@johpaz/hive-agents 0.0.38 → 0.0.40

package/packages/core/src/storage/crypto.ts

@@ -1,4 +1,5 @@
 import { logger } from "../utils/logger"
+import { getDb } from "./sqlite"
 
 const log = logger.child("crypto")
 const SERVICE = "hive"
@@ -12,30 +13,71 @@ const _mem = new Map<string, string>()
 let _keychainOk: boolean | null = null // null = untested
 
 async function _get(name: string): Promise<string | null> {
-  if (_keychainOk === false) return _mem.get(name) ?? null
+  if (_keychainOk === false) {
+    return _mem.get(name) ?? _readDbSecret(name)
+  }
   try {
     const val = await (Bun as any).secrets.get({ service: SERVICE, name })
     _keychainOk = true
-    return val ?? null
+    return val ?? _mem.get(name) ?? _readDbSecret(name)
   } catch {
     _keychainOk = false
-    return _mem.get(name) ?? null
+    return _mem.get(name) ?? _readDbSecret(name)
   }
 }
 
-async function _set(name: string, value: string): Promise<void> {
+async function _set(name: string, value: string): Promise<boolean> {
   if (_keychainOk === false) {
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
-    return
+    return persistSecretToDb(name, value)
   }
   try {
     await (Bun as any).secrets.set({ service: SERVICE, name, value })
     _keychainOk = true
+    return true
   } catch {
     _keychainOk = false
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
     _mem.set(name, value)
+    return persistSecretToDb(name, value)
+  }
+}
+
+/**
+ * Read a secret from its DB ciphertext column as a last-resort fallback
+ * when the keychain and in-memory map are both empty. Used to survive
+ * container restarts when the OS keychain is unavailable (Docker, headless).
+ */
+function _readDbSecret(name: string): string | null {
+  const parts = name.split(":")
+  if (parts.length !== 3) return null
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return null
+  }
+
+  try {
+    const db = getDb()
+    const row = db.query(
+      `SELECT ${column}_encrypted AS enc, ${column}_iv AS iv FROM ${table} WHERE id = ?`
+    ).get(id) as { enc: string | null; iv: string | null } | undefined
+    if (!row?.enc || !row?.iv) return null
+    const plain = legacyDecryptAES(row.enc, row.iv)
+    if (plain) {
+      // Cache in memory for subsequent lookups in this process
+      _mem.set(name, plain)
+    }
+    return plain || null
+  } catch {
+    return null
   }
 }
 
@@ -64,16 +106,22 @@ export async function deleteSecret(name: string): Promise<void> {
 
 // ─── Provider secrets ────────────────────────────────────────────────────────
 
-export async function storeProviderApiKey(id: string, apiKey: string): Promise<void> {
-  await _set(`provider:${id}:api_key`, apiKey)
+/**
+ * Returns true if the secret was persisted to a durable store (OS keychain
+ * or DB-backed fallback). Returns false if it ended up in the per-process
+ * in-memory map only — useful so callers can avoid destructive actions
+ * (like nulling the DB ciphertext) that would lose data on restart.
+ */
+export async function storeProviderApiKey(id: string, apiKey: string): Promise<boolean> {
+  return await _set(`provider:${id}:api_key`, apiKey)
 }
 
 export async function loadProviderApiKey(id: string): Promise<string> {
   return (await _get(`provider:${id}:api_key`)) ?? ""
 }
 
-export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`provider:${id}:headers`, JSON.stringify(headers))
+export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`provider:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadProviderHeaders(id: string): Promise<Record<string, unknown>> {
@@ -90,8 +138,8 @@ export async function deleteProviderSecrets(id: string): Promise<void> {
 
 // ─── Channel secrets ─────────────────────────────────────────────────────────
 
-export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<void> {
-  await _set(`channel:${id}:config`, JSON.stringify(config))
+export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<boolean> {
+  return await _set(`channel:${id}:config`, JSON.stringify(config))
 }
 
 export async function loadChannelConfig(id: string): Promise<Record<string, unknown>> {
@@ -105,8 +153,8 @@ export async function deleteChannelSecrets(id: string): Promise<void> {
 
 // ─── MCP secrets ──────────────────────────────────────────────────────────────
 
-export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`mcp:${id}:headers`, JSON.stringify(headers))
+export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`mcp:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadMcpHeaders(id: string): Promise<Record<string, unknown>> {
@@ -114,8 +162,8 @@ export async function loadMcpHeaders(id: string): Promise<Record<string, unknown
   return raw ? JSON.parse(raw) : {}
 }
 
-export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<void> {
-  await _set(`mcp:${id}:env`, JSON.stringify(env))
+export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<boolean> {
+  return await _set(`mcp:${id}:env`, JSON.stringify(env))
 }
 
 export async function loadMcpEnv(id: string): Promise<Record<string, string>> {
@@ -132,8 +180,8 @@ export async function deleteMcpSecrets(id: string): Promise<void> {
 
 // ─── Agent secrets ────────────────────────────────────────────────────────────
 
-export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`agent:${id}:headers`, JSON.stringify(headers))
+export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`agent:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadAgentHeaders(id: string): Promise<Record<string, unknown>> {
@@ -182,7 +230,7 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
     const keyPath = nodePath.join(hiveDir, ".master.key")
     if (!nodeFs.existsSync(keyPath)) return ""
-    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf-8").trim(), "hex")
+    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
   }
 
   try {
@@ -195,3 +243,87 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
     return ""
   }
 }
+
+function getMasterKey(): Buffer | null {
+  const nodeCrypto = require("node:crypto")
+  const nodeFs = require("node:fs")
+  const nodePath = require("node:path")
+  const nodeOs = require("node:os")
+
+  const masterKey = process.env.HIVE_MASTER_KEY
+  if (masterKey) {
+    return Buffer.from(masterKey.slice(0, 32).padEnd(32, "0"), "utf8")
+  }
+  const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
+  const keyPath = nodePath.join(hiveDir, ".master.key")
+  if (!nodeFs.existsSync(keyPath)) return null
+  try {
+    return Buffer.from(nodeFs.readFileSync(keyPath, "utf8").trim(), "hex")
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Encrypt a plaintext string using the same AES-256-GCM scheme as the legacy
+ * store. Format: `<encDataHex>:<authTagHex>`. Used as a DB-backed fallback
+ * when the OS keychain is unavailable (headless Linux, Docker, etc.).
+ */
+export function legacyEncryptAES(plain: string, ivHex: string): string {
+  const nodeCrypto = require("node:crypto")
+  const key = getMasterKey()
+  if (!key) return ""
+  try {
+    const iv = Buffer.from(ivHex, "hex")
+    const cipher = nodeCrypto.createCipheriv("aes-256-gcm", key, iv)
+    const encData = cipher.update(plain, "utf8", "hex") + cipher.final("hex")
+    const authTag = cipher.getAuthTag().toString("hex")
+    return `${encData}:${authTag}`
+  } catch {
+    return ""
+  }
+}
+
+/**
+ * DB-backed persistence fallback for secrets. Maps the canonical secret
+ * name (e.g. `provider:openai:api_key`) to the matching ciphertext column
+ * and updates the row in-place. Returns true if the row was written.
+ */
+function persistSecretToDb(name: string, value: string): boolean {
+  const nodeCrypto = require("node:crypto")
+  const parts = name.split(":")
+  if (parts.length !== 3) return false
+  const [kind, id, field] = parts
+
+  let table: string
+  let column: string
+  switch (`${kind}:${field}`) {
+    case "provider:api_key": table = "providers"; column = "api_key"; break
+    case "provider:headers":  table = "providers"; column = "headers"; break
+    case "channel:config":    table = "channels";  column = "config"; break
+    case "mcp:headers":       table = "mcp_servers"; column = "headers"; break
+    case "mcp:env":           table = "mcp_servers"; column = "env"; break
+    case "agent:headers":     table = "agents"; column = "headers"; break
+    default: return false
+  }
+
+  const key = getMasterKey()
+  if (!key) {
+    log.warn(`[secrets] No master key in ${process.env.HIVE_HOME || "~/.hive"}/.master.key — cannot persist ${name} to DB fallback`)
+    return false
+  }
+
+  const iv = nodeCrypto.randomBytes(12).toString("hex")
+  const enc = legacyEncryptAES(value, iv)
+  if (!enc) return false
+
+  try {
+    const db = getDb()
+    db.query(`UPDATE ${table} SET ${column}_encrypted = ?, ${column}_iv = ? WHERE id = ?`)
+      .run(enc, iv, id)
+    return true
+  } catch (err) {
+    log.warn(`[secrets] DB fallback failed for ${name}: ${(err as Error).message}`)
+    return false
+  }
+}

package/packages/core/src/storage/migrate.ts

@@ -39,25 +39,38 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const p of providers) {
     if (p.api_key_encrypted && p.api_key_iv) {
       const existing = await loadProviderApiKey(p.id)
+      let stored = !!existing
       if (!existing) {
         const plain = legacyDecryptAES(p.api_key_encrypted, p.api_key_iv)
         if (plain) {
-          await storeProviderApiKey(p.id, plain)
-          migrated++
+          stored = await storeProviderApiKey(p.id, plain)
+          if (stored) migrated++
         }
       }
-      db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      // Only null the DB ciphertext when the secret reached a durable store
+      // (OS keychain or DB-backed fallback). In-memory fallback would lose
+      // the secret on the next process restart.
+      if (stored) {
+        db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES ciphertext for ${p.id} (will retry next start)`)
+      }
     }
 
     if (p.headers_encrypted && p.headers_iv) {
       const plain = legacyDecryptAES(p.headers_encrypted, p.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeProviderHeaders(p.id, JSON.parse(plain))
-          migrated++
+          stored = await storeProviderHeaders(p.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore JSON parse errors */ }
       }
-      db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      if (stored) {
+        db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping AES headers ciphertext for ${p.id}`)
+      }
     }
   }
 
@@ -74,13 +87,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const c of channels) {
     const plain = legacyDecryptAES(c.config_encrypted, c.config_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeChannelConfig(c.id, JSON.parse(plain))
-        migrated++
+        stored = await storeChannelConfig(c.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore JSON parse errors */ }
     }
-    db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    if (stored) {
+      db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping channel config for ${c.id}`)
+    }
   }
 
   // ── MCP servers ────────────────────────────────────────────────────────────
@@ -99,23 +117,33 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
   for (const m of mcpServers) {
     if (m.headers_encrypted && m.headers_iv) {
       const plain = legacyDecryptAES(m.headers_encrypted, m.headers_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpHeaders(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpHeaders(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP headers for ${m.id}`)
+      }
     }
     if (m.env_encrypted && m.env_iv) {
       const plain = legacyDecryptAES(m.env_encrypted, m.env_iv)
+      let stored = false
       if (plain) {
         try {
-          await storeMcpEnv(m.id, JSON.parse(plain))
-          migrated++
+          stored = await storeMcpEnv(m.id, JSON.parse(plain))
+          if (stored) migrated++
         } catch { /* ignore */ }
       }
-      db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      if (stored) {
+        db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+      } else {
+        log.warn(`[migrate] keychain unavailable — keeping MCP env for ${m.id}`)
+      }
     }
   }
 
@@ -132,13 +160,18 @@ export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
 
   for (const a of agents) {
     const plain = legacyDecryptAES(a.headers_encrypted, a.headers_iv)
+    let stored = false
     if (plain) {
       try {
-        await storeAgentHeaders(a.id, JSON.parse(plain))
-        migrated++
+        stored = await storeAgentHeaders(a.id, JSON.parse(plain))
+        if (stored) migrated++
       } catch { /* ignore */ }
     }
-    db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    if (stored) {
+      db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+    } else {
+      log.warn(`[migrate] keychain unavailable — keeping agent headers for ${a.id}`)
+    }
   }
 
   if (migrated > 0) {

package/packages/core/src/storage/onboarding.ts

@@ -1500,6 +1500,34 @@ export function runStartupMigrations(): void {
     markApplied("v0.0.32");
     log.info("✅ Migration v0.0.32: vision columns added to channels");
   }
+
+  // v0.0.33 — add HiveAgents LLM provider + 5 local GGUF models
+  if (!applied("v0.0.33")) {
+    const db = getDb();
+    log.info("[migration v0.0.33] Adding HiveAgents LLM provider and models...");
+
+    db.query(`
+      INSERT OR IGNORE INTO providers (id, name, base_url, category, enabled, active)
+      VALUES ('hiveagents', 'HiveAgents LLM (Cloudflare)', 'https://llm.hiveagents.io/v1', 'llm', 1, 1)
+    `).run();
+
+    const hiveModels = [
+      { id: "Qwen3.6-35B-A3B-UD-Q6_K.gguf",       name: "Qwen3.6 35B MoE (Recomendado)", ctx: 8192, caps: '["chat","streaming","reasoning"]' },
+      { id: "gemma-4-26B-A4B-it-UD-Q6_K_XL.gguf", name: "Gemma 4 26B MoE",               ctx: 8192, caps: '["chat","streaming"]' },
+      { id: "gemma-4-12b-it-UD-Q4_K_XL.gguf",     name: "Gemma 4 12B Dense",             ctx: 8192, caps: '["chat","streaming"]' },
+      { id: "Qwen3.6-27B-UD-Q6_K_XL.gguf",         name: "Qwen3.6 27B + MTP",             ctx: 8192, caps: '["chat","streaming","reasoning"]' },
+      { id: "gemma-4-31B-it-UD-Q6_K_XL.gguf",     name: "Gemma 4 31B Dense",             ctx: 8192, caps: '["chat","streaming"]' },
+    ];
+    for (const m of hiveModels) {
+      db.query(`
+        INSERT OR IGNORE INTO models (id, provider_id, name, model_type, context_window, capabilities, enabled, active)
+        VALUES (?, 'hiveagents', ?, 'llm', ?, ?, 1, 1)
+      `).run(m.id, m.name, m.ctx, m.caps);
+    }
+
+    markApplied("v0.0.33");
+    log.info("✅ Migration v0.0.33: HiveAgents LLM provider + 5 models added");
+  }
   } catch (e) {
     log.error("⚠️ runStartupMigrations failed:", { error: (e as Error).message });
   }

package/packages/core/src/storage/seed.ts

@@ -139,7 +139,10 @@ export const SEED_DATA: SeedData = {
     { id: "elevenlabs", name: "ElevenLabs", baseUrl: "https://api.elevenlabs.io/v1" },
     { id: "qwen", name: "Qwen (Alibaba)", baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1", category: "llm" },
     { id: "nvidia", name: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1" },
+    { id: "minimax", name: "MiniMax", baseUrl: "https://api.minimaxi.com/v1" },
+    { id: "opencode-go", name: "OpenCode Go", baseUrl: "https://opencode.ai/zen/go/v1" },
     { id: "piper", name: "Piper (Local TTS)" },
+    { id: "hiveagents", name: "HiveAgents LLM (Cloudflare)", baseUrl: "https://llm.hiveagents.io/v1", category: "llm" },
   ],
 
   models: [
@@ -249,6 +252,14 @@ export const SEED_DATA: SeedData = {
     { id: "e2b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "stt", "local"]) },
     { id: "e4b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "text", "vision", "stt", "local"]) },
     { id: "e4b_vision", providerId: "local-llama", name: "Gemma 4 4B Vision (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_12b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 12B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_26b_Q4_K_M", providerId: "local-llama", name: "Gemma 4 26B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "gemma4_31b_Q4_K_XL", providerId: "local-llama", name: "Gemma 4 31B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "vision", "local"]) },
+    { id: "qwen3_5_2b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 2B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_4b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 4B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_9b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 9B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_27b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 27B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
+    { id: "qwen3_5_35b_Q4_K_XL", providerId: "local-llama", name: "Qwen 3.5 35B (Local)", modelType: "llm", contextWindow: 16000, capabilities: JSON.stringify(["chat", "local"]) },
     { id: "local_stt", providerId: "local-llama", name: "Local STT (Gemma)", modelType: "stt", contextWindow: 16000, capabilities: JSON.stringify(["transcription", "local"]) },
 
 
@@ -282,6 +293,42 @@ export const SEED_DATA: SeedData = {
     { id: "google/gemma-4-31b-it", providerId: "nvidia", name: "Gemma 4 31B (NVIDIA)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "google/gemma-3-27b-it", providerId: "nvidia", name: "Gemma 3 27B (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]) },
     { id: "z-ai/glm-5.1", providerId: "nvidia", name: "GLM 5.1 (NVIDIA)", modelType: "llm", contextWindow: 131072, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming"]) },
+
+    // ── MiniMax (fuente: platform.minimaxi.com) — OpenAI-compatible endpoint ──
+    { id: "MiniMax-M3", providerId: "minimax", name: "MiniMax M3", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "MiniMax-M2.7", providerId: "minimax", name: "MiniMax M2.7", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.7-highspeed", providerId: "minimax", name: "MiniMax M2.7 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5", providerId: "minimax", name: "MiniMax M2.5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "MiniMax-M2.5-highspeed", providerId: "minimax", name: "MiniMax M2.5 Highspeed", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+
+    // ── OpenCode Go (fuente: opencode.ai) — OpenAI-compatible endpoint ──
+    { id: "opencode-go/minimax-m3",         providerId: "opencode-go", name: "MiniMax M3",          modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/minimax-m2.7",       providerId: "opencode-go", name: "MiniMax M2.7",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/minimax-m2.5",       providerId: "opencode-go", name: "MiniMax M2.5",        modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.6",          providerId: "opencode-go", name: "Kimi K2.6",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/kimi-k2.5",          providerId: "opencode-go", name: "Kimi K2.5",           modelType: "llm", contextWindow: 262144,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5.1",            providerId: "opencode-go", name: "GLM-5.1",             modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/glm-5",              providerId: "opencode-go", name: "GLM-5",               modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/deepseek-v4-pro",    providerId: "opencode-go", name: "DeepSeek V4 Pro",     modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/deepseek-v4-flash",  providerId: "opencode-go", name: "DeepSeek V4 Flash",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2-pro",        providerId: "opencode-go", name: "MiMo-V2 Pro",         modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2-omni",       providerId: "opencode-go", name: "MiMo-V2 Omni",        modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/mimo-v2.5-pro",      providerId: "opencode-go", name: "MiMo-V2.5 Pro",       modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]) },
+    { id: "opencode-go/mimo-v2.5",          providerId: "opencode-go", name: "MiMo-V2.5",           modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+    { id: "opencode-go/hy3-preview",        providerId: "opencode-go", name: "Hunyuan 3 Preview",   modelType: "llm", contextWindow: 128000,  capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]) },
+
+    // ── HiveAgents (llama.cpp local, acceso vía Cloudflare) ──
+    // IDs actualizados según modelos disponibles en https://llm.hiveagents.io
+    // contextWindow = 50000 porque así se cargan en el backend.
+    { id: "Qwen3.6-35B-A3B-UD-Q6_K.gguf",      providerId: "hiveagents", name: "Qwen3.6 35B MoE (Recomendado)", modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "reasoning"]) },
+    { id: "Qwen3.6-35B-A3B-UD-Q4_K_M.gguf",    providerId: "hiveagents", name: "Qwen3.6 35B MoE (Q4_K_M)",     modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "reasoning"]) },
+    { id: "Qwen3.6-27B-UD-Q4_K_XL.gguf",       providerId: "hiveagents", name: "Qwen3.6 27B + MTP",            modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "reasoning"]) },
+    { id: "Qwen3-Coder-Next-UD-Q4_K_M.gguf",    providerId: "hiveagents", name: "Qwen3 Coder Next",             modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "code"]) },
+    { id: "Qwopus3.6-27B-v2-MTP-Q6_K.gguf",    providerId: "hiveagents", name: "Qwopus3.6 27B v2 (Q6_K)",      modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "reasoning"]) },
+    { id: "Qwopus3.6-27B-v2-MTP-Q4_K_S.gguf",  providerId: "hiveagents", name: "Qwopus3.6 27B v2 (Q4_K_S)",    modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming", "reasoning"]) },
+    { id: "gemma-4-31B-it-UD-Q4_K_XL.gguf",    providerId: "hiveagents", name: "Gemma 4 31B Dense",            modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming"]) },
+    { id: "gemma-4-26B-A4B-it-UD-Q4_K_M.gguf", providerId: "hiveagents", name: "Gemma 4 26B MoE",              modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming"]) },
+    { id: "gemma-4-12b-it-UD-Q4_K_XL.gguf",    providerId: "hiveagents", name: "Gemma 4 12B Dense",            modelType: "llm", contextWindow: 50000, capabilities: JSON.stringify(["chat", "streaming"]) },
   ],
 
 
@@ -503,10 +550,13 @@ export function seedAllData(): void {
 
     let modelCount = 0;
     for (const model of SEED_DATA.models) {
+      // Local LLM models are always active so they appear in the selector
+      // (downloaded status is checked separately at runtime)
+      const isLocal = model.providerId === "local-llama";
       db.query(`
         INSERT OR REPLACE INTO models (id, provider_id, name, model_type, context_window, capabilities, enabled, active)
-        VALUES (?, ?, ?, ?, ?, ?, 1, 0)
-      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null)
+        VALUES (?, ?, ?, ?, ?, ?, 1, ?)
+      `).run(model.id, model.providerId, model.name, model.modelType, model.contextWindow || null, model.capabilities || null, isLocal ? 1 : 0)
       modelCount++;
     }
     db.run("PRAGMA foreign_keys = ON;");

package/packages/core/src/tool-runtime/index.ts

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs"
 import { fileURLToPath } from "node:url"
+import { dirname, join } from "node:path"
 import { availableParallelism } from "node:os"
 import type { Config } from "../config/loader.ts"
 import { loadConfig } from "../config/loader.ts"
@@ -110,8 +111,28 @@ function resolveWorkerEntry(): string {
     }
   }
 
+  const fallbacks: string[] = []
+  const envPath = process.env.HIVE_TOOL_WORKER_PATH
+  if (envPath) fallbacks.push(envPath)
+
+  try {
+    const execDir = dirname(process.execPath)
+    fallbacks.push(join(execDir, "tool-worker.js"))
+    fallbacks.push(join(execDir, "packages", "core", "src", "tool-runtime", "tool-worker.js"))
+  } catch {
+    // process.execPath is not available — skip execDir-based fallbacks
+  }
+
+  fallbacks.push("/app/tool-worker.js")
+
+  for (const filePath of fallbacks) {
+    if (existsSync(filePath)) {
+      return filePath
+    }
+  }
+
   throw new Error(
-    `Tool worker entry not found. Tried: ${candidates.map((candidate) => fileURLToPath(candidate)).join(", ")}`
+    `Tool worker entry not found. Tried: ${[...candidates.map((candidate) => fileURLToPath(candidate)), ...fallbacks].join(", ")}`
   )
 }