@johpaz/hive-sdk 0.2.0 → 0.3.0

package/packages/core/src/tool-runtime/index.ts

@@ -4,6 +4,9 @@ import { dirname, join } from "node:path"
 import { availableParallelism } from "node:os"
 import type { Config } from "../config/loader.ts"
 import { loadConfig } from "../config/loader.ts"
+import { logger } from "../utils/logger.ts"
+import { embeddedToolWorkerPath } from "./embedded-worker.generated.ts"
+import { hasHooks, runBeforeToolCall, runAfterToolCall } from "../hooks/index.ts"
 
 export type ToolCallLike = {
   id: string
@@ -105,7 +108,19 @@ type WorkerSlot = {
   job?: QueuedJob
 }
 
-function resolveWorkerEntry(): string {
+let cachedWorkerEntry: string | null | undefined
+
+/**
+ * Locate the tool worker entry, or null when this build ships without one.
+ *
+ * Returning null instead of throwing is deliberate: workers are an
+ * optimization, and a packaging gap must never take a whole turn down with it
+ * (it did until v1.0.3 — every desktop install failed each multi-tool turn
+ * with "Tool worker entry not found"). The caller degrades to the main thread.
+ */
+function resolveWorkerEntry(): string | null {
+  if (cachedWorkerEntry !== undefined) return cachedWorkerEntry
+
   const candidates = [
     new URL("./tool-worker.js", import.meta.url),
     new URL("./tool-worker.ts", import.meta.url),
@@ -115,7 +130,8 @@ function resolveWorkerEntry(): string {
 
   for (const candidate of candidates) {
     if (existsSync(fileURLToPath(candidate))) {
-      return candidate.href
+      cachedWorkerEntry = candidate.href
+      return cachedWorkerEntry
     }
   }
 
@@ -135,13 +151,25 @@ function resolveWorkerEntry(): string {
 
   for (const filePath of fallbacks) {
     if (existsSync(filePath)) {
-      return filePath
+      cachedWorkerEntry = filePath
+      return cachedWorkerEntry
     }
   }
 
-  throw new Error(
-    `Tool worker entry not found. Tried: ${[...candidates.map((candidate) => fileURLToPath(candidate)), ...fallbacks].join(", ")}`
+  // Standalone executable: the worker was embedded at compile time and lives in
+  // the virtual bunfs, where existsSync() reports false — so it is taken on
+  // trust. It is only ever set by scripts/build-gateway.ts.
+  if (embeddedToolWorkerPath) {
+    cachedWorkerEntry = embeddedToolWorkerPath
+    return cachedWorkerEntry
+  }
+
+  logger.warn(
+    "[tool-runtime] No tool worker entry found — running tool batches on the main thread (sequentially)",
+    { tried: [...candidates.map((candidate) => fileURLToPath(candidate)), ...fallbacks] }
   )
+  cachedWorkerEntry = null
+  return null
 }
 
 function serializeError(error: unknown): SerializedError {
@@ -187,6 +215,7 @@ const DEFAULT_MAIN_THREAD_TOOL_NAMES = new Set([
   "browser_navigate",
   "browser_screenshot",
   "artifact_inspect",
+  "artifact_read",
   "browser_click",
   "browser_type",
   "browser_extract",
@@ -255,10 +284,12 @@ class ToolWorkerPool {
   private workers: WorkerSlot[] = []
   private queue: QueuedJob[] = []
   private readonly maxWorkers: number
+  private readonly workerEntry: string
   private disposed = false
 
-  constructor(maxWorkers: number) {
+  constructor(maxWorkers: number, workerEntry: string) {
     this.maxWorkers = Math.max(1, maxWorkers)
+    this.workerEntry = workerEntry
   }
 
   execute(job: Omit<QueuedJob, "resolve" | "settled" | "startedAt">): Promise<ToolBatchResult> {
@@ -385,7 +416,7 @@ class ToolWorkerPool {
   }
 
   private createSlot(): WorkerSlot {
-    const worker = new Worker(resolveWorkerEntry(), { type: "module" })
+    const worker = new Worker(this.workerEntry, { type: "module" })
     const slot: WorkerSlot = { worker, busy: false }
 
     worker.onmessage = (event: MessageEvent<WorkerMessage>) => {
@@ -500,11 +531,15 @@ class ToolWorkerPool {
     job.resolve(result)
 
     if (restart) {
+      // Un worker que abortó o murió se descarta, y el reemplazo lo crea
+      // `drain()` solo si queda trabajo. Antes se levantaba uno nuevo en el
+      // acto: sobre un aborto —el caso típico al terminar un turno o una
+      // suite— eso deja un worker recién arrancado que nadie va a usar y que
+      // hay que terminar a mitad del arranque. Bun se cae con SIGSEGV al
+      // cerrar el proceso en ese estado (CI: workers_spawned 13, terminated 11).
       slot.worker.terminate()
       const index = this.workers.indexOf(slot)
-      if (index >= 0) {
-        this.workers[index] = this.createSlot()
-      }
+      if (index >= 0) this.workers.splice(index, 1)
     } else {
       slot.busy = false
       slot.job = undefined
@@ -550,15 +585,90 @@ function resolveToolTimeout(
   return baseTimeoutMs
 }
 
-function getPool(maxWorkers: number): ToolWorkerPool {
+function getPool(maxWorkers: number): ToolWorkerPool | null {
+  const workerEntry = resolveWorkerEntry()
+  if (!workerEntry) return null
+
   if (!sharedPool || sharedPoolSize !== maxWorkers) {
-    sharedPool = new ToolWorkerPool(maxWorkers)
+    sharedPool = new ToolWorkerPool(maxWorkers, workerEntry)
     sharedPoolSize = maxWorkers
   }
   return sharedPool
 }
 
+/**
+ * Ejecuta un lote de tool calls, aplicando los hooks alrededor.
+ *
+ * Los hooks se resuelven acá y no dentro del despacho porque hay dos caminos
+ * —hilo principal y pool de workers— con puntos de retorno distintos.
+ * Engancharlos abajo dejaría la mitad de las llamadas sin revisar, que en un
+ * hook de política es peor que no tenerlo.
+ *
+ * Una tool bloqueada **no se ejecuta**: se saca del lote y su lugar se rellena
+ * con el motivo, para que el modelo sepa por qué no se hizo en vez de
+ * reintentar a ciegas.
+ */
 export async function executeToolBatch(options: ExecuteToolBatchOptions): Promise<ToolBatchResult[]> {
+  const bloqueadas = new Map<string, string>()
+
+  if (hasHooks("beforeToolCall")) {
+    for (const toolCall of options.toolCalls) {
+      const args = typeof toolCall.function.arguments === "string"
+        ? (() => { try { return JSON.parse(toolCall.function.arguments) } catch { return {} } })()
+        : (toolCall.function.arguments ?? {})
+
+      const motivo = await runBeforeToolCall({
+        toolName: toolCall.function.name,
+        args: args as Record<string, unknown>,
+        agentId: options.toolConfig?.agent_id as string | undefined,
+        userId: options.toolConfig?.user_id as string | undefined,
+        threadId: options.toolConfig?.thread_id as string | undefined,
+      })
+      if (motivo) bloqueadas.set(toolCall.id, motivo)
+    }
+  }
+
+  const permitidas = options.toolCalls.filter((tc) => !bloqueadas.has(tc.id))
+  const ejecutadas = permitidas.length > 0
+    ? await executeToolBatchInner({ ...options, toolCalls: permitidas })
+    : []
+
+  // Se reconstruye el orden original: el modelo espera una respuesta por cada
+  // llamada que hizo, en el orden en que las hizo.
+  const porId = new Map(ejecutadas.map((r) => [r.toolCall.id, r]))
+  const resultados = options.toolCalls.map((toolCall) => {
+    const bloqueo = bloqueadas.get(toolCall.id)
+    if (bloqueo) {
+      return {
+        toolCall,
+        toolName: toolCall.function.name,
+        result: toolErrorResult(toolCall.function.name, bloqueo),
+        ok: false,
+        durationMs: 0,
+      } as ToolBatchResult
+    }
+    return porId.get(toolCall.id)!
+  })
+
+  if (hasHooks("afterToolCall")) {
+    for (const r of resultados) {
+      await runAfterToolCall({
+        toolName: r.toolName,
+        args: {},
+        result: r.result,
+        ok: r.ok,
+        durationMs: r.durationMs,
+        agentId: options.toolConfig?.agent_id as string | undefined,
+        userId: options.toolConfig?.user_id as string | undefined,
+        threadId: options.toolConfig?.thread_id as string | undefined,
+      })
+    }
+  }
+
+  return resultados
+}
+
+async function executeToolBatchInner(options: ExecuteToolBatchOptions): Promise<ToolBatchResult[]> {
   const runtimeConfig = resolveRuntimeConfig(options.workerPool)
   const hiveConfig = options.hiveConfig ?? loadConfig()
   const mainThreadToolNames = [
@@ -578,7 +688,13 @@ export async function executeToolBatch(options: ExecuteToolBatchOptions): Promis
     }))
   }
 
-  if (!runtimeConfig.enabled || !runtimeConfig.parallelToolCalls || options.toolCalls.length <= 1) {
+  // A null pool means workers are disabled, unnecessary (single call), or
+  // unavailable in this build — all three degrade to the main thread.
+  const pool = runtimeConfig.enabled && runtimeConfig.parallelToolCalls && options.toolCalls.length > 1
+    ? getPool(runtimeConfig.maxWorkers)
+    : null
+
+  if (!pool) {
     const results: ToolBatchResult[] = []
     for (const toolCall of options.toolCalls) {
       const startedAt = performance.now()
@@ -605,7 +721,6 @@ export async function executeToolBatch(options: ExecuteToolBatchOptions): Promis
     return results
   }
 
-  const pool = getPool(runtimeConfig.maxWorkers)
   const batchId = crypto.randomUUID()
   const abortHandler = () => pool.abortBatch(batchId, "Tool execution aborted")
   options.signal?.addEventListener("abort", abortHandler, { once: true })

package/packages/core/src/tools/agents/index.ts

@@ -33,22 +33,9 @@ export const memoryWriteTool: Tool = {
     required: ["title", "content"],
   },
   execute: async (params: Record<string, unknown>) => {
-    const title = params.title as string;
-    const content = params.content as string;
-
     try {
-      const memoryCol = await col<MemoryDoc>("memory");
-      const existing = await memoryCol.get(title);
-      const now = Date.now();
-      await memoryCol.put(title, {
-        id: title,
-        title,
-        content,
-        created_at: existing?.doc.created_at ?? now,
-        updated_at: now,
-      }, existing ? { expectedVersion: existing.version } : { expectedVersion: 0 });
-
-      return { ok: true, title, message: "Memory saved." };
+      const entry = await writeMemory(params.title as string, params.content as string);
+      return { ok: true, title: entry.title, message: "Memory saved." };
     } catch (error) {
       return { ok: false, error: `Failed to save memory: ${(error as Error).message}` };
     }
@@ -69,21 +56,15 @@ export const memoryReadTool: Tool = {
   },
   execute: async (params: Record<string, unknown>) => {
     const title = params.title as string;
-
     try {
-      const memoryCol = await col<MemoryDoc>("memory");
-      const entry = await memoryCol.get(title);
-
-      if (!entry) {
-        return { ok: false, error: `Memory not found: ${title}` };
-      }
-
+      const entry = await readMemory(title);
+      if (!entry) return { ok: false, error: `Memory not found: ${title}` };
       return {
         ok: true,
-        title: entry.doc.title,
-        content: entry.doc.content,
-        createdAt: new Date(entry.doc.created_at).toISOString(),
-        updatedAt: new Date(entry.doc.updated_at).toISOString(),
+        title: entry.title,
+        content: entry.content,
+        createdAt: new Date(entry.createdAt).toISOString(),
+        updatedAt: new Date(entry.updatedAt).toISOString(),
       };
     } catch (error) {
       return { ok: false, error: `Failed to read memory: ${(error as Error).message}` };
@@ -102,15 +83,11 @@ export const memoryListTool: Tool = {
   },
   execute: async () => {
     try {
-      const memoryCol = await col<MemoryDoc>("memory");
-      const notes = (await memoryCol.scan({}))
-        .map(e => e.doc)
-        .sort((a, b) => b.updated_at - a.updated_at);
-
+      const entries = await listMemories();
       return {
         ok: true,
-        count: notes.length,
-        entries: notes.map((n) => ({ title: n.title, createdAt: new Date(n.created_at).toISOString() })),
+        count: entries.length,
+        entries: entries.map((n) => ({ title: n.title, createdAt: new Date(n.createdAt).toISOString() })),
       };
     } catch (error) {
       return { ok: false, error: `Failed to list memories: ${(error as Error).message}` };
@@ -132,23 +109,9 @@ export const memorySearchTool: Tool = {
   },
   execute: async (params: Record<string, unknown>) => {
     const query = params.query as string;
-    const needle = query.toLowerCase();
-
     try {
-      const memoryCol = await col<MemoryDoc>("memory");
-      const notes = (await memoryCol.scan({}))
-        .map(e => e.doc)
-        .filter(n => n.content.toLowerCase().includes(needle) || n.title.toLowerCase().includes(needle));
-
-      return {
-        ok: true,
-        query,
-        count: notes.length,
-        results: notes.map((n) => ({
-          title: n.title,
-          snippet: n.content.slice(0, 200) + (n.content.length > 200 ? "..." : ""),
-        })),
-      };
+      const results = await searchMemories(query);
+      return { ok: true, query, count: results.length, results };
     } catch (error) {
       return { ok: false, error: `Failed to search memories: ${(error as Error).message}` };
     }
@@ -169,17 +132,9 @@ export const memoryDeleteTool: Tool = {
   },
   execute: async (params: Record<string, unknown>) => {
     const title = params.title as string;
-
     try {
-      const memoryCol = await col<MemoryDoc>("memory");
-      const existing = await memoryCol.get(title);
-
-      if (!existing) {
-        return { ok: false, error: `Memory not found: ${title}` };
-      }
-
-      await memoryCol.delete(title);
-
+      const borrada = await deleteMemory(title);
+      if (!borrada) return { ok: false, error: `Memory not found: ${title}` };
       return { ok: true, title, message: "Memory deleted." };
     } catch (error) {
       return { ok: false, error: `Failed to delete memory: ${(error as Error).message}` };
@@ -1202,6 +1157,9 @@ export const busReadTool: Tool = {
 
 import crypto from "crypto";
 import { getAvailableModelsTool } from "./get-available-models.ts";
+// Las tools de memoria son envoltorios: la implementación vive en services/memory.ts,
+// para que una UI pueda usarla sin pasar por el formato que espera el modelo.
+import { writeMemory, readMemory, listMemories, searchMemories, deleteMemory } from "../../services/memory.ts";
 
 export function createTools(): Tool[] {
   return [

package/packages/core/src/tools/cli/index.ts

@@ -10,6 +10,7 @@ import type { Tool } from "../types.ts";
 import { logger } from "../../utils/logger.ts";
 import { resolveInWorkspace, getWorkspace, expandPath } from "../filesystem/workspace-guard.ts";
 import * as fs from "node:fs";
+import { loadConfig } from "../../config/loader.ts";
 
 const log = logger.child("cli-exec");
 
@@ -28,6 +29,53 @@ const BLOCKED_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
   { pattern: /format\s+[a-z]:/i, reason: "disk format (Windows)" },
 ];
 
+/** El primer token del comando: `git status` → `git`. Es lo que se compara. */
+function commandName(command: string): string {
+  const limpio = command.trim().replace(/^\s*(sudo|env|nohup)\s+/i, "");
+  return (limpio.split(/[\s;|&<>]/)[0] ?? "").split("/").pop() ?? "";
+}
+
+/**
+ * Aplica la política de comandos que el usuario configuró.
+ *
+ * `tools.exec.allowlist` y `.denylist` existían en el esquema de configuración y
+ * **no las leía nadie**: alguien podía escribir `denylist: ["curl", "rm"]`
+ * creyendo que restringía a sus agentes, y no restringía nada. En una opción de
+ * seguridad eso es peor que no tenerla, porque da confianza falsa.
+ *
+ * `BLOCKED_PATTERNS` sigue siendo incondicional: lo catastrófico se bloquea
+ * haya o no configuración. Esta capa es la que el usuario controla.
+ *
+ * Precedencia: si hay allowlist, sólo eso se permite (es la postura más
+ * restrictiva y la que alguien espera al escribirla). La denylist se aplica
+ * después, para poder tener una allowlist amplia con excepciones puntuales.
+ *
+ * Devuelve el motivo del rechazo, o `null` si no hay objeción.
+ */
+function checkExecPolicy(command: string): string | null {
+  const exec = loadConfig().tools?.exec;
+  if (!exec) return null;
+
+  if (exec.enabled === false) {
+    return "La ejecución de comandos está deshabilitada en la configuración";
+  }
+
+  const nombre = commandName(command).toLowerCase();
+  if (!nombre) return null;
+
+  const permitidos = exec.allowlist?.map((c) => c.toLowerCase());
+  if (permitidos?.length && !permitidos.includes(nombre)) {
+    return `Comando no permitido: "${nombre}". Permitidos: ${permitidos.join(", ")}`;
+  }
+
+  const denegados = exec.denylist?.map((c) => c.toLowerCase());
+  if (denegados?.includes(nombre)) {
+    return `Comando denegado por la configuración: "${nombre}"`;
+  }
+
+  return null;   // sin objeción
+}
+
 export const cliExecTool: Tool = {
   name: "cli_exec",
   // Long-running commands need a generous runtime ceiling (the tool allows
@@ -75,6 +123,13 @@ export const cliExecTool: Tool = {
       return { ok: false, error: `Working directory not found: ${cwd}` };
     }
 
+    // ── Política configurable por el usuario ──────────────────────────────────
+    const objecion = checkExecPolicy(command);
+    if (objecion) {
+      log.warn(`bloqueado por configuración: ${command}`);
+      return { ok: false, error: objecion };
+    }
+
     // ── Dangerous pattern check ────────────────────────────────────────────────
     for (const { pattern, reason } of BLOCKED_PATTERNS) {
       if (pattern.test(command)) {

package/packages/core/src/tools/core/index.ts

@@ -136,6 +136,40 @@ function translateQueryToEnglish(query: string): string {
 
 // ─── search_knowledge ────────────────────────────────────────────────────────
 
+/**
+ * Las tools que el agente que pregunta puede realmente usar.
+ *
+ * El descubrimiento buscaba contra el índice global y devolvía cualquier
+ * coincidencia, sin mirar la lista blanca de quien preguntaba. La ejecución sí
+ * estaba protegida —`context-compiler.ts` recorta `allTools`, así que una tool
+ * fuera de la lista no se puede resolver ni llamar— pero el agente igual veía su
+ * nombre y su descripción. Filtrar acá cierra esa fuga y, de paso, deja de
+ * ofrecerle al modelo capacidades que no va a poder usar, que es una forma
+ * segura de hacerle perder un turno.
+ *
+ * Sin agente en el contexto (una llamada suelta, un test) no se filtra nada.
+ */
+async function allowedToolNames(agentId?: string): Promise<Set<string> | null> {
+  if (!agentId) return null;
+  try {
+    const agents = await col<AgentDoc>("agents");
+    const entry = await agents.get(agentId);
+    if (!entry) return null;
+
+    const raw = entry.doc.tool_allowlist_json ?? entry.doc.tools_json;
+    if (!raw) return null;   // sin lista declarada, descubrimiento abierto
+
+    const { expandToolAllowlist } = await import("../../agent/delegation-runtime.ts");
+    const patrones = JSON.parse(raw) as string[];
+    if (!Array.isArray(patrones) || patrones.length === 0) return new Set();
+
+    const { MINIMAL_TOOLS } = await import("../../agent/minimal-loadout.ts");
+    return new Set([...MINIMAL_TOOLS, ...expandToolAllowlist(patrones)]);
+  } catch {
+    return null;
+  }
+}
+
 export const searchKnowledgeTool: Tool = {
   name: "search_knowledge",
   description: "Busca en TODO el conocimiento de Hive: tools nativas, MCP, skills, agentes de catálogo y playbook.",
@@ -158,10 +192,11 @@ export const searchKnowledgeTool: Tool = {
     },
     required: ["query"],
   },
-  execute: async (params: Record<string, unknown>) => {
+  execute: async (params: Record<string, unknown>, config?: any) => {
     const query = params.query as string;
     const type = (params.type as string) ?? "all";
     const limit = (params.limit as number) ?? 10;
+    const usuarioActual = (config?.configurable?.user_id as string) ?? "";
     const MIN_RESULTS_FOR_BILINGUAL = 2;
 
     // Map the tool's `type` param onto capability types
@@ -187,6 +222,8 @@ export const searchKnowledgeTool: Tool = {
 
       const result: any = { query, type, tools: [], skills: [], playbook: [], toolsmcp: [], agents: [] };
 
+      const permitidas = await allowedToolNames(config?.configurable?.agent_id);
+
       // ─── Hydration from HiveDB collections (index stores only ids + search text) ──
 
       const coreCatalog = new Map(CORE_TOOL_CATALOG.map(t => [t.name, t]));
@@ -198,6 +235,10 @@ export const searchKnowledgeTool: Tool = {
       const agentsCol = await col<AgentDoc>("agents");
 
       async function hydrateTool(hit: CapabilityHit): Promise<any | null> {
+        // Ofrecerle al modelo una tool que no puede ejecutar es hacerle perder
+        // un turno, además de contarle qué existe fuera de su alcance.
+        if (permitidas && !permitidas.has(hit.rawId)) return null;
+
         const entry = await toolsCol.get(hit.rawId);
         if (entry) {
           const row = entry.doc;
@@ -232,6 +273,10 @@ export const searchKnowledgeTool: Tool = {
         const entry = await playbookCol.get(hit.rawId);
         const p = entry?.doc;
         if (!p || !p.active) return null;
+        // Mismo alcance que la inyección en el prompt: lo global más lo propio.
+        // Sin esto, el agente puede buscar en el playbook y leerle a un usuario
+        // lo que aprendió de otro, por la puerta de al lado.
+        if (p.user_id !== "" && p.user_id !== usuarioActual) return null;
         return {
           id: p.id, rule: p.rule, category: p.category,
           applicable_to: p.applicable_to ? JSON.parse(p.applicable_to) : null,
@@ -353,7 +398,10 @@ export const notifyTool: Tool = {
 
     log.info(`[notify] Sending to ${channel}/${userId}: ${message.substring(0, 80)}`);
 
-    const result = await sendToUserChannel(channel, userId, message)
+    // El aviso tiene que volver al hilo del que salió: sin el threadId,
+    // `notifyChannel` no sabe a qué conversación del canal responder.
+    const threadId = config?.configurable?.thread_id as string | undefined;
+    const result = await sendToUserChannel(channel, userId, message, { threadId })
     if (!result.ok) throw new Error(`Channel send failed: ${result.error}`)
     return result
   },

package/packages/core/src/tools/cron/index.ts

@@ -12,7 +12,7 @@ import type { Tool } from "../types.ts";
 import { col, toIndexable } from "../../storage/hive.ts";
 import type { UserDoc, UserIdentityDoc, ChannelDoc, CronJobDoc, TaskRunDoc } from "../../storage/collections.ts";
 import { logger } from "../../utils/logger.ts";
-import { Cron } from "croner";
+import { Cron } from "../../scheduler/cron/index.ts";
 
 const log = logger.child("CronTools");
 
@@ -114,9 +114,9 @@ export const cronCreateTool: Tool = {
       tool_name: { type: "string", description: "Specific tool to execute (optional)" },
       max_runs: { type: "number", description: "Maximum executions (optional, null = unlimited)" },
       channel: { type: "string", description: "Notification channel (system, telegram, discord, whatsapp, cli)" },
-      start_at: { type: "string", description: "ISO 8601 datetime: start of execution window (Croner startAt). Optional." },
-      stop_at: { type: "string", description: "ISO 8601 datetime: end of execution window (Croner stopAt). Optional." },
-      dom_and_dow: { type: "boolean", description: "If true, both day-of-month AND day-of-week must match (Croner domAndDow). Default: false (OR logic)" },
+      start_at: { type: "string", description: "ISO 8601 datetime: start of execution window. Optional." },
+      stop_at: { type: "string", description: "ISO 8601 datetime: end of execution window. Optional." },
+      dom_and_dow: { type: "boolean", description: "If true, both day-of-month AND day-of-week must match. Default: false (OR logic)" },
     },
     required: ["name", "task", "task_type"],
   },