hivecode-mcp 0.11.6 → 0.12.1

package/hive-update.js

@@ -0,0 +1,58 @@
+// hive-update.js -- tells an agent, and through it its human, that a newer hivecode is out.
+//
+// WHY THIS EXISTS. `npx -y hivecode-mcp@latest setup` points agent apps at a runtime COPY
+// (~/.hivecode/runtime/<version>), which is what made starting fast, offline and free of npx.
+// It also means nothing updates any more: every start used to fetch @latest, and now an agent
+// stays on the version it was set up with until someone runs setup again. A room with mixed
+// builds is the one condition hive_join itself warns can lose data, so the gap must be visible.
+//
+// IT NEVER GETS IN THE WAY. The check starts with the server, carries a short timeout, and
+// hive_join and hive_status use whatever answer has arrived by then. A failed check says
+// nothing -- no network is not news. HIVE_PRIVATE=1 and HIVE_NO_UPDATE_CHECK=1 both switch it
+// off: a user who asked for privacy did not ask for a request to npm on every start.
+import { VERSION } from './hive-version.js'
+
+const REGISTRY_LATEST = 'https://registry.npmjs.org/hivecode-mcp/latest'
+
+/** True when version `a` is newer than `b` (x.y.z; anything unparseable is never "newer"). */
+export function newer(a, b) {
+  const parse = (v) => String(v).split('-')[0].split('.').map((n) => Number(n))
+  const pa = parse(a)
+  const pb = parse(b)
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0
+    const y = pb[i] ?? 0
+    if (!Number.isFinite(x) || !Number.isFinite(y)) return false
+    if (x !== y) return x > y
+  }
+  return false
+}
+
+let latest = null
+let started = false
+
+export function startUpdateCheck({ fetchImpl = globalThis.fetch, timeoutMs = 4000, env = process.env } = {}) {
+  if (started) return
+  started = true
+  if (env.HIVE_NO_UPDATE_CHECK === '1' || env.HIVE_PRIVATE === '1' || typeof fetchImpl !== 'function') return
+  Promise.resolve()
+    // HIVE_UPDATE_URL exists for tests/update-notice-test.mjs, which serves a fake registry so the
+    // wiring is proven end to end through a real server process.
+    .then(() => fetchImpl(env.HIVE_UPDATE_URL || REGISTRY_LATEST, { signal: AbortSignal.timeout(timeoutMs), headers: { accept: 'application/json' } }))
+    .then((r) => (r && r.ok ? r.json() : null))
+    .then((j) => { if (j && typeof j.version === 'string') latest = j.version })
+    .catch(() => { /* offline, blocked, or slow: say nothing */ })
+}
+
+/** The line to show, or '' when this agent is current (or nobody knows yet). */
+export function updateNotice(current = VERSION, known = latest) {
+  if (!known || !newer(known, current)) return ''
+  return `UPDATE AVAILABLE: hivecode ${known} is out; this agent runs ${current}. Tell your human to run ` +
+    '`npx -y hivecode-mcp@latest setup` and reload this agent. Mixed versions in one room can lose data.'
+}
+
+export const _test = {
+  reset() { latest = null; started = false },
+  setLatest(v) { latest = v; started = true },
+  latest: () => latest,
+}

package/hive-version.js

@@ -0,0 +1,59 @@
+// hive-version.js — one place that knows what build this is.
+//
+// WHY THIS FILE EXISTS, and it is not tidiness.
+//
+// VERSION is load-bearing, not cosmetic. hive_join instructs every arriving agent to announce its
+// version in chat, because two clients running different builds in one room corrupt each other's
+// files with no error on either side — both writes succeed, both are green, and the disagreement
+// surfaces only as lost bytes. That announcement is the ONLY channel that makes a mixed build
+// visible from inside the room. So a version string is not a label; it is the input to the one
+// detector we have.
+//
+// On 20 Sep 2026 three entry points were found reporting a version package.json does not contain:
+// remote-mcp.js said '0.11.5' while live on the hosted relay, hive-mcp-http.js and hive-linear.js
+// both said '1.0.0'. hive-mcp.js had already been fixed months earlier, with a comment explaining
+// exactly why hardcoding it is dangerous — and that fix was never carried to the other three.
+// A detector that lies is strictly worse than no detector, because it is trusted.
+//
+// HIV-P7 closed that by giving each of the four files its own runtime read. Which produced the
+// next defect, and it was measured rather than predicted: with the reader duplicated four times,
+// corrupting ONE copy's fallback string to '9.9.9-DRIFTED' left tests/version-truth-test.mjs at
+// 16 passed, 0 failed. The property guards the version that gets REPORTED and says nothing about
+// the mechanism that produces it, so three of four copies could rot in silence.
+//
+// This codebase has watched that happen before. The extension's reconcile() and the engine's were
+// the same function once; they now share 34 lines and behave differently. Eight lines is not too
+// small to drift — it is exactly small enough that nobody feels the need to check.
+//
+// So the fix is DELETION, not another assertion. One definition, imported by all four. The
+// property becomes true by construction instead of by policing, and a fifth entry point written
+// next year gets it right by importing rather than by remembering.
+//
+// TWO DECISIONS WORTH KEEPING:
+//
+// It READS package.json rather than being told. package.json always ships beside these files —
+// in the repo and in the published tarball — so `new URL('./package.json', import.meta.url)`
+// resolves in both. Anything else (a constant, a build step, a generated file) can disagree with
+// the package the moment `npm version` runs, which is precisely the failure being fixed.
+//
+// IT NEVER THROWS. A version read is not worth a server that will not boot, and a server that
+// refuses to start is a worse outcome than one that says it does not know which build it is. So
+// an unreadable or malformed package.json yields '0.0.0-unknown' — a value that is obviously
+// wrong to a human, will never match a real release, and cannot be mistaken for a true answer.
+// Silence or an empty string could be read as "no mixed build here"; this cannot.
+
+import fs from 'fs'
+
+/** Recomputed never: a running process cannot change which build it is. */
+export const VERSION = (() => {
+  try {
+    const v = JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version
+    if (typeof v === 'string' && v) return v
+  } catch { /* fall through — see IT NEVER THROWS above */ }
+  return '0.0.0-unknown'
+})()
+
+/** The sentinel, exported so callers and tests can name it instead of retyping the literal. */
+export const UNKNOWN_VERSION = '0.0.0-unknown'
+
+export default VERSION

package/lang-js.js

@@ -128,11 +128,20 @@ function bareName(node) {
 function declaredNames(src) {
   const s = new Set()
   for (const node of parse(src).body) {
-    const nm = bareName(node); if (nm) s.add(nm)
-    // Import locals count as declared names too — so if an import is ever dropped and its
+    let n = node
+    if (n.type === 'ExportNamedDeclaration' && n.declaration) n = n.declaration
+    if (n.type === 'VariableDeclaration') {
+      for (const d of n.declarations) bindingNames(d.id, s)
+    } else {
+      const nm = bareName(node); if (nm) s.add(nm)
+    }
+    // Import locals count as declared names too — so if an import is ever dropped and its
     // binding is still used, the dangling-reference check catches it (safety net for the
     // import merge). Keeps the never-emit-broken-code guarantee honest for imports.
     if (node.type === 'ImportDeclaration') for (const sp of node.specifiers) s.add(sp.local.name)
+    if (node.type === 'ExportNamedDeclaration' && !node.declaration && node.specifiers) {
+      for (const sp of node.specifiers) s.add(sp.exported.name || sp.exported.value || sp.local.name)
+    }
   }
   return s
 }

package/limits.js

@@ -127,7 +127,27 @@ export const LIMITS = {
   // Retained CRDT size for one doc. A doc is one file in this design.
   maxDocBytes: num('HIVE_MAX_DOC_BYTES', 64 * 1024 * 1024),
   maxConnsPerRoom: num('HIVE_MAX_CONNS_PER_ROOM', 64),
-  maxConnsTotal: num('HIVE_MAX_CONNS_TOTAL', 512),
+  // The only cap that spans a whole project: a client holds one socket per open file (up to
+  // HIVE_MAX_OPEN_FILES=128) plus its base room, and each file is its own room as far as the
+  // per-room ceiling is concerned -- so a real team is bounded by THIS number and nothing else.
+  // It was 512: three participants on a 150-file room measured 409 connections, so a fourth
+  // was refused, on a relay already carrying other rooms. Measured cost 25 Sep 2026: ~56 KB of
+  // relay memory per connection (400 extra sockets to the same 400 docs: +22 MB), so 2048 is
+  // ~115 MB -- comfortable on a 512 MB free instance.
+  maxConnsTotal: num('HIVE_MAX_CONNS_TOTAL', 2048),
+  // ONE SOCKET PER PARTICIPANT (hive-mux-proto.js). A mux socket counts ONCE against
+  // maxConnsTotal above; each file it opens is a CHANNEL, counted against the file's per-room
+  // ceiling exactly as a per-file socket is, and against these two caps instead of the socket
+  // total -- which is the whole point: a participant stops costing 129 sockets.
+  //
+  // Sized by MEMORY, measured 25 Sep 2026: ~25.8 KB per channel whose doc no one else holds (the
+  // doc is most of it), ~2.4 KB for each further participant on the same doc. The socket cap
+  // used to bound open docs as a side effect; this is what bounds them now. 8192 lone small docs
+  // is ~211 MB on the 512 MB hosted instance -- raise it with the instance, not before. The per-
+  // participant cap matches the client's own bound in one-socket mode, so no single participant
+  // can take more than half the relay.
+  maxChannelsTotal: num('HIVE_MAX_CHANNELS_TOTAL', 8192),
+  maxChannelsPerSocket: num('HIVE_MUX_MAX_DOCS', 4096),
   // How long a client stays refused after tripping a rate limit. Long enough that a tight
   // loop actually yields, short enough that a human does not notice a one-off burst.
   cooloffMs: num('HIVE_RATE_COOLOFF_MS', 5000),
@@ -183,6 +203,32 @@ export function noteConnectionOpened(room) {
   roomConns.set(room, (roomConns.get(room) || 0) + 1)
 }
 
+// Channels share roomConns with sockets on purpose: the per-room ceiling means "how many
+// participants hold this file", and it must mean that whichever transport each one uses.
+let totalChannels = 0
+export function admitChannel(room, tier = null) {
+  if (totalChannels >= LIMITS.maxChannelsTotal) {
+    return { code: 503, reason: `Q438 relay at capacity (${LIMITS.maxChannelsTotal} open files across all participants)` }
+  }
+  const cap = (tier && tier.maxConnsPerRoom) || LIMITS.maxConnsPerRoom
+  const n = roomConns.get(room) || 0
+  if (n >= cap) {
+    const which = tier ? `${tier.tier} tier` : 'this relay'
+    return { code: 429, reason: `Q431 room at capacity (${cap} connections on ${which})` }
+  }
+  return null
+}
+export function noteChannelOpened(room) {
+  totalChannels++
+  roomConns.set(room, (roomConns.get(room) || 0) + 1)
+}
+export function noteChannelClosed(room) {
+  totalChannels = Math.max(0, totalChannels - 1)
+  const n = (roomConns.get(room) || 1) - 1
+  if (n <= 0) roomConns.delete(room)
+  else roomConns.set(room, n)
+}
+
 export function noteConnectionClosed(room) {
   totalConns = Math.max(0, totalConns - 1)
   const n = (roomConns.get(room) || 1) - 1
@@ -330,6 +376,7 @@ export function usageFor(room = null) {
 export function stats() {
   return {
     connections: totalConns,
+    channels: totalChannels,
     rooms: roomConns.size,
     largestDocBytes: docBytes.size ? Math.max(...docBytes.values()) : 0,
     docsTracked: docBytes.size,
@@ -340,6 +387,7 @@ export function stats() {
 /** Test-only: reset module state between cases. */
 export function _reset() {
   totalConns = 0
+  totalChannels = 0
   roomConns.clear()
   docBytes.clear()
   usage.clear()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hivecode-mcp",
-  "version": "0.11.6",
+  "version": "0.12.1",
   "description": "MCP server that lets any AI coding agent join a Hivecode room — humans and multiple AI agents edit one live codebase with folder-scoped permissions and approval gates.",
   "type": "module",
   "license": "MIT",
@@ -28,11 +28,23 @@
   },
   "files": [
     "hive-mcp.js",
+    "hive-mux.js",
+    "hive-mux-proto.js",
+    "hive-version.js",
+    "hive-pr-staleness.js",
     "hive-mailbox.js",
     "hive-obligations.js",
     "hive-receipts.js",
     "hive-throttle.js",
     "hive-instructions.js",
+    "hive-activity.js",
+    "hive-relay-health.js",
+    "hive-privacy.js",
+    "hive-setup.js",
+    "hive-stdio.js",
+    "hive-update.js",
+    "docs/SELF_HOSTING.md",
+    "reconcile.cjs",
     "hive-busy.js",
     "hive-stop-hook.js",
     "hive-hook-install.js",
@@ -72,8 +84,17 @@
     "test:features": "node tests/features-test.mjs",
     "test:features:shape": "node tests/features-test.mjs --shape",
     "test:learnings": "node tests/learnings-test.mjs",
-    "test:extension": "node tests/extension-parity-test.mjs",
+    "test:docs": "node tests/readme-promises-test.mjs",
+    "test:setup": "node tests/setup-test.mjs --package",
+    "test:mcp": "node tests/mcp-conformance-test.mjs",
+    "test:recreate": "node tests/blind-recreate-test.mjs",
+    "test:liveness": "node tests/agent-liveness-test.mjs && node tests/unreachable-recipient-test.mjs",
+    "build:ext": "node scripts/build-icr-cjs.cjs && node scripts/build-privacy-cjs.cjs",
+    "test:selfhost": "node tests/relay-pin-test.mjs && node tests/self-host-test.mjs && node tests/extension-privacy-parity-test.mjs",
+    "test:hardening": "node tests/genesis-claim-test.mjs && node tests/bare-root-write-test.mjs && node tests/version-truth-test.mjs && node tests/room-repo-drift-test.mjs && node tests/first-contact-refusal-test.mjs && node tests/open-file-cap-test.mjs && node tests/learnings-test.mjs && node tests/agent-liveness-test.mjs && node tests/unreachable-recipient-test.mjs && node tests/join-honesty-test.mjs && node tests/relay-diagnosis-test.mjs && node tests/blind-recreate-test.mjs && node tests/genesis-collision-test.mjs && node tests/relay-pin-test.mjs && node tests/self-host-test.mjs && node tests/extension-privacy-parity-test.mjs && node tests/readme-promises-test.mjs && node tests/setup-test.mjs && node tests/mcp-conformance-test.mjs && node tests/update-notice-test.mjs && node tests/mux-test.mjs",
+    "test:extension": "node tests/extension-parity-test.mjs && node tests/extension-privacy-parity-test.mjs",
     "test:ceiling": "node tests/refused-visible-test.mjs && node tests/ceiling-no-data-loss-test.mjs",
+    "test:mux": "node tests/mux-test.mjs",
     "test:identity": "node tests/identity-audit-test.mjs",
     "test:billing": "node tests/billing-test.mjs",
     "test:license": "node tests/hive-license-test.js",
@@ -117,17 +138,18 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.104.2",
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "acorn": "^8.17.0",
     "ignore": "^7.0.5",
     "lib0": "^0.2.117",
+    "lodash.debounce": "^4.0.8",
     "ws": "^8.18.0",
-    "y-websocket": "^2.0.4",
-    "yjs": "^13.6.18",
-    "zod": "^4.4.3"
+    "y-protocols": "^1.0.6",
+    "y-websocket": "^3.1.0",
+    "yjs": "^13.6.18"
   },
   "devDependencies": {
+    "@anthropic-ai/sdk": "^0.104.2",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/node": "^26.1.2",
     "esbuild": "^0.28.1",
     "typescript": "^7.0.2"