@shanesaravia/hive 0.3.0 → 0.5.0

package/packages/server/dist/api/rest.js

@@ -4,25 +4,141 @@ import { canAcceptReviewMission, canClearDirectStudioMission, reviewAcceptanceBl
 import { CONTEXT_BUDGETS } from "../messages/messagesStore.js";
 import { allPlanTasks } from "../plans/plansStore.js";
 import { buildFleetSnapshot } from "../roster/rosterBuilder.js";
+import { orchestratorTranscriptPath, readTranscript, transcriptSources, workerTranscriptPath } from "../transcripts/transcriptReader.js";
 import { skillPromptEvents, toHiveEvent } from "../hooks/hookIngest.js";
-import { isWorkEvent, reopensOnWork } from "../missions/reopenOnWork.js";
+import { isWorkEvent, reopensOnWork, returnsToReviewOnStop } from "../missions/reopenOnWork.js";
 import { startOrchestrator } from "../control/launcher.js";
 import { matchNativeCommand, runNativeCommand } from "../control/nativeCommands.js";
 import { sendMessage } from "../control/messaging.js";
+import { jobsToQuiesce, replacedManagerAfterResume } from "../control/missionQuiesce.js";
 import { parsePermissionAsk, permissionGrant } from "../control/permissionPark.js";
 import { forceStopSession, stopSession } from "../control/killer.js";
 import { discoverSkills } from "../skills/skillDiscovery.js";
+import { discoverAgents } from "../agents/agentDiscovery.js";
+import { AttachmentStore, isSupportedMediaType, MAX_ATTACHMENT_BYTES } from "../messages/attachmentStore.js";
+import { formatInterval, parseLoopCommand, parseMissionStartLoop } from "../loops/loopCommand.js";
+import { activeMonitors } from "../loops/monitors.js";
 import { translateSkillInvocations } from "../skills/skillInvocation.js";
-import { detectRepositoryMentions, foreignRepositoryForPath, inspectWorkingDirectory, recentRepositories, requireWorkingDirectory, suggestDirectories } from "../paths/pathResolver.js";
+import { detectRepositoryMentions, foreignRepositoryForPath, inspectWorkingDirectory, recentRepositories, requireWorkingDirectory, suggestDirectories, suggestPathEntries, suggestRepositories } from "../paths/pathResolver.js";
 import { missionReport, reportMarkdown } from "../reports/missionReport.js";
 import { createTemplate, deleteTemplate, discoverTemplates, discoverTemplatesDetailed, updateTemplate } from "../templates/templateDiscovery.js";
 import { publishGitHubReport } from "../reports/githubPublisher.js";
 import { enforceWorkingDirectory, normalize } from "../policies/policiesStore.js";
 import { detectProviderModels } from "../control/providerModels.js";
 import { reclaimEventDetail, reclaimWorktree } from "../worktrees/worktreeReclaim.js";
+import { reviewDiff } from "../reviews/reviewDiff.js";
+import { terminalCapability } from "../terminals/terminalCapability.js";
+import { providerTerminalCatalog } from "../terminals/providerDetection.js";
+import { terminalFeatureFlags } from "../terminals/terminalFeatures.js";
+/** Persist the human-significant transitions hidden inside a full plan snapshot. */
+export function planMilestones(previous, next) {
+    const milestones = [];
+    const previousPhases = new Map(previous?.phases.map((phase) => [phase.id, phase]));
+    const flatten = (plan) => {
+        const result = new Map();
+        const visit = (tasks) => tasks.forEach((task) => { result.set(task.id, task); visit(task.subtasks ?? []); });
+        plan?.phases.forEach((phase) => visit(phase.tasks));
+        return result;
+    };
+    const previousTasks = flatten(previous);
+    for (const phase of next.phases) {
+        const before = previousPhases.get(phase.id)?.status;
+        if (phase.status === "working" && before !== "working")
+            milestones.push({ phase: "phase_started", detail: phase.title });
+        if (phase.status === "completed" && before !== "completed")
+            milestones.push({ phase: "phase_completed", detail: phase.title });
+        for (const task of flatten({ ...next, phases: [{ ...phase, tasks: phase.tasks }] }).values()) {
+            const oldStatus = previousTasks.get(task.id)?.status;
+            if (task.status === "working" && oldStatus !== "working")
+                milestones.push({ phase: "task_started", detail: task.title, targetTask: task.id });
+            if (task.status === "completed" && oldStatus !== "completed")
+                milestones.push({ phase: "task_completed", detail: task.title, targetTask: task.id });
+        }
+    }
+    const previousGates = new Map(previous?.gates.map((gate) => [gate.id, gate.status]));
+    for (const gate of next.gates) {
+        if (previousGates.get(gate.id) === gate.status)
+            continue;
+        if (gate.status === "satisfied")
+            milestones.push({ phase: "gate_satisfied", detail: gate.label });
+        if (gate.status === "failed")
+            milestones.push({ phase: "gate_failed", detail: gate.label });
+        if (gate.status === "waived")
+            milestones.push({ phase: "gate_waived", detail: gate.label });
+    }
+    return milestones;
+}
+/** One sentence about structural plan changes; status transitions are separate milestone events. */
+export function planRevisionSummary(previous, next) {
+    if (!previous)
+        return `Plan created with ${next.phases.length} phase${next.phases.length === 1 ? "" : "s"} and ${next.progress.totalTasks} task${next.progress.totalTasks === 1 ? "" : "s"}`;
+    const flatten = (plan) => {
+        const result = new Map();
+        const visit = (tasks) => tasks.forEach((task) => { result.set(task.id, task.title); visit(task.subtasks ?? []); });
+        plan.phases.forEach((phase) => visit(phase.tasks));
+        return result;
+    };
+    const beforeTasks = flatten(previous);
+    const afterTasks = flatten(next);
+    const beforePhases = new Map(previous.phases.map((phase) => [phase.id, phase.title]));
+    const afterPhases = new Map(next.phases.map((phase) => [phase.id, phase.title]));
+    const beforeGates = new Map(previous.gates.map((gate) => [gate.id, gate.label]));
+    const afterGates = new Map(next.gates.map((gate) => [gate.id, gate.label]));
+    const added = (before, after) => [...after].filter(([id]) => !before.has(id)).map(([, label]) => String(label));
+    const removed = (before, after) => [...before].filter(([id]) => !after.has(id)).map(([, label]) => String(label));
+    const parts = [];
+    const additions = added(beforeTasks, afterTasks);
+    const removals = removed(beforeTasks, afterTasks);
+    const phaseAdds = added(beforePhases, afterPhases);
+    const phaseRemovals = removed(beforePhases, afterPhases);
+    const gateAdds = added(beforeGates, afterGates);
+    const gateRemovals = removed(beforeGates, afterGates);
+    if (additions.length)
+        parts.push(`added ${additions.length} task${additions.length === 1 ? "" : "s"}: ${additions.slice(0, 3).join(", ")}`);
+    if (removals.length)
+        parts.push(`removed ${removals.length} task${removals.length === 1 ? "" : "s"}: ${removals.slice(0, 3).join(", ")}`);
+    if (phaseAdds.length)
+        parts.push(`added phase${phaseAdds.length === 1 ? "" : "s"}: ${phaseAdds.slice(0, 2).join(", ")}`);
+    if (phaseRemovals.length)
+        parts.push(`removed phase${phaseRemovals.length === 1 ? "" : "s"}: ${phaseRemovals.slice(0, 2).join(", ")}`);
+    if (gateAdds.length)
+        parts.push(`added gate${gateAdds.length === 1 ? "" : "s"}: ${gateAdds.slice(0, 2).join(", ")}`);
+    if (gateRemovals.length)
+        parts.push(`removed gate${gateRemovals.length === 1 ? "" : "s"}: ${gateRemovals.slice(0, 2).join(", ")}`);
+    return parts.length ? parts.join("; ") : undefined;
+}
+/**
+ * The prompt an agent actually receives for a message carrying images.
+ *
+ * Named paths rather than an opaque "see attachment": the agent has to be able
+ * to open them, and an absolute path is the one instruction that works whether
+ * the turn runs in the repository, a worktree, or somewhere else entirely.
+ * Each attachment's name is the same "[Image #N]" token the user sees inline
+ * in their own message text, so this list is a direct lookup from what they
+ * already typed to the file the agent needs to read.
+ */
+export function promptWithAttachments(text, attached) {
+    if (!attached.length)
+        return text;
+    const list = attached.map((item) => `- [${item.name}]: ${item.path}`).join("\n");
+    const preamble = attached.length === 1 ? "The user attached an image" : `The user attached ${attached.length} images`;
+    return `${text ? `${text}\n\n` : ""}${preamble}, referenced inline in the message above. Read ${attached.length === 1 ? "it" : "them"} before replying:\n${list}`;
+}
+/** Returns the mission send path, so the loop scheduler drives turns exactly as a person's message does. */
 export function registerRest(app, deps) {
-    const { sessionsWatcher, jobsWatcher, events, missions, messages, plans, policies, codex, workerIdentity } = deps;
+    const { sessionsWatcher, jobsWatcher, events, missions, messages, plans, policies, codex, workerIdentity, terminalRuntime, loops } = deps;
+    const terminalFeatures = terminalFeatureFlags();
+    const attachments = new AttachmentStore();
     const missionSendTails = new Map();
+    app.get("/api/mission/:missionId/review-diff", async (req, reply) => {
+        const mission = missions.get(req.params.missionId);
+        if (!mission) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const worktree = missionWorktree(req.params.missionId);
+        return reviewDiff(worktree.path ?? mission.repository);
+    });
     function latestMissionTarget(missionId) {
         const candidates = [...jobsWatcher.getAll()].filter(([jobId]) => missions.missionFor(jobId) === missionId);
         candidates.sort((a, b) => Date.parse(b[1].createdAt ?? "") - Date.parse(a[1].createdAt ?? ""));
@@ -84,11 +200,71 @@ export function registerRest(app, deps) {
                 missionSendTails.delete(missionId);
         }
     }
+    /**
+     * Leaves the mission with at most one manager able to act: the one whose
+     * session is about to be resumed.
+     *
+     * A resume forks. The session it resumes keeps running, keeps its armed
+     * monitors and scheduled wake-ups, and keeps acting on a mission nobody is
+     * addressing any more — while Hive repoints the mission at the fork. Left
+     * unchecked that compounds one message at a time: mission f7ae71c7 reached
+     * five live managers against a single worktree and merge request, each
+     * re-closing the same gate, each spawning its own worker for the same plan
+     * task, and each reading the others' commits as work it never asked for.
+     *
+     * Failures are recorded and swallowed. A manager that will not stop is worth
+     * saying out loud, but it must not cost the user the message they sent.
+     */
+    async function quiesceMission(missionId, targetJobId) {
+        const provider = missions.summaryFor(missionId).provider ?? "claude";
+        const stopping = jobsToQuiesce({
+            jobs: [...jobsWatcher.getAll()].map(([jobId, job]) => ({ jobId, job, missionId: missions.missionFor(jobId) })),
+            sessions: sessionsWatcher.getAll().values(),
+            missionId,
+            targetJobId,
+        });
+        const stopped = [];
+        for (const jobId of stopping) {
+            const job = jobsWatcher.getAll().get(jobId);
+            const sessionId = job?.sessionId ?? job?.resumeSessionId ?? jobId;
+            const superseded = jobId !== targetJobId;
+            try {
+                if (provider === "codex")
+                    await codex.stop(jobId);
+                else
+                    await stopSession(jobId);
+                stopped.push(jobId);
+                events.add({ ts: Date.now(), sessionId, jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: superseded ? `Stopped superseded manager ${jobId.slice(0, 8)} before resuming: only one job may act on a mission.` : `Ended the parked turn on ${jobId.slice(0, 8)} so this message continues the conversation instead of branching it.` });
+            }
+            catch (error) {
+                events.add({ ts: Date.now(), sessionId, jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Could not stop ${superseded ? "superseded" : "parked"} manager ${jobId.slice(0, 8)}: ${error.message}` });
+            }
+        }
+        return stopped;
+    }
+    async function resumeClaude(previousJobId, sessionId, prompt, policy, additionalRepos) {
+        const result = await sendMessage(sessionId, prompt, policy, additionalRepos);
+        const replaced = replacedManagerAfterResume(previousJobId, result.jobId);
+        if (replaced) {
+            try {
+                await stopSession(replaced);
+                events.add({ ts: Date.now(), sessionId, jobId: replaced, source: "custom", phase: "custom", activityKind: "lifecycle", detail: `Retired manager ${replaced.slice(0, 8)} after resumed job ${result.jobId.slice(0, 8)} took over` });
+            }
+            catch (error) {
+                // The continuation is already live. Preserve it and make cleanup
+                // failure visible rather than turning a successful send into an error
+                // that invites the user to retry and create yet another manager.
+                events.add({ ts: Date.now(), sessionId, jobId: replaced, source: "custom", phase: "custom", activityKind: "lifecycle", outcome: "failure", detail: `Could not retire replaced manager ${replaced.slice(0, 8)}: ${error.message}` });
+            }
+        }
+        return result;
+    }
     async function sendToMission(missionId, text) {
         return withMissionQueue(missionId, async () => {
             const target = latestMissionTarget(missionId);
             if (!target)
                 throw new Error("mission not found");
+            const quiesced = await quiesceMission(missionId, target.jobId);
             const summary = missions.summaryFor(missionId);
             const policy = summary.policy ?? policies.get();
             const provider = summary.provider ?? "claude";
@@ -123,7 +299,7 @@ export function registerRest(app, deps) {
             try {
                 result = provider === "codex"
                     ? await codex.start({ task: prompt, cwd: repository, model: summary.model, mode: summary.mode, policy, resumeSessionId: target.sessionId })
-                    : await sendMessage(target.sessionId, prompt, policy, additionalRepos);
+                    : await resumeClaude(quiesced.includes(target.jobId) ? undefined : target.jobId, target.sessionId, prompt, policy, additionalRepos);
             }
             catch (error) {
                 if (reopening)
@@ -267,9 +443,123 @@ export function registerRest(app, deps) {
             return { error: err.message };
         }
     });
+    /**
+     * The mission's transcripts, as the terminal renders them.
+     *
+     * The hook-derived timeline above says that a tool ran; this says what it
+     * ran, what came back, and what the agent said about it. Both are kept: the
+     * timeline is the skimmable index, this is the record.
+     *
+     * `source` is `orchestrator` (the default) or a worker's native agent id.
+     * Every session the mission has ever held is searched, so a transcript from
+     * a resumed turn is still reachable.
+     */
+    app.get("/api/mission/:missionId/transcript", async (req, reply) => {
+        const snapshot = buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans, Date.now(), workerIdentity);
+        const node = snapshot.orchestrators.find((item) => item.missionId === req.params.missionId);
+        if (!node) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const sessionIds = [...new Set([
+                node.sessionId,
+                ...node.jobHistory.flatMap((entry) => [entry.sessionId, entry.resumedFrom].filter(Boolean)),
+            ])];
+        // A worker's roster label is the name already on screen everywhere else;
+        // matching on aliases too covers a worker the provider renamed.
+        const labelFor = (agentId) => node.workers.find((worker) => worker.id === agentId || worker.aliases?.includes(agentId))?.label;
+        const sources = transcriptSources({ sessionIds, labelFor }).map((source) => ({
+            ...source,
+            terminal: terminalCapability(source, node.mission.provider ?? "claude", node.lifecycleStatus, undefined, node.activityStatus === "working", terminalFeatures),
+        }));
+        const requested = req.query.source?.trim() || "orchestrator";
+        const source = sources.find((item) => item.id === requested) ?? sources[0];
+        if (!source)
+            return { sources, source: undefined, entries: [], truncated: false };
+        const file = source.kind === "orchestrator"
+            ? orchestratorTranscriptPath(source.sessionId)
+            : workerTranscriptPath(source.sessionId, source.id);
+        if (!file)
+            return { sources, source: source.id, entries: [], truncated: false };
+        const limit = Math.min(1_000, Math.max(20, Number(req.query.limit) || 400));
+        const read = readTranscript(file, limit);
+        return { sources, source: source.id, entries: read.entries, truncated: read.truncated, updatedAt: read.updatedAt };
+    });
     app.get("/api/session/:sessionId/timeline", async (req) => {
         return { events: events.recentFor(req.params.sessionId, 200) };
     });
+    app.get("/api/mission/:missionId/terminal/events", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const source = req.query.source?.trim() || "orchestrator";
+        const after = Math.max(0, Number(req.query.after) || 0);
+        return terminalRuntime.stream.replay(req.params.missionId, source, after);
+    });
+    app.post("/api/mission/:missionId/terminal/input", async (req, reply) => {
+        const source = req.body?.source?.trim() || "orchestrator";
+        const text = req.body?.text?.trim();
+        const clientInputId = req.body?.clientInputId?.trim();
+        const auditReject = (status, code, error, provider = "unknown") => {
+            terminalRuntime.observability.input({ missionId: req.params.missionId, source, provider, inputCharacters: req.body?.text?.length ?? 0, outcome: "rejected", reason: code });
+            reply.code(status);
+            return { error, code };
+        };
+        if (source !== "orchestrator")
+            return auditReject(409, "terminal_read_only", "Worker terminal sources are read only");
+        if (!text)
+            return auditReject(400, "invalid_terminal_input", "text is required");
+        if (text.length > 100_000)
+            return auditReject(413, "terminal_input_too_large", "terminal input exceeds 100000 characters");
+        if (!clientInputId || clientInputId.length > 128)
+            return auditReject(400, "invalid_client_input_id", "a clientInputId of at most 128 characters is required");
+        const mission = missions.get(req.params.missionId);
+        if (!mission)
+            return auditReject(404, "mission_not_found", "mission not found");
+        const summary = missions.summaryFor(req.params.missionId);
+        if ((summary.provider ?? "claude") !== "codex")
+            return auditReject(409, "terminal_follow_up_only", "This provider currently supports follow-up input, not interactive terminal input", "claude");
+        if (!terminalFeatures.codexInput)
+            return auditReject(409, "terminal_input_disabled", "Writable Codex Terminal input is disabled", "codex");
+        const detection = providerTerminalCatalog().codex;
+        if (detection.interactiveTransport !== "codex_app_server")
+            return auditReject(409, "terminal_transport_unavailable", detection.reason ?? "The installed Codex CLI does not support interactive terminal input", "codex");
+        const snapshot = buildFleetSnapshot(sessionsWatcher.getAll(), jobsWatcher.getAll(), events, missions, messages, plans, Date.now(), workerIdentity);
+        const node = snapshot.orchestrators.find((item) => item.missionId === req.params.missionId);
+        if (node?.activityStatus === "working")
+            return auditReject(409, "terminal_turn_active", "The current provider turn is still running", "codex");
+        if (summary.lifecycleStatus === "completed" || summary.lifecycleStatus === "archived")
+            return auditReject(409, "terminal_read_only", "Finished missions are read only until reopened", "codex");
+        const target = latestMissionTarget(req.params.missionId);
+        if (!target)
+            return auditReject(409, "terminal_thread_unavailable", "No provider thread is available for this mission", "codex");
+        const cwd = resumeRepository(req.params.missionId, summary.repository);
+        if (!cwd)
+            return auditReject(409, "terminal_cwd_unavailable", "No working directory is available for this mission", "codex");
+        try {
+            return await terminalRuntime.submitCodex({ missionId: req.params.missionId, source: "orchestrator", threadId: target.sessionId, cwd, text, clientInputId, model: summary.model, policy: summary.policy ?? policies.get() });
+        }
+        catch (error) {
+            reply.code(409);
+            return { error: error.message, code: "terminal_input_failed" };
+        }
+    });
+    app.post("/api/mission/:missionId/terminal/interrupt", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found", code: "mission_not_found" };
+        }
+        try {
+            await terminalRuntime.interrupt(req.params.missionId);
+            return { ok: true };
+        }
+        catch (error) {
+            reply.code(409);
+            return { error: error.message, code: "terminal_interrupt_unavailable" };
+        }
+    });
+    app.get("/api/terminal/status", async () => ({ features: terminalFeatures, observability: terminalRuntime.observability.snapshot() }));
     /**
      * Finished work that starts working again is no longer finished.
      *
@@ -304,6 +594,17 @@ export function registerRest(app, deps) {
             events.add(promptEvent);
         if (jobId)
             reopenIfWorking(event, jobId);
+        if (jobId && event.hookEventName === "Stop") {
+            const missionId = missions.missionFor(jobId);
+            const mission = missions.get(missionId);
+            const pendingDecision = events.recentFor(event.sessionId).some((candidate) => candidate.jobId === jobId && candidate.phase === "blocked_on_user" && candidate.ts <= event.ts);
+            if (mission && returnsToReviewOnStop(mission, pendingDecision)) {
+                const finalMessage = typeof req.body.last_assistant_message === "string" ? req.body.last_assistant_message : undefined;
+                missions.setLifecycleStatus(missionId, "ready_for_review");
+                missions.updateContext(missionId, { compactSummary: finalMessage?.slice(0, 1_200), currentState: "Awaiting user acceptance" });
+                events.add({ ts: Date.now(), sessionId: event.sessionId, jobId, source: "custom", phase: "ready_for_review", activityKind: "lifecycle", detail: "Follow-up work finished and returned to user acceptance" });
+            }
+        }
         // A write landing in another known repo marks that repo as touched by
         // the mission, so its footprint chips reflect reality, not just intent.
         if (event.activityKind === "file_write" && event.filePath && jobId) {
@@ -325,6 +626,7 @@ export function registerRest(app, deps) {
         }
         const effectiveJobId = jobId ?? sessionForId(sessionsWatcher, sessionId)?.jobId;
         let eventDetail = detail;
+        let derivedPlanMilestones = [];
         if (phase === "plan_updated") {
             if (!effectiveJobId) {
                 reply.code(404);
@@ -336,8 +638,11 @@ export function registerRest(app, deps) {
                 return { error: "mission not found for plan update" };
             }
             try {
+                const previousPlan = plans.get(missionId);
                 const plan = plans.replace(missionId, JSON.parse(detail));
-                eventDetail = `Plan updated to revision ${plan.revision}: ${plan.phases.length} phase${plan.phases.length === 1 ? "" : "s"}, ${plan.progress.totalTasks} task${plan.progress.totalTasks === 1 ? "" : "s"}`;
+                derivedPlanMilestones = planMilestones(previousPlan, plan);
+                const revisionSummary = planRevisionSummary(previousPlan, plan);
+                eventDetail = `Plan updated to revision ${plan.revision}: ${plan.phases.length} phase${plan.phases.length === 1 ? "" : "s"}, ${plan.progress.totalTasks} task${plan.progress.totalTasks === 1 ? "" : "s"}${revisionSummary ? ` · ${revisionSummary}` : ""}`;
                 const current = plan.phases.find((item) => ["working", "reviewing", "blocked"].includes(item.status));
                 const blocked = plan.phases.flatMap((item) => allPlanTasks(item.tasks)).filter((task) => task.status === "blocked").map((task) => task.title);
                 missions.updateContext(missionId, { compactSummary: `Plan revision ${plan.revision}; ${plan.progress.completedTasks}/${plan.progress.totalTasks} tasks complete${plan.progress.percent !== undefined ? ` (${plan.progress.percent}%)` : ""}. ${current ? `Current phase: ${current.title}.` : ""}${blocked.length ? ` Blocked: ${blocked.slice(0, 3).join(", ")}.` : ""}`.slice(0, 1_200), currentState: eventDetail });
@@ -374,6 +679,15 @@ export function registerRest(app, deps) {
             impact: phase === "blocked_on_user" ? decision?.impact : undefined,
             context: phase === "blocked_on_user" ? decision?.context : undefined,
         });
+        for (const [index, milestone] of derivedPlanMilestones.entries())
+            events.add({
+                ts: Date.now() + index + 1,
+                sessionId,
+                jobId: effectiveJobId,
+                source: "custom",
+                activityKind: "lifecycle",
+                ...milestone,
+            });
         if (effectiveJobId && phase !== "ready_for_review")
             reopenIfWorking({ sessionId, source: "custom", phase }, effectiveJobId);
         if (phase === "ready_for_review" && effectiveJobId) {
@@ -391,7 +705,7 @@ export function registerRest(app, deps) {
                 // One emit may name several workers (`--target a,b,c`); the task moves for each.
                 const targets = targetWorker && /[,;]/.test(targetWorker) ? [...new Set(targetWorker.split(/[,;]/).map((value) => value.trim()).filter(Boolean))] : [targetWorker];
                 for (const target of targets) {
-                    const canonicalWorker = workerIdentity.canonicalFor(missionId, target);
+                    const canonicalWorker = workerIdentity.canonicalFor(missionId, target, effectiveJobId);
                     try {
                         plans.applyTaskEvent(missionId, { phase, targetTask, targetWorker: target, canonicalWorker, evidence: phase === "worker_reported" ? detail : undefined });
                     }
@@ -540,12 +854,32 @@ Revise the structured plan to remove that requirement and stop work that was nee
             return { error: err.message };
         }
     });
-    app.post("/api/orchestrator/start", async (req, reply) => {
+    app.post("/api/orchestrator/start", { bodyLimit: Math.ceil(MAX_ATTACHMENT_BYTES * 1.4 * 8) }, async (req, reply) => {
         const { task, name, cwd, templateId } = req.body;
         if (!task) {
             reply.code(400);
             return { error: "task is required" };
         }
+        const pendingAttachments = req.body.attachments ?? [];
+        for (const item of pendingAttachments) {
+            if (!isSupportedMediaType(item.mediaType)) {
+                reply.code(415);
+                return { error: `unsupported image type: ${item.mediaType || "none given"}` };
+            }
+            if (!item.data) {
+                reply.code(400);
+                return { error: "attachment data is required" };
+            }
+        }
+        // `/loop …` is Hive's wherever it is typed, not only in a conversation.
+        // Handed to the CLI as a task it would run as the agent's own loop, which
+        // Hive cannot list or stop — the failure this feature exists to prevent.
+        const start = parseMissionStartLoop(task);
+        if ("error" in start) {
+            reply.code(400);
+            return { error: start.error };
+        }
+        const missionTask = start.prompt;
         try {
             const template = templateId ? discoverTemplates(cwd).find((item) => item.id === templateId) : undefined;
             if (templateId && !template) {
@@ -575,17 +909,23 @@ Revise the structured plan to remove that requirement and stop work that was nee
             const provider = req.body.provider ?? "claude";
             const model = req.body.model?.trim() || undefined;
             const planFirst = mode === "orchestrated" && req.body.planFirst === true;
-            const additionalRepos = detectRepositoryMentions(task, resolvedCwd);
+            const additionalRepos = detectRepositoryMentions(missionTask, resolvedCwd);
             const repoPrompt = additionalRepos.length ? `\n\n(Hive: you also have tool access to these repositories: ${additionalRepos.join(", ")})` : "";
             const planFirstPrompt = planFirst ? `\n\nHive Plan First checkpoint (mandatory): Before editing files, running implementation commands, or spawning/delegating to any workers, investigate only enough to propose a concrete structured plan. Publish that plan with every task and phase still queued and approvalStatus \"proposed\". Then emit blocked_on_user with decision id \"plan-approval\", kind \"scope\", and question \"Approve the proposed plan before implementation begins?\" Stop the turn after emitting it. Do not begin implementation until Hive resumes you with explicit plan approval. If changes are requested, revise and republish the queued plan, emit the same plan-approval decision again, and stop.` : "";
-            const providerTask = translateSkillInvocations(task, provider, new Set(discoverSkills(resolvedCwd, provider).map((skill) => skill.name)));
-            const prompt = providerTask + templatePrompt + limits + policyPrompt + repoPrompt + planFirstPrompt;
+            const providerTask = translateSkillInvocations(missionTask, provider, new Set(discoverSkills(resolvedCwd, provider).map((skill) => skill.name)));
+            // Generated ahead of `missions.create` so pasted images can be filed
+            // under the mission's id before the mission record itself exists.
+            const missionId = randomUUID();
+            const attached = pendingAttachments.map((item) => attachments.save(missionId, { name: item.name, mediaType: item.mediaType, data: Buffer.from(item.data, "base64") }));
+            const taskWithAttachments = promptWithAttachments(providerTask, attached);
+            const prompt = taskWithAttachments + templatePrompt + limits + policyPrompt + repoPrompt + planFirstPrompt;
             const result = provider === "codex"
                 ? await codex.start({ task: prompt, cwd: resolvedCwd, name, model, mode, policy })
                 : await startOrchestrator({ task: prompt, worktree, name, cwd: resolvedCwd, mode, policy, model, addDirs: additionalRepos });
             const mission = missions.create({
+                id: missionId,
                 name,
-                objective: task,
+                objective: missionTask,
                 repository: result.cwd,
                 jobId: result.jobId,
                 sessionId: result.sessionId,
@@ -605,10 +945,24 @@ Revise the structured plan to remove that requirement and stop work that was nee
                 text: task,
                 createdAt: Date.now(),
                 jobId: result.jobId,
+                ...(attached.length ? { attachments: attached } : {}),
             });
+            // The opening turn is the loop's first pass, so the schedule starts one
+            // interval out — exactly what `loops.create` does.
+            const loop = start.loop ? loops.create({ missionId: mission.id, ...start.loop }) : undefined;
+            if (loop) {
+                messages.add({
+                    id: `${result.jobId}:loop`,
+                    missionId: mission.id,
+                    role: "assistant",
+                    text: `Looping every ${formatInterval(loop.intervalMs)}: ${loop.prompt}\n\nThis first pass is running now; the next is at ${new Date(loop.nextRunAt).toLocaleTimeString()}. Stop it with \`/loop stop ${loop.id}\`, or from the Tasks panel.`,
+                    createdAt: Date.now() + 1,
+                    jobId: result.jobId,
+                });
+            }
             if (template)
                 plans.replace(mission.id, { phases: [{ id: "template", title: template.name, description: template.description, status: "queued", acceptanceCriteria: template.gates.map((gate) => gate.label), dependsOn: [], tasks: template.stages.map((stage, index) => ({ id: stage.id, title: stage.title, role: stage.role, status: "queued", weight: 1, dependsOn: stage.dependsOn ?? (index ? [template.stages[index - 1].id] : []), evidence: [] })) }], gates: template.gates.map((gate) => ({ ...gate, source: "template" })) });
-            return { ...result, missionId: mission.id };
+            return { ...result, missionId: mission.id, ...(loop ? { loopId: loop.id } : {}) };
         }
         catch (err) {
             reply.code(400);
@@ -624,6 +978,87 @@ Revise the structured plan to remove that requirement and stop work that was nee
             return { error: err.message };
         }
     });
+    // Base64 in a JSON body rather than multipart: a pasted screenshot arrives
+    // as bytes in the browser either way, and this needs no new dependency.
+    app.post("/api/mission/:missionId/attachment", { bodyLimit: Math.ceil(MAX_ATTACHMENT_BYTES * 1.4) }, async (req, reply) => {
+        const { missionId } = req.params;
+        if (!missions.get(missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        const mediaType = req.body?.mediaType ?? "";
+        if (!isSupportedMediaType(mediaType)) {
+            reply.code(415);
+            return { error: `unsupported image type: ${mediaType || "none given"}` };
+        }
+        if (!req.body?.data) {
+            reply.code(400);
+            return { error: "data is required" };
+        }
+        try {
+            return { attachment: attachments.save(missionId, { name: req.body.name, mediaType, data: Buffer.from(req.body.data, "base64") }) };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    app.get("/api/mission/:missionId/attachment/:attachmentId", async (req, reply) => {
+        const found = attachments.read(req.params.missionId, req.params.attachmentId);
+        if (!found) {
+            reply.code(404);
+            return { error: "attachment not found" };
+        }
+        reply.header("Content-Type", found.mediaType);
+        reply.header("Cache-Control", "private, max-age=31536000, immutable");
+        return reply.send(fs.createReadStream(found.file));
+    });
+    /** Everything currently running on a schedule or watching in the background. */
+    app.get("/api/tasks", async () => ({
+        loops: loops.active().map((loop) => ({ ...loop, missionName: missions.get(loop.missionId)?.name })),
+        monitors: activeMonitors(jobsWatcher.getAll(), (jobId) => missions.missionFor(jobId), (missionId) => missions.get(missionId)?.name ?? missionId),
+    }));
+    app.post("/api/loop/:loopId/stop", async (req, reply) => {
+        if (!loops.stop(req.params.loopId, "you stopped it")) {
+            reply.code(404);
+            return { error: "no active loop with that id" };
+        }
+        return { ok: true };
+    });
+    app.post("/api/mission/:missionId/loops/stop", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        return { ok: true, stopped: loops.stopMission(req.params.missionId, "you stopped it") };
+    });
+    /**
+     * Ends the turn that owns a mission's monitors. Hive did not start them and
+     * cannot address one individually, so stopping the turn is the honest lever.
+     */
+    app.post("/api/mission/:missionId/monitors/stop", async (req, reply) => {
+        if (!missions.get(req.params.missionId)) {
+            reply.code(404);
+            return { error: "mission not found" };
+        }
+        try {
+            await quiesceMission(req.params.missionId);
+            return { ok: true };
+        }
+        catch (err) {
+            reply.code(500);
+            return { error: err.message };
+        }
+    });
+    app.post("/api/agents/discover", async (req, reply) => {
+        try {
+            return { agents: discoverAgents(req.body?.cwd) };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
     app.post("/api/session/:sessionId/adopt", async (req, reply) => {
         const session = [...sessionsWatcher.getAll().values()].find((candidate) => candidate.sessionId === req.params.sessionId);
         if (!session) {
@@ -655,6 +1090,22 @@ Revise the structured plan to remove that requirement and stop work that was nee
         directories: req.body?.input?.trim() ? suggestDirectories(req.body.input) : recentRepositories(),
     }));
     app.post("/api/paths/inspect", async (req) => inspectWorkingDirectory(req.body?.input));
+    // Live "@path" completion in a composer: files and directories under a
+    // mission's own working directory, matching what's typed after the `@`.
+    app.post("/api/paths/suggest-entries", async (req, reply) => {
+        try {
+            const cwd = requireWorkingDirectory(req.body?.cwd);
+            return { entries: suggestPathEntries(cwd, req.body?.query ?? "") };
+        }
+        catch (err) {
+            reply.code(400);
+            return { error: err.message };
+        }
+    });
+    // Live "#repo" completion: sibling and recently used repositories matching what's typed after the `#`.
+    app.post("/api/repositories/suggest", async (req) => ({
+        repositories: suggestRepositories(req.body?.cwd, req.body?.query ?? ""),
+    }));
     app.post("/api/session/:pid/message", async (req, reply) => {
         const pid = Number(req.params.pid);
         const session = sessionsWatcher.getAll().get(pid);
@@ -666,10 +1117,14 @@ Revise the structured plan to remove that requirement and stop work that was nee
             reply.code(400);
             return { error: "text is required" };
         }
-        const result = await sendMessage(session.sessionId, req.body.text);
         const missionId = session.jobId
             ? missions.missionFor(session.jobId)
             : session.sessionId;
+        // Messaging a session that belongs to a mission is the same fork as
+        // messaging the mission, through a second door. Only a session Hive does
+        // not manage as a mission is resumed without quiescing.
+        const quiesced = missions.get(missionId) ? await quiesceMission(missionId, session.jobId) : [];
+        const result = await resumeClaude(quiesced.includes(session.jobId ?? "") ? undefined : session.jobId, session.sessionId, req.body.text);
         missions.linkJob(missionId, result.jobId, result.sessionId);
         messages.add({
             id: `${result.jobId}:user`,
@@ -683,10 +1138,83 @@ Revise the structured plan to remove that requirement and stop work that was nee
     });
     app.post("/api/mission/:missionId/message", async (req, reply) => {
         const text = req.body?.text?.trim();
-        if (!text) {
+        const attached = (req.body?.attachmentIds ?? [])
+            .map((id) => attachments.describe(req.params.missionId, id))
+            .filter((item) => Boolean(item));
+        if (!text && !attached.length) {
             reply.code(400);
             return { error: "text is required" };
         }
+        // `/tasks` answers from Hive's own books rather than the agent's, which
+        // is the only place the whole fleet's loops and monitors are visible.
+        if (text && /^\/tasks\s*$/i.test(text.trim())) {
+            const missionId = req.params.missionId;
+            if (!missions.get(missionId)) {
+                reply.code(404);
+                return { error: "mission not found" };
+            }
+            const jobRef = `tasks:${randomUUID()}`;
+            const running = loops.active();
+            const monitors = activeMonitors(jobsWatcher.getAll(), (jobId) => missions.missionFor(jobId), (id) => missions.get(id)?.name ?? id);
+            const here = running.filter((loop) => loop.missionId === missionId);
+            const elsewhere = running.filter((loop) => loop.missionId !== missionId);
+            const lines = [
+                here.length
+                    ? `**Loops on this mission**\n${here.map((loop) => `• \`${loop.id}\` every ${formatInterval(loop.intervalMs)} — ${loop.prompt}`).join("\n")}`
+                    : "**Loops on this mission**\nNone.",
+                elsewhere.length ? `\n**Loops elsewhere**\n${elsewhere.map((loop) => `• \`${loop.id}\` ${missions.get(loop.missionId)?.name ?? loop.missionId} — every ${formatInterval(loop.intervalMs)}`).join("\n")}` : "",
+                monitors.length
+                    ? `\n**Monitors**\n${monitors.map((monitor) => `• ${monitor.label} — ${monitor.missionName}${monitor.missionId === missionId ? " (here)" : ""}`).join("\n")}`
+                    : "\n**Monitors**\nNone running.",
+                "\nStop a loop with `/loop stop <id>`. Monitors have no per-watcher stop — ending the turn from the Tasks panel stops all of that turn's watchers together.",
+            ];
+            messages.add({ id: `${jobRef}:user`, missionId, role: "user", text, createdAt: Date.now(), jobId: jobRef });
+            messages.add({ id: `${jobRef}:assistant`, missionId, role: "assistant", text: lines.filter(Boolean).join("\n"), createdAt: Date.now() + 1, jobId: jobRef });
+            return { ok: true, jobId: jobRef };
+        }
+        // `/loop` is Hive's, not the agent's: a loop the agent starts internally
+        // cannot be listed or stopped from here, and this one can.
+        const loopCommand = text ? parseLoopCommand(text) : undefined;
+        if (loopCommand) {
+            const missionId = req.params.missionId;
+            if (!missions.get(missionId)) {
+                reply.code(404);
+                return { error: "mission not found" };
+            }
+            const jobRef = `loop:${randomUUID()}`;
+            const say = (body) => {
+                messages.add({ id: `${jobRef}:user`, missionId, role: "user", text, createdAt: Date.now(), jobId: jobRef });
+                messages.add({ id: `${jobRef}:assistant`, missionId, role: "assistant", text: body, createdAt: Date.now() + 1, jobId: jobRef });
+            };
+            if (loopCommand.kind === "error") {
+                say(`⚠️ ${loopCommand.message}`);
+                return { ok: true, jobId: jobRef };
+            }
+            if (loopCommand.kind === "list") {
+                const running = loops.active(missionId);
+                say(running.length
+                    ? `Running on this mission:\n${running.map((loop) => `• \`${loop.id}\` every ${formatInterval(loop.intervalMs)} — ${loop.prompt}`).join("\n")}\n\nStop one with \`/loop stop <id>\`, or all with \`/loop stop\`.`
+                    : "No loops are running on this mission. Start one with `/loop 10m check for new PR comments`.");
+                return { ok: true, jobId: jobRef };
+            }
+            if (loopCommand.kind === "stop") {
+                const stopped = loopCommand.loopId
+                    ? (loops.stop(loopCommand.loopId, "you stopped it") ? 1 : 0)
+                    : loops.stopMission(missionId, "you stopped it");
+                say(stopped
+                    ? `Stopped ${stopped} loop${stopped === 1 ? "" : "s"}.`
+                    : loopCommand.loopId ? `No active loop with id \`${loopCommand.loopId}\`.` : "No loops were running on this mission.");
+                return { ok: true, jobId: jobRef };
+            }
+            const created = loops.create({ missionId, prompt: loopCommand.prompt, intervalMs: loopCommand.intervalMs });
+            say(`Looping every ${formatInterval(created.intervalMs)}: ${created.prompt}\n\nFirst run at ${new Date(created.nextRunAt).toLocaleTimeString()}. Stop it with \`/loop stop ${created.id}\`, or from the Tasks panel.`);
+            // The loop's own prompt runs now too, so the first pass is not a wait.
+            try {
+                await sendToMission(missionId, loopCommand.prompt);
+            }
+            catch { /* the schedule carries it from here */ }
+            return { ok: true, jobId: jobRef };
+        }
         const native = matchNativeCommand(text);
         if (native) {
             const missionId = req.params.missionId;
@@ -706,7 +1234,13 @@ Revise the structured plan to remove that requirement and stop work that was nee
             return { ok: true, jobId: jobRef };
         }
         try {
-            const result = await sendToMission(req.params.missionId, text);
+            // The model never receives bytes: the images are on the Hive host's
+            // disk and the agent opens them with its own Read tool, which behaves
+            // the same for every provider.
+            const result = await sendToMission(req.params.missionId, promptWithAttachments(text, attached));
+            if (attached.length) {
+                messages.add({ id: `${result.jobId}:user`, missionId: req.params.missionId, role: "user", text, createdAt: Date.now(), jobId: result.jobId, attachments: attached });
+            }
             return { ok: true, jobId: result.jobId };
         }
         catch (err) {
@@ -761,14 +1295,16 @@ Revise the structured plan to remove that requirement and stop work that was nee
             const ask = parsePermissionAsk(job.needs);
             const askLabel = ask ? `${ask.tool}: ${ask.detail}`.slice(0, 300) : job.needs.slice(0, 300);
             try {
-                await stopSession(jobId);
+                // Ends the parked turn, and any other manager still live on the
+                // mission with it — the verdict below resumes one conversation.
+                const quiesced = await quiesceMission(req.params.missionId, jobId);
                 const summary = missions.summaryFor(req.params.missionId);
                 const policy = summary.policy ?? policies.get();
                 const grant = approved ? permissionGrant(job.needs) : undefined;
                 const text = approved
                     ? `Your permission request (${askLabel}) is approved and now pre-allowed. Re-run it and continue where you left off.`
                     : `Your permission request (${askLabel}) was denied${/^deny$/i.test(answer) ? "" : ` — ${answer}`}. Continue without it or propose an alternative.`;
-                const result = await sendMessage(sessionId, text, grant ? { ...policy, allowedTools: [...policy.allowedTools, grant] } : policy);
+                const result = await resumeClaude(quiesced.includes(jobId) ? undefined : jobId, sessionId, text, grant ? { ...policy, allowedTools: [...policy.allowedTools, grant] } : policy);
                 missions.linkJob(req.params.missionId, result.jobId, result.sessionId);
                 messages.add({ id: `${result.jobId}:user`, missionId: req.params.missionId, role: "user", text, createdAt: Date.now(), jobId: result.jobId });
                 events.add({ ts: Date.now(), sessionId, jobId: result.jobId, source: "custom", phase: "decision_resolved", activityKind: "decision", detail: answer, decisionId: req.params.decisionId });
@@ -796,6 +1332,21 @@ Revise the structured plan to remove that requirement and stop work that was nee
                 return { error: err.message };
             }
         }
+        // An ask the agent wrote in its own reply (decision id ask:<jobId>) has
+        // no blocked_on_user event behind it — the turn simply ended with a
+        // question. Answering it is just replying, and the resolution event is
+        // what clears it from the inbox.
+        if (req.params.decisionId.startsWith("ask:")) {
+            try {
+                const result = await sendToMission(req.params.missionId, answer);
+                events.add({ ts: Date.now(), sessionId: result.sessionId ?? latestMissionTarget(req.params.missionId)?.sessionId ?? req.params.decisionId, jobId: result.jobId, source: "custom", phase: "decision_resolved", activityKind: "decision", detail: answer, decisionId: req.params.decisionId });
+                return { ok: true };
+            }
+            catch (err) {
+                reply.code(500);
+                return { error: err.message };
+            }
+        }
         const nodeEvents = [...jobsWatcher.getAll()].filter(([jobId]) => missions.missionFor(jobId) === req.params.missionId).flatMap(([, job]) => [job.sessionId, job.resumeSessionId].filter((value) => Boolean(value))).flatMap((sessionId) => events.recentFor(sessionId, 200));
         const pending = nodeEvents.find((event) => event.phase === "blocked_on_user" && event.decisionId === req.params.decisionId);
         const alreadyResolved = nodeEvents.some((event) => event.phase === "decision_resolved" && event.decisionId === req.params.decisionId);
@@ -856,14 +1407,11 @@ Revise the structured plan to remove that requirement and stop work that was nee
             return await withMissionQueue(req.params.missionId, async () => {
                 const recent = messages.modelContext(req.params.missionId);
                 const retrieved = messages.relevantContext(req.params.missionId, `${mission.objective} ${mission.compactSummary ?? ""} ${mission.currentState ?? ""}`, new Set(recent.map((message) => message.id)));
-                const target = latestMissionTarget(req.params.missionId);
-                const currentJob = target ? jobsWatcher.getAll().get(target.jobId) : undefined;
-                if (target && currentJob && ["working", "busy", "queued"].includes(currentJob.state)) {
-                    if (mission.provider === "codex")
-                        await codex.stop(target.jobId);
-                    else
-                        await stopSession(target.jobId);
-                }
+                // The replacement manager is about to take the mission over, so every
+                // manager already on it stands down — not just the one mid-turn. A
+                // handoff that left the old job running would be the same collision
+                // the resume path had, with the two managers a turn further apart.
+                await quiesceMission(req.params.missionId);
                 const context = { objective: mission.objective, compactSummary: mission.compactSummary, currentState: mission.currentState, recentMessages: recent.map(({ role, text }) => ({ role, text })), relevantOlderMessages: retrieved.map(({ role, text }) => ({ role, text })), budgets: mission.budgets };
                 const prompt = `You are taking over an existing Hive mission from another manager. Continue the same mission without replaying completed work. Inspect current repository state, reconcile this bounded handoff context with reality, publish a fresh structured plan revision, and ask the user only when a genuine decision is required.\n\nHandoff context:\n${JSON.stringify(context)}`;
                 const result = mission.provider === "codex"
@@ -1053,6 +1601,7 @@ Revise the structured plan to remove that requirement and stop work that was nee
         events.add({ ts: Date.now(), sessionId: targetSession.sessionId, jobId: targetSession.jobId, source: "custom", phase: "custom", activityKind: "lifecycle", detail: req.body?.force ? "Force stop requested" : "Graceful stop requested" });
         return { ok: true };
     });
+    return { sendToMission };
 }
 function sessionForId(watcher, sessionId) {
     for (const session of watcher.getAll().values()) {