@johpaz/hive-sdk 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## Sin publicar
+
+### Seguridad
+
+- **`sanitizeDiagnostic` dejaba el token en claro detrás del esquema de auth.**
+  La regex consumía sólo la palabra `Bearer`, así que un diagnóstico con
+  `authorization: Bearer <token>` quedaba como `authorization: [REDACTED] <token>`
+  y la credencial viajaba al prompt del coordinador. Afecta a **0.1.5 y
+  anteriores**: el archivo viaja en el tarball publicado.
+
+### Corregido
+
+- Se fijaron las 8 dependencias que estaban en `latest` (`zod`, `discord.js`,
+  `grammy`, `@slack/bolt`, `@whiskeysockets/baileys`, `@modelcontextprotocol/sdk`,
+  `qrcode-terminal`, `@sapphire/snowflake`). Como `bun.lock` no se publica, cada
+  instalación resolvía `latest` de nuevo: el SDK ya estaba corriendo
+  `@slack/bolt` **5.0.0** mientras hive, con el mismo código de canales, corría
+  **4.7.x**. Ahora quedan alineados.
+
+### Añadido
+
+- **Backend de navegador intercambiable.** Las tools hablan con la interfaz
+  `BrowserBackend`; además del `agent-browser` de siempre (default, sin cambios)
+  hay un `WebViewBackend` sobre `Bun.WebView`, in-process, sin instalación de
+  ~75 MB ni descarga de Chrome. Se elige con `tools.browser.backend`
+  (`"agent-browser" | "webview" | "auto"`) o `HIVE_BROWSER_BACKEND`.
+- Cobertura de `acceptance-checks` (27 tests), del backend de navegador (27) y
+  del selector con tools registradas en runtime (6).
+- Workflow de CI: typecheck, tests, verificación de aislamiento de la base, y un
+  job que genera un scaffold con `create-app` y lo typechequea contra el SDK de
+  ese commit.
+
 ## 0.1.5
 
 Sincronización del SDK con el runtime de agentes de `hive`. **Trae rupturas de

package/README.md

@@ -212,4 +212,4 @@ npm view @johpaz/hive-sdk dist-tags   # verificar después del release
 
 ---
 
-*Hive SDK v0.1.5 — MIT*
+*Hive SDK v0.1.6 — MIT*

package/bun.lock

@@ -8,16 +8,16 @@
         "@anthropic-ai/sdk": "^0.74.0",
         "@google/genai": "^1.43.0",
         "@johpaz/hive-db": "^0.4.0",
-        "@modelcontextprotocol/sdk": "latest",
-        "@sapphire/snowflake": "latest",
-        "@slack/bolt": "latest",
-        "@whiskeysockets/baileys": "latest",
+        "@modelcontextprotocol/sdk": "^1.26.0",
+        "@sapphire/snowflake": "^3.5.5",
+        "@slack/bolt": "^4.7.2",
+        "@whiskeysockets/baileys": "7.0.0-rc11",
         "async-mutex": "^0.5.0",
         "cron-parser": "^5.5.0",
         "croner": "^10.0.1",
-        "discord.js": "latest",
+        "discord.js": "^14.26.4",
         "docx": "^9.6.1",
-        "grammy": "latest",
+        "grammy": "^1.42.0",
         "groq-sdk": "^0.37.0",
         "jsonwebtoken": "^9.0.3",
         "jszip": "^3.10.1",
@@ -27,10 +27,10 @@
         "pdf-lib": "^1.17.1",
         "pdfjs-dist": "^5.6.205",
         "pptxgenjs": "^4.0.1",
-        "qrcode-terminal": "latest",
+        "qrcode-terminal": "^0.12.0",
         "toon-format-parser": "^1.1.0",
         "xlsx": "^0.18.5",
-        "zod": "latest",
+        "zod": "^4.4.3",
       },
       "devDependencies": {
         "@types/bun": "^1.3.13",
@@ -40,7 +40,7 @@
     },
     "packages/cli": {
       "name": "@hive/cli",
-      "version": "0.0.15",
+      "version": "0.1.5",
       "bin": {
         "hive": "./src/index.ts",
       },
@@ -50,21 +50,21 @@
     },
     "packages/core": {
       "name": "@hive/core",
-      "version": "0.0.15",
+      "version": "0.1.5",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.74.0",
         "@google/genai": "^1.43.0",
         "@johpaz/hive-db": "^0.4.0",
-        "@modelcontextprotocol/sdk": "latest",
-        "@sapphire/snowflake": "latest",
-        "@slack/bolt": "latest",
-        "@whiskeysockets/baileys": "latest",
+        "@modelcontextprotocol/sdk": "^1.26.0",
+        "@sapphire/snowflake": "^3.5.5",
+        "@slack/bolt": "^4.7.2",
+        "@whiskeysockets/baileys": "7.0.0-rc11",
         "async-mutex": "^0.5.0",
         "cron-parser": "^5.5.0",
         "croner": "^10.0.1",
-        "discord.js": "latest",
+        "discord.js": "^14.26.4",
         "docx": "^9.6.1",
-        "grammy": "latest",
+        "grammy": "^1.42.0",
         "groq-sdk": "^0.37.0",
         "jsonwebtoken": "^9.0.3",
         "jszip": "^3.10.1",
@@ -74,10 +74,10 @@
         "pdf-lib": "^1.17.1",
         "pdfjs-dist": "^5.6.205",
         "pptxgenjs": "^4.0.1",
-        "qrcode-terminal": "latest",
+        "qrcode-terminal": "^0.12.0",
         "toon-format-parser": "^1.1.0",
         "xlsx": "^0.18.5",
-        "zod": "latest",
+        "zod": "^4.4.3",
       },
       "devDependencies": {
         "@types/jsonwebtoken": "^9.0.10",
@@ -258,17 +258,17 @@
 
     "@sapphire/snowflake": ["@sapphire/snowflake@3.5.5", "", {}, "sha512-xzvBr1Q1c4lCe7i6sRnrofxeO1QTP/LKQ6A6qy0iB4x5yfiSfARMEQEghojzTNALDTcv8En04qYNIco9/K9eZQ=="],
 
-    "@slack/bolt": ["@slack/bolt@5.0.0", "", { "dependencies": { "@slack/logger": "^5.0.0", "@slack/oauth": "^4.0.0", "@slack/socket-mode": "^3.0.0", "@slack/types": "^3.0.0", "@slack/web-api": "^8.0.0", "express": "^5.0.0", "path-to-regexp": "^8.1.0", "raw-body": "^3", "tsscmp": "^1.0.6" }, "peerDependencies": { "@types/express": "^5.0.0" } }, "sha512-L0FTzidrDKTu4Ph8sdv0bB3acafBTAC02TBcD+hojPTTNSMX3hSK+rkpkUKkqbbc0vGpSjd6A/g71Rjy7EbBhw=="],
+    "@slack/bolt": ["@slack/bolt@4.7.3", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/oauth": "^3.0.5", "@slack/socket-mode": "^2.0.7", "@slack/types": "^2.21.1", "@slack/web-api": "^7.16.0", "axios": "^1.12.0", "express": "^5.0.0", "path-to-regexp": "^8.1.0", "raw-body": "^3", "tsscmp": "^1.0.6" }, "peerDependencies": { "@types/express": "^5.0.0" } }, "sha512-bODs8q/yNDWUPoxmQhFrRqLMA5vhB/PDizYWqb6CkQhLWEUo5JFtfJcmeU4ElGl6qSt++OKjSYNa4MPc77CleQ=="],
 
-    "@slack/logger": ["@slack/logger@5.0.0", "", { "dependencies": { "@types/node": ">=20" } }, "sha512-VGXhmmgsAo9shdQYh4tFDndd+7nsgp0Y5h0UPDaUp8K359pBasI6YdkMqFW3mCOxLQkq09qj7o7cq6f3DuXcJQ=="],
+    "@slack/logger": ["@slack/logger@4.0.1", "", { "dependencies": { "@types/node": ">=18" } }, "sha512-6cmdPrV/RYfd2U0mDGiMK8S7OJqpCTm7enMLRR3edccsPX8j7zXTLnaEF4fhxxJJTAIOil6+qZrnUPTuaLvwrQ=="],
 
-    "@slack/oauth": ["@slack/oauth@4.0.0", "", { "dependencies": { "@slack/logger": "^5.0.0", "@slack/web-api": "^8.0.0", "@types/jsonwebtoken": "^9", "@types/node": ">=20", "jsonwebtoken": "^9" } }, "sha512-Aqs5bGghT+VtNcdwVOQy7CcyCfDNd9YYnZsCRukIF9p1Mxuq4uL+BjqlWQB0SeS4wzrLzePPgvj8JDuQil+ezA=="],
+    "@slack/oauth": ["@slack/oauth@3.0.5", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/web-api": "^7.15.0", "@types/jsonwebtoken": "^9", "@types/node": ">=18", "jsonwebtoken": "^9" } }, "sha512-exqFQySKhNDptWYSWhvRUJ4/+ndu2gayIy7vg/JfmJq3wGtGdHk531P96fAZyBm5c1Le3yaPYqv92rL4COlU3A=="],
 
-    "@slack/socket-mode": ["@slack/socket-mode@3.0.0", "", { "dependencies": { "@slack/logger": "^5.0.0", "@slack/web-api": "^8.0.0", "@types/node": ">=20", "eventemitter3": "^5" }, "peerDependencies": { "undici": "^7.0.0" } }, "sha512-QShO60SB0E+HH+TbcKj3CBEQbodToRyiXnxuSB4t1kvUlqEmuGA1nOOjrRDkDJbOECAZ13PLe4ek9SrntpfoYg=="],
+    "@slack/socket-mode": ["@slack/socket-mode@2.0.7", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/web-api": "^7.15.0", "@types/node": ">=18", "@types/ws": "^8", "eventemitter3": "^5", "ws": "^8" } }, "sha512-qYy07je71WnEHgRwmw12DlAnZLi5HXmdlI2WUzUK2LH/rYXQpP6uEg462S5CwfE8FoCKUdIigHtYnOOfzZH1lQ=="],
 
-    "@slack/types": ["@slack/types@3.0.0", "", {}, "sha512-KNOqpnNAlsFt5Jk9XBclslQ0lobRIg/0tnhpmvZJAglHJx9E8oceN8hC3gaBzkR6UzQ9Wzq4rLsJ98wUcxWPfw=="],
+    "@slack/types": ["@slack/types@2.22.0", "", {}, "sha512-sZ9lIgJhPX2qft/tKWiklFlc0o1FWeI7QtciZJfW1+ErH1eGGHvOZ8e73sleTCFEFJp1q/R0WeS8Oa7AsiDprg=="],
 
-    "@slack/web-api": ["@slack/web-api@8.0.0", "", { "dependencies": { "@slack/logger": "^5.0.0", "@slack/types": "^3.0.0", "@types/node": ">=20", "@types/retry": "0.12.0", "eventemitter3": "^5.0.1", "p-queue": "^6", "p-retry": "^4", "retry": "^0.13.1" } }, "sha512-ORx3XQryQPq2Jnxv5giSKXVoQRUeylrrymIR2S9fPzLjPcCts8RayMeBSZMcpfpAqp6fnBRuPW2UB6dUPUTEZA=="],
+    "@slack/web-api": ["@slack/web-api@7.19.0", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/types": "^2.21.0", "@types/node": ">=18", "@types/retry": "0.12.0", "axios": "^1.16.0", "eventemitter3": "^5.0.1", "form-data": "^4.0.4", "is-electron": "2.2.2", "is-stream": "^2", "p-queue": "^6", "p-retry": "^4", "retry": "^0.13.1" } }, "sha512-ItjyjEZml+LDH8CjcCLRLJHh7VZtevPKExrRN3l5KWyBliyDnGAeoO4Y+K+fFBmRpKLYVPgqWMX4THldv2HVtA=="],
 
     "@tokenizer/inflate": ["@tokenizer/inflate@0.4.1", "", { "dependencies": { "debug": "^4.4.3", "token-types": "^6.1.1" } }, "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA=="],
 
@@ -308,7 +308,7 @@
 
     "@vladfrangu/async_event_emitter": ["@vladfrangu/async_event_emitter@2.4.7", "", {}, "sha512-Xfe6rpCTxSxfbswi/W/Pz7zp1WWSNn4A0eW4mLkQUewCrXXtMj31lCg+iQyTkh/CkusZSq9eDflu7tjEDXUY6g=="],
 
-    "@whiskeysockets/baileys": ["@whiskeysockets/baileys@7.0.0-rc13", "", { "dependencies": { "@cacheable/node-cache": "^1.4.0", "@hapi/boom": "^9.1.3", "async-mutex": "^0.5.0", "libsignal": "^6.0.0", "lru-cache": "^11.1.0", "music-metadata": "^11.12.3", "p-queue": "^9.0.0", "pino": "^9.6", "protobufjs": "^7.5.6", "whatsapp-rust-bridge": "0.5.4", "ws": "^8.13.0" }, "peerDependencies": { "audio-decode": "^2.1.3", "jimp": "^1.6.1", "link-preview-js": "^3.0.0", "sharp": "*" }, "optionalPeers": ["audio-decode", "jimp", "link-preview-js"] }, "sha512-8JPc8gaaCRykkjW2jxLGQ7/RZGrc7awO7WU+QJocf58eSUI9jAdcuYLynzhAbyU4UWvJJsHImZ+5E/JaZj5ypA=="],
+    "@whiskeysockets/baileys": ["@whiskeysockets/baileys@7.0.0-rc11", "", { "dependencies": { "@cacheable/node-cache": "^1.4.0", "@hapi/boom": "^9.1.3", "async-mutex": "^0.5.0", "libsignal": "^6.0.0", "lru-cache": "^11.1.0", "music-metadata": "^11.12.3", "p-queue": "^9.0.0", "pino": "^9.6", "protobufjs": "^7.5.6", "whatsapp-rust-bridge": "0.5.4", "ws": "^8.13.0" }, "peerDependencies": { "audio-decode": "^2.1.3", "jimp": "^1.6.1", "link-preview-js": "^3.0.0", "sharp": "*" }, "optionalPeers": ["audio-decode", "jimp", "link-preview-js"] }, "sha512-4FKCVZR8mGz7oy6aRJgcBdM5t1CjzzDOedfccphwJao5BAy6RKCTTDbjyOaJejCkYDwjkEADpZBRmKDxvGmoUQ=="],
 
     "@xmldom/xmldom": ["@xmldom/xmldom@0.8.13", "", {}, "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw=="],
 
@@ -318,7 +318,7 @@
 
     "adler-32": ["adler-32@1.3.1", "", {}, "sha512-ynZ4w/nUUv5rrsR8UUGoe1VC9hZj6V5hU9Qw1HlMDJGEJw5S7TfTErWTjMys6M7vr0YWcPqs3qAr4ss0nDfP+A=="],
 
-    "agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="],
+    "agent-base": ["agent-base@6.0.2", "", { "dependencies": { "debug": "4" } }, "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ=="],
 
     "agentkeepalive": ["agentkeepalive@4.6.0", "", { "dependencies": { "humanize-ms": "^1.2.1" } }, "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ=="],
 
@@ -334,6 +334,8 @@
 
     "atomic-sleep": ["atomic-sleep@1.0.0", "", {}, "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ=="],
 
+    "axios": ["axios@1.19.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw=="],
+
     "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
 
     "bignumber.js": ["bignumber.js@9.3.1", "", {}, "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ=="],
@@ -446,7 +448,9 @@
 
     "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
 
-    "form-data": ["form-data@4.0.5", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.2", "mime-types": "^2.1.12" } }, "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w=="],
+    "follow-redirects": ["follow-redirects@1.16.0", "", {}, "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw=="],
+
+    "form-data": ["form-data@4.0.6", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.4", "mime-types": "^2.1.35" } }, "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ=="],
 
     "form-data-encoder": ["form-data-encoder@1.7.2", "", {}, "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A=="],
 
@@ -488,7 +492,7 @@
 
     "hashery": ["hashery@1.5.1", "", { "dependencies": { "hookified": "^1.15.0" } }, "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ=="],
 
-    "hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
 
     "hono": ["hono@4.12.18", "", {}, "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ=="],
 
@@ -498,7 +502,7 @@
 
     "https": ["https@1.0.0", "", {}, "sha512-4EC57ddXrkaF0x83Oj8sM6SLQHAWXw90Skqu2M4AEWENZ3F02dFJE/GARA8igO79tcgYqGrD7ae4f5L3um2lgg=="],
 
-    "https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
+    "https-proxy-agent": ["https-proxy-agent@5.0.1", "", { "dependencies": { "agent-base": "6", "debug": "4" } }, "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA=="],
 
     "humanize-ms": ["humanize-ms@1.2.1", "", { "dependencies": { "ms": "^2.0.0" } }, "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ=="],
 
@@ -516,8 +520,12 @@
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
+    "is-electron": ["is-electron@2.2.2", "", {}, "sha512-FO/Rhvz5tuw4MCWkpMzHFKWD2LsfHzIb7i6MdPYZ/KW7AlxawyLkqdy+jPZP1WubqEADE3O4FUENlJHDfQASRg=="],
+
     "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
 
+    "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+
     "isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
 
     "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
@@ -656,6 +664,8 @@
 
     "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
 
+    "proxy-from-env": ["proxy-from-env@2.1.0", "", {}, "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA=="],
+
     "qified": ["qified@0.10.1", "", { "dependencies": { "hookified": "^2.1.1" } }, "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA=="],
 
     "qrcode-terminal": ["qrcode-terminal@0.12.0", "", { "bin": { "qrcode-terminal": "./bin/qrcode-terminal.js" } }, "sha512-EXtzRZmC+YGmGlDFbXKxQiMZNwCLEO6BANKXG4iCtSIM0yqc/pappSx3RIKr4r0uh5JsBckOXeKrB3Iz7mdQpQ=="],
@@ -802,12 +812,20 @@
 
     "@slack/web-api/p-queue": ["p-queue@6.6.2", "", { "dependencies": { "eventemitter3": "^4.0.4", "p-timeout": "^3.2.0" } }, "sha512-RwFpb72c/BhQLEXIZ5K2e+AhgNVmIejGlTgiB9MzZ0e93GRvqZ7uSi0dvRF7/XIXDeNkra2fNHBxTyPDGySpjQ=="],
 
+    "@types/node-fetch/form-data": ["form-data@4.0.5", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.2", "mime-types": "^2.1.12" } }, "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w=="],
+
+    "es-set-tostringtag/hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+
     "fetch-blob/web-streams-polyfill": ["web-streams-polyfill@3.3.3", "", {}, "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw=="],
 
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
+    "gaxios/https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
+
     "gaxios/node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="],
 
+    "get-intrinsic/hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+
     "groq-sdk/@types/node": ["@types/node@18.19.130", "", { "dependencies": { "undici-types": "~5.26.4" } }, "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg=="],
 
     "music-metadata/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
@@ -824,10 +842,18 @@
 
     "@slack/web-api/p-queue/p-timeout": ["p-timeout@3.2.0", "", { "dependencies": { "p-finally": "^1.0.0" } }, "sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg=="],
 
+    "@types/node-fetch/form-data/hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+
+    "@types/node-fetch/form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
+
     "form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
+    "gaxios/https-proxy-agent/agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="],
+
     "groq-sdk/@types/node/undici-types": ["undici-types@5.26.5", "", {}, "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="],
 
     "pptxgenjs/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
+
+    "@types/node-fetch/form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johpaz/hive-sdk",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": false,
   "description": "Hive SDK — The Agent Harness SDK. Build, deploy, and scale AI agent applications with multi-channel support, context engineering, and swarm orchestration.",
   "license": "MIT",
@@ -76,16 +76,16 @@
     "@johpaz/hive-db": "^0.4.0",
     "@anthropic-ai/sdk": "^0.74.0",
     "@google/genai": "^1.43.0",
-    "@modelcontextprotocol/sdk": "latest",
-    "@sapphire/snowflake": "latest",
-    "@slack/bolt": "latest",
-    "@whiskeysockets/baileys": "latest",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@sapphire/snowflake": "^3.5.5",
+    "@slack/bolt": "^4.7.2",
+    "@whiskeysockets/baileys": "7.0.0-rc11",
     "async-mutex": "^0.5.0",
     "cron-parser": "^5.5.0",
     "croner": "^10.0.1",
-    "discord.js": "latest",
+    "discord.js": "^14.26.4",
     "docx": "^9.6.1",
-    "grammy": "latest",
+    "grammy": "^1.42.0",
     "groq-sdk": "^0.37.0",
     "jsonwebtoken": "^9.0.3",
     "jszip": "^3.10.1",
@@ -95,10 +95,10 @@
     "openai": "^6.18.0",
     "pdfjs-dist": "^5.6.205",
     "pptxgenjs": "^4.0.1",
-    "qrcode-terminal": "latest",
+    "qrcode-terminal": "^0.12.0",
     "toon-format-parser": "^1.1.0",
     "xlsx": "^0.18.5",
-    "zod": "latest"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/bun": "^1.3.13",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hive/cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Hive CLI — init, run, test, trace",
   "license": "MIT",
   "type": "module",

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hive/core",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Hive Core — runtime de agentes con context engineering, catálogo de modelos y HiveDB",
   "license": "MIT",
   "type": "module",
@@ -37,16 +37,16 @@
     "@johpaz/hive-db": "^0.4.0",
     "@anthropic-ai/sdk": "^0.74.0",
     "@google/genai": "^1.43.0",
-    "@modelcontextprotocol/sdk": "latest",
-    "@sapphire/snowflake": "latest",
-    "@slack/bolt": "latest",
-    "@whiskeysockets/baileys": "latest",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@sapphire/snowflake": "^3.5.5",
+    "@slack/bolt": "^4.7.2",
+    "@whiskeysockets/baileys": "7.0.0-rc11",
     "async-mutex": "^0.5.0",
     "cron-parser": "^5.5.0",
     "croner": "^10.0.1",
-    "discord.js": "latest",
+    "discord.js": "^14.26.4",
     "docx": "^9.6.1",
-    "grammy": "latest",
+    "grammy": "^1.42.0",
     "groq-sdk": "^0.37.0",
     "jsonwebtoken": "^9.0.3",
     "jszip": "^3.10.1",
@@ -56,10 +56,10 @@
     "openai": "^6.18.0",
     "pdfjs-dist": "^5.6.205",
     "pptxgenjs": "^4.0.1",
-    "qrcode-terminal": "latest",
+    "qrcode-terminal": "^0.12.0",
     "toon-format-parser": "^1.1.0",
     "xlsx": "^0.18.5",
-    "zod": "latest"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/jsonwebtoken": "^9.0.10"

package/packages/core/src/agent/acceptance-checks.ts

@@ -42,7 +42,13 @@ export interface AcceptanceChecks {
 
 export function sanitizeDiagnostic(value: string, limit = 1000): string {
   return value
-    .replace(/(api[_-]?key|token|authorization|secret)(["'=:\s]+)[^\s,}"']+/gi, "$1$2[REDACTED]")
+    .replace(
+      // El esquema de auth va aparte: sin el grupo opcional, "authorization:
+      // Bearer <token>" consumía sólo "Bearer" y dejaba el token en claro.
+      /(api[_-]?key|token|authorization|secret)(["'=:\s]+)(?:(bearer|basic)\s+)?[^\s,}"']+/gi,
+      (_match, key: string, separator: string, scheme?: string) =>
+        `${key}${separator}${scheme ? `${scheme} ` : ""}[REDACTED]`,
+    )
     .slice(0, limit);
 }
 

package/packages/core/src/config/loader.ts

@@ -120,6 +120,11 @@ const BrowserConfigSchema = z.object({
   headless: z.boolean().optional(),
   timeoutMs: z.number().optional(),
   sessionName: z.string().optional(),
+  // "agent-browser" (default) usa Chrome via CLI y sirve headless/Docker.
+  // "webview" usa Bun.WebView in-process — mucho más rápido y sin instalación,
+  // pero requiere Chrome instalado (o macOS con WebKit). "auto" toma webview
+  // sólo si hay motor. Lo pisa HIVE_BROWSER_BACKEND.
+  backend: z.enum(["agent-browser", "webview", "auto"]).optional(),
 });
 
 const CanvasConfigSchema = z.object({

package/packages/core/src/tools/web/browser-backend.ts

@@ -0,0 +1,129 @@
+/**
+ * BrowserBackend — el contrato que consumen las browser tools.
+ *
+ * Hay dos implementaciones con perfiles opuestos:
+ *
+ *  - `AgentBrowserBackend` (browser-service.ts): habla con el CLI de
+ *    agent-browser por subproceso. Maneja Chrome de verdad, corre headless y
+ *    por lo tanto sirve en Docker y en un servidor sin display. El costo es
+ *    un `Bun.spawn` por operación —medido en ~68 ms de piso— más una
+ *    instalación diferida de ~75 MB y la descarga de Chrome.
+ *
+ *  - `WebViewBackend` (webview-backend.ts): usa `Bun.WebView`, in-process.
+ *    Sin instalación, sin subprocesos, ~0.25 ms por `evaluate`. Necesita un
+ *    entorno gráfico (WebKitGTK en Linux, WebKit del sistema en macOS), así
+ *    que no sirve headless.
+ *
+ * El default sigue siendo agent-browser: es el único de los dos que funciona
+ * donde suele correr el gateway. WebView se elige explícitamente.
+ */
+
+export interface ScreenshotOptions {
+  encoding?: "blob" | "buffer" | "base64" | "shmem";
+  format?: "png" | "jpeg" | "webp";
+  quality?: number;
+  clip?: { x: number; y: number; width: number; height: number; scale: number };
+}
+
+export interface SnapshotOptions {
+  /** Colapsa nodos sin nombre accesible y recorta el texto largo. Default: true. */
+  compact?: boolean;
+  /** Profundidad máxima del árbol. */
+  depth?: number;
+  /** Sólo elementos accionables (links, botones, inputs...). */
+  interactiveOnly?: boolean;
+}
+
+/**
+ * La superficie que las tools de `tools/web/` realmente usan. Se mantuvo
+ * deliberadamente chica: cualquier método que se agregue acá hay que
+ * implementarlo en los dos backends.
+ */
+export interface BrowserBackend {
+  readonly url: string;
+  readonly title: string;
+  readonly loading: boolean;
+
+  navigate(url: string): Promise<void>;
+  evaluate<T = unknown>(script: string): Promise<T>;
+  screenshot(options?: ScreenshotOptions): Promise<string>;
+  /** Árbol de accesibilidad en texto — lo que ve el modelo en vez del HTML crudo. */
+  snapshot(options?: SnapshotOptions): Promise<string>;
+  click(selector: string, options?: Record<string, unknown>): Promise<void>;
+  type(text: string): Promise<void>;
+  typeIn(selector: string, text: string): Promise<void>;
+  fill(selector: string, text: string): Promise<void>;
+  press(key: string, options?: { modifiers?: string[] }): Promise<void>;
+  scroll(dx: number, dy: number): Promise<void>;
+  scrollTo(selector: string, options?: { behavior?: "smooth" | "instant" }): Promise<void>;
+  back(): Promise<void>;
+  forward(): Promise<void>;
+  reload(): Promise<void>;
+  resize(width: number, height: number): Promise<void>;
+  /** Captura de un elemento puntual; el backend puede recortar sobre el viewport. */
+  screenshotElement(selector: string): Promise<string>;
+  close(): void;
+}
+
+export type BrowserBackendKind = "agent-browser" | "webview";
+
+/** `auto` resuelve a webview si el runtime lo soporta; si no, agent-browser. */
+export type BrowserBackendPreference = BrowserBackendKind | "auto";
+
+/** Motor que usa `Bun.WebView` por debajo. */
+export type WebViewEngine = "webkit" | "chrome";
+
+const CHROME_PATHS = [
+  "/usr/bin/google-chrome",
+  "/usr/bin/google-chrome-stable",
+  "/usr/bin/chromium",
+  "/usr/bin/chromium-browser",
+  "/snap/bin/chromium",
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+  "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+];
+
+/** Chrome instalado en el sistema — `Bun.WebView` con motor chrome lo necesita. */
+export function findChrome(): string | null {
+  if (process.env.BUN_CHROME_PATH) return process.env.BUN_CHROME_PATH;
+  const { existsSync } = require("node:fs") as typeof import("node:fs");
+  for (const candidate of CHROME_PATHS) {
+    if (existsSync(candidate)) return candidate;
+  }
+  // Último recurso: lo que esté en el PATH del usuario.
+  const home = process.env.HOME;
+  if (home) {
+    for (const name of ["google-chrome", "chromium"]) {
+      const local = `${home}/.local/bin/${name}`;
+      if (existsSync(local)) return local;
+    }
+  }
+  return null;
+}
+
+/**
+ * Motor a usar. WebKit no tiene dependencias externas pero sólo existe en macOS;
+ * Chrome corre headless en cualquier lado —incluido Docker— siempre que el
+ * binario esté instalado.
+ */
+export function resolveWebViewEngine(): WebViewEngine | null {
+  if (process.platform === "darwin") return "webkit";
+  return findChrome() ? "chrome" : null;
+}
+
+/** `Bun.WebView` existe desde Bun 1.3; además hace falta un motor utilizable. */
+export function isWebViewSupported(): boolean {
+  if (typeof (globalThis as { Bun?: { WebView?: unknown } }).Bun?.WebView !== "function") return false;
+  return resolveWebViewEngine() !== null;
+}
+
+export function resolveBackendKind(
+  preference: BrowserBackendPreference | undefined,
+): BrowserBackendKind {
+  const wanted = process.env.HIVE_BROWSER_BACKEND ?? preference ?? "agent-browser";
+  if (wanted === "webview") return "webview";
+  if (wanted === "auto") return isWebViewSupported() ? "webview" : "agent-browser";
+  return "agent-browser";
+}