v5.167.0

Added

• Added src/scripts/dashboard-mobile-shots.mjs, a headless-Chrome harness that screenshots the dashboard at 390×844, 375×667, 430×932 and 768×1024 in light and dark themes (collapsed, each section expanded, Settings, Knowledge Sources, terminal) and writes an overflow-report.json of horizontal overflow, off-screen boxes, clipped text and needlessly ellipsised text, plus a non-blocking Dashboard Mobile Shots workflow that uploads both as artifacts (#11808, part of #11807).
• The kick log source from #11799 is now a dashboard setting (#11809, #9579): Settings → Logging → Kick log source picks Scrollback, CLI transcript or Auto (config key governor.logging.kick_log_source), applies to the next kick without a restart, and the kick history page shows each archive's source. HIVE_KICK_LOG_SOURCE still wins when set; the control then shows the effective value disabled with a "set by HIVE_KICK_LOG_SOURCE" note.
• Hub auto-upgrades in instant mode are now rate-limited per hive: a hive that auto-upgraded less than HIVE_UPGRADE_COOLDOWN_SECONDS ago (default 6h, negative disables) is deferred rather than rolled again, then upgrades straight to the newest target once the cooldown expires; the heartbeat upgrade policy reports cooldown_seconds and next_eligible_at (#11825).
• Added the hive/in-progress label and a timestamped hive:claim … at=<RFC3339> start marker, applied when an agent claims an issue before opening a PR, cleared when the PR opens, the claim is released, PR evidence appears or the marker lapses; every kick tells the agent to claim first, other hives withhold a live-claimed issue, and the lifecycle timeline gains a started stage for per-repo SLA spans (#11841).
• dashboard settings: expose dashboard keys (#11867)
• dashboard settings: expose backends keys (#11887)
• dashboard settings: expose classifier keys (#11901)
• dashboard settings: expose contribute keys (#11909)
• Added Delivery SLA metrics: per-repo and fleet-wide open_to_triage, triage_to_start, start_to_pr, pr_to_merge and open_to_merge spans (p50/p95/n over 7d and 30d windows) derived from the lifecycle timeline with no extra GitHub API calls, 30 days of daily history persisted under /data/sla-history.json so sparklines survive restarts, a stale_in_progress list of hive/in-progress issues older than the agent claim TTL with no PR, all exposed in GET /api/status (sla, repos[].sla); a Delivery SLA panel in the dashboard Overview (tiles with 30-day sparklines colour-coded against configurable sla.targets, stale badge linking to the issues, 7d/30d toggle and a per-repo breakdown) and the targets editable under Settings → Thresholds / /api/config/sla (#11841 follow-on).
• Kick logs can now be built from the backend CLI's own transcript instead of the tmux scrollback (#11762, #9579). Set HIVE_KICK_LOG_SOURCE=transcript (or auto) and Copilot CLI and Claude Code archives and live full logs list every turn, every tool call with its full arguments (the shell command) and its full output, with timestamps and no (N lines hidden) collapsing. A missing, stale or unparseable transcript falls back to the scrollback with one warning; the log header gains a source: line naming which was used. The default stays scrollback.
• Add a global Settings search box that filters settings by labels, help text, YAML keys, and known option text.

Changed

• The Knowledge Integrations dialog now shows a vendor/project icon for each connector instead of the same generic 🔌 plug on every row (#11780). Obsidian, Confluence, Git, GitHub Wiki, Google Drive, Notion and SharePoint / OneDrive use their simple-icons marks (CC0, inline SVG, currentColor so they follow the theme and the active-row accent); Document and Repo wiki use a document-sheet and open-book glyph. The same icon heads the detail pane, the count badge alignment is unchanged, and any future connector type without a mapping still falls back to the plug.
• Hub self-upgrades stay instant but no longer disturb fleet alerting: the hub persists its crash-loop/heartbeat alert bookkeeping across restarts (/data/saas/hub-alert-state.json) and holds back new crash-loop/offline alerts for 10 minutes after it (re)starts, so a hub roll never manufactures fleet alerts; the hub's instant upgrade cadence is now documented next to the hosted daily/weekly cadence (#11826).
• dashboard: settings-parity ratchet (every hive.yaml key must have a Settings control) (#11856)
• dedupe: advisory-only checklists (no proposed closes/relabels) now carry Decision required: no and the triage/advisory label instead of being parked as needs-decision (#11864)
• Dashboard: the Delivery SLA tiles, sparklines, stale in-progress badge and per-repo table moved from the Overview to the Throughput section, following its repository filter and period pills; the Overview KPI strip is back to its pre-SLA layout. API, persistence and Settings → Thresholds targets are unchanged (#11899).

Fixed

• Dashboard help tooltips (.config-info ⓘ / ? marks) now hide when the pointer leaves the trigger and popover, on Escape, outside click, scroll/resize, and whenever a modal opens; the popover stays open while hovering its buttons/links, opens after a short hover-intent delay, and only one is open at a time (#11782).
• Issues a person reopens after the PR that closed them merged are re-queued for work instead of being parked as hive/likely-done / verify-once: the duplicate-PR ledger voids the merged claim on the issues.reopened webhook and on poll (state_reason=reopened, one timeline read per new activity), logs reopened issue re-queued, the kick tells the agent to implement the remainder rather than re-verify, the dashboard shows ↺ reopened after PR #N merged, and the close-on-merge sweep never closes the issue for that PR again (#11785).
• The Knowledge Sources modal (and the How Knowledge Works / Import Facts modals that share its recipe) can be scrolled all the way to the bottom again (#11786): the dialog body is the single internal scroller instead of a nested fixed-height one, and an empty textarea under the pointer no longer swallows wheel events.
• Advisory digest: a 403 Resource not accessible by integration (or 404) on editing the existing digest comment now falls back to creating a fresh App-authored comment instead of retrying the same edit every eval cycle; when the create is refused too and the repository has been transferred to another owner, the hub health row and dashboard App banner name the move (old/repo → new/repo) and the remedy instead of "add the repo to the installation"; and post attempts pause for governor.advisory.post_retry_backoff_s (default 1h, HIVE_ADVISORY_POST_RETRY_BACKOFF_S) after a write-forbidden failure; and the dashboard App Re-check now re-discovers a wrong-account installation before the repo-coverage check, so a hive repointed at a repo's new owner adopts that org's installation without a restart (#11791).
• Dashboard Channel card no longer shows a days-old "Last upgrade · Nd ago" from a settled dashboard-button upgrade record after the hub has rolled the hive again; the newest landed upgrade (or the running commit, marked superseded) wins, on mobile and desktop alike (#11796).
• hub: assigned hosted hives no longer settle on the slot placeholder org when the spoke heartbeats it; the hub keeps pushing (and restores) the approved request org (#11800).
• Mobile dashboard: section ? help marks, ⚙ settings gears, drag grips and topbar icon chips are now a fixed 40px square tap target with a 16px glyph instead of 44px circles around a 9.6px glyph, and the Overview 24h/7d range pills are padded so they read as pills rather than circles; desktop sizing is unchanged (#11801).
• Mobile dashboard: collapsed-section summaries, quota meters, tile rows and topbar pills now reflow on phones instead of overflowing or clipping (#11807).
• Fixed the Dashboard Mobile Shots workflow crashing with spawn google-chrome ENOENT on the self-hosted runners: it now installs Chrome for Testing and passes it via CHROME_BIN, and src/scripts/dashboard-mobile-shots.mjs resolves browser candidates against PATH so a missing browser is a clean SKIP rather than an unhandled error (#11810).
• Hub alerts: unclaimed pool slots seeded with the placeholder project no longer raise repo-overlap warnings against each other (#11818), and Acknowledge no longer intermittently fails with 409 — token-burn medians and repo overlaps are now computed over the whole fleet for every caller, so another user's scoped dashboard poll can no longer evict an alert's shared FirstSeen/ack (#11819).
• A contributor blocked verdict whose reason is the contributor's own tooling failing — push to the fork rejected, token missing the workflow scope, credential or permission errors, stale fork — no longer parks the issue fleet-wide behind the blocked label: the relay demotes it and applies no label, the hub reclassifies it as an idle completion (short cooldown, re-offered), removes a blocked label the relay applied and leaves one explanatory comment, and the task prompt tells agents such a failure is never blocked (#11820; seen on #11775, #11776).
• hub: candidate-channel hives now show "every image (candidate)" instead of the daily schedule when the schedule is bypassed, and the auto-upgrade audit log records the effective schedule and reason (#11823).
• The hub's "Crash-looping" alert no longer counts hub-triggered auto-upgrade rollouts as restarts (#11824, part of #11812). The rule counted every distinct spoke StartedAt in its 2h window, so a fleet upgrade wave (each rolling the pod once or twice) raised a false Critical on every hive it touched while all pods were Running with RESTARTS 0. The hub now remembers when it armed an upgrade for a hive (and any upgrade visible in the alert snapshot), and starts landing within 10 minutes of it are not counted; unexplained restarts, including crashes after an earlier upgrade, still alert as before.
• hub: TestResolveCommitBehindCachesKnownAndUnknown no longer flakes (#11833).
• dashboard: TestDiscoverCopilotModels_SDKFailureNoTokenCarriesError no longer flakes (#11834).
• Surfaced a slot-placeholder project.org paired with a bare repo name as a failing project_org health check (dashboard tooltip, /api/health/deep, hub alert) instead of letting the hive run silently without GitHub credentials (#11846, part of #11800).
• Added a hub sweep (startup + every 30 minutes) that logs assigned hives whose live org differs from their approved org, and a placeholderOrg flag on the My Hives row for a delivered claim whose spoke still reports a slot-placeholder org with a primary repo set (#11847, part of #11800).
• Mobile dashboard: landscape phones (667–932px wide, under 500px tall) no longer get the desktop layout — the theme layout guard releases the topbar across the whole ≤1024px drawer range so the navbar spans the full width, and a new landscape-phone media tier adds notch safe-area insets, keeps the topbar to one row, and makes Settings, Feedback, Knowledge, ACMM and Hive Chat fill the viewport with internal scroll; the mobile screenshot harness now covers 844×390, 932×430, 667×375 and 740×360 (#11860)
• Coverage gate: added unit tests for internal/settingsparity and internal/tools/settingsparity (the tool's main now delegates to a testable run helper), and made TestDeadSessionRecoveryOwnershipTransfer hermetic so it no longer leaks real tmux sessions between subtests (#11875)
• Hub landing: the "Agent CLIs by support tier" paragraph in the integrations band is now centered in its column like the sibling headings and chip rows, instead of being pinned to the left edge at wide viewports (#11884).
• agent: diagnostic pane tail in lastError/pausedReason is redacted like other pane-derived status fields (#11889)
• The merge-request watcher no longer polls forever when a required check was never created: once nothing on a head older than 30 minutes is queued or running, the request is quarantined with a "never created" reason and the fix loop is not re-engaged. Attempts, CI waits and exhausted heads are now persisted per PR+SHA under /data so restarts and re-dropped hive-merge requests cannot restart the cycle, and pending CI polls back off from 10 s to 1 min to 5 min (#11891, #11894, #11895).
• A required check that was never created no longer makes a blocked PR merge-eligible (#11892, part of #11877): when the only required context (e.g. build-gate) is absent from both the head's check runs and its commit statuses and GitHub reports mergeable_state=blocked, ProtectionFacts.MissingRequiredChecks now names it, so the merge sweep skips the PR with required-check-missing: instead of counting it as eligible/actionable. Routing to the held/needs-human band on the terminal merge-gate verdict is tracked separately.
• The automerge sweep now logs a single automerge hold line per PR head for required-check-held:<ctx> and required-check-never-started:<ctx> instead of an automerge skip line on every tick; the PR is still counted as skipped in tick stats (#11893, #11877).
• Agents on the built-in litellm backend now take their inference endpoint from the explicit gateways: entry named litellm whenever one exists, matching where the key already came from; previously a stale governor.litellm.endpoint/HIVE_LITELLM_ENDPOINT won the endpoint while the Model Gateways tab supplied the key, so Test Connection passed against the new gateway while every agent call sent the new key to the old one and died with 401 Invalid proxy server token (#9945). Both Test buttons now also print the exact request agents will make (POST …/v1/chat/completions, bearer header, key SHA-256 prefix, model, config source) and warn when it is not the endpoint or key just tested, and JSON gateway auth errors are reported with the request shape (method, path, header, User-Agent, egress proxy) and the responder's Server header, classified apart from proxy/WAF HTML refusals.
• Added a shared automatic-agent-restart circuit breaker so repeated relaunch loops back off, pause with a restart-storm reason, and reset cleanly instead of flooding the hub dashboard.
• Stop login-prompt recovery from restarting agents unless that agent’s own backend has a usable credential.
• Auto-merge no longer polls a trusted-bot or App-authored PR forever when its required checks cannot appear: the sweep approves pull_request workflow runs GitHub holds for approval on same-repository heads (once per head, via the mutation boundary; needs App Actions: write, otherwise reports required-check-held:<ctx>), reports heads GitHub never scheduled runs for as required-check-never-started:<ctx>, and the NOTICE autofix workflow now releases the held runs its own GITHUB_TOKEN push creates on Dependabot branches.
• Respect daily/weekly auto-upgrade windows for candidate-channel hives unless explicitly configured for continuous candidate tracking.
• Prune stale Copilot extraction cache directories, pause disk-full Copilot relaunch loops, and prevent inference backend launch command defaults from starting gateway binaries as agents.
• dashboard: copilot model discovery no longer flaps to "degraded — not the CLI catalog" every few minutes on loaded spokes. The SDK helper probe budget (3 s against a measured 2.4–3.2 s run) now sits above the helper's own 15 s watchdog, a deadline kill is reported as "sdk helper timed out after 20s" instead of "signal: killed (stderr: )", the last good CLI catalog is retained (in memory and under /data/.hive) and served as "cached CLI catalog — refresh failing" through transient helper failures and across restarts, and failed probes back off (30 s doubling to 1 h) instead of re-spawning node+CLI every 30 s (#11865).
• Give daily time-of-day cadences enough catch-up window to survive stretched governor eval intervals instead of skipping the slot.
• src/Dockerfile and src/Dockerfile.hub base images are now pulled from mirror.gcr.io (Google's quota-free Docker Hub cache) instead of ECR Public, which returned 429 Data limit exceeded on shared CI runners; tags and digests are unchanged (#11757).
• Treat duplicate-session crash recovery as a live tmux session and log failed tmux probes so false missing-session checks do not inflate restart storm counts.

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.