hivecode-mcp 0.14.1 → 0.14.3

package/hive-update.js

@@ -1,58 +1,58 @@
-// hive-update.js -- tells an agent, and through it its human, that a newer hivecode is out.
-//
-// WHY THIS EXISTS. `npx -y hivecode-mcp@latest setup` points agent apps at a runtime COPY
-// (~/.hivecode/runtime/<version>), which is what made starting fast, offline and free of npx.
-// It also means nothing updates any more: every start used to fetch @latest, and now an agent
-// stays on the version it was set up with until someone runs setup again. A room with mixed
-// builds is the one condition hive_join itself warns can lose data, so the gap must be visible.
-//
-// IT NEVER GETS IN THE WAY. The check starts with the server, carries a short timeout, and
-// hive_join and hive_status use whatever answer has arrived by then. A failed check says
-// nothing -- no network is not news. HIVE_PRIVATE=1 and HIVE_NO_UPDATE_CHECK=1 both switch it
-// off: a user who asked for privacy did not ask for a request to npm on every start.
-import { VERSION } from './hive-version.js'
-
-const REGISTRY_LATEST = 'https://registry.npmjs.org/hivecode-mcp/latest'
-
-/** True when version `a` is newer than `b` (x.y.z; anything unparseable is never "newer"). */
-export function newer(a, b) {
-  const parse = (v) => String(v).split('-')[0].split('.').map((n) => Number(n))
-  const pa = parse(a)
-  const pb = parse(b)
-  for (let i = 0; i < 3; i++) {
-    const x = pa[i] ?? 0
-    const y = pb[i] ?? 0
-    if (!Number.isFinite(x) || !Number.isFinite(y)) return false
-    if (x !== y) return x > y
-  }
-  return false
-}
-
-let latest = null
-let started = false
-
-export function startUpdateCheck({ fetchImpl = globalThis.fetch, timeoutMs = 4000, env = process.env } = {}) {
-  if (started) return
-  started = true
-  if (env.HIVE_NO_UPDATE_CHECK === '1' || env.HIVE_PRIVATE === '1' || typeof fetchImpl !== 'function') return
-  Promise.resolve()
-    // HIVE_UPDATE_URL exists for tests/update-notice-test.mjs, which serves a fake registry so the
-    // wiring is proven end to end through a real server process.
-    .then(() => fetchImpl(env.HIVE_UPDATE_URL || REGISTRY_LATEST, { signal: AbortSignal.timeout(timeoutMs), headers: { accept: 'application/json' } }))
-    .then((r) => (r && r.ok ? r.json() : null))
-    .then((j) => { if (j && typeof j.version === 'string') latest = j.version })
-    .catch(() => { /* offline, blocked, or slow: say nothing */ })
-}
-
-/** The line to show, or '' when this agent is current (or nobody knows yet). */
-export function updateNotice(current = VERSION, known = latest) {
-  if (!known || !newer(known, current)) return ''
-  return `UPDATE AVAILABLE: hivecode ${known} is out; this agent runs ${current}. Tell your human to run ` +
-    '`npx -y hivecode-mcp@latest setup` and reload this agent. Mixed versions in one room can lose data.'
-}
-
-export const _test = {
-  reset() { latest = null; started = false },
-  setLatest(v) { latest = v; started = true },
-  latest: () => latest,
-}
+// hive-update.js -- tells an agent, and through it its human, that a newer hivecode is out.
+//
+// WHY THIS EXISTS. `npx -y hivecode-mcp@latest setup` points agent apps at a runtime COPY
+// (~/.hivecode/runtime/<version>), which is what made starting fast, offline and free of npx.
+// It also means nothing updates any more: every start used to fetch @latest, and now an agent
+// stays on the version it was set up with until someone runs setup again. A room with mixed
+// builds is the one condition hive_join itself warns can lose data, so the gap must be visible.
+//
+// IT NEVER GETS IN THE WAY. The check starts with the server, carries a short timeout, and
+// hive_join and hive_status use whatever answer has arrived by then. A failed check says
+// nothing -- no network is not news. HIVE_PRIVATE=1 and HIVE_NO_UPDATE_CHECK=1 both switch it
+// off: a user who asked for privacy did not ask for a request to npm on every start.
+import { VERSION } from './hive-version.js'
+
+const REGISTRY_LATEST = 'https://registry.npmjs.org/hivecode-mcp/latest'
+
+/** True when version `a` is newer than `b` (x.y.z; anything unparseable is never "newer"). */
+export function newer(a, b) {
+  const parse = (v) => String(v).split('-')[0].split('.').map((n) => Number(n))
+  const pa = parse(a)
+  const pb = parse(b)
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0
+    const y = pb[i] ?? 0
+    if (!Number.isFinite(x) || !Number.isFinite(y)) return false
+    if (x !== y) return x > y
+  }
+  return false
+}
+
+let latest = null
+let started = false
+
+export function startUpdateCheck({ fetchImpl = globalThis.fetch, timeoutMs = 4000, env = process.env } = {}) {
+  if (started) return
+  started = true
+  if (env.HIVE_NO_UPDATE_CHECK === '1' || env.HIVE_PRIVATE === '1' || typeof fetchImpl !== 'function') return
+  Promise.resolve()
+    // HIVE_UPDATE_URL exists for tests/update-notice-test.mjs, which serves a fake registry so the
+    // wiring is proven end to end through a real server process.
+    .then(() => fetchImpl(env.HIVE_UPDATE_URL || REGISTRY_LATEST, { signal: AbortSignal.timeout(timeoutMs), headers: { accept: 'application/json' } }))
+    .then((r) => (r && r.ok ? r.json() : null))
+    .then((j) => { if (j && typeof j.version === 'string') latest = j.version })
+    .catch(() => { /* offline, blocked, or slow: say nothing */ })
+}
+
+/** The line to show, or '' when this agent is current (or nobody knows yet). */
+export function updateNotice(current = VERSION, known = latest) {
+  if (!known || !newer(known, current)) return ''
+  return `UPDATE AVAILABLE: hivecode ${known} is out; this agent runs ${current}. Tell your human to run ` +
+    '`npx -y hivecode-mcp@latest setup` and reload this agent. Mixed versions in one room can lose data.'
+}
+
+export const _test = {
+  reset() { latest = null; started = false },
+  setLatest(v) { latest = v; started = true },
+  latest: () => latest,
+}

package/hive-version.js

@@ -1,110 +1,110 @@
-// hive-version.js — one place that knows what build this is.
-//
-// WHY THIS FILE EXISTS, and it is not tidiness.
-//
-// VERSION is load-bearing, not cosmetic. hive_join instructs every arriving agent to announce its
-// version in chat, because two clients running different builds in one room corrupt each other's
-// files with no error on either side — both writes succeed, both are green, and the disagreement
-// surfaces only as lost bytes. That announcement is the ONLY channel that makes a mixed build
-// visible from inside the room. So a version string is not a label; it is the input to the one
-// detector we have.
-//
-// On 20 Sep 2026 three entry points were found reporting a version package.json does not contain:
-// remote-mcp.js said '0.11.5' while live on the hosted relay, hive-mcp-http.js and hive-linear.js
-// both said '1.0.0'. hive-mcp.js had already been fixed months earlier, with a comment explaining
-// exactly why hardcoding it is dangerous — and that fix was never carried to the other three.
-// A detector that lies is strictly worse than no detector, because it is trusted.
-//
-// HIV-P7 closed that by giving each of the four files its own runtime read. Which produced the
-// next defect, and it was measured rather than predicted: with the reader duplicated four times,
-// corrupting ONE copy's fallback string to '9.9.9-DRIFTED' left tests/version-truth-test.mjs at
-// 16 passed, 0 failed. The property guards the version that gets REPORTED and says nothing about
-// the mechanism that produces it, so three of four copies could rot in silence.
-//
-// This codebase has watched that happen before. The extension's reconcile() and the engine's were
-// the same function once; they now share 34 lines and behave differently. Eight lines is not too
-// small to drift — it is exactly small enough that nobody feels the need to check.
-//
-// So the fix is DELETION, not another assertion. One definition, imported by all four. The
-// property becomes true by construction instead of by policing, and a fifth entry point written
-// next year gets it right by importing rather than by remembering.
-//
-// TWO DECISIONS WORTH KEEPING:
-//
-// It READS package.json rather than being told. package.json always ships beside these files —
-// in the repo and in the published tarball — so `new URL('./package.json', import.meta.url)`
-// resolves in both. Anything else (a constant, a build step, a generated file) can disagree with
-// the package the moment `npm version` runs, which is precisely the failure being fixed.
-//
-// IT NEVER THROWS. A version read is not worth a server that will not boot, and a server that
-// refuses to start is a worse outcome than one that says it does not know which build it is. So
-// an unreadable or malformed package.json yields '0.0.0-unknown' — a value that is obviously
-// wrong to a human, will never match a real release, and cannot be mistaken for a true answer.
-// Silence or an empty string could be read as "no mixed build here"; this cannot.
-
-import fs from 'fs'
-import path from 'path'
-import { fileURLToPath } from 'url'
-
-/** Recomputed never: a running process cannot change which build it is. */
-export const VERSION = (() => {
-  try {
-    const v = JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version
-    if (typeof v === 'string' && v) return v
-  } catch { /* fall through — see IT NEVER THROWS above */ }
-  return '0.0.0-unknown'
-})()
-
-/** The sentinel, exported so callers and tests can name it instead of retyping the literal. */
-export const UNKNOWN_VERSION = '0.0.0-unknown'
-
-// BUILD: WHICH COMMIT, not just which version (29 Sep 2026).
-//
-// VERSION alone could not see a mixed build. On 28-29 Sep release-gate HEAD and the published
-// tarball both said "0.12.2" while differing by a night of fixes, and the hosted relay's /health
-// reported no version at all -- "is the fix deployed?" was answered from its uptime. So a build
-// carries its commit when it knows one:
-//   RENDER_GIT_COMMIT  set by Render for a deployed relay (its image has no .git)
-//   a git checkout     .git beside package.json: a folder, or a worktree's `gitdir:` file
-//   otherwise ''       an npm install: VERSION is the whole identity, and it is the true one
-// VERSION itself is untouched -- the update notice compares it with the registry's -- so the
-// commit travels separately, and VERSION_LABEL is what people and agents are shown.
-//
-// It never walks UP. hivecode-mcp installed into someone's repo would otherwise report THAT repo's
-// commit as its own build, which is the lie this exists to prevent. And like VERSION it never throws.
-const HEX = /^[0-9a-f]{7,40}$/
-export function buildOf(root, env = process.env) {
-  try {
-    const rc = String(env.RENDER_GIT_COMMIT || '').trim().toLowerCase()
-    if (HEX.test(rc)) return rc.slice(0, 7)
-    const dotGit = path.join(root, '.git')
-    let gitDir = dotGit
-    if (fs.statSync(dotGit).isFile()) { // a worktree: ".git" is a file holding "gitdir: <path>"
-      const m = /^gitdir:\s*(.+?)\s*$/m.exec(fs.readFileSync(dotGit, 'utf8'))
-      if (!m) return ''
-      gitDir = path.resolve(root, m[1])
-    }
-    const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim()
-    if (/^[0-9a-f]{40}$/.test(head)) return head.slice(0, 7) // detached
-    const ref = /^ref:\s*(\S+)$/.exec(head)
-    if (!ref) return ''
-    let common = gitDir // a worktree keeps its branches in the main repo's .git
-    try { common = path.resolve(gitDir, fs.readFileSync(path.join(gitDir, 'commondir'), 'utf8').trim()) } catch { }
-    for (const d of [gitDir, common]) {
-      try { const h = fs.readFileSync(path.join(d, ref[1]), 'utf8').trim(); if (/^[0-9a-f]{40}$/.test(h)) return h.slice(0, 7) } catch { }
-    }
-    for (const line of fs.readFileSync(path.join(common, 'packed-refs'), 'utf8').split('\n')) {
-      const [h, r] = line.trim().split(/\s+/)
-      if (r === ref[1] && /^[0-9a-f]{40}$/.test(h)) return h.slice(0, 7)
-    }
-  } catch { /* no .git, unreadable, malformed: no commit to report -- see IT NEVER THROWS */ }
-  return ''
-}
-
-/** This build's commit, or '' when it has none to report (an npm install). */
-export const BUILD = buildOf(fileURLToPath(new URL('.', import.meta.url)))
-
-/** What people and agents are shown: "0.12.2+fe1d89e" from a checkout, "0.12.2" from npm. */
-export const VERSION_LABEL = BUILD ? `${VERSION}+${BUILD}` : VERSION
-
-export default VERSION
+// hive-version.js — one place that knows what build this is.
+//
+// WHY THIS FILE EXISTS, and it is not tidiness.
+//
+// VERSION is load-bearing, not cosmetic. hive_join instructs every arriving agent to announce its
+// version in chat, because two clients running different builds in one room corrupt each other's
+// files with no error on either side — both writes succeed, both are green, and the disagreement
+// surfaces only as lost bytes. That announcement is the ONLY channel that makes a mixed build
+// visible from inside the room. So a version string is not a label; it is the input to the one
+// detector we have.
+//
+// On 20 Sep 2026 three entry points were found reporting a version package.json does not contain:
+// remote-mcp.js said '0.11.5' while live on the hosted relay, hive-mcp-http.js and hive-linear.js
+// both said '1.0.0'. hive-mcp.js had already been fixed months earlier, with a comment explaining
+// exactly why hardcoding it is dangerous — and that fix was never carried to the other three.
+// A detector that lies is strictly worse than no detector, because it is trusted.
+//
+// HIV-P7 closed that by giving each of the four files its own runtime read. Which produced the
+// next defect, and it was measured rather than predicted: with the reader duplicated four times,
+// corrupting ONE copy's fallback string to '9.9.9-DRIFTED' left tests/version-truth-test.mjs at
+// 16 passed, 0 failed. The property guards the version that gets REPORTED and says nothing about
+// the mechanism that produces it, so three of four copies could rot in silence.
+//
+// This codebase has watched that happen before. The extension's reconcile() and the engine's were
+// the same function once; they now share 34 lines and behave differently. Eight lines is not too
+// small to drift — it is exactly small enough that nobody feels the need to check.
+//
+// So the fix is DELETION, not another assertion. One definition, imported by all four. The
+// property becomes true by construction instead of by policing, and a fifth entry point written
+// next year gets it right by importing rather than by remembering.
+//
+// TWO DECISIONS WORTH KEEPING:
+//
+// It READS package.json rather than being told. package.json always ships beside these files —
+// in the repo and in the published tarball — so `new URL('./package.json', import.meta.url)`
+// resolves in both. Anything else (a constant, a build step, a generated file) can disagree with
+// the package the moment `npm version` runs, which is precisely the failure being fixed.
+//
+// IT NEVER THROWS. A version read is not worth a server that will not boot, and a server that
+// refuses to start is a worse outcome than one that says it does not know which build it is. So
+// an unreadable or malformed package.json yields '0.0.0-unknown' — a value that is obviously
+// wrong to a human, will never match a real release, and cannot be mistaken for a true answer.
+// Silence or an empty string could be read as "no mixed build here"; this cannot.
+
+import fs from 'fs'
+import path from 'path'
+import { fileURLToPath } from 'url'
+
+/** Recomputed never: a running process cannot change which build it is. */
+export const VERSION = (() => {
+  try {
+    const v = JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version
+    if (typeof v === 'string' && v) return v
+  } catch { /* fall through — see IT NEVER THROWS above */ }
+  return '0.0.0-unknown'
+})()
+
+/** The sentinel, exported so callers and tests can name it instead of retyping the literal. */
+export const UNKNOWN_VERSION = '0.0.0-unknown'
+
+// BUILD: WHICH COMMIT, not just which version (29 Sep 2026).
+//
+// VERSION alone could not see a mixed build. On 28-29 Sep release-gate HEAD and the published
+// tarball both said "0.12.2" while differing by a night of fixes, and the hosted relay's /health
+// reported no version at all -- "is the fix deployed?" was answered from its uptime. So a build
+// carries its commit when it knows one:
+//   RENDER_GIT_COMMIT  set by Render for a deployed relay (its image has no .git)
+//   a git checkout     .git beside package.json: a folder, or a worktree's `gitdir:` file
+//   otherwise ''       an npm install: VERSION is the whole identity, and it is the true one
+// VERSION itself is untouched -- the update notice compares it with the registry's -- so the
+// commit travels separately, and VERSION_LABEL is what people and agents are shown.
+//
+// It never walks UP. hivecode-mcp installed into someone's repo would otherwise report THAT repo's
+// commit as its own build, which is the lie this exists to prevent. And like VERSION it never throws.
+const HEX = /^[0-9a-f]{7,40}$/
+export function buildOf(root, env = process.env) {
+  try {
+    const rc = String(env.RENDER_GIT_COMMIT || '').trim().toLowerCase()
+    if (HEX.test(rc)) return rc.slice(0, 7)
+    const dotGit = path.join(root, '.git')
+    let gitDir = dotGit
+    if (fs.statSync(dotGit).isFile()) { // a worktree: ".git" is a file holding "gitdir: <path>"
+      const m = /^gitdir:\s*(.+?)\s*$/m.exec(fs.readFileSync(dotGit, 'utf8'))
+      if (!m) return ''
+      gitDir = path.resolve(root, m[1])
+    }
+    const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim()
+    if (/^[0-9a-f]{40}$/.test(head)) return head.slice(0, 7) // detached
+    const ref = /^ref:\s*(\S+)$/.exec(head)
+    if (!ref) return ''
+    let common = gitDir // a worktree keeps its branches in the main repo's .git
+    try { common = path.resolve(gitDir, fs.readFileSync(path.join(gitDir, 'commondir'), 'utf8').trim()) } catch { }
+    for (const d of [gitDir, common]) {
+      try { const h = fs.readFileSync(path.join(d, ref[1]), 'utf8').trim(); if (/^[0-9a-f]{40}$/.test(h)) return h.slice(0, 7) } catch { }
+    }
+    for (const line of fs.readFileSync(path.join(common, 'packed-refs'), 'utf8').split('\n')) {
+      const [h, r] = line.trim().split(/\s+/)
+      if (r === ref[1] && /^[0-9a-f]{40}$/.test(h)) return h.slice(0, 7)
+    }
+  } catch { /* no .git, unreadable, malformed: no commit to report -- see IT NEVER THROWS */ }
+  return ''
+}
+
+/** This build's commit, or '' when it has none to report (an npm install). */
+export const BUILD = buildOf(fileURLToPath(new URL('.', import.meta.url)))
+
+/** What people and agents are shown: "0.12.2+fe1d89e" from a checkout, "0.12.2" from npm. */
+export const VERSION_LABEL = BUILD ? `${VERSION}+${BUILD}` : VERSION
+
+export default VERSION

package/hive-webhook.js

@@ -1,54 +1,55 @@
-// hive-webhook -- one Slack or Discord incoming-webhook URL, and the rule for what may be sent to it.
-//
-// Shared by the GitHub watcher (hive-github.js) and the room notifier (hive-notify.js): the same
-// URL works for both, and the same two promises hold for both.
-//   1. Nothing with a key or token in it leaves: every message is scrubbed first.
-//   2. A notification that fails is logged and dropped, never retried in a loop and never a reason
-//      to stop: it is a courtesy, the work is the point.
-import { findSecrets } from './hive-secrets.js'
-
-/** Every key or token in `text` replaced. Run on everything that goes to GitHub or a webhook. */
-export function scrub(text) {
-  let s = String(text || '')
-  for (const f of findSecrets(s, { tokens: true })) s = s.split(f.value).join(`[${f.kind} removed]`)
-  return s
-}
-
-export function cleanError(e, url) {
-  let s = String(e && (e.message || e) || 'unknown error')
-  if (url) s = s.split(url).join('[webhook url removed]')
-  try {
-    const u = new URL(url)
-    if (u.pathname && u.pathname !== '/') s = s.split(u.pathname).join('[path removed]')
-  } catch { }
-  s = scrub(s)
-  s = s.replace(/Failed to parse URL from .+/i, 'Failed to parse URL')
-  return s
-}
-
-/** `send(text)` resolves true when the webhook took it. Slack wants {text}, Discord {content}; any
- *  other host gets Slack format ({text}). */
-export function makeNotifier(url, { fetchImpl = globalThis.fetch, log = () => {} } = {}) {
-  if (!url) return async () => false
-  let host = ''
-  try { host = new URL(url).hostname.toLowerCase() } catch { host = '' }
-  const slack = /(^|\.)slack\.com$/.test(host)
-  const discord = /(^|\.)discord(app)?\.com$/.test(host)
-  const kind = discord ? 'discord' : slack ? 'slack' : 'other'
-  const send = async (text) => {
-    const msg = scrub(text)
-    // allowed_mentions: an issue titled "@everyone" must not page a whole Discord server.
-    const body = discord ? { content: msg.slice(0, 1900), allowed_mentions: { parse: [] } } : { text: msg }
-    try {
-      const r = await fetchImpl(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(10000) })
-      if (!r.ok) { log(`notification not delivered: HTTP ${r.status}`); return false }
-      return true
-    } catch (e) {
-      log(`notification not delivered: ${cleanError(e, url)}`)
-      return false
-    }
-  }
-  send.host = host
-  send.kind = kind
-  return send
-}
+// hive-webhook -- one Slack or Discord incoming-webhook URL, and the rule for what may be sent to it.
+//
+// Shared by the GitHub watcher (hive-github.js) and the room notifier (hive-notify.js): the same
+// URL works for both, and the same two promises hold for both.
+//   1. Nothing with a key or token in it leaves: every message is scrubbed first.
+//   2. A notification that fails is logged and dropped, never retried in a loop and never a reason
+//      to stop: it is a courtesy, the work is the point.
+import { findSecrets } from './hive-secrets.js'
+import { relayFetch } from './hive-transport.js'
+
+/** Every key or token in `text` replaced. Run on everything that goes to GitHub or a webhook. */
+export function scrub(text) {
+  let s = String(text || '')
+  for (const f of findSecrets(s, { tokens: true })) s = s.split(f.value).join(`[${f.kind} removed]`)
+  return s
+}
+
+export function cleanError(e, url) {
+  let s = String(e && (e.message || e) || 'unknown error')
+  if (url) s = s.split(url).join('[webhook url removed]')
+  try {
+    const u = new URL(url)
+    if (u.pathname && u.pathname !== '/') s = s.split(u.pathname).join('[path removed]')
+  } catch { }
+  s = scrub(s)
+  s = s.replace(/Failed to parse URL from .+/i, 'Failed to parse URL')
+  return s
+}
+
+/** `send(text)` resolves true when the webhook took it. Slack wants {text}, Discord {content}; any
+ *  other host gets Slack format ({text}). */
+export function makeNotifier(url, { fetchImpl = relayFetch, log = () => {} } = {}) {
+  if (!url) return async () => false
+  let host = ''
+  try { host = new URL(url).hostname.toLowerCase() } catch { host = '' }
+  const slack = /(^|\.)slack\.com$/.test(host)
+  const discord = /(^|\.)discord(app)?\.com$/.test(host)
+  const kind = discord ? 'discord' : slack ? 'slack' : 'other'
+  const send = async (text) => {
+    const msg = scrub(text)
+    // allowed_mentions: an issue titled "@everyone" must not page a whole Discord server.
+    const body = discord ? { content: msg.slice(0, 1900), allowed_mentions: { parse: [] } } : { text: msg }
+    try {
+      const r = await fetchImpl(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(10000) })
+      if (!r.ok) { log(`notification not delivered: HTTP ${r.status}`); return false }
+      return true
+    } catch (e) {
+      log(`notification not delivered: ${cleanError(e, url)}`)
+      return false
+    }
+  }
+  send.host = host
+  send.kind = kind
+  return send
+}

package/icr-merge.js

@@ -1,58 +1,58 @@
-// icr-merge.js — the bridge that brings ICR into the live product, SAFELY.
-//
-// Hivecode's reconcile() merges concurrent edits with merge3() (a line-level 3-way
-// merge). merge3 is convergent: across many peers it always settles on one canonical
-// text. ICR's structural merge produces a DIFFERENT canonical form (it may reorder or
-// reformat). Mixing two merge algorithms in a live multi-peer sync means the same logical
-// content has two byte-forms, and peers ping-pong between them — which corrupts files
-// (duplicated/*dropped* lines). So we do NOT change merge bytes with ICR here.
-//
-// Instead ICR runs in ADVISORY mode: merge3 still produces the bytes (full convergence
-// preserved, identical to pre-ICR behavior), and ICR runs alongside purely to DETECT the
-// meaning-level problems a line merge can't see — a dangling reference, a rename, a
-// same-declaration clash — and surface them as a warning on the activity feed. This ships
-// ICR's core value (catching semantic breaks) with zero divergence risk.
-//
-// ICR's full structural/rename AUTO-MERGE lives in the library (icr.js) and is proven by
-// the test suite + fuzzer; turning it on in the product is a later step that needs a
-// format-preserving, single-canonical-form merge so peers can't diverge.
-
-import { structuralMerge, supports } from './icr.js'
-import { merge3 } from './core.js'
-
-// Turn ICR's machine conflict keys into a human sentence for the activity feed / chat.
-function describeConflicts(conflicts) {
-  return (conflicts || []).map((c) => {
-    if (c.startsWith('ref:')) return `'${c.slice(4)}' was removed or renamed but is still used`
-    if (c.startsWith('fn:')) return `both sides changed function ${c.slice(3)}`
-    if (c.startsWith('class:')) return `both sides changed class ${c.slice(6)}`
-    if (c.startsWith('var:')) return `both sides changed ${c.slice(4)}`
-    return `both sides changed ${c}`
-  }).join('; ')
-}
-
-// Same shape as merge3 — { text, conflict } — plus an `icr` tag ('structural'|'rename')
-// and an optional `icrWarning`. ICR's format-preserving merge is convergent (symmetric +
-// fixed-point, verified by icr-converge-test.js), so its 'auto' result is used as the
-// merged bytes for supported files; merge3 covers conflicts, fallbacks, and other languages.
-export function icrMerge3(base, mine, theirs, relPath) {
-  const lm = merge3(base, mine, theirs)
-  if (!supports(relPath)) return lm
-
-  let r
-  try { r = structuralMerge(base, mine, theirs, { filename: relPath }) }
-  catch { return lm } // ICR must never break a sync
-
-  if (r.status === 'auto') {
-    const renamed = r.renames && r.renames.length
-    return {
-      text: r.text, conflict: false, icr: renamed ? 'rename' : 'structural',
-      icrWarning: renamed ? `auto-applied rename ${r.renames.join(', ')} — call sites updated` : undefined,
-    }
-  }
-  // A meaning-level conflict the line merge can't represent (dangling ref / clash): keep
-  // the safe line-merge bytes, but surface what ICR caught so it isn't shipped silently.
-  if (r.status === 'semantic-conflict')
-    return { ...lm, icrWarning: describeConflicts(r.conflicts) }
-  return lm // 'fallback'
-}
+// icr-merge.js — the bridge that brings ICR into the live product, SAFELY.
+//
+// Hivecode's reconcile() merges concurrent edits with merge3() (a line-level 3-way
+// merge). merge3 is convergent: across many peers it always settles on one canonical
+// text. ICR's structural merge produces a DIFFERENT canonical form (it may reorder or
+// reformat). Mixing two merge algorithms in a live multi-peer sync means the same logical
+// content has two byte-forms, and peers ping-pong between them — which corrupts files
+// (duplicated/*dropped* lines). So we do NOT change merge bytes with ICR here.
+//
+// Instead ICR runs in ADVISORY mode: merge3 still produces the bytes (full convergence
+// preserved, identical to pre-ICR behavior), and ICR runs alongside purely to DETECT the
+// meaning-level problems a line merge can't see — a dangling reference, a rename, a
+// same-declaration clash — and surface them as a warning on the activity feed. This ships
+// ICR's core value (catching semantic breaks) with zero divergence risk.
+//
+// ICR's full structural/rename AUTO-MERGE lives in the library (icr.js) and is proven by
+// the test suite + fuzzer; turning it on in the product is a later step that needs a
+// format-preserving, single-canonical-form merge so peers can't diverge.
+
+import { structuralMerge, supports } from './icr.js'
+import { merge3 } from './core.js'
+
+// Turn ICR's machine conflict keys into a human sentence for the activity feed / chat.
+function describeConflicts(conflicts) {
+  return (conflicts || []).map((c) => {
+    if (c.startsWith('ref:')) return `'${c.slice(4)}' was removed or renamed but is still used`
+    if (c.startsWith('fn:')) return `both sides changed function ${c.slice(3)}`
+    if (c.startsWith('class:')) return `both sides changed class ${c.slice(6)}`
+    if (c.startsWith('var:')) return `both sides changed ${c.slice(4)}`
+    return `both sides changed ${c}`
+  }).join('; ')
+}
+
+// Same shape as merge3 — { text, conflict } — plus an `icr` tag ('structural'|'rename')
+// and an optional `icrWarning`. ICR's format-preserving merge is convergent (symmetric +
+// fixed-point, verified by icr-converge-test.js), so its 'auto' result is used as the
+// merged bytes for supported files; merge3 covers conflicts, fallbacks, and other languages.
+export function icrMerge3(base, mine, theirs, relPath) {
+  const lm = merge3(base, mine, theirs)
+  if (!supports(relPath)) return lm
+
+  let r
+  try { r = structuralMerge(base, mine, theirs, { filename: relPath }) }
+  catch { return lm } // ICR must never break a sync
+
+  if (r.status === 'auto') {
+    const renamed = r.renames && r.renames.length
+    return {
+      text: r.text, conflict: false, icr: renamed ? 'rename' : 'structural',
+      icrWarning: renamed ? `auto-applied rename ${r.renames.join(', ')} — call sites updated` : undefined,
+    }
+  }
+  // A meaning-level conflict the line merge can't represent (dangling ref / clash): keep
+  // the safe line-merge bytes, but surface what ICR caught so it isn't shipped silently.
+  if (r.status === 'semantic-conflict')
+    return { ...lm, icrWarning: describeConflicts(r.conflicts) }
+  return lm // 'fallback'
+}