@johpaz/hive-agents 0.0.38 → 0.0.39

package/packages/core/src/storage/crypto.ts

@@ -1,4 +1,5 @@
 import { logger } from "../utils/logger"
+import { getDb } from "./sqlite"
 
 const log = logger.child("crypto")
 const SERVICE = "hive"
@@ -12,30 +13,71 @@ const _mem = new Map<string, string>()
 let _keychainOk: boolean | null = null // null = untested
 
 async function _get(name: string): Promise<string | null> {
-  if (_keychainOk === false) return _mem.get(name) ?? null
+  if (_keychainOk === false) {
+    return _mem.get(name) ?? _readDbSecret(name)
+  }
   try {
     const val = await (Bun as any).secrets.get({ service: SERVICE, name })
     _keychainOk = true
-    return val ?? null
+    return val ?? _mem.get(name) ?? _readDbSecret(name)
   } catch {
     _keychainOk = false
-    return _mem.get(name) ?? null
+    return _mem.get(name) ?? _readDbSecret(name)
   }
 }
 
-async function _set(name: string, value: string): Promise<void> {
+async function _set(name: string, value: string): Promise<boolean> {
   if (_keychainOk === false) {
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
-    return
+    return persistSecretToDb(name, value)
   }
   try {
     await (Bun as any).secrets.set({ service: SERVICE, name, value })
     _keychainOk = true
+    return true
   } catch {
     _keychainOk = false
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
+    return persistSecretToDb(name, value)
+  }
+}
+
+/**
+ * Read a secret from its DB ciphertext column as a last-resort fallback
+ * when the keychain and in-memory map are both empty. Used to survive
+ * container restarts when the OS keychain is unavailable (Docker, headless).
+ */
+function _readDbSecret(name: string): string | null {
+  const parts = name.split(":")
+  if (parts.length !== 3) return null
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return null
+  }
+
+  try {
+    const db = getDb()
+    const row = db.query(
+      `SELECT ${column}_encrypted AS enc, ${column}_iv AS iv FROM ${table} WHERE id = ?`
+    ).get(id) as { enc: string | null; iv: string | null } | undefined
+    if (!row?.enc || !row?.iv) return null
+    const plain = legacyDecryptAES(row.enc, row.iv)
+    if (plain) {
+      // Cache in memory for subsequent lookups in this process
+      _mem.set(name, plain)
+    }
+    return plain || null
+  } catch {
+    return null
   }
 }
 
@@ -64,16 +106,22 @@ export async function deleteSecret(name: string): Promise<void> {
 
 // ─── Provider secrets ────────────────────────────────────────────────────────
 
-export async function storeProviderApiKey(id: string, apiKey: string): Promise<void> {
-  await _set(`provider:${id}:api_key`, apiKey)
+/**
+ * Returns true if the secret was persisted to a durable store (OS keychain
+ * or DB-backed fallback). Returns false if it ended up in the per-process
+ * in-memory map only — useful so callers can avoid destructive actions
+ * (like nulling the DB ciphertext) that would lose data on restart.
+ */
+export async function storeProviderApiKey(id: string, apiKey: string): Promise<boolean> {
+  return await _set(`provider:${id}:api_key`, apiKey)
 }
 
 export async function loadProviderApiKey(id: string): Promise<string> {
   return (await _get(`provider:${id}:api_key`)) ?? ""
 }
 
-export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`provider:${id}:headers`, JSON.stringify(headers))
+export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`provider:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadProviderHeaders(id: string): Promise<Record<string, unknown>> {
@@ -90,8 +138,8 @@ export async function deleteProviderSecrets(id: string): Promise<void> {
 
 // ─── Channel secrets ─────────────────────────────────────────────────────────
 
-export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<void> {
-  await _set(`channel:${id}:config`, JSON.stringify(config))
+export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<boolean> {
+  return await _set(`channel:${id}:config`, JSON.stringify(config))
 }
 
 export async function loadChannelConfig(id: string): Promise<Record<string, unknown>> {
@@ -105,8 +153,8 @@ export async function deleteChannelSecrets(id: string): Promise<void> {
 
 // ─── MCP secrets ──────────────────────────────────────────────────────────────
 
-export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`mcp:${id}:headers`, JSON.stringify(headers))
+export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`mcp:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadMcpHeaders(id: string): Promise<Record<string, unknown>> {
@@ -114,8 +162,8 @@ export async function loadMcpHeaders(id: string): Promise<Record<string, unknown
   return raw ? JSON.parse(raw) : {}
 }
 
-export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<void> {
-  await _set(`mcp:${id}:env`, JSON.stringify(env))
+export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<boolean> {
+  return await _set(`mcp:${id}:env`, JSON.stringify(env))
 }
 
 export async function loadMcpEnv(id: string): Promise<Record<string, string>> {
@@ -132,8 +180,8 @@ export async function deleteMcpSecrets(id: string): Promise<void> {
 
 // ─── Agent secrets ────────────────────────────────────────────────────────────
 
-export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`agent:${id}:headers`, JSON.stringify(headers))
+export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`agent:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadAgentHeaders(id: string): Promise<Record<string, unknown>> {
@@ -182,7 +230,7 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
     const keyPath = nodePath.join(hiveDir, ".master.key")
     if (!nodeFs.existsSync(keyPath)) return ""
-    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf-8").trim(), "hex")
+    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
   }
 
   try {
@@ -195,3 +243,87 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     return ""
   }
 }
+
+function getMasterKey(): Buffer | null {
+  const nodeCrypto = require("node:crypto")
+  const nodeFs = require("node:fs")
+  const nodePath = require("node:path")
+  const nodeOs = require("node:os")
+
+  const masterKey = process.env.HIVE_MASTER_KEY
+  if (masterKey) {
+    return Buffer.from(masterKey.slice(0, 32).padEnd(32, "0"), "utf8")
+  }
+  const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
+  const keyPath = nodePath.join(hiveDir, ".master.key")
+  if (!nodeFs.existsSync(keyPath)) return null
+  try {
+    return Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Encrypt a plaintext string using the same AES-256-GCM scheme as the legacy
+ * store. Format: `<encDataHex>:<authTagHex>`. Used as a DB-backed fallback
+ * when the OS keychain is unavailable (headless Linux, Docker, etc.).
+ */
+export function legacyEncryptAES(plain: string, ivHex: string): string {
+  const nodeCrypto = require("node:crypto")
+  const key = getMasterKey()
+  if (!key) return ""
+  try {
+    const iv = Buffer.from(ivHex, "hex")
+    const cipher = nodeCrypto.createCipheriv("aes-256-gcm", key, iv)
+    const encData = cipher.update(plain, "utf8", "hex") + cipher.final("hex")
+    const authTag = cipher.getAuthTag().toString("hex")
+    return `${encData}:${authTag}`
+  } catch {
+    return ""
+  }
+}
+
+/**
+ * DB-backed persistence fallback for secrets. Maps the canonical secret
+ * name (e.g. `provider:openai:api_key`) to the matching ciphertext column
+ * and updates the row in-place. Returns true if the row was written.
+ */
+function persistSecretToDb(name: string, value: string): boolean {
+  const nodeCrypto = require("node:crypto")
+  const parts = name.split(":")
+  if (parts.length !== 3) return false
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return false
+  }
+
+  const key = getMasterKey()
+  if (!key) {
+    log.warn(`[secrets] No master key in ${process.env.HIVE_HOME || "~/.hive"}/.master.key — cannot persist ${name} to DB fallback`)
+    return false
+  }
+
+  const iv = nodeCrypto.randomBytes(12).toString("hex")
+  const enc = legacyEncryptAES(value, iv)
+  if (!enc) return false
+
+  try {
+    const db = getDb()
+    db.query(`UPDATE ${table} SET ${column}_encrypted = ?, ${column}_iv = ? WHERE id = ?`)
+      .run(enc, iv, id)
+    return true
+  } catch (err) {
+    log.warn(`[secrets] DB fallback failed for ${name}: ${(err as Error).message}`)
+    return false
+  }
+}

package/packages/core/src/storage/migrate.ts

@@ -39,25 +39,38 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const p of providers) {
     if (p.api_key_encrypted && p.api_key_iv) {
       const existing = await loadProviderApiKey(p.id)
+      let stored = !!existing
       if (!existing) {
         const plain = legacyDecryptAES(p.api_key_encrypted, p.api_key_iv)
         if (plain) {
-          await storeProviderApiKey(p.id, plain)
-          migrated++
+          stored = await storeProviderApiKey(p.id, plain)
+          if (stored) migrated++
         }
       }
-      db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      // Only null the DB ciphertext when the secret reached a durable store
+      // (OS keychain or DB-backed fallback). In-memory fallback would lose
+      // the secret on the next process restart.
+      if (stored) {
+        db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES ciphertext for ${p.id} (will retry next start)`)
+      }
     }
 
     if (p.headers_encrypted && p.headers_iv) {
       const plain = legacyDecryptAES(p.headers_encrypted, p.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeProviderHeaders(p.id, JSON.parse(plain))
-          migrated++
+          stored = await storeProviderHeaders(p.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore JSON parse errors */ }
       }
-      db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      if (stored) {
+        db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES headers ciphertext for ${p.id}`)
+      }
     }
   }
 
@@ -74,13 +87,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const c of channels) {
     const plain = legacyDecryptAES(c.config_encrypted, c.config_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeChannelConfig(c.id, JSON.parse(plain))
-        migrated++
+        stored = await storeChannelConfig(c.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore JSON parse errors */ }
     }
-    db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    if (stored) {
+      db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping channel config for ${c.id}`)
+    }
   }
 
   // ── MCP servers ────────────────────────────────────────────────────────────
@@ -99,23 +117,33 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const m of mcpServers) {
     if (m.headers_encrypted && m.headers_iv) {
       const plain = legacyDecryptAES(m.headers_encrypted, m.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpHeaders(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpHeaders(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP headers for ${m.id}`)
+      }
     }
     if (m.env_encrypted && m.env_iv) {
       const plain = legacyDecryptAES(m.env_encrypted, m.env_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpEnv(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpEnv(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP env for ${m.id}`)
+      }
     }
   }
 
@@ -132,13 +160,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const a of agents) {
     const plain = legacyDecryptAES(a.headers_encrypted, a.headers_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeAgentHeaders(a.id, JSON.parse(plain))
-        migrated++
+        stored = await storeAgentHeaders(a.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore */ }
     }
-    db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    if (stored) {
+      db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping agent headers for ${a.id}`)
+    }
   }
 
   if (migrated > 0) {

package/packages/core/src/storage/seed.ts

@@ -139,6 +139,8 @@ export const SEED_DATA: SeedData = {
     { id: "elevenlabs", name: "ElevenLabs", baseUrl: "https://api.elevenlabs.io/v1" },
     { id: "qwen", name: "Qwen (Alibaba)", baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1", category: "llm" },
     { id: "nvidia", name: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1" },
+    { id: "minimax", name: "MiniMax", baseUrl: "https://api.minimaxi.com/v1" },
+    { id: "opencode-go", name: "OpenCode Go", baseUrl: "https://opencode.ai/zen/go/v1" },
     { id: "piper", name: "Piper (Local TTS)" },
   ],
 
@@ -249,6 +251,14 @@ export const SEED_DATA: SeedData = {
     { id: "e2b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "stt", "local"]) },
     { id: "e4b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "vision", "stt", "local"]) },
     { id: "e4b_vision", providerId: "local-llama", name: "Gemma 4 4B Vision (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_12b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 12B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_26b_Q4_K_M", providerId: "local-llama", name: "Gemma 4 26B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_31b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 31B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "qwen3_5_2b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_4b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_9b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 9B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_27b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 27B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_35b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 35B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
     { id: "local_stt", providerId: "local-llama", name: "Local STT (Gemma)", modelType: "stt", contextWindow: 16000, capabilities: JSON.stringify(["transcription", "local"]) },
 
 
@@ -282,6 +292,29 @@ export const SEED_DATA: SeedData = {
     { id: "google/gemma-4-31b-it", providerId: "nvidia", name: "Gemma 4 31B (NVIDIA)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "google/gemma-3-27b-it", providerId: "nvidia", name: "Gemma 3 27B (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "z-ai/glm-5.1", providerId: "nvidia", name: "GLM 5.1 (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming"]) },
+
+    // ── MiniMax (fuente: platform.minimaxi.com) — OpenAI-compatible endpoint ──
+    { id: "MiniMax-M3", providerId: "minimax", name: "MiniMax M3", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "MiniMax-M2.7", providerId: "minimax", name: "MiniMax M2.7", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.7-highspeed", providerId: "minimax", name: "MiniMax M2.7 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5", providerId: "minimax", name: "MiniMax M2.5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5-highspeed", providerId: "minimax", name: "MiniMax M2.5 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+
+    // ── OpenCode Go (fuente: opencode.ai) — OpenAI-compatible endpoint ──
+    { id: "opencode-go/minimax-m3",         providerId: "opencode-go", name: "MiniMax M3",          modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/minimax-m2.7",       providerId: "opencode-go", name: "MiniMax M2.7",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/minimax-m2.5",       providerId: "opencode-go", name: "MiniMax M2.5",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.6",          providerId: "opencode-go", name: "Kimi K2.6",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.5",          providerId: "opencode-go", name: "Kimi K2.5",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5.1",            providerId: "opencode-go", name: "GLM-5.1",             modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5",              providerId: "opencode-go", name: "GLM-5",               modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/deepseek-v4-pro",    providerId: "opencode-go", name: "DeepSeek V4 Pro",     modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/deepseek-v4-flash",  providerId: "opencode-go", name: "DeepSeek V4 Flash",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2-pro",        providerId: "opencode-go", name: "MiMo-V2 Pro",         modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2-omni",       providerId: "opencode-go", name: "MiMo-V2 Omni",        modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2.5-pro",      providerId: "opencode-go", name: "MiMo-V2.5 Pro",       modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2.5",          providerId: "opencode-go", name: "MiMo-V2.5",           modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/hy3-preview",        providerId: "opencode-go", name: "Hunyuan 3 Preview",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
   ],
 
 
@@ -503,10 +536,13 @@ export function seedAllData(): void {
 
     let modelCount = 0;
     for (const model of SEED_DATA.models) {
+      // Local LLM models are always active so they appear in the selector
+      // (downloaded status is checked separately at runtime)
+      const isLocal = model.providerId === "local-llama";
       db.query(`
         INSERT OR REPLACE INTO models (id, provider_id, name, model_type, context_window, capabilities, enabled, active)
-        VALUES (?, ?, ?, ?, ?, ?, 1, 0)
-      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null)
+        VALUES (?, ?, ?, ?, ?, ?, 1, ?)
+      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null, isLocal ? 1 : 0)
       modelCount++;
     }
     db.run("PRAGMA foreign_keys = ON;");

package/packages/core/src/tool-runtime/index.ts

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs"
 import { fileURLToPath } from "node:url"
+import { dirname, join } from "node:path"
 import { availableParallelism } from "node:os"
 import type { Config } from "../config/loader.ts"
 import { loadConfig } from "../config/loader.ts"
@@ -110,8 +111,28 @@ function resolveWorkerEntry(): string {
     }
   }
 
+  const fallbacks: string[] = []
+  const envPath = process.env.HIVE_TOOL_WORKER_PATH
+  if (envPath) fallbacks.push(envPath)
+
+  try {
+    const execDir = dirname(process.execPath)
+    fallbacks.push(join(execDir, "tool-worker.js"))
+    fallbacks.push(join(execDir, "packages", "core", "src", "tool-runtime", "tool-worker.js"))
+  } catch {
+    // process.execPath is not available — skip execDir-based fallbacks
+  }
+
+  fallbacks.push("/app/tool-worker.js")
+
+  for (const filePath of fallbacks) {
+    if (existsSync(filePath)) {
+      return filePath
+    }
+  }
+
   throw new Error(
-    `Tool worker entry not found. Tried: ${candidates.map((candidate) => fileURLToPath(candidate)).join(", ")}`
+    `Tool worker entry not found. Tried: ${[...candidates.map((candidate) => fileURLToPath(candidate)), ...fallbacks].join(", ")}`
   )
 }
 

package/packages/core/src/tools/api/api-request.ts

@@ -0,0 +1,174 @@
+/**
+ * api_request - Make HTTP requests to REST APIs (curl-like)
+ *
+ * Supports: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS
+ * Features: custom headers, JSON/form body, query params, timeout
+ *
+ * @category api
+ * @seedId api_request
+ * @spanish llamar api, petición http, curl, post a api, put api, delete api
+ */
+
+import type { Tool } from "../types.ts";
+import { logger } from "../../utils/logger.ts";
+
+const log = logger.child("api-request");
+
+const ALLOWED_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"];
+
+export const apiRequestTool: Tool = {
+  name: "api_request",
+  description:
+    "Make an HTTP request to a REST API endpoint. Supports GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS with custom headers, body, and query parameters. " +
+    "Spanish: llamar api, petición http, curl, post a api, put api, delete api, consumir servicio rest",
+  parameters: {
+    type: "object",
+    properties: {
+      method: {
+        type: "string",
+        description: "HTTP method: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS",
+        enum: ALLOWED_METHODS,
+      },
+      url: {
+        type: "string",
+        description: "Full URL of the API endpoint (including query string, or use query_params)",
+      },
+      headers: {
+        type: "object",
+        description: "Optional HTTP headers as key-value pairs. Example: {\"Content-Type\": \"application/json\", \"Authorization\": \"Bearer token\"}",
+        additionalProperties: { type: "string" },
+      },
+      body: {
+        type: "string",
+        description: "Optional request body as a string. For JSON APIs, pass a JSON string. For form data, pass URL-encoded string.",
+      },
+      query_params: {
+        type: "object",
+        description: "Optional query parameters as key-value pairs. Will be URL-encoded and appended to the URL.",
+        additionalProperties: { type: "string" },
+      },
+      timeout_ms: {
+        type: "number",
+        description: "Request timeout in milliseconds. Default: 30000 (30s). Max: 120000 (2 min).",
+        minimum: 1000,
+        maximum: 120000,
+      },
+    },
+    required: ["method", "url"],
+  },
+  execute: async (params: Record<string, unknown>) => {
+    const method = (params.method as string)?.toUpperCase().trim() || "GET";
+    let url = params.url as string;
+    const headers = (params.headers as Record<string, string>) || {};
+    const body = params.body as string | undefined;
+    const queryParams = (params.query_params as Record<string, string>) || {};
+    const timeoutMs = (params.timeout_ms as number) || 30000;
+
+    if (!ALLOWED_METHODS.includes(method)) {
+      return {
+        ok: false,
+        error: `Invalid HTTP method: ${method}. Allowed: ${ALLOWED_METHODS.join(", ")}`,
+      };
+    }
+
+    if (!url || typeof url !== "string") {
+      return {
+        ok: false,
+        error: "Missing required parameter: url",
+      };
+    }
+
+    // Append query params to URL
+    if (Object.keys(queryParams).length > 0) {
+      const urlObj = new URL(url);
+      for (const [key, value] of Object.entries(queryParams)) {
+        urlObj.searchParams.append(key, value);
+      }
+      url = urlObj.toString();
+    }
+
+    log.info(`[api_request] ${method} ${url}`);
+
+    const fetchOptions: RequestInit = {
+      method,
+      headers: {
+        "User-Agent": "HiveAgent/1.0",
+        ...headers,
+      },
+      // @ts-ignore — Bun supports timeout
+      timeout: timeoutMs,
+    };
+
+    if (body !== undefined && body !== null && body !== "") {
+      // Auto-set Content-Type to application/json if body looks like JSON
+      if (
+        !headers["Content-Type"] &&
+        !headers["content-type"] &&
+        typeof body === "string" &&
+        (body.trim().startsWith("{") || body.trim().startsWith("["))
+      ) {
+        (fetchOptions.headers as Record<string, string>)["Content-Type"] = "application/json";
+      }
+      fetchOptions.body = body;
+    }
+
+    try {
+      const response = await fetch(url, fetchOptions);
+
+      // For HEAD requests, don't read body
+      if (method === "HEAD") {
+        const responseHeaders: Record<string, string> = {};
+        response.headers.forEach((value, key) => {
+          responseHeaders[key] = value;
+        });
+        return {
+          ok: response.ok,
+          status: response.status,
+          statusText: response.statusText,
+          headers: responseHeaders,
+          url: response.url,
+        };
+      }
+
+      const contentType = response.headers.get("content-type") || "";
+      let responseBody: string | object;
+      const rawText = await response.text();
+
+      if (contentType.includes("application/json")) {
+        try {
+          responseBody = JSON.parse(rawText);
+        } catch {
+          responseBody = rawText;
+        }
+      } else {
+        responseBody = rawText;
+      }
+
+      const responseHeaders: Record<string, string> = {};
+      response.headers.forEach((value, key) => {
+        responseHeaders[key] = value;
+      });
+
+      log.info(`[api_request] ${method} ${url} → ${response.status} ${response.statusText}`);
+
+      return {
+        ok: response.ok,
+        status: response.status,
+        statusText: response.statusText,
+        headers: responseHeaders,
+        body: responseBody,
+        contentType,
+        url: response.url,
+      };
+    } catch (error) {
+      const msg = (error as Error).message;
+      log.error(`[api_request] ${method} ${url} failed: ${msg}`);
+      return {
+        ok: false,
+        error: `HTTP request failed: ${msg}`,
+        url,
+        method,
+      };
+    }
+  },
+};