hivehq 2.0.0

package/dist/src/server/routes-team-memory.js

@@ -0,0 +1,154 @@
+import { isMemoryKind, MEMORY_BODY_MAX_CHARS, MEMORY_KINDS, MEMORY_QUERY_MAX_CHARS, MEMORY_SEARCH_MAX_LIMIT, MEMORY_TAG_MAX_CHARS, MEMORY_TAG_MAX_COUNT, } from '../shared/team-memory.js';
+import { BadRequestError } from './http-errors.js';
+import { readJsonBody, route, sendJson } from './route-helpers.js';
+import { authenticateCliAgent, requireCommandForRole } from './team-authz.js';
+import { serializeMemoryEntry, serializeMemorySearchResult, } from './team-memory-http-serializers.js';
+import { MemoryEntryStatusError } from './team-memory-store.js';
+const requireNonEmptyString = (value, field) => {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new BadRequestError(`Missing ${field}`);
+    }
+    return value.trim();
+};
+const requireMemoryBody = (value) => {
+    const body = requireNonEmptyString(value, 'body');
+    if ([...body].length > MEMORY_BODY_MAX_CHARS) {
+        throw new BadRequestError(`body must be ${MEMORY_BODY_MAX_CHARS} characters or fewer`);
+    }
+    return body;
+};
+const requireMemoryQuery = (value) => {
+    const query = requireNonEmptyString(value, 'query');
+    if ([...query].length > MEMORY_QUERY_MAX_CHARS) {
+        throw new BadRequestError(`query must be ${MEMORY_QUERY_MAX_CHARS} characters or fewer`);
+    }
+    return query;
+};
+const parseLimit = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+        throw new BadRequestError('limit must be a non-negative integer');
+    }
+    return Math.min(value, MEMORY_SEARCH_MAX_LIMIT);
+};
+const parseKind = (value) => {
+    if (value === undefined)
+        return 'fact';
+    if (!isMemoryKind(value)) {
+        throw new BadRequestError(`kind must be one of: ${MEMORY_KINDS.join(', ')}`);
+    }
+    return value;
+};
+const parseTags = (value) => {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new BadRequestError('tags must be an array of strings');
+    }
+    if (value.length > MEMORY_TAG_MAX_COUNT) {
+        throw new BadRequestError(`tags must contain ${MEMORY_TAG_MAX_COUNT} items or fewer`);
+    }
+    const tags = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || item.trim().length === 0) {
+            throw new BadRequestError('tags must be non-empty strings');
+        }
+        const tag = item.trim();
+        if ([...tag].length > MEMORY_TAG_MAX_CHARS) {
+            throw new BadRequestError(`tags must be ${MEMORY_TAG_MAX_CHARS} characters or fewer`);
+        }
+        if (!tags.includes(tag))
+            tags.push(tag);
+    }
+    return tags;
+};
+const authenticateMemoryRequest = (body, store) => {
+    const workspaceId = requireNonEmptyString(body.project_id, 'project_id');
+    const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+    const token = typeof body.token === 'string' ? body.token : undefined;
+    const agent = authenticateCliAgent({
+        fromAgentId,
+        getAgent: store.getAgent,
+        token,
+        validateToken: store.validateAgentToken,
+        workspaceId,
+    });
+    return { agent, workspaceId };
+};
+export const teamMemoryRoutes = [
+    route('POST', '/api/team/memory/add', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const { agent, workspaceId } = authenticateMemoryRequest(body, store);
+        requireCommandForRole(agent, 'memory_add');
+        const memory = store.addMemoryEntry({
+            actor: {
+                id: agent.id,
+                name: agent.name,
+                role: agent.role,
+            },
+            body: requireMemoryBody(body.body),
+            kind: parseKind(body.kind),
+            tags: parseTags(body.tags),
+            workspaceId,
+        });
+        sendJson(response, 200, {
+            memory: serializeMemoryEntry(memory),
+            ok: true,
+        });
+    }),
+    route('POST', '/api/team/memory/show', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const { agent, workspaceId } = authenticateMemoryRequest(body, store);
+        requireCommandForRole(agent, 'memory_show');
+        const memoryId = requireNonEmptyString(body.memory_id, 'memory_id');
+        const memory = store.getMemoryEntry(workspaceId, memoryId);
+        if (!memory) {
+            sendJson(response, 404, { error: `Memory entry not found: ${memoryId}` });
+            return;
+        }
+        sendJson(response, 200, {
+            memory: serializeMemoryEntry(memory),
+            ok: true,
+        });
+    }),
+    route('POST', '/api/team/memory/search', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const { agent, workspaceId } = authenticateMemoryRequest(body, store);
+        requireCommandForRole(agent, 'memory_search');
+        const limit = parseLimit(body.limit);
+        const results = store.searchMemoryEntries(workspaceId, requireMemoryQuery(body.query), {
+            ...(limit !== undefined ? { limit } : {}),
+        });
+        sendJson(response, 200, {
+            ok: true,
+            results: results.map(serializeMemorySearchResult),
+        });
+    }),
+    route('POST', '/api/team/memory/forget', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const { agent, workspaceId } = authenticateMemoryRequest(body, store);
+        requireCommandForRole(agent, 'memory_forget');
+        const memoryId = requireNonEmptyString(body.memory_id, 'memory_id');
+        const memory = store.getMemoryEntry(workspaceId, memoryId);
+        if (!memory) {
+            sendJson(response, 404, { error: `Memory entry not found: ${memoryId}` });
+            return;
+        }
+        try {
+            sendJson(response, 200, {
+                memory: serializeMemoryEntry(store.archiveMemoryEntry(workspaceId, memoryId)),
+                ok: true,
+            });
+        }
+        catch (error) {
+            if (error instanceof MemoryEntryStatusError) {
+                sendJson(response, 409, {
+                    error: `Memory entry has status ${error.actualStatus}; expected active`,
+                });
+                return;
+            }
+            throw error;
+        }
+    }),
+];

package/dist/src/server/routes-team-recall.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDefinition } from './route-types.js';
+export declare const teamRecallRoutes: RouteDefinition[];

package/dist/src/server/routes-team-recall.js

@@ -0,0 +1,119 @@
+import { RECALL_QUERY_MAX_CHARS } from '../shared/team-recall.js';
+import { BadRequestError } from './http-errors.js';
+import { readJsonBody, route, sendJson } from './route-helpers.js';
+import { authenticateCliAgent, requireCommandForRole } from './team-authz.js';
+const DEFAULT_RECALL_LIMIT = 10;
+const requireNonEmptyString = (value, field) => {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new BadRequestError(`Missing ${field}`);
+    }
+    const trimmed = value.trim();
+    if (field === 'query' && [...trimmed].length > RECALL_QUERY_MAX_CHARS) {
+        throw new BadRequestError(`query must be ${RECALL_QUERY_MAX_CHARS} characters or fewer`);
+    }
+    return trimmed;
+};
+const optionalNonNegativeInteger = (value, field) => {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isInteger(value) || Number(value) < 0) {
+        throw new BadRequestError(`${field} must be a non-negative integer`);
+    }
+    return Number(value);
+};
+const serializeContext = (item) => ({
+    created_at: item.createdAt,
+    from_agent_id: item.fromAgentId,
+    source_sequence: item.sourceSequence,
+    text: item.text,
+    to_agent_id: item.toAgentId,
+    type: item.type,
+    worker_id: item.workerId,
+});
+const serializeRecallResult = (result) => ({
+    context: result.context.map(serializeContext),
+    created_at: result.createdAt,
+    dispatch_id: result.dispatchId,
+    dispatch_status: result.dispatchStatus,
+    from_agent_id: result.fromAgentId,
+    index_name: result.indexName,
+    memory_confidence: result.memoryConfidence ?? null,
+    memory_id: result.memoryId ?? null,
+    memory_kind: result.memoryKind ?? null,
+    memory_status: result.memoryStatus ?? null,
+    memory_tags: result.memoryTags ?? [],
+    message_type: result.messageType,
+    report_text: result.reportText,
+    score: result.score,
+    source_sequence: result.sourceSequence,
+    source_type: result.sourceType,
+    text: result.text,
+    to_agent_id: result.toAgentId,
+    worker_id: result.workerId,
+});
+const memoryToRecallResult = (memory) => ({
+    context: memory.sources.map((source) => ({
+        createdAt: source.createdAt,
+        fromAgentId: source.actorAgentIdSnapshot,
+        sourceSequence: source.sourceSequence ?? 0,
+        text: source.excerpt ?? '',
+        toAgentId: null,
+        type: source.sourceType,
+        workerId: source.actorAgentIdSnapshot ?? '',
+    })),
+    createdAt: memory.updatedAt,
+    dispatchId: null,
+    dispatchStatus: null,
+    fromAgentId: null,
+    indexName: memory.indexName,
+    memoryConfidence: memory.confidence,
+    memoryId: memory.id,
+    memoryKind: memory.kind,
+    memoryStatus: memory.status,
+    memoryTags: memory.tags,
+    messageType: null,
+    reportText: null,
+    score: memory.score,
+    sourceSequence: 0,
+    sourceType: 'memory',
+    text: memory.body,
+    toAgentId: null,
+    workerId: null,
+});
+export const teamRecallRoutes = [
+    route('POST', '/api/team/recall', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const query = requireNonEmptyString(body.query, 'query');
+        const token = typeof body.token === 'string' ? body.token : undefined;
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'recall');
+        const limit = optionalNonNegativeInteger(body.limit, 'limit');
+        const window = optionalNonNegativeInteger(body.window, 'window');
+        const recallResults = store.recallMessages(projectId, query, {
+            ...(limit !== undefined ? { limit } : {}),
+            ...(window !== undefined ? { window } : {}),
+        });
+        const memoryResults = store
+            .searchMemoryEntries(projectId, query, {
+            ...(limit !== undefined ? { limit } : {}),
+            statuses: ['active'],
+        })
+            .map(memoryToRecallResult);
+        const combined = [...recallResults, ...memoryResults]
+            .sort((a, b) => a.score - b.score || b.createdAt - a.createdAt)
+            .slice(0, limit ?? DEFAULT_RECALL_LIMIT);
+        sendJson(response, 200, {
+            ok: true,
+            query,
+            results: combined.map(serializeRecallResult),
+        });
+    }),
+];

package/dist/src/server/routes-team.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDefinition } from './route-types.js';
+export declare const teamRoutes: RouteDefinition[];

package/dist/src/server/routes-team.js

@@ -0,0 +1,351 @@
+import { randomUUID } from 'node:crypto';
+import { resolveCommandPresetLaunchConfig } from './agent-launch-resolver.js';
+import { validateCronNextRunAt } from './cron-util.js';
+import { BadRequestError, ForbiddenError } from './http-errors.js';
+import { readJsonBody, route, sendJson } from './route-helpers.js';
+import { authenticateCliAgent, requireCommandForRole } from './team-authz.js';
+import { readWorkflowEnabled, WORKFLOW_ENABLED_KEY } from './workflow-feature.js';
+const WORKER_ROLES = new Set(['coder', 'reviewer', 'tester', 'custom']);
+const toWorkerRole = (value) => value && WORKER_ROLES.has(value) ? value : 'coder';
+// Experimental gate: `team workflow run` / `team workflow schedule` only work
+// when the user has enabled workflows in Settings. Off by default. The PTY
+// runner itself isn't gated (internal API + the scheduler gate handle that) —
+// this is the agent-facing entry point, so the orchestrator gets a clear,
+// actionable error instead of a silent no-op.
+const requireWorkflowsEnabled = (store) => {
+    if (!readWorkflowEnabled(store.settings.getAppState(WORKFLOW_ENABLED_KEY)?.value ?? null)) {
+        throw new ForbiddenError('Workflows are an experimental Hive feature and are currently disabled. ' +
+            'Enable them in Hive Settings (the gear menu, top-right) to use `team workflow`. ' +
+            'Until then, dispatch work with `team send`.');
+    }
+};
+const requireNonEmptyString = (value, field) => {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new BadRequestError(`Missing ${field}`);
+    }
+    return value;
+};
+const getArtifacts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+const REPORT_STATUSES = new Set(['success', 'failed']);
+const getReportStatus = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || !REPORT_STATUSES.has(value)) {
+        throw new BadRequestError('Invalid status; expected success or failed');
+    }
+    return value;
+};
+export const teamRoutes = [
+    route('POST', '/api/team/send', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const to = requireNonEmptyString(body.to, 'to');
+        const text = requireNonEmptyString(body.text, 'text');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'send');
+        const dispatch = await store.dispatchTaskByWorkerName(projectId, to, text, {
+            autoStartWorker: false,
+            fromAgentId,
+            hivePort: String(request.socket.localPort ?? ''),
+        });
+        /* The user-facing team send route queues work for stopped workers without
+           auto-starting them; internal workflow dispatches may still surface
+           restarted_worker when they intentionally wake a worker. */
+        sendJson(response, 202, {
+            dispatch_id: dispatch.id,
+            ok: true,
+            restarted_worker: dispatch.restartedWorker,
+        });
+    }),
+    route('POST', '/api/team/spawn', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'spawn');
+        const role = toWorkerRole(body.role);
+        const name = typeof body.name === 'string' && body.name.trim().length > 0
+            ? body.name.trim()
+            : `${role}-${randomUUID()}`;
+        const launchConfig = (body.cli ? resolveCommandPresetLaunchConfig(store.settings, body.cli) : undefined) ??
+            { command: body.cli ?? 'claude', args: [] };
+        // M11: default is persistent (acts like a normal member); --ephemeral
+        // opts into auto-dismiss-after-first-report (mirrors workflow workers,
+        // but orchestrator-spawned). Existing M1-D cascade-on-orchestrator-exit
+        // still applies to whatever ephemeral workers remain.
+        const ephemeral = body.ephemeral === true;
+        const workerInput = ephemeral
+            ? { name, role, ephemeral: true, spawnedBy: 'orchestrator' }
+            : { name, role };
+        const worker = store.addWorkerWithLaunch(projectId, workerInput, launchConfig);
+        sendJson(response, 201, {
+            name: worker.name,
+            ok: true,
+            worker_id: worker.id,
+            ephemeral,
+        });
+    }),
+    route('POST', '/api/team/workflow/run', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const source = requireNonEmptyString(body.source, 'source');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'workflow');
+        // Feature gate AFTER auth so an unauthenticated caller gets 401/400, not a
+        // 403 that leaks whether the experiment is on.
+        requireWorkflowsEnabled(store);
+        const hivePort = String(request.socket.localPort ?? '');
+        const input = {
+            workspaceId: projectId,
+            source,
+            hivePort,
+            triggeredByAgentId: fromAgentId,
+            ...(body.args !== undefined ? { args: body.args } : {}),
+            ...(typeof body.name === 'string' && body.name.trim()
+                ? { scriptPath: `<inline:${body.name.trim()}>` }
+                : {}),
+        };
+        const run = await store.startWorkflowInline(input);
+        sendJson(response, 202, { ok: true, run_id: run.id, name: run.name, status: run.status });
+    }),
+    /* Agent-initiated scheduling. Workflows are authored by the orchestrator,
+       not picked from a human script library — so registering a recurring run
+       is also an agent action: the orchestrator passes the workflow source +
+       a cron, and the runtime persists the source (so cron can fire it with no
+       orchestrator in the loop) and registers the schedule. The UI only
+       lists / pauses / deletes schedules; it cannot create them. */
+    route('POST', '/api/team/workflow/schedule', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const source = requireNonEmptyString(body.source, 'source');
+        const name = requireNonEmptyString(body.name, 'name');
+        const cron = requireNonEmptyString(body.cron, 'cron');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'workflow');
+        // Feature gate AFTER auth (see /run above).
+        requireWorkflowsEnabled(store);
+        const nextRunAt = validateCronNextRunAt(cron);
+        const schedule = await store.scheduleWorkflowInline({
+            workspaceId: projectId,
+            source,
+            name,
+            cron,
+            nextRunAt,
+            ...(body.args !== undefined ? { args: body.args } : {}),
+        });
+        sendJson(response, 201, {
+            ok: true,
+            schedule_id: schedule.id,
+            script_path: schedule.scriptPath,
+            cron: schedule.cron,
+            next_run_at: schedule.nextRunAt,
+        });
+    }),
+    route('POST', '/api/team/workflow/stop', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const runId = requireNonEmptyString(body.run_id, 'run_id');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'workflow');
+        const stopped = store.stopWorkflowRun(runId);
+        sendJson(response, stopped ? 202 : 409, { ok: stopped, run_id: runId });
+    }),
+    /* TIER 1 #6 — per-agent transcript dump. The completion reminder injected
+       into the orchestrator's stdin promised this command but it never
+       existed, so any orchestrator that followed the suggestion got a
+       usage error. Returns the run record + the full per-dispatch detail
+       (step / phase / label / prompt / status / report text) so the
+       orchestrator can read past the 200-char per-step summary cap in the
+       reminder. */
+    route('POST', '/api/team/workflow/show', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const runId = requireNonEmptyString(body.run_id, 'run_id');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'workflow');
+        const run = store.getWorkflowRun(runId);
+        if (!run || run.workspaceId !== projectId) {
+            sendJson(response, 404, { error: `Workflow run not found: ${runId}` });
+            return;
+        }
+        const dispatches = store.listWorkflowRunDispatches(runId).map((d) => ({
+            step_index: d.stepIndex,
+            phase: d.phase,
+            label: d.label,
+            to_agent_id: d.toAgentId,
+            status: d.status,
+            text: d.text,
+            report_text: d.reportText,
+            submitted_at: d.submittedAt,
+            reported_at: d.reportedAt,
+        }));
+        sendJson(response, 200, {
+            ok: true,
+            run: {
+                id: run.id,
+                name: run.name,
+                status: run.status,
+                phase: run.phase,
+                started_at: run.startedAt,
+                finished_at: run.finishedAt,
+                error: run.error,
+                result: run.result,
+            },
+            dispatches,
+        });
+    }),
+    route('POST', '/api/team/dismiss', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const name = requireNonEmptyString(body.name, 'name');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'dismiss');
+        const worker = store.listWorkers(projectId).find((item) => item.name === name);
+        if (!worker) {
+            sendJson(response, 404, { error: `No such worker: ${name}` });
+            return;
+        }
+        store.deleteWorker(projectId, worker.id);
+        sendJson(response, 200, { ok: true });
+    }),
+    route('POST', '/api/team/cancel', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const dispatchId = requireNonEmptyString(body.dispatch_id, 'dispatch_id');
+        const reason = requireNonEmptyString(body.reason, 'reason');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'cancel');
+        const result = store.cancelTask(projectId, dispatchId, { fromAgentId, reason });
+        sendJson(response, 202, {
+            dispatch_id: result.dispatch?.id ?? null,
+            forward_error: result.forwardError,
+            forwarded: result.forwarded,
+            ok: true,
+        });
+    }),
+    route('POST', '/api/team/report', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const resultText = requireNonEmptyString(body.result, 'result');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'report');
+        const reportInput = {
+            artifacts: getArtifacts(body.artifacts),
+            ...(typeof body.dispatch_id === 'string' ? { dispatchId: body.dispatch_id } : {}),
+            requireActiveRun: true,
+            text: resultText,
+        };
+        const status = getReportStatus(body.status);
+        if (status !== undefined) {
+            const result = store.reportTask(projectId, fromAgentId, {
+                ...reportInput,
+                status,
+            });
+            sendJson(response, 202, {
+                dispatch_id: result.dispatch?.id ?? null,
+                forward_error: result.forwardError,
+                forwarded: result.forwarded,
+                ok: true,
+            });
+            return;
+        }
+        else {
+            const result = store.reportTask(projectId, fromAgentId, reportInput);
+            sendJson(response, 202, {
+                dispatch_id: result.dispatch?.id ?? null,
+                forward_error: result.forwardError,
+                forwarded: result.forwarded,
+                ok: true,
+            });
+            return;
+        }
+    }),
+    route('POST', '/api/team/status', async ({ request, response, store }) => {
+        const body = await readJsonBody(request);
+        const projectId = requireNonEmptyString(body.project_id, 'project_id');
+        const fromAgentId = requireNonEmptyString(body.from_agent_id, 'from_agent_id');
+        const resultText = requireNonEmptyString(body.result, 'result');
+        const agent = authenticateCliAgent({
+            fromAgentId,
+            getAgent: store.getAgent,
+            token: body.token,
+            validateToken: store.validateAgentToken,
+            workspaceId: projectId,
+        });
+        requireCommandForRole(agent, 'status');
+        const result = store.statusTask(projectId, fromAgentId, {
+            artifacts: getArtifacts(body.artifacts),
+            requireActiveRun: true,
+            text: resultText,
+        });
+        sendJson(response, 202, {
+            dispatch_id: result.dispatch?.id ?? null,
+            forward_error: result.forwardError,
+            forwarded: result.forwarded,
+            ok: true,
+        });
+        return;
+    }),
+];

package/dist/src/server/routes-ui.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDefinition } from './route-types.js';
+export declare const uiRoutes: RouteDefinition[];

package/dist/src/server/routes-ui.js

@@ -0,0 +1,17 @@
+import { ForbiddenError } from './http-errors.js';
+import { route, sendJson } from './route-helpers.js';
+export const uiRoutes = [
+    route('GET', '/api/ui/session', ({ request, response, store }) => {
+        // HARDEN (defense in depth, layer 3): this route mints the master
+        // hive_ui_token cookie, the single credential for every /api/* route + WS
+        // upgrade. The bridge whitelist already hard-denies /api/ui/session, but if
+        // that ever regresses, a tunnel-tagged request must STILL never mint a
+        // cookie for a remote device. The tunnel is authorized by the per-boot
+        // secret, so it has zero need for the UI cookie — refuse it outright.
+        if (store.authorizeRemoteTunnelRequest(request)) {
+            throw new ForbiddenError('UI session cookie is not available over the remote tunnel');
+        }
+        response.setHeader('set-cookie', `hive_ui_token=${store.getUiToken()}; Path=/; HttpOnly; SameSite=Strict`);
+        sendJson(response, 200, { ok: true });
+    }),
+];

package/dist/src/server/routes-version.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDefinition } from './route-types.js';
+export declare const versionRoutes: RouteDefinition[];

package/dist/src/server/routes-version.js

@@ -0,0 +1,6 @@
+import { route, sendJson } from './route-helpers.js';
+export const versionRoutes = [
+    route('GET', '/api/version', async ({ response, versionService }) => {
+        sendJson(response, 200, await versionService.getVersionInfo());
+    }),
+];

package/dist/src/server/routes-workflow-schedules.d.ts

@@ -0,0 +1,2 @@
+import type { RouteDefinition } from './route-types.js';
+export declare const workflowScheduleRoutes: RouteDefinition[];