@cmgmyr/hive 1.5.0 → 1.7.0

package/dist/hook.js

@@ -1,7 +1,70 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, parse, relative, sep } from "node:path";
 import { awaitingFirstPromptSql } from "./firstPrompt.js";
 import { liveBackgroundTasks, SUBAGENT_LATCH_SQL, withholdsIdle } from "./backgroundTasks.js";
+function canonicalPathWithMissingSuffix(input) {
+    if (!isAbsolute(input) || input.includes("\0"))
+        return null;
+    let current = parse(input).root;
+    const missing = [];
+    try {
+        current = realpathSync(current);
+    }
+    catch {
+        return null;
+    }
+    for (const part of input.slice(parse(input).root.length).split(sep)) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (missing.length)
+                missing.pop();
+            else
+                current = dirname(current);
+            continue;
+        }
+        if (missing.length) {
+            missing.push(part);
+            continue;
+        }
+        const candidate = join(current, part);
+        try {
+            current = realpathSync(candidate);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return null;
+            missing.push(part);
+        }
+    }
+    return join(current, ...missing);
+}
+function acceptsWorkerHook(row, payload, sessionsRoot) {
+    if (!row || row.kind !== "agent" || row.codex_home === "" || sessionsRoot === undefined)
+        return true;
+    const transcript = payload.transcript_path;
+    if (typeof transcript === "string" && transcript !== "") {
+        const canonicalRoot = canonicalPathWithMissingSuffix(sessionsRoot);
+        const canonicalTranscript = canonicalPathWithMissingSuffix(transcript);
+        if (canonicalRoot === null || canonicalTranscript === null)
+            return false;
+        const rel = relative(canonicalRoot, canonicalTranscript);
+        return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+    }
+    if (transcript !== undefined && transcript !== null && transcript !== "")
+        return false;
+    return (typeof row.session_id === "string" && row.session_id !== "" &&
+        typeof payload.session_id === "string" && payload.session_id !== "" &&
+        row.session_id === payload.session_id);
+}
+function validCheckpointThreshold() {
+    const text = process.env.HIVE_CONTEXT_CHECKPOINT_PERCENT;
+    if (!text || !/^\d+$/.test(text))
+        return false;
+    const value = Number(text);
+    return Number.isInteger(value) && value >= 1 && value <= 100;
+}
 let raw;
 function readRaw() {
     if (raw === undefined) {
@@ -161,8 +224,33 @@ function stateFor(event, actorId) {
 }
 if (process.argv[2] === "post_tool_use") {
     try {
+        const kind = process.argv[3];
+        const actorId = process.env.HIVE_AGENT_ID ?? "";
+        let suppliedPayload;
+        if (kind === "codex" && validCheckpointThreshold() && actorId.startsWith("agent:")) {
+            suppliedPayload = readPayload();
+            const { db } = await import("./db.js");
+            const row = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+                .get(actorId);
+            if (row?.kind === "agent") {
+                const { harnessFor } = await import("./harnesses.js");
+                if (harnessFor(row.command).name === "codex") {
+                    if (row.status !== "running")
+                        process.exit(0);
+                    if (typeof row.codex_home === "string" && row.codex_home !== "") {
+                        const { codexHomeDir } = await import("./codexHome.js");
+                        if (!acceptsWorkerHook(row, suppliedPayload, join(codexHomeDir(row.codex_home), "sessions"))) {
+                            process.exit(0);
+                        }
+                    }
+                }
+            }
+        }
         const { runContextCheckpointHook } = await import("./contextCheckpoint.js");
-        runContextCheckpointHook(process.argv[3]);
+        if (suppliedPayload === undefined)
+            runContextCheckpointHook(kind);
+        else
+            runContextCheckpointHook(kind, suppliedPayload);
     }
     catch { }
     process.exit(0);
@@ -172,13 +260,43 @@ try {
     const actorId = process.env.HIVE_AGENT_ID;
     if (actorId) {
         const event = process.argv[2] ?? "";
-        const state = stateFor(event, actorId);
-        if (state !== null) {
-            db.prepare("UPDATE agents SET agent_state = ?, state_changed_at = datetime('now') WHERE actor_id = ? AND kind = 'agent'").run(state, actorId);
-        }
-        if (event === "prompt") {
-            db.prepare(`UPDATE agents SET resumed_at = '' WHERE actor_id = ? AND kind = 'agent' AND ${awaitingFirstPromptSql("agents")}`).run(actorId);
+        const hookPayload = readPayload();
+        const row = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+            .get(actorId);
+        let guarded = false;
+        let state = null;
+        if (row?.kind === "agent") {
+            const { harnessFor } = await import("./harnesses.js");
+            if (harnessFor(row.command).name === "codex") {
+                if (row.status !== "running")
+                    process.exit(0);
+                const { codexHomeDir } = await import("./codexHome.js");
+                const result = db.transaction(() => {
+                    const current = db.prepare("SELECT kind, command, status, codex_home, session_id FROM agents WHERE actor_id = ?")
+                        .get(actorId);
+                    if (current?.kind === "agent" && harnessFor(current.command).name === "codex" && current.status !== "running") {
+                        return { status: "inactive", state: null };
+                    }
+                    if (!current || current.kind !== "agent" || typeof current.codex_home !== "string" || !current.codex_home || harnessFor(current.command).name !== "codex") {
+                        return { status: "changed", state: null };
+                    }
+                    const sessionsRoot = join(codexHomeDir(current.codex_home), "sessions");
+                    if (!acceptsWorkerHook(current, hookPayload, sessionsRoot))
+                        return { status: "rejected", state: null };
+                    const state = applyWorkerTransition(actorId, event);
+                    reconcileSessionId(actorId, hookPayload);
+                    reconcileTranscriptPath(actorId, hookPayload);
+                    db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+                    return { status: "accepted", state };
+                }).immediate();
+                if (result.status === "rejected" || result.status === "inactive")
+                    process.exit(0);
+                guarded = result.status === "accepted";
+                state = result.state;
+            }
         }
+        if (!guarded)
+            state = applyWorkerTransition(actorId, event);
         // A lead's turn state is its own table; agents.agent_state stays worker-only.
         if (process.env.HIVE_LEAD === "1" && (event === "prompt" || event === "stop" || event === "session_end")) {
             try {
@@ -195,12 +313,24 @@ try {
             catch {
             }
         }
-        reconcileSessionId(actorId, readPayload());
-        reconcileTranscriptPath(actorId, readPayload());
-        db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+        if (!guarded) {
+            reconcileSessionId(actorId, hookPayload);
+            reconcileTranscriptPath(actorId, hookPayload);
+            db.prepare("UPDATE actors SET last_seen_at = datetime('now') WHERE id = ?").run(actorId);
+        }
         record(actorId, event, state ?? UNCHANGED);
     }
 }
 catch {
 }
 process.exit(0);
+function applyWorkerTransition(actorId, event) {
+    const state = stateFor(event, actorId);
+    if (state !== null) {
+        db.prepare("UPDATE agents SET agent_state = ?, state_changed_at = datetime('now') WHERE actor_id = ? AND kind = 'agent'").run(state, actorId);
+    }
+    if (event === "prompt") {
+        db.prepare(`UPDATE agents SET resumed_at = '' WHERE actor_id = ? AND kind = 'agent' AND ${awaitingFirstPromptSql("agents")}`).run(actorId);
+    }
+    return state;
+}

package/dist/leadWatch.js

@@ -2,7 +2,7 @@ import { db } from "./db.js";
 import { paneClassifierFor } from "./harnesses.js";
 import { readLeadTurnState } from "./leadState.js";
 import { LEAD_KIND } from "./spawn.js";
-import { holdsHumanInput, paneReissued, rowAliveProbe } from "./tmux.js";
+import { foreignSocket, holdsHumanInput, observationFailed, rowOwnership } from "./tmux.js";
 export const LEAD_TARGET_GONE = "LEAD_TARGET_GONE";
 export const LEAD_TARGET_REISSUED = "LEAD_TARGET_REISSUED";
 export const LEAD_TARGET_RESTARTED = "LEAD_TARGET_RESTARTED";
@@ -39,14 +39,16 @@ export function evaluateLeadWatch(sub, mode, snapshot, readers) {
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
     if (lead.pane_pid !== sub.pane_pid)
         return { kind: "invalid", reason: LEAD_TARGET_RESTARTED };
-    if (snapshot === null)
-        return { kind: "pending", reason: "tmux did not answer" };
-    const probe = rowAliveProbe(lead.tmux_socket, lead.tmux_target, snapshot);
-    if (probe.live === null)
+    if (foreignSocket(lead.tmux_socket))
         return { kind: "pending", reason: "its pane cannot be probed from this process" };
-    if (!probe.live)
+    if (observationFailed(snapshot))
+        return { kind: "pending", reason: "tmux did not answer" };
+    const ownership = rowOwnership(lead, snapshot);
+    if (ownership === "unknown")
+        return { kind: "pending", reason: "pane ownership unknown" };
+    if (ownership === "gone")
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
-    if (paneReissued(sub.pane_pid, probe))
+    if (ownership === "reissued")
         return { kind: "invalid", reason: LEAD_TARGET_REISSUED };
     const state = readLeadTurnState(lead.id);
     if (state === null || state.pane_pid !== sub.pane_pid)

package/dist/portfolio.js

@@ -4,7 +4,7 @@ import { existsSync } from "node:fs";
 import { parseTags } from "./result.js";
 import { OPEN_BLOCKERS_SQL } from "./tools/todos.js";
 import { readLeadTurnState } from "./leadState.js";
-import { liveTargets, paneReissued, rowAlive, rowAliveProbe } from "./tmux.js";
+import { liveTargets, ownershipLiveness, rowOwnership } from "./tmux.js";
 export const PORTFOLIO_REASONS = [
     "needs_human",
     "dead_lead_pane",
@@ -84,15 +84,14 @@ function projectRow(project, now, snapshot) {
     const agents = db
         .prepare("SELECT id, kind, agent_state, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' ORDER BY id")
         .all(project.id);
-    const liveness = (a) => snapshot ? rowAlive(a.tmux_socket, a.tmux_target, snapshot) : null;
-    const reissued = (a) => snapshot !== null && paneReissued(a.pane_pid, rowAliveProbe(a.tmux_socket, a.tmux_target, snapshot));
+    const liveness = (a) => ownershipLiveness(rowOwnership(a, snapshot));
     const workers = { working: 0, idle: 0, needs_input: 0, other: 0, unreachable: 0, unconfirmed: 0 };
     let liveWorking = 0;
     let liveWaiting = 0;
     let lead = { state: "none", agent_id: null, turn: "unknown" };
     for (const a of agents) {
         if (a.kind === "lead") {
-            const live = reissued(a) ? false : liveness(a);
+            const live = liveness(a);
             lead = {
                 state: live === true ? "alive" : live === false ? "dead_pane" : "unknown",
                 agent_id: a.id,
@@ -102,7 +101,7 @@ function projectRow(project, now, snapshot) {
         }
         if (a.kind !== "agent")
             continue;
-        const live = reissued(a) ? false : liveness(a);
+        const live = liveness(a);
         if (live === false)
             workers.unreachable++;
         else if (live === null)

package/dist/processes.js

@@ -1,8 +1,8 @@
 import { getProject } from "./context.js";
 import { db } from "./db.js";
 import { loadProjectYml } from "./projectYml.js";
-import { closeAgentRow, killAgentPane, relayoutAfterPaneLeft } from "./spawn.js";
-import { cancelCopyMode, paneProcessExited, paneReissued, paneVisibility, paneWindow, projectWindows, rowLive, rowLiveProbe, sessionName, tmux, } from "./tmux.js";
+import { closeAgentRow, currentOwnership, killAgentPane, paneIdentity, relayoutAfterPaneLeft } from "./spawn.js";
+import { cancelCopyMode, observeRowOwnership, paneProcessExited, paneVisibility, paneWindow, projectWindows, rowLive, sessionName, tmux, } from "./tmux.js";
 // One derivation for every surface that reports where a project's processes are: `hive status`,
 // `hive doctor`, and the dashboard. Two tmux window lookups per project, then one per running
 // process, and none at all for a project with neither a running command nor a defined one.
@@ -96,6 +96,19 @@ function waitForPaneToExit(target, timeoutMs) {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(STOP_POLL_MS, remaining));
     }
 }
+const UNKNOWN_OWNERSHIP_NOTE = "its pane ownership is unknown (no pane pid recorded, a legacy window target, or another tmux socket), so hive left it running";
+const REISSUED_NOTE = "its pane id now belongs to another process, which was left alone";
+const CHANGED_NOTE = "its row was closed or recorded a different pane during the stop, so hive touched nothing further";
+// Unknown, or a row that changed underneath the stop, is left running: closing it would hide a
+// process that may still be running from every surface that reports one.
+function notOwned(row, ownership) {
+    if (ownership === "unknown")
+        return { name: row.name, leg: "unreachable", note: UNKNOWN_OWNERSHIP_NOTE };
+    if (ownership === "changed")
+        return { name: row.name, leg: "unreachable", note: CHANGED_NOTE };
+    closeAgentRow(row.id, paneIdentity(row));
+    return { name: row.name, leg: "already-gone", ...(ownership === "reissued" ? { note: REISSUED_NOTE } : {}) };
+}
 // The only thing that stops a hive.yml command. kill-pane alone is SIGHUP, which a dev server with
 // detached grandchildren survives while still holding its port, so the graceful leg comes first and
 // the receipt says which one ended it.
@@ -103,19 +116,19 @@ function waitForPaneToExit(target, timeoutMs) {
 // argument so every caller has to declare its trigger from the closed set docs/projects.md is
 // checked against, and whichever caller prints it already knows which one it passed.
 export function stopProcess(row, reason) {
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    // A pane hive cannot see is left alone, row and all: closing the row here would hide a process
-    // that is still running from every surface that reports one.
-    if (probe.live === null)
+    const identity = paneIdentity(row);
+    const ownership = observeRowOwnership(identity);
+    if (ownership === "probe-failed")
         return { name: row.name, leg: "unreachable" };
-    // A reissued pane id belongs to whoever holds it now, so it is never killed - same compare as
-    // janitor() and wake delivery.
-    if (probe.live === false || paneReissued(row.pane_pid, probe)) {
-        closeAgentRow(row.id);
-        return { name: row.name, leg: "already-gone" };
-    }
+    if (ownership !== "live")
+        return notOwned(row, ownership);
     markStopping(row.project_id, row.id);
     const window = paneWindow(row.tmux_target);
+    const beforeSignal = currentOwnership(row.id, identity);
+    if (beforeSignal !== "live") {
+        clearStoppingMarker(row.project_id, row.id);
+        return notOwned(row, beforeSignal);
+    }
     try {
         // In copy mode C-c is `cancel`, not SIGINT, so the graceful leg would silently do nothing to a
         // pane someone scrolled back in. A stop may take that scrollback position: the process is ending.
@@ -126,6 +139,11 @@ export function stopProcess(row, reason) {
     }
     let leg = "interrupted";
     if (!waitForPaneToExit(row.tmux_target, STOP_GRACE_MS)) {
+        const beforeKill = currentOwnership(row.id, identity);
+        if (beforeKill !== "live") {
+            clearStoppingMarker(row.project_id, row.id);
+            return notOwned(row, beforeKill);
+        }
         try {
             killAgentPane(row.tmux_target);
         }
@@ -137,7 +155,7 @@ export function stopProcess(row, reason) {
     // RUNNING, so the process stays visible to hive status, hive stop and the janitor.
     if (leg === "still-running")
         return { name: row.name, leg };
-    closeAgentRow(row.id, row.tmux_target);
+    closeAgentRow(row.id, identity);
     clearStoppingMarker(row.project_id, row.id);
     relayoutAfterPaneLeft(window);
     return { name: row.name, leg };
@@ -152,9 +170,13 @@ export function stopLine(stopped) {
         case "killed":
             return `${stopped.name}: stopped (killed after ${STOP_GRACE_MS / 1000}s)`;
         case "already-gone":
-            return `${stopped.name}: already gone (nothing was running)`;
+            return stopped.note
+                ? `${stopped.name}: already gone (${stopped.note})`
+                : `${stopped.name}: already gone (nothing was running)`;
         case "unreachable":
-            return `${stopped.name}: tmux could not be probed, so hive left it running`;
+            return stopped.note
+                ? `${stopped.name}: ${stopped.note}`
+                : `${stopped.name}: tmux could not be probed, so hive left it running`;
         case "still-running":
             return `${stopped.name}: still running: its pane survived C-c and kill-pane, so hive left the row open`;
     }

package/dist/projectRemove.js

@@ -1,5 +1,7 @@
 import { backupNow } from "./backup.js";
 import { dataDir, db } from "./db.js";
+import { LEAD_KIND } from "./spawn.js";
+import { foreignSocket, liveTargets, observationFailed, rowOwnership } from "./tmux.js";
 export const PROJECT_OWNER_TABLES = [
     "pads",
     "todos",
@@ -28,17 +30,49 @@ export function formatRowCounts(counts) {
         .map(([table, n]) => `${table}: ${n}`)
         .join(", ");
 }
-function assertNoRunningAgents(projectId, name) {
-    const running = db
-        .prepare("SELECT id, name FROM agents WHERE project_id = ? AND status = 'running' ORDER BY id")
-        .all(projectId);
+const runningRows = (projectId) => db
+    .prepare("SELECT id, name, kind, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' ORDER BY id")
+    .all(projectId);
+const identities = (rows) => JSON.stringify(rows.map((r) => [r.id, r.tmux_target, r.tmux_socket, r.pane_pid]));
+function assertNoRunningAgents(projectId, name, running, panes) {
     if (running.length === 0)
         return;
-    const names = running.map((a) => `${a.name} (agent ${a.id})`).join(", ");
-    throw new Error(`project ${projectId} ("${name}") has running agents: ${names}. Nothing deleted. Run hive doctor to close rows whose panes are gone, or agent_close them.`);
+    const snapshot = panes === undefined ? liveTargets() : panes;
+    const blockers = running
+        .map((a) => ({ ...a, ownership: rowOwnership(a, snapshot) }))
+        .filter((a) => a.ownership === "live" || a.ownership === "unknown");
+    if (blockers.length === 0)
+        return;
+    const names = blockers
+        .map((a) => `${a.name} (agent ${a.id}, ${a.ownership === "live" ? "owns a live pane" : "pane identity unknown"})`)
+        .join(", ");
+    const hints = [];
+    const liveLeads = blockers.filter((a) => a.ownership === "live" && a.kind === LEAD_KIND);
+    const liveOthers = blockers.filter((a) => a.ownership === "live" && a.kind !== LEAD_KIND);
+    const unknown = blockers.filter((a) => a.ownership === "unknown");
+    if (liveLeads.length > 0)
+        hints.push("A live lead is stopped or restarted from its own terminal, never retired with row_only.");
+    if (liveOthers.length > 0)
+        hints.push("Stop a live worker or command with agent_close first.");
+    if (unknown.length > 0 && observationFailed(snapshot)) {
+        hints.push("tmux could not be probed, so no row's ownership could be checked. Retry in a few seconds.");
+    }
+    else if (unknown.length > 0) {
+        const foreign = unknown.some((a) => foreignSocket(a.tmux_socket));
+        hints.push("A row whose pane cannot be verified is retired explicitly by a human or peer lead through this project's MCP " +
+            `tool, ${unknown.map((a) => `agent_close({agent_id: ${a.id}, row_only: true})`).join(", ")}` +
+            (foreign
+                ? ", or run this again from the tmux socket a foreign-socket row was recorded on, where its ownership can be verified."
+                : "."));
+    }
+    throw new Error(`project ${projectId} ("${name}") has running agents: ${names}. Nothing deleted. ${hints.join(" ")}`);
 }
-const deleteProjectRows = db.transaction((projectId, name, expected, after) => {
-    assertNoRunningAgents(projectId, name);
+const deleteProjectRows = db.transaction((projectId, name, expected, observed, after) => {
+    const running = runningRows(projectId);
+    if (identities(running) !== observed.rows) {
+        throw new Error(`project ${projectId} ("${name}") changed while the snapshot was taken; nothing removed, run it again.`);
+    }
+    assertNoRunningAgents(projectId, name, running, observed.panes);
     if (JSON.stringify(projectRowCounts(projectId)) !== JSON.stringify(expected)) {
         throw new Error(`project ${projectId} ("${name}") changed while the snapshot was taken; nothing removed, run it again.`);
     }
@@ -52,7 +86,7 @@ export function removeProject(projectId, opts) {
     const target = db.prepare("SELECT id, name, path FROM projects WHERE id = ?").get(projectId);
     if (!target)
         throw new Error(`no project ${projectId}.`);
-    assertNoRunningAgents(projectId, target.name);
+    assertNoRunningAgents(projectId, target.name, runningRows(projectId));
     const counts = projectRowCounts(projectId);
     let snapshot = null;
     if (opts.snapshot) {
@@ -62,7 +96,9 @@ export function removeProject(projectId, opts) {
         snapshot = result.path ?? null;
     }
     opts.afterSnapshot?.();
+    const rows = runningRows(projectId);
+    const observed = { rows: identities(rows), panes: rows.length > 0 ? liveTargets() : null };
     const removed = { deleted: { id: target.id, name: target.name, path: target.path }, counts, snapshot };
-    deleteProjectRows.immediate(projectId, target.name, counts, () => opts.onRemoved?.(removed));
+    deleteProjectRows.immediate(projectId, target.name, counts, observed, () => opts.onRemoved?.(removed));
     return removed;
 }