@tt-a1i/hive 1.4.3 → 1.5.0

package/dist/src/cli/team.js

@@ -1,5 +1,5 @@
-import { realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { sameFilesystemPath } from '../server/path-canonicalization.js';
 const REQUIRED_ENV_KEYS = [
     'HIVE_PORT',
     'HIVE_PROJECT_ID',
@@ -10,6 +10,13 @@ const TEAM_USAGE = [
     'Usage:',
     '  team list',
     '  team send <worker-name> "<task>"',
+    '  team spawn <role> [--name <name>] [--cli <claude|codex|opencode|gemini>] [--ephemeral]',
+    '  team dismiss <worker-name>',
+    "  team workflow run --stdin [--args '<JSON>']   (script from stdin — for multi-line scripts)",
+    '  team workflow run --inline "<source>" [--args \'<JSON>\']',
+    '  team workflow stop <run-id>',
+    '  team workflow show <run-id>   (full per-agent transcript for one run)',
+    '  team workflow schedule --cron "<cron>" --name <n> --stdin   (register a recurring run)',
     '  team cancel --dispatch <dispatch-id> "<reason>"',
     '  team report "<result>" [--dispatch <dispatch-id>] [--artifact <path>]',
     '  team report --stdin [--dispatch <dispatch-id>] [--artifact <path>]',
@@ -17,10 +24,13 @@ const TEAM_USAGE = [
     '  team status --stdin [--artifact <path>]',
     '',
     'Flags can appear in any order. Use --stdin to pipe long bodies and avoid shell-escaping issues.',
-    "Use a quoted heredoc (<<'EOF') so $vars, backticks, and command substitutions stay literal:",
-    "  team report --stdin --dispatch <id> <<'EOF'",
-    '  ... long report ...',
-    '  EOF',
+    'The body comes from stdin — use whatever your shell supports:',
+    "  POSIX:        team report --stdin --dispatch <id> <<'EOF'",
+    '                ... long report ...',
+    '                EOF',
+    '  Windows cmd:  type body.txt | team report --stdin --dispatch <id>',
+    '  PowerShell:   Get-Content body.txt | team report --stdin --dispatch <id>',
+    '  Portable:     team report --stdin --dispatch <id> < body.txt',
     '',
     'For role rules, workflow, and recovery instructions, see .hive/PROTOCOL.md',
 ].join('\n');
@@ -32,6 +42,15 @@ const getHiveEnv = () => {
     return values;
 };
 const getBaseUrl = (env) => `http://127.0.0.1:${env.HIVE_PORT}`;
+// Read `--flag value` from an argv slice; returns undefined when absent or
+// when the flag is the last token with no following value.
+const readFlag = (args, flag) => {
+    const index = args.indexOf(flag);
+    if (index === -1)
+        return undefined;
+    const value = args[index + 1];
+    return value && !value.startsWith('--') ? value : undefined;
+};
 const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const describeFetchError = (baseUrl, error) => {
     const cause = error instanceof Error && error.cause instanceof Error ? ` (${error.cause.message})` : '';
@@ -174,6 +193,20 @@ export const parseCancelArgs = (args) => {
     }
     return { dispatchId, reason };
 };
+export const decodeStdinBuffer = (buffer) => {
+    if (buffer.length >= 3 && buffer[0] === 0xef && buffer[1] === 0xbb && buffer[2] === 0xbf) {
+        return buffer.subarray(3).toString('utf8');
+    }
+    if (buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe) {
+        return buffer.subarray(2).toString('utf16le');
+    }
+    if (buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff) {
+        const swapped = Buffer.from(buffer.subarray(2));
+        swapped.swap16();
+        return swapped.toString('utf16le');
+    }
+    return buffer.toString('utf8');
+};
 export const readStdinToString = async (command = 'report') => {
     if (process.stdin.isTTY) {
         throw new Error(withUsage('--stdin requires piped input, but stdin is a TTY. Did you forget to pipe content in?', command));
@@ -182,7 +215,7 @@ export const readStdinToString = async (command = 'report') => {
     for await (const chunk of process.stdin) {
         chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
     }
-    const content = Buffer.concat(chunks).toString('utf8');
+    const content = decodeStdinBuffer(Buffer.concat(chunks));
     if (!content.trim()) {
         throw new Error(withUsage('--stdin received empty input', command));
     }
@@ -226,9 +259,184 @@ export const runTeamCommand = async (argv) => {
             to: workerName,
             text: task,
         });
+        const payload = (await response.json());
+        /* When the dispatch happened to also auto-wake a stopped worker
+           (PTY had no active run), make the silent restart visible. Stderr
+           is the right channel because the JSON on stdout is the
+           machine-readable payload; the human-readable narration goes
+           beside it so it doesn't corrupt parsers. */
+        if (payload.restarted_worker === true) {
+            console.error(`Hive woke up worker "${workerName}" before dispatching.`);
+        }
+        console.log(JSON.stringify(payload));
+        return;
+    }
+    if (command === 'spawn') {
+        const role = args[0];
+        if (!role || role.startsWith('--')) {
+            throw new Error('Usage: team spawn <role> [--name <name>] [--cli <claude|codex|opencode|gemini>] [--ephemeral]\n' +
+                '  Default: persistent member (lives until you `team dismiss` it).\n' +
+                '  --ephemeral: auto-dismiss after the next dispatch report (one-shot worker).');
+        }
+        const name = readFlag(args, '--name');
+        const cli = readFlag(args, '--cli');
+        const ephemeral = args.includes('--ephemeral');
+        const env = getHiveEnv();
+        const response = await postJson(getBaseUrl(env), '/api/team/spawn', {
+            project_id: env.HIVE_PROJECT_ID,
+            from_agent_id: env.HIVE_AGENT_ID,
+            token: env.HIVE_AGENT_TOKEN,
+            role,
+            ...(name ? { name } : {}),
+            ...(cli ? { cli } : {}),
+            ...(ephemeral ? { ephemeral: true } : {}),
+        });
         console.log(JSON.stringify(await response.json()));
         return;
     }
+    if (command === 'dismiss') {
+        const workerName = args[0];
+        if (!workerName || workerName.startsWith('--')) {
+            throw new Error('Usage: team dismiss <worker-name>');
+        }
+        const env = getHiveEnv();
+        const response = await postJson(getBaseUrl(env), '/api/team/dismiss', {
+            project_id: env.HIVE_PROJECT_ID,
+            from_agent_id: env.HIVE_AGENT_ID,
+            token: env.HIVE_AGENT_TOKEN,
+            name: workerName,
+        });
+        console.log(JSON.stringify(await response.json()));
+        return;
+    }
+    if (command === 'workflow') {
+        const sub = args[0];
+        const rest = args.slice(1);
+        if (sub === 'run') {
+            const inlineFlag = rest.indexOf('--inline');
+            const stdinFlag = rest.includes('--stdin');
+            const name = readFlag(rest, '--name');
+            // TIER 2 #8 — `--args '<JSON>'` makes the script's `args` global a
+            // real value instead of always undefined. Parses lazily so a bad
+            // JSON gives a clear local error before the HTTP round-trip.
+            const rawArgs = readFlag(rest, '--args');
+            let parsedArgs;
+            if (rawArgs !== undefined) {
+                try {
+                    parsedArgs = JSON.parse(rawArgs);
+                }
+                catch (error) {
+                    throw new Error(`Usage: team workflow run … --args '<JSON>'\n  --args must be valid JSON; got: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            let source;
+            if (inlineFlag !== -1) {
+                const literal = rest[inlineFlag + 1];
+                if (!literal)
+                    throw new Error('Usage: team workflow run --inline "<script-source>"');
+                source = literal;
+            }
+            else if (stdinFlag) {
+                source = await readStdinToString('workflow run');
+            }
+            else {
+                throw new Error('Usage: team workflow run --stdin   |   team workflow run --inline "<script-source>"\n' +
+                    '  Pass workflow source via stdin (POSIX heredoc / `type x.ts |`) or as one inline arg.\n' +
+                    "  Optional: --args '<JSON>' makes the script's `args` global a real value.");
+            }
+            const env = getHiveEnv();
+            const response = await postJson(getBaseUrl(env), '/api/team/workflow/run', {
+                project_id: env.HIVE_PROJECT_ID,
+                from_agent_id: env.HIVE_AGENT_ID,
+                token: env.HIVE_AGENT_TOKEN,
+                source,
+                ...(name ? { name } : {}),
+                ...(parsedArgs !== undefined ? { args: parsedArgs } : {}),
+            });
+            console.log(JSON.stringify(await response.json()));
+            return;
+        }
+        if (sub === 'stop') {
+            const runId = rest[0];
+            if (!runId)
+                throw new Error('Usage: team workflow stop <run-id>');
+            const env = getHiveEnv();
+            const response = await postJson(getBaseUrl(env), '/api/team/workflow/stop', {
+                project_id: env.HIVE_PROJECT_ID,
+                from_agent_id: env.HIVE_AGENT_ID,
+                token: env.HIVE_AGENT_TOKEN,
+                run_id: runId,
+            });
+            console.log(JSON.stringify(await response.json()));
+            return;
+        }
+        if (sub === 'show') {
+            const runId = rest[0];
+            if (!runId)
+                throw new Error('Usage: team workflow show <run-id>');
+            const env = getHiveEnv();
+            const response = await postJson(getBaseUrl(env), '/api/team/workflow/show', {
+                project_id: env.HIVE_PROJECT_ID,
+                from_agent_id: env.HIVE_AGENT_ID,
+                token: env.HIVE_AGENT_TOKEN,
+                run_id: runId,
+            });
+            console.log(JSON.stringify(await response.json()));
+            return;
+        }
+        if (sub === 'schedule') {
+            const usage = 'Usage: team workflow schedule --cron "<5-field cron>" --name <name> --stdin\n' +
+                '       team workflow schedule --cron "<cron>" --name <name> --inline "<source>" [--args \'<JSON>\']\n' +
+                '  Registers a recurring run. Source is persisted so cron can fire it with no orchestrator present.';
+            const inlineFlag = rest.indexOf('--inline');
+            const stdinFlag = rest.includes('--stdin');
+            const cron = readFlag(rest, '--cron');
+            const name = readFlag(rest, '--name');
+            if (!cron || !name)
+                throw new Error(usage);
+            const rawArgs = readFlag(rest, '--args');
+            let parsedArgs;
+            if (rawArgs !== undefined) {
+                try {
+                    parsedArgs = JSON.parse(rawArgs);
+                }
+                catch (error) {
+                    throw new Error(`Usage: team workflow schedule … --args '<JSON>'\n  --args must be valid JSON; got: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            let source;
+            if (inlineFlag !== -1) {
+                const literal = rest[inlineFlag + 1];
+                if (!literal)
+                    throw new Error(usage);
+                source = literal;
+            }
+            else if (stdinFlag) {
+                source = await readStdinToString('workflow schedule');
+            }
+            else {
+                throw new Error(usage);
+            }
+            const env = getHiveEnv();
+            const response = await postJson(getBaseUrl(env), '/api/team/workflow/schedule', {
+                project_id: env.HIVE_PROJECT_ID,
+                from_agent_id: env.HIVE_AGENT_ID,
+                token: env.HIVE_AGENT_TOKEN,
+                source,
+                name,
+                cron,
+                ...(parsedArgs !== undefined ? { args: parsedArgs } : {}),
+            });
+            console.log(JSON.stringify(await response.json()));
+            return;
+        }
+        throw new Error('Usage:\n' +
+            "  team workflow run --stdin [--args '<JSON>']     (read script from stdin)\n" +
+            '  team workflow run --inline "<source>" [--args ...]  (one-arg form)\n' +
+            '  team workflow stop <run-id>                     (cancel a running workflow)\n' +
+            '  team workflow show <run-id>                     (full per-agent transcript)\n' +
+            '  team workflow schedule --cron "<cron>" --name <n> --stdin   (register a recurring run)');
+    }
     if (command === 'cancel') {
         const cancel = parseCancelArgs(args);
         const env = getHiveEnv();
@@ -282,7 +490,7 @@ export const runTeamCommand = async (argv) => {
     throw new Error('Unsupported team command');
 };
 const isMainModule = process.argv[1]
-    ? fileURLToPath(import.meta.url) === realpathSync(process.argv[1])
+    ? sameFilesystemPath(fileURLToPath(import.meta.url), process.argv[1])
     : false;
 if (isMainModule) {
     void runTeamCommand(process.argv.slice(2)).catch((error) => {

package/dist/src/server/agent-command-resolver.d.ts

@@ -1,5 +1,14 @@
 interface ResolvedSpawnCommand {
-    args: string[];
+    /**
+     * `args` is a `string[]` for plain executables (node-pty's serializer is
+     * fine for them) and a verbatim `string` for Windows `.cmd`/`.bat` shim
+     * launches. The verbatim form bypasses node-pty's `argsToCommandLine`,
+     * because that function backslash-escapes any embedded `"` and cmd.exe
+     * does NOT recognize `\"` as an escape — it treats `\` as literal, which
+     * leaves cmd looking up a program name containing literal quote chars.
+     * See `node-pty/src/windowsPtyAgent.ts` `argsToCommandLine` for the rule.
+     */
+    args: string | string[];
     command: string;
 }
 export declare const resolveCommandPath: (command: string, cwd: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform) => string;

package/dist/src/server/agent-command-resolver.js

@@ -1,5 +1,6 @@
 import { accessSync, constants } from 'node:fs';
-import { delimiter, extname, isAbsolute, join } from 'node:path';
+import { basename, delimiter, extname, isAbsolute, join } from 'node:path';
+import { buildCmdCallCommand } from './windows-command-line.js';
 const hasPathSeparator = (command) => command.includes('/') || command.includes('\\');
 const canExecute = (path, platform = process.platform) => {
     try {
@@ -54,16 +55,43 @@ const isWindowsBatchFile = (command) => {
     const extension = extname(command).toLowerCase();
     return extension === '.cmd' || extension === '.bat';
 };
-const quoteWindowsCommandArgument = (value) => `"${value.replace(/"/g, '\\"')}"`;
-const createWindowsCommandLine = (command, args) => [command, ...args].map(quoteWindowsCommandArgument).join(' ');
+const buildWindowsBatchCommandLine = (command, args) => {
+    // `call` is cmd's built-in batch invocation; it handles quoted .cmd / .bat
+    // paths reliably (this is the same pattern Node.js's child_process uses
+    // internally on Windows since the CVE-2024-27980 fix).
+    return `/d /s /c ${buildCmdCallCommand(command, args)}`;
+};
+/**
+ * Recognize the exact shape that `createStartupCommandLaunch` produces on
+ * Windows: `cmd.exe` with args `['/d', '/s', '/c', '<raw user command>']`.
+ * Pinned to length 4 so this branch only fires for that single contract;
+ * any other cmd.exe invocation (e.g. someone explicitly composing custom
+ * shell args via the launch config) keeps the default node-pty path.
+ *
+ * We need this repackaging because the user's raw command often contains `"`
+ * (Windows users habitually wrap paths) and node-pty's `argsToCommandLine`
+ * backslash-escapes those — cmd.exe then sees `\"...\"` and looks up a
+ * program whose name starts with `\`.
+ */
+const isCmdExeShellLaunch = (resolvedCommand, args) => basename(resolvedCommand).toLowerCase() === 'cmd.exe' &&
+    args.length === 4 &&
+    args[0] === '/d' &&
+    args[1] === '/s' &&
+    (args[2] === '/c' || args[2] === '/k');
 export const resolveSpawnCommand = (command, cwd, env, args = [], platform = process.platform) => {
     const resolvedCommand = resolveCommandPath(command, cwd, env, platform);
     if (platform === 'win32' && isWindowsBatchFile(resolvedCommand)) {
         return {
-            args: ['/d', '/s', '/c', createWindowsCommandLine(resolvedCommand, args)],
+            args: buildWindowsBatchCommandLine(resolvedCommand, args),
             command: getEnvValue(env, 'ComSpec', platform) ?? 'cmd.exe',
         };
     }
+    if (platform === 'win32' && isCmdExeShellLaunch(resolvedCommand, args)) {
+        return {
+            args: args.join(' '),
+            command: resolvedCommand,
+        };
+    }
     return { args, command: resolvedCommand };
 };
 export const assertCommandIsExecutable = (command, cwd, env) => {

package/dist/src/server/agent-launch-resolver.js

@@ -1,4 +1,4 @@
-import { createStartupCommandLaunch, getStartupCommandExecutable, } from './startup-command-parser.js';
+import { createStartupCommandLaunch, getStartupCommandExecutable, normalizeExecutableToken, } from './startup-command-parser.js';
 export const resolveCommandPresetLaunchConfig = (settings, commandPresetId) => {
     const preset = settings.getCommandPreset(commandPresetId);
     if (!preset)
@@ -12,8 +12,14 @@ export const resolveCommandPresetLaunchConfig = (settings, commandPresetId) => {
 const findPresetForStartupCommand = (settings, startupCommand, commandPresetId) => {
     if (commandPresetId)
         return settings.getCommandPreset(commandPresetId);
-    const executable = getStartupCommandExecutable(startupCommand);
-    return executable ? settings.getCommandPreset(executable) : undefined;
+    // Reduce the raw token (which may be a bare command, an absolute path,
+    // or a Windows path with spaces and a .cmd suffix) to the canonical
+    // brand id before looking up the preset. Without this normalization
+    // step `getCommandPreset` only matched bare command names — Windows
+    // users typing the full nvm4w path lost CLI brand identification,
+    // session capture, and post-start input strategy in one swoop.
+    const brandId = normalizeExecutableToken(getStartupCommandExecutable(startupCommand));
+    return brandId ? settings.getCommandPreset(brandId) : undefined;
 };
 export const resolveStartupCommandLaunchConfig = (settings, startupCommand, commandPresetId = null) => {
     const trimmedStartupCommand = startupCommand.trim();

package/dist/src/server/agent-manager-support.d.ts

@@ -2,6 +2,34 @@ import type { IPty } from 'node-pty';
 import type { AgentRunRecord, AgentRunSnapshot } from './agent-manager.js';
 import type { PtyOutputBus } from './pty-output-bus.js';
 export declare const MAX_RUN_OUTPUT_LENGTH = 1000000;
+type ExecRunner = (cmd: string, args: readonly string[], done: (success: boolean) => void) => void;
+/**
+ * Windows analogue of POSIX `process.kill(-pgid, SIGKILL)`. node-pty on
+ * Windows hands `pty.kill()` to TerminateProcess against the PTY's main
+ * process only — children that the worker spawned (npm install, build
+ * scripts, custom tooling) become orphans and keep writing to the
+ * filesystem after the worker card flips to stopped.
+ *
+ * `taskkill /pid <pid> /t /f` walks the process tree (`/t`) and forces
+ * termination (`/f`), matching what task manager would do.
+ *
+ * IMPORTANT — call this BEFORE any other termination of the parent
+ * process. taskkill /T builds the tree by querying the parent for its
+ * descendants; if the parent is already gone (e.g. pty.kill() ran
+ * first) the enumeration returns empty and the children become
+ * orphans. /F also terminates the parent itself, so a parent-kill
+ * after this call is only useful as a fallback when taskkill itself
+ * failed (taskkill missing from PATH, restricted PowerShell, etc.).
+ *
+ * Best-effort: non-zero exits (process already gone, taskkill missing
+ * from PATH, access denied) are swallowed and surface as a `false`
+ * return. The caller is expected to fall back to pty.kill().
+ *
+ * Exported for unit testing — the `runner` parameter lets tests assert
+ * the exact argv without mocking node:child_process.
+ */
+export declare const taskkillProcessTree: (pid: number, platform?: NodeJS.Platform, runner?: ExecRunner, onFailure?: () => void) => boolean;
 export declare const toAgentRunSnapshot: (run: AgentRunRecord) => AgentRunSnapshot;
 export declare const finishAgentRun: (run: AgentRunRecord, exitCode: number | null, ptyOutputBus: PtyOutputBus) => void;
 export declare const attachAgentPty: (run: AgentRunRecord, pty: IPty, ptyOutputBus: PtyOutputBus) => void;
+export {};

package/dist/src/server/agent-manager-support.js

@@ -1,6 +1,63 @@
-import { execFileSync } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 export const MAX_RUN_OUTPUT_LENGTH = 1_000_000;
 const FORCE_KILL_DELAY_MS = 750;
+const TASKKILL_TIMEOUT_MS = 3000;
+const PTY_READ_EOF_EXIT_GRACE_MS = 1000;
+const isPtyReadEofError = (error) => {
+    const candidate = error;
+    return process.platform !== 'win32' && candidate?.code === 'EIO' && candidate.syscall === 'read';
+};
+const serializePtyInput = (input) => Buffer.isBuffer(input) ? input.toString('latin1') : input;
+const defaultExecRunner = (cmd, args, done) => {
+    let settled = false;
+    const settle = (success) => {
+        if (settled)
+            return;
+        settled = true;
+        done(success);
+    };
+    const child = execFile(cmd, [...args], { maxBuffer: 64 * 1024, timeout: TASKKILL_TIMEOUT_MS, windowsHide: true }, (error) => settle(!error));
+    child.once('error', () => settle(false));
+};
+/**
+ * Windows analogue of POSIX `process.kill(-pgid, SIGKILL)`. node-pty on
+ * Windows hands `pty.kill()` to TerminateProcess against the PTY's main
+ * process only — children that the worker spawned (npm install, build
+ * scripts, custom tooling) become orphans and keep writing to the
+ * filesystem after the worker card flips to stopped.
+ *
+ * `taskkill /pid <pid> /t /f` walks the process tree (`/t`) and forces
+ * termination (`/f`), matching what task manager would do.
+ *
+ * IMPORTANT — call this BEFORE any other termination of the parent
+ * process. taskkill /T builds the tree by querying the parent for its
+ * descendants; if the parent is already gone (e.g. pty.kill() ran
+ * first) the enumeration returns empty and the children become
+ * orphans. /F also terminates the parent itself, so a parent-kill
+ * after this call is only useful as a fallback when taskkill itself
+ * failed (taskkill missing from PATH, restricted PowerShell, etc.).
+ *
+ * Best-effort: non-zero exits (process already gone, taskkill missing
+ * from PATH, access denied) are swallowed and surface as a `false`
+ * return. The caller is expected to fall back to pty.kill().
+ *
+ * Exported for unit testing — the `runner` parameter lets tests assert
+ * the exact argv without mocking node:child_process.
+ */
+export const taskkillProcessTree = (pid, platform = process.platform, runner = defaultExecRunner, onFailure) => {
+    if (platform !== 'win32' || pid <= 0)
+        return false;
+    try {
+        runner('taskkill', ['/pid', String(pid), '/t', '/f'], (success) => {
+            if (!success)
+                onFailure?.();
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
 export const toAgentRunSnapshot = (run) => ({
     runId: run.runId,
     agentId: run.agentId,
@@ -22,6 +79,7 @@ export const finishAgentRun = (run, exitCode, ptyOutputBus) => {
 export const attachAgentPty = (run, pty, ptyOutputBus) => {
     let stdinClosed = false;
     let forceKillTimer;
+    let ptyReadEofTimer;
     const resolveProcessGroupId = () => {
         if (process.platform === 'win32' || pty.pid <= 0)
             return null;
@@ -60,16 +118,29 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
             ignoreBestEffortGroupKillError(error);
         }
     };
-    const killPty = (signal) => {
+    const killPtyDirect = (signal) => {
         try {
-            if (process.platform === 'win32')
-                pty.kill();
-            else
-                pty.kill(signal);
+            pty.kill(signal);
         }
         catch (error) {
             ignoreMissingProcess(error);
         }
+    };
+    const killPty = (signal) => {
+        if (process.platform === 'win32') {
+            // taskkill /pid <pid> /t /f walks the parent's process tree
+            // BEFORE terminating it — so we have to run it while the parent
+            // is still alive. Calling pty.kill() first (the previous
+            // ordering) detaches the children: taskkill /T then fails with
+            // "process not found" and the npm-installs / build scripts
+            // become orphans. taskkill /f also terminates the parent, so
+            // pty.kill() is the fallback for the rare case where taskkill
+            // is missing from PATH or refused (e.g. restricted PowerShell).
+            if (!taskkillProcessTree(pty.pid, process.platform, defaultExecRunner, () => killPtyDirect()))
+                killPtyDirect();
+        }
+        else
+            killPtyDirect(signal);
         killProcessGroup(signal);
     };
     const clearForceKillTimer = () => {
@@ -78,8 +149,34 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
         clearTimeout(forceKillTimer);
         forceKillTimer = undefined;
     };
+    const clearPtyReadEofTimer = () => {
+        if (!ptyReadEofTimer)
+            return;
+        clearTimeout(ptyReadEofTimer);
+        ptyReadEofTimer = undefined;
+    };
+    const schedulePtyReadEofExitGuard = (error) => {
+        if (ptyReadEofTimer)
+            return;
+        ptyReadEofTimer = setTimeout(() => {
+            ptyReadEofTimer = undefined;
+            if (stopped())
+                return;
+            console.error(`[hive] PTY read EOF without exit for run ${run.runId}`, error);
+            finishAgentRun(run, null, ptyOutputBus);
+            try {
+                killPty('SIGTERM');
+                scheduleForceKill();
+            }
+            catch (killError) {
+                ignoreMissingProcess(killError);
+            }
+        }, PTY_READ_EOF_EXIT_GRACE_MS);
+        ptyReadEofTimer.unref?.();
+    };
     const cleanupProcessGroup = () => {
         clearForceKillTimer();
+        clearPtyReadEofTimer();
         killProcessGroup('SIGKILL');
     };
     const scheduleForceKill = () => {
@@ -88,10 +185,15 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
         forceKillTimer = setTimeout(() => {
             forceKillTimer = undefined;
             try {
-                if (process.platform === 'win32')
-                    pty.kill();
+                if (process.platform === 'win32') {
+                    // Same ordering as killPty(): tree-kill before terminating the
+                    // parent, so taskkill /T can still enumerate the process tree.
+                    // pty.kill() is the fallback for taskkill-missing hosts.
+                    if (!taskkillProcessTree(pty.pid, process.platform, defaultExecRunner, () => killPtyDirect()))
+                        killPtyDirect();
+                }
                 else
-                    pty.kill('SIGKILL');
+                    killPtyDirect('SIGKILL');
             }
             catch (error) {
                 ignoreMissingProcess(error);
@@ -109,6 +211,9 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
         },
         pid: pty.pid,
         resize(cols, rows) {
+            if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols <= 0 || rows <= 0) {
+                throw new Error(`Invalid terminal size for run: ${run.runId}`);
+            }
             pty.resize(cols, rows);
         },
         resume() {
@@ -119,6 +224,7 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
                 cleanupProcessGroup();
                 return;
             }
+            clearPtyReadEofTimer();
             killPty('SIGTERM');
             stdinClosed = true;
             scheduleForceKill();
@@ -127,7 +233,7 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
             if (stdinClosed || run.status === 'exited' || run.status === 'error') {
                 throw new Error(`PTY is not active for run: ${run.runId}`);
             }
-            pty.write(text);
+            pty.write(serializePtyInput(text));
         },
     };
     pty.onData((chunk) => {
@@ -138,8 +244,30 @@ export const attachAgentPty = (run, pty, ptyOutputBus) => {
             run.output = run.output.slice(-MAX_RUN_OUTPUT_LENGTH);
         ptyOutputBus.publish(run.runId, chunk);
     });
+    pty.on?.('error', (error) => {
+        if (stopped())
+            return;
+        if (isPtyReadEofError(error)) {
+            // Unix PTYs can surface a closed slave as read/EIO just before
+            // node-pty delivers the real onExit event. Treat it as EOF, not
+            // as the run's terminal status.
+            stdinClosed = true;
+            schedulePtyReadEofExitGuard(error);
+            return;
+        }
+        console.error(`[hive] PTY error for run ${run.runId}`, error);
+        stdinClosed = true;
+        finishAgentRun(run, null, ptyOutputBus);
+        try {
+            killPty('SIGTERM');
+        }
+        catch (killError) {
+            ignoreMissingProcess(killError);
+        }
+    });
     pty.onExit((event) => {
         stdinClosed = true;
+        clearPtyReadEofTimer();
         cleanupProcessGroup();
         finishAgentRun(run, event.exitCode, ptyOutputBus);
     });

package/dist/src/server/agent-run-bootstrap.d.ts

@@ -3,6 +3,23 @@ import type { AgentLaunchConfigInput } from './agent-run-store.js';
 import type { AgentSessionStorePort } from './agent-runtime-ports.js';
 import type { CommandPresetRecord } from './command-preset-store.js';
 import { type SessionCaptureSnapshot } from './session-capture.js';
+/**
+ * Builds a `{ <PATH-key>: <new-value> }` object for the spawn env override.
+ * Critical on Windows: the OS env block reports PATH under its native casing
+ * (typically `Path`). Writing to a literal `PATH` key would, after spread
+ * with `process.env`, leave two entries — `Path` carrying the original value
+ * and `PATH` carrying our prepend. CreateProcess then sees both and the
+ * effective lookup order is undefined; in practice the child PTY often falls
+ * back to the original `Path` and never sees `HIVE_BIN_DIR`, breaking every
+ * `team` shim resolution.
+ *
+ * We detect the existing key (case-insensitive on Windows) and overwrite IT,
+ * so the merge produces exactly one PATH entry.
+ *
+ * Exported for unit testing — `buildAgentRunBootstrap` is the only in-tree
+ * caller.
+ */
+export declare const buildSpawnPathEnvEntry: (parentEnv: NodeJS.ProcessEnv, hiveBinDir: string, platform: NodeJS.Platform) => NodeJS.ProcessEnv;
 export declare const buildAgentRunBootstrap: (workspace: WorkspaceSummary, agentId: string, config: AgentLaunchConfigInput, sessionStore: AgentSessionStorePort, getCommandPreset: (id: string) => CommandPresetRecord | undefined, agent?: AgentSummary) => {
     sessionCaptureSnapshot: {
         discriminator?: {
@@ -50,7 +67,6 @@ export declare const buildAgentRunBootstrap: (workspace: WorkspaceSummary, agent
         HIVE_PROJECT_ID: string;
         HIVE_AGENT_ID: string;
         HIVE_AGENT_TOKEN: string;
-        PATH: string;
     };
 };
 export declare const startAgentRunCapture: ({ agentId, sessionCaptureSnapshot, sessionStore, startConfig, workspace, }: {