@tt-a1i/hive 2.0.1 → 2.1.0

package/dist/src/server/action-center-summary.js

@@ -0,0 +1,188 @@
+const MAX_RECENT_ACTIVITY = 12;
+const MAX_REMOTE_ATTENTION_SCAN = 25;
+const MAX_REMOTE_ATTENTION_ITEMS = 3;
+const MAX_WAITING_REPORT_ATTENTION_ITEMS = 3;
+const PREVIEW_MAX = 180;
+const TERMINAL_HINT_MAX = 120;
+// A quiet dispatch is surfaced as an FYI, never an alarm: Hive deliberately
+// has no timeout/stall detection (design §3.6 — the user judges a silent
+// worker). Ordinary coding tasks routinely run past any threshold we could
+// pick, so the age is generous and the severity stays at `info`.
+const WAITING_REPORT_MS = 10 * 60 * 1000;
+const truncateText = (text, max) => {
+    if (!text)
+        return null;
+    const normalized = text.replace(/\s+/gu, ' ').trim();
+    if (!normalized)
+        return null;
+    return normalized.length > max ? `${normalized.slice(0, max)}...` : normalized;
+};
+const dispatchTimestamp = (dispatch) => dispatch.reportedAt ?? dispatch.submittedAt ?? dispatch.deliveredAt ?? dispatch.createdAt;
+const dispatchActivityKind = (status) => {
+    if (status === 'reported')
+        return 'reported';
+    if (status === 'cancelled')
+        return 'cancelled';
+    if (status === 'submitted')
+        return 'submitted';
+    return 'queued';
+};
+const workerName = (workersById, workerId) => workersById.get(workerId)?.name ?? null;
+const workspaceIdFromEndpoint = (endpoint) => {
+    const match = endpoint?.match(/^\/api\/(?:ui\/)?workspaces\/([^/?#]+)/u);
+    if (!match?.[1])
+        return null;
+    try {
+        return decodeURIComponent(match[1]);
+    }
+    catch {
+        return match[1];
+    }
+};
+const remoteAuditBelongsToWorkspace = (entry, workspaceId) => {
+    if (entry.workspaceId !== null)
+        return entry.workspaceId === workspaceId;
+    const endpointWorkspaceId = workspaceIdFromEndpoint(entry.endpoint);
+    return endpointWorkspaceId === null || endpointWorkspaceId === workspaceId;
+};
+const waitingForReportAge = (dispatch, now) => {
+    if (dispatch.status !== 'submitted' || dispatch.submittedAt === null)
+        return null;
+    const age = now - dispatch.submittedAt;
+    return age >= WAITING_REPORT_MS ? age : null;
+};
+const buildAttentionItems = (input) => {
+    const attention = [];
+    const workersById = new Map(input.workers.map((worker) => [worker.id, worker]));
+    if (input.workers.length === 0) {
+        attention.push({ kind: 'no_workers', severity: 'info' });
+    }
+    for (const worker of input.workers) {
+        if (worker.status !== 'stopped' || worker.pendingTaskCount <= 0)
+            continue;
+        const openCount = input.openDispatches.filter((dispatch) => dispatch.toAgentId === worker.id).length;
+        attention.push({
+            kind: 'stopped_with_queue',
+            open_dispatches: openCount,
+            pending_task_count: worker.pendingTaskCount,
+            severity: 'warning',
+            worker_id: worker.id,
+            worker_name: worker.name,
+        });
+    }
+    for (const dispatch of input.waitingReportDispatches.slice(0, MAX_WAITING_REPORT_ATTENTION_ITEMS)) {
+        const age = waitingForReportAge(dispatch, input.now);
+        if (age === null)
+            continue;
+        attention.push({
+            dispatch_id: dispatch.id,
+            kind: 'dispatch_waiting_report',
+            minutes_ago: Math.floor(age / 60_000),
+            severity: 'info',
+            submitted_at: dispatch.submittedAt,
+            worker_id: dispatch.toAgentId,
+            worker_name: workerName(workersById, dispatch.toAgentId),
+        });
+    }
+    const remoteProblems = input.store
+        .getRemoteAuditStore()
+        .list(MAX_REMOTE_ATTENTION_SCAN)
+        .filter((entry) => entry.result !== 'ok' && remoteAuditBelongsToWorkspace(entry, input.workspaceId))
+        .slice(0, MAX_REMOTE_ATTENTION_ITEMS);
+    for (const entry of remoteProblems) {
+        attention.push({
+            action: entry.action,
+            endpoint: entry.endpoint,
+            kind: entry.result === 'error' ? 'remote_error' : 'remote_rejected',
+            reason: entry.rejectReason,
+            severity: entry.result === 'error' ? 'error' : 'warning',
+            ts: entry.ts,
+        });
+    }
+    return attention;
+};
+const serializeDispatchEvidence = (dispatch, workersById, includeTextEvidence) => {
+    const textEvidence = includeTextEvidence
+        ? {
+            label: dispatch.label,
+            phase: dispatch.phase,
+            report_preview: truncateText(dispatch.reportText, PREVIEW_MAX),
+            task_preview: truncateText(dispatch.text, PREVIEW_MAX),
+        }
+        : {
+            // Workflow-authored label/phase are task-title-class free text (the
+            // first-party guidance even puts file paths in labels), so the
+            // shareable support bundle reduces them to presence flags.
+            has_label: dispatch.label !== null,
+            has_phase: dispatch.phase !== null,
+        };
+    return {
+        created_at: dispatch.createdAt,
+        id: dispatch.id,
+        ...textEvidence,
+        status: dispatch.status,
+        submitted_at: dispatch.submittedAt,
+        timestamp: dispatchTimestamp(dispatch),
+        to_agent_id: dispatch.toAgentId,
+        to_worker_name: workerName(workersById, dispatch.toAgentId),
+        workflow_run_id: dispatch.workflowRunId,
+    };
+};
+export const buildActionCenterSummary = (input) => {
+    const includeTextEvidence = input.includeTextEvidence !== false;
+    const now = input.now ?? Date.now();
+    const workers = input.store.listWorkers(input.workspaceId);
+    const workersById = new Map(workers.map((worker) => [worker.id, worker]));
+    const openDispatches = input.store.listOpenDispatches(input.workspaceId);
+    const waitingReportDispatches = openDispatches.filter((dispatch) => waitingForReportAge(dispatch, now) !== null);
+    const recentDispatches = input.store.listRecentDispatches(input.workspaceId, MAX_RECENT_ACTIVITY);
+    return {
+        attention: buildAttentionItems({
+            now,
+            openDispatches,
+            store: input.store,
+            waitingReportDispatches,
+            workers,
+            workspaceId: input.workspaceId,
+        }),
+        generated_at: now,
+        recent_activity: recentDispatches.map((dispatch) => ({
+            ...serializeDispatchEvidence(dispatch, workersById, includeTextEvidence),
+            kind: dispatchActivityKind(dispatch.status),
+        })),
+        summary: {
+            idle_workers: workers.filter((worker) => worker.status === 'idle').length,
+            open_dispatches: openDispatches.length,
+            recent_reports: recentDispatches.filter((dispatch) => dispatch.status === 'reported').length,
+            stopped_with_queue: workers.filter((worker) => worker.status === 'stopped' && worker.pendingTaskCount > 0).length,
+            stopped_workers: workers.filter((worker) => worker.status === 'stopped').length,
+            total_workers: workers.length,
+            waiting_reports: waitingReportDispatches.length,
+            working_workers: workers.filter((worker) => worker.status === 'working').length,
+        },
+        workers: workers.map((worker) => {
+            const workerOpenDispatches = openDispatches.filter((dispatch) => dispatch.toAgentId === worker.id);
+            const latestReport = recentDispatches.find((dispatch) => dispatch.toAgentId === worker.id && dispatch.status === 'reported') ?? null;
+            const terminalHint = includeTextEvidence
+                ? {
+                    terminal_hint: truncateText(input.store.getLastPtyLineForAgent(input.workspaceId, worker.id), TERMINAL_HINT_MAX),
+                }
+                : {};
+            return {
+                current_dispatch: workerOpenDispatches[0]
+                    ? serializeDispatchEvidence(workerOpenDispatches[0], workersById, includeTextEvidence)
+                    : null,
+                id: worker.id,
+                latest_report: latestReport
+                    ? serializeDispatchEvidence(latestReport, workersById, includeTextEvidence)
+                    : null,
+                name: worker.name,
+                pending_task_count: worker.pendingTaskCount,
+                role: worker.role,
+                status: worker.status,
+                ...terminalHint,
+            };
+        }),
+        workspace_id: input.workspaceId,
+    };
+};

package/dist/src/server/agent-command-resolver.d.ts

@@ -14,4 +14,10 @@ interface ResolvedSpawnCommand {
 export declare const resolveCommandPath: (command: string, cwd: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform) => string;
 export declare const resolveSpawnCommand: (command: string, cwd: string, env: NodeJS.ProcessEnv, args?: string[], platform?: NodeJS.Platform) => ResolvedSpawnCommand;
 export declare const assertCommandIsExecutable: (command: string, cwd: string, env: NodeJS.ProcessEnv) => void;
+/**
+ * PATH-availability probe shared by Settings preset serialization and
+ * `team spawn` CLI selection. True when `command` resolves to an executable
+ * with the preset's env overlayed on the current process env. Never throws.
+ */
+export declare const isCommandAvailableOnPath: (command: string, env?: Record<string, string>) => boolean;
 export type { ResolvedSpawnCommand };

package/dist/src/server/agent-command-resolver.js

@@ -104,3 +104,19 @@ export const resolveSpawnCommand = (command, cwd, env, args = [], platform = pro
 export const assertCommandIsExecutable = (command, cwd, env) => {
     resolveCommandPath(command, cwd, env);
 };
+/**
+ * PATH-availability probe shared by Settings preset serialization and
+ * `team spawn` CLI selection. True when `command` resolves to an executable
+ * with the preset's env overlayed on the current process env. Never throws.
+ */
+export const isCommandAvailableOnPath = (command, env = {}) => {
+    if (!command.trim())
+        return false;
+    try {
+        resolveCommandPath(command, process.cwd(), { ...process.env, ...env });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};

package/dist/src/server/agent-manager.js

@@ -4,6 +4,15 @@ import { resolveSpawnCommand } from './agent-command-resolver.js';
 import { attachAgentPty, toAgentRunSnapshot } from './agent-manager-support.js';
 import { createPtyOutputBus } from './pty-output-bus.js';
 const createRunId = () => randomUUID();
+const CLAUDE_AGENT_SESSION_ENV_KEYS = new Set([
+    'AI_AGENT',
+    'CLAUDECODE',
+    'CLAUDE_CODE_ENTRYPOINT',
+    'CLAUDE_CODE_EXECPATH',
+    'CLAUDE_CODE_SESSION_ID',
+    'CLAUDE_EFFORT',
+]);
+const isClaudeAgentSessionEnvKey = (key, platform) => CLAUDE_AGENT_SESSION_ENV_KEYS.has(platform === 'win32' ? key.toUpperCase() : key);
 const getWindowsEnvKey = (env, key) => {
     if (Object.hasOwn(env, key))
         return key;
@@ -18,7 +27,8 @@ export const createSpawnEnv = (inputEnv, platform = process.platform, parentEnv
         env[targetKey] = value;
     }
     for (const key of Object.keys(env)) {
-        if (env[key] === undefined)
+        // Final spawn boundary: strip outer Claude session identity, not Claude runtime config.
+        if (env[key] === undefined || isClaudeAgentSessionEnvKey(key, platform))
             delete env[key];
     }
     return env;

package/dist/src/server/agent-run-starter.js

@@ -1,9 +1,10 @@
 import { classifyCompletedRunStatus, shouldClearResumedSessionOnExit, } from './agent-exit-classification.js';
 import { buildAgentRunBootstrap, startAgentRunCapture } from './agent-run-bootstrap.js';
 import { handleAgentRunExit } from './agent-run-exit-handler.js';
-import { buildAgentStartupInstructions } from './agent-startup-instructions.js';
+import { buildAgentStartupInstructions, buildWorkflowAgentStartupInstructions, } from './agent-startup-instructions.js';
 import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { createPostStartInputWriter, isInteractiveAgentCommand } from './post-start-input-writer.js';
+import { isResumeLaunchConfig } from './preset-launch-support.js';
 import { buildMemoryDigestSafely, logMemoryDigestInjection, rollbackMemoryDigestInjection, } from './team-memory-injection.js';
 export const createAgentRunStarter = ({ agentManager, registry, onAgentExit, store, sessionStore, tokenRegistry, getCommandPreset, getAgent, restartPolicy, getFlags, memoryInjection, }) => async (workspace, agentId, config, hivePort) => {
     if (!agentManager)
@@ -57,9 +58,21 @@ export const createAgentRunStarter = ({ agentManager, registry, onAgentExit, sto
         tokenRegistry.revokeIfMatches(agentId, token);
         throw error;
     }
+    let markPostStartInputReady = () => { };
+    const postStartInputReady = new Promise((resolve) => {
+        markPostStartInputReady = resolve;
+    });
+    let postStartInputReadyMarked = false;
+    const finishPostStartInput = () => {
+        if (postStartInputReadyMarked)
+            return;
+        postStartInputReadyMarked = true;
+        markPostStartInputReady();
+    };
     const liveRun = {
         ...run,
         exitCode: run.status === 'error' ? run.exitCode : null,
+        postStartInputReady,
         startedAt,
         status: run.status === 'error' ? 'error' : 'starting',
     };
@@ -86,6 +99,7 @@ export const createAgentRunStarter = ({ agentManager, registry, onAgentExit, sto
         onAgentExit(workspace.id, agentId);
         registry.resolveExit(run.runId);
         registry.clearPendingExitCode(run.runId);
+        finishPostStartInput();
         return liveRun;
     }
     startAgentRunCapture({
@@ -106,16 +120,38 @@ export const createAgentRunStarter = ({ agentManager, registry, onAgentExit, sto
     const postStartWriter = createPostStartInputWriter(agentManager, startConfig.interactiveCommand ?? startConfig.command);
     queueMicrotask(() => {
         try {
+            let restartWrite = null;
             const injectedRestartMessage = restartPolicy.injectPostStartMessage({
                 agentId,
                 runId: run.runId,
                 startConfig,
                 workspace,
-                writeToRun: postStartWriter,
+                writeToRun: (targetRunId, text) => {
+                    restartWrite = postStartWriter(targetRunId, text);
+                    return restartWrite;
+                },
             });
-            if (!injectedRestartMessage &&
-                agent &&
+            if (injectedRestartMessage) {
+                void (restartWrite ?? Promise.resolve()).catch(() => { }).finally(finishPostStartInput);
+                return;
+            }
+            if (isResumeLaunchConfig(startConfig)) {
+                finishPostStartInput();
+                return;
+            }
+            if (agent &&
                 isInteractiveAgentCommand(startConfig.interactiveCommand ?? startConfig.command)) {
+                if (agent.spawnedBy === 'workflow') {
+                    void postStartWriter(run.runId, buildWorkflowAgentStartupInstructions({
+                        agent,
+                        workspace,
+                    }))
+                        .catch(() => {
+                        // The agent may have exited before post-start guidance could be written.
+                    })
+                        .finally(finishPostStartInput);
+                    return;
+                }
                 const memoryDigest = buildMemoryDigestSafely({
                     contextType: 'startup',
                     memoryInjection,
@@ -134,13 +170,18 @@ export const createAgentRunStarter = ({ agentManager, registry, onAgentExit, sto
                     memoryDigest: auditedMemoryDigest?.text,
                     workspace,
                     flags: getFlags?.() ?? FEATURE_FLAGS_ALL_OFF,
-                })).catch(() => {
+                }))
+                    .catch(() => {
                     rollbackMemoryDigestInjection({ injectionIds, memoryInjection });
                     // The agent may have exited before post-start guidance could be written.
-                });
+                })
+                    .finally(finishPostStartInput);
+                return;
             }
+            finishPostStartInput();
         }
         catch {
+            finishPostStartInput();
             // The agent may have exited before post-start guidance could be written.
         }
     });

package/dist/src/server/agent-runtime-types.d.ts

@@ -1,5 +1,9 @@
 import type { AgentRunSnapshot } from './agent-manager.js';
 export interface LiveAgentRun extends AgentRunSnapshot {
+    /** Resolves after the startup / recovery input queued right after PTY start
+     *  has either been written or intentionally skipped. Workflow workers use
+     *  this to avoid racing their first dispatch ahead of startup instructions. */
+    postStartInputReady?: Promise<void>;
     startedAt: number;
     userStopped?: boolean;
 }

package/dist/src/server/agent-startup-instructions.d.ts

@@ -18,3 +18,7 @@ export declare const buildAgentStartupInstructions: ({ agent, memoryDigest, work
      *  team-sizing rule. Omitted → all off. */
     flags?: FeatureFlags;
 }) => string;
+export declare const buildWorkflowAgentStartupInstructions: ({ agent, workspace, }: {
+    agent: AgentSummary;
+    workspace: WorkspaceSummary;
+}) => string;

package/dist/src/server/agent-startup-instructions.js

@@ -1,37 +1,63 @@
 import { BUILTIN_COMMAND_PRESET_CLI_LIST } from './command-preset-defaults.js';
 import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
+import { escapeHiveEnvelopeText } from './hive-envelope-escape.js';
 import { getHiveTeamRules } from './hive-team-guidance.js';
 import { TASKS_RELATIVE_PATH } from './tasks-file.js';
 export const buildAgentSessionBindingMarker = ({ agent, workspace, }) => `Hive session binding: workspace_id=${workspace.id}; agent_id=${agent.id}`;
-export const buildAgentLegacyIdentityMarker = ({ agent, workspace, }) => `You are ${agent.name} (${agent.role}) in workspace ${workspace.name}.`;
+export const buildAgentLegacyIdentityMarker = ({ agent, workspace, }) => `You are ${escapeHiveEnvelopeText(agent.name)} (${agent.role}) in workspace ${escapeHiveEnvelopeText(workspace.name)}.`;
 export const buildAgentStartupInstructions = ({ agent, memoryDigest, workspace, flags = FEATURE_FLAGS_ALL_OFF, }) => {
     const { workflowsEnabled } = flags;
     const lines = [
         '<hive-message kind="startup">',
         '',
         buildAgentLegacyIdentityMarker({ agent, workspace }),
-        `Current workspace: ${workspace.name}`,
-        `Project path: ${workspace.path}`,
+        `Current workspace: ${escapeHiveEnvelopeText(workspace.name)}`,
+        `Project path: ${escapeHiveEnvelopeText(workspace.path)}`,
         buildAgentSessionBindingMarker({ agent, workspace }),
         '',
-        // agent.description is the role contract — it follows the user's chosen
-        // language / custom edit and is intentionally left as authored.
-        `Your role: ${agent.description}`,
+        // agent.description follows the user's chosen language / custom edit, but
+        // still travels inside a Hive envelope, so XML-like delimiters are escaped.
+        `Your role: ${escapeHiveEnvelopeText(agent.description)}`,
         '',
     ];
     if (memoryDigest) {
         lines.push(memoryDigest, '');
     }
     if (agent.role === 'orchestrator') {
-        lines.push('Your responsibilities:', '- Respond to the user directly; clarify the goal and break it into dispatchable tasks', `- Maintain ${TASKS_RELATIVE_PATH}`, '- Dispatch by worker name and drive the next step from each report', '', 'Available team commands:', '- team list', '- team recall "<query>" [--limit <n>] [--window <n>]', '- team memory add "<body>" [--kind fact|preference|decision|pitfall|procedure_ref] [--tag <tag>]', '- team memory show <memory-id>', '- team memory search "<query>" [--limit <n>]', '- team memory forget <memory-id>', '- team send "<worker-name>" "<task>"', `- team spawn <role> [--name <n>] [--cli <${BUILTIN_COMMAND_PRESET_CLI_LIST}>] [--ephemeral]`, '- team cancel --dispatch <id> "<reason>"', ...(workflowsEnabled
+        lines.push('Your responsibilities:', '- Respond to the user directly; clarify the goal and break it into dispatchable tasks', `- Maintain ${TASKS_RELATIVE_PATH} (GFM task list; mark dependencies with a trailing \`[needs: #2, #5]\` — 1-based positions; \`team next\` lists the tasks unblocked right now)`, '- Dispatch by worker name and drive the next step from each report', '', 'Available team commands:', '- team list', '- team next', '- team recall "<query>" [--limit <n>] [--window <n>]', '- team memory add "<body>" [--kind fact|preference|decision|pitfall|procedure_ref] [--tag <tag>]', '- team memory show <memory-id>', '- team memory search "<query>" [--limit <n>]', '- team memory dream show <dream-run-id>', '- team memory apply --run <dream-run-id> --stdin', '- team memory forget <memory-id>', '- team send "<worker-name>" "<task>"', `- team spawn <role> [--name <n>] [--cli <${BUILTIN_COMMAND_PRESET_CLI_LIST}>] [--ephemeral]`, '- team dismiss <worker-name>', '- team cancel --dispatch <id> "<reason>"', ...(workflowsEnabled
             ? [
                 '- team workflow run --stdin   (fan-out / staged work — see .hive/PROTOCOL.md for the DSL)',
             ]
-            : []), '', 'Always dispatch by worker name, never by worker id.', 'Always cancel an open dispatch by its dispatch id.', 'Search memory before adding: use `team memory search "<query>"` to avoid duplicates.', 'Use `team memory add` only for rare, evidence-backed workspace facts/decisions/pitfalls that should help future Hive agents across sessions.', 'Nothing worth saving is a normal outcome; do not add memory just to prove you used it.', 'Use `team memory forget` only to archive obsolete workspace memory; it does not physically delete evidence.', '', 'Hive worker dispatch rules:', ...getHiveTeamRules(agent, flags));
+            : []), '', 'Always dispatch by worker name, never by worker id.', 'Always cancel an open dispatch by its dispatch id.', '', 'Hive worker dispatch rules:', ...getHiveTeamRules(agent, flags));
+    }
+    else if (agent.role === 'sentinel') {
+        // Observe-only role: `team report` is 403'd for sentinels and they never
+        // receive dispatches, so the worker command list (which mandates report)
+        // must not be injected here — list only what the authz matrix allows.
+        lines.push('Available team commands:', '- team status "<finding>" [--artifact <path>]                     escalate a patrol finding to the Orchestrator', '- team status --stdin [--artifact <path>]                         same, body read from stdin', '- team recall "<query>" [--limit <n>] [--window <n>]               search prior team messages/reports in this workspace', '- team memory show <memory-id>                                     inspect a memory entry and its evidence', '- team memory search "<query>" [--limit <n>]                         search active workspace memory', '- team --help                                                     command syntax only', '', 'You observe only: no dispatches are ever assigned to you, and `team report` is not available to your role.', '', 'Hive sentinel boundaries:', ...getHiveTeamRules(agent, flags));
     }
     else {
-        lines.push('Available team commands:', '- team report "<result>" [--dispatch <id>] [--artifact <path>]    report done / failed / blocked', '- team report --stdin [--dispatch <id>] [--artifact <path>]       same, body read from stdin (multi-line / quotes / special chars)', '- team status "<state>" [--artifact <path>]                       mid-task progress / standby / connected status', '- team status --stdin [--artifact <path>]                         same, body read from stdin', '- team recall "<query>" [--limit <n>] [--window <n>]               search prior team messages/reports in this workspace', '- team memory show <memory-id>                                     inspect a memory entry and its evidence', '- team memory search "<query>" [--limit <n>]                         search active workspace memory', '- team list                                                       list the workspace workers (with status)', '- team --help                                                     command syntax only; NOT a way to report', '', 'Syntax notes:', '- The body is the first positional argument; flag order is free: `team report "result" --dispatch X` and `team report --dispatch X "result"` are both valid.', "- Long bodies (multi-line / quotes / shell metacharacters) always go through `--stdin`, piped in via your shell (POSIX: a quoted heredoc `<<'EOF' … EOF` to stop $var / backtick expansion; Windows cmd: `type body.txt |` or `< body.txt`; PowerShell: `Get-Content -Raw -Encoding utf8 body.txt |`). `--stdin` only reads from stdin and relies on no shell syntax of its own.", '- On error the CLI also prints USAGE — fix the arguments against it.', '', 'When a task is done you MUST run `team report "<result>"`.', 'Failure, blocked, or partial completion are also reported with `team report "<current state and reason>"`.', 'When no task is in progress, report connection / standby / blocked state with `team status "<state>"`.', 'Use `team recall "<query>"` when prior team messages or reports may contain useful evidence.', 'Use `team memory search "<query>"` to look up active durable workspace memory.', 'Include durable findings in `team report`; workers cannot add or forget memory.', 'Do not call team send; workers cannot dispatch to each other.', '', 'Hive worker boundaries:', ...getHiveTeamRules(agent, flags));
+        lines.push('Available team commands:', '- team report "<result>" [--dispatch <id>] [--artifact <path>]    report done / failed / blocked', '- team report --stdin [--dispatch <id>] [--artifact <path>]       same, body read from stdin (multi-line / quotes / special chars)', '- team status "<state>" [--artifact <path>]                       progress / standby update at any time; never closes a dispatch', '- team status --stdin [--artifact <path>]                         same, body read from stdin', '- team recall "<query>" [--limit <n>] [--window <n>]               search prior team messages/reports in this workspace', '- team memory show <memory-id>                                     inspect a memory entry and its evidence', '- team memory search "<query>" [--limit <n>]                         search active workspace memory', '- team memory dream show <dream-run-id>                            inspect a pending Dream run only when the Orchestrator assigns memory review', '- team --help                                                     command syntax only; NOT a way to report', '', 'Syntax notes:', '- The body is the first positional argument; flag order is free: `team report "result" --dispatch X` and `team report --dispatch X "result"` are both valid.', "- Long bodies (multi-line / quotes / shell metacharacters) always go through `--stdin`, piped in via your shell (POSIX: a quoted heredoc `<<'EOF' … EOF` to stop $var / backtick expansion; Windows cmd: `type body.txt |` or `< body.txt`; PowerShell: `Get-Content -Raw -Encoding utf8 body.txt |`). `--stdin` only reads from stdin and relies on no shell syntax of its own.", '- On error the CLI also prints USAGE — fix the arguments against it.', '', 'Hive worker boundaries:', ...getHiveTeamRules(agent, flags));
     }
     lines.push('', '</hive-message>', '');
     return lines.join('\n');
 };
+export const buildWorkflowAgentStartupInstructions = ({ agent, workspace, }) => [
+    '<hive-message kind="startup">',
+    '',
+    buildAgentLegacyIdentityMarker({ agent, workspace }),
+    `Current workspace: ${escapeHiveEnvelopeText(workspace.name)}`,
+    `Project path: ${escapeHiveEnvelopeText(workspace.path)}`,
+    buildAgentSessionBindingMarker({ agent, workspace }),
+    '',
+    `Your role: ${escapeHiveEnvelopeText(agent.description)}`,
+    '',
+    'You are a one-shot Hive workflow worker. Finish only the dispatch that follows this startup message.',
+    'Do not launch nested CLI subagents or workflow runners; do the work in this PTY.',
+    'All workflow workers share the same workspace filesystem root. Stay inside the dispatch scope you receive; do not edit unrelated files or assume isolated worktrees.',
+    'The user talks to the Orchestrator, not to you. Never wait for terminal input — if blocked or missing information, report the blocker with `team report`.',
+    'Do not call `team send` or `team workflow`. When done, use the `team report ... --dispatch <id>` syntax from the dispatch message.',
+    '',
+    '</hive-message>',
+    '',
+].join('\n');

package/dist/src/server/agent-stdin-dispatcher.js

@@ -1,49 +1,57 @@
 import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
+import { escapeHiveEnvelopeAttribute, escapeHiveEnvelopeText } from './hive-envelope-escape.js';
 import { buildOrchestratorReminderTail, buildWorkerReminderTail } from './hive-team-guidance.js';
 import { PtyInactiveError } from './http-errors.js';
 import { createPostStartInputWriter } from './post-start-input-writer.js';
 import { buildDispatchMemoryDigestSafely, logMemoryDigestInjection, rollbackMemoryDigestInjection, } from './team-memory-injection.js';
 export const buildOrchestratorReportPayload = (workerName, text, artifacts, flags = FEATURE_FLAGS_ALL_OFF) => {
-    const lines = [`<hive-message kind="report" from="@${workerName}">`, text];
+    const lines = [
+        `<hive-message kind="report" from="@${escapeHiveEnvelopeAttribute(workerName)}">`,
+        escapeHiveEnvelopeText(text),
+    ];
     for (const artifact of artifacts)
-        lines.push(`artifact: ${artifact}`);
+        lines.push(`artifact: ${escapeHiveEnvelopeText(artifact)}`);
     lines.push('</hive-message>', '', buildOrchestratorReminderTail(flags), '');
     return lines.join('\n');
 };
 export const buildOrchestratorStatusPayload = (workerName, text, artifacts, flags = FEATURE_FLAGS_ALL_OFF) => {
-    const lines = [`<hive-message kind="status" from="@${workerName}">`, text];
+    const lines = [
+        `<hive-message kind="status" from="@${escapeHiveEnvelopeAttribute(workerName)}">`,
+        escapeHiveEnvelopeText(text),
+    ];
     for (const artifact of artifacts)
-        lines.push(`artifact: ${artifact}`);
+        lines.push(`artifact: ${escapeHiveEnvelopeText(artifact)}`);
     lines.push('</hive-message>', '', buildOrchestratorReminderTail(flags), '');
     return lines.join('\n');
 };
 export const buildOrchestratorUserInputPayload = (text, flags = FEATURE_FLAGS_ALL_OFF) => [text, '', buildOrchestratorReminderTail(flags), ''].join('\n');
 export const buildWorkerDispatchPayload = (fromAgentName, workerDescription, dispatchId, text, memoryDigest) => [
-    `<hive-message kind="dispatch" from="@${fromAgentName}">`,
+    `<hive-message kind="dispatch" from="@${escapeHiveEnvelopeAttribute(fromAgentName)}">`,
     '',
-    `Your role: ${workerDescription}`,
+    `Your role: ${escapeHiveEnvelopeText(workerDescription)}`,
     '',
     'You must:',
     `- When the task is done, failed, blocked, or partially done, run \`team report "<result>" --dispatch ${dispatchId}\``,
     '- Do not do unrelated work; report as soon as you are done',
+    '- Never stop to wait for terminal input — if you need a decision, report the question as blocked instead',
     '',
     `dispatch_id: ${dispatchId}`,
     '',
     ...(memoryDigest ? [memoryDigest, ''] : []),
     'Task:',
-    text,
+    escapeHiveEnvelopeText(text),
     '</hive-message>',
     '',
     buildWorkerReminderTail(dispatchId),
     '',
 ].join('\n');
 export const buildWorkerCancelPayload = (dispatchId, reason) => [
-    `<hive-message kind="cancel" dispatch="${dispatchId}">`,
+    `<hive-message kind="cancel" dispatch="${escapeHiveEnvelopeAttribute(dispatchId)}">`,
     '',
     'Stop working on this dispatch and do not call team report for it.',
     '',
     'Cancellation reason:',
-    reason,
+    escapeHiveEnvelopeText(reason),
     '</hive-message>',
     '',
 ].join('\n');