@shanesaravia/hive 0.1.0

package/packages/server/dist/api/rest.js

@@ -0,0 +1,793 @@
+import { randomUUID } from "node:crypto";
+import { CONTEXT_BUDGETS } from "../messages/messagesStore.js";
+import { allPlanTasks } from "../plans/plansStore.js";
+import { buildFleetSnapshot } from "../roster/rosterBuilder.js";
+import { toHiveEvent } from "../hooks/hookIngest.js";
+import { startOrchestrator } from "../control/launcher.js";
+import { matchNativeCommand, runNativeCommand } from "../control/nativeCommands.js";
+import { sendMessage } from "../control/messaging.js";
+import { parsePermissionAsk, permissionGrant } from "../control/permissionPark.js";
+import { forceStopSession, stopSession } from "../control/killer.js";
+import { discoverSkills } from "../skills/skillDiscovery.js";
+import { detectRepositoryMentions, foreignRepositoryForPath, inspectWorkingDirectory, recentRepositories, requireWorkingDirectory, suggestDirectories } from "../paths/pathResolver.js";
+import { missionReport, reportMarkdown } from "../reports/missionReport.js";
+import { createTemplate, deleteTemplate, discoverTemplates, discoverTemplatesDetailed, updateTemplate } from "../templates/templateDiscovery.js";
+import { publishGitHubReport } from "../reports/githubPublisher.js";
+import { enforceWorkingDirectory, normalize } from "../policies/policiesStore.js";
+import { detectProviderModels } from "../control/providerModels.js";
+export function registerRest(app, deps) {
+    const { sessionsWatcher, jobsWatcher, events, missions, messages, plans, policies, codex } = deps;
+    const missionSendTails = new Map();
+    function latestMissionTarget(missionId) {
+        const candidates = [...jobsWatcher.getAll()].filter(([jobId]) => missions.missionFor(jobId) === missionId);
+        candidates.sort((a, b) => Date.parse(b[1].createdAt ?? "") - Date.parse(a[1].createdAt ?? ""));
+        const latest = candidates[0];
+        const sessionId = missions.latestSessionFor(missionId) ?? latest?.[1].sessionId ?? latest?.[1].resumeSessionId;
+        return latest && sessionId ? { jobId: latest[0], sessionId } : undefined;
+    }
+    async function withMissionQueue(missionId, run) {
+        const previous = missionSendTails.get(missionId) ?? Promise.resolve();
+        const operation = previous.catch(() => undefined).then(run);
+        const tail = operation.then(() => undefined, () => undefined);
+        missionSendTails.set(missionId, tail);
+        try {
+            return await operation;
+        }
+        finally {
+            if (missionSendTails.get(missionId) === tail)
+                missionSendTails.delete(missionId);
+        }
+    }
+    async function sendToMission(missionId, text) {
+        return withMissionQueue(missionId, async () => {
+            const target = latestMissionTarget(missionId);
+            if (!target)
+                throw new Error("mission not found");
+            const summary = missions.summaryFor(missionId);
+            const policy = summary.policy ?? policies.get();
+            // "add this to monorepo" should just work: repos mentioned by name get
+            // --add-dir access, persisted so every later turn keeps the grant.
+            const mentioned = detectRepositoryMentions(text, summary.repository);
+            const additionalRepos = [...new Set([...(summary.additionalRepositories ?? []), ...mentioned])];
+            if (mentioned.length)
+                missions.addRepositories(missionId, mentioned);
+            const prompt = additionalRepos.length ? `${text}\n\n(Hive: you also have tool access to these repositories: ${additionalRepos.join(", ")})` : text;
+            const result = summary.provider === "codex"
+                ? await codex.start({ task: prompt, cwd: summary.repository, model: summary.model, mode: summary.mode, policy, resumeSessionId: target.sessionId })
+                : await sendMessage(target.sessionId, prompt, policy, additionalRepos);
+            missions.linkJob(missionId, result.jobId, result.sessionId);
+            messages.add({ id: `${result.jobId}:user`, missionId, role: "user", text, createdAt: Date.now(), jobId: result.jobId });
+            // A follow-up to a closed mission is an implicit reopen — work resumed.
+            if (["completed", "archived", "failed", "paused"].includes(summary.lifecycleStatus)) {
+                missions.setLifecycleStatus(missionId, "active");
+                events.add({ ts: Date.now(), sessionId: result.sessionId ?? target.sessionId, jobId: result.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Mission reopened from ${summary.lifecycleStatus} by a new message` });
+            }
+            return result;
+        });
+    }
+    app.get("/api/fleet", async () => buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans));
+    app.get("/api/policies", async () => ({ policy: policies.get() }));
+    app.get("/api/providers/models", async () => ({ providers: detectProviderModels() }));
+    app.put("/api/policies", async (req, reply) => {
+        try {
+            const policy = policies.set(req.body ?? {});
+            events.add({ ts: Date.now(), sessionId: "hive:policies", source: "custom", phase: "custom", activityKind: "decision", detail: "Workspace permission defaults updated by user" });
+            return { policy };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/templates/discover", async (req, reply) => { try {
+        return discoverTemplatesDetailed(req.body?.cwd);
+    }
+    catch (err) {
+        reply.code(400);
+        return { error: err.message };
+    } });
+    app.post("/api/templates", async (req, reply) => { try {
+        if (req.body?.source !== "user" && req.body?.source !== "repository")
+            throw new Error("template source must be user or repository");
+        return { template: createTemplate(req.body.template, req.body.source, req.body.cwd) };
+    }
+    catch (err) {
+        reply.code(400);
+        return { error: err.message };
+    } });
+    app.put("/api/templates/:source/:id", async (req, reply) => { try {
+        if (req.params.source !== "user" && req.params.source !== "repository")
+            throw new Error("built-in templates are read-only");
+        return { template: updateTemplate(req.params.id, req.body.template, req.params.source, req.body.cwd) };
+    }
+    catch (err) {
+        reply.code(400);
+        return { error: err.message };
+    } });
+    app.delete("/api/templates/:source/:id", async (req, reply) => { try {
+        if (req.params.source !== "user" && req.params.source !== "repository")
+            throw new Error("built-in templates cannot be deleted");
+        deleteTemplate(req.params.id, req.params.source, req.query.cwd);
+        events.add({ ts: Date.now(), sessionId: "hive:templates", source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Template deleted: ${req.params.source}/${req.params.id}${req.query.cwd ? ` · ${req.query.cwd}` : ""}` });
+        return { ok: true };
+    }
+    catch (err) {
+        reply.code(400);
+        return { error: err.message };
+    } });
+    app.get("/api/mission/:missionId/report", async (req, reply) => {
+        const snapshot = buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans);
+        const node = snapshot.orchestrators.find((item) => item.missionId === req.params.missionId);
+        if (!node) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const report = missionReport(node, snapshot.decisions.filter((decision) => decision.missionId === node.missionId));
+        const safeName = node.name.replace(/[^a-z0-9_-]+/gi, "-").replace(/^-|-$/g, "") || "mission";
+        if (req.query.format === "json")
+            return reply.header("Content-Disposition", `attachment; filename="${safeName}-report.json"`).type("application/json").send(JSON.stringify(report, null, 2));
+        return reply.header("Content-Disposition", `attachment; filename="${safeName}-report.md"`).type("text/markdown").send(reportMarkdown(report));
+    });
+    app.post("/api/mission/:missionId/report/github", async (req, reply) => {
+        if (!req.body?.confirmed) {
+            reply.code(400);
+            return { error: "explicit confirmation is required before publishing externally" };
+        }
+        if (req.body.kind !== "issue" && req.body.kind !== "pr") {
+            reply.code(400);
+            return { error: "choose a GitHub issue or pull request" };
+        }
+        const snapshot = buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans);
+        const node = snapshot.orchestrators.find((item) => item.missionId === req.params.missionId);
+        if (!node?.mission.repository) {
+            reply.code(404);
+            return { error: "mission repository not found" };
+        }
+        const target = { sessionId: node.sessionId, jobId: node.jobId };
+        events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `External publish approved: mission report to GitHub ${req.body.kind} ${req.body.target ?? ""}` });
+        try {
+            const report = missionReport(node, snapshot.decisions.filter((decision) => decision.missionId === node.missionId));
+            await publishGitHubReport({ kind: req.body.kind, target: req.body.target ?? "", markdown: reportMarkdown(report), cwd: node.mission.repository });
+            events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "output", outcome: "success", detail: `Mission report published to GitHub ${req.body.kind} ${req.body.target}` });
+            return { ok: true };
+        }
+        catch (err) {
+            events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "output", outcome: "failure", detail: `GitHub report publish failed: ${err.message}` });
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.get("/api/session/:sessionId/timeline", async (req) => {
+        return { events: events.recentFor(req.params.sessionId, 200) };
+    });
+    app.post("/hooks/:eventName", async (req, reply) => {
+        const payload = {
+            ...req.body,
+            hook_event_name: req.body.hook_event_name ?? req.params.eventName,
+        };
+        if (!payload.session_id) {
+            reply.code(400);
+            return { error: "missing session_id" };
+        }
+        const jobId = sessionForId(sessionsWatcher, payload.session_id)?.jobId;
+        const event = toHiveEvent(payload, jobId);
+        events.add(event);
+        // A write landing in another known repo marks that repo as touched by
+        // the mission, so its footprint chips reflect reality, not just intent.
+        if (event.activityKind === "file_write" && event.filePath && jobId) {
+            const missionId = missions.missionFor(jobId);
+            const mission = missions.get(missionId);
+            if (mission) {
+                const touched = foreignRepositoryForPath(event.filePath, mission.repository);
+                if (touched)
+                    missions.addRepositories(missionId, [touched]);
+            }
+        }
+        return { ok: true };
+    });
+    app.post("/events", async (req, reply) => {
+        const { sessionId, jobId, phase, detail, targetWorker, targetTask } = req.body;
+        if (!sessionId || !phase || !detail) {
+            reply.code(400);
+            return { error: "sessionId, phase, and detail are required" };
+        }
+        const effectiveJobId = jobId ?? sessionForId(sessionsWatcher, sessionId)?.jobId;
+        let eventDetail = detail;
+        if (phase === "plan_updated") {
+            if (!effectiveJobId) {
+                reply.code(404);
+                return { error: "could not resolve mission for plan update" };
+            }
+            const missionId = missions.missionFor(effectiveJobId);
+            if (!missions.get(missionId)) {
+                reply.code(404);
+                return { error: "mission not found for plan update" };
+            }
+            try {
+                const plan = plans.replace(missionId, JSON.parse(detail));
+                eventDetail = `Plan updated to revision ${plan.revision}: ${plan.phases.length} phase${plan.phases.length === 1 ? "" : "s"}, ${plan.progress.totalTasks} task${plan.progress.totalTasks === 1 ? "" : "s"}`;
+                const current = plan.phases.find((item) => ["working", "reviewing", "blocked"].includes(item.status));
+                const blocked = plan.phases.flatMap((item) => allPlanTasks(item.tasks)).filter((task) => task.status === "blocked").map((task) => task.title);
+                missions.updateContext(missionId, { compactSummary: `Plan revision ${plan.revision}; ${plan.progress.completedTasks}/${plan.progress.totalTasks} tasks complete${plan.progress.percent !== undefined ? ` (${plan.progress.percent}%)` : ""}. ${current ? `Current phase: ${current.title}.` : ""}${blocked.length ? ` Blocked: ${blocked.slice(0, 3).join(", ")}.` : ""}`.slice(0, 1_200), currentState: eventDetail });
+            }
+            catch (err) {
+                reply.code(400);
+                return { error: err.message };
+            }
+        }
+        let decision;
+        if (phase === "blocked_on_user") {
+            try {
+                decision = JSON.parse(detail);
+            }
+            catch {
+                decision = { question: detail };
+            }
+            eventDetail = decision?.question?.trim() || detail;
+        }
+        events.add({
+            ts: Date.now(),
+            sessionId,
+            jobId: effectiveJobId,
+            source: "custom",
+            phase,
+            activityKind: phase === "blocked_on_user" ? "decision" : undefined,
+            detail: eventDetail,
+            targetWorker,
+            targetTask,
+            decisionId: phase === "blocked_on_user" ? decision?.id ?? randomUUID() : undefined,
+            decisionKind: phase === "blocked_on_user" ? decision?.kind ?? "question" : undefined,
+            choices: phase === "blocked_on_user" && Array.isArray(decision?.choices) ? decision.choices.slice(0, 6).map(String) : undefined,
+            recommendation: phase === "blocked_on_user" ? decision?.recommendation : undefined,
+            impact: phase === "blocked_on_user" ? decision?.impact : undefined,
+            context: phase === "blocked_on_user" ? decision?.context : undefined,
+        });
+        if (phase === "ready_for_review" && effectiveJobId) {
+            const missionId = missions.missionFor(effectiveJobId);
+            if (missions.get(missionId)) {
+                missions.setLifecycleStatus(missionId, "ready_for_review");
+                missions.updateContext(missionId, { compactSummary: detail.slice(0, 1_200), currentState: "Awaiting user acceptance" });
+            }
+        }
+        if ((phase === "delegating" || phase === "worker_reported" || phase === "reviewing") && effectiveJobId) {
+            const missionId = missions.missionFor(effectiveJobId);
+            if (missions.get(missionId)) {
+                // Best-effort: keeps plan task statuses truthful when the
+                // orchestrator emits activity without republishing the plan.
+                try {
+                    plans.applyTaskEvent(missionId, { phase, targetTask, targetWorker, evidence: phase === "worker_reported" ? detail : undefined });
+                }
+                catch { /* a later plan_updated remains the source of truth */ }
+            }
+        }
+        return { ok: true };
+    });
+    app.get("/api/mission/:missionId/plan", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        return { plan: plans.get(req.params.missionId), revisions: plans.revisions(req.params.missionId).map(({ revision, updatedAt }) => ({ revision, updatedAt })) };
+    });
+    app.get("/api/mission/:missionId/plan/revisions", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        return { revisions: plans.revisions(req.params.missionId) };
+    });
+    app.post("/api/mission/:missionId/plan", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        try {
+            return { plan: plans.replace(req.params.missionId, req.body) };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/gate/:gateId/waive", async (req, reply) => {
+        try {
+            const plan = plans.waiveGate(req.params.missionId, req.params.gateId, req.body?.reason ?? "");
+            const gate = plan.gates.find((item) => item.id === req.params.gateId);
+            const target = latestMissionTarget(req.params.missionId);
+            if (target)
+                events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "decision", detail: `Completion gate waived: ${gate.label}. Reason: ${gate.waiver?.reason}` });
+            return { ok: true, plan };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/plan/approval", async (req, reply) => {
+        if (req.body?.status !== "approved" && req.body?.status !== "rejected") {
+            reply.code(400);
+            return { error: "invalid plan approval status" };
+        }
+        try {
+            const plan = plans.setApproval(req.params.missionId, req.body.status, req.body.reason);
+            const target = latestMissionTarget(req.params.missionId);
+            if (target)
+                events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "decision", detail: req.body.status === "approved" ? `Plan revision ${plan.revision - 1} approved` : `Plan rejected: ${plan.approvalReason}` });
+            if (req.body.status === "rejected") {
+                try {
+                    await sendToMission(req.params.missionId, `The current plan was rejected. Revise it before continuing. Feedback: ${plan.approvalReason}`);
+                }
+                catch { /* rejection remains recorded even when no live job can resume */ }
+            }
+            return { ok: true, plan };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/orchestrator/start", async (req, reply) => {
+        const { task, name, cwd, templateId } = req.body;
+        if (!task) {
+            reply.code(400);
+            return { error: "task is required" };
+        }
+        try {
+            const template = templateId ? discoverTemplates(cwd).find((item) => item.id === templateId) : undefined;
+            if (templateId && !template) {
+                reply.code(400);
+                return { error: `mission template not found: ${templateId}` };
+            }
+            const mode = req.body.mode ?? template?.mode;
+            const budgets = { ...(template?.budgets ?? {}), ...(req.body.budgets ?? {}) };
+            const worktree = req.body.worktree ?? template?.worktree;
+            const policy = normalize({
+                ...policies.get(),
+                ...(template ? {
+                    commits: template.permissions.commits,
+                    pushes: template.permissions.pushes,
+                    pullRequests: template.permissions.pullRequests,
+                    releases: template.permissions.releases,
+                    destructiveActions: template.permissions.destructiveActions,
+                    networkAccess: template.permissions.network,
+                } : {}),
+                ...(req.body.policy ?? {}),
+            });
+            const resolvedCwd = requireWorkingDirectory(cwd);
+            enforceWorkingDirectory(resolvedCwd, policy);
+            const limits = Object.values(budgets).some(Boolean) ? `\n\nHive mission limits (soft boundaries): ${JSON.stringify(budgets)}. Stay within these limits. Before exceeding one, stop and emit blocked_on_user with a concrete approval request and the projected additional usage.` : "";
+            const templatePrompt = template ? `\n\nMission template ${template.name} v${template.version}: ${template.managerInstructions}\nPermissions: ${JSON.stringify(template.permissions)}. Request approval before any disallowed action.` : "";
+            const policyPrompt = `\n\nHive permission policy: ${JSON.stringify(policy)}. These are hard boundaries where enforced by CLI tool restrictions. Before any action outside the policy, stop and emit blocked_on_user with the exact access needed; do not attempt to bypass the restriction.`;
+            const provider = req.body.provider ?? "claude";
+            const model = req.body.model?.trim() || undefined;
+            const additionalRepos = detectRepositoryMentions(task, resolvedCwd);
+            const repoPrompt = additionalRepos.length ? `\n\n(Hive: you also have tool access to these repositories: ${additionalRepos.join(", ")})` : "";
+            const prompt = task + templatePrompt + limits + policyPrompt + repoPrompt;
+            const result = provider === "codex"
+                ? await codex.start({ task: prompt, cwd: resolvedCwd, name, model, mode, policy })
+                : await startOrchestrator({ task: prompt, worktree, name, cwd: resolvedCwd, mode, policy, model, addDirs: additionalRepos });
+            const mission = missions.create({
+                name,
+                objective: task,
+                repository: result.cwd,
+                jobId: result.jobId,
+                sessionId: result.sessionId,
+                mode,
+                budgets,
+                template: template ? { id: template.id, name: template.name, version: template.version, source: template.source } : undefined,
+                policy,
+                provider,
+                model,
+                additionalRepositories: additionalRepos,
+            });
+            messages.add({
+                id: `${result.jobId}:user`,
+                missionId: mission.id,
+                role: "user",
+                text: task,
+                createdAt: Date.now(),
+                jobId: result.jobId,
+            });
+            if (template)
+                plans.replace(mission.id, { phases: [{ id: "template", title: template.name, description: template.description, status: "queued", acceptanceCriteria: template.gates.map((gate) => gate.label), dependsOn: [], tasks: template.stages.map((stage, index) => ({ id: stage.id, title: stage.title, role: stage.role, status: "queued", weight: 1, dependsOn: stage.dependsOn ?? (index ? [template.stages[index - 1].id] : []), evidence: [] })) }], gates: template.gates });
+            return { ...result, missionId: mission.id };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/skills/discover", async (req, reply) => {
+        try {
+            return { skills: discoverSkills(req.body?.cwd) };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/session/:sessionId/adopt", async (req, reply) => {
+        const session = [...sessionsWatcher.getAll().values()].find((candidate) => candidate.sessionId === req.params.sessionId);
+        if (!session) {
+            reply.code(404);
+            return { error: "session not found" };
+        }
+        if (!session.jobId) {
+            reply.code(409);
+            return { error: "Only Claude background jobs can be adopted; this interactive process can still be ended or hidden." };
+        }
+        const existingId = missions.missionFor(session.jobId);
+        const existing = missions.get(existingId);
+        if (existing)
+            return { ok: true, missionId: existing.id };
+        const job = jobsWatcher.getAll().get(session.jobId);
+        const mission = missions.create({
+            name: req.body?.name ?? job?.name ?? session.name,
+            objective: job?.intent ?? job?.detail ?? "Adopted Claude session",
+            repository: session.cwd,
+            jobId: session.jobId,
+            sessionId: session.sessionId,
+            mode: "direct",
+        });
+        if (job?.intent)
+            messages.add({ id: `${session.jobId}:user`, missionId: mission.id, role: "user", text: job.intent, createdAt: Date.parse(job.createdAt ?? "") || Date.now(), jobId: session.jobId });
+        return { ok: true, missionId: mission.id };
+    });
+    app.post("/api/directories/suggest", async (req) => ({
+        directories: req.body?.input?.trim() ? suggestDirectories(req.body.input) : recentRepositories(),
+    }));
+    app.post("/api/paths/inspect", async (req) => inspectWorkingDirectory(req.body?.input));
+    app.post("/api/session/:pid/message", async (req, reply) => {
+        const pid = Number(req.params.pid);
+        const session = sessionsWatcher.getAll().get(pid);
+        if (!session) {
+            reply.code(404);
+            return { error: "session not found" };
+        }
+        if (!req.body.text) {
+            reply.code(400);
+            return { error: "text is required" };
+        }
+        const result = await sendMessage(session.sessionId, req.body.text);
+        const missionId = session.jobId
+            ? missions.missionFor(session.jobId)
+            : session.sessionId;
+        missions.linkJob(missionId, result.jobId, result.sessionId);
+        messages.add({
+            id: `${result.jobId}:user`,
+            missionId,
+            role: "user",
+            text: req.body.text,
+            createdAt: Date.now(),
+            jobId: result.jobId,
+        });
+        return { ok: true };
+    });
+    app.post("/api/mission/:missionId/message", async (req, reply) => {
+        const text = req.body?.text?.trim();
+        if (!text) {
+            reply.code(400);
+            return { error: "text is required" };
+        }
+        const native = matchNativeCommand(text);
+        if (native) {
+            const missionId = req.params.missionId;
+            if (!missions.get(missionId)) {
+                reply.code(404);
+                return { error: "mission not found" };
+            }
+            const jobRef = `native:${randomUUID()}`;
+            const summary = missions.summaryFor(missionId);
+            const target = native.scope === "session" ? latestMissionTarget(missionId) : undefined;
+            messages.add({ id: `${jobRef}:user`, missionId, role: "user", text, createdAt: Date.now(), jobId: jobRef });
+            // Runs out-of-band: native commands hang as background-session prompts,
+            // and the answer lands in the transcript when the CLI finishes.
+            void runNativeCommand(native, { cwd: summary.repository, sessionId: target?.sessionId })
+                .then((output) => messages.add({ id: `${jobRef}:assistant`, missionId, role: "assistant", text: output, createdAt: Date.now(), jobId: jobRef }))
+                .catch((err) => messages.add({ id: `${jobRef}:assistant`, missionId, role: "assistant", text: `⚠️ /${native.name} failed: ${err.message}`, createdAt: Date.now(), jobId: jobRef }));
+            return { ok: true, jobId: jobRef };
+        }
+        try {
+            const result = await sendToMission(req.params.missionId, text);
+            return { ok: true, jobId: result.jobId };
+        }
+        catch (err) {
+            reply.code(404);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/decision/:decisionId/answer", async (req, reply) => {
+        const answer = req.body?.answer?.trim();
+        if (!answer) {
+            reply.code(400);
+            return { error: "answer is required" };
+        }
+        const mission = missions.get(req.params.missionId);
+        if (!mission) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        // Parked permission prompts (decision id perm:<jobId>): a background
+        // session cannot answer its own prompt, so end the parked turn and
+        // resume the conversation with the verdict — pre-allowing the asked
+        // tool on approval so the retry does not park again.
+        if (req.params.decisionId.startsWith("perm:")) {
+            const jobId = req.params.decisionId.slice(5);
+            const job = jobsWatcher.getAll().get(jobId);
+            if (!job || job.tempo !== "blocked" || !job.needs) {
+                reply.code(409);
+                return { error: "permission request is no longer pending" };
+            }
+            const sessionId = job.sessionId ?? job.resumeSessionId;
+            if (!sessionId) {
+                reply.code(500);
+                return { error: "no session to resume" };
+            }
+            const approved = /^(approve|allow|yes)/i.test(answer);
+            const ask = parsePermissionAsk(job.needs);
+            const askLabel = ask ? `${ask.tool}: ${ask.detail}`.slice(0, 300) : job.needs.slice(0, 300);
+            try {
+                await stopSession(jobId);
+                const summary = missions.summaryFor(req.params.missionId);
+                const policy = summary.policy ?? policies.get();
+                const grant = approved ? permissionGrant(job.needs) : undefined;
+                const text = approved
+                    ? `Your permission request (${askLabel}) is approved and now pre-allowed. Re-run it and continue where you left off.`
+                    : `Your permission request (${askLabel}) was denied${/^deny$/i.test(answer) ? "" : ` — ${answer}`}. Continue without it or propose an alternative.`;
+                const result = await sendMessage(sessionId, text, grant ? { ...policy, allowedTools: [...policy.allowedTools, grant] } : policy);
+                missions.linkJob(req.params.missionId, result.jobId, result.sessionId);
+                messages.add({ id: `${result.jobId}:user`, missionId: req.params.missionId, role: "user", text, createdAt: Date.now(), jobId: result.jobId });
+                events.add({ ts: Date.now(), sessionId, jobId: result.jobId, source: "custom", phase: "decision_resolved", activityKind: "decision", detail: answer, decisionId: req.params.decisionId });
+                return { ok: true };
+            }
+            catch (err) {
+                reply.code(500);
+                return { error: err.message };
+            }
+        }
+        const nodeEvents = [...jobsWatcher.getAll()].filter(([jobId]) => missions.missionFor(jobId) === req.params.missionId).flatMap(([, job]) => [job.sessionId, job.resumeSessionId].filter((value) => Boolean(value))).flatMap((sessionId) => events.recentFor(sessionId, 200));
+        const pending = nodeEvents.find((event) => event.phase === "blocked_on_user" && event.decisionId === req.params.decisionId);
+        const alreadyResolved = nodeEvents.some((event) => event.phase === "decision_resolved" && event.decisionId === req.params.decisionId);
+        if (!pending || alreadyResolved) {
+            reply.code(409);
+            return { error: "decision is no longer pending" };
+        }
+        try {
+            const result = await sendToMission(req.params.missionId, `Answer to your pending question: ${answer}`);
+            events.add({ ts: Date.now(), sessionId: result.sessionId ?? pending.sessionId, jobId: result.jobId, source: "custom", phase: "decision_resolved", activityKind: "decision", detail: answer, decisionId: req.params.decisionId });
+            return { ok: true };
+        }
+        catch (err) {
+            reply.code(500);
+            return { error: err.message };
+        }
+    });
+    app.get("/api/mission/:missionId/messages", async (req) => {
+        const before = req.query.before ? Number(req.query.before) : undefined;
+        const limit = req.query.limit ? Number(req.query.limit) : undefined;
+        return messages.page(req.params.missionId, {
+            before: Number.isFinite(before) ? before : undefined,
+            limit: Number.isFinite(limit) ? limit : undefined,
+        });
+    });
+    app.get("/api/mission/:missionId/context", async (req, reply) => {
+        const mission = missions.get(req.params.missionId);
+        if (!mission) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const summary = missions.summaryFor(req.params.missionId);
+        const recentMessages = messages.modelContext(req.params.missionId);
+        const retrievedMessages = messages.relevantContext(req.params.missionId, `${summary.objective} ${summary.compactSummary ?? ""} ${summary.currentState ?? ""}`, new Set(recentMessages.map((message) => message.id)));
+        return { mission: summary, recentMessages, retrievedMessages, budgets: CONTEXT_BUDGETS, estimatedTokens: { summary: Math.ceil(((summary.compactSummary?.length ?? 0) + (summary.currentState?.length ?? 0)) / 4), recent: Math.ceil(recentMessages.reduce((sum, message) => sum + message.text.length, 0) / 4), retrieved: Math.ceil(retrievedMessages.reduce((sum, message) => sum + message.text.length, 0) / 4) } };
+    });
+    app.post("/api/mission/:missionId/context", async (req) => {
+        missions.updateContext(req.params.missionId, req.body ?? {});
+        return { ok: true };
+    });
+    app.post("/api/mission/:missionId/handoff", async (req, reply) => {
+        const mission = missions.get(req.params.missionId);
+        if (!mission) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        try {
+            return await withMissionQueue(req.params.missionId, async () => {
+                const recent = messages.modelContext(req.params.missionId);
+                const retrieved = messages.relevantContext(req.params.missionId, `${mission.objective} ${mission.compactSummary ?? ""} ${mission.currentState ?? ""}`, new Set(recent.map((message) => message.id)));
+                const target = latestMissionTarget(req.params.missionId);
+                const currentJob = target ? jobsWatcher.getAll().get(target.jobId) : undefined;
+                if (target && currentJob && ["working", "busy", "queued"].includes(currentJob.state)) {
+                    if (mission.provider === "codex")
+                        await codex.stop(target.jobId);
+                    else
+                        await stopSession(target.jobId);
+                }
+                const context = { objective: mission.objective, compactSummary: mission.compactSummary, currentState: mission.currentState, recentMessages: recent.map(({ role, text }) => ({ role, text })), relevantOlderMessages: retrieved.map(({ role, text }) => ({ role, text })), budgets: mission.budgets };
+                const prompt = `You are taking over an existing Hive mission from another manager. Continue the same mission without replaying completed work. Inspect current repository state, reconcile this bounded handoff context with reality, publish a fresh structured plan revision, and ask the user only when a genuine decision is required.\n\nHandoff context:\n${JSON.stringify(context)}`;
+                const result = mission.provider === "codex"
+                    ? await codex.start({ task: prompt, name: mission.name, cwd: mission.repository, mode: mission.mode, policy: mission.policy ?? policies.get(), model: mission.model })
+                    : await startOrchestrator({ task: prompt, name: mission.name, cwd: mission.repository, mode: mission.mode, worktree: false, policy: mission.policy, model: mission.model });
+                missions.linkJob(req.params.missionId, result.jobId, result.sessionId);
+                events.add({ ts: Date.now(), sessionId: result.sessionId, jobId: result.jobId, source: "custom", phase: "resuming", activityKind: "lifecycle", detail: `Manager handoff completed; replacement job ${result.jobId.slice(0, 8)} started with bounded context.` });
+                return { ok: true, jobId: result.jobId };
+            });
+        }
+        catch (err) {
+            reply.code(500);
+            return { error: err.message };
+        }
+    });
+    app.put("/api/mission/:missionId/policy", async (req, reply) => {
+        const mission = missions.get(req.params.missionId);
+        if (!mission) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        if (!req.body?.confirmed) {
+            reply.code(400);
+            return { error: "explicit confirmation is required to change a running mission's permissions" };
+        }
+        try {
+            const policy = normalize({ ...(mission.policy ?? policies.get()), ...(req.body.policy ?? {}) });
+            if (mission.repository)
+                enforceWorkingDirectory(mission.repository, policy);
+            missions.setPolicy(req.params.missionId, policy);
+            const target = latestMissionTarget(req.params.missionId);
+            if (target)
+                events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "decision", detail: `Mission permission policy updated by user: ${JSON.stringify(policy)}` });
+            return { policy };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/status", async (req, reply) => {
+        const allowed = ["active", "ready_for_review", "paused", "completed", "failed", "archived"];
+        if (!allowed.includes(req.body?.status)) {
+            reply.code(400);
+            return { error: "invalid mission status" };
+        }
+        if (req.body.status === "completed") {
+            const unresolved = plans.unresolvedRequiredGates(req.params.missionId);
+            const blocking = unresolved.filter((gate) => gate.type !== "user_approval");
+            if (blocking.length) {
+                reply.code(409);
+                return { error: `Resolve required completion gates first: ${blocking.map((gate) => gate.label).join(", ")}` };
+            }
+            plans.satisfyUserApprovalGates(req.params.missionId);
+        }
+        // Legacy Claude jobs can appear as mission cards before Hive has a durable
+        // record for them. setLifecycleStatus adopts those cards on first use.
+        const previous = missions.summaryFor(req.params.missionId).lifecycleStatus;
+        missions.setLifecycleStatus(req.params.missionId, req.body.status);
+        const target = latestMissionTarget(req.params.missionId);
+        if (target)
+            events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Mission status changed from ${previous} to ${req.body.status}` });
+        return { ok: true };
+    });
+    app.post("/api/mission/:missionId/action", async (req, reply) => {
+        const actions = {
+            status_summary: { label: "Immediate status summary requested", prompt: "Provide an immediate concise status summary: completed work, active work, blockers, verification, and the next concrete step. Update the structured plan if it is stale." },
+            plan_revision: { label: "Plan revision requested", prompt: "Review the current structured plan against actual progress and revise it now. Preserve stable task IDs, explain blockers, and identify the next milestone." },
+            review: { label: "Review requested", prompt: "Coordinate a fresh review of the current work before completion. Report findings, address important issues, and attach concrete evidence to the structured plan." },
+            test_pass: { label: "Verification pass requested", prompt: "Run or coordinate the relevant tests, typechecks, lint, and other verification for this mission. Report exact outcomes and attach evidence to the structured plan." },
+        };
+        const selected = actions[req.body?.action];
+        if (!selected) {
+            reply.code(400);
+            return { error: "invalid mission action" };
+        }
+        try {
+            const result = await sendToMission(req.params.missionId, selected.prompt);
+            events.add({ ts: Date.now(), sessionId: result.sessionId ?? latestMissionTarget(req.params.missionId)?.sessionId ?? result.jobId, jobId: result.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: selected.label });
+            return { ok: true, jobId: result.jobId };
+        }
+        catch (err) {
+            reply.code(404);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/task/:taskId/action", async (req, reply) => {
+        const plan = plans.get(req.params.missionId);
+        const task = plan?.phases.flatMap((phase) => allPlanTasks(phase.tasks)).find((item) => item.id === req.params.taskId);
+        if (!task) {
+            reply.code(404);
+            return { error: "plan task not found" };
+        }
+        const detail = req.body?.detail?.trim().slice(0, 1000);
+        const actions = {
+            retry: `Retry failed task ${task.id} (${task.title}) without replaying completed work. Diagnose the prior failure, delegate only the remaining scope, and update the plan with new evidence.`,
+            cancel: `Cancel task ${task.id} (${task.title}) and gracefully stop its assigned worker if still active. Preserve its reports and mark the task cancelled. Reason: ${detail || "User cancelled this task."}`,
+            replace_worker: `Replace the worker assigned to task ${task.id} (${task.title}) without stopping the mission. Preserve useful context and evidence, gracefully stop the previous worker if active, then delegate the remaining scope to a new worker. ${detail || ""}`,
+            reassign: `Reassign task ${task.id} (${task.title}) and update its owner/worker in the structured plan. New assignment guidance: ${detail || "Choose the most appropriate available worker."}`,
+            priority: `Change the priority of task ${task.id} (${task.title}) to ${detail || "high"}. Reorder eligible work and update dependencies only when necessary.`,
+        };
+        const prompt = actions[req.body?.action];
+        if (!prompt) {
+            reply.code(400);
+            return { error: "invalid task action" };
+        }
+        try {
+            const result = await sendToMission(req.params.missionId, prompt);
+            events.add({ ts: Date.now(), sessionId: result.sessionId ?? latestMissionTarget(req.params.missionId)?.sessionId ?? result.jobId, jobId: result.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Task control: ${req.body.action.replaceAll("_", " ")} · ${task.title}`, targetTask: task.id, targetWorker: task.workerId });
+            return { ok: true, jobId: result.jobId };
+        }
+        catch (err) {
+            reply.code(404);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/task", async (req, reply) => {
+        const description = req.body?.description?.trim().slice(0, 1000);
+        if (!description) {
+            reply.code(400);
+            return { error: "task description is required" };
+        }
+        if (!plans.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission plan not found" };
+        }
+        try {
+            const result = await sendToMission(req.params.missionId, `Add this task to the current structured plan with a stable ID, appropriate priority, dependencies, owner, and acceptance evidence; then schedule it without replaying completed work: ${description}`);
+            events.add({ ts: Date.now(), sessionId: result.sessionId ?? latestMissionTarget(req.params.missionId)?.sessionId ?? result.jobId, jobId: result.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Task addition requested: ${description}` });
+            return { ok: true, jobId: result.jobId };
+        }
+        catch (err) {
+            reply.code(404);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/mission/:missionId/rename", async (req, reply) => {
+        if (typeof req.body?.name !== "string") {
+            reply.code(400);
+            return { error: "name is required" };
+        }
+        missions.rename(req.params.missionId, req.body.name);
+        return { ok: true };
+    });
+    app.delete("/api/mission/:missionId", async (req, reply) => {
+        const target = latestMissionTarget(req.params.missionId);
+        if (target)
+            events.add({ ts: Date.now(), ...target, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Mission permanently deleted: ${req.params.missionId}` });
+        if (!missions.remove(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        messages.removeMission(req.params.missionId);
+        plans.removeMission(req.params.missionId);
+        return { ok: true };
+    });
+    app.post("/api/session/:pid/stop", async (req, reply) => {
+        const pid = Number(req.params.pid);
+        const targetSession = sessionsWatcher.getAll().get(pid);
+        if (!targetSession) {
+            reply.code(404);
+            return { error: "session not found" };
+        }
+        if (req.body?.force) {
+            forceStopSession(pid);
+        }
+        else {
+            if (!targetSession.jobId) {
+                reply.code(409);
+                return { error: "session is not associated with a background job" };
+            }
+            const missionId = missions.missionFor(targetSession.jobId);
+            if (missions.summaryFor(missionId).provider === "codex")
+                await codex.stop(targetSession.jobId);
+            else
+                await stopSession(targetSession.jobId);
+        }
+        events.add({ ts: Date.now(), sessionId: targetSession.sessionId, jobId: targetSession.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: req.body?.force ? "Force stop requested" : "Graceful stop requested" });
+        return { ok: true };
+    });
+}
+function sessionForId(watcher, sessionId) {
+    for (const session of watcher.getAll().values()) {
+        if (session.sessionId === sessionId)
+            return session;
+    }
+    return undefined;
+}