@cmgmyr/hive 1.4.0 → 1.6.0

package/claude-plugin/skills/profile/SKILL.md

@@ -9,7 +9,27 @@ You are interviewing someone to produce, or change, a hive profile: the standing
 
 ## Read before you ask anything
 
-Run `hive profile list` and `hive doctor` (or read this project's `hive.yml` directly) before the first question. If this is an edit, also read the named profile's current, rendered behavior with `hive profile read <file> --profile <name>` for each of `posture.md`, `runbook.md`, `worker.md`, and any other `.md` it carries, so you understand what this profile actually does today. Do not ask the user to repeat anything already answered by what you just read. This rendered read is for understanding only - `references/interview.md` covers the raw template (via `hive profile path`) you must read from, and write onto, when you actually apply an edit; a rendered copy drops any conditional section whose var is unset, so it is never a safe edit source.
+Run `hive profile list` and `hive doctor` (or read this project's `hive.yml` directly) before the first question. If this is an edit, also read the named profile's current, rendered behavior for each of `posture.md`, `runbook.md`, `worker.md`, and any other `.md` it carries, using "Read a rendered file in bounded sections" below, so you understand what this profile actually does today. Do not ask the user to repeat anything already answered by what you just read. This rendered read is for understanding only - `references/interview.md` covers the raw template (via `hive profile path`) you must read from, and write onto, when you actually apply an edit; a rendered copy drops any conditional section whose var is unset, so it is never a safe edit source.
+
+## Read a rendered file in bounded sections
+
+A harness may persist tool output over about 30KB to a file and show only a short preview, so a large rendered file read straight into a tool result is read mostly unseen. Redirect first, then look. `profile_name` is a name from `hive profile list`, `profile_file` is a filename it lists, and `profile_rendered` is a disposable file:
+
+```sh
+profile_rendered=$(mktemp)
+hive profile read "$profile_file" --profile "$profile_name" > "$profile_rendered" && wc -c < "$profile_rendered"
+printf '%s\n' "$profile_rendered"
+```
+
+Shell variables do not survive between tool calls. Note the path the last line printed and write that literal path into every later command and every file-reader call; do not rely on `$profile_rendered` after this call.
+
+Use the saved content only if the read command succeeded. `wc -c` is the rendered size in bytes, the same number `hive profile list` and `hive doctor` show. If it is 25600 or less, read the whole file with your file reader. Above that, never read the whole file in one tool call; read it in sections of at most 16000 bytes each:
+
+1. Check for long lines first: `awk 'length > 2000 {print NR; exit}' PATH`. A file reader truncates any line over 2000 characters, so if this prints a line number, read the whole file by bytes with step 3 instead of with line ranges.
+2. Otherwise pick a line range with your file reader's offset and limit, and measure it first: `sed -n '1,80p' PATH | wc -c`. Shrink the range until the count is 16000 or less, then read it. Continue from the next line until you have read the last line. A scan of the headers is not a read.
+3. To read by bytes: `dd if=PATH bs=1 skip=0 count=16000 2>/dev/null`. Advance `skip` by 15996 each time, which overlaps 4 bytes so text split at a section edge shows whole in the next section. Stop when a section reaches the byte count from `wc -c`.
+
+Delete the temporary file when you are done. It is for understanding and checking only, never a source for an edit (see below).
 
 ## Discovery first, not a checklist
 
@@ -70,7 +90,7 @@ A command, a repository name, a ticket prefix: these belong in `hive.yml` `vars`
 
 ## Validate before you tell them it's done
 
-After writing, run `hive doctor` and `hive profile read <file> --profile <name>` for each file you touched, from the project the profile is meant to serve. A profile with no readable `runbook.md` fails `hive doctor` outright; `posture.md` and `worker.md` do not, but check them anyway. Tell the user to restart any running hive session so it picks up the change, and invite one small follow-up edit once they've tried it - that is the expected way a profile keeps improving.
+After writing, run `hive doctor` and read each file you touched with "Read a rendered file in bounded sections" above, from the project the profile is meant to serve. Read it to the last line: a change near the end of a large file is easy to miss. A profile with no readable `runbook.md` fails `hive doctor` outright; `posture.md` and `worker.md` do not, but check them anyway. Tell the user to restart any running hive session so it picks up the change, and invite one small follow-up edit once they've tried it - that is the expected way a profile keeps improving.
 
 ## What this skill does not do
 

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"1.4.0","sha":"0bea55d","dirty":false,"build_id":"9dcef67c-6f6f-4f48-88a1-116efaa27142"}
+{"version":"1.6.0","sha":"ac13530","dirty":false,"build_id":"428a468f-98af-497e-a40c-fb87feef27ac"}

package/dist/cli.js

@@ -19,6 +19,7 @@ import { checkoutUpgradeSteps, detectInstallShape, globalUpgradeSteps } from "./
 import { isLowHeadroom, orphanLoginShellDetails, ptyHeadroom } from "./ptys.js";
 import { addProject, agentProjectPin, assertQueenCrossProjectWrite, captureQueenWriteIdentity, currentActor, effectiveProjectId, findProjectForCwd, findProjectForDir, getProjectByPath, gitPrimaryRoot, getProject, listProjects, QUEEN_PROFILE, queenHomeDir, registeredAncestor, takeRegistrationNotice, } from "./context.js";
 import { confirmQueenWrite, listQueenAudit } from "./queenAudit.js";
+import { formatRowCounts, projectRowCounts, removeProject } from "./projectRemove.js";
 import { ensureHooksFile } from "./hooks.js";
 import { errorMessage, registrationNoticeText, withTrailingNewline } from "./result.js";
 import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneReissue, } from "./scheduler.js";
@@ -29,7 +30,7 @@ import { probeSessionInterpreter, reexecTarget, sessionStartVerdict, } from "./s
 import { backupHealth, backupNow, backupsDir, formatBytes, listSnapshots, previewRestore, restoreSnapshot, totalSizeBytes, } from "./backup.js";
 import { describeTeardownWindow, readTeardowns, teardownLogPath, } from "./teardown.js";
 import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, upsertActor, withWindowClaim, } from "./spawn.js";
-import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isPaneTarget, isViewSessionName, listOwnedWindows, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePid, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, paneReissued, rowLive, rowLiveProbe, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
+import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isPaneTarget, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePid, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, paneReissued, rowLive, rowLiveProbe, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
 import { describeVisibility, processCounts } from "./dashboard.js";
 import { runningCommandRow, runningCommandRows, snapshotProcesses, stopAllProcesses, stopLine, stopProcess, STOP_REASONS, } from "./processes.js";
 import { activeProfile, agentVarKeys, BUILT_IN_PROJECT_YML, configHash, loadProjectYml, mergedProjectVars, NO_PROFILE, PROJECT_YML_KEYS, resolveCommandDir, resolveFirstMessage, } from "./projectYml.js";
@@ -95,6 +96,9 @@ Usage:
   hive todo <id>             print one todo in full, comments included
   hive backups               list automatic store snapshots
   hive restore <name> [--yes] [--force]  overwrite the live store from a snapshot
+  hive project rm <id|path> [--yes]
+                             remove another project and everything it owns,
+                             after a snapshot; never the one you are in
   hive runbook               this project's standing process, vars resolved
   hive posture               the posture text this project's lead starts with
   hive kickoff [--explain]   SessionStart hook output; silent unless this is a lead checkout
@@ -1107,6 +1111,16 @@ function profileDriftText(f) {
         text: `hive's default ${f.file} changed since you forked it${pct != null ? ` (${pct}% diverged)` : ""}`,
     };
 }
+const PROFILE_SIZE_WARNING_BYTES = 25600;
+function profileRenderedBytes(name, file, vars) {
+    const rendered = renderProfileFile(name, file, vars);
+    return rendered == null ? null : Buffer.byteLength(withTrailingNewline(rendered), "utf8");
+}
+function profileSizeAdvisory(name, file) {
+    return (`${name}/${file}: rendered size exceeds ${PROFILE_SIZE_WARNING_BYTES} bytes. A harness may persist tool output ` +
+        "over about 30KB and show only a short preview. Split into smaller profile files read with hive profile read, " +
+        "or redirect hive profile read to a file and read by section.");
+}
 function cmdProfile(argv) {
     const [sub, ...rest] = argv;
     try {
@@ -1121,7 +1135,9 @@ function cmdProfile(argv) {
                     return;
                 }
                 const here = findProjectForCwd();
-                const current = here ? activeProfile(loadProjectYml(here.path).config) : null;
+                const hereConfig = here ? loadProjectYml(here.path).config : null;
+                const current = here ? activeProfile(hereConfig) : null;
+                const listVars = mergedProjectVars(hereConfig);
                 const statuses = names.map((profile) => profileStatus(profile));
                 const fileWidth = Math.max(11, ...statuses.flatMap((s) => s.files.map((f) => f.file.length)));
                 for (const [i, profile] of names.entries()) {
@@ -1129,7 +1145,11 @@ function cmdProfile(argv) {
                     console.log(`${profile === current ? "*" : " "} ${profile}`);
                     for (const f of status.files) {
                         const drift = profileDriftText(f);
-                        console.log(`    ${f.file.padEnd(fileWidth)} ${f.source.padEnd(7)} ${f.path}${drift ? `   (${drift.text})` : ""}`);
+                        const bytes = profileRenderedBytes(profile, f.file, listVars);
+                        const size = bytes == null ? "[rendered size unavailable]" : `[${bytes} rendered bytes]`;
+                        console.log(`    ${f.file.padEnd(fileWidth)} ${f.source.padEnd(7)} ${f.path}${drift ? `   (${drift.text})` : ""} ${size}`);
+                        if (bytes != null && bytes > PROFILE_SIZE_WARNING_BYTES)
+                            console.log(`      ${profileSizeAdvisory(profile, f.file)}`);
                     }
                 }
                 if (current)
@@ -1546,9 +1566,17 @@ function cmdHide(argv) {
         return `${name}: hidden`;
     }));
 }
+const LEAD_OWNERSHIP_LABEL = {
+    live: "running",
+    gone: "no live pane",
+    reissued: "no live pane",
+    unknown: "pane identity unknown",
+};
 function cmdStatus() {
     janitor();
     let anyOutput = false;
+    let snapshot;
+    const statusSnapshot = () => (snapshot === undefined ? (snapshot = liveTargets()) : snapshot);
     let windows;
     let windowsError;
     const ownedWindows = () => {
@@ -1594,7 +1622,9 @@ function cmdStatus() {
         for (const a of agents) {
             const state = a.kind === "agent"
                 ? describeForHuman(deriveProvenance(a, null))
-                : (whereIs.get(a.name) ?? "running");
+                : a.kind === LEAD_KIND
+                    ? LEAD_OWNERSHIP_LABEL[rowOwnership(a, statusSnapshot())]
+                    : (whereIs.get(a.name) ?? "running");
             const label = a.kind === "command" ? "cmd  " : a.kind === LEAD_KIND ? "lead " : "agent";
             console.log(`  ${label}  ${a.name.padEnd(20)} ${state}`);
             if (reportsAgentStateLog(a)) {
@@ -1877,7 +1907,7 @@ function reportProjectScope(here) {
         if (locked && project.id !== here?.id)
             continue;
         if (project.path === homePath || project.path === "/") {
-            warn("project scope", `"${project.name}" (${project.path}) is a home directory; every unregistered directory under it resolves to this project. The project_prune tool with this project's id (from any hive session) removes it once it holds nothing.`);
+            warn("project scope", `"${project.name}" (${project.path}) is a home directory; every unregistered directory under it resolves to this project. The project_prune tool with this project's id (from an unlocked session in another project) removes it once it holds nothing.`);
         }
     }
     for (const parent of projects) {
@@ -2149,7 +2179,7 @@ function reportCrewTeardown(projectId) {
 }
 function reportStalledWorkers(projectId) {
     const latched = db
-        .prepare(`SELECT name, command, kind, cwd, session_id, transcript_path, agent_state, state_changed_at, tmux_target, tmux_socket
+        .prepare(`SELECT name, command, kind, cwd, session_id, transcript_path, agent_state, state_changed_at, tmux_target, tmux_socket, pane_pid
            FROM agents
           WHERE project_id = ? AND status = 'running' AND kind = 'agent'
             AND agent_state IN ('working', 'waiting') AND state_changed_at IS NOT NULL
@@ -2160,6 +2190,7 @@ function reportStalledWorkers(projectId) {
         // never this latch"), and a harness with no transcript to check would have nothing to read.
         .filter((row) => reportsAgentStateLog(row) && hasTranscriptSignal(row) && row.session_id !== "");
     const stalled = [];
+    let snapshot;
     for (const row of latched) {
         const latchedFor = ageSecondsSince(row.state_changed_at);
         if (latchedFor < STALL_BOUND_SECONDS)
@@ -2176,7 +2207,9 @@ function reportStalledWorkers(projectId) {
         if (stale !== "never" && stale.seconds < STALL_BOUND_SECONDS)
             continue;
         if (row.agent_state === "waiting") {
-            if (foreignSocket(row.tmux_socket))
+            if (snapshot === undefined)
+                snapshot = liveTargets();
+            if (rowOwnership(row, snapshot) !== "live")
                 continue;
             const choiceCheck = paneClassifierFor(row.command)?.choiceCheck;
             if (!choiceCheck || choiceCheck(row.tmux_target).awaitingChoice !== false)
@@ -2355,6 +2388,12 @@ function cmdDoctor(argv) {
             warn("profile vars", `hive.yml vars ${collisions.join(", ")} are derived from agents: and are ignored.`);
         }
         const vars = mergedProjectVars(cfg);
+        for (const f of resolved) {
+            const bytes = profileRenderedBytes(name, f.file, vars);
+            info("profile size", bytes == null ? `${name}/${f.file}: rendered size unavailable` : `${name}/${f.file}: ${bytes} rendered bytes`);
+            if (bytes != null && bytes > PROFILE_SIZE_WARNING_BYTES)
+                info("profile size warning", profileSizeAdvisory(name, f.file));
+        }
         const renderedText = profileFileNames(name)
             .map((file) => renderProfileFile(name, file, vars))
             .filter((t) => t != null)
@@ -2404,21 +2443,36 @@ function cmdDoctor(argv) {
     });
     if (here) {
         const lead = db
-            .prepare("SELECT tmux_target, tmux_socket FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
+            .prepare("SELECT id, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
             .get(here.id, LEAD_KIND);
         if (lead) {
-            const live = rowLive(lead.tmux_socket, lead.tmux_target);
-            if (live === false) {
-                warn("lead", "the lead's row is running but its pane is not live. The janitor leaves lead rows alone on " +
+            const snapshot = liveTargets();
+            const ownership = rowOwnership(lead, snapshot);
+            const unobserved = !foreignSocket(lead.tmux_socket) && observationFailed(snapshot);
+            if (ownership === "gone" || ownership === "reissued") {
+                warn("lead", (ownership === "reissued"
+                    ? "the lead's row is running but its pane id now belongs to a different process. "
+                    : "the lead's row is running but its pane is not live. ") +
+                    "The janitor leaves lead rows alone on " +
                     "purpose, so nothing will fix this by itself. Run `hive lead` to record a fresh pane and reuse " +
                     "this identity, or ask a claude session connected to this project's hive MCP server to call " +
-                    "the agent_close tool on it to retire the row for good - required before `hive restore`, which " +
+                    (ownership === "reissued"
+                        ? `agent_close({agent_id: ${lead.id}, row_only: true}) on it (plain agent_close refuses a pane id ` +
+                            "that still exists)"
+                        : "the agent_close tool on it") +
+                    " to retire the row for good - required before `hive restore`, which " +
                     "otherwise refuses while any lead row reads running, and end that session too, since it also " +
                     "holds this store open.");
             }
-            else if (live === null) {
+            else if (ownership === "unknown" && unobserved) {
                 warn("lead", "the lead's pane liveness could not be probed (tmux did not answer).");
             }
+            else if (ownership === "unknown") {
+                warn("lead", `pane identity unknown: the lead's row (agents.id ${lead.id}) cannot be verified as owning pane ` +
+                    `${lead.tmux_target || "(none)"}, because it is on another tmux socket or no pane pid was recorded ` +
+                    "for it. Its screen was not read. If this lead is gone, a human or peer lead (never a worker) can " +
+                    `retire the row with the MCP tool agent_close({agent_id: ${lead.id}, row_only: true}).`);
+            }
         }
         const stuck = db
             .prepare("SELECT name, kind, tmux_socket FROM agents WHERE project_id = ? AND status = 'running' AND kind != ?")
@@ -2437,19 +2491,21 @@ function cmdDoctor(argv) {
     }
     if (here) {
         const workers = db
-            .prepare("SELECT name, actor_id, command, kind, tmux_target, tmux_socket FROM agents WHERE project_id = ? AND status = 'running' AND kind = 'agent' ORDER BY id")
+            .prepare("SELECT name, actor_id, command, kind, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' AND kind = 'agent' ORDER BY id")
             .all(here.id);
+        const paneSnapshot = workers.length > 0 ? liveTargets() : null;
         let inputBoxClean = 0;
         let inputBoxDrifted = 0;
         let inputBoxUnclassified = 0;
         let leadsProbed = 0;
         let workersProbed = 0;
         const leadRows = db
-            .prepare("SELECT name, command, tmux_target, tmux_socket FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
+            .prepare("SELECT name, command, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
             .all(here.id, LEAD_KIND);
+        const leadSnapshot = leadRows.length > 0 ? (paneSnapshot ?? liveTargets()) : null;
         for (const leadBox of leadRows) {
             const leadHarness = harnessFor(leadBox.command);
-            if (!leadHarness.classifiesPaneScreen || foreignSocket(leadBox.tmux_socket))
+            if (!leadHarness.classifiesPaneScreen || rowOwnership(leadBox, leadSnapshot) !== "live")
                 continue;
             leadsProbed += 1;
             const box = leadHarness.paneClassifier.inputBoxState(leadBox.tmux_target);
@@ -2474,20 +2530,26 @@ function cmdDoctor(argv) {
                 workersReported += 1;
                 // Dispatched through w's OWN harness, never the claude-only import - reading a codex pane
                 // with claude's dialog regexes fails silently in either direction (.claude/rules/tmux-and-panes.md).
+                const ownership = rowOwnership(w, paneSnapshot);
                 const foreign = foreignSocket(w.tmux_socket);
+                const unowned = ownership !== "live";
                 const workerChoiceCheck = paneClassifierFor(w.command)?.choiceCheck;
-                const { awaitingChoice, tail } = foreign || !workerChoiceCheck ? { awaitingChoice: null, tail: "" } : workerChoiceCheck(w.tmux_target);
+                const { awaitingChoice, tail } = unowned || !workerChoiceCheck ? { awaitingChoice: null, tail: "" } : workerChoiceCheck(w.tmux_target);
                 if (awaitingChoice === true)
                     dialogCount += 1;
                 verboseInfo("worker live state", `worker ${w.name}`, `last log event: ${describeLastLogEvent(lastLogEvent(w.actor_id))}`, `permission mode: ${lastPermissionMode(w.actor_id) ?? "unknown (no record)"}`, foreign
                     ? `pane: recorded on a different tmux socket (${w.tmux_socket}); this process cannot read it`
-                    : `pane: ${describePaneChoice(awaitingChoice)}`, ...(foreign
+                    : unowned
+                        ? `pane: not read - pane ownership ${ownership}`
+                        : `pane: ${describePaneChoice(awaitingChoice)}`, ...(foreign
                     ? ["tail: (not read - foreign socket)"]
-                    : awaitingChoice === null
-                        ? ["tail: (pane could not be read)"]
-                        : tail === ""
-                            ? ["tail: (pane rendered nothing)"]
-                            : ["tail:", ...tail.split("\n").map((line) => `| ${line}`)]));
+                    : unowned
+                        ? [`tail: (not read - pane ownership ${ownership})`]
+                        : awaitingChoice === null
+                            ? ["tail: (pane could not be read)"]
+                            : tail === ""
+                                ? ["tail: (pane rendered nothing)"]
+                                : ["tail:", ...tail.split("\n").map((line) => `| ${line}`)]));
             }
             // Gated on classifiesPaneScreen, not reportsAgentStateLog: this drift check only needs the pane,
             // and a codex worker's pane has been readable since todo 524, independent of whether its
@@ -2495,7 +2557,7 @@ function cmdDoctor(argv) {
             // own harness, never the claude-only import above, or a codex worker's screen gets read with
             // claude's regexes (see hive-internals).
             const harness = harnessFor(w.command);
-            if (!harness.classifiesPaneScreen || foreignSocket(w.tmux_socket))
+            if (!harness.classifiesPaneScreen || rowOwnership(w, paneSnapshot) !== "live")
                 continue;
             workersProbed += 1;
             const box = harness.paneClassifier.inputBoxState(w.tmux_target);
@@ -2887,6 +2949,57 @@ function cmdPortfolio(argv) {
     const l = report.totals.lanes;
     console.log(`\n${report.totals.projects} project(s): ${l.waiting_on_you} waiting on you, ${l.stuck} stuck, ${l.moving} moving, ${l.quiet} quiet`);
 }
+async function cmdProject(argv) {
+    const parsed = parseArgs(argv, { flags: ["--yes", "-y"] });
+    rejectUnknownFlags("project", parsed, "--yes/-y");
+    const [verb, ref] = parsed.positional;
+    if (verb !== "rm" || !ref || parsed.positional.length > 2) {
+        console.log("Usage: hive project rm <id|path> [--yes]");
+        process.exit(1);
+    }
+    if (process.env.HIVE_PROJECT_LOCK === "1" || agentProjectPin() != null) {
+        console.log("hive project rm: this session is locked to one project (HIVE_PROJECT_LOCK=1) and cannot remove projects.");
+        process.exit(1);
+    }
+    let target;
+    if (/^\d+$/.test(ref))
+        target = getProject(Number(ref));
+    else
+        target = getProjectByPath(ref) ?? getProjectByPath(canonicalPath(ref));
+    if (!target) {
+        console.log(`hive project rm: "${ref}" is not a registered project id or exact registered path. List them with the project_list tool.`);
+        process.exit(1);
+    }
+    if (findProjectForCwd()?.id === target.id) {
+        console.log(`hive project rm: project ${target.id} ("${target.name}") is the one this directory belongs to and is never removed from itself. Run it from another project.`);
+        process.exit(1);
+    }
+    assertQueenCrossProjectWrite("hive project rm", target.id, {});
+    const counts = projectRowCounts(target.id);
+    console.log(`Project ${target.id}: "${target.name}" (${target.path})`);
+    console.log(Object.keys(counts).length > 0 ? `It owns ${formatRowCounts(counts)}.` : "It owns no rows.");
+    console.log("A snapshot of the store is taken first. Restore it with: hive restore <name>");
+    if (!parsed.flags.has("--yes") && !parsed.flags.has("-y")) {
+        const confirmed = await confirmYesNo("Remove this project and everything it owns? [y/N] ");
+        if (confirmed === null) {
+            console.log("Not removed: run hive interactively to confirm, or pass --yes.");
+            process.exit(1);
+        }
+        if (!confirmed) {
+            console.log("Not removed.");
+            process.exit(1);
+        }
+    }
+    const removed = removeProject(target.id, {
+        snapshot: true,
+        onRemoved: (r) => confirmQueenWrite("hive project rm", r.deleted.id, {}, { project_id: r.deleted.id, name: r.deleted.name, counts: r.counts }),
+    });
+    console.log(`Removed project ${removed.deleted.id} ("${removed.deleted.name}").`);
+    if (Object.keys(removed.counts).length > 0)
+        console.log(`Deleted ${formatRowCounts(removed.counts)}.`);
+    console.log(`Snapshot: ${removed.snapshot}`);
+    console.log("Its actors and any files it left on disk are untouched; actor_prune removes inert actors.");
+}
 function cmdBackups() {
     const snapshots = listSnapshots(dataDir);
     if (snapshots.length === 0) {
@@ -3259,7 +3372,7 @@ if (command === "--version" || command === "-v") {
 const COMMANDS = [
     "lead", "queen", "queen-audit", "init", "attach", "start", "stop", "show", "hide", "status", "portfolio", "next", "setup", "upgrade", "doctor",
     LEAD_PANE_EXITED_VERB,
-    "pads", "pad", "todos", "todo", "backups", "restore", "runbook", "posture", "profile", "kickoff", "statusline",
+    "pads", "pad", "todos", "todo", "backups", "restore", "project", "runbook", "posture", "profile", "kickoff", "statusline",
 ];
 if (!COMMANDS.includes(command)) {
     if (command.startsWith("--")) {
@@ -3344,6 +3457,9 @@ try {
         case "restore":
             await cmdRestore(rest);
             break;
+        case "project":
+            await cmdProject(rest);
+            break;
         case "runbook":
             cmdRunbook(rest[0]);
             break;

package/dist/context.js

@@ -339,10 +339,11 @@ export const QUEEN_REACH = {
     agent_close: "home",
     project_select: "select",
     project_add: "global",
-    project_prune: "global",
+    project_prune: "prune",
     actor_prune: "global",
     "hive lead": "spin_up",
     "hive queen-audit": "read",
+    "hive project rm": "prune",
     "hive init": "home",
     "hive attach": "home",
     "hive next": "home",
@@ -365,6 +366,7 @@ function foreignWriteProblem(reach, targetProjectId, args) {
     switch (reach) {
         case "spin_up":
         case "todo":
+        case "prune":
             return null;
         case "lead_wake": {
             if (args.scope !== undefined)
@@ -440,6 +442,6 @@ function queenRefusal(operation, targetProjectId, problem) {
     const target = targetProjectId === null ? null : getProject(targetProjectId);
     const where = target ? `in project ${target.id} ("${target.name}")` : "outside the queen's own project";
     return new Error(`${QUEEN_REFUSAL}: the queen cannot run ${operation} ${where}: ${problem}. Into another project the ` +
-        "queen may only todo_create, todo_comment, send text or wakes to its running lead, and start its lead " +
-        "with `hive lead <path>`. Everything else there is its lead's to do.");
+        "queen may only todo_create, todo_comment, send text or wakes to its running lead, start its lead " +
+        "with `hive lead <path>`, and run project_prune or `hive project rm` on it. Everything else there is its lead's to do.");
 }

package/dist/contextCheckpoint.js

@@ -24,7 +24,7 @@ export function contextCheckpointAdditionalContext(actorId, thresholdPercent, fi
         return null;
     }
 }
-export function runContextCheckpointHook(kind) {
+export function runContextCheckpointHook(kind, suppliedPayload) {
     const thresholdText = process.env.HIVE_CONTEXT_CHECKPOINT_PERCENT;
     if (!thresholdText || !/^\d+$/.test(thresholdText))
         return;
@@ -35,7 +35,7 @@ export function runContextCheckpointHook(kind) {
     if (!actorId.startsWith("agent:") || (kind !== "claude" && kind !== "codex"))
         return;
     try {
-        const payload = JSON.parse(readFileSync(0, "utf8"));
+        const payload = suppliedPayload === undefined ? JSON.parse(readFileSync(0, "utf8")) : suppliedPayload;
         if (payload === null || typeof payload !== "object" || Array.isArray(payload))
             return;
         const fill = readContextFill(kind, {

package/dist/help.js

@@ -175,7 +175,10 @@ runbook (fork it first), not a pad write.`,
   agent_close(name|agent_id) — kill the worker's pane and mark closed. Capture
     handoffs first; output is not retained. Self-close needs confirm_self.
     On a PARKED row (by agent_id) it releases the park instead, which is how
-    you abandon a lane you have decided not to resume.
+    you abandon a lane you have decided not to resume. row_only=true marks
+    a stale row closed with no kill, stop or typing; a human or peer lead
+    only, refused for a row that provably owns a live pane or when tmux
+    could not be probed.
 
 Address a worker by its name, not its id: agent_send(name="impl", ...). A
 partial name works when it matches one running worker, so name="123" finds
@@ -252,10 +255,14 @@ Every pad, todo, kv entry, and lease belongs to one project (a directory).
   project_list — all registered projects plus the current selection
   project_add(path?, name?) — register a directory (defaults to cwd)
   project_select(project_id) — set this session's default scope
-  project_prune() — delete every registered project that owns no rows
+  project_prune(project_id?, confirm_name?) — delete every registered project that owns no rows
     anywhere in the store, verified individually; never your own; refuses
     under HIVE_PROJECT_LOCK=1 since it sweeps every project, not just yours.
-    With project_id, removes only that project, and only if it owns no rows
+    With project_id, removes only that project, and only if it owns no rows.
+    With project_id and confirm_name (its exact name), removes it with every
+    row it owns after a snapshot; refuses while a running row owns a live
+    pane or cannot be verified (agent_close row_only retires the latter).
+    From a terminal: hive project rm <id|path> [--yes].
 
 Resolution order: explicit project_id argument, then session selection, then
 working-directory auto-detection. When the working directory matches no

package/dist/hook.js

@@ -1,7 +1,70 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, parse, relative, sep } from "node:path";
 import { awaitingFirstPromptSql } from "./firstPrompt.js";
 import { liveBackgroundTasks, SUBAGENT_LATCH_SQL, withholdsIdle } from "./backgroundTasks.js";
+function canonicalPathWithMissingSuffix(input) {
+    if (!isAbsolute(input) || input.includes("\0"))
+        return null;
+    let current = parse(input).root;
+    const missing = [];
+    try {
+        current = realpathSync(current);
+    }
+    catch {
+        return null;
+    }
+    for (const part of input.slice(parse(input).root.length).split(sep)) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (missing.length)
+                missing.pop();
+            else
+                current = dirname(current);
+            continue;
+        }
+        if (missing.length) {
+            missing.push(part);
+            continue;
+        }
+        const candidate = join(current, part);
+        try {
+            current = realpathSync(candidate);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return null;
+            missing.push(part);
+        }
+    }
+    return join(current, ...missing);
+}
+function acceptsWorkerHook(row, payload, sessionsRoot) {
+    if (!row || row.kind !== "agent" || row.codex_home === "" || sessionsRoot === undefined)
+        return true;
+    const transcript = payload.transcript_path;
+    if (typeof transcript === "string" && transcript !== "") {
+        const canonicalRoot = canonicalPathWithMissingSuffix(sessionsRoot);
+        const canonicalTranscript = canonicalPathWithMissingSuffix(transcript);
+        if (canonicalRoot === null || canonicalTranscript === null)
+            return false;
+        const rel = relative(canonicalRoot, canonicalTranscript);
+        return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+    }
+    if (transcript !== undefined && transcript !== null && transcript !== "")
+        return false;
+    return (typeof row.session_id === "string" && row.session_id !== "" &&
+        typeof payload.session_id === "string" && payload.session_id !== "" &&
+        row.session_id === payload.session_id);
+}
+function validCheckpointThreshold() {
+    const text = process.env.HIVE_CONTEXT_CHECKPOINT_PERCENT;
+    if (!text || !/^\d+$/.test(text))
+        return false;
+    const value = Number(text);
+    return Number.isInteger(value) && value >= 1 && value <= 100;
+}
 let raw;
 function readRaw() {
     if (raw === undefined) {
@@ -161,8 +224,33 @@ function stateFor(event, actorId) {
 }
 if (process.argv[2] === "post_tool_use") {
     try {
+        const kind = process.argv[3];
+        const actorId = process.env.HIVE_AGENT_ID ?? "";
+        let suppliedPayload;
+        if (kind === "codex" && validCheckpointThreshold() && actorId.startsWith("agent:")) {
+            suppliedPayload = readPayload();
+            const { db } = await import("./db.js");
+            const row = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+                .get(actorId);
+            if (row?.kind === "agent") {
+                const { harnessFor } = await import("./harnesses.js");
+                if (harnessFor(row.command).name === "codex") {
+                    if (row.status !== "running")
+                        process.exit(0);
+                    if (typeof row.codex_home === "string" && row.codex_home !== "") {
+                        const { codexHomeDir } = await import("./codexHome.js");
+                        if (!acceptsWorkerHook(row, suppliedPayload, join(codexHomeDir(row.codex_home), "sessions"))) {
+                            process.exit(0);
+                        }
+                    }
+                }
+            }
+        }
         const { runContextCheckpointHook } = await import("./contextCheckpoint.js");
-        runContextCheckpointHook(process.argv[3]);
+        if (suppliedPayload === undefined)
+            runContextCheckpointHook(kind);
+        else
+            runContextCheckpointHook(kind, suppliedPayload);
     }
     catch { }
     process.exit(0);
@@ -172,13 +260,43 @@ try {
     const actorId = process.env.HIVE_AGENT_ID;
     if (actorId) {
         const event = process.argv[2] ?? "";
-        const state = stateFor(event, actorId);
-        if (state !== null) {
-            db.prepare("UPDATE agents SET agent_state = ?, state_changed_at = datetime('now') WHERE actor_id = ? AND kind = 'agent'").run(state, actorId);
-        }
-        if (event === "prompt") {
-            db.prepare(`UPDATE agents SET resumed_at = '' WHERE actor_id = ? AND kind = 'agent' AND ${awaitingFirstPromptSql("agents")}`).run(actorId);
+        const hookPayload = readPayload();
+        const row = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+            .get(actorId);
+        let guarded = false;
+        let state = null;
+        if (row?.kind === "agent") {
+            const { harnessFor } = await import("./harnesses.js");
+            if (harnessFor(row.command).name === "codex") {
+                if (row.status !== "running")
+                    process.exit(0);
+                const { codexHomeDir } = await import("./codexHome.js");
+                const result = db.transaction(() => {
+                    const current = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+                        .get(actorId);
+                    if (current?.kind === "agent" && harnessFor(current.command).name === "codex" && current.status !== "running") {
+                        return { status: "inactive", state: null };
+                    }
+                    if (!current || current.kind !== "agent" || typeof current.codex_home !== "string" || !current.codex_home || harnessFor(current.command).name !== "codex") {
+                        return { status: "changed", state: null };
+                    }
+                    const sessionsRoot = join(codexHomeDir(current.codex_home), "sessions");
+                    if (!acceptsWorkerHook(current, hookPayload, sessionsRoot))
+                        return { status: "rejected", state: null };
+                    const state = applyWorkerTransition(actorId, event);
+                    reconcileSessionId(actorId, hookPayload);
+                    reconcileTranscriptPath(actorId, hookPayload);
+                    db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+                    return { status: "accepted", state };
+                }).immediate();
+                if (result.status === "rejected" || result.status === "inactive")
+                    process.exit(0);
+                guarded = result.status === "accepted";
+                state = result.state;
+            }
         }
+        if (!guarded)
+            state = applyWorkerTransition(actorId, event);
         // A lead's turn state is its own table; agents.agent_state stays worker-only.
         if (process.env.HIVE_LEAD === "1" && (event === "prompt" || event === "stop" || event === "session_end")) {
             try {
@@ -195,12 +313,24 @@ try {
             catch {
             }
         }
-        reconcileSessionId(actorId, readPayload());
-        reconcileTranscriptPath(actorId, readPayload());
-        db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+        if (!guarded) {
+            reconcileSessionId(actorId, hookPayload);
+            reconcileTranscriptPath(actorId, hookPayload);
+            db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+        }
         record(actorId, event, state ?? UNCHANGED);
     }
 }
 catch {
 }
 process.exit(0);
+function applyWorkerTransition(actorId, event) {
+    const state = stateFor(event, actorId);
+    if (state !== null) {
+        db.prepare("UPDATE agents SET agent_state = ?, state_changed_at = datetime('now') WHERE actor_id = ? AND kind = 'agent'").run(state, actorId);
+    }
+    if (event === "prompt") {
+        db.prepare(`UPDATE agents SET resumed_at = '' WHERE actor_id = ? AND kind = 'agent' AND ${awaitingFirstPromptSql("agents")}`).run(actorId);
+    }
+    return state;
+}

package/dist/portfolio.js

@@ -4,7 +4,7 @@ import { existsSync } from "node:fs";
 import { parseTags } from "./result.js";
 import { OPEN_BLOCKERS_SQL } from "./tools/todos.js";
 import { readLeadTurnState } from "./leadState.js";
-import { liveTargets, paneReissued, rowAlive, rowAliveProbe } from "./tmux.js";
+import { liveTargets, ownershipLiveness, rowOwnership } from "./tmux.js";
 export const PORTFOLIO_REASONS = [
     "needs_human",
     "dead_lead_pane",
@@ -84,15 +84,14 @@ function projectRow(project, now, snapshot) {
     const agents = db
         .prepare("SELECT id, kind, agent_state, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' ORDER BY id")
         .all(project.id);
-    const liveness = (a) => snapshot ? rowAlive(a.tmux_socket, a.tmux_target, snapshot) : null;
-    const reissued = (a) => snapshot !== null && paneReissued(a.pane_pid, rowAliveProbe(a.tmux_socket, a.tmux_target, snapshot));
+    const liveness = (a) => ownershipLiveness(rowOwnership(a, snapshot));
     const workers = { working: 0, idle: 0, needs_input: 0, other: 0, unreachable: 0, unconfirmed: 0 };
     let liveWorking = 0;
     let liveWaiting = 0;
     let lead = { state: "none", agent_id: null, turn: "unknown" };
     for (const a of agents) {
         if (a.kind === "lead") {
-            const live = reissued(a) ? false : liveness(a);
+            const live = liveness(a);
             lead = {
                 state: live === true ? "alive" : live === false ? "dead_pane" : "unknown",
                 agent_id: a.id,
@@ -102,7 +101,7 @@ function projectRow(project, now, snapshot) {
         }
         if (a.kind !== "agent")
             continue;
-        const live = reissued(a) ? false : liveness(a);
+        const live = liveness(a);
         if (live === false)
             workers.unreachable++;
         else if (live === null)

package/dist/projectRemove.js

@@ -0,0 +1,104 @@
+import { backupNow } from "./backup.js";
+import { dataDir, db } from "./db.js";
+import { LEAD_KIND } from "./spawn.js";
+import { foreignSocket, liveTargets, observationFailed, rowOwnership } from "./tmux.js";
+export const PROJECT_OWNER_TABLES = [
+    "pads",
+    "todos",
+    "kv",
+    "leases",
+    "agents",
+    "wakes",
+    "command_trust",
+];
+const COUNTED_TABLES = [
+    ...PROJECT_OWNER_TABLES.map((t) => [t, `SELECT COUNT(*) AS n FROM ${t} WHERE project_id = ?`]),
+    ["todo_comments", "SELECT COUNT(*) AS n FROM todo_comments WHERE todo_id IN (SELECT id FROM todos WHERE project_id = ?)"],
+    ["agent_messages", "SELECT COUNT(*) AS n FROM agent_messages WHERE project_id = ?"],
+];
+export function projectRowCounts(projectId) {
+    const counts = {};
+    for (const [table, sql] of COUNTED_TABLES) {
+        const n = db.prepare(sql).get(projectId).n;
+        if (n > 0)
+            counts[table] = n;
+    }
+    return counts;
+}
+export function formatRowCounts(counts) {
+    return Object.entries(counts)
+        .map(([table, n]) => `${table}: ${n}`)
+        .join(", ");
+}
+const runningRows = (projectId) => db
+    .prepare("SELECT id, name, kind, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' ORDER BY id")
+    .all(projectId);
+const identities = (rows) => JSON.stringify(rows.map((r) => [r.id, r.tmux_target, r.tmux_socket, r.pane_pid]));
+function assertNoRunningAgents(projectId, name, running, panes) {
+    if (running.length === 0)
+        return;
+    const snapshot = panes === undefined ? liveTargets() : panes;
+    const blockers = running
+        .map((a) => ({ ...a, ownership: rowOwnership(a, snapshot) }))
+        .filter((a) => a.ownership === "live" || a.ownership === "unknown");
+    if (blockers.length === 0)
+        return;
+    const names = blockers
+        .map((a) => `${a.name} (agent ${a.id}, ${a.ownership === "live" ? "owns a live pane" : "pane identity unknown"})`)
+        .join(", ");
+    const hints = [];
+    const liveLeads = blockers.filter((a) => a.ownership === "live" && a.kind === LEAD_KIND);
+    const liveOthers = blockers.filter((a) => a.ownership === "live" && a.kind !== LEAD_KIND);
+    const unknown = blockers.filter((a) => a.ownership === "unknown");
+    if (liveLeads.length > 0)
+        hints.push("A live lead is stopped or restarted from its own terminal, never retired with row_only.");
+    if (liveOthers.length > 0)
+        hints.push("Stop a live worker or command with agent_close first.");
+    if (unknown.length > 0 && observationFailed(snapshot)) {
+        hints.push("tmux could not be probed, so no row's ownership could be checked. Retry in a few seconds.");
+    }
+    else if (unknown.length > 0) {
+        const foreign = unknown.some((a) => foreignSocket(a.tmux_socket));
+        hints.push("A row whose pane cannot be verified is retired explicitly by a human or peer lead through this project's MCP " +
+            `tool, ${unknown.map((a) => `agent_close({agent_id: ${a.id}, row_only: true})`).join(", ")}` +
+            (foreign
+                ? ", or run this again from the tmux socket a foreign-socket row was recorded on, where its ownership can be verified."
+                : "."));
+    }
+    throw new Error(`project ${projectId} ("${name}") has running agents: ${names}. Nothing deleted. ${hints.join(" ")}`);
+}
+const deleteProjectRows = db.transaction((projectId, name, expected, observed, after) => {
+    const running = runningRows(projectId);
+    if (identities(running) !== observed.rows) {
+        throw new Error(`project ${projectId} ("${name}") changed while the snapshot was taken; nothing removed, run it again.`);
+    }
+    assertNoRunningAgents(projectId, name, running, observed.panes);
+    if (JSON.stringify(projectRowCounts(projectId)) !== JSON.stringify(expected)) {
+        throw new Error(`project ${projectId} ("${name}") changed while the snapshot was taken; nothing removed, run it again.`);
+    }
+    db.prepare("DELETE FROM agent_messages WHERE project_id = ?").run(projectId);
+    if (db.prepare("DELETE FROM projects WHERE id = ?").run(projectId).changes === 0) {
+        throw new Error(`no project ${projectId}.`);
+    }
+    after();
+});
+export function removeProject(projectId, opts) {
+    const target = db.prepare("SELECT id, name, path FROM projects WHERE id = ?").get(projectId);
+    if (!target)
+        throw new Error(`no project ${projectId}.`);
+    assertNoRunningAgents(projectId, target.name, runningRows(projectId));
+    const counts = projectRowCounts(projectId);
+    let snapshot = null;
+    if (opts.snapshot) {
+        const result = backupNow(db, dataDir, "manual");
+        if (!result.ok)
+            throw new Error(`could not snapshot the store first, nothing deleted: ${result.error ?? "unknown error"}`);
+        snapshot = result.path ?? null;
+    }
+    opts.afterSnapshot?.();
+    const rows = runningRows(projectId);
+    const observed = { rows: identities(rows), panes: rows.length > 0 ? liveTargets() : null };
+    const removed = { deleted: { id: target.id, name: target.name, path: target.path }, counts, snapshot };
+    deleteProjectRows.immediate(projectId, target.name, counts, observed, () => opts.onRemoved?.(removed));
+    return removed;
+}

package/dist/queenAudit.js

@@ -9,6 +9,10 @@ export const QUEEN_AUDIT_MAX_ROWS = 20_000;
 function resource(type, value) {
     return typeof value === "number" && Number.isInteger(value) && value > 0 ? { type, id: value } : null;
 }
+function removalSummary(r) {
+    const counts = Object.entries((r.counts ?? {})).map(([t, n]) => `${t} ${n}`);
+    return `removed project "${r.name}"${counts.length > 0 ? ` with ${counts.join(", ")}` : ""}`;
+}
 export const QUEEN_AUDIT_OPERATIONS = {
     todo_create: {
         mode: "database",
@@ -45,6 +49,16 @@ export const QUEEN_AUDIT_OPERATIONS = {
         resource: (r) => r.sent === true ? resource("agent", r.agent_id) : null,
         summary: (a, r) => `agent #${r.agent_id} ${a.submit === false ? "pasted without submit" : "submitted"}: ${a.text}`,
     },
+    project_prune: {
+        mode: "database",
+        resource: (r) => resource("project", r.project_id),
+        summary: (_a, r) => removalSummary(r),
+    },
+    "hive project rm": {
+        mode: "database",
+        resource: (r) => resource("project", r.project_id),
+        summary: (_a, r) => removalSummary(r),
+    },
     "hive lead": {
         mode: "external",
         resource: (r) => r.disposition === "started" || r.disposition === "adopted" ? resource("agent", r.agent_id) : null,

package/dist/spawn.js

@@ -371,13 +371,18 @@ export function reapCodexHomeForClosedAgent(agentId, codexHome) {
     }
     db.prepare("UPDATE agents SET codex_home = '' WHERE id = ? AND codex_home = ?").run(agentId, codexHome);
 }
-export function closeAgentRow(agentId, expectedTmuxTarget) {
-    const info = expectedTmuxTarget === undefined
+export function closeAgentRow(agentId, expected) {
+    const info = expected === undefined
         ? db
             .prepare("UPDATE agents SET status = 'closed', closed_at = datetime('now') WHERE id = ? AND status = 'running'")
             .run(agentId)
-        : db
-            .prepare("UPDATE agents SET status = 'closed', closed_at = datetime('now') WHERE id = ? AND status = 'running' AND tmux_target = ?")
-            .run(agentId, expectedTmuxTarget);
+        : typeof expected === "string"
+            ? db
+                .prepare("UPDATE agents SET status = 'closed', closed_at = datetime('now') WHERE id = ? AND status = 'running' AND tmux_target = ?")
+                .run(agentId, expected)
+            : db
+                .prepare("UPDATE agents SET status = 'closed', closed_at = datetime('now') WHERE id = ? AND status = 'running' " +
+                "AND tmux_target = ? AND tmux_socket = ? AND pane_pid = ?")
+                .run(agentId, expected.tmux_target, expected.tmux_socket, expected.pane_pid);
     return info.changes > 0;
 }

package/dist/tmux.js

@@ -470,6 +470,31 @@ export function rowAliveProbe(recordedSocket, target, snapshot) {
 export function paneReissued(recordedPid, probe) {
     return probe.live === true && recordedPid !== "" && probe.pid !== null && probe.pid !== recordedPid;
 }
+// The one place a row's claim on a pane is decided. An existing pane is "live" only when both
+// pids are known and equal; an empty recorded pid on a live id is "unknown", never "live".
+export function observationFailed(snapshot) {
+    return snapshot === null || snapshot.serverAnswered === false;
+}
+export function rowOwnership(row, snapshot) {
+    if (foreignSocket(row.tmux_socket))
+        return "unknown";
+    if (row.tmux_target === "")
+        return "gone";
+    const observed = snapshot === undefined ? liveTargets() : snapshot;
+    if (observed === null || observationFailed(observed))
+        return "unknown";
+    if (!targetAlive(row.tmux_target, observed))
+        return "gone";
+    if (!isPaneTarget(row.tmux_target))
+        return "unknown";
+    const pid = targetPid(row.tmux_target, observed) ?? "";
+    if (row.pane_pid === "" || pid === "")
+        return "unknown";
+    return pid === row.pane_pid ? "live" : "reissued";
+}
+export function ownershipLiveness(ownership) {
+    return ownership === "live" ? true : ownership === "unknown" ? null : false;
+}
 export const RAW_ATTACH_TMUX_CONFIG = [
     "set -g allow-passthrough all",
 ];
@@ -1018,7 +1043,8 @@ export function paneChoiceCheck(target) {
 // codex has no box border to anchor on, so the box's bottom edge used to be inferred from the literal
 // text of its footer status line - but that text is not stable (todo 524: two different compositions
 // seen on one codex version, one with no shared substring at all). The anchor below reads structure
-// instead of content: the pane's own last non-blank row IS the bottom edge, whatever it says.
+// instead of content: the pane's own last non-blank row IS the bottom edge, whatever it says, except that a
+// "? for shortcuts" row or a right-aligned footer row pulls the edge up to the status row above it.
 // codex's own choice-menu shape (see hive-internals), not claude's CHOICE_DIALOG wording. Declared
 // above findCodexPromptBox because the box search itself now needs it to reject a choice row rather
 // than mistake it for a live prompt.
@@ -1037,6 +1063,7 @@ function codexPromptContentStart(promptRow) {
         i += 1;
     return i;
 }
+const CODEX_SHORTCUTS_ROW = /^\?\s+for shortcuts/;
 function findCodexPromptBox(rows) {
     const text = rows.map((row) => stripControlBytes(stripSgr(row)).trim());
     let footer = text.length - 1;
@@ -1044,6 +1071,17 @@ function findCodexPromptBox(rows) {
         footer -= 1;
     if (footer < 0)
         return null;
+    // The row directly above "? for shortcuts" starts one footer block if it has codex's " · " status separator.
+    if (CODEX_SHORTCUTS_ROW.test(text[footer]) && footer > 0 && text[footer - 1].includes(" · "))
+        footer -= 1;
+    else if (footer > 0 && text[footer - 1].includes(" · ")) {
+        const footerRow = stripControlBytes(stripSgr(rows[footer]));
+        const footerContent = footerRow.trim();
+        const leadingWhitespace = footerRow.length - footerRow.trimStart().length;
+        // Use the row's geometry so this remains independent of whatever Codex writes in its footer.
+        if (leadingWhitespace > footerContent.length)
+            footer -= 1;
+    }
     let prompt = -1;
     for (let i = footer - 1; i >= 0 && footer - i <= BOX_MAX_ROWS; i--) {
         // The arrow ALONE, against the trimmed row: capture-pane strips a trailing space, and a box with
@@ -1062,12 +1100,10 @@ function findCodexPromptBox(rows) {
     // stale submitted prompt that also starts with "›").
     if (CODEX_CHOICE_LINE.test(text[prompt]))
         return null;
-    // Nothing but the prompt's own continuation, then one blank gap, may sit between the prompt row and
-    // the footer. Real content in that gap means the "›" found above is stale scrollback, not the live
-    // box - a busy/mid-turn screen can have an old prompt sitting within BOX_MAX_ROWS of whatever text
-    // is currently at the bottom, and only this check tells the two apart (see hive-internals).
+    // Only indented continuation rows, then one blank gap, may sit between the prompt and footer.
+    // Left-aligned output in that gap means the prompt is stale, not a live box (see hive-internals).
     let i = prompt + 1;
-    while (i <= footer && text[i] !== "")
+    while (i <= footer && text[i] !== "" && /^\s/.test(stripControlBytes(stripSgr(rows[i]))))
         i += 1;
     while (i <= footer && text[i] === "")
         i += 1;

package/dist/tools/agents.js

@@ -16,7 +16,7 @@ import { markGoneReported } from "../scheduler.js";
 import { agentIdentityEnv, branchAt, closeAgentRow, discardOrphanedPane, isReservedAgentName, isRunningLeadActor, killAgentPane, launchAgent, LEAD_KIND, parkAgentRow, reapCodexHomeForClosedAgent, releaseParkRow, renameAgent, resumeAgent, storedLaunchOptions, } from "../spawn.js";
 import { COMMAND_KIND, runningCommandRow, stopLine, stopProcess, STOP_REASONS } from "../processes.js";
 import { readContextTokens, readContextFill, resolveTranscriptDir } from "../transcript.js";
-import { capturePane, captureFinalScreen, DEFAULT_LAYOUT, cancelCopyMode, describePaneChoice, ensureAttached, findUnsafeControlChar, holdsHumanInput, liveTargets, paneCurrentCommand, paneInCopyMode, paneWindow, pollPaneReadiness, rowAlive, rowLive, sendText, sessionName, setRemainOnExit, sleep, TEXT_ALLOWED_CONTROL_CHARS, tmux, TmuxTimeoutError, WINDOW_LAYOUTS, } from "../tmux.js";
+import { capturePane, captureFinalScreen, DEFAULT_LAYOUT, cancelCopyMode, describePaneChoice, ensureAttached, findUnsafeControlChar, foreignSocket, holdsHumanInput, liveTargets, observationFailed, ownershipLiveness, paneCurrentCommand, paneInCopyMode, paneWindow, pollPaneReadiness, rowLive, rowOwnership, sendText, sessionName, setRemainOnExit, sleep, TEXT_ALLOWED_CONTROL_CHARS, tmux, TmuxTimeoutError, WINDOW_LAYOUTS, } from "../tmux.js";
 import { agentIdParam, agentNameParam, idParam, projectIdParam } from "./params.js";
 import { deriveProvenance, lastLogEvent, lastPermissionMode, reportsAgentStateLog, } from "../stateProvenance.js";
 const CLOSED_ROW_ORDER = "(parked_at != '') DESC, closed_at DESC, id DESC";
@@ -129,12 +129,60 @@ function buildParkReceipt(project, agent, parkedAt, branch, note) {
         ...(note ? { note } : {}),
     };
 }
+function closeRowOnly(agent, confirmSelf) {
+    const receipt = { row_only: true, agent_id: agent.id, name: agent.name, closed: true };
+    if (currentActor().startsWith("agent:")) {
+        throw new Error(`Agent ${agent.id} ("${agent.name}"): row_only retirement is reserved for a human at a terminal or a peer ` +
+            "lead; a worker may not retire rows this way. Nothing was changed.");
+    }
+    if (agent.actor_id === currentActor() && !confirmSelf) {
+        throw new Error("This would close your own session. Pass confirm_self=true only if the user explicitly asked you to close yourself.");
+    }
+    if (agent.status !== "running") {
+        return {
+            ...receipt,
+            ...(agent.parked_at ? { parked: true } : {}),
+            note: "Already closed; row_only changed nothing and left any park in place.",
+        };
+    }
+    const observes = !foreignSocket(agent.tmux_socket) && agent.tmux_target !== "";
+    const snapshot = observes ? liveTargets() : null;
+    if (observes && observationFailed(snapshot))
+        throw probeFailed(agent);
+    const ownership = rowOwnership(agent, snapshot);
+    if (ownership === "live") {
+        throw new Error(`Agent ${agent.id} ("${agent.name}") owns a live pane (its recorded pane pid matches), so row_only refuses: ` +
+            "retiring the row would orphan a running process with nothing left to stop it by. " +
+            (agent.kind === LEAD_KIND
+                ? "Restart or end the lead from its own terminal."
+                : "Use agent_close without row_only to stop it."));
+    }
+    if (!closeAgentRow(agent.id, { tmux_target: agent.tmux_target, tmux_socket: agent.tmux_socket, pane_pid: agent.pane_pid })) {
+        const after = getAgentRow(agent.project_id, agent.id, "Call agent_list(include_closed: true).");
+        if (after.status !== "running") {
+            return {
+                ...receipt,
+                ...(after.parked_at ? { parked: true } : {}),
+                note: "Already closed by someone else before this call's row-only retirement landed. Nothing else was changed.",
+            };
+        }
+        throw new Error(`Agent ${agent.id} ("${agent.name}")'s pane identity changed since this call read it, most likely a fresh ` +
+            "pane recorded on it. Nothing was closed. Re-read it with agent_status and decide again.");
+    }
+    return {
+        ...receipt,
+        note: `Row retired with no kill, stop or typing; its pane ownership read ${ownership}.` +
+            (ownership === "unknown" ? " Anything still running in that pane was left alone." : ""),
+    };
+}
 export function isLive(agent) {
     if (agent.status !== "running")
         return false;
     return rowLive(agent.tmux_socket, agent.tmux_target);
 }
 export const PROBE_FAILED_NOTE = "tmux could not be probed, so liveness is unknown. Nothing was changed. Retry in a few seconds.";
+const unknownOwnershipNote = (snapshot) => observationFailed(snapshot) ? PROBE_FAILED_NOTE : UNVERIFIED_OWNERSHIP_NOTE;
+const UNVERIFIED_OWNERSHIP_NOTE = "This row's pane cannot be verified as its own: it is on another tmux socket, or no pane pid was recorded for it, so liveness is unknown and no screen was read. Nothing was changed. If the row is stale, a human or peer lead can retire it with agent_close(row_only=true).";
 export const probeFailed = (agent) => new Error(`Agent ${agent.id} ("${agent.name}"): ${PROBE_FAILED_NOTE}`);
 function requireLive(agent) {
     if (agent.status !== "running") {
@@ -250,11 +298,7 @@ const PANE_READY_MS = Number(process.env.HIVE_SPAWN_READY_MS ?? 45_000);
 export function summaryLiveness(row, snapshot) {
     if (row.status !== "running")
         return false;
-    if (snapshot === undefined)
-        return rowLive(row.tmux_socket, row.tmux_target);
-    if (snapshot === null)
-        return null;
-    return rowAlive(row.tmux_socket, row.tmux_target, snapshot);
+    return ownershipLiveness(rowOwnership(row, snapshot));
 }
 function capturePaneQuietly(target) {
     try {
@@ -1031,11 +1075,12 @@ export function registerAgents(server) {
     }, (args) => run(() => {
         const project = resolveProject(args.project_id);
         const agent = findAgent(project.id, args);
-        const summary = agentSummary(agent);
+        const snapshot = agent.status === "running" ? liveTargets() : null;
+        const summary = agentSummary(agent, snapshot);
         const briefPath = agentBriefPath(agent.id);
         return {
             ...summary,
-            ...(summary.alive === null ? { note: PROBE_FAILED_NOTE } : {}),
+            ...(summary.alive === null ? { note: unknownOwnershipNote(snapshot) } : {}),
             closed_at: agent.closed_at,
             current_command: summary.alive ? paneCurrentCommand(agent.tmux_target) : null,
             brief_path: existsSync(briefPath) ? briefPath : null,
@@ -1285,7 +1330,8 @@ export function registerAgents(server) {
         const project = resolveProject(args.project_id);
         const agent = findAgent(project.id, args);
         const lines = Math.min(args.lines ?? 50, 200);
-        const alive = isLive(agent);
+        const snapshot = agent.status === "running" ? liveTargets() : null;
+        const alive = summaryLiveness(agent, snapshot);
         return {
             agent_id: agent.id,
             name: agent.name,
@@ -1296,14 +1342,14 @@ export function registerAgents(server) {
                 ? {}
                 : {
                     note: alive === null
-                        ? PROBE_FAILED_NOTE
-                        : "No live tmux window; output is not retained after exit.",
+                        ? unknownOwnershipNote(snapshot)
+                        : "No live tmux window this row owns; output is not retained after exit.",
                 }),
             ...(alive !== true && agent.exit_tail ? { exit_tail: agent.exit_tail } : {}),
         };
     }));
     server.registerTool("agent_close", {
-        description: "Kill an agent's tmux window and mark it closed, addressed by name (or agent_id). Capture handoffs (todo comments, pads) BEFORE closing; terminal output is not retained. Closing yourself requires confirm_self=true. Refuses a lead target whose pane is live; retires one whose pane is confirmed dead. A worker may never close a lead, live or dead.",
+        description: "Kill an agent's tmux window and mark it closed, addressed by name (or agent_id). Capture handoffs (todo comments, pads) BEFORE closing; terminal output is not retained. Closing yourself requires confirm_self=true. Refuses a lead target whose pane is live; retires one whose pane is confirmed dead. A worker may never close a lead, live or dead. row_only=true retires a stale row with no kill, stop or typing: for a human or peer lead only, and refused for any row that provably owns a live pane or when tmux could not be probed.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,
@@ -1314,12 +1360,17 @@ export function registerAgents(server) {
             name: agentNameParam,
             agent_id: agentIdParam,
             confirm_self: z.boolean().optional(),
+            row_only: z
+                .boolean()
+                .optional()
+                .describe("Mark the row closed with no kill, stop or typing, for a row whose pane is gone, reissued or unverifiable. Human or peer lead only. Defaults to false."),
             project_id: projectIdParam,
         },
         outputSchema: {
             agent_id: idParam,
             name: z.string(),
             closed: z.boolean(),
+            row_only: z.boolean().optional(),
             park_released: z.boolean().optional(),
             parked: z.boolean().optional(),
             note: z.string().optional(),
@@ -1327,6 +1378,8 @@ export function registerAgents(server) {
     }, (args) => run(() => {
         const project = resolveProject(args.project_id);
         const agent = findAgent(project.id, args);
+        if (args.row_only === true)
+            return closeRowOnly(agent, args.confirm_self === true);
         if (agent.kind === LEAD_KIND && currentActor().startsWith("agent:")) {
             throw new Error(`Agent ${agent.id} ("${agent.name}") is this project's lead session. Retiring a lead - live, ` +
                 "confirmed dead, or unprobed - is reserved for a human at a terminal or a peer lead; a " +

package/dist/tools/meta.js

@@ -1,39 +1,29 @@
 import { z } from "zod";
 import { db } from "../db.js";
-import { addProject, currentActor, listProjects, resolveProject, selectProjectById, TOUCH_INTERVAL_MS, trySelectedProject, } from "../context.js";
+import { addProject, currentActor, listProjects, findProjectForCwd, resolveProject, selectProjectById, TOUCH_INTERVAL_MS, trySelectedProject, } from "../context.js";
+import { confirmQueenWrite } from "../queenAudit.js";
 import { errorMessage, run } from "../result.js";
 import { HELP_TOPICS, helpOverview } from "../help.js";
 import { idParam } from "./params.js";
+import { formatRowCounts, PROJECT_OWNER_TABLES, projectRowCounts, removeProject } from "../projectRemove.js";
 function refuseIfLocked(tool) {
     if (process.env.HIVE_PROJECT_LOCK === "1") {
         throw new Error(`${tool} sweeps the whole store, across every project and every actor. This session is locked to one project (HIVE_PROJECT_LOCK=1) and cannot run it. Run it from an unlocked session (a lead).`);
     }
 }
-export const PROJECT_OWNER_TABLES = [
-    "pads",
-    "todos",
-    "kv",
-    "leases",
-    "agents",
-    "wakes",
-    "command_trust",
-];
 function existsWhere(table, column, value) {
     return db.prepare(`SELECT 1 FROM ${table} WHERE ${column} = ? LIMIT 1`).get(value) !== undefined;
 }
 function projectOwnsRows(projectId) {
     return PROJECT_OWNER_TABLES.some((table) => existsWhere(table, "project_id", projectId));
 }
-function ownedRowCounts(projectId) {
-    return PROJECT_OWNER_TABLES.flatMap((table) => {
-        const n = db.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE project_id = ?`).get(projectId).n;
-        return n > 0 ? [`${table}: ${n}`] : [];
-    });
-}
-const pruneProjectIfEmpty = db.transaction((projectId) => {
-    if (projectOwnsRows(projectId))
+const pruneProjectIfEmpty = db.transaction((project) => {
+    if (projectOwnsRows(project.id))
+        return false;
+    if (db.prepare("DELETE FROM projects WHERE id = ?").run(project.id).changes === 0)
         return false;
-    return db.prepare("DELETE FROM projects WHERE id = ?").run(projectId).changes > 0;
+    confirmQueenWrite("project_prune", project.id, {}, { project_id: project.id, name: project.name });
+    return true;
 });
 export const ACTOR_OWNER_COLUMNS = [
     ["agents", "actor_id"],
@@ -149,30 +139,52 @@ export function registerMeta(server) {
         inputSchema: { project_id: idParam },
     }, ({ project_id }) => run(() => selectProjectById(project_id)));
     server.registerTool("project_prune", {
-        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
+        description: "Delete every registered project that owns no rows anywhere in the store (pads, todos, kv, leases, agents, wakes, command_trust), verified individually before each delete. Never prunes the caller's own project. With project_id, removes exactly that one project instead of sweeping, and only if it owns no rows; otherwise refuses and names what it owns. With project_id AND confirm_name (the project's exact name), removes that one project even when it owns rows: it takes a snapshot first, refuses while a running row owns a live pane or its pane ownership cannot be verified (agent_close row_only retires the latter), then deletes the project with everything it owns (todos, comments, pads, kv, leases, agents, wakes, trust, agent messages) in one transaction and reports per-table counts and the snapshot path. queen_audit rows naming it are kept, and so are other projects' lead-idle subscriptions that target it, so a watch on its lead ends with a named reason. confirm_name without project_id is refused, and there is no forced sweep. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep, and a project-locked session may only touch its own project. Immediate, permanent: no dry-run mode.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,
             idempotentHint: true,
             openWorldHint: false,
         },
-        inputSchema: { project_id: idParam.optional() },
+        inputSchema: { project_id: idParam.optional(), confirm_name: z.string().optional() },
         outputSchema: {
             deleted: z.array(z.object({ id: idParam, name: z.string() })),
             held_back: z.object({ project_id: idParam, reason: z.string() }),
             errors: z.array(z.object({ id: idParam, name: z.string(), error: z.string() })).optional(),
+            counts: z.record(z.string(), z.number()).optional(),
+            snapshot: z.string().nullable().optional(),
         },
-    }, ({ project_id }) => run(() => {
+    }, ({ project_id, confirm_name }) => run(() => {
         refuseIfLocked("project_prune");
         const homeId = resolveProject().id;
+        const cwdId = findProjectForCwd()?.id;
+        const isOwn = (id) => id === homeId || id === cwdId;
+        if (confirm_name !== undefined && project_id === undefined) {
+            throw new Error("project_prune: confirm_name needs project_id; there is no forced sweep.");
+        }
         if (project_id !== undefined) {
-            if (project_id === homeId)
+            if (isOwn(project_id))
                 throw new Error(`project_prune: project ${project_id} is the caller's own project and is never pruned.`);
             const target = listProjects().find((p) => p.id === project_id);
             if (!target)
                 throw new Error(`project_prune: no project ${project_id}. List them with project_list.`);
-            if (!pruneProjectIfEmpty.immediate(project_id)) {
-                throw new Error(`project_prune: project ${project_id} ("${target.name}") is not empty, nothing deleted. It owns ${ownedRowCounts(project_id).join(", ")}.`);
+            if (confirm_name !== undefined) {
+                if (confirm_name !== target.name) {
+                    throw new Error(`project_prune: confirm_name does not match project ${project_id}, whose name is "${target.name}". Nothing deleted.`);
+                }
+                const removed = removeProject(project_id, {
+                    snapshot: true,
+                    onRemoved: (r) => confirmQueenWrite("project_prune", project_id, {}, { project_id, name: r.deleted.name, counts: r.counts }),
+                });
+                return {
+                    deleted: [{ id: removed.deleted.id, name: removed.deleted.name }],
+                    held_back: { project_id: homeId, reason: "caller's own project" },
+                    counts: removed.counts,
+                    snapshot: removed.snapshot,
+                };
+            }
+            if (!pruneProjectIfEmpty.immediate(target)) {
+                throw new Error(`project_prune: project ${project_id} ("${target.name}") is not empty, nothing deleted. It owns ${formatRowCounts(projectRowCounts(project_id))}. To remove it with everything it owns, pass confirm_name with its exact name.`);
             }
             return {
                 deleted: [{ id: target.id, name: target.name }],
@@ -182,10 +194,10 @@ export function registerMeta(server) {
         const deleted = [];
         const errors = [];
         for (const project of listProjects()) {
-            if (project.id === homeId)
+            if (isOwn(project.id))
                 continue;
             try {
-                if (pruneProjectIfEmpty.immediate(project.id)) {
+                if (pruneProjectIfEmpty.immediate(project)) {
                     deleted.push({ id: project.id, name: project.name });
                 }
             }
@@ -200,7 +212,7 @@ export function registerMeta(server) {
         };
     }));
     server.registerTool("actor_prune", {
-        description: "Delete every actor that owns no rows anywhere in the store and has not been active in the last minute: agents.actor_id, agents.parent_actor_id, todos.locked_by, todo_comments.author, kv.updated_by, leases.owner, pads.updated_by, wakes.owner, wakes.deliver_actor, agent_state_log.actor_id. The scan is global across every project, never scoped to the caller's: actors carry no project_id, so an actor can own rows in a project the caller cannot see, and a project-scoped scan would misread that actor as inert and delete it. Never prunes the caller's own actor. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep. Run this after project_prune when sweeping the store: an empty project owns no agents rows either, so today the order cannot orphan an actor, but that stops being true the day project deletion ever covers a non-empty project, and this ordering is the one that stays safe if it does. Immediate, permanent: no dry-run mode.",
+        description: "Delete every actor that owns no rows anywhere in the store and has not been active in the last minute: agents.actor_id, agents.parent_actor_id, todos.locked_by, todo_comments.author, kv.updated_by, leases.owner, pads.updated_by, wakes.owner, wakes.deliver_actor, agent_state_log.actor_id. The scan is global across every project, never scoped to the caller's: actors carry no project_id, so an actor can own rows in a project the caller cannot see, and a project-scoped scan would misread that actor as inert and delete it. Never prunes the caller's own actor. Refuses under HIVE_PROJECT_LOCK=1: this is a whole-store sweep. Run this after project_prune when sweeping the store: project_prune with confirm_name removes a non-empty project together with its agents rows, so run this afterwards to clear that project's actors that own nothing else. Actors with agent_state_log rows stay, because that log is append-only and has no project, which means every actor that ever ran a lead or worker stays. Immediate, permanent: no dry-run mode.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmgmyr/hive",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Run a crew of Claude Code and Codex workers from one lead session: visible tmux panes, exact state from hooks, one local SQLite store.",
   "type": "module",
   "bin": {