hivecode-mcp 0.12.4 → 0.13.1

package/hive-authors.js

@@ -0,0 +1,44 @@
+// hive-authors.js -- who wrote what the room holds: the ONE authorsOf, shared by sync.js and hive-pr.js. A receipt counts only when verify(r) === true or verify(r).ok === true (a truthy {ok:false} used to count).
+import { contentHash } from './substrate.js'
+
+/**
+ * Check whether a receipt is valid according to the optional verify function.
+ * Handles both boolean returns and { ok: boolean } result objects (verifyReceipt).
+ */
+export function isReceiptValid(verify, r) {
+  if (!verify) return true
+  const v = verify(r)
+  return v === true || Boolean(v && v.ok)
+}
+
+/**
+ * The authors of a file's held content, newest-landed first, from verified receipts only.
+ */
+export function authorsOf(receipts, verify, roomText) {
+  const ok = (receipts || []).filter((r) => r && r.author && isReceiptValid(verify, r))
+  if (!ok.length) return { last: null, contributors: [], first: 0, receipts: [] }
+  const want = typeof roomText === 'string' ? contentHash(roomText) : null
+  let idx = -1
+  if (want) {
+    for (let i = ok.length - 1; i >= 0; i--) {
+      if (ok[i].contentHash === want) {
+        idx = i
+        break
+      }
+    }
+  }
+  const held = idx >= 0 ? ok.slice(0, idx + 1) : ok
+  const last = held[held.length - 1]
+  const seen = new Map()
+  for (const r of held) {
+    if (!seen.has(r.author)) {
+      seen.set(r.author, { author: r.author, name: r.name || 'agent', at: r.at || 0 })
+    }
+  }
+  return {
+    last: last ? { author: last.author, name: last.name || 'agent', at: last.at || 0 } : null,
+    contributors: [...seen.values()],
+    first: Math.min(...ok.map((r) => r.at || 0)),
+    receipts: held,
+  }
+}

package/hive-await.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // hive-await — block until someone speaks to you, then exit. The CLI's `hive_wait`.
 //
-//   npx -y -p hivecode-mcp@latest hivecode-await "<relay|room>" <YourName> [idleMinutes]
+//   npx -y -p hivecode-mcp@latest hivecode-await "<relay|room>" <YourName> [idleMinutes] [app]
 //
 // Run it in the BACKGROUND and let its exit wake you. Exits 0 in both cases; read `reason` on stdout:
 //   {"reason":"mention","messages":[...]}   someone said @YourName or @all -> read, reply, run it again
@@ -37,15 +37,20 @@ import { startSync, parseLink } from './sync.js'
 import * as RC from './hive-receipts.js'
 import { awaitDir, armedFile, BEAT_MS } from './hive-listen.js'
 
-const [, , LINK = '', NAME = '', IDLE_MIN = '10'] = process.argv
+const [, , LINK = '', NAME = '', IDLE_MIN = '10', APP_ARG = ''] = process.argv
 if (!LINK || !NAME) {
-  console.error('usage: npx -y -p hivecode-mcp@latest hivecode-await "<relay|room>" <YourName> [idleMinutes]')
+  console.error('usage: npx -y -p hivecode-mcp@latest hivecode-await "<relay|room>" <YourName> [idleMinutes] [app]')
   process.exit(2)
 }
 const { relay, room } = parseLink(LINK)
 const dir = awaitDir(NAME)
+// Which app will be woken when this listener exits: passed by listenCommand, or inferred from the
+// session environment when the agent ran `node hive-await.js <link> <name> <min>` directly. Without
+// `app` here, a listener running while the MCP connection is closed or restarting leaves `app`
+// undefined in awareness, and hive-activity.js misreports the agent as "not woken by it".
+const APP = APP_ARG || process.env.HIVE_APP || (process.env.CLAUDE_CODE_SESSION_ID ? 'claude-code' : (process.env.ANTIGRAVITY_CONVERSATION_ID || process.env.ANTIGRAVITY_AGENT ? 'antigravity' : ''))
 
-const hive = startSync({ relay, room, dir, name: NAME, kind: 'ai', token: process.env.HIVE_TOKEN || '', syncFiles: false, listener: true, log: () => {} })
+const hive = startSync({ relay, room, dir, name: NAME, kind: 'ai', token: process.env.HIVE_TOKEN || '', syncFiles: false, listener: true, app: APP, log: () => {} })
 
 // ARMED, AND THE NEWEST LISTENER WINS (4 Oct 2026; see hive-listen.js). This file is how the Stop
 // hook and the MCP server know, with no network call, that the agent will hear the room after its
@@ -55,20 +60,40 @@ const hive = startSync({ relay, room, dir, name: NAME, kind: 'ai', token: proces
 // listener that finds the file naming another process leaves: that one was started after it.
 const ARMED = armedFile(NAME, room)
 const SESSION = process.env.CLAUDE_CODE_SESSION_ID || process.env.ANTIGRAVITY_CONVERSATION_ID || ''
-const AGAIN = `"${process.execPath.replace(/\\/g, '/')}" "${path.resolve(process.argv[1]).replace(/\\/g, '/')}" "${LINK}" "${NAME}" ${IDLE_MIN}`
+const AGAIN = `"${process.execPath.replace(/\\/g, '/')}" "${path.resolve(process.argv[1]).replace(/\\/g, '/')}" "${LINK}" "${NAME}" ${IDLE_MIN}${APP_ARG ? ` "${APP_ARG}"` : ''}`
 const startedAt = Date.now()
 let synced = false
-const ownerPid = () => { try { return Number(JSON.parse(fs.readFileSync(ARMED, 'utf8')).pid) || 0 } catch { return 0 } }
+const readArmed = () => { try { return JSON.parse(fs.readFileSync(ARMED, 'utf8')) } catch { return null } }
+const ownerPid = () => Number((readArmed() || {}).pid) || 0
+const alive = (pid) => { try { process.kill(pid, 0); return true } catch (e) { return e.code === 'EPERM' } }
+// THE NEWEST BY START TIME WINS, NOT THE LAST ONE TO WRITE (6 Oct 2026, the first macOS run). Every
+// listener reads the file and then rewrites it on each beat. An older listener that read it just
+// before a newer one wrote it put its own claim back on top, and the NEWER one then left as
+// "superseded" while the older stayed: N1 and N3 failed on macOS, never on Windows. So a claim is
+// judged by when its listener started. A listener yields only to one that started after it and is
+// still running; a newer one that finds an older claim on top takes the file back on its next beat.
+// The file is also written whole (a temp file renamed over it), so a reader never sees half of one.
+const newerThanMe = (rec) => {
+  const pid = Number(rec && rec.pid) || 0
+  if (!pid || pid === process.pid || !alive(pid)) return false
+  const at = Number(rec.at) || 0
+  return at > startedAt || (at === startedAt && pid > process.pid)
+}
 function beat() {
   try {
     fs.mkdirSync(path.dirname(ARMED), { recursive: true })
-    fs.writeFileSync(ARMED, JSON.stringify({ pid: process.pid, name: NAME, room, link: LINK, session: SESSION, at: startedAt, beat: Date.now(), synced }))
+    const body = JSON.stringify({ pid: process.pid, name: NAME, room, link: LINK, session: SESSION, ...(APP ? { app: APP } : {}), at: startedAt, beat: Date.now(), synced })
+    const part = `${ARMED}.${process.pid}.tmp`
+    try { fs.writeFileSync(part, body); fs.renameSync(part, ARMED) } catch {
+      try { fs.rmSync(part, { force: true }) } catch {}
+      fs.writeFileSync(ARMED, body)
+    }
   } catch { /* unarmed is the safe reading: the hook asks for a fresh listener, and it replaces this one */ }
 }
 const superseded = () => {
-  const o = ownerPid()
-  if (!o || o === process.pid) return false
-  finish('superseded', { note: `a newer listener for ${NAME} in ${room} took over (pid ${o}). Do not start this one again.` })
+  const rec = readArmed()
+  if (!newerThanMe(rec)) return false
+  finish('superseded', { note: `a newer listener for ${NAME} in ${room} took over (pid ${rec.pid}). Do not start this one again.` })
   return true
 }
 beat()

package/hive-branch.js

@@ -31,7 +31,6 @@ import os from 'os'
 import path from 'path'
 import crypto from 'crypto'
 import { spawnSync } from 'child_process'
-import { fileURLToPath } from 'url'
 import ignore from 'ignore'
 import { startSync, parseLink, ALWAYS_IGNORE, SKIP } from './sync.js'
 import { PUBLIC_DEFAULT_RELAY, currentRelayFor } from './hive-privacy.js'
@@ -40,6 +39,10 @@ import { validateMemberName, suggestMemberName } from './hive-mailbox.js'
 import { isSafeRelPath } from './token.js'
 
 const TEXT_MAX = 1_000_000 // sync.js MAX_BYTES: a larger file never crosses the relay
+
+// For hive-land.js, the one landing path. Declared below; exported here so the landing reads the
+// binding, the branch and the room with exactly the rules this module binds and seeds with.
+export { projectRoot, validBranch, revParse, coded, safeSegment, isOwnFile, git as gitIn, waitFor }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 const coded = (code, msg) => Object.assign(new Error(`${code} ${msg}`), { code })
 
@@ -58,6 +61,19 @@ export function roomFolder(link, name) {
 
 // ---- git ----------------------------------------------------------------------------------
 
+// OUR SCRATCH WORKTREES RUN WITHOUT THE DEVELOPER'S GIT HOOKS. A post-checkout hook that exits 1
+// made `pr` fail with Q563 although git had made the worktree (measured 25 Oct 2026, a vexp hook);
+// others run npm install or rewrite files in what is a scratch folder about to be deleted. Only
+// commands inside our own temporary worktrees: the developer's checkout and every push keep their
+// hooks. A hooks path that is never created means "no hooks" on every platform git runs on.
+export const NO_HOOKS_DIR = path.join(os.tmpdir(), 'hivecode-no-hooks-never-created')
+export const noHooks = (args) => ['-c', `core.hooksPath=${NO_HOOKS_DIR}`, ...args]
+/** The same for a child process that runs git itself. Appends to any GIT_CONFIG_* already set. */
+export function noHooksEnv(env = process.env) {
+  const n = Number(env.GIT_CONFIG_COUNT) > 0 ? Number(env.GIT_CONFIG_COUNT) : 0
+  return { ...env, GIT_CONFIG_COUNT: String(n + 1), [`GIT_CONFIG_KEY_${n}`]: 'core.hooksPath', [`GIT_CONFIG_VALUE_${n}`]: NO_HOOKS_DIR }
+}
+
 function git(cwd, args, { input, raw = false, trim = true } = {}) {
   const r = spawnSync('git', args, { cwd, input, encoding: raw ? undefined : 'utf8', maxBuffer: 1024 * 1024 * 1024, windowsHide: true })
   if (r.error) return { code: -1, out: raw ? Buffer.alloc(0) : '', err: r.error.message }
@@ -74,8 +90,14 @@ export function repoRoot(dir) {
   return r.code === 0 && r.out ? path.resolve(r.out) : null
 }
 
+// Links are resolved on both sides: git names a repository's top with them resolved, while the home
+// directory comes as written, and on macOS the temp folders sit behind one (6 Oct 2026).
 const sameDir = (a, b) => {
-  const n = (p) => path.resolve(p).replace(/[\\/]+$/, '')
+  const n = (p) => {
+    let r = path.resolve(p)
+    try { r = fs.realpathSync.native(r) } catch { /* a path that cannot be resolved is compared as written */ }
+    return r.replace(/[\\/]+$/, '')
+  }
   return process.platform === 'win32' ? n(a).toLowerCase() === n(b).toLowerCase() : n(a) === n(b)
 }
 
@@ -186,7 +208,7 @@ export function roomCarries(files) {
 // folder look held by some other process, and a foreign shadow is somebody else's ancestry.
 // By exact name: a project's own `.hiverc` is its business. All of these are already never carried
 // (always-ignored, or rendered locally), so the seed and a fresh joiner agree on what the room holds.
-const OWN_FILES = new Set(['.hive.json', '.hive-shadow.json', '.hive-shadow.json.tmp', '.hive-lock.json', '.hive-id.json', '.hive-mcp-session.json'])
+const OWN_FILES = new Set(['.hive.json', '.hive-shadow.json', '.hive-shadow.json.tmp', '.hive-lock.json', '.hive-id.json', '.hive-mcp-session.json', '.hive-stop-hook.json'])
 const isOwnFile = (rel) => OWN_FILES.has(path.posix.basename(rel))
 
 function writeFiles(dir, files) {
@@ -308,6 +330,13 @@ async function seedRoom({ root, branch, commit, link, you, log }) {
       throw coded('Q566', `a fresh joiner did not receive the whole branch: ${missing.length} of ${expected.size} files are missing or different (first: ${missing.slice(0, 5).join(', ')}). Nothing was bound; agents would have built on a partial tree.`)
     }
     const short = commit.slice(0, 7)
+    // Who holds this room's repo, for display only: an agent on another machine asked to open a PR
+    // is told whom to ask. Never a path; what lands is decided on the landing machine alone.
+    try { const R = await import('./hive-repos.js'); R.writeRepoHolder(seeder.doc, { branch, holder: you, host: os.hostname() }) } catch { /* display only */ }
+    // THE COMMIT THE ROOM STARTS FROM, for a teammate's `--join`: without it their clone cannot tell
+    // a file the room deleted from one added to the branch later, and landing from there skipped the
+    // room's deletions -- and the Q572 guard -- without a word (antigravity, 5 Nov 2026).
+    try { seeder.doc.getMap('seed').set('commit', commit); seeder.doc.getMap('seed').set('branch', branch) } catch { /* older relay docs */ }
     seeder.say(`Room for git branch \`${branch}\` @ ${short}, seeded by ${you} with ${expected.size} file(s). Work here lands on \`${branch}\` as one commit per agent via \`npx -y hivecode-mcp@latest pr ${branch}\`. Room folders are not git checkouts on purpose: edit files, do not commit.`)
     await sleep(600) // let the announcement leave before the socket closes
     return { dir, count: expected.size, total: files.length }
@@ -336,6 +365,25 @@ async function roomPaths(link, you) {
 }
 const roomFileCount = async (link, you) => { const p = await roomPaths(link, you); return p ? p.size : null }
 
+/** The commit the room was seeded from, as its seeder recorded it ({ commit, branch }), or null. */
+async function roomSeed(link, you) {
+  const { relay, room } = parseLink(link)
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hive-peek-'))
+  const peek = startSync({ relay, room, dir, name: `${you}-peek`, kind: 'ai', passive: true, syncFiles: false, log: () => {} })
+  try {
+    let synced = false
+    peek.provider.on('sync', (s) => { if (s) synced = true })
+    if (!(await waitFor(() => synced, 15000))) return null
+    await sleep(300)
+    const m = peek.doc.getMap('seed')
+    const commit = m.get('commit')
+    return typeof commit === 'string' && /^[0-9a-f]{40}$/i.test(commit) ? { commit, branch: String(m.get('branch') || '') } : null
+  } finally {
+    try { peek.stop() } catch { }
+    try { fs.rmSync(dir, { recursive: true, force: true }) } catch { }
+  }
+}
+
 /** The branch a PR from `name` goes into: the checkout's current branch, else origin's default. */
 function defaultBase(root, name) {
   const cur = git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD'])
@@ -350,7 +398,7 @@ function defaultBase(root, name) {
  * line, and naming this room in its .hive.json. The path comes from git config, and config is
  * editable text -- a path that fails any of these is refused, never removed.
  */
-function removeRoomFolder(dir, room) {
+export function removeRoomFolder(dir, room) {
   const abs = path.resolve(dir)
   const home = path.resolve(hiveHome()) + path.sep
   let ours = false
@@ -364,6 +412,15 @@ function removeRoomFolder(dir, room) {
   fs.rmSync(abs, { recursive: true, force: true })
 }
 
+const projectRootOrNull = (cwd) => { try { return projectRoot(cwd) } catch { return null } }
+
+// THIS MACHINE'S RECORD OF WHICH REPO HOLDS WHICH ROOM (hive-repos.js), so an agent that joined by
+// link -- not by branch -- can still land from here with hive_pr. Imported late: hive-repos imports
+// this module. Best effort: a registry that cannot be written never fails a bind, and hive_pr then
+// says exactly that the room is not bound on this machine (Q583), with the command that fixes it.
+async function registerLocal(root, branch, link) {
+  try { const R = await import('./hive-repos.js'); return !!R.registerRepo({ root, branch, link }) } catch { return false }
+}
 function youFrom(root, given) {
   const raw = given || git(root, ['config', 'user.name']).out || os.userInfo().username || 'dev'
   return validateMemberName(raw).ok ? raw : suggestMemberName(raw)
@@ -384,14 +441,17 @@ export async function bindBranch({ cwd, branch, from = '', relay = '', you = '',
     const { relay: jr, room } = parseLink(join)
     if (!jr || !room) throw coded('Q567', `"${join}" is not a room link (it looks like wss://relay|room-...).`)
     if (existing && existing.link !== join) throw coded('Q567', `branch "${name}" is already bound to a different room here (${existing.link}). Remove it with: git config --remove-section "hivecode.${name}"`)
-    writeBinding(root, name, { room: join })
-    return { root, branch: name, link: join, you: me, joined: true }
+    const seed = await roomSeed(join, me)
+    writeBinding(root, name, { room: join, base: seed && seed.commit ? seed.commit : '' })
+    await registerLocal(root, name, join)
+    return { root, branch: name, link: join, you: me, joined: true, base: seed && seed.commit ? seed.commit : '' }
   }
 
   if (existing && !reseed) {
     const n = await roomFileCount(existing.link, me)
     // Empty is only news when the seed was not: a branch with nothing a room can carry seeds nothing.
     const lost = n === 0 && Number(existing.files || 1) > 0
+    await registerLocal(root, name, existing.link) // a binding made before the registry existed gets its entry
     return { root, branch: name, link: existing.link, you: me, from: existing.from, existing: true, roomFiles: n, lost }
   }
 
@@ -440,155 +500,27 @@ export async function bindBranch({ cwd, branch, from = '', relay = '', you = '',
     throw e
   }
   writeBinding(root, name, { room: link, from: fromName, base: tip, seed: seeded.dir, files: String(seeded.count) })
+  await registerLocal(root, name, link)
   return { root, branch: name, link, you: me, from: fromName, commit: tip, created, reseeded: reseed, files: seeded.count, total: seeded.total, seedDir: seeded.dir }
 }
 
 // ---- landing: the room's work becomes commits on the branch ---------------------------------
 
-const HIVE_PR = path.join(path.dirname(fileURLToPath(import.meta.url)), 'hive-pr.js')
-const reEsc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-
 /**
- * THE ROOM'S DELETIONS, which hive-pr does not land: it copies the files a room holds, so a file an
- * agent deleted would simply stay on the branch, in a PR that looks complete. A room bound to a
- * branch starts as the whole branch, so "on the branch but no longer in the room" is a deletion --
- * but only when the room provably held THAT version of the file. For each such path:
- *   - last changed on the branch by a landing from this room (its commit says "Room: <id>") -> delete
- *   - unchanged since the seed commit                                                  -> delete
- *   - in the seed, but changed on the branch since by someone else                     -> REFUSE (Q572):
- *     deleting it would erase a change the room never saw
- *   - not in the seed and not landed from this room: added to the branch outside the room -> keep
- */
-async function roomDeletions({ root, link, base, tip }) {
-  if (!base) return []
-  const paths = await roomPaths(link, 'hive-land')
-  if (!paths) throw coded('Q565', `could not reach the relay to read the room's file list, so its deletions cannot be accounted for. Nothing was changed.`)
-  const room = parseLink(link).room
-  const atTip = treeFiles(root, tip)
-  const carries = roomCarries(atTip)
-  const baseSha = new Map(treeFiles(root, base).map((f) => [f.rel, f.sha]))
-  const gone = [], diverged = []
-  for (const f of atTip) {
-    if (!carries(f) || paths.has(f.rel)) continue
-    const last = git(root, ['log', '-1', '--format=%B', tip, '--', f.rel]).out
-    if (new RegExp(`^Room: ${reEsc(room)}$`, 'm').test(last)) gone.push(f.rel)
-    else if (baseSha.get(f.rel) === f.sha) gone.push(f.rel)
-    else if (baseSha.has(f.rel)) diverged.push(f.rel)
-  }
-  if (diverged.length) {
-    const who = (rel) => git(root, ['log', '-1', '--format=%h %an %ad %s', '--date=short', tip, '--', rel]).out
-    throw coded('Q572', `the room deleted ${diverged.length} file(s) that were changed on the branch since it was seeded, by a change the room never saw:\n${diverged.map((r) => `  ${r}   last changed by: ${who(r)}`).join('\n')}\nDeleting them would erase that change. Nothing was changed. Restore the file in the room (or delete it on the branch yourself), then run pr again.`)
-  }
-  return gone
-}
-
-function worktreesOn(root, branch) {
-  const r = git(root, ['worktree', 'list', '--porcelain'])
-  const out = []
-  let cur = null
-  for (const line of r.out.split('\n')) {
-    if (line.startsWith('worktree ')) cur = line.slice(9)
-    else if (line === `branch refs/heads/${branch}` && cur) out.push(path.resolve(cur))
-  }
-  return out
-}
-
-/**
- * `pr <name>`: land the room's work on the bound branch as one commit per agent.
+ * `pr <name>` used to land here. Landing now has ONE path, hive-land.js landAndOpen, shared by the
+ * `pr` command, the hive_pr tool and the GitHub watcher: every check (claims, an empty room, workflow
+ * files, keys, tests, origin ahead, the lock) protects all three. Two copies of the landing had
+ * already drifted once (the deletion accounting lived only here).
  *
- * hive-pr writes the commits (attribution and the staleness check are all its own), but it runs in
- * a TEMPORARY WORKTREE detached at the branch tip, because hive-pr switches the checkout it is given
- * and the developer's must never be switched. The branch then moves by compare-and-swap from the tip
- * the worktree was cut from, so a commit that reached the branch meanwhile is refused, never lost.
+ * landBranch keeps its old contract for the watcher, which still runs its own workflow, key and test
+ * checks after landing, and whose agent has exited by the time it lands (so its claims are moot):
+ * { ok:true, landed, tip, deletions } | { ok:false, code } with the reason on logErr.
  */
 export async function landBranch({ cwd, branch, dry = false, push = false, pr = false, base = '', force = '', only = '', title = '', log = console.log, logErr = console.error }) {
-  const root = projectRoot(cwd)
-  const name = validBranch(root, branch)
-  const b = readBinding(root, name)
-  if (!b) throw coded('Q562', `branch "${name}" has no Hivecode room here. Create one with: npx -y hivecode-mcp@latest branch ${name}`)
-  const tip = revParse(root, `refs/heads/${name}`)
-  if (!tip) throw coded('Q563', `branch "${name}" does not exist in ${root}. Fetch it first: git fetch origin ${name}:${name}`)
-
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'hive-land-'))
-  const temp = `hivecode-land/${safeSegment(name)}-${process.pid}-${Date.now()}`
-  const cleanup = () => {
-    git(root, ['worktree', 'remove', '--force', tmp])
-    try { fs.rmSync(tmp, { recursive: true, force: true }) } catch { }
-    git(root, ['worktree', 'prune'])
-    if (revParse(root, `refs/heads/${temp}`)) git(root, ['branch', '-D', temp])
-  }
-  const wt = git(root, ['worktree', 'add', '--detach', tmp, tip])
-  if (wt.code !== 0) { cleanup(); throw coded('Q563', `could not make a temporary worktree: ${wt.err}`) }
-
-  try {
-    // Accounted for BEFORE anything is written, so a refusal (Q572) leaves the branch as it was.
-    const deletions = await roomDeletions({ root, link: b.link, base: b.base, tip })
-
-    const args = [HIVE_PR, b.link, 'hive-pr', '--repo', tmp, '--branch', temp, '--base', 'HEAD']
-    if (dry) args.push('--dry-run')
-    if (force) args.push('--force', force)
-    if (only) args.push('--only', only)
-    const r = spawnSync(process.execPath, args, { cwd: tmp, encoding: 'utf8', env: { ...process.env, HIVE_PROVENANCE: 'on' }, maxBuffer: 64 * 1024 * 1024, windowsHide: true })
-    if (r.stdout) log(r.stdout.replace(/\s+$/, ''))
-    // Q501 is hive-pr saying no file in the room carries an agent's receipt: nothing was changed or
-    // added. For a branch room that is an answer, not a failure -- and deletions may still land.
-    const nothingChanged = r.status !== 0 && /^Q501 /m.test(r.stderr || '')
-    if (r.stderr && !nothingChanged) logErr(r.stderr.replace(/\s+$/, ''))
-    if (r.status !== 0 && !nothingChanged) return { ok: false, code: r.status || 1 }
-    if (dry) {
-      if (deletions.length) log(`would delete ${deletions.length} file(s) the room deleted: ${deletions.join(', ')}`)
-      return { ok: true, dry: true, deletions }
-    }
-
-    if (deletions.length) {
-      // hive-pr left the temporary worktree on its branch when it committed; when it had nothing to
-      // commit it never made one, so make it here, at the same tip.
-      if (!revParse(root, `refs/heads/${temp}`)) git(tmp, ['checkout', '-q', '-b', temp])
-      const rm = git(tmp, ['rm', '-q', '--', ...deletions])
-      if (rm.code !== 0) throw coded('Q563', `could not stage the room's deletions: ${rm.err}`)
-      const msg = [`Room: delete ${deletions.length === 1 ? deletions[0] : `${deletions.length} files`}`, '', ...deletions.map((d) => `  - ${d}`), '', `Room: ${parseLink(b.link).room}`].join('\n')
-      const c = git(tmp, ['commit', '-q', '-m', msg, '--author', 'hivecode-room <room@agents.hivecode.local>'])
-      if (c.code !== 0) throw coded('Q563', `could not commit the room's deletions: ${c.err || c.out}`)
-    }
-    if (nothingChanged && !deletions.length) { log(`nothing to land yet: no agent has changed a file in the room for ${name}.`); return { ok: true, landed: 0 } }
-
-    const newTip = revParse(root, `refs/heads/${temp}`)
-    if (!newTip || newTip === tip) { log(`nothing to land: ${name} already has everything the room holds.`); return { ok: true, landed: 0 } }
-
-    // Move the branch. Checked out somewhere: only a clean fast-forward of that checkout, which is
-    // what `git pull` would do; with local changes it is refused, because moving the branch under a
-    // dirty checkout makes its edits look like reversals of the landed work.
-    const on = worktreesOn(root, name).filter((p) => p !== path.resolve(tmp))
-    if (on.length) {
-      const where = on[0]
-      const dirty = git(where, ['status', '--porcelain', '--untracked-files=no'])
-      if (dirty.out) throw coded('Q571', `${name} is checked out in ${where} with uncommitted changes. Commit or stash them there (or switch that checkout to another branch), then run pr again. Nothing was changed.`)
-      const ff = git(where, ['merge', '--ff-only', '--quiet', newTip])
-      if (ff.code !== 0) throw coded('Q570', `could not fast-forward ${name} in ${where}: ${ff.err || 'git refused'}. Nothing was changed; if the branch moved there, run pr again.`)
-    } else {
-      const cas = git(root, ['update-ref', '-m', 'hivecode: land room work', `refs/heads/${name}`, newTip, tip])
-      if (cas.code !== 0) throw coded('Q570', `${name} moved while this was landing (it is no longer ${tip.slice(0, 7)}). Nothing was changed; run pr again so the new commits are accounted for.`)
-    }
-    const made = git(root, ['log', '--format=  %h  %an  %s', `${tip}..${newTip}`]).out
-    log(`\nlanded on ${name}:\n${made}`)
-
-    if (push) {
-      const p = git(root, ['push', '-u', 'origin', name])
-      if (p.code !== 0) throw coded('Q573', `the work landed on ${name} locally, but the push failed: ${p.err}`)
-      log(`pushed ${name}`)
-    }
-    if (pr) {
-      const into = base || b.from
-      if (!into) throw coded('Q574', `the work landed on ${name}, but there is no branch to open the PR into; pass --base <branch>.`)
-      const body = [`Opened by Hivecode from the room bound to \`${name}\`.`, '', 'Each commit carries its agent as the git author and the signed author id as a `Hivecode-Author` trailer.', '', '```', made, '```'].join('\n')
-      const g = spawnSync('gh', ['pr', 'create', '--base', into, '--head', name, '--title', title || `Hivecode: ${name}`, '--body', body], { cwd: root, encoding: 'utf8', windowsHide: true })
-      if (g.status !== 0) throw coded('Q574', `the work landed on ${name}, but gh pr create failed: ${(g.stderr || (g.error && g.error.message) || '').toString().trim()}`)
-      log((g.stdout || '').trim())
-    }
-    return { ok: true, landed: made.split('\n').filter(Boolean).length, tip: newTip, deletions }
-  } finally {
-    cleanup()
-  }
+  const { landAndOpen } = await import('./hive-land.js')
+  const r = await landAndOpen({ cwd, branch, dry: !!dry, push, pr, base, force, only, title, log, logErr, claims: false, checks: false, by: 'the Hivecode GitHub watcher' })
+  if (!r.ok) { logErr(r.why); return { ok: false, code: 1, refused: r.code } }
+  return r.dry ? { ok: true, dry: true, deletions: r.deletions } : { ok: true, landed: r.landed, tip: r.tip, deletions: r.deletions }
 }
 
 // ---- CLI ----------------------------------------------------------------------------------
@@ -600,7 +532,7 @@ function flags(argv) {
     const a = argv[i]
     if (!a.startsWith('--')) { pos.push(a); continue }
     const k = a.slice(2)
-    if (['dry-run', 'push', 'pr', 'reseed'].includes(k)) f[k] = true
+    if (['dry-run', 'push', 'pr', 'reseed', 'allow-workflow-changes', 'allow-mass-delete', 'save'].includes(k)) f[k] = true
     else f[k] = argv[++i] || ''
   }
   return { pos, f }
@@ -610,7 +542,8 @@ const USAGE = `usage:
   npx -y hivecode-mcp@latest branch <name> [--from <ref>] [--name <you>] [--relay <url>]
   npx -y hivecode-mcp@latest branch <name> --join "<link>"
   npx -y hivecode-mcp@latest branch <name> --reseed
-  npx -y hivecode-mcp@latest pr <name> [--dry-run] [--push] [--pr] [--base <branch>] [--force "<reason>"]`
+  npx -y hivecode-mcp@latest pr <name> [--dry-run] [--push] [--pr] [--base <branch>] [--test "<command>" [--test-copy <file,...>] [--test-setup "<cmd>"] [--save]] [--test-minutes <n>]
+                                       [--allow-workflow-changes] [--allow-mass-delete] [--title "<t>"] [--force "<reason>"]`
 
 /** `argv` starts at the subcommand: ['branch', 'fix-x', ...] or ['pr', 'fix-x', ...]. Returns an exit code. */
 export async function main(argv, { cwd = process.cwd(), log = console.log, logErr = console.error } = {}) {
@@ -620,8 +553,26 @@ export async function main(argv, { cwd = process.cwd(), log = console.log, logEr
   if (!name || (cmd !== 'branch' && cmd !== 'pr')) { logErr(USAGE); return 2 }
   try {
     if (cmd === 'pr') {
-      const r = await landBranch({ cwd, branch: name, dry: !!f['dry-run'], push: !!(f.push || f.pr), pr: !!f.pr, base: f.base || '', force: f.force || '', only: f.only || '', title: f.title || '', log, logErr })
-      return r.ok ? 0 : r.code || 1
+      const { landAndOpen, testCommandFor, saveTestCommand } = await import('./hive-land.js')
+      let test = f.test || ''
+      // --test-copy a,b  and  --test-setup "<cmd>": what the tests need beyond git (see hive-land.js).
+      const testCopy = 'test-copy' in f ? String(f['test-copy'] || '').split(',').map((s) => s.trim()).filter(Boolean) : undefined
+      const testSetup = 'test-setup' in f ? String(f['test-setup'] || '') : undefined
+      if (f.save) {
+        if (!test) { logErr(`--save keeps a test command: pass it with --test "<command>"`); return 2 }
+        saveTestCommand(cwd, name, test, { copy: testCopy ?? null, setup: testSetup ?? null })
+        log(`saved: landing ${name} now runs ${testSetup ? `\`${testSetup}\`, then ` : ''}\`${test}\` first${testCopy && testCopy.length ? `, with ${testCopy.join(', ')} copied in` : ''}, from any caller (pr, hive_pr, room mode). Change it the same way.`)
+      }
+      // No --test: the command saved for this branch, if any. (The project's own `npm test` is the
+      // hive_pr tool's fallback; here the developer is present, so nothing runs they did not choose.)
+      if (!test) { const t = testCommandFor(cwd, name); if (t.from === 'saved') { test = t.command; log(`tests: \`${test}\` (saved for ${name})`) } }
+      const r = await landAndOpen({
+        cwd, branch: name, dry: !!f['dry-run'], push: !!(f.push || f.pr), pr: !!f.pr, base: f.base || '', force: f.force || '', only: f.only || '', title: f.title || '',
+        test, testMinutes: Number(f['test-minutes']) || 0, testCopy, testSetup, allowWorkflowChanges: !!f['allow-workflow-changes'], allowMassDelete: !!f['allow-mass-delete'],
+        by: youFrom(projectRootOrNull(cwd) || cwd, ''), log, logErr,
+      })
+      if (!r.ok) { logErr(r.why); return 1 }
+      return 0
     }
     const r = await bindBranch({ cwd, branch: name, from: f.from || '', relay: f.relay || '', you: f.name || '', join: f.join || '', reseed: !!f.reseed })
     const agentLine = `Use hive_join with branch "${r.branch}", repo "${r.root.replace(/\\/g, '/')}", as a name of your own (each agent picks a different one)`