@tt-a1i/hive 1.5.0 → 1.7.0

package/dist/src/server/feature-flags.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Every experimental feature flag resolved into one snapshot.
+ *
+ * Threading this bag through the prompt-build call graph — instead of one
+ * `getX` accessor per flag — is the whole point of this module: a new flag adds
+ * a field here and is read at the one site that needs it, without touching any
+ * of the carriers in between (agent-runtime → run-starter / restart-policy /
+ * tasks-watcher → the pure builders in hive-team-guidance).
+ *
+ * Each flag keeps its own storage semantics and doc in its own file
+ * ([[workflow-feature]], [[team-autostaff]]); this module only composes them.
+ */
+export interface FeatureFlags {
+    /** Workflow runtime — `team workflow`, the scheduler, the Drawer, and the
+     *  orchestrator guidance that teaches them. Default OFF. */
+    workflowsEnabled: boolean;
+    /** Auto-staff orchestrator guidance — size the team to the task up front
+     *  rather than one worker at a time. Default ON. */
+    autostaffEnabled: boolean;
+}
+/**
+ * Conservative all-off snapshot. Use as the parameter default wherever a
+ * builder is called without flags — it preserves the per-flag `= false`
+ * defaults the builders carried before this registry existed.
+ *
+ * This is NOT the storage default: an ABSENT `team.autostaff` key reads back
+ * ON via {@link readFeatureFlags}. Only an OMITTED argument falls back to off,
+ * which is the safe choice (never inject guidance for a flag nobody resolved).
+ */
+export declare const FEATURE_FLAGS_ALL_OFF: FeatureFlags;
+interface AppStateReader {
+    getAppState: (key: string) => {
+        value: string | null;
+    } | undefined;
+}
+/**
+ * Read every flag from app_state into one snapshot, each with its own storage
+ * default (workflows off-when-absent, auto-staff on-when-absent). Called fresh
+ * each time so a Settings toggle takes effect without restarting the runtime.
+ */
+export declare const readFeatureFlags: (settings: AppStateReader) => FeatureFlags;
+export {};

package/dist/src/server/feature-flags.js

@@ -0,0 +1,24 @@
+import { AUTOSTAFF_ENABLED_KEY, readAutostaffEnabled } from './team-autostaff.js';
+import { readWorkflowEnabled, WORKFLOW_ENABLED_KEY } from './workflow-feature.js';
+/**
+ * Conservative all-off snapshot. Use as the parameter default wherever a
+ * builder is called without flags — it preserves the per-flag `= false`
+ * defaults the builders carried before this registry existed.
+ *
+ * This is NOT the storage default: an ABSENT `team.autostaff` key reads back
+ * ON via {@link readFeatureFlags}. Only an OMITTED argument falls back to off,
+ * which is the safe choice (never inject guidance for a flag nobody resolved).
+ */
+export const FEATURE_FLAGS_ALL_OFF = {
+    workflowsEnabled: false,
+    autostaffEnabled: false,
+};
+/**
+ * Read every flag from app_state into one snapshot, each with its own storage
+ * default (workflows off-when-absent, auto-staff on-when-absent). Called fresh
+ * each time so a Settings toggle takes effect without restarting the runtime.
+ */
+export const readFeatureFlags = (settings) => ({
+    workflowsEnabled: readWorkflowEnabled(settings.getAppState(WORKFLOW_ENABLED_KEY)?.value ?? null),
+    autostaffEnabled: readAutostaffEnabled(settings.getAppState(AUTOSTAFF_ENABLED_KEY)?.value ?? null),
+});

package/dist/src/server/hive-team-guidance.d.ts

@@ -1,4 +1,5 @@
 import type { AgentSummary } from '../shared/types.js';
+import { type FeatureFlags } from './feature-flags.js';
 import { type WorkflowCliPolicy } from './workflow-cli-policy.js';
 /**
  * Tail reminder appended to every message that flows INTO the orchestrator
@@ -17,7 +18,7 @@ import { type WorkflowCliPolicy } from './workflow-cli-policy.js';
  * the workflow DSL live in `.hive/PROTOCOL.md`, which agents re-read on demand.
  * A long banner on every turn is itself the noise this envelope exists to beat.
  */
-export declare const buildOrchestratorReminderTail: (workflowsEnabled: boolean) => string;
+export declare const buildOrchestratorReminderTail: ({ workflowsEnabled }: FeatureFlags) => string;
 /**
  * Tail reminder appended to dispatches sent TO a worker. Reinforces the
  * worker identity (so the agent does not regress into its normal CLI
@@ -25,7 +26,7 @@ export declare const buildOrchestratorReminderTail: (workflowsEnabled: boolean)
  * with dispatch_id pre-bound.
  */
 export declare const buildWorkerReminderTail: (dispatchId: string) => string;
-export declare const getHiveTeamRules: (agent: Pick<AgentSummary, "role">, workflowsEnabled?: boolean, autostaffEnabled?: boolean) => readonly string[];
+export declare const getHiveTeamRules: (agent: Pick<AgentSummary, "role">, flags?: FeatureFlags) => readonly string[];
 /**
  * Workspace-local protocol cheat sheet written to `.hive/PROTOCOL.md`. Agents
  * are explicitly trained to look at project root markdown when confused, so
@@ -35,4 +36,4 @@ export declare const getHiveTeamRules: (agent: Pick<AgentSummary, "role">, workf
  * syntax and the workflow DSL reference — the always-on injections only carry
  * the lean core rules and point here.
  */
-export declare const buildProtocolDoc: (cliPolicy?: WorkflowCliPolicy, workflowsEnabled?: boolean, autostaffEnabled?: boolean) => string;
+export declare const buildProtocolDoc: (cliPolicy?: WorkflowCliPolicy, flags?: FeatureFlags) => string;

package/dist/src/server/hive-team-guidance.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { DEFAULT_WORKFLOW_CLI_POLICY } from './workflow-cli-policy.js';
 /**
  * Tail reminder appended to every message that flows INTO the orchestrator
@@ -16,10 +17,10 @@ import { DEFAULT_WORKFLOW_CLI_POLICY } from './workflow-cli-policy.js';
  * the workflow DSL live in `.hive/PROTOCOL.md`, which agents re-read on demand.
  * A long banner on every turn is itself the noise this envelope exists to beat.
  */
-export const buildOrchestratorReminderTail = (workflowsEnabled) => {
+export const buildOrchestratorReminderTail = ({ workflowsEnabled }) => {
     const body = 'You are the Hive Orchestrator. Reply with one of: ' +
         '(a) `team send "<worker-name>" "<task>"` to dispatch — run `team list` first if the roster may have changed since your last view (Hive does not push membership changes; stale names fail). ' +
-        'If no worker fits or the roster is empty, `team spawn <role> [--cli claude|codex|opencode|gemini]` to create one (add `--ephemeral` for a one-shot), then dispatch; do not ask the user to add workers. ' +
+        'If no worker fits or the roster is empty, `team spawn <role> [--cli claude|codex|opencode|gemini|hermes]` to create one (add `--ephemeral` for a one-shot), then dispatch; do not ask the user to add workers. ' +
         '(b) `team cancel --dispatch <id> "<reason>"` to close an obsolete dispatch. ' +
         (workflowsEnabled
             ? '(c) `team workflow run --stdin` to fan out across 3+ workers or run a staged review→fix — never a loop of `team send` (no barrier, no UI group, no stop button). (d) plain text to the user. '
@@ -52,7 +53,7 @@ const CORE_ORCHESTRATOR_RULES = [
     'Small, low-risk tasks you can finish in a couple of minutes: do them yourself; do not dispatch for the sake of form. Reach for `team send` when the work needs parallelism, long execution, independent review/test, a dedicated role, or the user explicitly asked for a worker.',
     'If exactly one worker is available, dispatch to it directly with `team send <worker-name> "<task>"` — do not bounce the choice back to the user.',
     'When the user says "have a worker do X", dispatch it with `team send <worker-name> "<task>"`.',
-    'If the roster is empty or lacks the role the task needs, build the team yourself: `team spawn <role> [--name <n>] [--cli claude|codex|opencode|gemini]`, then immediately dispatch. Do not stop to ask the user to add members — that call is yours.',
+    'If the roster is empty or lacks the role the task needs, build the team yourself: `team spawn <role> [--name <n>] [--cli claude|codex|opencode|gemini|hermes]`, then immediately dispatch. Do not stop to ask the user to add members — that call is yours.',
     '`team spawn` is PERSISTENT by default (a normal member that stays in the workspace); add `--ephemeral` for a one-shot worker that auto-dismisses after its first `team report`. Rule of thumb: will you reuse this role in the next 10 minutes? Yes → persistent; no → `--ephemeral`.',
     'When the user cancels or changes direction on an open dispatch, close it explicitly with `team cancel --dispatch <id> "<reason>"` — do not just say "cancel" in prose.',
     'Each `team send` opens a SEPARATE dispatch with its own pending count and its own required report — it is not a way to tack context onto a dispatch already in flight. Send the same worker twice and it owes you TWO reports; one report closes only one dispatch (the one its `--dispatch <id>` names, or the oldest open one if the flag is omitted), so the other stays open and the worker is pinned on `working`. To change or extend an in-flight task, `team cancel --dispatch <id> "<reason>"` the stale dispatch and re-send the whole task, or wait for the worker to report and dispatch the follow-up after.',
@@ -85,7 +86,7 @@ const buildAutostaffRule = (workflowsEnabled) => 'You may size the team to the t
     (workflowsEnabled
         ? ' When the work is a one-shot fan-out across 3+ workers or a staged review→fix that runs to completion, prefer `team workflow run` (barrier, phase tree, stop button) over a batch of `team spawn`; reserve up-front staffing for a standing team you direct interactively across several turns.'
         : '');
-const orchestratorRules = (workflowsEnabled, autostaffEnabled) => [
+const orchestratorRules = ({ workflowsEnabled, autostaffEnabled, }) => [
     ...CORE_ORCHESTRATOR_RULES,
     ...(workflowsEnabled ? WORKFLOW_ORCHESTRATOR_RULES : []),
     ...(autostaffEnabled ? [buildAutostaffRule(workflowsEnabled)] : []),
@@ -98,9 +99,7 @@ const WORKER_RULES = [
     '`team --help` only prints command syntax — it is NOT a way to report; its output never reaches the Orchestrator. You still owe a real `team report` / `team status` afterward.',
     'If `team report` / `team status` errors, it also prints USAGE — fix the arguments per USAGE and retry; do not use `team --help` as a stand-in for reporting.',
 ];
-export const getHiveTeamRules = (agent, workflowsEnabled = false, autostaffEnabled = false) => agent.role === 'orchestrator'
-    ? orchestratorRules(workflowsEnabled, autostaffEnabled)
-    : WORKER_RULES;
+export const getHiveTeamRules = (agent, flags = FEATURE_FLAGS_ALL_OFF) => (agent.role === 'orchestrator' ? orchestratorRules(flags) : WORKER_RULES);
 const renderRules = (rules) => rules.map((line) => `- ${line}`).join('\n');
 /**
  * The workflow DSL teaching: agent()/parallel()/pipeline() semantics, the
@@ -122,7 +121,7 @@ Host functions injected into the script: \`agent(prompt, opts)\`,
 \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`phase(title)\`,
 \`log(msg)\`, plus the \`args\` global.
 
-\`agent(prompt, opts)\` opts: \`{ agentType?: "coder"|"reviewer"|"tester"|"custom"|<custom-role-name>, cli?: "claude"|"codex"|"opencode"|"gemini", model?: string, label?: string, timeoutMs?: number }\` — other fields are silently ignored. \`agentType\` also accepts the name of a workspace custom role template (case-insensitive); a typo throws rather than silently falling back to coder. \`model\` is passed through to the worker launch config (\`--model <id>\`), so a 100-way fan-out can use a cheap model and the synthesizer a strong one. The worker auto-dismisses when its \`agent()\` call resolves — you never dismiss it.
+\`agent(prompt, opts)\` opts: \`{ agentType?: "coder"|"reviewer"|"tester"|"custom"|<custom-role-name>, cli?: "claude"|"codex"|"opencode"|"gemini"|"hermes", model?: string, outputSchema?: object, label?: string, timeoutMs?: number }\` — other fields are silently ignored. \`agentType\` also accepts the name of a workspace custom role template (case-insensitive); a typo throws rather than silently falling back to coder. \`model\` is passed through to the worker launch config (\`--model <id>\`), so a 100-way fan-out can use a cheap model and the synthesizer a strong one. \`outputSchema\` makes \`agent()\` resolve to a parsed object instead of a string: the worker is told to end its report with a fenced \`\`\`json block whose keys match the schema. On a parse miss it falls back to \`{ text: "<raw report>" }\`, so ALWAYS treat a missing field as the SAFE default (never assume success). The worker auto-dismisses when its \`agent()\` call resolves — you never dismiss it.
 
 \`parallel()\` takes an array of THUNKS (\`() => agent(...)\`), NOT already-started promises: \`parallel([agent(...), agent(...)])\` degrades to unordered concurrency counted as a single step (a no-op grouping), because the promises already started at construction time. \`pipeline(items, ...stages)\` stages are also functions, shape \`(prev, item, i) => agent(...)\`.
 
@@ -176,15 +175,16 @@ while (dry < 2) {
 }
 return confirmed
 \`\`\`
-- **judge panel** — N independent verifiers per finding; majority confirms. Catches plausible-but-wrong findings:
+- **judge panel** — N independent verifiers per finding; majority confirms. \`outputSchema\` makes each vote a typed object instead of fragile yes/no string-matching. Note the safe default: a parse miss has no \`refuted\` key, so \`v.refuted === false\` is false → the finding stays refuted and a malformed reply can never flip it to "confirmed":
 \`\`\`
 phase('Verify')
 const votes = await parallel([
-  () => agent(\`Try to REFUTE: \${claim}. Default refuted=true if uncertain. Reply yes/no.\`),
-  () => agent(\`Independently judge: \${claim}. Reply yes/no.\`),
-  () => agent(\`Repro test: \${claim}. Did you confirm? yes/no.\`),
+  () => agent(\`Try to REFUTE: \${claim}. Default refuted=true if uncertain.\`, { outputSchema: { refuted: 'boolean' } }),
+  () => agent(\`Independently judge: \${claim}.\`, { outputSchema: { refuted: 'boolean' } }),
+  () => agent(\`Repro test: \${claim}. Did it reproduce?\`, { outputSchema: { refuted: 'boolean' } }),
 ])
-const real = votes.filter((v) => v?.toLowerCase().startsWith('y')).length >= 2
+// Only an explicit refuted:false counts as "survived"; missing/unparseable stays safely refuted.
+const real = votes.filter((v) => v && v.refuted === false).length >= 2
 \`\`\`
 - **pipeline** — multi-item, multi-stage, no barrier between stages (item A can be in stage 3 while item B is in stage 1); wall-clock = slowest single item, not sum-of-slowest-per-stage. Each stage gets \`(prevResult, originalItem, index)\`; a stage that throws drops that item to null and skips its remaining stages.
 
@@ -198,7 +198,8 @@ On completion Hive injects \`<hive-system-reminder>Hive workflow ... finished: s
  * syntax and the workflow DSL reference — the always-on injections only carry
  * the lean core rules and point here.
  */
-export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, workflowsEnabled = false, autostaffEnabled = false) => {
+export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, flags = FEATURE_FLAGS_ALL_OFF) => {
+    const { workflowsEnabled } = flags;
     // The `team workflow …` subcommands + the DSL reference + the per-workspace
     // CLI-policy section only appear when the experimental workflow feature is
     // ON. While off, the orchestrator's canonical reference never mentions
@@ -252,7 +253,7 @@ export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, workfl
         '',
         '- `team list` — show workspace members and their status',
         '- `team send "<worker-name>" "<task>"` — dispatch to a worker by name (never id)',
-        '- `team spawn <role> [--name <name>] [--cli claude|codex|opencode|gemini]` — create a PERSISTENT member when none fits (or when the roster is empty)',
+        '- `team spawn <role> [--name <name>] [--cli claude|codex|opencode|gemini|hermes]` — create a PERSISTENT member when none fits (or when the roster is empty)',
         '- `team spawn <role> --ephemeral [other-flags]` — create a one-shot worker that auto-dismisses after its first `team report`',
         '- `team dismiss <worker-name>` — remove an ephemeral worker you spawned',
         '- `team cancel --dispatch <id> "<reason>"` — cancel an obsolete open dispatch',
@@ -266,7 +267,7 @@ export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, workfl
         '',
         '## Orchestrator rules',
         '',
-        renderRules(orchestratorRules(workflowsEnabled, autostaffEnabled)),
+        renderRules(orchestratorRules(flags)),
         '',
         '## Worker rules',
         '',

package/dist/src/server/post-start-input-writer.js

@@ -1,5 +1,5 @@
 import { normalizeExecutableToken } from './startup-command-parser.js';
-const INTERACTIVE_COMMANDS = new Set(['claude', 'codex', 'gemini', 'opencode']);
+const INTERACTIVE_COMMANDS = new Set(['claude', 'codex', 'gemini', 'hermes', 'opencode']);
 const READY_CHECK_INTERVAL_MS = 50;
 const READY_TIMEOUT_MS = 3000;
 const MIN_SUBMIT_AFTER_PASTE_DELAY_MS = 600;
@@ -19,7 +19,7 @@ const CODEX_PASTE_ACK_TIMEOUT_MS = 10000;
 // timeout before Enter is sent.
 const CODEX_PASTE_ACK_MIN_CHARS = 2000;
 const CODEX_SUBMIT_RETRY_DELAY_MS = 500;
-const COMMANDS_WITH_BRACKETED_PASTE = new Set(['claude', 'codex', 'opencode']);
+const COMMANDS_WITH_BRACKETED_PASTE = new Set(['claude', 'codex', 'hermes', 'opencode']);
 const COMMANDS_WAITING_FOR_PASTE_ACK = new Set(['claude', 'codex']);
 const BRACKETED_PASTE_END = '\u001b[201~';
 const PASTE_ACK_PATTERN = /(?:^|[\r\n])\s*(?:[❯›]\s*)?\[(?:Pasted text #\d+[^\]]*|Pasted Content [\d,]+ chars)\]/u;

package/dist/src/server/preset-launch-support.js

@@ -63,7 +63,8 @@ const shouldVerifySessionBeforeResume = (capture) => {
 const supportsPresetResume = (capture) => capture?.source === 'claude_project_jsonl_dir' ||
     capture?.source === 'codex_session_jsonl_dir' ||
     capture?.source === 'gemini_session_json_dir' ||
-    capture?.source === 'opencode_session_db';
+    capture?.source === 'opencode_session_db' ||
+    capture?.source === 'stdout_regex';
 export const withPresetResumeArgs = (config, preset, lastSessionId, cwd, discriminator, onInvalidSessionId) => {
     const launchConfig = normalizeCodexNodeEntrypoint(config, preset);
     let nextConfig = withPresetYoloArgs(launchConfig, preset);

package/dist/src/server/recovery-summary.d.ts

@@ -1,15 +1,14 @@
 import type { AgentSummary, WorkspaceSummary } from '../shared/types.js';
+import { type FeatureFlags } from './feature-flags.js';
 import type { RecoveryMessage } from './message-log-store.js';
-export declare const buildRecoverySummary: ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, workflowsEnabled, autostaffEnabled, }: {
+export declare const buildRecoverySummary: ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, flags, }: {
     agent: AgentSummary;
     allTaskMessages?: RecoveryMessage[];
     messages: RecoveryMessage[];
     tasksContent: string;
     workers: AgentSummary[];
     workspace: WorkspaceSummary;
-    /** Experimental workflow gate — keeps the recovered handover prompt
-     *  consistent with the live flag (omits the workflow rule when off). */
-    workflowsEnabled?: boolean;
-    /** Experimental auto-staff gate (default on) — same, for the team-sizing rule. */
-    autostaffEnabled?: boolean;
+    /** Live experimental flags — keep the recovered handover prompt consistent
+     *  with what a fresh startup would inject (workflow + team-sizing rules). */
+    flags?: FeatureFlags;
 }) => string;

package/dist/src/server/recovery-summary.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { getHiveTeamRules } from './hive-team-guidance.js';
 import { wrapSystemMessage } from './system-message.js';
 import { TASKS_RELATIVE_PATH } from './tasks-file.js';
@@ -64,7 +65,7 @@ const formatWorkers = (workers) => {
     return workers.map((worker) => `- ${worker.name} (${worker.role}, ${worker.status}, pending_task_count: ${worker.pendingTaskCount})`);
 };
 const getTaskSectionTitle = (agent) => agent.role === 'orchestrator' ? '## Tasks you dispatched' : '## Tasks recently sent to you';
-export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, workflowsEnabled = false, autostaffEnabled = false, }) => wrapSystemMessage([
+export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, flags = FEATURE_FLAGS_ALL_OFF, }) => wrapSystemMessage([
     `You are ${agent.name} (${agent.role}) in workspace ${workspace.name}.`,
     'Hive just restarted you and could not recover via native session resume. Here is the handover context.',
     '',
@@ -84,7 +85,7 @@ export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksCo
     ...formatWorkers(workers),
     '',
     agent.role === 'orchestrator' ? '## Hive worker dispatch rules' : '## Hive worker boundaries',
-    ...getHiveTeamRules(agent, workflowsEnabled, autostaffEnabled),
+    ...getHiveTeamRules(agent, flags),
     '',
     'Continue from here. If unsure, ask the user.',
 ].join('\n'));

package/dist/src/server/report-outbox-store.d.ts

@@ -0,0 +1,36 @@
+import type { Database } from 'better-sqlite3';
+/**
+ * Durable redelivery queue for worker reports the orchestrator could not
+ * receive. `team report` persists the dispatch as reported and forwards the
+ * report into the orchestrator's stdin best-effort; if that write fails (the
+ * PTY exited / is mid-restart, or the orchestrator was down at report time)
+ * the report would otherwise be lost — the ledger says "reported" yet the
+ * orchestrator waits forever, indistinguishable from a hang.
+ *
+ * Entries are keyed by dispatch id (UNIQUE) so a report enqueues at most once,
+ * and drain marks them delivered only after the orchestrator PTY write
+ * actually resolves, so a failed redelivery stays pending for the next drain.
+ */
+export interface ReportOutboxEntry {
+    id: number;
+    workspaceId: string;
+    targetAgentId: string;
+    dispatchId: string;
+    payload: string;
+    createdAt: number;
+    deliveredAt: number | null;
+}
+interface EnqueueInput {
+    workspaceId: string;
+    targetAgentId: string;
+    dispatchId: string;
+    payload: string;
+}
+export declare const createReportOutboxStore: (db: Database) => {
+    enqueue: (input: EnqueueInput) => void;
+    listPending: (workspaceId: string, targetAgentId: string) => ReportOutboxEntry[];
+    markDelivered: (id: number) => void;
+    pendingCount: (workspaceId: string, targetAgentId: string) => number;
+};
+export type ReportOutboxStore = ReturnType<typeof createReportOutboxStore>;
+export {};

package/dist/src/server/report-outbox-store.js

@@ -0,0 +1,33 @@
+const rowToEntry = (row) => ({
+    id: row.id,
+    workspaceId: row.workspace_id,
+    targetAgentId: row.target_agent_id,
+    dispatchId: row.dispatch_id,
+    payload: row.payload,
+    createdAt: row.created_at,
+    deliveredAt: row.delivered_at,
+});
+export const createReportOutboxStore = (db) => {
+    // INSERT OR IGNORE on the UNIQUE dispatch_id: a dispatch reports once, so a
+    // second enqueue for the same dispatch (e.g. a retry path) is a no-op rather
+    // than a duplicate the orchestrator would see twice.
+    const enqueue = (input) => {
+        db.prepare(`INSERT OR IGNORE INTO report_outbox
+        (workspace_id, target_agent_id, dispatch_id, payload, created_at)
+       VALUES (?, ?, ?, ?, ?)`).run(input.workspaceId, input.targetAgentId, input.dispatchId, input.payload, Date.now());
+    };
+    const listPending = (workspaceId, targetAgentId) => db
+        .prepare(`SELECT id, workspace_id, target_agent_id, dispatch_id, payload, created_at, delivered_at
+           FROM report_outbox
+           WHERE workspace_id = ? AND target_agent_id = ? AND delivered_at IS NULL
+           ORDER BY created_at ASC, id ASC`)
+        .all(workspaceId, targetAgentId).map(rowToEntry);
+    const markDelivered = (id) => {
+        db.prepare(`UPDATE report_outbox SET delivered_at = ? WHERE id = ? AND delivered_at IS NULL`).run(Date.now(), id);
+    };
+    const pendingCount = (workspaceId, targetAgentId) => db
+        .prepare(`SELECT COUNT(*) AS n FROM report_outbox
+           WHERE workspace_id = ? AND target_agent_id = ? AND delivered_at IS NULL`)
+        .get(workspaceId, targetAgentId).n;
+    return { enqueue, listPending, markDelivered, pendingCount };
+};

package/dist/src/server/restart-policy-support.d.ts

@@ -1,5 +1,6 @@
 import type { AgentSummary, WorkspaceSummary } from '../shared/types.js';
 import type { PersistedAgentRun } from './agent-run-store.js';
+import type { FeatureFlags } from './feature-flags.js';
 import type { MessageLogHandle, MessageLogRecord, RecoveryMessage } from './message-log-store.js';
 export interface RestartPolicyInput {
     deleteMessage: (handle: MessageLogHandle) => void;
@@ -11,11 +12,9 @@ export interface RestartPolicyInput {
     listAgentRuns: (agentId: string) => PersistedAgentRun[];
     listMessagesForRecovery: (workspaceId: string, sinceMs: number) => RecoveryMessage[];
     readTasks: (workspacePath: string) => string;
-    /** Experimental workflow gate — threaded into the recovery handover prompt
-     *  so it matches the live flag. Optional; omitted → off. */
-    getWorkflowsEnabled?: () => boolean;
-    /** Experimental auto-staff gate (default on) — same. */
-    getAutostaffEnabled?: () => boolean;
+    /** Resolves the live experimental flags, threaded into the recovery handover
+     *  prompt so it matches a fresh startup. Optional; omitted → all off. */
+    getFlags?: () => FeatureFlags;
 }
 export declare const findPreviousRun: (runs: PersistedAgentRun[], currentRunId: string) => PersistedAgentRun | undefined;
 export declare const writeSystemMessage: ({ deleteMessage, insertMessage, record, runId, text, writeToRun, }: {

package/dist/src/server/restart-policy.d.ts

@@ -9,6 +9,10 @@ export interface RestartPolicy {
         workspace: WorkspaceSummary;
         writeToRun: (runId: string, text: string) => Promise<void>;
     }) => boolean;
+    /** Record that `runId` was killed at the user's request (Stop button), so a
+     *  subsequent restart does not inject the crash-recovery handover for a run
+     *  the user deliberately ended. */
+    markUserStopped: (runId: string) => void;
 }
 export declare const createNoopRestartPolicy: () => RestartPolicy;
-export declare const createRestartPolicy: ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getWorkflowsEnabled, getAutostaffEnabled, }: RestartPolicyInput) => RestartPolicy;
+export declare const createRestartPolicy: ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getFlags, }: RestartPolicyInput) => RestartPolicy;

package/dist/src/server/restart-policy.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { buildRecoverySummary } from './recovery-summary.js';
 import { findPreviousRun, writeSystemMessage, } from './restart-policy-support.js';
 import { createSystemRecoverySummaryMessage } from './runtime-message-builders.js';
@@ -6,38 +7,55 @@ export const createNoopRestartPolicy = () => ({
     injectPostStartMessage() {
         return false;
     },
+    markUserStopped() { },
 });
-export const createRestartPolicy = ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getWorkflowsEnabled, getAutostaffEnabled, }) => ({
-    injectPostStartMessage({ agentId, runId, startConfig, workspace, writeToRun }) {
-        const previousRun = findPreviousRun(listAgentRuns(agentId), runId);
-        if (!previousRun)
-            return false;
-        const snapshot = getWorkspaceSnapshot(workspace.id);
-        const agent = snapshot.agents.find((item) => item.id === agentId);
-        if (!agent)
-            return false;
-        const workers = snapshot.agents.filter((item) => item.role !== 'orchestrator' && item.id !== agentId);
-        const tasksContent = readTasks(snapshot.summary.path);
-        if (startConfig.resumedSessionId)
+export const createRestartPolicy = ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getFlags, }) => {
+    // Runs the user killed via the Stop button. A deliberate stop is otherwise
+    // byte-identical to a crash (both end status 'error'), so without this a
+    // stop+Restart would inject the "could not recover" handover with stale open
+    // tasks the user may have meant to abandon. In-process only: after a runtime
+    // restart this is empty, which is correct — that case IS a recovery.
+    const userStoppedRuns = new Set();
+    return {
+        markUserStopped(runId) {
+            userStoppedRuns.add(runId);
+        },
+        injectPostStartMessage({ agentId, runId, startConfig, workspace, writeToRun }) {
+            const previousRun = findPreviousRun(listAgentRuns(agentId), runId);
+            if (!previousRun)
+                return false;
+            // Consume the marker whether or not we end up skipping, so it never
+            // lingers to suppress a later genuine crash on the same run id.
+            const wasUserStopped = userStoppedRuns.delete(previousRun.runId);
+            const snapshot = getWorkspaceSnapshot(workspace.id);
+            const agent = snapshot.agents.find((item) => item.id === agentId);
+            if (!agent)
+                return false;
+            const workers = snapshot.agents.filter((item) => item.role !== 'orchestrator' && item.id !== agentId);
+            const tasksContent = readTasks(snapshot.summary.path);
+            if (startConfig.resumedSessionId)
+                return true;
+            // Deliberate stop + restart: start fresh, no crash handover.
+            if (wasUserStopped)
+                return false;
+            const text = buildRecoverySummary({
+                agent,
+                allTaskMessages: listMessagesForRecovery(workspace.id, 0),
+                messages: listMessagesForRecovery(workspace.id, Date.now() - RECOVERY_WINDOW_MS),
+                tasksContent,
+                workers,
+                workspace,
+                flags: getFlags?.() ?? FEATURE_FLAGS_ALL_OFF,
+            });
+            writeSystemMessage({
+                deleteMessage,
+                insertMessage,
+                record: createSystemRecoverySummaryMessage(workspace.id, agentId, text),
+                runId,
+                text,
+                writeToRun,
+            });
             return true;
-        const text = buildRecoverySummary({
-            agent,
-            allTaskMessages: listMessagesForRecovery(workspace.id, 0),
-            messages: listMessagesForRecovery(workspace.id, Date.now() - RECOVERY_WINDOW_MS),
-            tasksContent,
-            workers,
-            workspace,
-            workflowsEnabled: getWorkflowsEnabled?.() ?? false,
-            autostaffEnabled: getAutostaffEnabled?.() ?? false,
-        });
-        writeSystemMessage({
-            deleteMessage,
-            insertMessage,
-            record: createSystemRecoverySummaryMessage(workspace.id, agentId, text),
-            runId,
-            text,
-            writeToRun,
-        });
-        return true;
-    },
-});
+        },
+    };
+};

package/dist/src/server/routes-settings.js

@@ -1,4 +1,5 @@
 import { resolveCommandPath } from './agent-command-resolver.js';
+import { readFeatureFlags } from './feature-flags.js';
 import { BadRequestError } from './http-errors.js';
 import { getRequiredParam, readJsonBody, route, sendJson } from './route-helpers.js';
 import { ensureProtocolFile } from './tasks-file.js';
@@ -49,11 +50,10 @@ const serializeRoleTemplate = (template) => ({
  */
 const refreshWorkflowProtocolDocs = (store) => {
     const policy = readWorkflowCliPolicy(store.settings.getAppState(WORKFLOW_CLI_POLICY_KEY)?.value ?? null);
-    const enabled = readWorkflowEnabled(store.settings.getAppState(WORKFLOW_ENABLED_KEY)?.value ?? null);
-    const autostaff = readAutostaffEnabled(store.settings.getAppState(AUTOSTAFF_ENABLED_KEY)?.value ?? null);
+    const flags = readFeatureFlags(store.settings);
     for (const workspace of store.listWorkspaces()) {
         try {
-            ensureProtocolFile(workspace.path, policy, enabled, autostaff);
+            ensureProtocolFile(workspace.path, policy, flags);
         }
         catch (error) {
             console.error('[hive] swallowed:settings.refreshProtocol', error);

package/dist/src/server/routes-tasks.js

@@ -1,6 +1,29 @@
 import { getRequiredParam, readJsonBody, route, sendJson } from './route-helpers.js';
+import { computeRunnableTasks } from './task-deps.js';
+import { authenticateCliAgent, requireCommandForRole } from './team-authz.js';
 import { requireUiTokenFromRequest } from './ui-auth-helpers.js';
 export const taskRoutes = [
+    route('GET', '/api/workspaces/:workspaceId/tasks/next', ({ params, request, response, store, tasksFileService }) => {
+        const workspaceId = getRequiredParam(response, params, 'workspaceId', 'Workspace id is required');
+        if (!workspaceId) {
+            return;
+        }
+        // CLI-agent auth (mirrors `team list`): `team next` is an orchestrator
+        // planning query, not a UI call.
+        const agentId = request.headers['x-hive-agent-id'];
+        const token = request.headers['x-hive-agent-token'];
+        const agent = authenticateCliAgent({
+            fromAgentId: typeof agentId === 'string' ? agentId : undefined,
+            getAgent: store.getAgent,
+            token: typeof token === 'string' ? token : undefined,
+            validateToken: store.validateAgentToken,
+            workspaceId,
+        });
+        requireCommandForRole(agent, 'next');
+        const workspace = store.getWorkspaceSnapshot(workspaceId);
+        const tasks = computeRunnableTasks(tasksFileService.readTasks(workspace.summary.path));
+        sendJson(response, 200, { tasks });
+    }),
     route('GET', '/api/workspaces/:workspaceId/tasks', ({ params, request, response, store, tasksFileService }) => {
         const workspaceId = getRequiredParam(response, params, 'workspaceId', 'Workspace id is required');
         if (!workspaceId) {

package/dist/src/server/routes-workspaces.js

@@ -78,6 +78,11 @@ export const workspaceRoutes = [
             workspaceId,
         });
         requireCommandForRole(agent, 'list');
+        // The orchestrator polling `team list` is its natural post-restart wakeup:
+        // flush any reports a prior outage stranded back into its stdin now that
+        // it is reachable again. Cheap (indexed, usually empty) and a safe no-op
+        // for non-orchestrator callers.
+        store.drainReportOutbox(workspaceId);
         sendJson(response, 200, enrichTeamList(workspaceId, store, store.listWorkers(workspaceId)).map(serializeTeamListItem));
     }),
     route('POST', '/api/workspaces/:workspaceId/workers', async ({ params, request, response, store }) => {

package/dist/src/server/runtime-restart-policy.d.ts

@@ -1,8 +1,9 @@
 import type { AgentRunStorePort } from './agent-runtime-ports.js';
+import type { FeatureFlags } from './feature-flags.js';
 import type { MessageLogHandle, MessageLogRecord, RecoveryMessage } from './message-log-store.js';
 import type { TasksFileService } from './tasks-file.js';
 import type { WorkspaceStore } from './workspace-store.js';
-export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getWorkflowsEnabled, getAutostaffEnabled, }: {
+export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }: {
     agentRunStore: Pick<AgentRunStorePort, "listAgentRuns">;
     messageLogStore: {
         deleteMessage: (handle: MessageLogHandle) => void;
@@ -11,6 +12,5 @@ export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStor
     };
     tasksFileService: Pick<TasksFileService, "readTasks">;
     workspaceStore: Pick<WorkspaceStore, "getWorkspaceSnapshot">;
-    getWorkflowsEnabled?: () => boolean;
-    getAutostaffEnabled?: () => boolean;
+    getFlags?: () => FeatureFlags;
 }) => import("./restart-policy.js").RestartPolicy;

package/dist/src/server/runtime-restart-policy.js

@@ -1,12 +1,11 @@
 import { createRestartPolicy } from './restart-policy.js';
 // Narrow helper keeps runtime-store under the hard line cap.
-export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getWorkflowsEnabled, getAutostaffEnabled, }) => createRestartPolicy({
+export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }) => createRestartPolicy({
     deleteMessage: messageLogStore.deleteMessage,
     getWorkspaceSnapshot: workspaceStore.getWorkspaceSnapshot,
     insertMessage: messageLogStore.insertMessage,
     listAgentRuns: agentRunStore.listAgentRuns,
     listMessagesForRecovery: messageLogStore.listMessagesForRecovery,
     readTasks: tasksFileService.readTasks,
-    ...(getWorkflowsEnabled ? { getWorkflowsEnabled } : {}),
-    ...(getAutostaffEnabled ? { getAutostaffEnabled } : {}),
+    ...(getFlags ? { getFlags } : {}),
 });

package/dist/src/server/runtime-store-contract.d.ts

@@ -28,6 +28,9 @@ export interface RuntimeStore {
         restartedWorker: boolean;
     }>;
     reportTask: (workspaceId: string, workerId: string, input?: ReportTaskInput) => ReportTaskResult;
+    /** Flush any reports stranded by a prior orchestrator outage. Safe no-op
+     *  when the orchestrator is down or the outbox is empty. */
+    drainReportOutbox: (workspaceId: string) => void;
     statusTask: (workspaceId: string, workerId: string, input?: StatusTaskInput) => ReportTaskResult;
     cancelTask: (workspaceId: string, dispatchId: string, input: CancelTaskInput) => ReportTaskResult;
     listDispatches: (workspaceId: string, options?: ListDispatchesOptions) => DispatchRecord[];

package/dist/src/server/runtime-store-helpers.d.ts

@@ -11,6 +11,7 @@ import { createTasksFileService } from './tasks-file.js';
 import { createTasksFileWatcher } from './tasks-file-watcher.js';
 import { createTeamOperations } from './team-operations.js';
 import { createUiAuth } from './ui-auth.js';
+import { createWebhookNotifier } from './webhook-notifier.js';
 import { type WorkerOutputTracker } from './worker-output-tracker.js';
 import { type WorkflowDispatchAwaiter } from './workflow-dispatch-awaiter.js';
 import { createWorkflowRunLogStore } from './workflow-run-log-store.js';
@@ -31,6 +32,7 @@ export interface RuntimeStoreServices {
     tasksFileService: ReturnType<typeof createTasksFileService>;
     teamOps: ReturnType<typeof createTeamOperations>;
     uiAuth: ReturnType<typeof createUiAuth>;
+    webhookNotifier: ReturnType<typeof createWebhookNotifier>;
     workerOutputTracker: WorkerOutputTracker | null;
     workflowDispatchAwaiter: WorkflowDispatchAwaiter;
     workflowRunLogStore: ReturnType<typeof createWorkflowRunLogStore>;