@shanesaravia/hive 0.2.1 → 0.4.0

package/packages/server/dist/api/ws.js

@@ -1,17 +1,58 @@
 import { buildFleetSnapshot } from "../roster/rosterBuilder.js";
+/** Strictly parse the only client messages that may affect terminal delivery. */
+export function parseTerminalSubscription(raw) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const message = raw;
+    if (message.type !== "terminal/subscribe" && message.type !== "terminal/unsubscribe")
+        return undefined;
+    if (typeof message.missionId !== "string" || !message.missionId.trim())
+        return undefined;
+    if (message.source !== undefined && typeof message.source !== "string")
+        return undefined;
+    const source = typeof message.source === "string" ? message.source.trim() : "orchestrator";
+    if (!source)
+        return undefined;
+    const numericAfter = typeof message.after === "number" ? message.after : 0;
+    return {
+        action: message.type === "terminal/subscribe" ? "subscribe" : "unsubscribe",
+        missionId: message.missionId.trim(),
+        source,
+        after: Number.isFinite(numericAfter) ? Math.max(0, Math.floor(numericAfter)) : 0,
+    };
+}
 /**
  * Single WS endpoint pushing roster + event deltas. The frontend never polls
  * REST for live state — this is the only steady-state channel.
  */
 export function registerWs(app, deps) {
-    const { sessionsWatcher, jobsWatcher, events, missions, messages, plans } = deps;
+    const { sessionsWatcher, jobsWatcher, events, missions, messages, plans, workerIdentity, terminalStream, terminalObservability, webBuild } = deps;
     const clients = new Set();
+    const terminalSubscriptions = new Map();
+    // Every roster the client ever sees is built the same way. The first one
+    // used to be built without the identity store, so a reload resolved workers
+    // from the bare event window and the next broadcast disagreed with it.
+    const currentRoster = () => buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans, Date.now(), workerIdentity);
+    let lastRosterJson = "";
     function broadcastRoster() {
-        const snapshot = buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans);
-        const msg = JSON.stringify({ type: "roster", snapshot });
+        lastRosterJson = JSON.stringify({ type: "roster", snapshot: currentRoster() });
         for (const client of clients)
-            client.send(msg);
+            client.send(lastRosterJson);
     }
+    // Time-based rules — correlation graces, the stop-settle, stalled work — used
+    // to take effect only when some unrelated event happened to arrive. A short
+    // ticker re-derives the roster and pushes it only when something changed.
+    const ticker = setInterval(() => {
+        if (!clients.size)
+            return;
+        const next = JSON.stringify({ type: "roster", snapshot: currentRoster() });
+        if (next === lastRosterJson)
+            return;
+        lastRosterJson = next;
+        for (const client of clients)
+            client.send(next);
+    }, 1_500);
+    app.addHook("onClose", async () => { clearInterval(ticker); });
     function broadcastEvent(event) {
         const msg = JSON.stringify({ type: "event", event });
         for (const client of clients)
@@ -26,12 +67,52 @@ export function registerWs(app, deps) {
         broadcastEvent(event);
         broadcastRoster();
     });
+    const stopTerminalEvents = terminalStream.onEvent((event) => {
+        const key = `${event.missionId}:${event.source}`;
+        const message = JSON.stringify({ type: "terminal/event", event });
+        for (const client of clients) {
+            if (!terminalSubscriptions.get(client)?.has(key))
+                continue;
+            // A slow browser catches up through sequence replay; never let terminal
+            // output grow the ws library's pending buffer without bound.
+            if (client.readyState === 1 && client.bufferedAmount < 1_000_000)
+                client.send(message);
+            else
+                terminalObservability.metric("stream.slow_client_recovery");
+        }
+    });
+    app.addHook("onClose", async () => stopTerminalEvents());
     app.get("/ws", { websocket: true }, (socket) => {
         clients.add(socket);
-        socket.send(JSON.stringify({
-            type: "roster",
-            snapshot: buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans),
-        }));
-        socket.on("close", () => clients.delete(socket));
+        terminalSubscriptions.set(socket, new Set());
+        if (webBuild)
+            socket.send(JSON.stringify({ type: "hello", build: webBuild }));
+        socket.send(JSON.stringify({ type: "roster", snapshot: currentRoster() }));
+        socket.on("message", (raw) => {
+            let parsed;
+            try {
+                parsed = JSON.parse(String(raw));
+            }
+            catch {
+                return;
+            }
+            const message = parseTerminalSubscription(parsed);
+            if (!message)
+                return;
+            const { missionId, source } = message;
+            const key = `${missionId}:${source}`;
+            if (message.action === "unsubscribe") {
+                terminalSubscriptions.get(socket)?.delete(key);
+                return;
+            }
+            terminalSubscriptions.get(socket)?.add(key);
+            const replay = terminalStream.replay(missionId, source, message.after);
+            terminalObservability.metric(message.after > 0 ? "stream.reconnect" : "stream.subscription");
+            if (replay.truncated)
+                terminalObservability.metric("stream.truncated_recovery");
+            if (socket.readyState === 1)
+                socket.send(JSON.stringify({ type: "terminal/replay", missionId, source, ...replay }));
+        });
+        socket.on("close", () => { clients.delete(socket); terminalSubscriptions.delete(socket); });
     });
 }

package/packages/server/dist/control/launcher.js

@@ -20,11 +20,23 @@ export async function startOrchestrator(opts) {
     const args = buildLaunchArgs(opts);
     const before = new Set(listSessionFiles());
     const cwd = requireWorkingDirectory(opts.cwd);
-    const child = spawn("claude", args, { cwd, detached: true, stdio: "ignore" });
+    // stderr is piped rather than ignored: when the CLI refuses to launch it
+    // says exactly why, and throwing that away left every refusal looking like
+    // the same 30-second timeout. The pipe is drained and the child is still
+    // unref'd, so nothing keeps the server alive.
+    const child = spawn("claude", args, { cwd, detached: true, stdio: ["ignore", "ignore", "pipe"] });
+    // `claude --bg` detaches and exits at once on the happy path, so an exit is
+    // not a failure — only a non-zero one is. Reading the exit alone as failure
+    // aborts every successful launch before its session can register.
+    const refusal = { text: "", failed: false };
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => { refusal.text = (refusal.text + chunk).slice(0, 2000); });
+    child.once("exit", (code) => { refusal.failed = (code ?? 0) !== 0; });
+    child.once("error", (error) => { refusal.text ||= error.message; refusal.failed = true; });
     child.unref();
     // Worktree launches must copy/check out the repo before the session
     // registers, which can take well over 8s on large repositories.
-    const session = await waitForNewSession(before, opts.worktree ? 30000 : 8000);
+    const session = await waitForNewSession(before, opts.worktree ? 30000 : 8000, refusal);
     if (!session.jobId) {
         throw new Error("Orchestrator session started without a background job ID");
     }
@@ -45,13 +57,29 @@ export function generateWorktreeName(missionName) {
     const suffix = Math.random().toString(36).slice(2, 8);
     return slug ? `hive-${slug}-${suffix}` : `hive-${suffix}`;
 }
+/**
+ * The permission mode a background session runs in.
+ *
+ * Nothing is watching a background job's TTY, so any mode that stops to ask a
+ * question is a mode that can park a mission indefinitely. That is why this
+ * was "bypassPermissions" — but the CLI now requires a one-time interactive
+ * disclaimer before --bg will accept it, which is not something a server can
+ * agree to on the user's behalf, so every launch failed outright.
+ *
+ * "auto" takes it. It is also the mode that should have been asked for: it
+ * still declines what it judges genuinely dangerous rather than waiving every
+ * check, and Hive already surfaces a parked mission as a decision the user can
+ * answer from the board. A prompt nobody sees is the thing to avoid; a prompt
+ * Hive can put in front of someone is the product working.
+ *
+ * The policy remains the real boundary either way, and it is a stronger one
+ * than a prompt: `--disallowedTools` denies rm, git reset --hard, git clean,
+ * releases and publishes outright, and a denied tool cannot be used at any
+ * permission level.
+ */
+export const PERMISSION_MODE = "auto";
 export function buildLaunchArgs(opts) {
-    const args = [
-        "--bg",
-        // Background sessions have no TTY to answer permission prompts — "auto"
-        // (the mode Claude Code's own background jobs use) lets it proceed
-        // without stalling. disallowedTools remains the actual safety boundary.
-    ];
+    const args = ["--bg"];
     // Variadic --add-dir must come before the trailing task positional, with a
     // flag after it, or it would swallow the task as another directory.
     if (opts.addDirs?.length)
@@ -64,7 +92,7 @@ export function buildLaunchArgs(opts) {
         args.push("--disallowedTools", [...new Set(denied)].join(","));
     if (opts.policy?.allowedTools.length)
         args.push("--allowedTools", opts.policy.allowedTools.join(","));
-    args.push("--permission-mode", "auto");
+    args.push("--permission-mode", PERMISSION_MODE);
     if (opts.worktree) {
         // Always pass an explicit name: the CLI's --worktree greedily consumes the
         // next non-flag argument, so a bare --worktree would swallow the task
@@ -93,7 +121,9 @@ function listSessionFiles() {
  * new session is up is its sessions/<pid>.json file appearing. Poll the
  * filesystem briefly (startup confirmation only, not steady-state polling).
  */
-async function waitForNewSession(before, timeoutMs) {
+async function waitForNewSession(before, timeoutMs, 
+/** What the CLI said on its way out, if it refused to start at all. */
+refusal) {
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {
         const now = listSessionFiles();
@@ -108,7 +138,16 @@ async function waitForNewSession(before, timeoutMs) {
                 // The daemon may still be writing the newly discovered file.
             }
         }
+        // A CLI that has already failed is never going to register a session, so
+        // report what it said instead of waiting out the rest of the timeout.
+        if (refusal?.failed)
+            throw new Error(launchFailure(refusal.text));
         await new Promise((r) => setTimeout(r, 250));
     }
-    throw new Error("Timed out waiting for orchestrator session to start");
+    throw new Error(refusal?.text ? launchFailure(refusal.text) : "Timed out waiting for orchestrator session to start");
+}
+/** The CLI's own words, trimmed to the part worth putting on a banner. */
+export function launchFailure(stderr) {
+    const said = stderr.split("\n").map((line) => line.trim()).filter(Boolean).join(" ").trim();
+    return said ? `Claude CLI refused to start the mission: ${said}` : "Claude CLI exited before the mission started";
 }

package/packages/server/dist/control/messaging.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 import { config } from "../config.js";
 import { disallowedTools } from "../policies/policiesStore.js";
+import { PERMISSION_MODE } from "./launcher.js";
 const execFileAsync = promisify(execFile);
 /**
  * Sends a follow-up message into a running session. The per-session Unix
@@ -22,10 +23,10 @@ export function buildResumeArgs(sessionId, text, policy, addDirs) {
     // The prompt positional must precede --resume/--bg: trailing positionals are
     // silently dropped on resumed background turns (the session starts idle,
     // "send a prompt to start", and never replies).
-    // Resumes inherit the session's permission mode today, but pin auto
+    // Resumes inherit the session's permission mode today, but pin it
     // explicitly so a CLI change can never drop follow-up turns into a
     // prompting mode no background session can answer.
-    const args = [text, "--resume", sessionId, "--bg", "--permission-mode", "auto"];
+    const args = [text, "--resume", sessionId, "--bg", "--permission-mode", PERMISSION_MODE];
     const denied = policy ? disallowedTools(policy) : [];
     if (denied.length)
         args.push("--disallowedTools", denied.join(","));

package/packages/server/dist/control/missionQuiesce.js

@@ -0,0 +1,66 @@
+/**
+ * Job states in which the provider is holding a turn open — running one, or
+ * parked partway through one waiting for an answer. A resume cannot join a
+ * turn that is already in progress; it starts a second one beside it.
+ */
+const MID_TURN_JOB_STATES = ["working", "busy", "queued", "blocked"];
+/**
+ * Whether the provider can still act through this job.
+ *
+ * Live is not the same as mid-turn, and reading it that way is what let this
+ * go unnoticed for a day. A background orchestrator that has finished its turn
+ * keeps whatever it armed while running — background monitors, scheduled
+ * wake-ups, polling shells — and the daemon brings it back to act on them
+ * minutes or hours later. Mission f7ae71c7's first manager sat at "blocked"
+ * for 24 hours and spawned workers, pushed commits and re-closed gates the
+ * whole time.
+ *
+ * The session record is the honest signal: the daemon writes one while the
+ * session exists and removes it when the session is gone. While it is there,
+ * something can still wake the job.
+ */
+export function jobIsLive(jobId, job, sessions) {
+    if (MID_TURN_JOB_STATES.includes(job.state))
+        return true;
+    for (const session of sessions) {
+        if (session.jobId === jobId)
+            return true;
+        if (job.sessionId && session.sessionId === job.sessionId)
+            return true;
+        if (job.resumeSessionId && session.sessionId === job.resumeSessionId)
+            return true;
+    }
+    return false;
+}
+/**
+ * The jobs that must be stopped before a mission is resumed, so that the
+ * resume leaves exactly one manager able to act.
+ *
+ * `claude --resume` forks. The session it resumes goes on running — with its
+ * armed monitors, its scheduled wake-ups and its background shells intact —
+ * while the fork carries the conversation on under a fresh session id, and
+ * Hive repoints the mission at the fork. Nothing ever addresses the old branch
+ * again, but nothing stops it either. On mission f7ae71c7 thirteen sends left
+ * five managers alive at once against one worktree and one merge request: each
+ * re-closed the same gate, each spawned its own worker for the same plan task,
+ * and each read the others' commits as changes it had never asked for and
+ * blamed them on its own worker.
+ *
+ * The resume target is spared while it is between turns — that is the ordinary
+ * case, where the resume continues the conversation rather than branching it.
+ * A target that is mid-turn or parked is stopped first, which is what the
+ * handoff and parked-permission paths already do before resuming.
+ */
+export function jobsToQuiesce(input) {
+    const stop = [];
+    for (const { jobId, job, missionId } of input.jobs) {
+        if (missionId !== input.missionId)
+            continue;
+        if (!jobIsLive(jobId, job, input.sessions))
+            continue;
+        if (jobId === input.targetJobId && !MID_TURN_JOB_STATES.includes(job.state))
+            continue;
+        stop.push(jobId);
+    }
+    return stop;
+}

package/packages/server/dist/health/deriveAlerts.js

@@ -1,3 +1,4 @@
+import { matchesWorker } from "@hive/shared";
 const LONG_RUNNING_MS = 15 * 60 * 1000;
 const HIGH_TOKEN_TURN = 20_000;
 const MIN_TOKEN_ALERT_RUNTIME_MS = 5 * 60 * 1000;
@@ -7,6 +8,14 @@ export function deriveAlerts(input) {
     const alerts = [];
     if (input.stale)
         alerts.push({ id: "stale-job", severity: "critical", title: "Stale job state", explanation: "Claude reports this job as working, but Hive cannot find its live process.", evidence: "A working/busy job record exists without a matching session record.", recovery: "Restart or resume the mission; archive the stale record if the work is no longer needed." });
+    // A mission is meant to have one manager. More than one means a resume
+    // forked instead of continuing, and the extras did not stop: they share the
+    // worktree, the branch and the plan, so each redoes the other's work and
+    // reads the other's commits as changes it never made. The board shows only
+    // the newest, which is exactly why this needs saying.
+    const live = input.liveJobIds ?? [];
+    if (live.length > 1)
+        alerts.push({ id: "concurrent-jobs", severity: "critical", title: "More than one manager is live on this mission", explanation: "Several orchestrator jobs for this mission can still act, and they share one worktree, branch and plan. Expect duplicated delegations, repeated gate transitions, and each manager reporting the others' commits as work it never asked for.", evidence: `${live.length} live jobs: ${live.map((jobId) => jobId.slice(0, 8)).join(", ")}`, recovery: "Send the mission a message: resuming now stops every superseded manager first. Any that survive that can be stopped from the sessions list." });
     for (const worker of input.workers.filter((item) => !item.doneAt && (item.jobState === "working" || item.jobState === "busy"))) {
         const workerEvents = input.events.filter((event) => matchesWorker(event.targetWorker, worker));
         const lastUpdate = Math.max(worker.startedAt, worker.jobUpdatedAt ?? 0, ...workerEvents.map((event) => event.ts));
@@ -50,6 +59,4 @@ export function deriveAlerts(input) {
         alerts.push({ id: "unclear-wait", severity: "warning", title: "Waiting without a clear question", explanation: "The runtime says it needs user input, but Hive has no structured pending decision to display.", evidence: "Waiting state present; no unresolved blocked_on_user event found.", recovery: "Open the mission and ask the orchestrator to state one concrete question with choices and a recommendation." });
     return alerts;
 }
-function matchesWorker(target, worker) { if (!target)
-    return false; const value = target.toLowerCase(); return value === worker.id.toLowerCase() || value === worker.label.toLowerCase() || worker.id.toLowerCase().startsWith(value) || worker.label.toLowerCase().includes(value); }
 function minutes(ms) { return Math.max(1, Math.floor(ms / 60_000)); }

package/packages/server/dist/hooks/hookIngest.js

@@ -1,3 +1,4 @@
+import { ORCHESTRATOR_AGENT_NAME } from "@hive/shared";
 const SUMMARY_LIMIT = 140;
 const RAW_STRING_LIMIT = 2_000;
 const SECRET_KEY = /(token|secret|password|authorization|cookie|api[_-]?key)/i;
@@ -57,11 +58,64 @@ export function skillPromptEvents(payload, jobId) {
             }];
     });
 }
+/**
+ * Structured worker attribution. Only a provider agent id may name a person:
+ * `agent_type` is a role shared by many workers and previously landed in the
+ * same field, which could merge two workers or split one in two.
+ *
+ * For an Agent launch the payload's top-level ids belong to the *launching*
+ * agent, so they become the parent and the new worker's id comes from the tool
+ * response. That is what lets a worker's own sub-agent roll up into it instead
+ * of taking a desk of its own.
+ */
+function workerRef(payload) {
+    const top = record(payload);
+    const response = record(payload.tool_response);
+    const input = record(payload.tool_input);
+    // A launch that errored still launched: the provider returns the child id in
+    // the failure response too, and the child may already have started.
+    const launch = (payload.hook_event_name === "PostToolUse" || payload.hook_event_name === "PostToolUseFailure") && payload.tool_name === "Agent";
+    const agentId = launch
+        ? stringField(response, "agentId", "agent_id")
+        : stringField(top, "agent_id", "subagent_id");
+    const parentAgentId = launch
+        ? stringField(top, "agent_id", "subagent_id")
+        : stringField(top, "parent_agent_id", "parent_id", "parent_agent");
+    const ref = {
+        agentId,
+        agentType: stringField(top, "agent_type"),
+        label: launch
+            ? stringField(response, "description") ?? stringField(input, "description") ?? stringField(input, "subagent_type")
+            : stringField(top, "agent_name", "teammate_name", "description"),
+        // A worker's parent is only meaningful when it is another worker.
+        parentAgentId: parentAgentId && parentAgentId !== agentId && parentAgentId !== ORCHESTRATOR_AGENT_NAME ? parentAgentId : undefined,
+    };
+    return Object.values(ref).some(Boolean) ? ref : undefined;
+}
+/**
+ * A tool call that leaves work running past the end of the agent's turn.
+ *
+ * Three shapes: a backgrounded shell command; `Monitor`, which is the sanctioned
+ * way to wait (foreground sleep is blocked) and always outlives the turn; and an
+ * `Agent` launch the provider answered `isAsync`, which leaves the *launcher*
+ * waiting on a child. Missing the last two made a waiting worker look retired.
+ */
+function backgrounded(payload) {
+    const input = record(payload.tool_input);
+    if (input.run_in_background === true || input.runInBackground === true)
+        return true;
+    if (payload.tool_name === "Monitor" && (payload.hook_event_name === "PostToolUse" || payload.hook_event_name === "PreToolUse"))
+        return true;
+    if (payload.tool_name === "Agent" && payload.hook_event_name === "PostToolUse" && record(payload.tool_response).isAsync === true)
+        return true;
+    return undefined;
+}
 function evidence(payload) {
     const input = record(payload.tool_input);
     const tool = payload.tool_name ?? "";
     const command = stringField(input, "command");
     const filePath = stringField(input, "file_path", "path", "notebook_path");
+    const ref = workerRef(payload);
     let targetWorker = stringField(payload, "agent_id", "subagent_id", "agent_name", "agent_type", "teammate_name");
     // Agent launches are emitted by the manager, so the payload's top-level
     // agent_type is `hive-orchestrator`. Claude returns the durable worker id in
@@ -71,28 +125,32 @@ function evidence(payload) {
         targetWorker = stringField(record(payload.tool_response), "agentId", "agent_id") ?? targetWorker;
     }
     if (["TaskCreated", "TaskCompleted", "TeammateIdle"].includes(payload.hook_event_name))
-        return { activityKind: "agent", targetWorker };
+        return { activityKind: "agent", targetWorker, workerRef: ref };
+    // The provider's idle notification fires after every turn; it means "the
+    // session is idle", not "the assistant asked you something".
+    if (payload.hook_event_name === "Notification" && payload.notification_type === "idle_prompt")
+        return { activityKind: "agent", targetWorker, workerRef: ref };
     if (["PermissionRequest", "PermissionDenied", "Elicitation", "ElicitationResult", "Notification"].includes(payload.hook_event_name))
-        return { activityKind: "decision", targetWorker };
+        return { activityKind: "decision", targetWorker, workerRef: ref };
     if (["InstructionsLoaded", "ConfigChange"].includes(payload.hook_event_name))
-        return { activityKind: "file_read", filePath: stringField(payload, "file_path", "path"), targetWorker };
+        return { activityKind: "file_read", filePath: stringField(payload, "file_path", "path"), targetWorker, workerRef: ref };
     if (["WorktreeCreate", "WorktreeRemove"].includes(payload.hook_event_name))
-        return { activityKind: "output", artifactPath: stringField(payload, "worktree_path", "path"), targetWorker };
+        return { activityKind: "output", artifactPath: stringField(payload, "worktree_path", "path"), targetWorker, workerRef: ref };
     if (payload.hook_event_name === "SubagentStart" || payload.hook_event_name === "SubagentStop")
-        return { activityKind: "agent", targetWorker };
+        return { activityKind: "agent", targetWorker, workerRef: ref };
     if (tool === "Read" || tool === "Glob" || tool === "Grep")
-        return { activityKind: "file_read", filePath, targetWorker };
+        return { activityKind: "file_read", filePath, targetWorker, workerRef: ref };
     if (["Edit", "Write", "NotebookEdit"].includes(tool)) {
         const artifactPath = filePath && /\.(png|jpe?g|webp|gif|svg|pdf|docx?|xlsx?|pptx?|zip)$/i.test(filePath) ? filePath : undefined;
-        return { activityKind: artifactPath ? "output" : "file_write", filePath, artifactPath, targetWorker };
+        return { activityKind: artifactPath ? "output" : "file_write", filePath, artifactPath, targetWorker, workerRef: ref };
     }
     if (tool === "Bash") {
         const isTest = Boolean(command && /(^|\s)(test|pytest|vitest|jest|mocha|cargo test|go test|npm test|npm run test|typecheck|lint)(\s|$)/i.test(command));
-        return { activityKind: isTest ? "test" : "command", command: command?.slice(0, 500), targetWorker };
+        return { activityKind: isTest ? "test" : "command", command: command?.slice(0, 500), targetWorker, workerRef: ref };
     }
     if (payload.hook_event_name === "StopFailure")
-        return { activityKind: "lifecycle", targetWorker };
-    return { activityKind: payload.tool_name ? "tool" : "lifecycle", targetWorker };
+        return { activityKind: "lifecycle", targetWorker, workerRef: ref };
+    return { activityKind: payload.tool_name ? "tool" : "lifecycle", targetWorker, workerRef: ref };
 }
 function outcome(payload) {
     if (payload.hook_event_name === "PostToolUseFailure" || payload.hook_event_name === "StopFailure" || payload.hook_event_name === "PermissionDenied")
@@ -129,5 +187,6 @@ export function toHiveEvent(payload, jobId) {
         outcome: outcome(payload),
         rawPayload: sanitizeRaw(payload),
         ...evidence(payload),
+        backgrounded: backgrounded(payload),
     };
 }

package/packages/server/dist/index.js

@@ -2,7 +2,7 @@ import Fastify from "fastify";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import websocket from "@fastify/websocket";
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { config } from "./config.js";
@@ -12,12 +12,17 @@ import { EventsStore } from "./events/eventsStore.js";
 import { MissionsStore } from "./missions/missionsStore.js";
 import { MessagesStore } from "./messages/messagesStore.js";
 import { PlansStore } from "./plans/plansStore.js";
+import { WorkerIdentityStore } from "./roster/workerIdentity.js";
 import { registerRest } from "./api/rest.js";
 import { registerWs } from "./api/ws.js";
 import { drainHookSpool } from "./hooks/hookSpool.js";
 import { PoliciesStore } from "./policies/policiesStore.js";
 import { CodexRuntime } from "./control/codexRuntime.js";
+import { LoopStore } from "./loops/loopStore.js";
+import { LoopScheduler } from "./loops/loopScheduler.js";
 import { allowedBrowserOrigins, browserOriginAllowed } from "./security/originPolicy.js";
+import { TerminalRuntime } from "./terminals/terminalRuntime.js";
+import { TerminalObservability } from "./terminals/terminalObservability.js";
 async function main() {
     const app = Fastify({ logger: true });
     const browserOrigins = allowedBrowserOrigins({
@@ -41,8 +46,12 @@ async function main() {
     const missions = new MissionsStore();
     const messages = new MessagesStore();
     const plans = new PlansStore();
+    const workerIdentity = new WorkerIdentityStore();
     const policies = new PoliciesStore();
     const codex = new CodexRuntime();
+    const terminalObservability = new TerminalObservability((record) => app.log.info({ terminalAudit: record }, "terminal input operation"));
+    const terminalRuntime = new TerminalRuntime(undefined, undefined, terminalObservability);
+    const loops = new LoopStore();
     events.init();
     policies.init();
     codex.init();
@@ -58,12 +67,34 @@ async function main() {
     messages.syncJobs(jobsWatcher.getAll(), missions);
     jobsWatcher.onJobsChange((jobs) => messages.syncJobs(jobs, missions));
     missions.onChange(() => messages.syncJobs(jobsWatcher.getAll(), missions));
-    registerRest(app, { sessionsWatcher, jobsWatcher, events, missions, messages, plans, policies, codex });
-    registerWs(app, { sessionsWatcher, jobsWatcher, events, missions, messages, plans });
-    app.get("/health", async () => ({ ok: true }));
     const webRoot = process.env.HIVE_WEB_DIST
         ? path.resolve(process.env.HIVE_WEB_DIST)
         : fileURLToPath(new URL("../../web/dist/", import.meta.url));
+    // Identifies the web bundle this server serves. A tab that loaded an older
+    // bundle reconnects after a restart and keeps running old code against new
+    // data — a fixed bug reported again from a stale tab. The client reloads
+    // when this changes.
+    const webBuild = webBuildId(webRoot);
+    const { sendToMission } = registerRest(app, { sessionsWatcher, jobsWatcher, events, missions, messages, plans, policies, codex, workerIdentity, terminalRuntime, loops });
+    // Loops survive a restart because they live in the database, so the
+    // scheduler picks up whatever was already running the moment it starts.
+    const loopScheduler = new LoopScheduler({
+        loops,
+        send: (missionId, prompt) => sendToMission(missionId, prompt),
+        // Never interrupt a live turn: a loop that fires mid-conversation would
+        // quiesce whatever the agent is currently saying.
+        isBusy: (missionId) => [...jobsWatcher.getAll()].some(([jobId, job]) => missions.missionFor(jobId) === missionId && job.state !== "done" && job.state !== "failed"),
+        // A finished or archived mission has no session left to wake.
+        isRunnable: (missionId) => {
+            const lifecycle = missions.get(missionId)?.lifecycleStatus;
+            return Boolean(lifecycle) && lifecycle !== "archived" && lifecycle !== "completed";
+        },
+        onError: (loop, error) => app.log.warn({ loopId: loop.id, missionId: loop.missionId, err: error.message }, "loop turn failed"),
+    });
+    loopScheduler.start();
+    registerWs(app, { sessionsWatcher, jobsWatcher, events, missions, messages, plans, workerIdentity, terminalStream: terminalRuntime.stream, terminalObservability, webBuild });
+    app.addHook("onClose", async () => terminalRuntime.close());
+    app.get("/health", async () => ({ ok: true, webBuild }));
     const isCompiledRuntime = fileURLToPath(import.meta.url).includes(`${path.sep}dist${path.sep}`);
     if (existsSync(path.join(webRoot, "index.html"))) {
         await app.register(fastifyStatic, { root: webRoot });
@@ -82,6 +113,15 @@ async function main() {
     if (replayedHooks)
         app.log.info(`replayed ${replayedHooks} hook event(s) captured while Hive was offline`);
 }
+function webBuildId(webRoot) {
+    try {
+        const entry = readdirSync(path.join(webRoot, "assets")).find((file) => /^index-.*\.js$/.test(file));
+        if (entry)
+            return entry;
+    }
+    catch { /* no built bundle: dev server, or tests */ }
+    return `dev-${process.pid}-${Date.now()}`;
+}
 main().catch((err) => {
     console.error(err);
     process.exit(1);

package/packages/server/dist/loops/loopCommand.js

@@ -0,0 +1,56 @@
+/** The shortest useful cadence; anything faster is a runaway, not a loop. */
+export const MIN_LOOP_INTERVAL_MS = 30_000;
+export const MAX_LOOP_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export const DEFAULT_LOOP_INTERVAL_MS = 5 * 60 * 1000;
+const UNITS = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+/**
+ * "5m", "30s", "1h30m" — the same shorthand the CLI's own `/loop` accepts.
+ * Returns undefined for anything that is not purely an interval, so a prompt
+ * beginning with a word is never silently eaten as a duration.
+ */
+export function parseInterval(token) {
+    const trimmed = token.trim().toLowerCase();
+    if (!trimmed || !/^(\d+(?:\.\d+)?[smhd])+$/.test(trimmed))
+        return undefined;
+    let total = 0;
+    for (const [, amount, unit] of trimmed.matchAll(/(\d+(?:\.\d+)?)([smhd])/g)) {
+        total += Number(amount) * UNITS[unit];
+    }
+    return total > 0 ? total : undefined;
+}
+export function formatInterval(ms) {
+    const hours = Math.floor(ms / 3_600_000);
+    const minutes = Math.floor((ms % 3_600_000) / 60_000);
+    const seconds = Math.round((ms % 60_000) / 1000);
+    return [hours && `${hours}h`, minutes && `${minutes}m`, seconds && `${seconds}s`].filter(Boolean).join("") || "0s";
+}
+/**
+ * Reads `/loop …` typed into a mission conversation.
+ *
+ * Returns undefined when the text is not a loop command at all, so ordinary
+ * messages fall straight through to the mission.
+ */
+export function parseLoopCommand(text) {
+    const match = text.trim().match(/^\/loop\b\s*([\s\S]*)$/i);
+    if (!match)
+        return undefined;
+    const rest = match[1].trim();
+    if (!rest || rest.toLowerCase() === "list")
+        return { kind: "list" };
+    const stop = rest.match(/^stop\b\s*(\S*)$/i);
+    if (stop)
+        return { kind: "stop", loopId: stop[1] || undefined };
+    const [first, ...remainder] = rest.split(/\s+/);
+    const parsed = parseInterval(first);
+    const intervalMs = parsed ?? DEFAULT_LOOP_INTERVAL_MS;
+    const prompt = (parsed ? remainder.join(" ") : rest).trim();
+    if (!prompt)
+        return { kind: "error", message: "A loop needs something to run: /loop 10m check for new PR comments" };
+    if (intervalMs < MIN_LOOP_INTERVAL_MS) {
+        return { kind: "error", message: `The shortest loop interval is ${formatInterval(MIN_LOOP_INTERVAL_MS)}; ${formatInterval(intervalMs)} would run away.` };
+    }
+    if (intervalMs > MAX_LOOP_INTERVAL_MS) {
+        return { kind: "error", message: `The longest loop interval is ${formatInterval(MAX_LOOP_INTERVAL_MS)}.` };
+    }
+    return { kind: "start", intervalMs, prompt };
+}

package/packages/server/dist/loops/loopNoop.js

@@ -0,0 +1,38 @@
+/**
+ * The line a looping agent ends on when its pass found nothing to do.
+ *
+ * Bracketed and namespaced so it cannot be mistaken for prose the agent meant
+ * to say, and so a reply that merely discusses looping is not mistaken for a
+ * quiet run.
+ */
+export const NOOP_MARKER = "[hive:no-change]";
+const NOOP_PATTERN = new RegExp(`\\n*\\s*${NOOP_MARKER.replace(/[[\]]/g, "\\$&")}\\s*$`, "i");
+/**
+ * What Hive appends when it re-sends a loop's prompt.
+ *
+ * Kept off the stored prompt so the Tasks panel shows what the reader actually
+ * asked for, not Hive's bookkeeping.
+ */
+export function withLoopInstructions(prompt) {
+    return `${prompt}\n\n(Hive loop: this prompt runs on a schedule. If this pass found nothing new to act on, end your reply with the single line ${NOOP_MARKER} — Hive folds those away so the quiet runs do not bury the ones that mattered.)`;
+}
+const INSTRUCTION_PATTERN = /\n*\(Hive loop: this prompt runs on a schedule\.[\s\S]*?\)\s*$/;
+/**
+ * Removes Hive's own appended instruction from a recorded prompt.
+ *
+ * The job records the full text that was sent, but the bookkeeping half was
+ * never the reader's words and has no business in their chat bubble.
+ */
+export function stripLoopInstructions(text) {
+    return text.replace(INSTRUCTION_PATTERN, "").trimEnd();
+}
+/**
+ * Splits the marker off a reply.
+ *
+ * The marker is bookkeeping, not something the reader should have to look at,
+ * so it never reaches the transcript — only the flag it sets does.
+ */
+export function stripNoopMarker(text) {
+    const stripped = text.replace(NOOP_PATTERN, "");
+    return stripped === text ? { text, noop: false } : { text: stripped.trimEnd(), noop: true };
+}