@tt-a1i/hive 1.7.0 → 2.0.2

package/dist/src/server/routes-workspaces.js

@@ -21,11 +21,11 @@ const getSerializedWorker = (workspaceId, workerId, store) => {
 const getRuntimePort = (request) => String(request.socket.localPort ?? '');
 export const workspaceRoutes = [
     route('GET', '/api/workspaces', ({ request, response, store }) => {
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         sendJson(response, 200, store.listWorkspaces());
     }),
     route('POST', '/api/workspaces', async ({ request, response, store }) => {
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         const body = await readJsonBody(request);
         const startupCommand = typeof body.startup_command === 'string' ? body.startup_command : null;
         const workspacePath = validateWorkspacePath(body.path);
@@ -50,7 +50,7 @@ export const workspaceRoutes = [
         if (!workspaceId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         await store.deleteWorkspace(workspaceId);
         response.statusCode = 204;
         response.end();
@@ -60,7 +60,7 @@ export const workspaceRoutes = [
         if (!workspaceId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         sendJson(response, 200, enrichTeamList(workspaceId, store, store.listWorkers(workspaceId)).map(serializeTeamListItem));
     }),
     route('GET', '/api/workspaces/:workspaceId/team', ({ params, request, response, store }) => {
@@ -90,7 +90,7 @@ export const workspaceRoutes = [
         if (!workspaceId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         const body = await readJsonBody(request);
         const presetId = body.command_preset_id ?? null;
         const startupCommand = typeof body.startup_command === 'string' ? body.startup_command : null;
@@ -128,7 +128,7 @@ export const workspaceRoutes = [
         if (!workspaceId || !workerId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         store.deleteWorker(workspaceId, workerId);
         response.statusCode = 204;
         response.end();
@@ -139,7 +139,7 @@ export const workspaceRoutes = [
         if (!workspaceId || !workerId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         const body = await readJsonBody(request);
         if (typeof body.name !== 'string') {
             sendJson(response, 400, { error: 'name is required' });
@@ -153,7 +153,7 @@ export const workspaceRoutes = [
         if (!workspaceId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         const body = await readJsonBody(request);
         store.recordUserInput(workspaceId, `${workspaceId}:orchestrator`, body.text);
         sendJson(response, 202, { ok: true });
@@ -164,7 +164,7 @@ export const workspaceRoutes = [
         if (!workspaceId || !agentId) {
             return;
         }
-        requireUiTokenFromRequest(request, store.validateUiToken);
+        requireUiTokenFromRequest(request, store.validateUiToken, store.authorizeRemoteTunnelRequest);
         if (agentId === getOrchestratorId(workspaceId) &&
             !store.peekAgentLaunchConfig(workspaceId, agentId)) {
             seedOrchestratorLaunchConfig(store, store.settings, workspaceId);

package/dist/src/server/routes.js

@@ -3,14 +3,19 @@ import { dispatchRoutes } from './routes-dispatches.js';
 import { fsRoutes } from './routes-fs.js';
 import { marketplaceRoutes } from './routes-marketplace.js';
 import { openWorkspaceRoutes } from './routes-open-workspace.js';
+import { remoteRoutes } from './routes-remote.js';
 import { runtimeRoutes } from './routes-runtime.js';
 import { settingsRoutes } from './routes-settings.js';
 import { taskRoutes } from './routes-tasks.js';
 import { teamRoutes } from './routes-team.js';
+import { teamMemoryRoutes } from './routes-team-memory.js';
+import { teamRecallRoutes } from './routes-team-recall.js';
 import { uiRoutes } from './routes-ui.js';
 import { versionRoutes } from './routes-version.js';
 import { workflowScheduleRoutes } from './routes-workflow-schedules.js';
 import { workflowRoutes } from './routes-workflows.js';
+import { workspaceMemoryRoutes } from './routes-workspace-memory.js';
+import { workspaceMemoryDreamRoutes } from './routes-workspace-memory-dreams.js';
 import { workspaceRoutes } from './routes-workspaces.js';
 const routes = [
     ...workspaceRoutes,
@@ -20,12 +25,17 @@ const routes = [
     ...uiRoutes,
     ...settingsRoutes,
     ...taskRoutes,
+    ...workspaceMemoryDreamRoutes,
+    ...workspaceMemoryRoutes,
     ...runtimeRoutes,
+    ...teamRecallRoutes,
+    ...teamMemoryRoutes,
     ...teamRoutes,
     ...fsRoutes,
     ...marketplaceRoutes,
     ...workflowRoutes,
     ...workflowScheduleRoutes,
+    ...remoteRoutes,
 ];
 export const matchRoute = (method, pathname) => {
     for (const routeDefinition of routes) {

package/dist/src/server/runtime-database.d.ts

@@ -1,2 +1,3 @@
 import type { Database } from 'better-sqlite3';
+export declare const formatRuntimeDataDirOpenMessage: (dataDir: string, error: unknown) => string;
 export declare const openRuntimeDatabase: (dataDir?: string) => Database;

package/dist/src/server/runtime-database.js

@@ -2,15 +2,40 @@ import { mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import BetterSqlite3 from 'better-sqlite3';
 import { initializeRuntimeDatabase } from './sqlite-schema.js';
+export const formatRuntimeDataDirOpenMessage = (dataDir, error) => {
+    const detail = error instanceof Error ? error.message : String(error);
+    return [
+        `Hive could not open its local data directory: ${dataDir}`,
+        detail,
+        '',
+        'Choose a writable local folder and start Hive with HIVE_DATA_DIR set, for example:',
+        '  PowerShell: $env:HIVE_DATA_DIR="C:\\HiveData"; hive',
+        '  cmd.exe:    set HIVE_DATA_DIR=C:\\HiveData && hive',
+    ].join('\n');
+};
+const createRuntimeDataDirOpenError = (dataDir, error) => new Error(formatRuntimeDataDirOpenMessage(dataDir, error), { cause: error });
+const configureRuntimeDatabase = (database, input) => {
+    database.pragma('busy_timeout = 5000');
+    if (!input.persistent)
+        return;
+    database.pragma('journal_mode = WAL');
+    database.pragma('synchronous = NORMAL');
+};
 export const openRuntimeDatabase = (dataDir) => {
     let database;
     if (dataDir) {
-        mkdirSync(dataDir, { recursive: true });
-        database = new BetterSqlite3(join(dataDir, 'runtime.sqlite'));
+        try {
+            mkdirSync(dataDir, { recursive: true });
+            database = new BetterSqlite3(join(dataDir, 'runtime.sqlite'));
+        }
+        catch (error) {
+            throw createRuntimeDataDirOpenError(dataDir, error);
+        }
     }
     else {
         database = new BetterSqlite3(':memory:');
     }
+    configureRuntimeDatabase(database, { persistent: Boolean(dataDir) });
     initializeRuntimeDatabase(database);
     return database;
 };

package/dist/src/server/runtime-restart-policy.d.ts

@@ -2,14 +2,16 @@ import type { AgentRunStorePort } from './agent-runtime-ports.js';
 import type { FeatureFlags } from './feature-flags.js';
 import type { MessageLogHandle, MessageLogRecord, RecoveryMessage } from './message-log-store.js';
 import type { TasksFileService } from './tasks-file.js';
+import type { TeamMemoryInjectionService } from './team-memory-injection.js';
 import type { WorkspaceStore } from './workspace-store.js';
-export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }: {
+export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, memoryInjection, tasksFileService, workspaceStore, getFlags, }: {
     agentRunStore: Pick<AgentRunStorePort, "listAgentRuns">;
     messageLogStore: {
         deleteMessage: (handle: MessageLogHandle) => void;
         insertMessage: (record: MessageLogRecord) => MessageLogHandle;
         listMessagesForRecovery: (workspaceId: string, sinceMs: number) => RecoveryMessage[];
     };
+    memoryInjection?: TeamMemoryInjectionService;
     tasksFileService: Pick<TasksFileService, "readTasks">;
     workspaceStore: Pick<WorkspaceStore, "getWorkspaceSnapshot">;
     getFlags?: () => FeatureFlags;

package/dist/src/server/runtime-restart-policy.js

@@ -1,6 +1,6 @@
 import { createRestartPolicy } from './restart-policy.js';
 // Narrow helper keeps runtime-store under the hard line cap.
-export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }) => createRestartPolicy({
+export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, memoryInjection, tasksFileService, workspaceStore, getFlags, }) => createRestartPolicy({
     deleteMessage: messageLogStore.deleteMessage,
     getWorkspaceSnapshot: workspaceStore.getWorkspaceSnapshot,
     insertMessage: messageLogStore.insertMessage,
@@ -8,4 +8,5 @@ export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, task
     listMessagesForRecovery: messageLogStore.listMessagesForRecovery,
     readTasks: tasksFileService.readTasks,
     ...(getFlags ? { getFlags } : {}),
+    ...(memoryInjection ? { memoryInjection } : {}),
 });

package/dist/src/server/runtime-store-contract.d.ts

@@ -1,3 +1,4 @@
+import type { IncomingMessage } from 'node:http';
 import type { AgentSummary, TeamListItem, WorkspaceSummary } from '../shared/types.js';
 import type { AgentManager } from './agent-manager.js';
 import type { AgentLaunchConfigInput, PersistedAgentRun } from './agent-run-store.js';
@@ -5,8 +6,16 @@ import type { LiveAgentRun } from './agent-runtime-types.js';
 import type { DispatchRecord, ListDispatchesOptions } from './dispatch-ledger-store.js';
 import type { RecoveryMessage } from './message-log-store.js';
 import type { PtyOutputBus } from './pty-output-bus.js';
+import type { RemoteAuditStore } from './remote-audit-store.js';
+import type { DeviceSessionProvider } from './remote-device-session.js';
+import type { RemoteDeviceRecord, RemoteDeviceStore } from './remote-device-store.js';
+import type { RemotePairing } from './remote-pairing.js';
+import type { RemoteTunnel, TunnelStatus } from './remote-tunnel.js';
 import type { SettingsStore } from './settings-store.js';
+import type { DreamRunRecord } from './team-memory-dream-store.js';
+import type { AddMemoryEntryInput, LogMemoryInjectionsInput, MemoryEntryWithSources, MemoryInjectionWithMemory, MemoryListOptions, MemorySearchOptions, MemorySearchResult } from './team-memory-store.js';
 import type { CancelTaskInput, DispatchTaskInput, ReportTaskInput, ReportTaskResult, StatusTaskInput } from './team-operations.js';
+import type { RecallOptions, RecallResult } from './team-recall-store.js';
 import type { TerminalRunSummary } from './terminal-input-profile.js';
 import type { WorkflowDispatchAwaiter } from './workflow-dispatch-awaiter.js';
 import type { WorkflowRunRecord } from './workflow-run-store.js';
@@ -59,6 +68,22 @@ export interface RuntimeStore {
     registerTasksListener: (listener: (workspaceId: string, content: string) => void) => () => void;
     listAgentRuns: (agentId: string) => PersistedAgentRun[];
     listMessagesForRecovery: (workspaceId: string, sinceMs: number) => RecoveryMessage[];
+    recallMessages: (workspaceId: string, query: string, options?: RecallOptions) => RecallResult[];
+    addMemoryEntry: (input: AddMemoryEntryInput) => MemoryEntryWithSources;
+    approveMemoryCandidate: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+    archiveMemoryEntry: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+    getMemoryEntry: (workspaceId: string, memoryId: string) => MemoryEntryWithSources | undefined;
+    listMemoryEntries: (workspaceId: string, options?: MemoryListOptions) => MemoryEntryWithSources[];
+    listMemoryInjectionsForDispatch: (workspaceId: string, dispatchId: string) => MemoryInjectionWithMemory[];
+    logMemoryInjections: (input: LogMemoryInjectionsInput) => string[];
+    rejectMemoryCandidate: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+    searchMemoryEntries: (workspaceId: string, query: string, options?: MemorySearchOptions) => MemorySearchResult[];
+    setMemoryDisabled: (workspaceId: string, memoryId: string, disabled: boolean) => MemoryEntryWithSources;
+    setMemoryPinned: (workspaceId: string, memoryId: string, pinned: boolean) => MemoryEntryWithSources;
+    listMemoryDreamRuns: (workspaceId: string, limit?: number) => DreamRunRecord[];
+    revertMemoryDream: (workspaceId: string, runId: string) => DreamRunRecord;
+    runMemoryDream: (workspaceId: string) => Promise<DreamRunRecord>;
+    tickMemoryDreamScheduler: (now?: number) => Promise<void>;
     peekAgentToken: (agentId: string) => string | undefined;
     pauseTerminalRun: (runId: string) => void;
     resizeAgentRun: (runId: string, cols: number, rows: number) => void;
@@ -69,6 +94,18 @@ export interface RuntimeStore {
     stopAgentRun: (runId: string) => void;
     validateAgentToken: (agentId: string, token: string | undefined) => boolean;
     validateUiToken: (token: string | undefined) => boolean;
+    authorizeRemoteTunnelRequest: (request: IncomingMessage) => boolean;
+    getRemoteTunnelSecret: () => string;
+    getRemoteAuditStore: () => RemoteAuditStore;
+    getRemoteDeviceSessions: () => DeviceSessionProvider;
+    getRemotePairing: () => RemotePairing;
+    confirmRemotePairing: (pairingId: string, name?: string) => Promise<RemoteDeviceRecord | null>;
+    getRemoteDeviceStore: () => RemoteDeviceStore;
+    getRemoteTunnelStatus: () => TunnelStatus;
+    setRemoteTunnelStatus: (status: TunnelStatus) => void;
+    bindRemoteTunnel: (tunnel: RemoteTunnel) => void;
+    setRemoteEnabled: (enabled: boolean) => void;
+    revokeRemoteDevice: (deviceId: string) => boolean;
     getWorkflowDispatchAwaiter: () => WorkflowDispatchAwaiter;
     runWorkflow: (input: RunWorkflowInput) => Promise<WorkflowRunRecord>;
     startWorkflow: (input: RunWorkflowInput) => Promise<WorkflowRunRecord>;

package/dist/src/server/runtime-store-dream.d.ts

@@ -0,0 +1,23 @@
+import type { DreamRunRecord } from './team-memory-dream-store.js';
+interface RuntimeStoreDreamServices {
+    teamMemoryDreamRunner: {
+        runManual: (workspaceId: string) => Promise<DreamRunRecord>;
+    };
+    teamMemoryDreamScheduler: {
+        tick: (now?: number) => Promise<void>;
+    };
+    teamMemoryDreamStore: {
+        listRuns: (workspaceId: string, limit?: number) => DreamRunRecord[];
+        revertRun: (workspaceId: string, runId: string) => DreamRunRecord;
+    };
+    teamMemoryExport: {
+        schedule: (workspaceId: string) => void;
+    };
+}
+export declare const createRuntimeStoreDreamMethods: (services: RuntimeStoreDreamServices) => {
+    listMemoryDreamRuns(workspaceId: string, limit?: number): DreamRunRecord[];
+    revertMemoryDream(workspaceId: string, runId: string): DreamRunRecord;
+    runMemoryDream(workspaceId: string): Promise<DreamRunRecord>;
+    tickMemoryDreamScheduler(now?: number): Promise<void>;
+};
+export {};

package/dist/src/server/runtime-store-dream.js

@@ -0,0 +1,16 @@
+export const createRuntimeStoreDreamMethods = (services) => ({
+    listMemoryDreamRuns(workspaceId, limit) {
+        return services.teamMemoryDreamStore.listRuns(workspaceId, limit);
+    },
+    revertMemoryDream(workspaceId, runId) {
+        const run = services.teamMemoryDreamStore.revertRun(workspaceId, runId);
+        services.teamMemoryExport.schedule(workspaceId);
+        return run;
+    },
+    runMemoryDream(workspaceId) {
+        return services.teamMemoryDreamRunner.runManual(workspaceId);
+    },
+    tickMemoryDreamScheduler(now) {
+        return services.teamMemoryDreamScheduler.tick(now);
+    },
+});

package/dist/src/server/runtime-store-helpers.d.ts

@@ -5,11 +5,21 @@ import type { LiveAgentRun } from './agent-runtime-types.js';
 import { createDispatchLedgerStore } from './dispatch-ledger-store.js';
 import { createMessageLogStore } from './message-log-store.js';
 import type { PtyOutputBus } from './pty-output-bus.js';
+import { type RemoteAuditStore } from './remote-audit-store.js';
+import type { DeviceSessionProvider } from './remote-device-session.js';
+import { type RemoteDeviceStore } from './remote-device-store.js';
+import { type RemotePairing } from './remote-pairing.js';
 import { openRuntimeDatabase } from './runtime-database.js';
 import { createSettingsStore } from './settings-store.js';
 import { createTasksFileService } from './tasks-file.js';
 import { createTasksFileWatcher } from './tasks-file-watcher.js';
+import { createTeamMemoryDreamRunner } from './team-memory-dream-runner.js';
+import { createTeamMemoryDreamScheduler } from './team-memory-dream-scheduler.js';
+import { createTeamMemoryDreamStore } from './team-memory-dream-store.js';
+import { createTeamMemoryExportService } from './team-memory-export.js';
+import { createTeamMemoryStore } from './team-memory-store.js';
 import { createTeamOperations } from './team-operations.js';
+import { createTeamRecallStore } from './team-recall-store.js';
 import { createUiAuth } from './ui-auth.js';
 import { createWebhookNotifier } from './webhook-notifier.js';
 import { type WorkerOutputTracker } from './worker-output-tracker.js';
@@ -25,11 +35,21 @@ export interface RuntimeStoreServices {
     db: ReturnType<typeof openRuntimeDatabase>;
     dispatchLedgerStore: ReturnType<typeof createDispatchLedgerStore>;
     messageLogStore: ReturnType<typeof createMessageLogStore>;
+    remoteAuditStore: RemoteAuditStore;
+    remoteDeviceSessions: DeviceSessionProvider;
+    remoteDeviceStore: RemoteDeviceStore;
+    remotePairing: RemotePairing;
     settings: ReturnType<typeof createSettingsStore>;
     shellRuntime: ReturnType<typeof createWorkspaceShellRuntime>;
     tasksFileWatcher: ReturnType<typeof createTasksFileWatcher>;
     tasksFileWatchCallbacks: Set<(workspaceId: string, content: string) => void>;
     tasksFileService: ReturnType<typeof createTasksFileService>;
+    teamMemoryDreamRunner: ReturnType<typeof createTeamMemoryDreamRunner>;
+    teamMemoryDreamScheduler: ReturnType<typeof createTeamMemoryDreamScheduler>;
+    teamMemoryDreamStore: ReturnType<typeof createTeamMemoryDreamStore>;
+    teamMemoryStore: ReturnType<typeof createTeamMemoryStore>;
+    teamMemoryExport: ReturnType<typeof createTeamMemoryExportService>;
+    teamRecallStore: ReturnType<typeof createTeamRecallStore>;
     teamOps: ReturnType<typeof createTeamOperations>;
     uiAuth: ReturnType<typeof createUiAuth>;
     webhookNotifier: ReturnType<typeof createWebhookNotifier>;

package/dist/src/server/runtime-store-helpers.js

@@ -5,13 +5,24 @@ import { createDispatchLedgerStore } from './dispatch-ledger-store.js';
 import { readFeatureFlags } from './feature-flags.js';
 import { createMessageLogStore } from './message-log-store.js';
 import { seedOrchestratorLaunchConfig } from './orchestrator-launch.js';
+import { createRemoteAuditStore } from './remote-audit-store.js';
+import { REMOTE_DAEMON_ID_KEY, REMOTE_GATEWAY_URL_KEY } from './remote-config-keys.js';
+import { createPersistentDeviceSessionProvider, createRemoteDeviceStore, } from './remote-device-store.js';
+import { createRemotePairing } from './remote-pairing.js';
 import { createReportOutboxStore } from './report-outbox-store.js';
 import { openRuntimeDatabase } from './runtime-database.js';
 import { buildRuntimeRestartPolicy } from './runtime-restart-policy.js';
 import { createSettingsStore } from './settings-store.js';
 import { createTasksFileService } from './tasks-file.js';
 import { createTasksFileWatcher } from './tasks-file-watcher.js';
+import { createWorkspaceMemoryDigestProvider } from './team-memory-digest.js';
+import { createTeamMemoryDreamRunner, defaultDreamCliCommand, dreamCliCommandForLaunchCommand, } from './team-memory-dream-runner.js';
+import { createTeamMemoryDreamScheduler } from './team-memory-dream-scheduler.js';
+import { createTeamMemoryDreamStore } from './team-memory-dream-store.js';
+import { createTeamMemoryExportService, MEMORY_EXPORT_DREAM_CHANGELOG_LIMIT, } from './team-memory-export.js';
+import { createTeamMemoryStore } from './team-memory-store.js';
 import { createTeamOperations } from './team-operations.js';
+import { createTeamRecallStore } from './team-recall-store.js';
 import { resolveTerminalInputProfile } from './terminal-input-profile.js';
 import { createUiAuth } from './ui-auth.js';
 import { createWebhookNotifier, WEBHOOK_URL_KEY } from './webhook-notifier.js';
@@ -36,6 +47,9 @@ export const createRuntimeStoreServices = (options = {}) => {
     const db = openRuntimeDatabase(options.dataDir);
     const messageLogStore = createMessageLogStore(db);
     const dispatchLedgerStore = createDispatchLedgerStore(db);
+    const teamMemoryStore = createTeamMemoryStore(db);
+    const teamMemoryDreamStore = createTeamMemoryDreamStore(db);
+    const teamRecallStore = createTeamRecallStore(db);
     const reportOutbox = createReportOutboxStore(db);
     const workflowDispatchAwaiter = createWorkflowDispatchAwaiter();
     const workflowRunStore = createWorkflowRunStore(db);
@@ -45,6 +59,16 @@ export const createRuntimeStoreServices = (options = {}) => {
     const agentSessionStore = createAgentSessionStore(db);
     const settings = createSettingsStore(db);
     const getFlags = () => readFeatureFlags(settings);
+    const memoryDigestProvider = createWorkspaceMemoryDigestProvider({
+        memoryStore: teamMemoryStore,
+        settings,
+    });
+    const memoryInjection = {
+        buildDigest: memoryDigestProvider.buildDigest,
+        buildDispatchDigest: memoryDigestProvider.buildDispatchDigest,
+        deleteInjections: teamMemoryStore.deleteInjections,
+        logInjections: teamMemoryStore.logInjections,
+    };
     const webhookNotifier = createWebhookNotifier({
         getUrl: () => settings.getAppState(WEBHOOK_URL_KEY)?.value ?? null,
     });
@@ -58,10 +82,27 @@ export const createRuntimeStoreServices = (options = {}) => {
         getFlags,
     });
     const uiAuth = createUiAuth();
+    const remoteAuditStore = createRemoteAuditStore(db);
+    // M4: the live runtime uses the PERSISTENT provider backed by the device store (M3's
+    // InMemoryDeviceSessionProvider stays test-only). A device row exists only after a desktop confirm,
+    // so this provider serves nothing until then; a revoke drops it from get()/candidates() at once.
+    const remoteDeviceStore = createRemoteDeviceStore(db);
+    const remoteDeviceSessions = createPersistentDeviceSessionProvider(remoteDeviceStore);
+    const remotePairing = createRemotePairing({
+        deviceStore: remoteDeviceStore,
+        audit: remoteAuditStore,
+        getGatewayUrl: () => settings.getAppState(REMOTE_GATEWAY_URL_KEY)?.value ?? null,
+        getDaemonId: () => settings.getAppState(REMOTE_DAEMON_ID_KEY)?.value ?? null,
+    });
     const shellRuntime = createWorkspaceShellRuntime(options.agentManager);
     agentRunStore.markUnfinishedRunsStale();
     workflowRunStore.markUnfinishedRunsInterrupted();
-    const workspaceStore = createWorkspaceStore(db, dispatchLedgerStore.listOpenDispatchKinds());
+    const workspaceStore = createWorkspaceStore(db, dispatchLedgerStore.listOpenDispatchKinds);
+    const teamMemoryExport = createTeamMemoryExportService({
+        getWorkspacePath: (workspaceId) => workspaceStore.getWorkspaceSnapshot(workspaceId).summary.path,
+        listDreamRuns: (workspaceId) => teamMemoryDreamStore.listRuns(workspaceId, MEMORY_EXPORT_DREAM_CHANGELOG_LIMIT),
+        listEntries: teamMemoryStore.listExportEntries,
+    });
     const startExistingWorkspaceWatches = () => {
         for (const workspace of workspaceStore.listWorkspaces()) {
             void tasksFileWatcher
@@ -72,6 +113,7 @@ export const createRuntimeStoreServices = (options = {}) => {
     const restartPolicy = buildRuntimeRestartPolicy({
         agentRunStore,
         messageLogStore,
+        memoryInjection,
         tasksFileService,
         workspaceStore,
         getFlags,
@@ -121,20 +163,41 @@ export const createRuntimeStoreServices = (options = {}) => {
             for (const child of children)
                 removeWorkerCompletely(workspaceId, child.id);
         }
-    }, restartPolicy, (workspaceId, agentId) => workspaceStore.getAgent(workspaceId, agentId), getFlags);
-    // Mirrors runtime-store.deleteWorker (stop run → drop launch config → drop
-    // dispatches → drop worker row, transactionally). Hoisted `function` so the
+    }, restartPolicy, (workspaceId, agentId) => workspaceStore.getAgent(workspaceId, agentId), getFlags, memoryInjection);
+    const teamMemoryDreamRunner = createTeamMemoryDreamRunner({
+        dreamStore: teamMemoryDreamStore,
+        getDreamCliCommand: (workspaceId) => {
+            seedOrchestratorLaunchConfig(agentRuntime, settings, workspaceId);
+            const config = agentRuntime.peekAgentLaunchConfig(workspaceId, getOrchestratorId(workspaceId));
+            return config?.command
+                ? dreamCliCommandForLaunchCommand(config.command)
+                : defaultDreamCliCommand();
+        },
+        getWorkspacePath: (workspaceId) => workspaceStore.getWorkspaceSnapshot(workspaceId).summary.path,
+        memoryStore: teamMemoryStore,
+        scheduleExport: teamMemoryExport.schedule,
+    });
+    const teamMemoryDreamScheduler = createTeamMemoryDreamScheduler({
+        getScheduleState: teamMemoryDreamStore.getScheduleState,
+        getWorkspaceSnapshot: (workspaceId) => workspaceStore.getWorkspaceSnapshot(workspaceId),
+        listWorkspaces: workspaceStore.listWorkspaces,
+        runScheduled: teamMemoryDreamRunner.runScheduled,
+        settings,
+    });
+    teamMemoryDreamScheduler.start();
+    // Mirrors runtime-store.deleteWorker (drop dispatches + worker row
+    // transactionally → drop launch config → stop run). Hoisted `function` so the
     // onAgentExit closure above can reference it; only invoked at runtime, after
     // agentRuntime is assigned.
     function removeWorkerCompletely(workspaceId, workerId) {
         const activeRun = agentRuntime.getActiveRunByAgentId(workspaceId, workerId);
-        if (activeRun)
-            agentRuntime.stopAgentRun(activeRun.runId);
-        agentRuntime.deleteAgentLaunchConfig(workspaceId, workerId);
         db.transaction(() => {
             dispatchLedgerStore.deleteWorkerDispatches(workspaceId, workerId);
             workspaceStore.deleteWorker(workspaceId, workerId);
         })();
+        agentRuntime.deleteAgentLaunchConfig(workspaceId, workerId);
+        if (activeRun)
+            agentRuntime.stopAgentRun(activeRun.runId);
     }
     // Boot cleanup: after a runtime restart every ephemeral worker is an orphan
     // (its spawner — a workflow run or an orchestrator PTY — is gone). Remove
@@ -173,11 +236,21 @@ export const createRuntimeStoreServices = (options = {}) => {
         db,
         dispatchLedgerStore,
         messageLogStore,
+        remoteAuditStore,
+        remoteDeviceSessions,
+        remoteDeviceStore,
+        remotePairing,
         settings,
         shellRuntime,
         tasksFileWatcher,
         tasksFileWatchCallbacks,
         tasksFileService,
+        teamMemoryDreamRunner,
+        teamMemoryDreamScheduler,
+        teamMemoryDreamStore,
+        teamMemoryExport,
+        teamMemoryStore,
+        teamRecallStore,
         teamOps,
         uiAuth,
         webhookNotifier,
@@ -248,6 +321,7 @@ export const createRuntimeStoreLifecycle = ({ agentManager, services, }) => {
             // instead of hanging on a Promise that can never resolve.
             services.workflowDispatchAwaiter.cancelAll('runtime closing');
             services.shellRuntime.close();
+            await services.teamMemoryExport.close();
             await services.agentRuntime.close();
             await services.tasksFileWatcher.close();
             services.workerOutputTracker?.closeAll();

package/dist/src/server/runtime-store-memory.d.ts

@@ -0,0 +1,33 @@
+import type { AddMemoryEntryInput, LogMemoryInjectionsInput, MemoryEntryWithSources, MemoryInjectionWithMemory, MemoryListOptions, MemorySearchOptions, MemorySearchResult } from './team-memory-store.js';
+interface RuntimeStoreMemoryServices {
+    teamMemoryExport: {
+        schedule: (workspaceId: string) => void;
+    };
+    teamMemoryStore: {
+        addEntry: (input: AddMemoryEntryInput) => MemoryEntryWithSources;
+        approveCandidate: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+        archiveEntry: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+        getEntryWithSources: (workspaceId: string, memoryId: string) => MemoryEntryWithSources | undefined;
+        listEntries: (workspaceId: string, options?: MemoryListOptions) => MemoryEntryWithSources[];
+        listInjectionsForDispatch: (workspaceId: string, dispatchId: string) => MemoryInjectionWithMemory[];
+        logInjections: (input: LogMemoryInjectionsInput) => string[];
+        rejectCandidate: (workspaceId: string, memoryId: string) => MemoryEntryWithSources;
+        searchEntries: (workspaceId: string, query: string, options?: MemorySearchOptions) => MemorySearchResult[];
+        setDisabled: (workspaceId: string, memoryId: string, disabled: boolean) => MemoryEntryWithSources;
+        setPinned: (workspaceId: string, memoryId: string, pinned: boolean) => MemoryEntryWithSources;
+    };
+}
+export declare const createRuntimeStoreMemoryMethods: (services: RuntimeStoreMemoryServices) => {
+    addMemoryEntry(input: AddMemoryEntryInput): MemoryEntryWithSources;
+    approveMemoryCandidate(workspaceId: string, memoryId: string): MemoryEntryWithSources;
+    archiveMemoryEntry(workspaceId: string, memoryId: string): MemoryEntryWithSources;
+    getMemoryEntry: (workspaceId: string, memoryId: string) => MemoryEntryWithSources | undefined;
+    listMemoryEntries: (workspaceId: string, options?: MemoryListOptions) => MemoryEntryWithSources[];
+    listMemoryInjectionsForDispatch: (workspaceId: string, dispatchId: string) => MemoryInjectionWithMemory[];
+    logMemoryInjections: (input: LogMemoryInjectionsInput) => string[];
+    rejectMemoryCandidate(workspaceId: string, memoryId: string): MemoryEntryWithSources;
+    searchMemoryEntries: (workspaceId: string, query: string, options?: MemorySearchOptions) => MemorySearchResult[];
+    setMemoryDisabled(workspaceId: string, memoryId: string, disabled: boolean): MemoryEntryWithSources;
+    setMemoryPinned(workspaceId: string, memoryId: string, pinned: boolean): MemoryEntryWithSources;
+};
+export {};

package/dist/src/server/runtime-store-memory.js

@@ -0,0 +1,37 @@
+export const createRuntimeStoreMemoryMethods = (services) => ({
+    addMemoryEntry(input) {
+        const memory = services.teamMemoryStore.addEntry(input);
+        services.teamMemoryExport.schedule(input.workspaceId);
+        return memory;
+    },
+    approveMemoryCandidate(workspaceId, memoryId) {
+        const memory = services.teamMemoryStore.approveCandidate(workspaceId, memoryId);
+        services.teamMemoryExport.schedule(workspaceId);
+        return memory;
+    },
+    archiveMemoryEntry(workspaceId, memoryId) {
+        const memory = services.teamMemoryStore.archiveEntry(workspaceId, memoryId);
+        services.teamMemoryExport.schedule(workspaceId);
+        return memory;
+    },
+    getMemoryEntry: (workspaceId, memoryId) => services.teamMemoryStore.getEntryWithSources(workspaceId, memoryId),
+    listMemoryEntries: (workspaceId, options) => services.teamMemoryStore.listEntries(workspaceId, options),
+    listMemoryInjectionsForDispatch: (workspaceId, dispatchId) => services.teamMemoryStore.listInjectionsForDispatch(workspaceId, dispatchId),
+    logMemoryInjections: (input) => services.teamMemoryStore.logInjections(input),
+    rejectMemoryCandidate(workspaceId, memoryId) {
+        const memory = services.teamMemoryStore.rejectCandidate(workspaceId, memoryId);
+        services.teamMemoryExport.schedule(workspaceId);
+        return memory;
+    },
+    searchMemoryEntries: (workspaceId, query, options) => services.teamMemoryStore.searchEntries(workspaceId, query, options),
+    setMemoryDisabled(workspaceId, memoryId, disabled) {
+        const memory = services.teamMemoryStore.setDisabled(workspaceId, memoryId, disabled);
+        services.teamMemoryExport.schedule(workspaceId);
+        return memory;
+    },
+    setMemoryPinned(workspaceId, memoryId, pinned) {
+        const memory = services.teamMemoryStore.setPinned(workspaceId, memoryId, pinned);
+        services.teamMemoryExport.schedule(workspaceId);
+        return memory;
+    },
+});

package/dist/src/server/runtime-store-remote.d.ts

@@ -0,0 +1,5 @@
+import type { RuntimeStore } from './runtime-store-contract.js';
+import type { RuntimeStoreServices } from './runtime-store-helpers.js';
+type RuntimeStoreRemoteMethods = Pick<RuntimeStore, 'authorizeRemoteTunnelRequest' | 'bindRemoteTunnel' | 'confirmRemotePairing' | 'getRemoteAuditStore' | 'getRemoteDeviceSessions' | 'getRemoteDeviceStore' | 'getRemotePairing' | 'getRemoteTunnelSecret' | 'getRemoteTunnelStatus' | 'revokeRemoteDevice' | 'setRemoteEnabled' | 'setRemoteTunnelStatus'>;
+export declare const createRuntimeStoreRemoteMethods: (services: RuntimeStoreServices) => RuntimeStoreRemoteMethods;
+export {};

package/dist/src/server/runtime-store-remote.js

@@ -0,0 +1,45 @@
+import { REMOTE_ENABLED_KEY } from './remote-config-keys.js';
+export const createRuntimeStoreRemoteMethods = (services) => {
+    // Remote tunnel handle (M4). bindRemoteTunnel sets it in hive.ts after the tunnel is constructed;
+    // a runtime that never builds a tunnel leaves it null and the revoke closed loop still rejects new
+    // streams via the persistent provider.
+    let remoteTunnel = null;
+    let remoteTunnelStatus = 'disabled';
+    return {
+        authorizeRemoteTunnelRequest: (request) => services.uiAuth.isTunnelRequest(request),
+        getRemoteTunnelSecret: () => services.uiAuth.getTunnelSecret(),
+        getRemoteAuditStore: () => services.remoteAuditStore,
+        getRemoteDeviceSessions: () => services.remoteDeviceSessions,
+        getRemotePairing: () => services.remotePairing,
+        confirmRemotePairing: async (pairingId, name) => {
+            // D3: the tunnel driver owns the full confirm sequence (local row -> gateway /pair/confirm ->
+            // `confirmed` to the phone). If no tunnel is bound, fall back to local-only confirm.
+            if (remoteTunnel)
+                return remoteTunnel.confirmPairing(pairingId, name);
+            return services.remotePairing.confirmPairing(pairingId, name === undefined ? undefined : { name });
+        },
+        getRemoteDeviceStore: () => services.remoteDeviceStore,
+        getRemoteTunnelStatus: () => remoteTunnelStatus,
+        setRemoteTunnelStatus: (status) => {
+            remoteTunnelStatus = status;
+        },
+        bindRemoteTunnel: (tunnel) => {
+            remoteTunnel = tunnel;
+        },
+        setRemoteEnabled: (enabled) => {
+            services.settings.setAppState(REMOTE_ENABLED_KEY, enabled ? 'true' : 'false');
+            // Reconcile the outbound socket against the new flag. No-op when no tunnel is bound.
+            remoteTunnel?.refresh();
+        },
+        revokeRemoteDevice: (deviceId) => {
+            // (1) Persistent provider drops the session at once; (2) live streams are closed best-effort;
+            // (3) audit one revoke row for actual state changes.
+            const revoked = services.remoteDeviceStore.revoke(deviceId);
+            remoteTunnel?.closeDevice(deviceId, 'revoked');
+            if (revoked) {
+                services.remoteAuditStore.enqueue({ action: 'revoke', deviceId, result: 'ok' });
+            }
+            return revoked;
+        },
+    };
+};