@cmgmyr/hive 1.8.0 → 1.9.1

package/README.md

@@ -5,7 +5,7 @@ Run a crew of Claude Code and Codex workers from one lead session: visible tmux
 
 - Visible workers: each one is a real tmux pane you can read and type into.
 - Exact state: workers report it through their own CLI's hooks, so nothing polls.
-- One local SQLite store: no daemon, and nothing leaves your machine.
+- One local SQLite store: no daemon. The MCP server, hooks, and scheduler make no outbound requests; the CLI contacts npm only to check for updates, and upgrades can download ([details](docs/security.md)).
 
 ![hive: a lead plans, spawns workers, and is woken when they finish](https://raw.githubusercontent.com/cmgmyr/hive/main/docs/assets/demo.svg)
 
@@ -32,7 +32,7 @@ Run `cd ~/Code/your-project && hive`. It is shorthand for `hive lead`, and it op
 
 ## How it works
 
-Each Claude Code session runs its own `hive` MCP server over stdio, and every instance reads and writes one SQLite database (WAL mode) at `~/.hive/hive.db`, so every session sees the same state. There is no daemon and nothing leaves your machine. State is scoped to a project (a directory), resolved from the working directory; a lead spawns workers into tmux panes locked to that project.
+Each Claude Code session runs its own `hive` MCP server over stdio, and every instance reads and writes one SQLite database (WAL mode) at `~/.hive/hive.db`, so every session sees the same state. There is no daemon. The MCP server, hooks, and scheduler make no outbound requests; the CLI contacts npm only to check for updates, and upgrades can download ([details](docs/security.md)). State is scoped to a project (a directory), resolved from the working directory; a lead spawns workers into tmux panes locked to that project.
 
 ## Why not subagents?
 

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"1.8.0","sha":"9d4e070","dirty":false,"build_id":"1871c7f0fe55c487adf13e0faae11b7efc34043070171e0de08356b62218bbad"}
+{"version":"1.9.1","sha":"2056b89","dirty":false,"build_id":"6b9bbe7ee1cda1fc2700518664c980aac9692d27caead18970553a3f6b3cbae9"}

package/dist/claudeWake.js

@@ -0,0 +1,44 @@
+import { createConnection } from "node:net";
+export const CROSS_SESSION_CLOSE = "</cross-session-message>";
+export const SOCKET_WAKE_FOOTER = "Automated hive wake. Do not reply to this sender.";
+const SOCKET_WRITE_BOUND_MS = 1000;
+export function senderAddress(socketPath) {
+    const encoded = socketPath.replace(/[^A-Za-z0-9/._-]/gu, (c) => [...Buffer.from(c)].map((b) => `%${b.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
+    return `uds:${encoded}`;
+}
+function claudeWakeFrame(senderAddress, text) {
+    const content = `<cross-session-message from="${senderAddress}" from-name="hive">\n${text}\n${CROSS_SESSION_CLOSE}`;
+    return JSON.stringify({ type: "user", from: senderAddress, message: { role: "user", content } }) + "\n";
+}
+// True only for a completed local write. The socket sends no ack, so true never means the lead read it.
+export function postClaudeWake(options) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (ok)
+                socket.end();
+            else
+                socket.destroy();
+            resolve(ok);
+        };
+        const socket = createConnection(options.socketPath);
+        const timer = setTimeout(() => finish(false), SOCKET_WRITE_BOUND_MS);
+        socket.on("error", () => finish(false));
+        socket.on("connect", () => {
+            let allowed = false;
+            try {
+                allowed = options.beforeWrite();
+            }
+            catch {
+                allowed = false;
+            }
+            if (!allowed)
+                return finish(false);
+            socket.write(claudeWakeFrame(options.senderAddress, options.text), (err) => finish(!err));
+        });
+    });
+}

package/dist/cli.js

@@ -20,16 +20,16 @@ import { isLowHeadroom, orphanLoginShellDetails, ptyHeadroom } from "./ptys.js";
 import { addProject, agentProjectPin, assertQueenCrossProjectWrite, captureQueenWriteIdentity, currentActor, effectiveProjectId, findProjectForCwd, findProjectForDir, getProjectByPath, gitPrimaryRoot, getProject, listProjects, QUEEN_PROFILE, queenHomeDir, registeredAncestor, takeRegistrationNotice, } from "./context.js";
 import { confirmQueenWrite, listQueenAudit } from "./queenAudit.js";
 import { formatRowCounts, projectRowCounts, removeProject } from "./projectRemove.js";
-import { ensureHooksFile } from "./hooks.js";
+import { ensureHooksFile, ensureLeadHooksFile } from "./hooks.js";
 import { errorMessage, registrationNoticeText, withTrailingNewline } from "./result.js";
-import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isLeadRowClosedHold, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneIdentity, } from "./scheduler.js";
+import { ACTIVE_TIMER_WHERE, socketAwaitingWhere, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isLeadRowClosedHold, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneIdentity, } from "./scheduler.js";
 import { readTurnCount } from "./turnCount.js";
 import { collectPortfolio, leadText } from "./portfolio.js";
 import { STALL_BOUND_SECONDS } from "./backgroundTasks.js";
 import { probeSessionInterpreter, reexecTarget, sessionStartVerdict, } from "./sessionProbe.js";
 import { backupHealth, backupNow, backupsDir, formatBytes, listSnapshots, previewRestore, restoreSnapshot, totalSizeBytes, } from "./backup.js";
 import { describeTeardownWindow, readTeardowns, teardownLogPath, } from "./teardown.js";
-import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, upsertActor, withWindowClaim, } from "./spawn.js";
+import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, relayoutAfterPaneLeft, upsertActor, withWindowClaim, } from "./spawn.js";
 import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, observeRowOwnership, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePidForRecord, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, rowLive, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
 import { describeVisibility, processCounts } from "./dashboard.js";
 import { runningCommandRow, runningCommandRows, snapshotProcesses, stopAllProcesses, stopLine, stopProcess, STOP_REASONS, } from "./processes.js";
@@ -400,7 +400,7 @@ async function cmdLead(argv) {
         for (const w of warnings)
             console.log(`! ${w}`);
         const session = sessionName();
-        const hooksPath = ensureHooksFile();
+        const hooksPath = ensureLeadHooksFile(project.id, config?.quiet_messaging === true);
         let leadCommand = "claude";
         if (!config) {
             console.log("No hive.yml here; starting a plain claude lead. Add a hive.yml to define project commands and a custom lead (run hive --help for the format).");
@@ -546,7 +546,9 @@ async function cmdLead(argv) {
                     createdPane = true;
                 }
                 else {
-                    leadPane = tmux("split-window", ...(detach ? ["-d"] : []), "-P", "-F", "#{pane_id}", "-t", foundWindow, "-c", project.path, ...envFlags, launchCommand);
+                    const firstPane = tmux("list-panes", "-t", foundWindow, "-F", "#{pane_id}").split("\n")[0];
+                    leadPane = tmux("split-window", "-b", ...(detach ? ["-d"] : []), "-P", "-F", "#{pane_id}", "-t", firstPane || foundWindow, "-c", project.path, ...envFlags, launchCommand);
+                    relayoutAfterPaneLeft(foundWindow);
                     leadWindow = foundWindow;
                     createdPane = true;
                 }
@@ -601,7 +603,7 @@ async function cmdLead(argv) {
                 if (updated === 0)
                     return false;
                 db.prepare(`UPDATE wakes SET deliver_pane = ?, held_at = NULL, held_reason = NULL
-           WHERE ${ACTIVE_TIMER_WHERE} AND deliver_actor = ?
+           WHERE ((${ACTIVE_TIMER_WHERE}) OR (${socketAwaitingWhere()})) AND deliver_actor = ?
              AND (? = 1 OR held_reason IS NULL OR held_reason NOT LIKE ?)`).run(leadPane, leadActorId, createdPane ? 1 : 0, `${HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX}%`);
                 confirmQueenWrite("hive lead", project.id, { detach }, {
                     agent_id: leadAgentId,
@@ -743,6 +745,8 @@ const HIVE_YML_TEMPLATE = `# hive project config. Read by \`hive lead\` from the
 
 # dashboard: true               # write .hive/dashboard.html (default: false)
 
+# quiet_messaging: true        # wakes and worker messages reach a claude lead as one row (default: false; restart the lead)
+
 # vars:                         # substituted into the profile runbook
 #   repo: owner/name            # {{repo}}
 #   ticket_prefix: DEVX         # sections needing it drop when it is unset
@@ -3372,7 +3376,7 @@ function cmdPad(argv) {
     process.stdout.write(withTrailingNewline(pad.content));
 }
 process.stdout.on("error", (error) => {
-    if (error.code === "EPIPE")
+    if (error.code === "EPIPE" || error.code === "ENOTCONN")
         process.exit(0);
     throw error;
 });

package/dist/dashboard.js

@@ -799,7 +799,7 @@ const STYLE = `
   .muted { font-size: 0.8125rem; }
   .cap-note { display: flex; align-items: center; gap: 0.4rem; color: var(--fg-subtle);
     font-size: 0.78125rem; margin: 0 0 0.6rem; }
-  pre.board { white-space: pre; overflow: auto; max-height: 60vh; background: var(--panel-sunken);
+  pre.board { white-space: pre-wrap; overflow-wrap: anywhere; overflow: auto; max-height: 60vh; background: var(--panel-sunken);
     border: 1px solid var(--border); border-radius: var(--r-ctl); padding: 0.85rem;
     font-family: var(--font-mono); font-size: 0.8125rem; line-height: 1.5; margin: 0;
     overscroll-behavior: contain; }
@@ -999,6 +999,7 @@ const SCRIPT = `
         s.filterCaret = filterInput.selectionStart;
         save(s);
         applyFilter(filterInput.value);
+        paintStamp();
         deferReload();
       });
     }
@@ -1039,7 +1040,21 @@ const SCRIPT = `
       window.addEventListener("resize", function () { measureHeader(); paintNav(); });
     }
 
-    if (typeof state.scrollY === "number") window.scrollTo(0, state.scrollY);
+    function absTop(el) { return el.getBoundingClientRect().top + window.scrollY; }
+    var anchorEl = state.anchor && typeof state.anchor.id === "string"
+      ? document.getElementById(state.anchor.id) : null;
+    if (anchorEl && typeof state.anchor.offset === "number") {
+      window.scrollTo(0, absTop(anchorEl) + state.anchor.offset);
+    } else if (typeof state.scrollY === "number") {
+      window.scrollTo(0, state.scrollY);
+    }
+    var itemSel = "details.pad-item, details.todo-item";
+    var padItems = document.querySelectorAll("details.pad-item");
+    for (var pi = 0; pi < padItems.length; pi++) {
+      var saved = state.padScroll && state.padScroll[padItems[pi].id];
+      var padPre = padItems[pi].querySelector("pre.board");
+      if (padItems[pi].open && padPre && typeof saved === "number") padPre.scrollTop = saved;
+    }
 
     // Live toggle. Replaces <meta http-equiv="refresh">, which the browser
     // schedules at PARSE TIME - removing the tag afterward does not cancel it,
@@ -1056,39 +1071,75 @@ const SCRIPT = `
     function clearReload() {
       if (reloadTimer !== null) { clearTimeout(reloadTimer); reloadTimer = null; }
     }
-    // Typing restarts the 10s rather than suspending it, so "refreshes every
-    // 10s" stays true - it is measured from the last keystroke, not from load.
+    function anyItemOpen() {
+      var items = document.querySelectorAll(itemSel);
+      for (var i = 0; i < items.length; i++) {
+        var it = items[i];
+        if (it.open && !it.closest("details.section:not([open])") && !it.closest("[hidden]")) return true;
+      }
+      return false;
+    }
+    // Typing and scrolling restart the 10s rather than suspending it, so
+    // "refreshes every 10s" stays true; an open pad or todo suspends it.
     function deferReload() {
       if (!live) return;
       clearReload();
-      armReload();
+      if (!anyItemOpen()) armReload();
     }
     var toggle = document.getElementById("live-toggle");
     var stamp = document.getElementById("generated-stamp");
     var stampTime = stamp ? stamp.getAttribute("data-time") : "";
-    function paintStamp(live) {
+    var tail = " local. Read-only: nothing here writes back to the store.";
+    function paintStamp() {
       if (!stamp) return;
-      stamp.textContent = live
-        ? "generated " + stampTime + " local, refreshes every 10s. Read-only: nothing here writes back to the store."
-        : "paused, generated " + stampTime + " local. Read-only: nothing here writes back to the store.";
+      stamp.textContent = !live
+        ? "paused, generated " + stampTime + tail
+        : anyItemOpen()
+          ? "paused while a pad or todo is open, generated " + stampTime + tail
+          : "generated " + stampTime + " local, refreshes every 10s. Read-only: nothing here writes back to the store.";
     }
     var live = typeof state.live === "boolean" ? state.live : true;
     if (toggle) toggle.checked = live;
-    paintStamp(live);
-    if (live) armReload(); else clearReload();
+    paintStamp();
+    deferReload();
+    var items = document.querySelectorAll(itemSel);
+    for (var ii = 0; ii < items.length; ii++) {
+      items[ii].addEventListener("toggle", function () { paintStamp(); deferReload(); });
+    }
+    var sectionEls = document.querySelectorAll("details.section");
+    for (var si = 0; si < sectionEls.length; si++) {
+      sectionEls[si].addEventListener("toggle", function () { paintStamp(); deferReload(); });
+    }
     if (toggle) {
       toggle.addEventListener("change", function () {
         var s = load();
-        s.live = toggle.checked;
+        live = toggle.checked;
+        s.live = live;
         save(s);
-        paintStamp(toggle.checked);
-        if (toggle.checked) armReload(); else clearReload();
+        paintStamp();
+        if (live) deferReload(); else clearReload();
       });
     }
+    window.addEventListener("scroll", function () {
+      if (reloadTimer !== null) deferReload();
+    }, { passive: true });
 
     window.addEventListener("beforeunload", function () {
       var s = load();
       s.scrollY = window.scrollY;
+      s.anchor = null;
+      var secs = document.querySelectorAll("details.section");
+      for (var k = 0; k < secs.length; k++) {
+        if (secs[k].getBoundingClientRect().top <= headerOffset) {
+          s.anchor = { id: secs[k].id, offset: window.scrollY - absTop(secs[k]) };
+        }
+      }
+      s.padScroll = {};
+      var openPads = document.querySelectorAll("details.pad-item");
+      for (var m = 0; m < openPads.length; m++) {
+        var pre = openPads[m].querySelector("pre.board");
+        if (openPads[m].open && pre && pre.scrollTop > 0) s.padScroll[openPads[m].id] = pre.scrollTop;
+      }
       if (filterInput) {
         s.filterFocused = document.activeElement === filterInput;
         s.filterCaret = filterInput.selectionStart;

package/dist/db.js

@@ -408,6 +408,26 @@ CREATE TABLE queen_audit (
   CHECK(home_project_id != target_project_id)
 );
 CREATE INDEX idx_queen_audit_target ON queen_audit(target_project_id, id);
+`,
+    `
+ALTER TABLE agents ADD COLUMN claude_messaging_socket TEXT NOT NULL DEFAULT '';
+ALTER TABLE agents ADD COLUMN claude_messaging_pane_pid TEXT NOT NULL DEFAULT '';
+ALTER TABLE wakes ADD COLUMN delivery_method TEXT;
+ALTER TABLE wakes ADD COLUMN socket_attempt_at TEXT;
+ALTER TABLE wakes ADD COLUMN socket_delivery_note TEXT;
+`,
+    `ALTER TABLE wakes ADD COLUMN delivered_by TEXT;`,
+    `
+ALTER TABLE agent_messages ADD COLUMN delivery_status TEXT;
+ALTER TABLE agent_messages ADD COLUMN delivery_method TEXT;
+ALTER TABLE agent_messages ADD COLUMN socket_attempt_at TEXT;
+ALTER TABLE agent_messages ADD COLUMN confirmed_at TEXT;
+ALTER TABLE agent_messages ADD COLUMN fallback_claimed_at TEXT;
+ALTER TABLE agent_messages ADD COLUMN typed_at TEXT;
+ALTER TABLE agent_messages ADD COLUMN delivery_note TEXT;
+ALTER TABLE agent_messages ADD COLUMN target_identity TEXT;
+ALTER TABLE agent_messages ADD COLUMN sender_tag TEXT;
+CREATE INDEX idx_agent_messages_delivery ON agent_messages(delivery_status, id) WHERE delivery_status IS NOT NULL;
 `,
 ];
 export function storeSchemaAhead(database) {

package/dist/harnesses.js

@@ -1,4 +1,4 @@
-import { claudeTrailerView, codexInputBoxState, codexTrailerView, codexPaneChoiceCheck, codexPaneHasInputBox, inputBoxState, paneChoiceCheck, paneHasInputBox, } from "./tmux.js";
+import { claudeTrailerView, codexInputBoxState, codexTrailerView, codexPaneChoiceCheck, codexPaneHasInputBox, inputBoxSnapshot, inputBoxState, paneChoiceCheck, paneHasInputBox, } from "./tmux.js";
 export function commandHead(command) {
     return command.trim().split(/\s+/)[0] ?? "";
 }
@@ -52,7 +52,7 @@ const claudeHarness = {
     supportsResume: true,
     supportsRename: true,
     classifiesPaneScreen: true,
-    paneClassifier: { choiceCheck: paneChoiceCheck, inputBoxState, hasInputBox: paneHasInputBox, trailerView: claudeTrailerView },
+    paneClassifier: { choiceCheck: paneChoiceCheck, inputBoxState, inputBoxSnapshot, hasInputBox: paneHasInputBox, trailerView: claudeTrailerView },
     hasScopes: true,
     needsHome: false,
     // "--" so a message that starts with a dash is never read as a flag.

package/dist/help.js

@@ -148,9 +148,13 @@ runbook (fork it first), not a pad write.`,
     Text is prefixed with the sender tag.
     Text over 300 chars sent to a LEAD by anyone but that lead is stored and
     delivered as a one-line pointer, so the human's own pane stays readable;
-    the receipt says shortened and names the message id.
-  agent_message_get(message_id) — the full text behind a pointer line. Kept
-    7 days; a lookup for a pruned id says it expired, not that it is missing.
+    the receipt says shortened and names the message id. With quiet_messaging
+    on, a worker's submitted text to a Claude lead is stored with an id and
+    posted to the lead's messaging socket instead; the receipt says pending
+    until the lead's prompt confirms it, and hive types it into the pane once
+    if nothing does. Do not resend a pending send.
+  agent_message_get(message_id) — the full text behind a pointer line, plus
+    the delivery state of a quiet message. Kept 7 days; a lookup for a pruned id says it expired, not that it is missing.
   agent_output(name|agent_id, lines?) — read the rendered terminal.
   agent_status(name|agent_id, include_brief?) — liveness, current command,
     short tail, and the path to the brief this worker was given

package/dist/hook.js

@@ -185,6 +185,21 @@ async function stopProcessesForEndedLead(actorId, payload) {
     const { stopAllProcesses, STOP_REASONS } = await import("./processes.js");
     stopAllProcesses(row.project_id, STOP_REASONS.leadSessionEnded);
 }
+// Bound to the pid of the pane this hook runs in, not to agents.pane_pid: on a fresh launch this can
+// run before cmdLead records the new pane. The scheduler uses it only when the two pids agree.
+async function registerLeadMessagingSocket(actorId) {
+    const raw = process.env.CLAUDE_CODE_MESSAGING_SOCKET ?? "";
+    const pane = process.env.TMUX_PANE ?? "";
+    let socket = isAbsolute(raw) && !raw.includes("\0") ? raw : "";
+    let pid = "";
+    if (socket !== "" && pane !== "") {
+        const { panePidForRecord } = await import("./tmux.js");
+        pid = panePidForRecord(pane);
+    }
+    if (pid === "")
+        socket = "";
+    db.prepare("UPDATE agents SET claude_messaging_socket = ?, claude_messaging_pane_pid = ? WHERE actor_id = ? AND kind = 'lead' AND status = 'running'").run(socket, pid, actorId);
+}
 function reconcileSessionId(actorId, payload) {
     const sessionId = typeof payload.session_id === "string" ? payload.session_id : "";
     if (!sessionId)
@@ -306,6 +321,13 @@ try {
             catch {
             }
         }
+        if (event === "session_start" && process.env.HIVE_LEAD === "1") {
+            try {
+                await registerLeadMessagingSocket(actorId);
+            }
+            catch {
+            }
+        }
         if (event === "session_end") {
             try {
                 await stopProcessesForEndedLead(actorId, readPayload());

package/dist/hooks.js

@@ -22,6 +22,20 @@ export function ensureHooksFile() {
     writeFileSync(path, JSON.stringify(settings, null, 2) + "\n");
     return path;
 }
+// Off returns the store-wide file unchanged. On writes a per-project file, because hooks.json is shared
+// by every project's lead and an accept there would reach leads that never opted in.
+export function ensureLeadHooksFile(projectId, quietMessaging) {
+    if (!quietMessaging)
+        return ensureHooksFile();
+    const base = stateHookSettings();
+    const settings = {
+        hooks: { ...base.hooks, SessionStart: [hookEntry("session_start")] },
+        crossSessionInbound: "accept",
+    };
+    const path = join(dataDir, `lead-${projectId}-hooks.json`);
+    writeFileSync(path, JSON.stringify(settings, null, 2) + "\n");
+    return path;
+}
 function stateHookSettings() {
     return {
         hooks: {

package/dist/leadMessage.js

@@ -14,6 +14,17 @@ export const MESSAGE_RETENTION = "-7 days";
 // direction. Far above any observed rate, and lower than agent_state_log's 20,000 because a row here
 // holds unbounded message text rather than a hook payload.
 export const MESSAGE_MAX_ROWS = 5_000;
+export const DELIVERY_FIELDS = [
+    "delivery_status",
+    "delivery_method",
+    "socket_attempt_at",
+    "confirmed_at",
+    "fallback_claimed_at",
+    "typed_at",
+    "delivery_note",
+    "target_identity",
+    "sender_tag",
+];
 function senderName(projectId, actorId) {
     const row = db
         .prepare(`SELECT name FROM agents WHERE project_id = ? AND actor_id = ?
@@ -44,7 +55,7 @@ export function storeLeadMessage(projectId, fromActor, toAgentId, text) {
 }
 export function readLeadMessage(projectId, messageId) {
     return db
-        .prepare(`SELECT id, from_actor, from_name, to_agent_id, text, created_at
+        .prepare(`SELECT id, from_actor, from_name, to_agent_id, text, created_at, ${DELIVERY_FIELDS.join(", ")}
          FROM agent_messages WHERE id = ? AND project_id = ?`)
         .get(messageId, projectId);
 }
@@ -75,17 +86,27 @@ export function missMessage(messageId, kind) {
 // also covers format characters. The head comes from outside, and a raw control byte in it reaches tmux
 // as a keystroke rather than as text, submitting this pointer early and splitting it. The sender's name
 // is flattened by senderTag when it builds the tag ahead of this marker - the tag is who, this is what.
-export function leadPointerMarker(id, text) {
-    return `[message #${id}, ${text.length} chars]`;
+export function leadPointerMarker(id, text, redelivered = false) {
+    return `[message #${id}, ${text.length} chars${redelivered ? ", re-delivered" : ""}]`;
 }
-export function renderLeadPointer(id, text, tag) {
+const redeliveredLead = (id, redelivered) => redelivered ? ` If you already handled message #${id}, ignore this.` : "";
+export function renderLeadPointer(id, text, tag, redelivered = false) {
     const flat = flatten(text);
     const head = flat.length > HEAD_BUDGET ? cutToUnitBudget(flat, HEAD_BUDGET) + ELLIPSIS : flat;
-    return `${tag}${leadPointerMarker(id, text)} ${head} agent_message_get(${id}) for the full text.`;
+    return `${tag}${leadPointerMarker(id, text, redelivered)}${redeliveredLead(id, redelivered)} ${head} agent_message_get(${id}) for the full text.`;
 }
-export function shortenedSendNote(id, deliveredChars) {
-    return (`Over ${LEAD_MESSAGE_THRESHOLD} characters to a LEAD, so that pane got a ${deliveredChars}-character ` +
-        `pointer instead of this text: a lead's pane is a human's own window and hive keeps it quiet. Nothing ` +
+// A short message carries its id too, so a quiet send has a marker its confirmation can match.
+export function renderLeadMessage(id, text, tag, redelivered = false) {
+    return text.length > LEAD_MESSAGE_THRESHOLD
+        ? renderLeadPointer(id, text, tag, redelivered)
+        : `${tag}${leadPointerMarker(id, text, redelivered)}${redeliveredLead(id, redelivered)} ${text}`;
+}
+export function shortenedSendNote(id, deliveredChars, channel = "pane") {
+    return (`Over ${LEAD_MESSAGE_THRESHOLD} characters to a LEAD, so ` +
+        (channel === "pane"
+            ? `that pane got a ${deliveredChars}-character pointer instead of this text`
+            : `hive delivers a ${deliveredChars}-character pointer instead of this text, over the lead's messaging socket or, failing that, typed once into its pane`) +
+        `: a lead's pane is a human's own window and hive keeps it quiet. Nothing ` +
         `was lost - the full text is stored as message ${id} and the pointer names agent_message_get(${id}) - ` +
         `but the lead reads the rest only if it chooses to. Put whatever must be ACTED on in the first ` +
         `${HEAD_BUDGET} characters, or on the todo, where it is durable. Worker-bound sends are never shortened.`);