@cmgmyr/hive 1.6.0 → 1.8.0

package/dist/cli.js

@@ -22,7 +22,7 @@ import { confirmQueenWrite, listQueenAudit } from "./queenAudit.js";
 import { formatRowCounts, projectRowCounts, removeProject } from "./projectRemove.js";
 import { ensureHooksFile } from "./hooks.js";
 import { errorMessage, registrationNoticeText, withTrailingNewline } from "./result.js";
-import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneReissue, } from "./scheduler.js";
+import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isLeadRowClosedHold, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneIdentity, } from "./scheduler.js";
 import { readTurnCount } from "./turnCount.js";
 import { collectPortfolio, leadText } from "./portfolio.js";
 import { STALL_BOUND_SECONDS } from "./backgroundTasks.js";
@@ -30,7 +30,7 @@ import { probeSessionInterpreter, reexecTarget, sessionStartVerdict, } from "./s
 import { backupHealth, backupNow, backupsDir, formatBytes, listSnapshots, previewRestore, restoreSnapshot, totalSizeBytes, } from "./backup.js";
 import { describeTeardownWindow, readTeardowns, teardownLogPath, } from "./teardown.js";
 import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, upsertActor, withWindowClaim, } from "./spawn.js";
-import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isPaneTarget, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePid, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, paneReissued, rowLive, rowLiveProbe, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
+import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, observeRowOwnership, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePidForRecord, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, rowLive, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
 import { describeVisibility, processCounts } from "./dashboard.js";
 import { runningCommandRow, runningCommandRows, snapshotProcesses, stopAllProcesses, stopLine, stopProcess, STOP_REASONS, } from "./processes.js";
 import { activeProfile, agentVarKeys, BUILT_IN_PROJECT_YML, configHash, loadProjectYml, mergedProjectVars, NO_PROFILE, PROJECT_YML_KEYS, resolveCommandDir, resolveFirstMessage, } from "./projectYml.js";
@@ -322,17 +322,20 @@ function ensureLeadRow(project, command) {
             previousCommand: existing.command,
             previousCodexHome: existing.codex_home,
             casExpected: existing.tmux_target,
+            casSocket: existing.tmux_socket,
+            casPid: existing.pane_pid,
         };
     }
     const priorClosed = db
         .prepare("SELECT actor_id, tmux_target, tmux_socket, pane_pid, command, codex_home FROM agents WHERE project_id = ? AND kind = ? AND status = 'closed' AND actor_id != '' ORDER BY id DESC LIMIT 1")
         .get(project.id, LEAD_KIND);
+    const insertedSocket = tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR);
     let result;
     try {
         result = db.transaction(() => {
             const info = db
                 .prepare("INSERT INTO agents (project_id, name, command, cwd, kind, parent_actor_id, tmux_target, tmux_socket, pane_pid) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")
-                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), "");
+                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", insertedSocket, "");
             const agentId = Number(info.lastInsertRowid);
             const actorId = priorClosed?.actor_id ?? mintLeadActorId(agentId);
             db.prepare("UPDATE agents SET actor_id = ? WHERE id = ?").run(actorId, agentId);
@@ -352,6 +355,8 @@ function ensureLeadRow(project, command) {
         previousCommand: priorClosed?.command ?? "",
         previousCodexHome: priorClosed?.codex_home ?? "",
         casExpected: "",
+        casSocket: insertedSocket,
+        casPid: "",
     };
 }
 function reportMigrationResult(result) {
@@ -375,6 +380,8 @@ async function cmdLead(argv) {
             registrationNotice = text;
         });
         const auditIdentity = captureQueenWriteIdentity(project.id);
+        // Only rows running before this invocation began are leftovers, trust prompts included; a later `hive start` is not.
+        const leftoverIds = new Set(runningCommandRows(project.id).map((row) => row.id));
         const { config, warnings, sources } = loadProjectYml(project.path);
         if (detach && (!process.stdin.isTTY || !process.stdout.isTTY)) {
             let untrusted;
@@ -453,7 +460,8 @@ async function cmdLead(argv) {
             }
         }
         const windowName = project.name;
-        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, } = ensureLeadRow(project, leadCommand);
+        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, casSocket, casPid, } = ensureLeadRow(project, leadCommand);
+        const previousIdentity = { tmux_target: previousTarget, tmux_socket: previousSocket, pane_pid: previousPanePid };
         // A fresh CODEX_HOME is built on every invocation, same as claude's hooks/posture files above -
         // cheap (a few KB; the codex-side plugins/cache bootstrap only materializes once a process
         // actually starts under it) and correct regardless of whether this invocation ends up creating
@@ -524,10 +532,8 @@ async function cmdLead(argv) {
             }
             else {
                 const foundWindow = findProjectWindow(session, project.id);
-                const probe = rowLiveProbe(previousSocket, previousTarget);
-                const adopted = isPaneTarget(previousTarget) && probe.live === true && !paneReissued(previousPanePid, probe)
-                    ? adoptableWindow(session, project.id, previousTarget)
-                    : null;
+                // Only a pane the row provably owns is adopted; unknown or reissued gets a fresh pane, never the stranger's pid.
+                const adopted = rowOwnership(previousIdentity) === "live" ? adoptableWindow(session, project.id, previousTarget) : null;
                 if (adopted) {
                     leadPane = previousTarget;
                     leadWindow = adopted;
@@ -574,12 +580,24 @@ async function cmdLead(argv) {
             if (newCodexHomeKey)
                 reapCodexHome(newCodexHomeKey);
         };
+        if (!createdPane && rowOwnership(previousIdentity) !== "live") {
+            abandonClaim();
+            throw new Error("The lead pane this `hive lead` was about to adopt no longer reads as the lead's own (its pane pid changed " +
+                "or could not be verified), so nothing was recorded. Re-run `hive lead`; it will start a fresh pane.");
+        }
+        const recordedPanePid = createdPane ? panePidForRecord(leadPane) : previousPanePid;
+        if (recordedPanePid === "") {
+            abandonClaim();
+            throw new Error(`tmux did not report a process id for the new lead pane ${leadPane} (asked twice), so it was discarded ` +
+                "rather than recorded: a lead row with no pane pid can never be verified as owning its pane. Re-run `hive lead`.");
+        }
         let wonRace;
         try {
             wonRace = db.transaction(() => {
                 const updated = db
-                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? WHERE id = ? AND tmux_target = ? AND status = 'running'")
-                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), panePid(leadPane), recordedCommand, recordedCodexHome, leadAgentId, casExpected).changes;
+                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? " +
+                    "WHERE id = ? AND tmux_target = ? AND tmux_socket = ? AND pane_pid = ? AND status = 'running'")
+                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), recordedPanePid, recordedCommand, recordedCodexHome, leadAgentId, casExpected, casSocket, casPid).changes;
                 if (updated === 0)
                     return false;
                 db.prepare(`UPDATE wakes SET deliver_pane = ?, held_at = NULL, held_reason = NULL
@@ -610,7 +628,7 @@ async function cmdLead(argv) {
         }
         if (createdPane) {
             armLeadPaneExitedHook();
-            clearLeftoverProcesses(project, config);
+            clearLeftoverProcesses(project, config, leftoverIds);
         }
         else if (!leadPaneExitedHookArmed()) {
             console.log(`! this tmux server carries no ${LEAD_PANE_EXITED_HOOK} backstop and hive arms one only on a pane it created, ` +
@@ -732,8 +750,13 @@ const HIVE_YML_TEMPLATE = `# hive project config. Read by \`hive lead\` from the
 #   start_command: /jira-start
 #   check: npm run lint && npx tsc --noEmit   # what a worker runs before
                                               # reporting done; gates only,
-                                              # no suite (test_all is that)
+                                              # no suite (suite_command is that)
 #   check: ./vendor/bin/pint --test && ./vendor/bin/phpstan   # a PHP stack's
+#   test_command: npm test -- test/foo.test.mjs   # scoped check for one change
+#   suite_command: npm test     # full suite; one run at a time, lead's slot
+#   verify_command: npm run build && node dist/cli.js --version   # exercises the real outcome
+#   review_command: /review     # a fresh-context reviewer, if your harness has one
+#   worker_model: sonnet        # the cheaper tier workers spawn on
 #   ci: weekly                  # absent: CI runs on push/PR. weekly: CI runs
                                 # on schedule + dispatch only, and the local
                                 # full suite gates the merge
@@ -1293,7 +1316,7 @@ function openDashboardOnce(project, dashboardFile) {
     if (claim.changes === 0)
         return;
     try {
-        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 5000 });
+        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 10000 });
     }
     catch {
         db.prepare("DELETE FROM kv WHERE project_id = ? AND key = ?").run(project.id, DASHBOARD_OPENED_KV_KEY);
@@ -1377,14 +1400,18 @@ function resolveNamedProcess(argv, verb) {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    if (probe.live === null) {
+    const ownership = observeRowOwnership(row);
+    if (ownership === "probe-failed") {
         console.log(CANNOT_TELL_WHERE(name));
         return null;
     }
+    if (ownership === "unknown") {
+        console.log(`${name}: its pane ownership is unknown (no pane pid recorded, or another tmux socket), so hive will not move that pane`);
+        return null;
+    }
     // A pane id alone is not an identity: tmux restarts them at %0 on a fresh server, so a stale
-    // running row names whoever holds that id now. Same compare as janitor() and wake delivery.
-    if (!probe.live || paneReissued(row.pane_pid, probe)) {
+    // running row names whoever holds that id now.
+    if (ownership !== "live") {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
@@ -1466,8 +1493,10 @@ function cmdLeadPaneExited(argv) {
 }
 // Only a lead that CREATED its pane clears leftovers. An adopted live lead is the same lead those
 // processes belong to, and stopping them there would take down a running crew's dev server.
-function clearLeftoverProcesses(project, config) {
+function clearLeftoverProcesses(project, config, leftoverIds) {
     for (const row of runningCommandRows(project.id)) {
+        if (!leftoverIds.has(row.id))
+            continue;
         const stopped = stopProcess(row, STOP_REASONS.previousLead);
         // Nothing was running under it, so the auto-start line that follows is the whole story.
         if (stopped.leg === "already-gone")
@@ -2793,7 +2822,8 @@ export function heldReasonLabel(heldReason) {
     if (isUnsubmittedInputHold(heldReason))
         return "typing";
     if (heldReason === HELD_REASON_LEAD_PANE_DEAD ||
-        wasHeldForPaneReissue(heldReason) ||
+        wasHeldForPaneIdentity(heldReason) ||
+        isLeadRowClosedHold(heldReason) ||
         isUnclassifiablePaneHold(heldReason)) {
         return "needs you";
     }

package/dist/help.js

@@ -179,6 +179,10 @@ runbook (fork it first), not a pad write.`,
     a stale row closed with no kill, stop or typing; a human or peer lead
     only, refused for a row that provably owns a live pane or when tmux
     could not be probed.
+  Every kill or type above acts only on a pane whose recorded pid matches.
+    Unverifiable ownership (no recorded pid) refuses by name; a gone or
+    reissued pane is never touched, and close, park and rename then act
+    on the row alone.
 
 Address a worker by its name, not its id: agent_send(name="impl", ...). A
 partial name works when it matches one running worker, so name="123" finds
@@ -316,7 +320,11 @@ place.`,
   pad_write(name, content, tags?) — create a pad; names are unique per project
   pad_write(pad_id, name, content, expected_revision) — full overwrite; the
     revision guard makes concurrent writers safe
-  pad_read(pad_id | name) — content plus revision and metadata
+  pad_read(pad_id | name, offset?, limit?) — content plus revision and metadata
+    offset and limit are nonnegative safe integers in UTF-16 code units, with
+    no default cap; a cut inside a surrogate pair moves back one unit, or
+    forward if moving back would return nothing, and the result reports its
+    effective offset
   pad_append(pad_id, content, expected_revision?) — add to the end
   pad_edit(pad_id, old_text, new_text, expected_revision?) — replace one
     unique literal occurrence; include enough context to disambiguate

package/dist/leadWatch.js

@@ -2,7 +2,7 @@ import { db } from "./db.js";
 import { paneClassifierFor } from "./harnesses.js";
 import { readLeadTurnState } from "./leadState.js";
 import { LEAD_KIND } from "./spawn.js";
-import { holdsHumanInput, paneReissued, rowAliveProbe } from "./tmux.js";
+import { foreignSocket, holdsHumanInput, observationFailed, rowOwnership } from "./tmux.js";
 export const LEAD_TARGET_GONE = "LEAD_TARGET_GONE";
 export const LEAD_TARGET_REISSUED = "LEAD_TARGET_REISSUED";
 export const LEAD_TARGET_RESTARTED = "LEAD_TARGET_RESTARTED";
@@ -39,14 +39,16 @@ export function evaluateLeadWatch(sub, mode, snapshot, readers) {
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
     if (lead.pane_pid !== sub.pane_pid)
         return { kind: "invalid", reason: LEAD_TARGET_RESTARTED };
-    if (snapshot === null)
-        return { kind: "pending", reason: "tmux did not answer" };
-    const probe = rowAliveProbe(lead.tmux_socket, lead.tmux_target, snapshot);
-    if (probe.live === null)
+    if (foreignSocket(lead.tmux_socket))
         return { kind: "pending", reason: "its pane cannot be probed from this process" };
-    if (!probe.live)
+    if (observationFailed(snapshot))
+        return { kind: "pending", reason: "tmux did not answer" };
+    const ownership = rowOwnership(lead, snapshot);
+    if (ownership === "unknown")
+        return { kind: "pending", reason: "pane ownership unknown" };
+    if (ownership === "gone")
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
-    if (paneReissued(sub.pane_pid, probe))
+    if (ownership === "reissued")
         return { kind: "invalid", reason: LEAD_TARGET_REISSUED };
     const state = readLeadTurnState(lead.id);
     if (state === null || state.pane_pid !== sub.pane_pid)

package/dist/processes.js

@@ -1,8 +1,8 @@
 import { getProject } from "./context.js";
 import { db } from "./db.js";
 import { loadProjectYml } from "./projectYml.js";
-import { closeAgentRow, killAgentPane, relayoutAfterPaneLeft } from "./spawn.js";
-import { cancelCopyMode, paneProcessExited, paneReissued, paneVisibility, paneWindow, projectWindows, rowLive, rowLiveProbe, sessionName, tmux, } from "./tmux.js";
+import { closeAgentRow, currentOwnership, killAgentPane, paneIdentity, relayoutAfterPaneLeft } from "./spawn.js";
+import { cancelCopyMode, observeRowOwnership, paneProcessExited, paneVisibility, paneWindow, projectWindows, rowLive, sessionName, tmux, } from "./tmux.js";
 // One derivation for every surface that reports where a project's processes are: `hive status`,
 // `hive doctor`, and the dashboard. Two tmux window lookups per project, then one per running
 // process, and none at all for a project with neither a running command nor a defined one.
@@ -96,6 +96,19 @@ function waitForPaneToExit(target, timeoutMs) {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(STOP_POLL_MS, remaining));
     }
 }
+const UNKNOWN_OWNERSHIP_NOTE = "its pane ownership is unknown (no pane pid recorded, a legacy window target, or another tmux socket), so hive left it running";
+const REISSUED_NOTE = "its pane id now belongs to another process, which was left alone";
+const CHANGED_NOTE = "its row was closed or recorded a different pane during the stop, so hive touched nothing further";
+// Unknown, or a row that changed underneath the stop, is left running: closing it would hide a
+// process that may still be running from every surface that reports one.
+function notOwned(row, ownership) {
+    if (ownership === "unknown")
+        return { name: row.name, leg: "unreachable", note: UNKNOWN_OWNERSHIP_NOTE };
+    if (ownership === "changed")
+        return { name: row.name, leg: "unreachable", note: CHANGED_NOTE };
+    closeAgentRow(row.id, paneIdentity(row));
+    return { name: row.name, leg: "already-gone", ...(ownership === "reissued" ? { note: REISSUED_NOTE } : {}) };
+}
 // The only thing that stops a hive.yml command. kill-pane alone is SIGHUP, which a dev server with
 // detached grandchildren survives while still holding its port, so the graceful leg comes first and
 // the receipt says which one ended it.
@@ -103,19 +116,19 @@ function waitForPaneToExit(target, timeoutMs) {
 // argument so every caller has to declare its trigger from the closed set docs/projects.md is
 // checked against, and whichever caller prints it already knows which one it passed.
 export function stopProcess(row, reason) {
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    // A pane hive cannot see is left alone, row and all: closing the row here would hide a process
-    // that is still running from every surface that reports one.
-    if (probe.live === null)
+    const identity = paneIdentity(row);
+    const ownership = observeRowOwnership(identity);
+    if (ownership === "probe-failed")
         return { name: row.name, leg: "unreachable" };
-    // A reissued pane id belongs to whoever holds it now, so it is never killed - same compare as
-    // janitor() and wake delivery.
-    if (probe.live === false || paneReissued(row.pane_pid, probe)) {
-        closeAgentRow(row.id);
-        return { name: row.name, leg: "already-gone" };
-    }
+    if (ownership !== "live")
+        return notOwned(row, ownership);
     markStopping(row.project_id, row.id);
     const window = paneWindow(row.tmux_target);
+    const beforeSignal = currentOwnership(row.id, identity);
+    if (beforeSignal !== "live") {
+        clearStoppingMarker(row.project_id, row.id);
+        return notOwned(row, beforeSignal);
+    }
     try {
         // In copy mode C-c is `cancel`, not SIGINT, so the graceful leg would silently do nothing to a
         // pane someone scrolled back in. A stop may take that scrollback position: the process is ending.
@@ -126,6 +139,11 @@ export function stopProcess(row, reason) {
     }
     let leg = "interrupted";
     if (!waitForPaneToExit(row.tmux_target, STOP_GRACE_MS)) {
+        const beforeKill = currentOwnership(row.id, identity);
+        if (beforeKill !== "live") {
+            clearStoppingMarker(row.project_id, row.id);
+            return notOwned(row, beforeKill);
+        }
         try {
             killAgentPane(row.tmux_target);
         }
@@ -137,7 +155,7 @@ export function stopProcess(row, reason) {
     // RUNNING, so the process stays visible to hive status, hive stop and the janitor.
     if (leg === "still-running")
         return { name: row.name, leg };
-    closeAgentRow(row.id, row.tmux_target);
+    closeAgentRow(row.id, identity);
     clearStoppingMarker(row.project_id, row.id);
     relayoutAfterPaneLeft(window);
     return { name: row.name, leg };
@@ -152,9 +170,13 @@ export function stopLine(stopped) {
         case "killed":
             return `${stopped.name}: stopped (killed after ${STOP_GRACE_MS / 1000}s)`;
         case "already-gone":
-            return `${stopped.name}: already gone (nothing was running)`;
+            return stopped.note
+                ? `${stopped.name}: already gone (${stopped.note})`
+                : `${stopped.name}: already gone (nothing was running)`;
         case "unreachable":
-            return `${stopped.name}: tmux could not be probed, so hive left it running`;
+            return stopped.note
+                ? `${stopped.name}: ${stopped.note}`
+                : `${stopped.name}: tmux could not be probed, so hive left it running`;
         case "still-running":
             return `${stopped.name}: still running: its pane survived C-c and kill-pane, so hive left the row open`;
     }