hivecode-mcp 0.14.1 → 0.14.3

package/hive-mcp.js

@@ -609,9 +609,10 @@ const connectionOf = (hive) => (typeof hive.connection === 'function' ? hive.con
 // copy changed and whether this folder's copy arrived. Said, not refused: claiming and then deciding
 // not to edit is legitimate.
 const claimSnaps = new Map() // `${room}|${region}` -> sha256 of the room's text at claim time
+const toLF = (s) => (typeof s === 'string' && s.indexOf('\r\n') !== -1 ? s.replace(/\r\n/g, '\n') : s)
 const textHash = (s) => crypto.createHash('sha256').update(String(s)).digest('hex')
 const roomTextOf = (s, region) => { try { const t = s.hive._fileText(region); return typeof t === 'string' ? t : null } catch { return null } }
-const diskTextOf = (s, region) => { try { return fs.readFileSync(path.join(s.dir, ...region.split('/')), 'utf8') } catch { return null } }
+const diskTextOf = (s, region) => { try { return toLF(fs.readFileSync(path.join(s.dir, ...region.split('/')), 'utf8')) } catch { return null } }
 function noteClaim(s, region) {
   const t = roomTextOf(s, region)
   claimSnaps.set(`${s.room}|${region}`, t == null ? null : textHash(t))
@@ -880,8 +881,8 @@ const TOOLS = [
     inputSchema: { type: 'object', properties: { region: { type: 'string', description: 'file path or region id' }, force: { type: 'boolean', description: 'release despite a failing gate; recorded against you and announced; for abandoned work only' }, why: { type: 'string', description: 'why the work is abandoned (give it whenever force is true)' } }, required: ['region'] } },
   { name: 'hive_claims', description: 'The live claim board: who holds which file. Authoritative; read it instead of asking the room.',
     inputSchema: { type: 'object', properties: {} } },
-  { name: 'hive_edit', description: 'Write a file through the medium (preferred over editing on disk): your intent and the exact change are signed into the provenance ledger as it lands. Claim the file first.',
-    inputSchema: { type: 'object', properties: { file: { type: 'string', description: 'relative path in the room' }, content: { type: 'string', description: 'the complete new file content' }, intent: { type: 'string', description: 'why you are making the change (signed into provenance)' } }, required: ['file', 'content'] } },
+  { name: 'hive_edit', description: 'Write a file through the medium (preferred over editing on disk): your intent and the exact change are signed into the provenance ledger as it lands. Claim the file first. Changing existing lines: pass old (whole lines, exactly as you read them) and new; if those lines changed since you read them it is refused and nothing is written. A whole new file: pass content.',
+    inputSchema: { type: 'object', properties: { file: { type: 'string', description: 'relative path in the room' }, old: { type: 'string', description: 'whole lines you are replacing, exactly as you read them; must appear once' }, new: { type: 'string', description: 'what replaces old' }, content: { type: 'string', description: 'the complete new file content (instead of old/new)' }, intent: { type: 'string', description: 'why you are making the change (signed into provenance)' } }, required: ['file'] } },
   { name: 'hive_fork', description: 'Read a silent fork on a file: the common base plus every divergent version with its author and signed intent. Reconcile them, then submit with hive_resolve.',
     inputSchema: { type: 'object', properties: { file: { type: 'string', description: 'the forked file path, as announced in chat' } }, required: ['file'] } },
   { name: 'hive_resolve', description: 'Resolve a fork with the full reconciled file, serving every side\'s intent. It must parse with no dangling references, or it is refused and nothing changes.',
@@ -976,11 +977,14 @@ function enforceDcoLock(opts = {}) {
   // violated within the hour by everyone including its author. A COUNTED lease makes the second
   // write impossible rather than discouraged: the server spends it, and the window shuts itself.
   const lease = /^PUBLISH(?::(\d+))?$/.exec(String(status || ''))
-  if (lease && opts.consumes) {
+  // `peek` checks the lease without spending it: hive_edit old/new peeks, writes, and spends only when
+  // something landed, so a refused or no-op edit keeps the window (antigravity-3, 1 Nov).
+  if (lease && (opts.consumes || opts.peek)) {
     const left = lease[1] === undefined ? 1 : Number(lease[1])
     if (left <= 0) {
       throw new Error(`[Lease Spent] Your PUBLISH window is used up. Ask for a new one — and if this is a revision of what you just wrote, publish to a NEW path rather than rewriting it.`)
     }
+    if (!opts.consumes) return
     const next = left - 1
     try {
       s.hive.setState(`${name}_status`, next > 0 ? `PUBLISH:${next}` : 'LOCKED')
@@ -1739,9 +1743,15 @@ Then call hive_release.`)
       case 'hive_claims': { const b = requireSession().hive.claimsBoard(); return text(b.length ? b.map((c) => `${c.region} — ${c.by}${c.intent ? ` (${c.intent})` : ''}`).join('\n') : '(nothing claimed right now — all open)') }
       case 'hive_edit': {
         const editPath = String(args.file || '')
+        // Two modes, never mixed: content is the whole file, old/new is the lines the agent edited.
+        // Only `file` is required by the schema now, so these checks are what refuse a call missing both.
+        const byLines = args.old !== undefined || args.new !== undefined
+        if (byLines && args.content !== undefined) return err('pass either content (the whole file) or old and new (the lines you changed), not both. Nothing was written.')
+        if (byLines && (typeof args.old !== 'string' || typeof args.new !== 'string')) return err('old/new needs both old and new. Nothing was written.')
+        if (!byLines && typeof args.content !== 'string') return err('pass content (the whole file), or old and new (the lines you changed). Nothing was written.')
         // Path gate + lease consumed BEFORE the write, not after: a spent lease that still wrote is
         // indistinguishable from no lease at all.
-        enforceDcoLock({ consumes: true, path: editPath })
+        enforceDcoLock(byLines ? { peek: true, path: editPath } : { consumes: true, path: editPath })
         // HIV-27, same reasoning: this tool's entire promise is that the change reaches every
         // peer. On a path this client never opens a connection for, it would not -- and it
         // would still report success.
@@ -1751,15 +1761,32 @@ Then call hive_release.`)
 
 Nothing was written. This tool exists to guarantee the change syncs to every peer; on this path it cannot.`)
         }
-        const r = requireSession().hive.edit(editPath, String(args.content ?? ''), String(args.intent || ''))
+        let r
+        if (byLines) {
+          // A file the room has but this folder has not loaded yet comes back as `loading`: wait for it
+          // (up to 8 s) rather than hand the agent a retry it may answer with a blind content write.
+          for (let t = 0; ; t++) {
+            if (t) enforceDcoLock({ peek: true, path: editPath })
+            r = requireSession().hive.editLines(editPath, args.old, args.new, String(args.intent || ''))
+            if (!r.loading || t >= 32) break
+            await new Promise((res) => setTimeout(res, 250))
+          }
+          if (r.ok && !r.noop) enforceDcoLock({ consumes: true, path: editPath }) // peeked just above, nothing awaited since
+        } else r = requireSession().hive.edit(editPath, args.content, String(args.intent || ''))
         if (r.error) return err(r.error)
+        if (r.noop) return text(`nothing to change: old and new are the same in ${r.file}. Nothing was written.`)
         if (r.withheld) {
           firstTime('withheld:' + r.file) // said here, so the next hive_wait does not say it again
           return text(`⛔ wrote ${r.file} in YOUR folder only. It was NOT shared, because it contains ${r.withheld}, and Hivecode does not send keys to the room or the relay. Nobody else has this change. Read the key from the environment instead (put it in .env, which is never shared); the file is shared on its next save without the key.`)
         }
-        return text(r.conflicted
-          ? `wrote ${r.file}, but it now carries <<<<<<< conflict markers (a concurrent edit collided). Read the file and resolve before continuing.`
-          : `✓ wrote ${r.file} through the medium — your intent is signed into its provenance ledger and the change is syncing to every peer.`)
+        if (r.conflicted) return text(`wrote ${r.file}, but it now carries <<<<<<< conflict markers (a concurrent edit collided). Read the file and resolve before continuing.`)
+        // SAY WHETHER IT REACHED THE RELAY, never just "syncing" (0.14.3 P0-1). Over HTTPS long-poll an
+        // edit waits in this process until the relay accepts it; an agent that left on "syncing" lost it.
+        const hiveS = requireSession().hive
+        const sent = typeof hiveS.whenSent === 'function' ? await hiveS.whenSent(r.file, 3000) : true
+        return text(sent
+          ? `✓ wrote ${r.file} through the medium — your intent is signed into its provenance ledger and the relay has the change; every peer gets it from there.`
+          : `⏳ wrote ${r.file} in your folder, but the relay has NOT accepted the change yet (slow or reconnecting link). It is still being sent: stay in the room (do not exit or leave) and check hive_status before you report it done.`)
       }
       case 'hive_fork': {
         const file = String(args.file || ''); if (!file) return err('need a file path')
@@ -1836,6 +1863,11 @@ Nothing was written. This tool exists to guarantee the change syncs to every pee
           unread: mailbox().peek(chatArray()).unreadCount,
           connected: conn ? conn.connected : null,
           filesSynced: conn ? `${conn.filesSynced}/${conn.files}` : null,
+          // How full this client's bounded working set is: files open / the bound (HIVE_MAX_OPEN_FILES, or
+          // 4096 on one socket, 128 with a socket per file). At the bound, files that were in the room
+          // at join arrive when touched; new ones still open (sync.js newRemote), and `waiting` counts
+          // the new ones queued for room.
+          ...(conn && conn.openCap ? { workingSet: `${conn.files}/${conn.openCap} open (${conn.transport === 'mux' ? 'one socket' : conn.transport === 'socket' ? 'a socket per file' : conn.transport})${conn.newWaiting ? `, ${conn.newWaiting} new waiting` : ''}` } : {}),
           // 'ws', or 'poll' where this network refuses WebSockets (HTTPS long-poll: same rooms, same rules).
           transport: conn ? transportFor(s.relay) : null,
           ...(conn && conn.folderLost ? { folderLost: conn.folderLost } : {}),
@@ -1849,7 +1881,17 @@ Nothing was written. This tool exists to guarantee the change syncs to every pee
       // row is dropped rather than left to read as GONE. GONE means "stopped without saying so",
       // and diluting it with agents that signed off correctly is how a signal stops being read.
       case 'hive_pr': return text(await runHivePr(args))
-      case 'hive_leave': { try { ACT.forget(activityMap(), requireSession().name) } catch { }; requireSession().hive.stop(); session = null; forgetSession(); return text('left the room') }
+      case 'hive_leave': {
+        try { ACT.forget(activityMap(), requireSession().name) } catch { }
+        const h = requireSession().hive
+        // Leave waits until the relay has every edit and message (0.14.3 P0-1), and names what it did not get.
+        const r = typeof h.leave === 'function' ? await h.leave({ timeoutMs: 10000 }) : (h.stop(), null)
+        session = null; forgetSession()
+        const missed = r ? [...r.unsent, ...(r.roomUnsent ? ['your last room messages'] : [])] : []
+        return missed.length
+          ? text(`left the room, but the relay had NOT accepted these when it stopped waiting (10 s): ${missed.join(', ')}. Nobody else has those changes. Rejoin and check them before you report the work done.`)
+          : text('left the room')
+      }
       default: return err(`unknown tool: ${name}`)
     }
   } catch (e) { return err(`error: ${e.message}`) }
@@ -1979,9 +2021,37 @@ function missingRequired(req) {
   return lines.join('\n')
 }
 
+// [!] MEANS "BEFORE YOU CONTINUE", SO IT IS CHECKED BEFORE THE CALL, NOT AFTER IT (P1-8, 9 Nov 2026).
+// Mail reached an agent only as a notice appended to a tool's RESULT, after the tool had run. In the
+// 9 Nov mock run Claude sent "[!] @antigravity-VM Stand down on test.js: ... Don't edit it."; the
+// agent's next call was hive_edit test.js, the file was written, and "[!] URGENT MAIL" came back in
+// the reply to that very write. The room read it as "delivered to one of two agents". So a call that
+// writes, takes work or lands it is refused while urgent mail addressed to this agent is unread, and
+// the refusal shows the message. Reading it (hive_check or hive_wait) is the decision; then retry.
+// Releasing, talking and reading are never held: a stand-down usually asks for exactly those.
+const URGENT_GATED = new Set(['hive_edit', 'hive_claim', 'hive_resolve', 'hive_fork', 'hive_pr', 'hive_set_state'])
+function urgentGate(name) {
+  try {
+    if (!URGENT_GATED.has(name) || !session || !session.mailbox) return ''
+    catchUp(session)
+    const m = session.mailbox.peek(chatArray())
+    const urgent = (m.mentions || []).filter((x) => x && priorityOf(x.text) === 'stop')
+    if (!urgent.length) return ''
+    const shown = urgent.slice(-3).map((x) => `  ${formatMessage(x)}`.slice(0, 600)).join('\n')
+    return [
+      `REFUSED -- ${urgent.length} URGENT message(s) ([!]) addressed to you are unread, and [!] means: handle it before you continue.`,
+      `Nothing was done. This ${name} call did NOT happen.`,
+      shown,
+      `Read it with hive_check (that marks it read), do what it asks, then call ${name} again if it still applies.`,
+    ].join('\n')
+  } catch { return '' }
+}
+
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
   const bad = missingRequired(req)
   if (bad) return { content: [{ type: 'text', text: bad }], isError: true }
+  const held = urgentGate(req.params && req.params.name)
+  if (held) return { content: [{ type: 'text', text: held }], isError: true }
   const res = await dispatch(req)
   // Never let the banner break a tool: append only to a well-formed text result, and skip the two
   // tools that already deliver mail themselves (appending would double-report the same messages).
@@ -2051,8 +2121,18 @@ if (isEntryPoint && process.argv[2] === 'setup') {
   // room and exit. The SDK kept this process alive on its open sockets instead, holding a seat
   // and a presence entry for a member that was gone, until something killed it.
   server.onclose = () => {
-    try { if (session) session.hive.stop() } catch { /* leaving is best-effort; exiting is not */ }
-    setTimeout(() => process.exit(0), 500)
+    // Leave, not stop: the last edits and messages go out before the process does (0.14.3 P0-1). Over
+    // HTTPS long-poll they are still in this process; a 500 ms exit dropped them. Capped, so a dead
+    // link cannot hold a departed agent's seat for long; whatever did not go is named on stderr.
+    const done = () => process.exit(0)
+    setTimeout(done, 12000).unref()
+    const s = session
+    if (!s) return setTimeout(done, 500)
+    Promise.resolve()
+      .then(() => (typeof s.hive.leave === 'function' ? s.hive.leave({ timeoutMs: 10000 }) : (s.hive.stop(), null)))
+      .then((r) => { if (r && (r.unsent.length || r.roomUnsent)) console.error(`[hive-mcp] left before the relay accepted: ${[...r.unsent, ...(r.roomUnsent ? ['(room messages)'] : [])].join(', ')}`) })
+      .catch(() => { /* leaving is best-effort; exiting is not */ })
+      .finally(() => setTimeout(done, 200))
   }
   await server.connect(transport)
   startUpdateCheck() // background, short timeout; hive_join and hive_status show what it finds

package/hive-mux-proto.js

@@ -1,58 +1,58 @@
-// hive-mux-proto.js -- the wire format for ONE socket per participant, shared by relay and client.
-//
-// WHY: Hivecode opened one WebSocket per FILE. A participant held 1 + min(files, 128) sockets,
-// so an agent in a 1000-file repository saw only 128 files on disk, and a relay's connection cap
-// divided by 129 per person. The mux carries every file doc of one room over one socket.
-//
-// The design rule that makes it safe: the relay does not grow a second enforcement path. Each
-// OPEN runs the SAME per-doc admission a per-file upgrade runs (token scope for that path, the
-// per-room ceiling, the committer limit), and the accepted channel is wrapped in a VirtualConn
-// that looks exactly like a ws connection to installUsageLimits, makeReadOnly, installWriteGate
-// and setupWSConnection. The bytes inside a MSG frame are the same y-protocols message a
-// per-file socket would carry.
-//
-// Frames are binary, lib0-encoded:
-//   client -> relay   OPEN     [0, id, docName]       open this file doc as channel `id`
-//                     CLOSE    [1, id]                the client is done with it
-//                     MSG      [2, id, ...payload]    a y-protocols message for that doc
-//   relay -> client   MSG      [2, id, ...payload]
-//                     OPENED   [3, id]                admitted; the relay's sync step 1 follows
-//                     REFUSED  [4, id, code, reason]  not admitted -- the HTTP status a per-file
-//                                                     upgrade would have answered, and why
-//                     CLOSED   [5, id, reason]        the relay closed that channel
-//                     BEAT     [6, 0]                 liveness, so a dead socket is noticed
-// Channel ids are chosen by the client and are only meaningful on the socket that opened them.
-import * as encoding from 'lib0/encoding'
-import * as decoding from 'lib0/decoding'
-
-export const MUX_PREFIX = '_hive_mux/'
-export const MUX_VERSION = 1
-export const F = Object.freeze({ OPEN: 0, CLOSE: 1, MSG: 2, OPENED: 3, REFUSED: 4, CLOSED: 5, BEAT: 6 })
-
-export function encodeFrame(kind, id, a, b) {
-  const e = encoding.createEncoder()
-  encoding.writeVarUint(e, kind)
-  encoding.writeVarUint(e, id >>> 0)
-  if (kind === F.OPEN) encoding.writeVarString(e, String(a))
-  else if (kind === F.MSG) encoding.writeUint8Array(e, a instanceof Uint8Array ? a : new Uint8Array(a))
-  else if (kind === F.REFUSED) { encoding.writeVarUint(e, a >>> 0); encoding.writeVarString(e, String(b || '')) }
-  else if (kind === F.CLOSED) encoding.writeVarString(e, String(a || ''))
-  return encoding.toUint8Array(e)
-}
-
-/** Decode one frame. Throws on garbage, which the caller treats as a protocol violation. */
-export function decodeFrame(buf) {
-  const u8 = buf instanceof Uint8Array ? buf : new Uint8Array(buf)
-  const d = decoding.createDecoder(u8)
-  const kind = decoding.readVarUint(d)
-  const id = decoding.readVarUint(d)
-  if (kind === F.OPEN) return { kind, id, docName: decoding.readVarString(d) }
-  if (kind === F.MSG) return { kind, id, payload: u8.subarray(d.pos) }
-  if (kind === F.REFUSED) return { kind, id, code: decoding.readVarUint(d), reason: decoding.readVarString(d) }
-  if (kind === F.CLOSED) return { kind, id, reason: decoding.readVarString(d) }
-  if (kind === F.CLOSE || kind === F.OPENED || kind === F.BEAT) return { kind, id }
-  throw new Error(`unknown mux frame kind ${kind}`)
-}
-
-/** The mux upgrade path for a base room, as the relay parses it (pathname minus the slash). */
-export function muxPath(room) { return MUX_PREFIX + encodeURIComponent(room) }
+// hive-mux-proto.js -- the wire format for ONE socket per participant, shared by relay and client.
+//
+// WHY: Hivecode opened one WebSocket per FILE. A participant held 1 + min(files, 128) sockets,
+// so an agent in a 1000-file repository saw only 128 files on disk, and a relay's connection cap
+// divided by 129 per person. The mux carries every file doc of one room over one socket.
+//
+// The design rule that makes it safe: the relay does not grow a second enforcement path. Each
+// OPEN runs the SAME per-doc admission a per-file upgrade runs (token scope for that path, the
+// per-room ceiling, the committer limit), and the accepted channel is wrapped in a VirtualConn
+// that looks exactly like a ws connection to installUsageLimits, makeReadOnly, installWriteGate
+// and setupWSConnection. The bytes inside a MSG frame are the same y-protocols message a
+// per-file socket would carry.
+//
+// Frames are binary, lib0-encoded:
+//   client -> relay   OPEN     [0, id, docName]       open this file doc as channel `id`
+//                     CLOSE    [1, id]                the client is done with it
+//                     MSG      [2, id, ...payload]    a y-protocols message for that doc
+//   relay -> client   MSG      [2, id, ...payload]
+//                     OPENED   [3, id]                admitted; the relay's sync step 1 follows
+//                     REFUSED  [4, id, code, reason]  not admitted -- the HTTP status a per-file
+//                                                     upgrade would have answered, and why
+//                     CLOSED   [5, id, reason]        the relay closed that channel
+//                     BEAT     [6, 0]                 liveness, so a dead socket is noticed
+// Channel ids are chosen by the client and are only meaningful on the socket that opened them.
+import * as encoding from 'lib0/encoding'
+import * as decoding from 'lib0/decoding'
+
+export const MUX_PREFIX = '_hive_mux/'
+export const MUX_VERSION = 1
+export const F = Object.freeze({ OPEN: 0, CLOSE: 1, MSG: 2, OPENED: 3, REFUSED: 4, CLOSED: 5, BEAT: 6 })
+
+export function encodeFrame(kind, id, a, b) {
+  const e = encoding.createEncoder()
+  encoding.writeVarUint(e, kind)
+  encoding.writeVarUint(e, id >>> 0)
+  if (kind === F.OPEN) encoding.writeVarString(e, String(a))
+  else if (kind === F.MSG) encoding.writeUint8Array(e, a instanceof Uint8Array ? a : new Uint8Array(a))
+  else if (kind === F.REFUSED) { encoding.writeVarUint(e, a >>> 0); encoding.writeVarString(e, String(b || '')) }
+  else if (kind === F.CLOSED) encoding.writeVarString(e, String(a || ''))
+  return encoding.toUint8Array(e)
+}
+
+/** Decode one frame. Throws on garbage, which the caller treats as a protocol violation. */
+export function decodeFrame(buf) {
+  const u8 = buf instanceof Uint8Array ? buf : new Uint8Array(buf)
+  const d = decoding.createDecoder(u8)
+  const kind = decoding.readVarUint(d)
+  const id = decoding.readVarUint(d)
+  if (kind === F.OPEN) return { kind, id, docName: decoding.readVarString(d) }
+  if (kind === F.MSG) return { kind, id, payload: u8.subarray(d.pos) }
+  if (kind === F.REFUSED) return { kind, id, code: decoding.readVarUint(d), reason: decoding.readVarString(d) }
+  if (kind === F.CLOSED) return { kind, id, reason: decoding.readVarString(d) }
+  if (kind === F.CLOSE || kind === F.OPENED || kind === F.BEAT) return { kind, id }
+  throw new Error(`unknown mux frame kind ${kind}`)
+}
+
+/** The mux upgrade path for a base room, as the relay parses it (pathname minus the slash). */
+export function muxPath(room) { return MUX_PREFIX + encodeURIComponent(room) }