@tt-a1i/hive 1.4.4 → 1.5.0

package/dist/src/server/workflow-schedule-store.js

@@ -0,0 +1,112 @@
+import { randomUUID } from 'node:crypto';
+const parseArgs = (value) => {
+    if (!value)
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+};
+const toRecord = (row) => ({
+    id: row.id,
+    workspaceId: row.workspace_id,
+    scriptPath: row.script_path,
+    cron: row.cron,
+    args: parseArgs(row.args),
+    enabled: row.enabled === 1,
+    lastRunAt: row.last_run_at,
+    nextRunAt: row.next_run_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+});
+export const createWorkflowScheduleStore = (db) => {
+    const create = (input) => {
+        const now = Date.now();
+        const record = {
+            id: randomUUID(),
+            workspaceId: input.workspaceId,
+            scriptPath: input.scriptPath,
+            cron: input.cron,
+            args: input.args ?? null,
+            enabled: input.enabled ?? true,
+            lastRunAt: null,
+            nextRunAt: input.nextRunAt,
+            createdAt: now,
+            updatedAt: now,
+        };
+        db.prepare(`INSERT INTO workflow_schedules (
+        id, workspace_id, script_path, cron, args, enabled,
+        last_run_at, next_run_at, created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record.id, record.workspaceId, record.scriptPath, record.cron, record.args === null ? null : JSON.stringify(record.args), record.enabled ? 1 : 0, record.lastRunAt, record.nextRunAt, record.createdAt, record.updatedAt);
+        return record;
+    };
+    const update = (id, input) => {
+        const sets = [];
+        const values = [];
+        if (input.cron !== undefined) {
+            sets.push('cron = ?');
+            values.push(input.cron);
+        }
+        if (input.args !== undefined) {
+            sets.push('args = ?');
+            values.push(input.args === null ? null : JSON.stringify(input.args));
+        }
+        if (input.enabled !== undefined) {
+            sets.push('enabled = ?');
+            values.push(input.enabled ? 1 : 0);
+        }
+        if (input.lastRunAt !== undefined) {
+            sets.push('last_run_at = ?');
+            values.push(input.lastRunAt);
+        }
+        if (input.nextRunAt !== undefined) {
+            sets.push('next_run_at = ?');
+            values.push(input.nextRunAt);
+        }
+        if (sets.length === 0)
+            return;
+        sets.push('updated_at = ?');
+        values.push(Date.now());
+        values.push(id);
+        db.prepare(`UPDATE workflow_schedules SET ${sets.join(', ')} WHERE id = ?`).run(...values);
+    };
+    const get = (id) => {
+        const row = db.prepare('SELECT * FROM workflow_schedules WHERE id = ?').get(id);
+        return row ? toRecord(row) : undefined;
+    };
+    const listForWorkspace = (workspaceId) => db
+        .prepare('SELECT * FROM workflow_schedules WHERE workspace_id = ? ORDER BY created_at DESC, id DESC')
+        .all(workspaceId).map(toRecord);
+    // Enabled schedules whose next_run_at has arrived — the scheduler queries
+    // this every tick and fires each.
+    const listDueSchedules = (now) => db
+        .prepare('SELECT * FROM workflow_schedules WHERE enabled = 1 AND next_run_at <= ? ORDER BY next_run_at')
+        .all(now).map(toRecord);
+    const deleteSchedule = (id) => {
+        db.prepare('DELETE FROM workflow_schedules WHERE id = ?').run(id);
+    };
+    // TIER 1 #5 — compare-and-swap claim. If two scheduler ticks see the same
+    // due schedule (overlapping setInterval invocations, slow esbuild
+    // transpile in startWorkflow, or future multi-process), only the one
+    // whose UPDATE matches the still-original next_run_at wins. Returns
+    // true if the caller may proceed to fire the workflow.
+    const claimDueSchedule = (input) => {
+        const result = db
+            .prepare(`UPDATE workflow_schedules
+         SET next_run_at = ?, last_run_at = ?, updated_at = ?
+         WHERE id = ? AND next_run_at = ?`)
+            .run(input.newNextRunAt, input.lastRunAt, Date.now(), input.id, input.expectedNextRunAt);
+        return result.changes === 1;
+    };
+    return {
+        create,
+        update,
+        get,
+        listForWorkspace,
+        listDueSchedules,
+        deleteSchedule,
+        claimDueSchedule,
+    };
+};

package/dist/src/server/workflow-scheduler.d.ts

@@ -0,0 +1,36 @@
+import type { WorkflowRunRecord } from './workflow-run-store.js';
+import type { RunWorkflowInput } from './workflow-runner.js';
+import type { createWorkflowScheduleStore } from './workflow-schedule-store.js';
+type ScheduleStore = ReturnType<typeof createWorkflowScheduleStore>;
+export interface WorkflowSchedulerDeps {
+    schedules: ScheduleStore;
+    startWorkflow: (input: RunWorkflowInput) => Promise<WorkflowRunRecord>;
+    /** Defensive guard against orphan schedules (TIER 1 #4). The workspace
+     *  delete cascade clears workflow_schedules in the same transaction so
+     *  fresh orphans cannot appear; this port catches any pre-existing or
+     *  externally-introduced orphan and self-heals by deleting the schedule
+     *  before it can fire and crash startWorkflow → re-fire next tick. */
+    workspaceExists?: (workspaceId: string) => boolean;
+    /** HivePort to pass into every fired workflow. Resolved lazily so the
+     *  scheduler doesn't need to be reconstructed when the runtime listens
+     *  on a different port (e.g. tests using port 0). */
+    getHivePort?: () => string;
+    /** Test seam: defaults to cron-parser. Returns next fire time in ms-epoch. */
+    computeNextRunAt?: (cron: string, after: Date) => number;
+    /** Experimental workflow gate. When provided and returns false, ticks fire
+     *  nothing (scheduled runs are held, not dropped — they fire once re-enabled).
+     *  Omitted → no gate (the scheduler unit tests rely on this default). */
+    isWorkflowEnabled?: () => boolean;
+}
+export interface WorkflowScheduler {
+    /** Run one tick using the given `now` (ms-epoch). For both production and tests. */
+    tick: (now?: number) => Promise<void>;
+    /** Arm a setInterval that calls tick() every `tickIntervalMs`. Returns void. */
+    start: (input?: {
+        tickIntervalMs?: number;
+    }) => void;
+    /** Clear the timer. Idempotent. */
+    close: () => void;
+}
+export declare const createWorkflowScheduler: (deps: WorkflowSchedulerDeps) => WorkflowScheduler;
+export {};

package/dist/src/server/workflow-scheduler.js

@@ -0,0 +1,97 @@
+import { CronExpressionParser } from 'cron-parser';
+const defaultComputeNextRunAt = (cron, after) => {
+    // cron-parser 5.x: `currentDate` is the reference point; `next()` returns
+    // the first strictly-greater fire. UTC by default.
+    const expr = CronExpressionParser.parse(cron, { currentDate: after, tz: 'UTC' });
+    return expr.next().toDate().getTime();
+};
+const DEFAULT_TICK_INTERVAL_MS = 30_000;
+export const createWorkflowScheduler = (deps) => {
+    const computeNext = deps.computeNextRunAt ?? defaultComputeNextRunAt;
+    let timer = null;
+    const scheduler = {
+        async tick(now = Date.now()) {
+            // Experimental gate: while workflows are disabled, hold all scheduled
+            // runs (don't fire, don't advance nextRunAt) so they resume cleanly
+            // once re-enabled.
+            if (deps.isWorkflowEnabled && !deps.isWorkflowEnabled())
+                return;
+            const due = deps.schedules.listDueSchedules(now);
+            for (const schedule of due) {
+                // TIER 1 #4 — self-heal orphan schedules: if a schedule survived a
+                // workspace-delete operation (shouldn't happen after the cascade
+                // fix, but defending against historical orphans), drop it now so
+                // it doesn't error-spam every tick from here forward.
+                if (deps.workspaceExists && !deps.workspaceExists(schedule.workspaceId)) {
+                    console.warn('[hive] workflow-scheduler: deleting orphan schedule', {
+                        scheduleId: schedule.id,
+                        workspaceId: schedule.workspaceId,
+                    });
+                    deps.schedules.deleteSchedule(schedule.id);
+                    continue;
+                }
+                // Compute the next fire BEFORE firing this one so a startWorkflow
+                // exception cannot keep us re-firing the same row each tick.
+                let nextRunAt;
+                try {
+                    nextRunAt = computeNext(schedule.cron, new Date(now));
+                }
+                catch (error) {
+                    console.error('[hive] workflow-scheduler: invalid cron, disabling schedule', {
+                        scheduleId: schedule.id,
+                        cron: schedule.cron,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    deps.schedules.update(schedule.id, { enabled: false });
+                    continue;
+                }
+                // TIER 1 #5 — compare-and-swap claim. If a previous tick is still
+                // running (slow esbuild / slow startWorkflow / many due schedules
+                // in one tick) and setInterval fires again, both ticks would
+                // otherwise see the same due schedule and fire it twice. CAS on
+                // the original next_run_at means only the first tick wins;
+                // losers see changes=0 and quietly skip.
+                const claimed = deps.schedules.claimDueSchedule({
+                    id: schedule.id,
+                    expectedNextRunAt: schedule.nextRunAt ?? 0,
+                    newNextRunAt: nextRunAt,
+                    lastRunAt: now,
+                });
+                if (!claimed)
+                    continue;
+                try {
+                    await deps.startWorkflow({
+                        workspaceId: schedule.workspaceId,
+                        scriptPath: schedule.scriptPath,
+                        hivePort: deps.getHivePort?.() ?? '',
+                        ...(schedule.args !== undefined && schedule.args !== null
+                            ? { args: schedule.args }
+                            : {}),
+                    });
+                }
+                catch (error) {
+                    console.error('[hive] workflow-scheduler: startWorkflow failed', {
+                        scheduleId: schedule.id,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        },
+        start({ tickIntervalMs = DEFAULT_TICK_INTERVAL_MS } = {}) {
+            if (timer)
+                clearInterval(timer);
+            timer = setInterval(() => {
+                scheduler.tick().catch((error) => {
+                    console.error('[hive] swallowed:workflow-scheduler.tick', error);
+                });
+            }, tickIntervalMs);
+        },
+        close() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+    return scheduler;
+};

package/dist/src/server/workflow-script-loader.d.ts

@@ -0,0 +1,34 @@
+export interface WorkflowMeta {
+    name: string;
+    description: string;
+    cron?: string;
+    phases?: Array<{
+        title: string;
+        detail?: string;
+        model?: string;
+    }>;
+    /** TIER 2 #11 — per-script budget overrides. Hard cap on total
+     *  `agent()` calls (default 1000 — matches CC's lifetime cap) and on
+     *  wall-clock duration in ms (default 60 min). Both apply to the
+     *  ENTIRE run including nested workflow() calls; exceeding either
+     *  rejects the offending agent() call and the run transitions to
+     *  'failed' (or 'stopped' if duration was the trigger). */
+    maxAgentCalls?: number;
+    maxDurationMs?: number;
+}
+export interface LoadedWorkflow {
+    meta: WorkflowMeta;
+    scriptPath: string;
+    scriptHash: string;
+    /** Transpiled `async function __wf(...) {…}` — the runner evals it via
+     *  `new Function(source + '; return __wf')()` and calls it with the DSL. */
+    compiledFunctionSource: string;
+}
+interface ExtractedMeta {
+    meta: WorkflowMeta;
+    body: string;
+}
+export declare const extractMeta: (source: string) => ExtractedMeta;
+export declare const loadWorkflowScriptSource: (source: string, scriptPath: string) => Promise<LoadedWorkflow>;
+export declare const loadWorkflowScriptFile: (absPath: string) => Promise<LoadedWorkflow>;
+export {};

package/dist/src/server/workflow-script-loader.js

@@ -0,0 +1,106 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+const DSL_PARAMS = 'agent, parallel, pipeline, phase, log, workflow, args';
+// Find the matching close brace for the object literal whose '{' is at
+// openIndex, ignoring braces inside '...' "..." `...` strings and // /* */
+// comments so they don't miscount the depth.
+const matchBrace = (source, openIndex) => {
+    let depth = 0;
+    let i = openIndex;
+    let str = null;
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        if (str) {
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === str)
+                str = null;
+            i += 1;
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            const nl = source.indexOf('\n', i);
+            i = nl === -1 ? source.length : nl;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const end = source.indexOf('*/', i + 2);
+            i = end === -1 ? source.length : end + 2;
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === '`') {
+            str = ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '{')
+            depth += 1;
+        else if (ch === '}') {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+        }
+        i += 1;
+    }
+    throw new Error('workflow meta: unbalanced braces in `export const meta`');
+};
+export const extractMeta = (source) => {
+    const re = /export\s+const\s+meta\s*(?::[^=]+)?=\s*\{/;
+    const m = re.exec(source);
+    if (!m) {
+        throw new Error('workflow script must `export const meta = { name, description }`');
+    }
+    const braceStart = source.indexOf('{', m.index + m[0].length - 1);
+    const braceEnd = matchBrace(source, braceStart);
+    const literal = source.slice(braceStart, braceEnd + 1);
+    let meta;
+    try {
+        // meta MUST be a pure literal (no calls/vars); eval it in isolation.
+        meta = new Function(`return (${literal})`)();
+    }
+    catch (error) {
+        throw new Error(`workflow meta is not a plain literal: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!meta || typeof meta.name !== 'string' || !meta.name.trim()) {
+        throw new Error('workflow meta requires a non-empty `name`');
+    }
+    if (typeof meta.description !== 'string') {
+        throw new Error('workflow meta requires a `description`');
+    }
+    let after = braceEnd + 1;
+    const tailMatch = /^(\s*as\s+const)?\s*;?/.exec(source.slice(after));
+    if (tailMatch)
+        after += tailMatch[0].length;
+    const body = source.slice(0, m.index) + source.slice(after);
+    return { meta, body };
+};
+// Module-level cache for esbuild's dynamic import. esbuild's top-level
+// invariant check requires `new TextEncoder().encode('') instanceof
+// Uint8Array` — true in Node, FALSE in jsdom's realm. Workflow runs are not
+// designed to be exercised end-to-end inside a jsdom test environment;
+// jsdom-hosted tests stub the run step at the network layer.
+let esbuildModulePromise = null;
+const loadEsbuild = async () => {
+    if (!esbuildModulePromise)
+        esbuildModulePromise = import('esbuild');
+    return esbuildModulePromise;
+};
+export const loadWorkflowScriptSource = async (source, scriptPath) => {
+    if (/^\s*import\s/m.test(source)) {
+        throw new Error('workflow scripts may not use `import`; use the ambient DSL + inline schemas');
+    }
+    const { meta, body } = extractMeta(source);
+    const wrapped = `async function __wf(${DSL_PARAMS}) {\n${body}\n}`;
+    // Lazy-load esbuild: its native binary breaks under jsdom/worker contexts
+    // used by the web test suite, so importing it at module-load time would
+    // crash any test file that transitively pulls in the runtime store. The
+    // transpile path is only reached when a workflow actually runs.
+    const { transform } = await loadEsbuild();
+    const { code } = await transform(wrapped, { loader: 'ts', target: 'es2022' });
+    const scriptHash = createHash('sha256').update(code).digest('hex');
+    return { meta, scriptPath, scriptHash, compiledFunctionSource: code };
+};
+export const loadWorkflowScriptFile = async (absPath) => loadWorkflowScriptSource(await readFile(absPath, 'utf8'), absPath);

package/dist/src/server/workspace-path-validation.js

@@ -1,5 +1,6 @@
-import { realpathSync, statSync } from 'node:fs';
+import { statSync } from 'node:fs';
 import { BadRequestError } from './http-errors.js';
+import { realpathNative } from './path-canonicalization.js';
 export const validateWorkspacePath = (path) => {
     if (typeof path !== 'string' || path.trim().length === 0) {
         throw new BadRequestError('Workspace path is required');
@@ -7,16 +8,27 @@ export const validateWorkspacePath = (path) => {
     const candidate = path.trim();
     let resolved;
     try {
-        resolved = realpathSync(candidate);
+        resolved = realpathNative(candidate);
     }
-    catch {
+    catch (error) {
+        const code = error?.code;
+        if (code === 'EACCES' || code === 'EPERM') {
+            throw new BadRequestError(`Workspace path is not accessible: ${candidate}`);
+        }
+        if (code === 'ENAMETOOLONG') {
+            throw new BadRequestError(`Workspace path is too long: ${candidate}`);
+        }
         throw new BadRequestError(`Workspace path does not exist: ${candidate}`);
     }
     let stat;
     try {
         stat = statSync(resolved);
     }
-    catch {
+    catch (error) {
+        const code = error?.code;
+        if (code === 'EACCES' || code === 'EPERM') {
+            throw new BadRequestError(`Workspace path is not accessible: ${candidate}`);
+        }
         throw new BadRequestError(`Workspace path does not exist: ${candidate}`);
     }
     if (!stat.isDirectory()) {

package/dist/src/server/workspace-shell-runtime.d.ts

@@ -7,6 +7,11 @@ export declare const resolveWorkspaceShellLaunch: (env?: NodeJS.ProcessEnv, plat
     args: string[];
     command: string;
 };
+export declare const resolveWorkspaceShellStart: (workspacePath: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform) => {
+    args: string[];
+    command: string;
+    cwd: string;
+};
 export declare const createWorkspaceShellRuntime: (agentManager: AgentManager | undefined) => {
     close(): void;
     closeRun(workspaceId: string, runId: string): boolean;

package/dist/src/server/workspace-shell-runtime.js

@@ -1,4 +1,5 @@
 import { basename } from 'node:path';
+import { escapeCmdToken } from './windows-command-line.js';
 const WORKSPACE_SHELL_SUFFIX = ':shell';
 const WORKSPACE_SHELL_LABEL = 'Shell';
 const EXITED_SHELL_RETENTION_MS = 5000;
@@ -20,6 +21,27 @@ export const resolveWorkspaceShellLaunch = (env = process.env, platform = proces
     const command = env.SHELL || '/bin/sh';
     return { command, args: shouldUseLoginShell(command) ? ['-l'] : [] };
 };
+const isWindowsUncPath = (path, platform = process.platform) => platform === 'win32' && /^[\\/]{2}[^\\/]+[\\/]+[^\\/]+/u.test(path);
+const getWindowsSafeShellCwd = (env = process.env) => {
+    const systemRoot = getEnvValue(env, 'SystemRoot', 'win32');
+    if (systemRoot)
+        return systemRoot;
+    const systemDrive = getEnvValue(env, 'SystemDrive', 'win32');
+    if (systemDrive)
+        return `${systemDrive}\\`;
+    return process.cwd();
+};
+export const resolveWorkspaceShellStart = (workspacePath, env = process.env, platform = process.platform) => {
+    const launch = resolveWorkspaceShellLaunch(env, platform);
+    if (isWindowsUncPath(workspacePath, platform)) {
+        return {
+            args: ['/d', '/s', '/k', `pushd ${escapeCmdToken(workspacePath)}`],
+            command: launch.command,
+            cwd: getWindowsSafeShellCwd(env),
+        };
+    }
+    return { ...launch, cwd: workspacePath };
+};
 export const createWorkspaceShellRuntime = (agentManager) => {
     const labelsByRunId = new Map();
     const workspaceIdsByRunId = new Map();
@@ -176,12 +198,12 @@ export const createWorkspaceShellRuntime = (agentManager) => {
         },
         async start(workspace) {
             const startedAt = Date.now();
-            const launch = resolveWorkspaceShellLaunch();
+            const launch = resolveWorkspaceShellStart(workspace.path);
             const run = await requireManager().startAgent({
                 agentId: getWorkspaceShellAgentId(workspace.id),
                 args: launch.args,
                 command: launch.command,
-                cwd: workspace.path,
+                cwd: launch.cwd,
                 env: {
                     COLORTERM: 'truecolor',
                     FORCE_COLOR: '1',

package/dist/src/server/workspace-store-contract.d.ts

@@ -1,4 +1,4 @@
-import type { AgentSummary, TeamListItem, WorkerRole, WorkspaceSummary } from '../shared/types.js';
+import type { AgentSummary, TeamListItem, WorkerRole, WorkerSpawnSource, WorkspaceSummary } from '../shared/types.js';
 export interface WorkspaceRecord {
     summary: WorkspaceSummary;
     agents: AgentSummary[];
@@ -7,6 +7,8 @@ export interface WorkerInput {
     description?: string;
     name: string;
     role: WorkerRole;
+    ephemeral?: boolean;
+    spawnedBy?: WorkerSpawnSource;
 }
 export interface WorkspaceStore {
     addWorker: (workspaceId: string, input: WorkerInput) => AgentSummary;
@@ -19,6 +21,7 @@ export interface WorkspaceStore {
     getWorkerByName: (workspaceId: string, workerName: string) => AgentSummary;
     getWorkspaceSnapshot: (workspaceId: string) => WorkspaceRecord;
     hasAgent: (workspaceId: string, agentId: string) => boolean;
+    hasWorkspace: (workspaceId: string) => boolean;
     listWorkers: (workspaceId: string) => TeamListItem[];
     listWorkspaces: () => WorkspaceSummary[];
     markAgentStarted: (workspaceId: string, agentId: string) => void;

package/dist/src/server/workspace-store-hydration.js

@@ -1,5 +1,5 @@
 import { getDefaultRoleDescription } from './role-templates.js';
-import { applyPendingTaskCount, createOrchestrator, isWorkerAgent, } from './workspace-store-support.js';
+import { applyPendingTaskCount, createOrchestrator, createWorkflowAgent, isWorkerAgent, } from './workspace-store-support.js';
 const createWorkerSummary = (workspaceId, row) => ({
     id: row.id,
     workspaceId,
@@ -8,7 +8,25 @@ const createWorkerSummary = (workspaceId, row) => ({
     role: row.role,
     status: 'stopped',
     pendingTaskCount: 0,
+    ephemeral: row.ephemeral === 1,
+    spawnedBy: row.spawned_by ?? null,
 });
+/**
+ * Build the worker SELECT defensively. The global runtime data dir
+ * (`~/.config/hive`) is shared across every Hive install on the machine, so a
+ * DB may have been migrated forward by a NEWER Hive whose `schema_version`
+ * already lists 19+. In that case our own v19 ALTER is skipped and the
+ * `workers` table can lack `ephemeral`/`spawned_by`. Selecting a non-existent
+ * column throws and crashes startup, so we only request the optional columns
+ * when they actually exist; `createWorkerSummary` defaults them otherwise.
+ */
+const buildWorkerSelect = (db, whereClause) => {
+    const present = new Set(db.prepare('PRAGMA table_info(workers)').all().map((c) => c.name));
+    const optional = ['ephemeral', 'spawned_by'].filter((column) => present.has(column));
+    const columns = ['id', 'workspace_id', 'name', 'description', 'role', ...optional].join(', ');
+    const where = whereClause ? `${whereClause} ` : '';
+    return `SELECT ${columns} FROM workers ${where}ORDER BY created_at ASC`;
+};
 const applyMessageKinds = (workspaces, messageKinds, workspaceId) => {
     for (const row of messageKinds) {
         if (workspaceId && row.workspace_id !== workspaceId) {
@@ -33,10 +51,10 @@ export const hydrateWorkspaceFromDb = (db, workspaces, messageKinds, workspaceId
     }
     workspaces.set(row.id, {
         summary: { id: row.id, name: row.name, path: row.path },
-        agents: [createOrchestrator(row.id)],
+        agents: [createOrchestrator(row.id), createWorkflowAgent(row.id)],
     });
     for (const workerRow of db
-        .prepare('SELECT id, workspace_id, name, description, role FROM workers WHERE workspace_id = ? ORDER BY created_at ASC')
+        .prepare(buildWorkerSelect(db, 'WHERE workspace_id = ?'))
         .all(workspaceId)) {
         workspaces.get(workspaceId)?.agents.push(createWorkerSummary(workerRow.workspace_id, workerRow));
     }
@@ -48,12 +66,10 @@ export const seedWorkspacesFromDb = (db, workspaces, messageKinds) => {
         .all()) {
         workspaces.set(row.id, {
             summary: { id: row.id, name: row.name, path: row.path },
-            agents: [createOrchestrator(row.id)],
+            agents: [createOrchestrator(row.id), createWorkflowAgent(row.id)],
         });
     }
-    for (const row of db
-        .prepare('SELECT id, workspace_id, name, description, role FROM workers ORDER BY created_at ASC')
-        .all()) {
+    for (const row of db.prepare(buildWorkerSelect(db, '')).all()) {
         workspaces.get(row.workspace_id)?.agents.push(createWorkerSummary(row.workspace_id, row));
     }
     applyMessageKinds(workspaces, messageKinds);

package/dist/src/server/workspace-store-mutations.js

@@ -24,11 +24,8 @@ export const getWorkerByNameRecord = (workspaces, workspaceId, workerName) => {
     return worker;
 };
 export const markAgentStarted = (workspaces, workspaceId, agentId) => {
-    // Worker status tracks "is this agent currently working", not "are there
-    // pending tasks". A freshly started PTY hasn't done anything yet, even if
-    // dispatch ledger replayed pendingTaskCount > 0 during hydration. The next
-    // team send will flip status to 'working' via markTaskDispatched.
-    getAgentRecord(workspaces, workspaceId, agentId).status = 'idle';
+    const agent = getAgentRecord(workspaces, workspaceId, agentId);
+    agent.status = isWorkerAgent(agent) ? getStatusFromPendingCount(agent.pendingTaskCount) : 'idle';
 };
 export const markAgentStopped = (workspaces, workspaceId, agentId) => {
     getAgentRecord(workspaces, workspaceId, agentId).status = 'stopped';

package/dist/src/server/workspace-store-support.d.ts

@@ -15,11 +15,15 @@ export interface WorkerRow {
     name: string;
     description: string | null;
     role: WorkerRole;
+    ephemeral: number;
+    spawned_by: string | null;
 }
 export interface WorkspaceSummaryRow extends WorkspaceRow {
 }
 export declare const getOrchestratorId: (workspaceId: string) => string;
 export declare const createOrchestrator: (workspaceId: string) => AgentSummary;
+export declare const getWorkflowAgentId: (workspaceId: string) => string;
+export declare const createWorkflowAgent: (workspaceId: string) => AgentSummary;
 export declare const isWorkerAgent: (agent: AgentSummary) => agent is AgentSummary & {
     role: WorkerRole;
 };

package/dist/src/server/workspace-store-support.js

@@ -9,8 +9,20 @@ export const createOrchestrator = (workspaceId) => ({
     status: 'stopped',
     pendingTaskCount: 0,
 });
+export const getWorkflowAgentId = (workspaceId) => `${workspaceId}:__workflow__`;
+// In-memory pseudo-agent (no DB row, no PTY) that gives the deterministic
+// workflow runner a dispatch identity — mirrors the orchestrator pseudo-agent.
+export const createWorkflowAgent = (workspaceId) => ({
+    id: getWorkflowAgentId(workspaceId),
+    workspaceId,
+    name: 'Workflow',
+    description: 'Hive workflow runner — deterministic multi-agent orchestration driver.',
+    role: 'workflow',
+    status: 'stopped',
+    pendingTaskCount: 0,
+});
 export const isWorkerAgent = (agent) => {
-    return agent.role !== 'orchestrator';
+    return agent.role !== 'orchestrator' && agent.role !== 'workflow';
 };
 export const getStatusFromPendingCount = (pendingTaskCount) => {
     return pendingTaskCount > 0 ? 'working' : 'idle';