@johpaz/hive-sdk 0.4.0 → 0.4.4

package/README.md

@@ -230,4 +230,4 @@ npm view @johpaz/hive-sdk dist-tags   # verificar después del release
 
 ---
 
-*Hive SDK v0.4.0 — MIT*
+*Hive SDK v0.4.4 — MIT*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johpaz/hive-sdk",
-  "version": "0.4.0",
+  "version": "0.4.4",
   "private": false,
   "description": "Hive SDK — The Agent Harness SDK. Build, deploy, and scale AI agent applications with multi-channel support, context engineering, and swarm orchestration.",
   "license": "MIT",
@@ -80,7 +80,7 @@
     "LICENSE"
   ],
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.2"
   },
   "workspaces": [
     "packages/core",
@@ -115,15 +115,15 @@
     "mammoth": "^1.12.0",
     "ollama": "^0.6.3",
     "openai": "^6.18.0",
-    "pdfjs-dist": "^5.6.205",
+    "pdfjs-dist": "^6.3.289",
     "pptxgenjs": "^4.0.1",
     "qrcode-terminal": "^0.12.0",
     "toon-format-parser": "^1.1.0",
-    "xlsx": "^0.18.5",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.13",
+    "@types/bun": "^1.4.1",
     "@types/jsonwebtoken": "^9.0.10",
     "typescript": "6.0.2"
   }

package/packages/cli/templates/hive-app/package.json

@@ -12,5 +12,8 @@
   },
   "devDependencies": {
     "@types/bun": "latest"
+  },
+  "engines": {
+    "bun": ">=1.4.2"
   }
 }

package/packages/core/src/config/loader.ts

@@ -1,3 +1,4 @@
+import { resolvePort } from "../utils/port.ts";
 import * as z from "zod";
 import { mkdirSync, existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
@@ -407,7 +408,7 @@ function buildDefaultConfig(): Config {
   return {
     gateway: {
       host: process.env.HIVE_HOST || "127.0.0.1",
-      port: parseInt(process.env.HIVE_PORT || "18790", 10),
+      port: resolvePort(process.env.HIVE_PORT, 18790),
       pidFile: path.join(hiveDir, "gateway.pid"),
       authToken: process.env.HIVE_AUTH_TOKEN || undefined,
       tools: {

package/packages/core/src/mcp/transports/sse.ts

@@ -96,11 +96,17 @@ export class SSETransport implements Transport {
       this.sessionId = sessionId;
     }
 
-    // Track cookies for session affinity (important for n8n/proxies)
-    const setCookie = response.headers.get("set-cookie");
-    if (setCookie) {
-      // Simple cookie extraction: just keep the keys and values
-      const newCookies = setCookie.split(',').map(c => c.split(';')[0].trim());
+    // Track cookies for session affinity (important for n8n/proxies).
+    //
+    // `getSetCookie()` y no `get("set-cookie")`: Set-Cookie es la única cabecera
+    // que puede repetirse sin combinarse, y `get()` devuelve las repeticiones
+    // unidas con ", " (Bun 1.4 lo alineó con la spec de Fetch). Partir eso por
+    // coma rompe cualquier cookie cuyo valor lleve una —`Expires=Wed, 09 Jun
+    // 2027 10:18:14 GMT` es el caso de todos los días— y dejaba fragmentos como
+    // "09 Jun 2027 10:18:14 GMT" haciéndose pasar por cookies.
+    const setCookies = response.headers.getSetCookie();
+    if (setCookies.length > 0) {
+      const newCookies = setCookies.map(c => c.split(";")[0].trim());
       this.cookies = [...new Set([...this.cookies, ...newCookies])];
     }
   }

package/packages/core/src/scheduler/CronScheduler.ts

@@ -7,9 +7,11 @@
  * El motor de cron es propio (`./cron`), sin dependencias: sólo `setTimeout` e
  * `Intl` del runtime. Antes era `croner`.
  *
- * `Bun.cron()` no sirve como reemplazo —se evaluó contra el runtime 1.4.0—:
+ * `Bun.cron()` no sirve como reemplazo —reevaluado contra el runtime 1.4.2—:
  * acepta sólo 5 campos y rechaza el sexto, no admite una fecha ISO como patrón
- * (que es como se agendan los jobs `one_shot`), ignora la zona horaria, y su
+ * (que es como se agendan los jobs `one_shot`), no toma una zona por job (usa la
+ * local del proceso desde 1.4; antes era UTC, y ese cambio silencioso es
+ * justamente por qué no conviene delegarle la conversión), y su
  * handle no expone la próxima corrida, que es de donde sale `next_run_at` y con
  * lo que se detectan las corridas perdidas al arrancar. Tampoco tiene
  * equivalente de `protect`, `maxRuns`, `interval`, `startAt`/`stopAt` ni

package/packages/core/src/scheduler/cron/job.ts

@@ -8,7 +8,8 @@
  * habría sido migrar la base para no ganar nada.
  *
  * No usa `Bun.cron()`: ese sólo acepta 5 campos, no admite una fecha ISO como
- * patrón —que es como se agendan los jobs `one_shot`—, ignora la zona horaria y
+ * patrón —que es como se agendan los jobs `one_shot`—, no toma una zona por job
+ * (usa la local del proceso desde Bun 1.4; antes era UTC) y
  * su handle no expone la próxima corrida, que es de donde sale `next_run_at` y
  * con lo que el scheduler detecta las corridas perdidas al arrancar. Lo que sí
  * se usa de Bun es el runtime pelado: `setTimeout` e `Intl`.

package/packages/core/src/scheduler/cron/zoned-time.ts

@@ -2,7 +2,8 @@
  * Reloj de pared ↔ instante, en una zona horaria IANA.
  *
  * Es la parte difícil de un cron con zona horaria y la razón por la que no
- * alcanza con `Bun.cron.parse()`, que sólo trabaja en UTC. "Todos los días a
+ * alcanza con `Bun.cron.parse()`, que resuelve en una sola zona —UTC hasta Bun
+ * 1.3, la local del proceso desde 1.4— y nunca en la del job. "Todos los días a
  * las 9" significa las 9 **del reloj de la pared en Bogotá**, y ese instante se
  * corre una hora dos veces al año en las zonas con horario de verano. Calcular
  * el offset una sola vez y sumarlo produce un cron que se desfasa un día al año

package/packages/core/src/storage/seed.ts

@@ -161,7 +161,11 @@ export const SEED_DATA: SeedData = {
     // Generación actual (4.6/4.7/4.8 pasaron a "legacy"). Los IDs sin fecha ya son
     // snapshots fijos, no alias evergreen.
     { id: "claude-opus-5", providerId: "anthropic", name: "Claude Opus 5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 5, outputPer1M: 25 },
-    { id: "claude-sonnet-5", providerId: "anthropic", name: "Claude Sonnet 5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 3, outputPer1M: 15 },
+    { id: "claude-sonnet-5", providerId: "anthropic", name: "Claude Sonnet 5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 2, outputPer1M: 10 },
+    // Fable 5.1 sucede a Fable 5 en el mismo escalón y al mismo precio: es el
+    // modelo más capaz de Anthropic con disponibilidad general. Fable 5 sigue
+    // servido, así que quedan los dos.
+    { id: "claude-fable-5-1", providerId: "anthropic", name: "Claude Fable 5.1", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 10, outputPer1M: 50 },
     { id: "claude-fable-5", providerId: "anthropic", name: "Claude Fable 5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 10, outputPer1M: 50 },
     { id: "claude-haiku-4-5-20251001", providerId: "anthropic", name: "Claude Haiku 4.5", modelType: "llm", contextWindow: 200000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1, outputPer1M: 5 },
 
@@ -182,6 +186,10 @@ export const SEED_DATA: SeedData = {
     // Solo la generación 3.x: la familia 2.0 ya está apagada y la 2.5 quedó
     // superada. `gemini-3.5-pro` y `gemini-3.1-flash-lite-preview` se quitaron:
     // el primero no existe en el catálogo y el segundo ya salió de preview.
+    // Precio de lanzamiento hasta el 2026-12-31; el 2027-01-01 sube a 1.5/7.5,
+    // que es la tarifa con la que ya está sembrado gemini-3.6-flash.
+    { id: "gemini-3.8-flash", providerId: "gemini", name: "Gemini 3.8 Flash", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.75, outputPer1M: 3.75 },
+    { id: "gemini-3.7-flash", providerId: "gemini", name: "Gemini 3.7 Flash", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.75, outputPer1M: 3.75 },
     { id: "gemini-3.6-flash", providerId: "gemini", name: "Gemini 3.6 Flash", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.5, outputPer1M: 7.5 },
     { id: "gemini-3.5-flash", providerId: "gemini", name: "Gemini 3.5 Flash", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.5, outputPer1M: 9 },
     { id: "gemini-3.5-flash-lite", providerId: "gemini", name: "Gemini 3.5 Flash Lite", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]), inputPer1M: 0.3, outputPer1M: 2.5 },
@@ -214,6 +222,10 @@ export const SEED_DATA: SeedData = {
     // 384K de salida máxima y tool calling en ambos.
     { id: "deepseek-v4-pro", providerId: "deepseek", name: "DeepSeek V4 Pro", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.435, outputPer1M: 0.87 },
     { id: "deepseek-v4-flash", providerId: "deepseek", name: "DeepSeek V4 Flash", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.14, outputPer1M: 0.28 },
+    // Variante experimental de V4 Flash con entrada de imagen; DeepSeek la tarifa
+    // igual que la base, por eso repite precio. Las imágenes se facturan como
+    // entrada, hasta 384 tokens cada una sin importar la resolución.
+    { id: "deepseek-v4-flash-vision-exp", providerId: "deepseek", name: "DeepSeek V4 Flash Vision (exp)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.14, outputPer1M: 0.28 },
 
     // ── Kimi / Moonshot (fuente: platform.kimi.ai/docs/pricing/chat) ──
     // La serie moonshot-v1-* se apaga el 2026-08-31; K2/K2.5 quedaron superadas.
@@ -223,32 +235,42 @@ export const SEED_DATA: SeedData = {
 
     // ── OpenRouter (fuente: GET https://openrouter.ai/api/v1/models) ──
     // Solo modelos vivos con `tools` en supported_parameters y publicados desde
-    // 2025-07. contextWindow = context_length reportado por el propio catálogo.
+    // 2025-07. contextWindow = context_length reportado por el propio catálogo,
+    // y los precios también salen de ahí — son los de la ruta de OpenRouter, no
+    // los del proveedor nativo, y se mueven solos. Revalidado el 2026-09-03.
     // Anthropic
+    { id: "anthropic/claude-fable-5.1", providerId: "openrouter", name: "Claude Fable 5.1 (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 10, outputPer1M: 50 },
     { id: "anthropic/claude-opus-5", providerId: "openrouter", name: "Claude Opus 5 (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 5, outputPer1M: 25 },
     { id: "anthropic/claude-sonnet-5", providerId: "openrouter", name: "Claude Sonnet 5 (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 2, outputPer1M: 10 },
     // OpenAI — la serie 5.6 se divide en Sol (flagship), Terra (equilibrado) y Luna (económico)
-    { id: "openai/gpt-5.6-sol", providerId: "openrouter", name: "GPT-5.6 Sol (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 5, outputPer1M: 30 },
-    { id: "openai/gpt-5.6-terra", providerId: "openrouter", name: "GPT-5.6 Terra (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 1, outputPer1M: 6 },
-    { id: "openai/gpt-5.6-luna", providerId: "openrouter", name: "GPT-5.6 Luna (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]), inputPer1M: 0.1, outputPer1M: 0.6 },
+    { id: "openai/gpt-5.6-sol", providerId: "openrouter", name: "GPT-5.6 Sol (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 2, outputPer1M: 10 },
+    { id: "openai/gpt-5.6-terra", providerId: "openrouter", name: "GPT-5.6 Terra (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 2, outputPer1M: 12 },
+    { id: "openai/gpt-5.6-luna", providerId: "openrouter", name: "GPT-5.6 Luna (OR)", modelType: "llm", contextWindow: 1050000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming"]), inputPer1M: 0.2, outputPer1M: 1.2 },
     // Google
-    { id: "google/gemini-3.6-flash", providerId: "openrouter", name: "Gemini 3.6 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.5, outputPer1M: 7.5 },
+    { id: "google/gemini-3.8-flash", providerId: "openrouter", name: "Gemini 3.8 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.75, outputPer1M: 3.75 },
+    { id: "google/gemini-3.7-flash", providerId: "openrouter", name: "Gemini 3.7 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.75, outputPer1M: 3.75 },
+    { id: "google/gemini-3.6-flash", providerId: "openrouter", name: "Gemini 3.6 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.75, outputPer1M: 3.75 },
     { id: "google/gemini-3.5-flash", providerId: "openrouter", name: "Gemini 3.5 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.5, outputPer1M: 9 },
     { id: "google/gemini-3.1-pro-preview", providerId: "openrouter", name: "Gemini 3.1 Pro (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 2, outputPer1M: 12 },
     // DeepSeek
-    { id: "deepseek/deepseek-v4-pro", providerId: "openrouter", name: "DeepSeek V4 Pro (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.435, outputPer1M: 0.87 },
-    { id: "deepseek/deepseek-v4-flash", providerId: "openrouter", name: "DeepSeek V4 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 0.14, outputPer1M: 0.28 },
+    { id: "deepseek/deepseek-v4-flash-vision-exp", providerId: "openrouter", name: "DeepSeek V4 Flash Vision exp (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.44, outputPer1M: 1.32 },
+    { id: "deepseek/deepseek-v4-pro", providerId: "openrouter", name: "DeepSeek V4 Pro (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 1.04226, outputPer1M: 2.08452 },
+    { id: "deepseek/deepseek-v4-flash", providerId: "openrouter", name: "DeepSeek V4 Flash (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 0.088606, outputPer1M: 0.177212 },
     // Kimi
     { id: "moonshotai/kimi-k3", providerId: "openrouter", name: "Kimi K3 (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 3, outputPer1M: 15 },
-    { id: "moonshotai/kimi-k2.7-code", providerId: "openrouter", name: "Kimi K2.7 Code (OR)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 0.73, outputPer1M: 3.5 },
+    { id: "moonshotai/kimi-k2.7-code", providerId: "openrouter", name: "Kimi K2.7 Code (OR)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 0.66, outputPer1M: 3.4 },
     // MiniMax
     { id: "minimax/minimax-m3", providerId: "openrouter", name: "MiniMax M3 (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.3, outputPer1M: 1.2 },
     // Z.ai / GLM
-    { id: "z-ai/glm-5.2", providerId: "openrouter", name: "GLM 5.2 (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.63, outputPer1M: 1.98 },
+    { id: "z-ai/glm-5.3", providerId: "openrouter", name: "GLM 5.3 (OR)", modelType: "llm", contextWindow: 1310720, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 1.4, outputPer1M: 4.4 },
+    { id: "z-ai/glm-5.3-flash", providerId: "openrouter", name: "GLM 5.3 Flash (OR)", modelType: "llm", contextWindow: 1310720, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.075, outputPer1M: 0.25 },
+    { id: "z-ai/glm-5.2", providerId: "openrouter", name: "GLM 5.2 (OR)", modelType: "llm", contextWindow: 1048576, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code", "reasoning"]), inputPer1M: 0.966, outputPer1M: 3.036 },
     // Qwen
     { id: "qwen/qwen3.8-max", providerId: "openrouter", name: "Qwen3.8 Max (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 2, outputPer1M: 6 },
+    { id: "qwen/qwen3.8-flash", providerId: "openrouter", name: "Qwen3.8 Flash (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.15, outputPer1M: 0.47 },
     { id: "qwen/qwen3.7-flash", providerId: "openrouter", name: "Qwen3.7 Flash (OR)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming"]), inputPer1M: 0.03, outputPer1M: 0.13 },
     // xAI
+    { id: "x-ai/grok-4.6", providerId: "openrouter", name: "Grok 4.6 (OR)", modelType: "llm", contextWindow: 500000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 2, outputPer1M: 6 },
     { id: "x-ai/grok-4.5", providerId: "openrouter", name: "Grok 4.5 (OR)", modelType: "llm", contextWindow: 500000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 2, outputPer1M: 6 },
     // Mistral
     { id: "mistralai/mistral-medium-3-5", providerId: "openrouter", name: "Mistral Medium 3.5 (OR)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming", "code"]), inputPer1M: 1.5, outputPer1M: 7.5 },
@@ -283,9 +305,14 @@ export const SEED_DATA: SeedData = {
     { id: "eleven_v3", providerId: "elevenlabs", name: "Eleven V3", modelType: "tts", contextWindow: 0, capabilities: JSON.stringify(["tts", "speech", "expressive"]) },
 
     // ── Qwen (Alibaba DashScope / Model Studio) ──
-    // Serie 3.7 = generación actual. Los contextWindow salen del catálogo de
-    // OpenRouter, que enruta a los mismos modelos: el `qwen3.6-max-preview` que
-    // estaba sembrado con 32768 en realidad tiene 262144.
+    // Serie 3.8 = generación actual; la 3.7 sigue servida. Los contextWindow salen
+    // del catálogo de OpenRouter, que enruta a los mismos modelos: el
+    // `qwen3.6-max-preview` que estaba sembrado con 32768 en realidad tiene 262144.
+    // Serie 3.8: Max es el buque insignia y Flash el de alto volumen. Precios del
+    // endpoint internacional (Singapur), que es el `baseUrl` sembrado — el de
+    // China continental cobra entre 60% y 70% menos.
+    { id: "qwen3.8-max", providerId: "qwen", name: "Qwen 3.8 Max", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 2, outputPer1M: 6 },
+    { id: "qwen3.8-flash", providerId: "qwen", name: "Qwen 3.8 Flash", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.14, outputPer1M: 0.42 },
     { id: "qwen3.7-max", providerId: "qwen", name: "Qwen 3.7 Max", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.475, outputPer1M: 4.425 },
     { id: "qwen3.7-plus", providerId: "qwen", name: "Qwen 3.7 Plus", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.32, outputPer1M: 1.28 },
     { id: "qwen3.6-flash", providerId: "qwen", name: "Qwen 3.6 Flash", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "json_mode", "function_calling", "streaming"]), inputPer1M: 0.1875, outputPer1M: 1.125 },
@@ -300,10 +327,13 @@ export const SEED_DATA: SeedData = {
     // Solo los mejores modelos agénticos (tool calling) del catálogo vivo. NVIDIA
     // retira modelos del endpoint sin avisar y responde 410 Gone al llamarlos, así
     // que esta lista se valida contra /v1/models — no contra la web de build.nvidia.com,
-    // que sigue mostrando fichas de modelos ya retirados. Verificado 2026-08-11.
+    // que sigue mostrando fichas de modelos ya retirados. Verificado 2026-09-03.
     // Nota: Qwen ya no tiene ningún modelo en el catálogo NVIDIA (todos retirados);
     // para Qwen usar el provider `qwen` (DashScope) directamente.
-    { id: "z-ai/glm-5.2", providerId: "nvidia", name: "GLM 5.2 (NVIDIA)", modelType: "llm", contextWindow: 200000, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    // z-ai/glm-5.2 se sacó: NVIDIA lo retiró de /v1/models. Para GLM usar el
+    // provider `z-ai` directo, o el enrutado de OpenRouter.
+    { id: "moonshotai/kimi-k3", providerId: "nvidia", name: "Kimi K3 (NVIDIA)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "nvidia/nemotron-3.5-lightning-30b-a3b", providerId: "nvidia", name: "Nemotron 3.5 Lightning 30B", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "moonshotai/kimi-k2.6", providerId: "nvidia", name: "Kimi K2.6 (NVIDIA)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "minimaxai/minimax-m3", providerId: "nvidia", name: "MiniMax M3 (NVIDIA)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "nvidia/nemotron-3-ultra-550b-a55b", providerId: "nvidia", name: "Nemotron 3 Ultra 550B", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
@@ -325,6 +355,7 @@ export const SEED_DATA: SeedData = {
     { id: "Qwen-Ambassador/Qwen3.7-Max", providerId: "modelscope", name: "Qwen3.7 Max (Embajador)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "Qwen-Ambassador/Qwen3.7-Plus", providerId: "modelscope", name: "Qwen3.7 Plus (Embajador)", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     // Open-weight del mismo endpoint, para cuentas sin permiso de embajador.
+    { id: "Qwen/Qwen3.8-27B", providerId: "modelscope", name: "Qwen3.8 27B (ModelScope)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "Qwen/Qwen3.5-397B-A17B", providerId: "modelscope", name: "Qwen3.5 397B (ModelScope)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "Qwen/Qwen3-Next-80B-A3B-Instruct", providerId: "modelscope", name: "Qwen3 Next 80B (ModelScope)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "Qwen/Qwen3-Coder-30B-A3B-Instruct", providerId: "modelscope", name: "Qwen3 Coder 30B (ModelScope)", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming"]), inputPer1M: 0, outputPer1M: 0 },
@@ -338,11 +369,30 @@ export const SEED_DATA: SeedData = {
     { id: "MiniMax-M2.7-highspeed", providerId: "minimax", name: "MiniMax M2.7 Highspeed", modelType: "llm", contextWindow: 204800, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]), inputPer1M: 0.3, outputPer1M: 1.2 },
 
     // ── Z.ai / GLM (fuente: docs.z.ai/guides/llm) — OpenAI-compatible endpoint ──
+    // GLM-5.3 es sólo texto (código y ciberseguridad); el Flash es el multimodal
+    // barato. OJO: 0.075/0.25 del Flash es promoción a mitad de precio hasta el
+    // 2026-09-09 (24:00 UTC+8); la tarifa de lista es 0.15/0.50.
+    { id: "glm-5.3", providerId: "z-ai", name: "GLM 5.3", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 1.4, outputPer1M: 4.4 },
+    { id: "glm-5.3-flash", providerId: "z-ai", name: "GLM 5.3 Flash", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.075, outputPer1M: 0.25 },
     { id: "glm-5.2", providerId: "z-ai", name: "GLM 5.2", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.63, outputPer1M: 1.98 },
     { id: "glm-5.1", providerId: "z-ai", name: "GLM 5.1", modelType: "llm", contextWindow: 204800, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.97, outputPer1M: 3.04 },
     { id: "glm-5", providerId: "z-ai", name: "GLM 5", modelType: "llm", contextWindow: 200000, capabilities: JSON.stringify(["chat", "code", "json_mode", "function_calling", "streaming", "reasoning"]), inputPer1M: 0.97, outputPer1M: 3.04 },
 
-    // ── OpenCode Go (fuente: opencode.ai) — OpenAI-compatible endpoint ──
+    // ── OpenCode Go (fuente: GET https://opencode.ai/zen/go/v1/models) ──
+    // Endpoint gratuito y OpenAI-compatible, por eso todo va con precio 0. El
+    // contextWindow es conservador a propósito: el listado no publica el ctx
+    // servido, y quedarse corto sólo adelanta la compactación mientras que
+    // pasarse revienta la llamada. Verificado 2026-09-03.
+    { id: "glm-5.3", providerId: "opencode-go", name: "GLM-5.3", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "glm-5.3-flash", providerId: "opencode-go", name: "GLM-5.3 Flash", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "glm-5.2", providerId: "opencode-go", name: "GLM-5.2", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "kimi-k3", providerId: "opencode-go", name: "Kimi K3", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "kimi-k2.7-code", providerId: "opencode-go", name: "Kimi K2.7 Code", modelType: "llm", contextWindow: 262144, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "qwen3.8-max", providerId: "opencode-go", name: "Qwen3.8 Max", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "qwen3.8-flash", providerId: "opencode-go", name: "Qwen3.8 Flash", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "grok-4.6", providerId: "opencode-go", name: "Grok 4.6", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "deepseek-v4-flash-vision-exp", providerId: "opencode-go", name: "DeepSeek V4 Flash Vision (exp)", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
+    { id: "hy4-preview", providerId: "opencode-go", name: "Hunyuan 4 Preview", modelType: "llm", contextWindow: 128000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "minimax-m3", providerId: "opencode-go", name: "MiniMax M3", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "vision", "function_calling", "streaming", "reasoning"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "minimax-m2.7", providerId: "opencode-go", name: "MiniMax M2.7", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]), inputPer1M: 0, outputPer1M: 0 },
     { id: "minimax-m2.5", providerId: "opencode-go", name: "MiniMax M2.5", modelType: "llm", contextWindow: 1000000, capabilities: JSON.stringify(["chat", "code", "function_calling", "streaming"]), inputPer1M: 0, outputPer1M: 0 },

package/packages/core/src/tools/office/office-leer-pdf.ts

@@ -10,6 +10,14 @@ import type { Tool } from "../types.ts";
 import { logger } from "../../utils/logger.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  assertBeforeDeadline,
+  MAX_PDF_INPUT_BYTES,
+  MAX_PDF_PAGES_PER_REQUEST,
+  OFFICE_PROCESSING_TIMEOUT_MS,
+  validateOfficeInput,
+} from "./security-limits.ts";
 
 const log = logger.child("office-leer-pdf");
 
@@ -48,61 +56,102 @@ export const officeLeerPdfTool: Tool = {
         return { ok: false, error: `Archivo no encontrado: ${rutaAbsoluta}` };
       }
 
+      const inputError = validateOfficeInput(
+        rutaAbsoluta,
+        MAX_PDF_INPUT_BYTES,
+        "El PDF",
+      );
+      if (inputError) return { ok: false, error: inputError };
+
       const buffer = fs.readFileSync(rutaAbsoluta);
       const uint8Array = new Uint8Array(buffer);
 
-      // Importar pdfjs-dist (compatible con Bun, sin worker)
+      // La build legacy conserva compatibilidad con Bun. PDF.js configura su
+      // propio fake worker en Node/Bun; borrar workerSrc rompe PDF.js 6+.
       const pdfjsLib = await import("pdfjs-dist/legacy/build/pdf.mjs" as any).catch(
         () => import("pdfjs-dist" as any)
       );
 
-      // Desactivar worker para entorno Node/Bun
       const lib = pdfjsLib.default ?? pdfjsLib;
-      if (lib.GlobalWorkerOptions) {
-        lib.GlobalWorkerOptions.workerSrc = "";
-      }
-
-      const doc = await lib.getDocument({ data: uint8Array, disableWorker: true }).promise;
-      const totalPaginas = doc.numPages;
+      const pdfjsPackageUrl = import.meta.resolve("pdfjs-dist/package.json");
+      const loadingTask = lib.getDocument({
+        data: uint8Array,
+        enableScripting: false,
+        isEvalSupported: false,
+        // Bun's process.getBuiltinModule("fs/promises") expects a filesystem
+        // path here; a file:// URL string is not accepted.
+        standardFontDataUrl: fileURLToPath(
+          new URL("./standard_fonts/", pdfjsPackageUrl),
+        ),
+      });
 
-      // Metadata
-      let titulo: string | undefined;
       try {
-        const meta = await doc.getMetadata();
-        titulo = (meta?.info as any)?.Title ?? undefined;
-      } catch {
-        // metadata opcional
+        const deadline = Date.now() + OFFICE_PROCESSING_TIMEOUT_MS;
+        const doc = await loadingTask.promise;
+        const totalPaginas = doc.numPages;
+
+        // Metadata
+        let titulo: string | undefined;
+        try {
+          const meta = await doc.getMetadata();
+          titulo = (meta?.info as any)?.Title ?? undefined;
+        } catch {
+          // metadata opcional
+        }
+
+        const inicio = paginaInicio;
+        if (!Number.isInteger(inicio) || inicio > totalPaginas) {
+          return {
+            ok: false,
+            error: `La página inicial debe estar entre 1 y ${totalPaginas}`,
+          };
+        }
+        if (paginaFin !== undefined && (!Number.isInteger(paginaFin) || paginaFin < inicio)) {
+          return {
+            ok: false,
+            error: "La página final debe ser un entero mayor o igual a la página inicial",
+          };
+        }
+
+        const fin = paginaFin ? Math.min(paginaFin, totalPaginas) : totalPaginas;
+        const paginasSolicitadas = fin - inicio + 1;
+        if (paginasSolicitadas > MAX_PDF_PAGES_PER_REQUEST) {
+          return {
+            ok: false,
+            error: `Se pueden leer como máximo ${MAX_PDF_PAGES_PER_REQUEST} páginas por solicitud`,
+          };
+        }
+
+        const textosPorPagina: Array<{ pagina: number; texto: string }> = [];
+
+        for (let i = inicio; i <= fin; i++) {
+          assertBeforeDeadline(deadline, "La lectura del PDF");
+          const pagina = await doc.getPage(i);
+          const contenido = await pagina.getTextContent();
+          const texto = (contenido.items as any[])
+            .map((item: any) => item.str ?? "")
+            .join(" ")
+            .replace(/\s+/g, " ")
+            .trim();
+          textosPorPagina.push({ pagina: i, texto });
+        }
+
+        const textoCompleto = textosPorPagina.map((p) => p.texto).join("\n\n");
+
+        log.info(`PDF leído: ${totalPaginas} páginas, ${textoCompleto.length} caracteres`);
+
+        return {
+          ok: true,
+          ruta: rutaAbsoluta,
+          totalPaginas,
+          paginasLeidas: paginasSolicitadas,
+          titulo,
+          texto: textoCompleto,
+          paginas: textosPorPagina,
+        };
+      } finally {
+        await loadingTask.destroy();
       }
-
-      const inicio = paginaInicio;
-      const fin = paginaFin ? Math.min(paginaFin, totalPaginas) : totalPaginas;
-
-      const textosPorPagina: Array<{ pagina: number; texto: string }> = [];
-
-      for (let i = inicio; i <= fin; i++) {
-        const pagina = await doc.getPage(i);
-        const contenido = await pagina.getTextContent();
-        const texto = (contenido.items as any[])
-          .map((item: any) => item.str ?? "")
-          .join(" ")
-          .replace(/\s+/g, " ")
-          .trim();
-        textosPorPagina.push({ pagina: i, texto });
-      }
-
-      const textoCompleto = textosPorPagina.map((p) => p.texto).join("\n\n");
-
-      log.info(`PDF leído: ${totalPaginas} páginas, ${textoCompleto.length} caracteres`);
-
-      return {
-        ok: true,
-        ruta: rutaAbsoluta,
-        totalPaginas,
-        paginasLeidas: fin - inicio + 1,
-        titulo,
-        texto: textoCompleto,
-        paginas: textosPorPagina,
-      };
     } catch (error) {
       log.error(`Error leyendo PDF: ${(error as Error).message}`);
       return {

package/packages/core/src/tools/office/office-leer-xlsx.ts

@@ -11,6 +11,14 @@ import { logger } from "../../utils/logger.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { cargarXlsx } from "./xlsx-loader.ts";
+import {
+  assertBeforeDeadline,
+  MAX_XLSX_INPUT_BYTES,
+  MAX_XLSX_ROWS_PER_SHEET,
+  MAX_XLSX_SHEETS,
+  OFFICE_PROCESSING_TIMEOUT_MS,
+  validateOfficeInput,
+} from "./security-limits.ts";
 
 const log = logger.child("office-leer-xlsx");
 
@@ -56,32 +64,43 @@ export const officeLeerXlsxTool: Tool = {
         return { ok: false, error: `Archivo no encontrado: ${rutaAbsoluta}` };
       }
 
+      const inputError = validateOfficeInput(
+        rutaAbsoluta,
+        MAX_XLSX_INPUT_BYTES,
+        "El XLSX",
+      );
+      if (inputError) return { ok: false, error: inputError };
+
       const XLSX = await cargarXlsx();
       const buffer = fs.readFileSync(rutaAbsoluta);
-      const workbook = XLSX.read(buffer, { type: "buffer" });
+      const deadline = Date.now() + OFFICE_PROCESSING_TIMEOUT_MS;
+      const workbook = XLSX.read(buffer, {
+        type: "buffer",
+        sheetRows: MAX_XLSX_ROWS_PER_SHEET + 2,
+        sheets: hojaFiltro,
+      });
 
       const nombresHojas = hojaFiltro
         ? [hojaFiltro]
         : workbook.SheetNames;
 
+      if (nombresHojas.length > MAX_XLSX_SHEETS) {
+        return {
+          ok: false,
+          error: `El XLSX contiene más de ${MAX_XLSX_SHEETS} hojas`,
+        };
+      }
+
       const hojas: Record<string, any[]> = {};
 
       for (const nombreHoja of nombresHojas) {
+        assertBeforeDeadline(deadline, "La lectura del XLSX");
         const hoja = workbook.Sheets[nombreHoja];
         if (!hoja) {
           log.warn(`Hoja '${nombreHoja}' no encontrada en el archivo`);
           continue;
         }
 
-        const opciones: any = {
-          header: incluirEncabezados ? 1 : 1,
-          defval: "",
-        };
-
-        if (rango) {
-          opciones.range = rango;
-        }
-
         if (incluirEncabezados) {
           // La primera fila se usa como encabezados
           hojas[nombreHoja] = XLSX.utils.sheet_to_json(hoja, {
@@ -96,6 +115,13 @@ export const officeLeerXlsxTool: Tool = {
             range: rango,
           });
         }
+
+        if (hojas[nombreHoja].length > MAX_XLSX_ROWS_PER_SHEET) {
+          return {
+            ok: false,
+            error: `La hoja '${nombreHoja}' supera el máximo de 10.000 filas`,
+          };
+        }
       }
 
       const totalFilas = Object.values(hojas).reduce(

package/packages/core/src/tools/office/security-limits.ts

@@ -0,0 +1,28 @@
+import { statSync } from "node:fs";
+
+export const MAX_PDF_INPUT_BYTES = 25 * 1024 * 1024;
+export const MAX_XLSX_INPUT_BYTES = 15 * 1024 * 1024;
+export const MAX_PDF_PAGES_PER_REQUEST = 200;
+export const MAX_XLSX_SHEETS = 50;
+export const MAX_XLSX_ROWS_PER_SHEET = 10_000;
+export const OFFICE_PROCESSING_TIMEOUT_MS = 30_000;
+
+export function validateOfficeInput(
+  filePath: string,
+  maxBytes: number,
+  label: string,
+): string | null {
+  const stat = statSync(filePath);
+  if (!stat.isFile()) return `${label} debe ser un archivo regular`;
+  if (stat.size > maxBytes) {
+    const maxMiB = maxBytes / (1024 * 1024);
+    return `${label} excede el límite de ${maxMiB} MiB`;
+  }
+  return null;
+}
+
+export function assertBeforeDeadline(deadline: number, label: string): void {
+  if (Date.now() > deadline) {
+    throw new Error(`${label} excedió el límite de procesamiento de 30 segundos`);
+  }
+}

package/packages/core/src/utils/port.ts

@@ -0,0 +1,33 @@
+/**
+ * Resolución de puertos desde el entorno.
+ *
+ * Bun 1.4 endureció `Bun.serve`: un puerto fuera de `[0, 65535]` —o `NaN`, que
+ * es lo que devuelve `parseInt("no-es-un-numero")`— ahora lanza `RangeError` en
+ * vez de recortar el valor. Un `HIVE_PORT` mal escrito dejó de degradar y pasó a
+ * tumbar el arranque con una excepción sin capturar:
+ *
+ *     RangeError: The value of "options.port" is out of range.
+ *                 It must be an integer. Received NaN
+ *
+ * Este helper vuelve a la degradación explícita: avisa y sigue con el puerto por
+ * defecto, que para una variable de entorno mal tipeada es el comportamiento
+ * útil. El `0` se deja pasar a propósito: `Bun.serve` lo interpreta como "asigná
+ * un puerto libre" y hay código que se apoya en eso.
+ *
+ * Avisa con `console.warn` y no con el logger del proyecto a propósito: esto lo
+ * usa `config/loader.ts`, y el logger importa `config/loader.ts` para saber
+ * dónde escribir. Importarlo acá cierra el ciclo y rompe con "Cannot access
+ * 'logger' before initialization". Además, cuando se resuelve un puerto el
+ * logger todavía no está configurado.
+ */
+
+export function resolvePort(raw: unknown, fallback: number): number {
+  if (raw === undefined || raw === null || raw === "") return fallback
+
+  const n = typeof raw === "number" ? raw : Number(String(raw).trim())
+  if (!Number.isInteger(n) || n < 0 || n > 65535) {
+    console.warn(`[config] Puerto inválido ${JSON.stringify(raw)}; se usa ${fallback}`)
+    return fallback
+  }
+  return n
+}

package/packages/core/src/voice/index.ts

@@ -1,3 +1,4 @@
+import { resolvePort } from "../utils/port.ts";
 import { col } from "../storage/hive.ts";
 import type { ChannelDoc, ModelDoc } from "../storage/collections.ts";
 import { loadProviderApiKey } from "../storage/crypto.ts";
@@ -281,7 +282,7 @@ class VoiceService {
 
   private async speakWithPiper(text: string, voiceId?: string): Promise<AudioOutput> {
     const cleanText = cleanTextForTTS(text);
-    const port = Number(process.env.TTS_PORT ?? 5500);
+    const port = resolvePort(process.env.TTS_PORT, 5500);
     const res = await fetch(`http://localhost:${port}/tts`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },