@tt-a1i/hive 0.6.0-alpha.0 → 0.6.0-alpha.2

package/CHANGELOG.md

@@ -2,11 +2,70 @@
 
 All notable user-facing changes will be documented in this file.
 
-## 0.6.0-alpha.0 - Unreleased
+## 0.6.0-alpha.2 - 2026-05-14
+
+Follow-up to alpha.1 — corrects a handful of inconsistencies and tightens the
+runtime-down experience that was deferred from the alpha.1 review.
+
+- Removed the OrchestratorHintOverlay introduced in alpha.1. The hint card on
+  the Orchestrator pane was judged as unnecessary; agent terminals are now
+  back to a clean full-bleed PTY.
+- Runtime-down handling is no longer half-finished: when the local Hive
+  runtime is unreachable on startup, the WelcomePane "Add your first
+  workspace" CTA is disabled with an explicit footnote, and `createWorkspace`
+  failures now surface as an error toast instead of being swallowed.
+- npm releases are now published with `--provenance`, matching the prior
+  claim in README/CHANGELOG. The alpha.0 / alpha.1 tarballs do not have
+  provenance attestations; alpha.2 is the first release that actually does.
+- Toast ids no longer use `Math.random()` (AGENTS.md §6); switched to a
+  module-level monotonic counter — `crypto.randomUUID` was the previous
+  fallback but a future LAN deployment would not have a secure context.
+- README and SECURITY no longer pin a specific version number in the public
+  preview banner — the npm badge now carries that responsibility.
+- Windows is documented as Tier 2 (CI smoke + manual verification before
+  release) rather than Tier 1; the previous wording oversold what the CI
+  matrix actually covers.
+
+## 0.6.0-alpha.1 - 2026-05-14
+
+UI onboarding revamp. Three audits (visual / UX / competitive) called the
+first-run state too sparse to ship publicly; this release answers all of them
+in one batch.
+
+- Empty main area now renders a WelcomePane with a 3-step guide and a primary
+  CTA, replacing the previous black null branch in WorkspaceDetail.
+- Sidebar EmptyState absorbs the New workspace CTA so the call-to-action sits
+  in the eye-flow center; the bottom dashed Add Workspace button still appears
+  once the list is non-empty.
+- Topbar drops the hardcoded `v0.1` and reads the real package version. The
+  Blueprint and Notifications actions hide while no workspace is active.
+- Cards lose the `translateY(-1px)` hover lift. Role badges now blend the
+  status color into the surface with `color-mix(in oklab, ... 22%, var(--bg-2))`
+  so they ride the token system instead of hardcoded hex.
+- Runtime-down on first load surfaces an explicit error toast instead of
+  falling through to "No workspaces."
+- Orchestrator pane shows a Cursor-style hint overlay on the first run; any
+  keystroke or the explicit Dismiss button removes it.
+- Worker cards expose the last terminal output line for working workers,
+  backed by a new `last_output_line` field on the team list payload and a new
+  per-run `worker-output-tracker` on the runtime.
+- New Try Demo flow renders a fully client-side demo workspace (fake
+  orchestrator + two workers, prerecorded scrollback, prefilled tasks
+  checklist). The demo never touches the server.
+- New first-run wizard auto-opens once per browser via a localStorage flag and
+  routes users into Add Workspace, Try Demo, or Skip.
+- Server: duplicate-start guard in `agent-runtime.startAgent` reuses the
+  active run rather than spawning a second PTY when the orchestrator autostart
+  collides with a manual start.
+- App refactor: split into `AppProviders` + `AppInner`, extracted
+  `useFirstRunWizard`, `useEffectiveWorkspaceState`, and
+  `WorkspaceTaskDrawer` so `web/src/app.tsx` stays under the 150-line hard
+  cap.
+
+## 0.6.0-alpha.0 - 2026-05-13
 
 - Prepared Hive for public preview package distribution.
 - Added Apache-2.0 licensing metadata and repository support documents.
 - Documented supported platforms, supported CLI presets, first-run flow, safety
   model, and troubleshooting guidance.
 - Added package smoke validation for packaged runtime startup.
-

package/README.md

@@ -1,127 +1,165 @@
 # Hive
 
-Hive is a local multi-agent workspace for CLI coding agents. It turns Claude
-Code, Codex, OpenCode, Gemini, and custom CLI agents into a visible team running
-on your machine: one Orchestrator owns the plan, worker agents execute tasks in
-their own PTYs, and the web UI keeps tasks, terminals, and reports in one place.
+<p align="center">
+  <img src="./assets/hive-hero.png" alt="Hive local-first multi-agent coding workspace hero image" />
+</p>
 
-Hive is built for people who already use CLI coding agents and want a tighter
-way to coordinate several of them without giving up each agent's native
-terminal workflow.
+Hive is a local multi-agent workspace for CLI coding agents. It lets you run
+Claude Code, Codex, OpenCode, Gemini, or any custom CLI agent as a visible team:
+one Orchestrator coordinates the plan, worker agents run in their own PTYs, and
+the web UI keeps tasks, terminals, and reports in one place.
 
-> Public preview status: macOS, Linux, and Windows are the Tier 1 targets.
+[![npm](https://img.shields.io/npm/v/@tt-a1i/hive.svg)](https://www.npmjs.com/package/@tt-a1i/hive)
+[![Node](https://img.shields.io/badge/node-%3E%3D22-3c873a.svg)](https://nodejs.org/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](./LICENSE)
+[![Platforms](https://img.shields.io/badge/platforms-macOS%20%C2%B7%20Linux%20%C2%B7%20Windows%20(best--effort)-lightgrey.svg)](#platform-support)
 
-## 60 Second Start
+English · [简体中文](./README.zh-CN.md)
 
-After the package is published:
+> Public preview. Hive is local-first, runs on `127.0.0.1`, and is intended
+> for developers who already use CLI coding agents. The latest published
+> version is on [npm](https://www.npmjs.com/package/@tt-a1i/hive) and the
+> badge above resolves to it.
 
-```bash
-npm i -g @tt-a1i/hive
-hive --port 4010
-```
+## Why Hive
+
+CLI coding agents are powerful, but coordinating several of them manually is
+awkward:
+
+- Long-running sessions are spread across terminals.
+- It is hard to split a task into implementation, review, and testing without a
+  routing layer.
+- Worker progress disappears into scrollback.
+- Restart recovery depends on each CLI's native session behavior.
+
+Hive adds that coordination layer without replacing the CLIs. The agents remain
+real terminal processes running on your machine; Hive manages the team shell
+around them.
+
+## Quick Start
+
+Prerequisites:
+
+- Node.js 22 or newer.
+- At least one supported agent CLI installed, authenticated, and available on
+  `PATH`.
 
-or:
+Install and start Hive:
 
 ```bash
-npx @tt-a1i/hive --port 4010
+npm install -g @tt-a1i/hive
+hive --port 4010
 ```
 
 Open the printed local URL, usually `http://127.0.0.1:4010/`.
 
-First run flow:
+First-run flow:
 
-1. Add a workspace by picking or pasting a project folder.
+1. Create a workspace from a project folder.
 2. Choose an Orchestrator preset.
 3. Hive creates `<workspace>/.hive/tasks.md`, starts the Orchestrator PTY, and
-   injects the internal `team` command into agent sessions.
+   injects the internal `team` command into the agent session.
 4. Add workers from the Team Members panel.
-5. The Orchestrator sends work with `team send <worker-name> "<task>"`; workers
-   reply with `team report`.
+5. Ask the Orchestrator to delegate work. It sends tasks with
+   `team send <worker-name> "<task>"`; workers report back with `team report`.
+
+## How It Works
+
+```text
+Browser UI on 127.0.0.1
+  tasks, team, terminals, reports
+          |
+          | HTTP + WebSocket
+          v
+Hive runtime
+  SQLite metadata, PTY lifecycle, task dispatch
+          |
+          +-- Orchestrator PTY
+          |     can call: team send, team list, team report
+          |
+          +-- Worker PTY
+          |     can call: team report
+          |
+          +-- Worker PTY
+                can call: team report
+
+Workspace task graph:
+  <workspace>/.hive/tasks.md
+```
 
-## What It Does
+Three details matter:
 
-- Keeps each agent in an isolated recoverable PTY.
-- Shows workspaces, team members, task state, and terminal output in one local
-  web UI.
-- Uses `.hive/tasks.md` as the workspace task graph so the plan remains visible
-  outside the app.
-- Injects the internal `team` command only inside agent sessions; it does not
-  install a global `team` command.
-- Stores runtime metadata under `~/.config/hive` by default, or under
-  `HIVE_DATA_DIR` when set.
+- Agents are real CLI processes, not simulated subagents.
+- `team` is injected only inside Hive-managed agent sessions by prepending the
+  package's internal bin directory to `PATH`; it is not installed as a global
+  command.
+- The task graph is a markdown file in the workspace, so you can inspect or
+  edit it outside the app.
 
-## Supported Agent Presets
+## Agent Presets
 
-| Preset | Command expected on PATH | Notes |
-| --- | --- | --- |
-| Claude Code | `claude` | Built-in default preset. |
-| Codex | `codex` | Uses the local Codex CLI. |
-| OpenCode | `opencode` | Uses the local OpenCode CLI. |
-| Gemini | `gemini` | Uses the local Gemini CLI. |
-| Custom | Any executable | Configure command and args in the UI. |
+| Preset | Command expected on `PATH` | Default bypass mode | Session resume |
+| --- | --- | --- | --- |
+| Claude Code | `claude` | `--dangerously-skip-permissions`, `--permission-mode=bypassPermissions` | `--resume <session_id>` |
+| Codex | `codex` | `--dangerously-bypass-approvals-and-sandbox` | `resume <session_id>` |
+| OpenCode | `opencode` | `--dangerously-skip-permissions` | `--session <session_id>` |
+| Gemini | `gemini` | `--yolo` | `--resume <session_id>` |
+| Custom | Any executable | User configured | User configured |
+
+Hive does not install these CLIs for you. Install and authenticate them in the
+same shell environment you use to start Hive.
+
+## What Hive Provides
 
-Hive does not install these CLIs for you. Install and authenticate each agent
-CLI before selecting it in Hive.
+- Workspace sidebar for switching between local projects.
+- Orchestrator and worker terminals backed by real PTYs.
+- Add Worker flow with role presets for coder, reviewer, tester, and custom
+  members.
+- `.hive/tasks.md` editor with external-file conflict handling.
+- Background PTY preservation and best-effort native session resume.
+- Local SQLite metadata under `~/.config/hive` by default, or `$HIVE_DATA_DIR`
+  when set.
+
+Hive does not provide sandboxing, multi-user auth, cloud hosting, or its own
+coding model. It coordinates tools you already run locally.
 
 ## Platform Support
 
 | Platform | Status | Notes |
 | --- | --- | --- |
-| macOS | Tier 1 | Local development and release verification target. |
-| Linux | Tier 1 | CI verification target; folder picking expects `zenity` when using the native picker. |
-| Windows | Tier 1 | CI verification target; folder picking uses Windows PowerShell and the packaged internal `team.cmd`. |
+| macOS | Tier 1 | Main development and release verification target. |
+| Linux | Tier 1 | CI verified. Native folder picking expects `zenity`; manual path entry works without it. |
+| Windows | Tier 2 | CI runs a Windows test subset and a packaged-install smoke. Folder picking uses Windows PowerShell and the package includes `team.cmd`. Treat as best-effort — full Windows verification before each release is manual. |
+
+All platforms require Node.js 22+. Hive depends on `node-pty`, so native install
+tooling may be required when prebuilt binaries are unavailable.
 
 ## Safety Model
 
-Hive is a local development tool, not a hosted multi-user service.
+Hive is a local development tool, not a hosted service.
 
 - The runtime binds to `127.0.0.1`. Do not expose the Hive port through a public
   tunnel, reverse proxy, or shared network interface.
 - Built-in presets intentionally use each CLI's non-interactive or bypass mode
   where available. Treat workers as able to run arbitrary shell commands inside
   the selected workspace.
-- Only open trusted workspaces. A worker has the same filesystem access as the
+- Open only trusted workspaces. A worker has the same filesystem access as the
   shell account running Hive.
 - Agent tokens are session scoped, generated by the local runtime, injected into
   agent process environments, and not intended as internet-facing credentials.
-- Hive has no multi-user authentication boundary. If another process can reach
-  the local port from the same machine, treat it as trusted local access.
-
-See [SECURITY.md](SECURITY.md) before using Hive with sensitive repositories.
-
-## Development
-
-```bash
-pnpm install
-pnpm dev
-```
-
-The development runtime uses `127.0.0.1:4010`; the Vite web server uses
-`127.0.0.1:5180` and proxies API and WebSocket traffic to the runtime.
-
-Useful checks:
-
-```bash
-pnpm check
-pnpm build
-pnpm test
-```
-
-## Production-Style Local Run
-
-```bash
-pnpm build
-node dist/src/cli/hive.js --port 4010
-```
+- Hive has no multi-user authentication boundary. Treat same-machine processes
+  that can reach the local port as trusted local access.
 
-The production server serves `web/dist` directly. No separate Vite server is
-needed after `pnpm build`.
+Read [SECURITY.md](SECURITY.md) before using Hive with sensitive repositories.
 
-Use an isolated data directory when testing:
+## Data Locations
 
-```bash
-HIVE_DATA_DIR=/tmp/hive-data node dist/src/cli/hive.js --port 4010
-```
+| Data | Location |
+| --- | --- |
+| Runtime metadata | `~/.config/hive` or `$HIVE_DATA_DIR` |
+| Workspace tasks | `<workspace>/.hive/tasks.md` |
+| Internal `team` command | Packaged under `dist/bin/`, injected into PTYs |
+| Web UI assets | Served by the runtime from the packaged `web/dist` build |
 
 ## Troubleshooting
 
@@ -132,7 +170,7 @@ same shell, and available on `PATH`.
 
 **Port already in use**
 
-Start Hive with a different local port:
+Start Hive with another local port:
 
 ```bash
 hive --port 4020
@@ -140,9 +178,9 @@ hive --port 4020
 
 **Native PTY install fails**
 
-Hive depends on `node-pty`, which ships native binaries. Use Node.js 22+, keep
-your package manager cache clean, and verify your platform is macOS, Linux, or
-Windows.
+Hive depends on `node-pty`, which uses native binaries. Use Node.js 22+, keep
+your package manager cache clean, and verify your platform build tools are
+available.
 
 **Folder picker does not open on Linux**
 
@@ -158,17 +196,55 @@ workspace path manually.
 Hive detected a newer `.hive/tasks.md` on disk. Use `Reload` to accept the file
 from disk, or `Keep Local` to keep the editor contents and save again.
 
-## Package Release
+**Worker appears stuck in `working`**
+
+Hive does not guess task completion from process activity. Workers move back to
+`idle` when they call `team report`. If a worker is blocked, stop or restart it
+from the UI.
+
+## Development
+
+```bash
+pnpm install
+pnpm dev
+```
+
+Development mode runs the runtime on `127.0.0.1:4010`; Vite runs on
+`127.0.0.1:5180` and proxies API and WebSocket traffic to the runtime.
+
+Useful checks:
+
+```bash
+pnpm check
+pnpm build
+pnpm test
+```
+
+Production-style local run:
+
+```bash
+pnpm build
+node dist/src/cli/hive.js --port 4010
+```
 
-Release commands are intentionally separate from normal development:
+The production server serves the built web UI directly. No Vite server is
+needed after `pnpm build`.
+
+## Release
+
+Maintainer dry run:
 
 ```bash
 pnpm release:dry
 ```
 
-That command runs linting, the production build, the full test suite, npm
-packlist validation, and a tarball install smoke test. Tag pushes matching `v*`
-run the GitHub Actions release workflow; the publish job requires `NPM_TOKEN`.
+Tag pushes matching `v*` run the GitHub Actions release workflow. The workflow
+verifies macOS, Ubuntu, and Windows, then publishes to npm with `NPM_TOKEN`.
+
+## Status
+
+Hive is in alpha public preview. Expect UI and protocol details to keep moving
+while the core local orchestration model hardens.
 
 ## License
 

package/README.zh-CN.md

@@ -0,0 +1,213 @@
+# Hive
+
+<p align="center">
+  <img src="./assets/hive-hero.png" alt="Hive 本机多 agent 协作工作台" />
+</p>
+
+Hive 是一个本机多 agent 协作工作台。它让 Claude Code、Codex、OpenCode、Gemini 或任意自定义 CLI Agent 组成一个可见的团队：一个 Orchestrator 负责协调计划，多个 Worker 在各自的 PTY 里执行任务，Web UI 把任务、终端和汇报集中在一处。
+
+[![npm](https://img.shields.io/npm/v/@tt-a1i/hive.svg)](https://www.npmjs.com/package/@tt-a1i/hive)
+[![Node](https://img.shields.io/badge/node-%3E%3D22-3c873a.svg)](https://nodejs.org/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](./LICENSE)
+[![Platforms](https://img.shields.io/badge/platforms-macOS%20%C2%B7%20Linux%20%C2%B7%20Windows%20(best--effort)-lightgrey.svg)](#平台支持)
+
+[English](./README.md) · 简体中文
+
+> Public preview。Hive 是本机优先的工具，只监听 `127.0.0.1`，面向已经在用 CLI Coding Agent 的开发者。最新发布版本见 [npm](https://www.npmjs.com/package/@tt-a1i/hive)，上面的 badge 会指向它。
+
+## 为什么需要 Hive
+
+CLI Coding Agent 各自都很强，但同时管几个就有点别扭：
+
+- 长任务的会话散在好几个终端里，注意力来回切。
+- 想把"实现 / review / 测试"分给三个 agent，却没有一层把它们路由起来。
+- Worker 的进度淹在 scrollback 里，回头看找不到。
+- 想重启接着干，全看每个 CLI 自己的 session 恢复行为，散乱不可控。
+
+Hive 加上这一层调度，**不替换**任何 CLI。Agent 还是真实跑在你电脑上的终端进程，Hive 只是它们外面的"团队 shell"。
+
+## 快速开始
+
+前置条件：
+
+- Node.js 22 或更新版本
+- 至少一个支持的 Agent CLI 已经安装好、登录过、在 `PATH` 上可调用
+
+安装并启动 Hive：
+
+```bash
+npm install -g @tt-a1i/hive
+hive --port 4010
+```
+
+打开终端打印出来的本机地址，通常是 `http://127.0.0.1:4010/`。
+
+首次使用流程：
+
+1. 选择一个项目目录作为 workspace。
+2. 挑一个 Orchestrator 预设。
+3. Hive 会创建 `<workspace>/.hive/tasks.md`，启动 Orchestrator 的 PTY，把内部的 `team` 命令注入这个 agent 会话。
+4. 在 Team Members 面板里添加 Worker。
+5. 跟 Orchestrator 说一声让它派活，它会用 `team send <worker-name> "<task>"` 发任务，Worker 完事后用 `team report` 回报。
+
+## 工作方式
+
+```text
+浏览器 UI 跑在 127.0.0.1
+  任务 · 团队 · 终端 · 汇报
+          |
+          | HTTP + WebSocket
+          v
+Hive Runtime
+  SQLite 元数据 · PTY 生命周期 · 任务派单
+          |
+          +-- Orchestrator PTY
+          |     可调用：team send、team list、team report
+          |
+          +-- Worker PTY
+          |     可调用：team report
+          |
+          +-- Worker PTY
+                可调用：team report
+
+Workspace 任务图：
+  <workspace>/.hive/tasks.md
+```
+
+三个细节值得记住：
+
+- Agent 是真正的 CLI 进程，不是模拟的 subagent。
+- `team` 命令**只**在 Hive 管理的 agent 会话里可用——通过把包内 bin 目录 prepend 到 PATH 实现，不会装成全局命令。
+- 任务图就是 workspace 里的一份 markdown 文件，你可以在编辑器里直接看或者改。
+
+## Agent 预设
+
+| 预设 | `PATH` 上的命令 | 默认 bypass 模式 | 会话恢复 |
+| --- | --- | --- | --- |
+| Claude Code | `claude` | `--dangerously-skip-permissions`、`--permission-mode=bypassPermissions` | `--resume <session_id>` |
+| Codex | `codex` | `--dangerously-bypass-approvals-and-sandbox` | `resume <session_id>` |
+| OpenCode | `opencode` | `--dangerously-skip-permissions` | `--session <session_id>` |
+| Gemini | `gemini` | `--yolo` | `--resume <session_id>` |
+| 自定义 | 任意可执行文件 | 自己配 | 自己配 |
+
+Hive 不替你安装这些 CLI。请在启动 Hive 的同一个 shell 环境里先装好、登录好。
+
+## Hive 提供什么
+
+- Workspace 侧边栏，方便在多个本机项目之间切换。
+- Orchestrator 和 Worker 终端都是真实 PTY 支撑的。
+- Add Worker 流程预置了 coder / reviewer / tester 和自定义成员的角色模板。
+- `.hive/tasks.md` 编辑器，带外部文件冲突处理。
+- PTY 后台保留 + 尽力使用各 CLI 原生 session 恢复。
+- 元数据存在本机 SQLite，默认在 `~/.config/hive`，或者通过 `$HIVE_DATA_DIR` 指定。
+
+Hive **不**提供 sandbox 隔离、多用户认证、云端托管，也没有自带的编码模型。它只负责调度你已经在用的本机工具。
+
+## 平台支持
+
+| 平台 | 状态 | 备注 |
+| --- | --- | --- |
+| macOS | Tier 1 | 主开发与发布验证平台 |
+| Linux | Tier 1 | CI 持续验证。目录选择器需要 `zenity`，没装也可以手动粘贴路径 |
+| Windows | Tier 2 | CI 跑 Windows 测试子集 + 打包安装 smoke。目录选择器走 Windows PowerShell，包内带了 `team.cmd`。视为 best-effort——每次发版前的完整 Windows 验证仍是手动 |
+
+所有平台都需要 Node.js 22+。Hive 依赖 `node-pty`，没有预编译二进制时需要你本机有原生构建工具链。
+
+## 安全模型
+
+Hive 是本机开发工具，**不是**托管服务。
+
+- Runtime 只监听 `127.0.0.1`。不要把 Hive 端口通过公网隧道、反向代理或任何共享网络接口暴露出去。
+- 内置预设会主动传 CLI 的 non-interactive / bypass flag。Worker 在选中的 workspace 里有跟启动 shell **同等**的执行权限——把它当成"会自动跑命令的你自己"。
+- 只打开你信任的 workspace。Worker 拥有跟你登录账户一样的文件系统访问权限。
+- Agent token 是 session 级的，由本机 runtime 生成，注入到 agent 进程环境变量里，**不**用于跨网络通信。
+- Hive 不做多用户认证。任何能从本机访问到端口的进程都视为可信本地访问。
+
+在敏感仓库里用 Hive 之前，请先读 [SECURITY.md](SECURITY.md)。
+
+## 数据位置
+
+| 数据 | 位置 |
+| --- | --- |
+| Runtime 元数据 | `~/.config/hive` 或 `$HIVE_DATA_DIR` |
+| Workspace 任务图 | `<workspace>/.hive/tasks.md` |
+| 内部 `team` 命令 | 包内 `dist/bin/`，通过 PATH 注入 PTY |
+| Web UI 资源 | 由 runtime 从包内 `web/dist` 直接服务 |
+
+## 故障排查
+
+**找不到 Agent CLI**
+
+确认选中的命令已经安装好、登录好、在启动 Hive 那个 shell 里能直接调用，且在 `PATH` 上。
+
+**端口被占用**
+
+换个本机端口启动：
+
+```bash
+hive --port 4020
+```
+
+**node-pty 原生构建失败**
+
+Hive 依赖 `node-pty`，它用原生二进制。确认 Node.js 22+，清干净 package manager 缓存，并准备好你平台的构建工具（macOS Xcode CLI、Linux build-essential + python3、Windows VS Build Tools）。
+
+**Linux 上目录选择器不弹**
+
+装 `zenity`，或者直接在对话框里粘路径。
+
+**Windows 上目录选择器不弹**
+
+确认 `powershell.exe` 在 `PATH` 上，或者直接粘路径。
+
+**Tasks 文件冲突 banner 出现**
+
+Hive 检测到磁盘上的 `.hive/tasks.md` 比 UI 里的新。`Reload` 接受磁盘版本，`Keep Local` 保留 UI 编辑并覆盖保存。
+
+**Worker 卡在 `working` 状态**
+
+Hive 不通过进程活动猜测任务完成。Worker 只有在调 `team report` 时才会回到 `idle`。如果它确实卡了，从 UI 里 Stop 或 Restart。
+
+## 开发
+
+```bash
+pnpm install
+pnpm dev
+```
+
+开发模式下 runtime 跑在 `127.0.0.1:4010`，Vite 跑在 `127.0.0.1:5180`，把 API 和 WebSocket 代理到 runtime。
+
+常用命令：
+
+```bash
+pnpm check
+pnpm build
+pnpm test
+```
+
+预演 production 构建：
+
+```bash
+pnpm build
+node dist/src/cli/hive.js --port 4010
+```
+
+Production 模式下 runtime 直接服务构建好的 web UI，不需要单独的 Vite。
+
+## 发布
+
+维护者本地预演：
+
+```bash
+pnpm release:dry
+```
+
+带 `v*` 的 tag push 会触发 GitHub Actions release workflow。workflow 会在 macOS、Ubuntu、Windows 三平台验证，然后用 `NPM_TOKEN` 发布到 npm。
+
+## 状态
+
+Hive 正处于 alpha public preview 阶段。在本机调度模型稳定下来之前，UI 和协议细节还会继续调整。
+
+## License
+
+Apache-2.0。详见 [LICENSE](LICENSE)。

package/SECURITY.md

@@ -43,6 +43,5 @@ Please include:
 
 - Running Hive as a shared server for multiple users.
 - Exposing Hive through a public tunnel or reverse proxy.
-- Windows production support.
+- Operating Hive as a hardened production service.
 - Sandboxing third-party CLI agents beyond the controls provided by those CLIs.
-

package/dist/src/server/agent-runtime.js

@@ -81,6 +81,9 @@ export const createAgentRuntime = (agentManager, agentRunStore, sessionStore, ge
         },
         async startAgent(workspace, agentId, input) {
             launchCache.setWorkspaceId(agentId, workspace.id);
+            const activeRun = getActiveRunByAgent(registry, launchCache.getWorkspaceId, syncRun, workspace.id, agentId);
+            if (activeRun)
+                return activeRun;
             return startLiveRun(workspace, agentId, launchCache.get(workspace.id, agentId), input.hivePort);
         },
         stopAgentRun(runId) {

package/dist/src/server/agent-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runtime.js","sourceRoot":"","sources":["../../../src/server/agent-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAsB,MAAM,qBAAqB,CAAA;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,YAAsC,EACtC,aAAgC,EAChC,YAAmC,EACnC,gBAAiE,EACjE,WAA2D,EAC3D,gBAA+B,uBAAuB,EAAE,EACxD,QAA6E,EAC/D,EAAE;IAChB,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,wBAAwB,EAAE,CAAA;IAChD,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC3F,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IACD,MAAM,WAAW,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAA;IAEjE,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,EAAE,CACpC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3F,MAAM,eAAe,GAAG,0BAA0B,CAAC;QACjD,YAAY;QACZ,eAAe,EAAE,WAAW,CAAC,IAAI;QACjC,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,YAAY;QACZ,QAAQ;QACR,WAAW;QACX,KAAK,EAAE,aAAa;QACpB,YAAY;QACZ,aAAa;QACb,gBAAgB;QAChB,QAAQ;QACR,aAAa;KACd,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;QACD,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK;YAC9C,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;QACD,uBAAuB,CAAC,WAAW,EAAE,OAAO;YAC1C,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;QACD,qBAAqB,CAAC,WAAW,EAAE,OAAO;YACxC,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/C,CAAC;QACD,qBAAqB,CAAC,WAAW,EAAE,OAAO;YACxC,OAAO,mBAAmB,CACxB,QAAQ,EACR,WAAW,CAAC,cAAc,EAC1B,OAAO,EACP,WAAW,EACX,OAAO,CACR,CAAA;QACH,CAAC;QACD,UAAU,CAAC,KAAK;YACd,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAA;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,eAAe;YACb,OAAO,WAAW,CAAC,YAAY,EAAE,CAAA;QACnC,CAAC;QACD,aAAa,CAAC,OAAO;YACnB,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACtF,CAAC;QACD,QAAQ,CAAC,KAAK;YACZ,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QACD,cAAc,CAAC,OAAO;YACpB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QACD,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI;YAC9B,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,CAAC;QACD,SAAS,CAAC,KAAK;YACb,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK;YACxC,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;YACjD,OAAO,YAAY,CACjB,SAAS,EACT,OAAO,EACP,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,EACtC,KAAK,CAAC,QAAQ,CACf,CAAA;QACH,CAAC;QACD,YAAY,CAAC,KAAK;YAChB,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACrD,CAAC;QACD,kBAAkB,EAAE,aAAa,CAAC,QAAQ;QAC1C,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,EAAE;YAC/E,eAAe,CAAC,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QACpF,CAAC;QACD,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI;YAC3E,eAAe,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAA;QAChG,CAAC;QACD,oBAAoB,CAAC,WAAW,EAAE,IAAI;YACpC,eAAe,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"agent-runtime.js","sourceRoot":"","sources":["../../../src/server/agent-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAsB,MAAM,qBAAqB,CAAA;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,YAAsC,EACtC,aAAgC,EAChC,YAAmC,EACnC,gBAAiE,EACjE,WAA2D,EAC3D,gBAA+B,uBAAuB,EAAE,EACxD,QAA6E,EAC/D,EAAE;IAChB,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,wBAAwB,EAAE,CAAA;IAChD,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC3F,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IACD,MAAM,WAAW,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAA;IAEjE,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,EAAE,CACpC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3F,MAAM,eAAe,GAAG,0BAA0B,CAAC;QACjD,YAAY;QACZ,eAAe,EAAE,WAAW,CAAC,IAAI;QACjC,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,YAAY;QACZ,QAAQ;QACR,WAAW;QACX,KAAK,EAAE,aAAa;QACpB,YAAY;QACZ,aAAa;QACb,gBAAgB;QAChB,QAAQ;QACR,aAAa;KACd,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;QACD,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK;YAC9C,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;QACD,uBAAuB,CAAC,WAAW,EAAE,OAAO;YAC1C,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;QACD,qBAAqB,CAAC,WAAW,EAAE,OAAO;YACxC,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/C,CAAC;QACD,qBAAqB,CAAC,WAAW,EAAE,OAAO;YACxC,OAAO,mBAAmB,CACxB,QAAQ,EACR,WAAW,CAAC,cAAc,EAC1B,OAAO,EACP,WAAW,EACX,OAAO,CACR,CAAA;QACH,CAAC;QACD,UAAU,CAAC,KAAK;YACd,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAA;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,eAAe;YACb,OAAO,WAAW,CAAC,YAAY,EAAE,CAAA;QACnC,CAAC;QACD,aAAa,CAAC,OAAO;YACnB,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACtF,CAAC;QACD,QAAQ,CAAC,KAAK;YACZ,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QACD,cAAc,CAAC,OAAO;YACpB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QACD,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI;YAC9B,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,CAAC;QACD,SAAS,CAAC,KAAK;YACb,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK;YACxC,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;YACjD,MAAM,SAAS,GAAG,mBAAmB,CACnC,QAAQ,EACR,WAAW,CAAC,cAAc,EAC1B,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,OAAO,CACR,CAAA;YACD,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAA;YAC/B,OAAO,YAAY,CACjB,SAAS,EACT,OAAO,EACP,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,EACtC,KAAK,CAAC,QAAQ,CACf,CAAA;QACH,CAAC;QACD,YAAY,CAAC,KAAK;YAChB,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACrD,CAAC;QACD,kBAAkB,EAAE,aAAa,CAAC,QAAQ;QAC1C,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,EAAE;YAC/E,eAAe,CAAC,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QACpF,CAAC;QACD,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI;YAC3E,eAAe,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAA;QAChG,CAAC;QACD,oBAAoB,CAAC,WAAW,EAAE,IAAI;YACpC,eAAe,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}