targetProjectId, args);
+    if (problem)
+        throw queenRefusal(operation, targetProjectId, problem);
+}
+export function assertQueenToolCall(tool, args) {
+    if (!isQueenLead())
+        return;
+    const reach = QUEEN_REACH[tool];
+    if (reach === "read")
+        return;
+    const override = typeof args.project_id === "number" ? args.project_id : undefined;
+    const target = reach === undefined || reach === "global" ? null : effectiveProjectId(override);
+    assertQueenCrossProjectWrite(tool, target, args);
+}
+function queenRefusal(operation, targetProjectId, problem) {
+    const target = targetProjectId === null ? null : getProject(targetProjectId);
+    const where = target ? `in project ${target.id} ("${target.name}")` : "outside the queen's own project";
+    return new Error(`${QUEEN_REFUSAL}: the queen cannot run ${operation} ${where}: ${problem}. Into another project the ` +
+        "queen may only todo_create, todo_comment, send text or wakes to its running lead, and start its lead " +
+        "with `hive lead <path>`. Everything else there is its lead's to do.");
+}

package/dist/db.js

@@ -368,6 +368,46 @@ ALTER TABLE wake_block_notices RENAME COLUMN timer_id TO wake_id;
 CREATE INDEX idx_wakes_active ON wakes(project_id, kind)
   WHERE cancelled_at IS NULL;
 CREATE INDEX idx_wakes_parent ON wakes(parent_wake_id) WHERE parent_wake_id IS NOT NULL;
+`,
+    `
+ALTER TABLE agents ADD COLUMN model TEXT;
+ALTER TABLE agents ADD COLUMN extra_args TEXT;
+`,
+    `
+CREATE TABLE lead_turn_state (
+  agent_id INTEGER PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  pane_pid TEXT NOT NULL DEFAULT '',
+  session_id TEXT NOT NULL DEFAULT '',
+  state TEXT NOT NULL DEFAULT 'unknown' CHECK (state IN ('unknown', 'working', 'idle')),
+  idle_seq INTEGER NOT NULL DEFAULT 0,
+  last_event TEXT NOT NULL DEFAULT '',
+  changed_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f', 'now'))
+);
+
+CREATE TABLE lead_idle_subscriptions (
+  wake_id INTEGER PRIMARY KEY REFERENCES wakes(id) ON DELETE CASCADE,
+  target_project_id INTEGER NOT NULL,
+  agent_id INTEGER NOT NULL,
+  pane_pid TEXT NOT NULL,
+  session_id TEXT NOT NULL DEFAULT '',
+  baseline_idle_seq INTEGER NOT NULL DEFAULT 0,
+  terminal_reason TEXT
+);
+`,
+    `
+CREATE TABLE queen_audit (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  actor_id TEXT NOT NULL,
+  home_project_id INTEGER NOT NULL,
+  target_project_id INTEGER NOT NULL,
+  operation TEXT NOT NULL,
+  resource_type TEXT NOT NULL,
+  resource_id INTEGER NOT NULL CHECK(resource_id > 0),
+  summary TEXT NOT NULL CHECK(length(summary) <= 160),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f','now')),
+  CHECK(home_project_id != target_project_id)
+);
+CREATE INDEX idx_queen_audit_target ON queen_audit(target_project_id, id);
 `,
 ];
 export function storeSchemaAhead(database) {
@@ -385,48 +425,68 @@ function readAppliedVersions() {
     return new Set(db.prepare("SELECT version FROM migrations").all().map((r) => r.version));
 }
 const MIGRATE_LOCK_MAX_ATTEMPTS = 24;
-function retryOnBusy(fn, label) {
+function retryOnBusy(fn, label, pending) {
     for (let attempt = 1;; attempt++) {
         try {
             return fn();
         }
         catch (e) {
             const busy = e instanceof Error && (e.code === "SQLITE_BUSY" || /database is locked/.test(e.message));
-            if (!busy || attempt >= MIGRATE_LOCK_MAX_ATTEMPTS) {
+            if (busy && attempt < MIGRATE_LOCK_MAX_ATTEMPTS)
+                continue;
+            if (busy) {
                 console.error(`hive: ${label} did not complete after ${attempt} attempt(s): the store's write lock never freed ` +
                     "up. Another hive process is likely still applying a migration (or is stuck); check for a " +
                     `wedged hive process and try again. Underlying error: ${errorMessage(e)}`);
-                process.exit(1);
             }
+            else {
+                console.error(`hive: ${label} failed: ${errorMessage(e)}${pending ? ` (${pending})` : ""}`);
+            }
+            process.exit(1);
         }
     }
 }
+function bookkeepingMissing() {
+    const names = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('migrations', 'backup_meta')").all().length;
+    return names < 2 || db.prepare("SELECT 1 FROM backup_meta WHERE id = 1").get() === undefined;
+}
 export function migrate() {
-    retryOnBusy(() => {
-        db.exec(`CREATE TABLE IF NOT EXISTS migrations (
-      version INTEGER PRIMARY KEY,
-      applied_at TEXT NOT NULL DEFAULT (datetime('now'))
-    )`);
-        db.exec(`CREATE TABLE IF NOT EXISTS backup_meta (
-      id INTEGER PRIMARY KEY CHECK (id = 1),
-      last_attempt_at TEXT,
-      last_success_at TEXT,
-      last_error TEXT,
-      last_error_at TEXT
-    )`);
-        db.prepare("INSERT OR IGNORE INTO backup_meta (id) VALUES (1)").run();
-    }, "preparing the store's bookkeeping tables");
+    if (bookkeepingMissing()) {
+        retryOnBusy(() => {
+            db.exec(`CREATE TABLE IF NOT EXISTS migrations (
+          version INTEGER PRIMARY KEY,
+          applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+        )`);
+            db.exec(`CREATE TABLE IF NOT EXISTS backup_meta (
+          id INTEGER PRIMARY KEY CHECK (id = 1),
+          last_attempt_at TEXT,
+          last_success_at TEXT,
+          last_error TEXT,
+          last_error_at TEXT
+        )`);
+            db.prepare("INSERT OR IGNORE INTO backup_meta (id) VALUES (1)").run();
+        }, "preparing the store's bookkeeping tables", "bookkeeping missing");
+    }
     const before = readAppliedVersions();
-    maybeBackupBeforeMigrations(db, dataDir, MIGRATIONS.length - before.size);
+    const pendingCount = MIGRATIONS.length - before.size;
+    maybeBackupBeforeMigrations(db, dataDir, pendingCount);
     const applyPending = db.transaction(() => {
         const applied = readAppliedVersions();
         MIGRATIONS.forEach((sql, i) => {
             const version = i + 1;
             if (applied.has(version))
                 return;
-            db.exec(sql);
+            try {
+                db.exec(sql);
+            }
+            catch (e) {
+                const wrapped = new Error(`migration ${version}: ${errorMessage(e)}`);
+                if (e instanceof Error)
+                    wrapped.code = e.code;
+                throw wrapped;
+            }
             db.prepare("INSERT INTO migrations (version) VALUES (?)").run(version);
         });
     });
-    retryOnBusy(() => applyPending.immediate(), "applying pending migrations");
+    retryOnBusy(() => applyPending.immediate(), "applying pending migrations", pendingCount > 0 ? `${pendingCount} migration${pendingCount === 1 ? "" : "s"} pending` : undefined);
 }

package/dist/firstMessage.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+export const FIRST_MESSAGE_SHA_ENV = "HIVE_LEAD_FIRST_MESSAGE_SHA";
+export function firstMessageDigest(message) {
+    return createHash("sha256").update(message.trim()).digest("hex");
+}