@johpaz/hive-agents 0.0.37 → 0.0.39

package/packages/core/src/storage/crypto.ts

@@ -1,4 +1,5 @@
 import { logger } from "../utils/logger"
+import { getDb } from "./sqlite"
 
 const log = logger.child("crypto")
 const SERVICE = "hive"
@@ -12,30 +13,71 @@ const _mem = new Map<string, string>()
 let _keychainOk: boolean | null = null // null = untested
 
 async function _get(name: string): Promise<string | null> {
-  if (_keychainOk === false) return _mem.get(name) ?? null
+  if (_keychainOk === false) {
+    return _mem.get(name) ?? _readDbSecret(name)
+  }
   try {
     const val = await (Bun as any).secrets.get({ service: SERVICE, name })
     _keychainOk = true
-    return val ?? null
+    return val ?? _mem.get(name) ?? _readDbSecret(name)
   } catch {
     _keychainOk = false
-    return _mem.get(name) ?? null
+    return _mem.get(name) ?? _readDbSecret(name)
   }
 }
 
-async function _set(name: string, value: string): Promise<void> {
+async function _set(name: string, value: string): Promise<boolean> {
   if (_keychainOk === false) {
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
-    return
+    return persistSecretToDb(name, value)
   }
   try {
     await (Bun as any).secrets.set({ service: SERVICE, name, value })
     _keychainOk = true
+    return true
   } catch {
     _keychainOk = false
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
+    return persistSecretToDb(name, value)
+  }
+}
+
+/**
+ * Read a secret from its DB ciphertext column as a last-resort fallback
+ * when the keychain and in-memory map are both empty. Used to survive
+ * container restarts when the OS keychain is unavailable (Docker, headless).
+ */
+function _readDbSecret(name: string): string | null {
+  const parts = name.split(":")
+  if (parts.length !== 3) return null
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return null
+  }
+
+  try {
+    const db = getDb()
+    const row = db.query(
+      `SELECT ${column}_encrypted AS enc, ${column}_iv AS iv FROM ${table} WHERE id = ?`
+    ).get(id) as { enc: string | null; iv: string | null } | undefined
+    if (!row?.enc || !row?.iv) return null
+    const plain = legacyDecryptAES(row.enc, row.iv)
+    if (plain) {
+      // Cache in memory for subsequent lookups in this process
+      _mem.set(name, plain)
+    }
+    return plain || null
+  } catch {
+    return null
   }
 }
 
@@ -64,16 +106,22 @@ export async function deleteSecret(name: string): Promise<void> {
 
 // ─── Provider secrets ────────────────────────────────────────────────────────
 
-export async function storeProviderApiKey(id: string, apiKey: string): Promise<void> {
-  await _set(`provider:${id}:api_key`, apiKey)
+/**
+ * Returns true if the secret was persisted to a durable store (OS keychain
+ * or DB-backed fallback). Returns false if it ended up in the per-process
+ * in-memory map only — useful so callers can avoid destructive actions
+ * (like nulling the DB ciphertext) that would lose data on restart.
+ */
+export async function storeProviderApiKey(id: string, apiKey: string): Promise<boolean> {
+  return await _set(`provider:${id}:api_key`, apiKey)
 }
 
 export async function loadProviderApiKey(id: string): Promise<string> {
   return (await _get(`provider:${id}:api_key`)) ?? ""
 }
 
-export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`provider:${id}:headers`, JSON.stringify(headers))
+export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`provider:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadProviderHeaders(id: string): Promise<Record<string, unknown>> {
@@ -90,8 +138,8 @@ export async function deleteProviderSecrets(id: string): Promise<void> {
 
 // ─── Channel secrets ─────────────────────────────────────────────────────────
 
-export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<void> {
-  await _set(`channel:${id}:config`, JSON.stringify(config))
+export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<boolean> {
+  return await _set(`channel:${id}:config`, JSON.stringify(config))
 }
 
 export async function loadChannelConfig(id: string): Promise<Record<string, unknown>> {
@@ -105,8 +153,8 @@ export async function deleteChannelSecrets(id: string): Promise<void> {
 
 // ─── MCP secrets ──────────────────────────────────────────────────────────────
 
-export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`mcp:${id}:headers`, JSON.stringify(headers))
+export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`mcp:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadMcpHeaders(id: string): Promise<Record<string, unknown>> {
@@ -114,8 +162,8 @@ export async function loadMcpHeaders(id: string): Promise<Record<string, unknown
   return raw ? JSON.parse(raw) : {}
 }
 
-export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<void> {
-  await _set(`mcp:${id}:env`, JSON.stringify(env))
+export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<boolean> {
+  return await _set(`mcp:${id}:env`, JSON.stringify(env))
 }
 
 export async function loadMcpEnv(id: string): Promise<Record<string, string>> {
@@ -132,8 +180,8 @@ export async function deleteMcpSecrets(id: string): Promise<void> {
 
 // ─── Agent secrets ────────────────────────────────────────────────────────────
 
-export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`agent:${id}:headers`, JSON.stringify(headers))
+export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`agent:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadAgentHeaders(id: string): Promise<Record<string, unknown>> {
@@ -182,7 +230,7 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
     const keyPath = nodePath.join(hiveDir, ".master.key")
     if (!nodeFs.existsSync(keyPath)) return ""
-    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf-8").trim(), "hex")
+    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
   }
 
   try {
@@ -195,3 +243,87 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     return ""
   }
 }
+
+function getMasterKey(): Buffer | null {
+  const nodeCrypto = require("node:crypto")
+  const nodeFs = require("node:fs")
+  const nodePath = require("node:path")
+  const nodeOs = require("node:os")
+
+  const masterKey = process.env.HIVE_MASTER_KEY
+  if (masterKey) {
+    return Buffer.from(masterKey.slice(0, 32).padEnd(32, "0"), "utf8")
+  }
+  const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
+  const keyPath = nodePath.join(hiveDir, ".master.key")
+  if (!nodeFs.existsSync(keyPath)) return null
+  try {
+    return Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Encrypt a plaintext string using the same AES-256-GCM scheme as the legacy
+ * store. Format: `<encDataHex>:<authTagHex>`. Used as a DB-backed fallback
+ * when the OS keychain is unavailable (headless Linux, Docker, etc.).
+ */
+export function legacyEncryptAES(plain: string, ivHex: string): string {
+  const nodeCrypto = require("node:crypto")
+  const key = getMasterKey()
+  if (!key) return ""
+  try {
+    const iv = Buffer.from(ivHex, "hex")
+    const cipher = nodeCrypto.createCipheriv("aes-256-gcm", key, iv)
+    const encData = cipher.update(plain, "utf8", "hex") + cipher.final("hex")
+    const authTag = cipher.getAuthTag().toString("hex")
+    return `${encData}:${authTag}`
+  } catch {
+    return ""
+  }
+}
+
+/**
+ * DB-backed persistence fallback for secrets. Maps the canonical secret
+ * name (e.g. `provider:openai:api_key`) to the matching ciphertext column
+ * and updates the row in-place. Returns true if the row was written.
+ */
+function persistSecretToDb(name: string, value: string): boolean {
+  const nodeCrypto = require("node:crypto")
+  const parts = name.split(":")
+  if (parts.length !== 3) return false
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return false
+  }
+
+  const key = getMasterKey()
+  if (!key) {
+    log.warn(`[secrets] No master key in ${process.env.HIVE_HOME || "~/.hive"}/.master.key — cannot persist ${name} to DB fallback`)
+    return false
+  }
+
+  const iv = nodeCrypto.randomBytes(12).toString("hex")
+  const enc = legacyEncryptAES(value, iv)
+  if (!enc) return false
+
+  try {
+    const db = getDb()
+    db.query(`UPDATE ${table} SET ${column}_encrypted = ?, ${column}_iv = ? WHERE id = ?`)
+      .run(enc, iv, id)
+    return true
+  } catch (err) {
+    log.warn(`[secrets] DB fallback failed for ${name}: ${(err as Error).message}`)
+    return false
+  }
+}

package/packages/core/src/storage/migrate.ts

@@ -39,25 +39,38 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const p of providers) {
     if (p.api_key_encrypted && p.api_key_iv) {
       const existing = await loadProviderApiKey(p.id)
+      let stored = !!existing
       if (!existing) {
         const plain = legacyDecryptAES(p.api_key_encrypted, p.api_key_iv)
         if (plain) {
-          await storeProviderApiKey(p.id, plain)
-          migrated++
+          stored = await storeProviderApiKey(p.id, plain)
+          if (stored) migrated++
         }
       }
-      db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      // Only null the DB ciphertext when the secret reached a durable store
+      // (OS keychain or DB-backed fallback). In-memory fallback would lose
+      // the secret on the next process restart.
+      if (stored) {
+        db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES ciphertext for ${p.id} (will retry next start)`)
+      }
     }
 
     if (p.headers_encrypted && p.headers_iv) {
       const plain = legacyDecryptAES(p.headers_encrypted, p.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeProviderHeaders(p.id, JSON.parse(plain))
-          migrated++
+          stored = await storeProviderHeaders(p.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore JSON parse errors */ }
       }
-      db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      if (stored) {
+        db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES headers ciphertext for ${p.id}`)
+      }
     }
   }
 
@@ -74,13 +87,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const c of channels) {
     const plain = legacyDecryptAES(c.config_encrypted, c.config_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeChannelConfig(c.id, JSON.parse(plain))
-        migrated++
+        stored = await storeChannelConfig(c.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore JSON parse errors */ }
     }
-    db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    if (stored) {
+      db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping channel config for ${c.id}`)
+    }
   }
 
   // ── MCP servers ────────────────────────────────────────────────────────────
@@ -99,23 +117,33 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const m of mcpServers) {
     if (m.headers_encrypted && m.headers_iv) {
       const plain = legacyDecryptAES(m.headers_encrypted, m.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpHeaders(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpHeaders(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP headers for ${m.id}`)
+      }
     }
     if (m.env_encrypted && m.env_iv) {
       const plain = legacyDecryptAES(m.env_encrypted, m.env_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpEnv(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpEnv(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP env for ${m.id}`)
+      }
     }
   }
 
@@ -132,13 +160,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const a of agents) {
     const plain = legacyDecryptAES(a.headers_encrypted, a.headers_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeAgentHeaders(a.id, JSON.parse(plain))
-        migrated++
+        stored = await storeAgentHeaders(a.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore */ }
     }
-    db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    if (stored) {
+      db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping agent headers for ${a.id}`)
+    }
   }
 
   if (migrated > 0) {

package/packages/core/src/storage/seed.ts

@@ -44,19 +44,7 @@ export const SEED_DATA: SeedData = {
     { id: "browser_wait", name: "browser_wait", category: "web", description: "Esperar a que aparezca un elemento o se cumpla una condición. Sinónimos: esperar, condición, elemento, selector, pausa" },
 
     // ─────────────────────────────────────────
-    // 3. PROJECTS — Proyectos y tareas en BD
-    // ─────────────────────────────────────────
-    { id: "project_create", name: "project_create", category: "projects", description: "Crear un nuevo proyecto con tareas en la base de datos. Sinónimos: nuevo proyecto, iniciar plan, crear proyecto" },
-    { id: "project_list", name: "project_list", category: "projects", description: "Listar todos los proyectos con su estado. Sinónimos: ver proyectos, historial, listar proyectos, mostrar proyectos" },
-    { id: "project_update", name: "project_update", category: "projects", description: "Actualizar progreso o metadatos del proyecto. Sinónimos: avance, porcentaje, estado, actualizar proyecto" },
-    { id: "project_done", name: "project_done", category: "projects", description: "Marcar proyecto como completado y archivarlo. Sinónimos: proyecto terminado, cerrar proyecto, completado, finalizar" },
-    { id: "project_fail", name: "project_fail", category: "projects", description: "Marcar proyecto como fallido y registrar razón. Sinónimos: proyecto fallido, marcar fracaso, error, falló proyecto" },
-    { id: "task_create", name: "task_create", category: "projects", description: "Agregar una tarea o subtarea a un proyecto existente. Sinónimos: crear tarea, agregar tarea, subtarea, pendiente" },
-    { id: "task_update", name: "task_update", category: "projects", description: "Actualizar estado de tarea (pendiente, en_progreso, hecho). Sinónimos: actualizar tarea, marcar completa, en progreso" },
-    { id: "task_evaluate", name: "task_evaluate", category: "projects", description: "Evaluar resultado de tarea contra criterios de aceptación. Sinónimos: validar resultado, criterios de aceptación, revisar tarea" },
-
-    // ─────────────────────────────────────────
-    // 4. CRON — Tareas programadas (Croner-based)
+    // 3. CRON — Tareas programadas (Croner-based)
     // ─────────────────────────────────────────
     { id: "cron.create", name: "cron.create", category: "cron", description: "Crear tarea programada: recurrente (expresión cron) o única (fire_at). Requiere campo 'task' con instrucción para el agente. Sinónimos: programar tarea, crear recordatorio, agendar, automatizar horario, tarea recurrente, una vez" },
     { id: "cron.list", name: "cron.list", category: "cron", description: "Listar todas las tareas programadas con próximos horarios de ejecución. Sinónimos: ver tareas programadas, listar cronograma, próximas ejecuciones" },
@@ -68,12 +56,12 @@ export const SEED_DATA: SeedData = {
     { id: "cron.history", name: "cron.history", category: "cron", description: "Obtener historial de ejecuciones y logs de una tarea programada. Sinónimos: historial ejecuciones, logs tarea, registro ejecuciones" },
 
     // ─────────────────────────────────────────
-    // 5. CLI — Ejecución de comandos
+    // 4. CLI — Ejecución de comandos
     // ─────────────────────────────────────────
     { id: "cli_exec", name: "cli_exec", category: "cli", description: "Ejecutar comandos shell/bash en el entorno del agente. NOTA: NO usar para tareas programadas, usar cron.create. Sinónimos: ejecutar comando, terminal, bash, script, consola" },
 
     // ─────────────────────────────────────────
-    // 6. AGENTS — Memoria, workers y delegación
+    // 5. AGENTS — Memoria, workers y delegación
     // ─────────────────────────────────────────
     { id: "memory_write", name: "memory_write", category: "agents", description: "Guardar información en memoria persistente a largo plazo. Sinónimos: guardar memoria, recordar, guardar dato, memoria persistente" },
     { id: "memory_read", name: "memory_read", category: "agents", description: "Recuperar una entrada de memoria por identificador. Sinónimos: leer memoria, recuperar dato, obtener memoria" },
@@ -89,10 +77,9 @@ export const SEED_DATA: SeedData = {
     { id: "task_status", name: "task_status", category: "agents", description: "Obtener estado de ejecución de tareas delegadas. Sinónimos: estado tarea delegada, verificar progreso, consultar tarea" },
     { id: "bus_publish", name: "bus_publish", category: "agents", description: "Publicar mensaje en el Agent Bus para comunicación worker-to-worker. Sinónimos: publicar mensaje, comunicar workers, enviar bus" },
     { id: "bus_read", name: "bus_read", category: "agents", description: "Leer mensajes no leídos del Agent Bus. Sinónimos: leer mensajes bus, recibir mensajes, verificar bus" },
-    { id: "project_updates", name: "project_updates", category: "agents", description: "Obtener actualizaciones recientes de workers en el mismo proyecto. Sinónimos: actualizaciones proyecto, estado workers, progreso equipo" },
 
     // ─────────────────────────────────────────
-    // 7. CANVAS — UI interactiva
+    // 6. CANVAS — UI interactiva
     // ─────────────────────────────────────────
     { id: "canvas_render", name: "canvas_render", category: "canvas", description: "Renderizar un componente o visualización en el canvas. Sinónimos: renderizar, visualizar, gráfico, diagrama" },
     { id: "canvas_ask", name: "canvas_ask", category: "canvas", description: "Mostrar formulario interactivo y esperar input del usuario. Sinónimos: formulario interactivo, preguntar usuario, input" },
@@ -103,7 +90,7 @@ export const SEED_DATA: SeedData = {
     { id: "canvas_clear", name: "canvas_clear", category: "canvas", description: "Limpiar contenido actual del canvas. Sinónimos: limpiar canvas, borrar visualización, resetear" },
 
     // ─────────────────────────────────────────
-    // 7b. CANVAS A2UI v0.9 — Superficies interactivas ricas
+    // 6b. CANVAS A2UI v0.9 — Superficies interactivas ricas
     // ─────────────────────────────────────────
     { id: "a2ui_create_surface", name: "a2ui_create_surface", category: "a2ui", description: "Crear superficie A2UI v0.9 para UI interactiva rica: formularios, dashboards, wizards, flujos multi-paso. Siempre llamar ANTES de a2ui_update_components. Requiere surfaceId y catalogId='https://a2ui.org/specification/v0_9/basic_catalog.json'. Sinónimos: crear superficie A2UI, iniciar UI A2UI, crear form A2UI, interfaz interactiva, crear dashboard A2UI" },
     { id: "a2ui_update_components", name: "a2ui_update_components", category: "a2ui", description: "Enviar componentes A2UI v0.9 como lista plana (adjacency list). Tipos: Text, Button, TextField, Row, Column, Card, List, Tabs, Modal, ChoicePicker, Slider, CheckBox, DateTimeInput, Image, Divider. Reglas: children usa explicitList (NO array), ChoicePicker usa selections (NO value), TextField usa textFieldType (NO variant), Tabs.tabItems.title es string plano. Sinónimos: actualizar componentes A2UI, enviar UI A2UI, renderizar componentes A2UI, layout A2UI" },
@@ -111,21 +98,21 @@ export const SEED_DATA: SeedData = {
     { id: "a2ui_delete_surface", name: "a2ui_delete_surface", category: "a2ui", description: "Eliminar superficie A2UI v0.9 del canvas. Usar al completar o cancelar el flujo para liberar recursos. Sinónimos: eliminar superficie A2UI, borrar UI A2UI, cerrar formulario A2UI, limpiar canvas A2UI" },
 
     // ─────────────────────────────────────────
-    // 8. VOICE — Voz
+    // 7. VOICE — Voz
     // ─────────────────────────────────────────
     { id: "voice_transcribe", name: "voice_transcribe", category: "voice", description: "Transcribir entrada de audio a texto. Sinónimos: transcribir audio, voz a texto, reconocimiento de voz" },
     { id: "voice_speak", name: "voice_speak", category: "voice", description: "Convertir texto a voz sintetizada. Sinónimos: texto a voz, sintetizar, hablar, leer en voz alta" },
 
-    // 10. SEARCH-KNOWLEDGE
+    // 8. SEARCH-KNOWLEDGE
     { id: "search_knowledge", name: "search_knowledge", category: "search-knowledge", description: "Buscar en la base de conocimientos. Sinónimos: buscar conocimiento, buscar en la base" },
 
-    // 11. CORE — Notificaciones y notas
+    // 9. CORE — Notificaciones y notas
     { id: "notify", name: "notify", category: "core", description: "Enviar notificación al usuario. Sinónimos: notificar, enviar notificación, alertar, aviso" },
     { id: "save_note", name: "save_note", category: "core", description: "Guardar nota persistente en el scratchpad. Sinónimos: guardar nota, escribir nota, recordatorio rápido, apuntar" },
     { id: "report_progress", name: "report_progress", category: "core", description: "Reportar progreso actual al usuario. Sinónimos: reportar progreso, informar estado, actualizar progreso, porcentaje" },
 
     // ─────────────────────────────────────────
-    // 12. OFFICE — Archivos Office (PDF, DOCX, XLSX, PPTX)
+    // 10. OFFICE — Archivos Office (PDF, DOCX, XLSX, PPTX)
     // ─────────────────────────────────────────
     { id: "office_leer_pdf", name: "office_leer_pdf", category: "office", description: "Leer contenido de un archivo PDF y retornar texto plano con metadata. Sinónimos: leer pdf, abrir pdf, extraer texto de pdf, contenido pdf, pdf a texto" },
     { id: "office_escribir_pdf", name: "office_escribir_pdf", category: "office", description: "Generar un archivo PDF desde texto con configuración de márgenes y tamaño de página. Sinónimos: crear pdf, generar pdf, escribir pdf, exportar a pdf" },
@@ -152,6 +139,8 @@ export const SEED_DATA: SeedData = {
     { id: "elevenlabs", name: "ElevenLabs", baseUrl: "https://api.elevenlabs.io/v1" },
     { id: "qwen", name: "Qwen (Alibaba)", baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1", category: "llm" },
     { id: "nvidia", name: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1" },
+    { id: "minimax", name: "MiniMax", baseUrl: "https://api.minimaxi.com/v1" },
+    { id: "opencode-go", name: "OpenCode Go", baseUrl: "https://opencode.ai/zen/go/v1" },
     { id: "piper", name: "Piper (Local TTS)" },
   ],
 
@@ -262,6 +251,14 @@ export const SEED_DATA: SeedData = {
     { id: "e2b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "stt", "local"]) },
     { id: "e4b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "vision", "stt", "local"]) },
     { id: "e4b_vision", providerId: "local-llama", name: "Gemma 4 4B Vision (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_12b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 12B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_26b_Q4_K_M", providerId: "local-llama", name: "Gemma 4 26B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_31b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 31B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "qwen3_5_2b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_4b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_9b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 9B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_27b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 27B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_35b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 35B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
     { id: "local_stt", providerId: "local-llama", name: "Local STT (Gemma)", modelType: "stt", contextWindow: 16000, capabilities: JSON.stringify(["transcription", "local"]) },
 
 
@@ -295,6 +292,29 @@ export const SEED_DATA: SeedData = {
     { id: "google/gemma-4-31b-it", providerId: "nvidia", name: "Gemma 4 31B (NVIDIA)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "google/gemma-3-27b-it", providerId: "nvidia", name: "Gemma 3 27B (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "z-ai/glm-5.1", providerId: "nvidia", name: "GLM 5.1 (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming"]) },
+
+    // ── MiniMax (fuente: platform.minimaxi.com) — OpenAI-compatible endpoint ──
+    { id: "MiniMax-M3", providerId: "minimax", name: "MiniMax M3", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "MiniMax-M2.7", providerId: "minimax", name: "MiniMax M2.7", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.7-highspeed", providerId: "minimax", name: "MiniMax M2.7 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5", providerId: "minimax", name: "MiniMax M2.5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5-highspeed", providerId: "minimax", name: "MiniMax M2.5 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+
+    // ── OpenCode Go (fuente: opencode.ai) — OpenAI-compatible endpoint ──
+    { id: "opencode-go/minimax-m3",         providerId: "opencode-go", name: "MiniMax M3",          modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/minimax-m2.7",       providerId: "opencode-go", name: "MiniMax M2.7",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/minimax-m2.5",       providerId: "opencode-go", name: "MiniMax M2.5",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.6",          providerId: "opencode-go", name: "Kimi K2.6",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.5",          providerId: "opencode-go", name: "Kimi K2.5",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5.1",            providerId: "opencode-go", name: "GLM-5.1",             modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5",              providerId: "opencode-go", name: "GLM-5",               modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/deepseek-v4-pro",    providerId: "opencode-go", name: "DeepSeek V4 Pro",     modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/deepseek-v4-flash",  providerId: "opencode-go", name: "DeepSeek V4 Flash",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2-pro",        providerId: "opencode-go", name: "MiMo-V2 Pro",         modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2-omni",       providerId: "opencode-go", name: "MiMo-V2 Omni",        modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2.5-pro",      providerId: "opencode-go", name: "MiMo-V2.5 Pro",       modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2.5",          providerId: "opencode-go", name: "MiMo-V2.5",           modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/hy3-preview",        providerId: "opencode-go", name: "Hunyuan 3 Preview",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
   ],
 
 
@@ -361,9 +381,9 @@ const INITIAL_PLAYBOOK_RULES = [
     applicable_to: JSON.stringify(["code", "development"]),
   },
   {
-    rule: "Al crear proyectos, divide las tareas en pasos atómicos que puedan ejecutarse independientemente",
+    rule: "Al delegar trabajo complejo a workers, divide el objetivo en pasos atómicos que puedan ejecutarse independientemente",
     category: "agent_creation",
-    applicable_to: JSON.stringify(["project_management", "tasks"]),
+    applicable_to: JSON.stringify(["delegation", "workers", "tasks"]),
   },
   {
     rule: "Guarda las preferencias importantes del usuario en el scratchpad usando la herramienta save_note para persistencia entre sesiones",
@@ -516,10 +536,13 @@ export function seedAllData(): void {
 
     let modelCount = 0;
     for (const model of SEED_DATA.models) {
+      // Local LLM models are always active so they appear in the selector
+      // (downloaded status is checked separately at runtime)
+      const isLocal = model.providerId === "local-llama";
       db.query(`
         INSERT OR REPLACE INTO models (id, provider_id, name, model_type, context_window, capabilities, enabled, active)
-        VALUES (?, ?, ?, ?, ?, ?, 1, 0)
-      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null)
+        VALUES (?, ?, ?, ?, ?, ?, 1, ?)
+      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null, isLocal ? 1 : 0)
       modelCount++;
     }
     db.run("PRAGMA foreign_keys = ON;");
@@ -552,24 +575,43 @@ export function seedAllData(): void {
     log.info("[seed] ✅ webchat activado por defecto");
 
     // 🔟 ACE Playbook - Initial rules for Agentic Context Engineering
+    db.query(`DELETE FROM playbook WHERE rule = ?`).run(
+      "Al crear proyectos, divide las tareas en pasos atómicos que puedan ejecutarse independientemente"
+    );
+
     let playbookCount = 0
     for (const rule of INITIAL_PLAYBOOK_RULES) {
-      db.query(`
-        INSERT OR REPLACE INTO playbook (rule, category, applicable_to, helpful_count, harmful_count, active)
-        VALUES (?, ?, ?, 1, 0, 1)
-      `).run(rule.rule, rule.category, rule.applicable_to)
+      const existing = db.query(`SELECT id FROM playbook WHERE rule = ?`).get(rule.rule) as { id: number } | null;
+      if (existing) {
+        db.query(`
+          UPDATE playbook
+          SET category = ?, applicable_to = ?, active = 1, updated_at = unixepoch()
+          WHERE id = ?
+        `).run(rule.category, rule.applicable_to, existing.id);
+      } else {
+        db.query(`
+          INSERT INTO playbook (rule, category, applicable_to, helpful_count, harmful_count, active)
+          VALUES (?, ?, ?, 1, 0, 1)
+        `).run(rule.rule, rule.category, rule.applicable_to);
+      }
       playbookCount++
     }
     log.info(`[seed] ✅ ${playbookCount} ACE playbook rules seeded`);
 
+    db.run(`DELETE FROM playbook_fts`);
+    const activePlaybook = db.query(`
+      SELECT id, rule, category, applicable_to
+      FROM playbook
+      WHERE active = 1
+    `).all() as Array<{ id: number; rule: string; category: string; applicable_to: string | null }>;
     const insertPlaybookFts = db.prepare(`
-      INSERT OR REPLACE INTO playbook_fts(rule, category, applicable_to)
-      VALUES (?, ?, ?)
+      INSERT OR REPLACE INTO playbook_fts(rowid, rule, category, applicable_to)
+      VALUES (?, ?, ?, ?)
     `);
-    for (const rule of INITIAL_PLAYBOOK_RULES) {
-      insertPlaybookFts.run(rule.rule, rule.category, rule.applicable_to);
+    for (const rule of activePlaybook) {
+      insertPlaybookFts.run(rule.id, rule.rule, rule.category, rule.applicable_to);
     }
-    log.info(`[seed] ✅ ${playbookCount} reglas playbook sincronizadas a playbook_fts`);
+    log.info(`[seed] ✅ ${activePlaybook.length} reglas playbook sincronizadas a playbook_fts`);
 
     log.info("[seed] ✨ Seed completado exitosamente.");
   } catch (err) {