Changelog

All notable changes to this project are documented here.

Format follows Keep a Changelog.

[Unreleased]

Fixed

• Built-in chat MCP works with hostname-only TLS certificates - when client TLS is enabled, Hive derives the local MCP WebSocket endpoint from the configured certificate's DNS subject alternative name. It falls back to a local IP only when that exact IP is present in the certificate, and never disables hostname verification.
• Windows Notes vault paths no longer fail their own root check - Hive normalizes Windows extended-length path prefixes before comparing the configured vault and resolved file path, preventing valid default vaults from reporting path escapes vault root.
• Ctrl+C did nothing in Windows run-as terminals - the service-side run-as helper received the ConPTY control event, but the PowerShell process created in the interactive user's Windows session did not. The helper now bridges the event to a target-session relay, which interrupts the foreground command while keeping the PowerShell session alive.
• Windows agent chat died before the first reply - the headless agent CLI was spawned through a cmd /c wrapper, and cmd drops the outer quotes of its command line whenever it sees more than two quote characters or a program with no executable extension. An install under C:\Program Files\... therefore exited 1 with 'C:\Program' is not recognized as an internal or external command, surfacing in the chat as "The agent stopped without a reply (exit code 1)". The daemon now spawns the CLI directly (letting the standard library host .cmd shims with escaping that survives), prefers an executable extension when resolving a program on PATH instead of npm's extensionless shim, and runs batch-file CLIs through cmd.exe /S /C in the run-as helper, which CreateProcessAsUserW cannot launch on its own.

Changed

• Daemon updates now include the node CLI - every manifest-based daemon update requires and stages the matching hive artifact, installing it beside hived on restart when missing and replacing it when stale. The desktop app no longer exposes separate local, per-node, or cluster-wide CLI update controls.
• hive update / hive update-node default to the local node - a bare hive update already self-updates the CLI following the local node's [update] channel and manifest URL; hive update-node (renamed from update-daemon, which remains as an alias) now likewise defaults to updating the local node with no arguments, instead of requiring --from <url>. Both still accept --from/--channel/--remote-token overrides.

Added

• Direct chat deletion everywhere - right-click a chat row on desktop, use its touch/mobile delete control or active-chat actions menu, or search F1 for the chat by name. Every entry point opens the same destructive confirmation before deleting the chat and saved transcript.
• Configurable navigation - choose Full or Simple usage profiles, where Simple shows only Chats and Notes, reorder or hide individual feature destinations, and switch between Comfortable and Compact spacing. Connection, Settings, Documentation, and the navigation settings remain available as permanent escape hatches on desktop and mobile, with matching F1 commands.
• Documentation inside the app - open the public docs from the expanded or collapsed desktop menu, the mobile menu footer, or F1 > Open Hive documentation.
• Human and AI changelog - root CHANGELOG.md is the single source for the public /docs/changelog page, raw Markdown, llms.txt, and llms-full.txt.
• Built-in chat MCP tools - untitled chats can call hive_set_chat_title; chats with attachments can call hive_list_context and hive_read_context_file to inspect cross-node context, including cached snapshots when an owning node is offline.
• Task targeting and durable cross-node moves - create and operate tasks on a selected cluster node from the app or CLI, filter the task list by node, and move a non-running task with its UUID, schedule, configuration, timestamps, and retained run history. Durable operation IDs make retries safe across disconnects and daemon restarts.
• Preferred Notes serving node - each device can pin Notes to one cluster node while connected elsewhere. All vault operations, settings, sync, and S3 tests route to that node; an offline preference stops instead of silently switching vaults.
• Symlink-safe Agent Docs rollout - discovery and status show symbolic-link targets. Hive preserves safe links inside the managed root and blocks broken links, external targets, escaping parent links, and write-time link swaps with a visible reason.
• hive version - new command printing this CLI's version, its build platform, and the locally installed hived version. hive --version / -V print the CLI version alone.
• Remote-URL updates - daemons, the CLI, and the desktop / mobile app can self-update from an arbitrary HTTP(S) URL hosting a RemoteUpdateManifest JSON document. hive update --from <url> replaces the running CLI, hive update-daemon --from <url> [--refresh-artifacts] asks the connected daemon to self-update (and optionally bulk-refresh its bundled clients/ and daemons/ trees so subsequent peer pulls serve the new version), and the desktop app's Settings → Updates card drives both flows from the GUI. Optional Bearer token (HIVE_UPDATE_TOKEN) for private endpoints; every artifact is SHA-256 verified post-download. See docs/remote-updates.md.
• Persistent + cluster-shared update settings - the manifest URL, bearer token, auto-check toggle, and interval are now persisted across restarts. Stored on the daemon under a new [update] config section and replicated to every cluster peer via PeerMessage::SyncRemoteUpdateConfig, so isolated nodes can still auto-update on schedule. The desktop app mirrors the same settings to localStorage so it can keep checking and update itself even when no daemon is reachable. Daemons run a background auto-check task (6-hour default) that broadcasts ServerMessage::RemoteUpdateAvailable when a newer manifest version appears; install is always manually confirmed.
• PTY sessions - interactive terminal sessions via portable-pty 0.8; SessionMode::Pty spawns the process in a full PTY, forwarding raw bytes to clients. Clients send SendPtyInput for keystrokes and ResizePty for window resize events.
• SQLite persistence - session metadata and task records are persisted to SQLite (rusqlite) at the platform data directory. The daemon restores sessions on startup without re-spawning processes; status changes (Idle, Exited) are written back immediately.
• Task scheduler - Scheduler runs a 10-second tick loop and fires Pending tasks whose next_run_at has elapsed. Three schedule types: OneShot (immediate, runs once), Interval { seconds } (repeating), Cron { expression } (6-field cron via cron 0.12). Tasks are persisted to SQLite and restored on daemon restart.
• Notifications - NotificationEngine fires HTTP notifications on session completion, session error, task completion, and cluster role change. Three backends: generic webhook (POST/PUT with custom headers), ntfy (topic + optional bearer token), and Pushover. Configured via [notifications] in config.toml.
• Projects - Project type (UUID key, name, description, working directory, default model, extra args) with full CRUD via protocol messages and Tauri commands. Sessions can be associated with a project via project_id.
• Process adoption - hive adopt [--pid <pid>] [--name <name>] [--dir <dir>] registers a running Claude Code process with the daemon without spawning it. Adopted sessions appear in hive ls and can be killed via hive kill. Dead adopted sessions are reaped automatically.
• hive install - extracts the bundled hived binary, runs an interactive config wizard (port, token, display name, cluster settings), and writes a systemd unit on Linux. Flags: --non-interactive, --name <name>, --json.
• Node display names - display_name field in DaemonConfig and ClusterSection. Names propagate via peer handshake (PeerHello/PeerHelloAck) and are shown in cluster status. Runtime rename via hive rename-node <id> <name> or the app's pencil icon; change is broadcast to all peers and persisted to config.toml.
• Daemon version + remote update - AuthResult now carries daemon_version and platform. Version badges shown in ClusterStatusView and SettingsView. hive update-node --address <host:port> and the app's Update button push a new hived binary to a remote node via WebSocket and trigger a self-restart.
• Cluster node remove - hive sends RemoveNode; the daemon removes the peer from its config, disconnects it, and broadcasts PeerForgetNode to remaining peers so they stop reconnecting.
• InitCluster message - allows the Tauri app to configure cluster settings on a daemon in standalone mode and optionally restart it to join the cluster.
• Windows Service - hived registers with the Windows SCM; install/uninstall via the desktop app's Settings view or sc commands. The service uses CREATE_NO_WINDOW for all child processes.
• PTY terminal view - PtyTerminal.vue wraps xterm.js (@xterm/xterm) with FitAddon for automatic column/row fitting. Scrollback is buffered in the Pinia store (MAX_PTY_SCROLLBACK = 2000 raw chunks) and replayed on component mount so navigating away and back preserves terminal history. A ResizeObserver keeps the terminal sized to its container; resize events are forwarded to the daemon via resize_pty. Theme-aware ANSI palettes (DARK_THEME/LIGHT_THEME) toggle reactively without re-creating the terminal.
• Shell picker - NewSessionDialog.vue shows a platform-filtered shell preset list for PTY sessions (PowerShell/cmd on Windows, bash/zsh/fish on Unix, plus a Custom… free-text entry). The selected command is passed to new_session as the optional command field; choosing the default claude preset sends None and lets the daemon decide.
• App auto-update - check_update Tauri command queries the update manifest and returns Option<{ version, body }>; install_update downloads and installs the update then restarts the app. Backed by tauri-plugin-updater.
• Remote Terminals (#7) - TerminalKind enum (Claude | Shell { command, args }) added to clusto-protocol/src/session.rs. SessionInfo gains a kind field (defaults to Claude, fully backward-compatible). New OpenTerminal client message and TerminalOpened server message. rc open <node> [--shell powershell|bash|zsh|cmd] CLI command opens a raw interactive shell session on any connected node. The PTY backend now accepts an arbitrary command rather than always launching claude.
• Agent Teams (#9) - Team and TeamStatus types added to clusto-protocol/src/team.rs. Six new ClientMessage variants: CreateTeam, SpawnWorker, RelayTeamMessage, ListTeams, GetTeam, DisbandTeam. Six new ServerMessage variants: TeamCreated, WorkerSpawned, TeamMessage, TeamList, TeamUpdated, TeamDeleted. SessionInfo gains team_id: Option<Uuid> and is_team_leader: bool. Teams are replicated across cluster nodes via PeerMessage::TeamUpserted / TeamRemoved, persisted in SQLite, and accessible via Tauri commands.
• Desktop app (Tauri 2.0) - Vue 3 + TypeScript frontend with Pinia stores. Views: Sessions, Cluster, Settings, Connect. Manages connection profiles, session lifecycle, cluster topology, local daemon install/start/stop/restart, and Windows Service registration.
• Android app - APK and AAB built via cargo tauri android build. Supports the same feature set as the desktop app.
• CI workflow - ci.yml runs cargo test for all Rust crates and Vitest for the frontend on every push.
• Release workflow - release.yml builds multi-platform binaries (Windows x64, Linux x64, Linux ARM64) and creates a GitHub Release with attached assets.

Changed

• SessionManager event loop (process_events) now handles SDK process completion via an mpsc channel fed by per-session oneshot watcher tasks, replacing a polling approach.
• Session status transitions to Idle (not Exited) when an SDK process completes normally; Exited is reserved for killed sessions.
• Cluster state replication extended to include projects and their CRUD mutations.
• ClusterNode.display_name is Arc<RwLock<Option<String>>> to support runtime rename without daemon restart.
• PeerHello and PeerHelloAck carry version and display_name fields so joining nodes advertise their version immediately.
• SyncClusterConfig is broadcast to all peers after UpdateClusterConfig so peer lists stay consistent without restart.
• Follower nodes ban removed peers (via PeerTransport ban list) to prevent immediate reconnect after RemoveNode.

Fixed

• Self-connections in PeerTransport are now rejected; a node no longer tries to connect to its own peer address.
• remove-node no longer triggers a reconnect loop when the removed peer attempts to rejoin.
• update-node relay correctly propagates auth failure back to the originating client.
• Version comparison in cluster upgrade flow uses semver ordering, not string comparison.