@danieltmn/tamnora 0.1.0 → 0.3.0

package/harness/packages/core/src/mcp/registry.js

@@ -0,0 +1,117 @@
+// Cliente del registro oficial de MCP (registry.modelcontextprotocol.io) y
+// normalizador de configs para importar servidores desde JSON.
+
+import { providerFetch } from '../providers/utils.js';
+
+const REGISTRY = 'https://registry.modelcontextprotocol.io';
+
+function slugifyId(name) {
+  return String(name ?? '')
+    .split('/')
+    .pop()
+    .replace(/[^a-z0-9_-]+/gi, '-')
+    .replace(/^-+|-+$/g, '')
+    .toLowerCase()
+    .slice(0, 40);
+}
+
+/** Busca servidores en el registro oficial. Devuelve la lista de `server`. */
+export async function searchMcpRegistry(query, { limit = 10 } = {}) {
+  const url = new URL(`${REGISTRY}/v0/servers`);
+  if (query) url.searchParams.set('search', String(query));
+  url.searchParams.set('limit', String(limit));
+  const res = await providerFetch(url.toString(), {
+    headers: { 'User-Agent': 'tamnora-harness', Accept: 'application/json' },
+  });
+  if (!res.ok) throw new Error(`El registro MCP respondio HTTP ${res.status}`);
+  const data = await res.json();
+  return (data.servers ?? []).map((entry) => entry.server ?? entry);
+}
+
+/** Busca por nombre exacto; con `strict` no cae en el primer resultado difuso. */
+export async function getMcpRegistryServer(query, { strict = false } = {}) {
+  const servers = await searchMcpRegistry(query, { limit: 10 });
+  const exact = servers.find(
+    (s) => s.name === query || s.title === query || slugifyId(s.name) === slugifyId(query)
+  );
+  if (exact) return exact;
+  return strict ? null : servers[0] ?? null;
+}
+
+/** Mapea un server del registro oficial a nuestra config de `mcp[]`. */
+export function registryServerToConfig(server) {
+  if (!server?.name) throw new Error('El servidor no tiene nombre.');
+  const id = slugifyId(server.name) || 'mcp';
+  const remote = (server.remotes ?? [])[0];
+  if (remote?.url) {
+    return { id, name: server.title || server.name, type: 'http', url: remote.url, enabled: true };
+  }
+  const pkg = (server.packages ?? [])[0];
+  if (pkg) {
+    const runtime = pkg.runtimeHint || (pkg.registryType === 'npm' ? 'npx' : 'uvx');
+    const args = [];
+    for (const arg of pkg.runtimeArguments ?? []) if (arg.type === 'positional' && arg.value) args.push(arg.value);
+    if (runtime === 'npx' && !args.includes('-y')) args.unshift('-y');
+    args.push(`${pkg.identifier}${pkg.version ? `@${pkg.version}` : ''}`);
+    const env = {};
+    for (const variable of pkg.environmentVariables ?? []) env[variable.name] = '';
+    const requiredEnv = (pkg.environmentVariables ?? []).filter((v) => v.isRequired).map((v) => v.name);
+    return {
+      id,
+      name: server.title || server.name,
+      type: 'stdio',
+      command: runtime,
+      args,
+      env,
+      requiredEnv,
+      enabled: true,
+    };
+  }
+  throw new Error('El servidor del registro no tiene remotes ni packages compatibles.');
+}
+
+/**
+ * Normaliza un snippet JSON a nuestra config. Acepta:
+ *  - `{ command, args, env }` o `{ url }`
+ *  - `{ mcpServers: { nombre: {...} } }` (formato Claude Desktop / mcpservers.org)
+ */
+export function normalizeMcpConfig(input, fallbackId = 'mcp') {
+  let value = input;
+  if (typeof value === 'string') {
+    try {
+      value = JSON.parse(value);
+    } catch {
+      throw new Error('El JSON no es valido.');
+    }
+  }
+  if (!value || typeof value !== 'object') throw new Error('Falta la config del servidor.');
+
+  let id = fallbackId;
+  let def = value;
+  const servers = value.mcpServers ?? value.mcp_servers;
+  if (servers && typeof servers === 'object') {
+    const key = Object.keys(servers)[0];
+    if (!key) throw new Error('El bloque "mcpServers" esta vacio.');
+    id = key;
+    def = servers[key];
+  }
+  if (value.id) id = String(value.id);
+  if (!def || typeof def !== 'object') throw new Error('Config invalida.');
+
+  const url = def.url ?? def.serverUrl;
+  const command = def.command;
+  if (!url && !command) throw new Error('La config necesita "command" (stdio) o "url" (http).');
+
+  const rawArgs = def.args ?? def.arguments ?? [];
+  const args = Array.isArray(rawArgs) ? rawArgs.map(String) : String(rawArgs).split(/\s+/).filter(Boolean);
+  return {
+    id: slugifyId(id) || fallbackId,
+    name: def.name || id,
+    type: url ? 'http' : 'stdio',
+    command: url ? undefined : String(command),
+    args: url ? [] : args,
+    url: url ? String(url) : undefined,
+    env: def.env && typeof def.env === 'object' ? def.env : undefined,
+    enabled: def.enabled !== false,
+  };
+}

package/harness/packages/core/src/procs/detect.js

@@ -0,0 +1,69 @@
+// Deteccion de como correr el proyecto en desarrollo (dev server) a partir de
+// package.json, composer/artisan y entrypoints PHP.
+
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+
+export const DEFAULT_PROCESS_ALLOW = [
+  'npm',
+  'node',
+  'npx',
+  'pnpm',
+  'yarn',
+  'bun',
+  'bunx',
+  'php',
+  'python',
+  'python3',
+  'composer',
+];
+
+const SCRIPT_ORDER = ['dev', 'start', 'serve', 'preview'];
+
+function readJson(file) {
+  try {
+    return JSON.parse(readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Package manager por `packageManager` o por lockfile (default npm). */
+export function packageManager(dir) {
+  const pkg = readJson(path.join(dir, 'package.json'));
+  if (pkg?.packageManager) return String(pkg.packageManager).split('@')[0];
+  if (existsSync(path.join(dir, 'pnpm-lock.yaml'))) return 'pnpm';
+  if (existsSync(path.join(dir, 'yarn.lock'))) return 'yarn';
+  if (existsSync(path.join(dir, 'bun.lockb')) || existsSync(path.join(dir, 'bun.lock'))) return 'bun';
+  return 'npm';
+}
+
+/** Devuelve chips `{ label, command, args, cwd }` para arrancar el proyecto. */
+export function detectProcs(dir) {
+  const chips = [];
+  const pkg = readJson(path.join(dir, 'package.json'));
+  if (pkg?.scripts && typeof pkg.scripts === 'object') {
+    const pm = packageManager(dir);
+    const names = SCRIPT_ORDER.filter((name) => pkg.scripts[name]);
+    if (!names.length) {
+      const first = Object.keys(pkg.scripts)[0];
+      if (first) names.push(first);
+    }
+    for (const name of names) chips.push({ label: `${name} (${pm})`, command: pm, args: ['run', name], cwd: dir });
+  }
+
+  if (existsSync(path.join(dir, 'artisan'))) {
+    chips.push({ label: 'artisan serve', command: 'php', args: ['artisan', 'serve'], cwd: dir });
+  } else if (readJson(path.join(dir, 'composer.json'))?.scripts?.dev) {
+    chips.push({ label: 'composer dev', command: 'composer', args: ['run', 'dev'], cwd: dir });
+  }
+
+  for (const rel of ['public/index.php', 'backend/public/index.php', 'index.php']) {
+    if (!existsSync(path.join(dir, rel))) continue;
+    const docroot = path.dirname(rel) === '.' ? '.' : path.dirname(rel);
+    chips.push({ label: `php -S (${rel})`, command: 'php', args: ['-S', '127.0.0.1:8000', '-t', docroot], cwd: dir });
+    break;
+  }
+
+  return chips;
+}

package/harness/packages/core/src/providers/ollama.js

@@ -1,5 +1,5 @@
 import { readNDJSON } from './stream.js';
-import { joinUrl, providerError, sortModels } from './utils.js';
+import { joinUrl, providerError, providerFetch, sortModels } from './utils.js';
 
 const OLLAMA_BASE_URL = 'http://localhost:11434';
 
@@ -46,7 +46,7 @@ export const ollamaProvider = {
   requiresKey: false,
 
   async listModels({ baseUrl }) {
-    const res = await fetch(joinUrl(baseUrl, '/api/tags'));
+    const res = await providerFetch(joinUrl(baseUrl, '/api/tags'));
     if (!res.ok) throw new Error(`No se pudo conectar con Ollama (HTTP ${res.status})`);
     const data = await res.json();
     return sortModels((data.models ?? []).map(toOllamaModel).filter((m) => m.id));
@@ -56,7 +56,7 @@ export const ollamaProvider = {
     const body = { model, messages: toOllamaMessages(messages), stream: true };
     if (tools?.length) body.tools = tools;
 
-    const res = await fetch(joinUrl(baseUrl, '/api/chat'), {
+    const res = await providerFetch(joinUrl(baseUrl, '/api/chat'), {
       method: 'POST',
       signal,
       headers: { 'Content-Type': 'application/json' },

package/harness/packages/core/src/providers/openaiCompatible.js

@@ -1,5 +1,5 @@
 import { readOpenAISSE } from './stream.js';
-import { joinUrl, authHeaders, providerError, normalizeModel, sortModels } from './utils.js';
+import { joinUrl, authHeaders, providerError, providerFetch, normalizeModel, sortModels } from './utils.js';
 
 /**
  * Generic adapter for any OpenAI-compatible chat completions API
@@ -12,7 +12,7 @@ export const openaiCompatibleProvider = {
   requiresKey: true,
 
   async listModels({ baseUrl, apiKey, headers }) {
-    const res = await fetch(joinUrl(baseUrl, '/models'), {
+    const res = await providerFetch(joinUrl(baseUrl, '/models'), {
       headers: authHeaders({ apiKey, headers }),
     });
     if (!res.ok) throw new Error(`No se pudo listar modelos (HTTP ${res.status})`);
@@ -38,7 +38,7 @@ export const openaiCompatibleProvider = {
 };
 
 export async function requestStream({ url, headers, providerLabel, model, body, signal, onEvent }) {
-  const res = await fetch(url, {
+  const res = await providerFetch(url, {
     method: 'POST',
     signal,
     headers: { ...headers, 'Content-Type': 'application/json' },

package/harness/packages/core/src/providers/openrouter.js

@@ -1,5 +1,5 @@
 import { requestStream } from './openaiCompatible.js';
-import { joinUrl, normalizeModel, sortModels } from './utils.js';
+import { joinUrl, providerFetch, normalizeModel, sortModels } from './utils.js';
 
 const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 
@@ -23,7 +23,7 @@ export const openrouterProvider = {
   requiresKey: true,
 
   async listModels({ apiKey, siteUrl, siteName }) {
-    const res = await fetch(joinUrl(OPENROUTER_BASE_URL, '/models'), {
+    const res = await providerFetch(joinUrl(OPENROUTER_BASE_URL, '/models'), {
       headers: openrouterHeaders({ apiKey, siteUrl, siteName }),
     });
     if (!res.ok) throw new Error(`No se pudo listar modelos (HTTP ${res.status})`);

package/harness/packages/core/src/providers/resilience.js

@@ -12,7 +12,7 @@ export function isRetryableError(err) {
   if (!err || isAbortError(err)) return false;
   const status = err.status ?? err.statusCode ?? err.response?.status;
   if (status) return status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
-  const code = String(err.code || '');
+  const code = String(err.code || err.cause?.code || '');
   if (
     ['ECONNRESET', 'ETIMEDOUT', 'ECONNREFUSED', 'EAI_AGAIN', 'ENOTFOUND', 'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT'].includes(
       code

package/harness/packages/core/src/providers/utils.js

@@ -10,6 +10,49 @@ export function authHeaders({ apiKey, headers = {} }) {
   return result;
 }
 
+const NETWORK_CODES = [
+  'ECONNRESET',
+  'ETIMEDOUT',
+  'ECONNREFUSED',
+  'EAI_AGAIN',
+  'ENOTFOUND',
+  'UND_ERR_SOCKET',
+  'UND_ERR_CONNECT_TIMEOUT',
+  'UND_ERR_HEADERS_TIMEOUT',
+];
+
+/**
+ * Wrap `fetch` so a low-level network failure (DNS, connection refused, TLS,
+ * offline) produces a readable message instead of the bare "fetch failed".
+ * The original error is kept as `cause` and its code is promoted so retry
+ * heuristics still recognize the failure as transient.
+ */
+export async function providerFetch(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    if (error?.name === 'AbortError') throw error;
+    const cause = error?.cause;
+    const code = cause?.code ?? error?.code;
+    const message = String(error?.message ?? '');
+    const networkish =
+      NETWORK_CODES.includes(code) || /fetch failed|network|socket|econnrefused|enotfound|econnreset/i.test(message);
+    if (!networkish) throw error;
+
+    let host = url;
+    try {
+      host = new URL(url).host;
+    } catch {
+      /* keep the raw url */
+    }
+    const detail = cause?.message && cause.message !== message ? ` (${cause.message})` : '';
+    const friendly = new Error(`No se pudo conectar con ${host}${detail}. Revisá la red, el DNS o el proxy.`);
+    friendly.cause = error;
+    if (code) friendly.code = code;
+    throw friendly;
+  }
+}
+
 /**
  * Build a descriptive error from a failed provider response, detecting the
  * common "model does not support tools" case.

package/harness/packages/core/src/skills/index.js

@@ -0,0 +1,90 @@
+// Skills: instrucciones especializadas en `<raiz>/<slug>/SKILL.md` con
+// frontmatter simple (name, description, when). Se inyectan al system prompt
+// las que esten habilitadas.
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+/** Parse a SKILL.md: frontmatter `--- key: value ---` plus body. */
+export function parseSkillMarkdown(text, fallbackId = '') {
+  const source = String(text ?? '');
+  let name = fallbackId;
+  let description = '';
+  let when = '';
+  let body = source.trim();
+  const match = source.match(/^---\s*\r?\n([\s\S]*?)\r?\n---\s*\r?\n?([\s\S]*)$/);
+  if (match) {
+    body = match[2].trim();
+    for (const line of match[1].split(/\r?\n/)) {
+      const kv = line.match(/^([A-Za-z][\w-]*)\s*:\s*(.*)$/);
+      if (!kv) continue;
+      const key = kv[1].toLowerCase();
+      const value = kv[2].trim().replace(/^["']|["']$/g, '');
+      if (key === 'name') name = value;
+      else if (key === 'description') description = value;
+      else if (key === 'when' || key === 'when_to_use') when = value;
+    }
+  }
+  return { name: name || fallbackId, description, when, body };
+}
+
+/** List the skills under a root (`<root>/<slug>/SKILL.md`). Missing root -> []. */
+export function loadSkills(root) {
+  const skills = [];
+  let entries = [];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return skills;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(root, entry.name);
+    const file = path.join(dir, 'SKILL.md');
+    try {
+      if (!statSync(file).isFile()) continue;
+      const parsed = parseSkillMarkdown(readFileSync(file, 'utf8'), entry.name);
+      skills.push({ id: entry.name, dir, path: file, ...parsed });
+    } catch {
+      // ignore unreadable skills
+    }
+  }
+  return skills.sort((a, b) => a.id.localeCompare(b.id, 'es'));
+}
+
+/** Merge several roots; later roots win on id collisions (workspace over casa). */
+export function mergeSkills(rootLists = []) {
+  const byId = new Map();
+  for (const list of rootLists) for (const skill of list) byId.set(skill.id, skill);
+  return [...byId.values()];
+}
+
+/** Escribe los archivos de una skill en `dir` (con guarda de traversal). */
+export async function writeSkillFiles(dir, files = []) {
+  const root = path.resolve(dir);
+  for (const file of files) {
+    const rel = String(file.path ?? '')
+      .replace(/\\/g, '/')
+      .replace(/^\/+/, '');
+    if (!rel) continue;
+    const target = path.resolve(root, rel);
+    if (target !== root && !target.startsWith(root + path.sep)) {
+      throw new Error(`Ruta de skill inválida: ${file.path}`);
+    }
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, String(file.contents ?? ''), 'utf8');
+  }
+}
+
+/** Text block appended to the system prompt with the enabled skills. */
+export function buildSkillsPrompt(skills = []) {
+  if (!skills.length) return '';
+  const parts = ['Tenés acceso a estas skills (instrucciones especializadas). Aplicá la que corresponda a la tarea:'];
+  for (const skill of skills) {
+    const title = skill.name || skill.id;
+    const desc = skill.description ? `${skill.description}\n` : '';
+    parts.push(`\n## ${title}\n${desc}${skill.body}`.trimEnd());
+  }
+  return parts.join('\n');
+}

package/harness/packages/core/src/skills/remote.js

@@ -0,0 +1,80 @@
+// Importa skills desde skills.sh resolviendolas por GitHub (la API de skills.sh
+// requiere un token OIDC de Vercel, pero los skills salen de repos de GitHub).
+
+const GITHUB_API = 'https://api.github.com';
+const RAW = 'https://raw.githubusercontent.com';
+
+/**
+ * Acepta una URL de skills.sh (`https://skills.sh/<owner>/<repo>/<slug>`), una
+ * de GitHub, o un id `owner/repo[/slug]`. Devuelve `{ owner, repo, slug }`.
+ */
+export function parseSkillRef(input) {
+  const raw = String(input ?? '').trim();
+  if (!raw) return null;
+  let url = null;
+  try {
+    url = new URL(raw);
+  } catch {
+    url = null;
+  }
+  if (url) {
+    const parts = url.pathname.split('/').filter(Boolean);
+    if (/(^|\.)skills\.sh$/i.test(url.hostname) && parts.length >= 3) {
+      return { owner: parts[0], repo: parts[1], slug: parts[2] };
+    }
+    if (url.hostname === 'github.com' && parts.length >= 2) {
+      return { owner: parts[0], repo: parts[1], slug: parts[2] ?? null };
+    }
+    return null;
+  }
+  const parts = raw.replace(/^\/+/, '').split('/').filter(Boolean);
+  if (parts.length === 3) return { owner: parts[0], repo: parts[1], slug: parts[2] };
+  if (parts.length === 2) return { owner: parts[0], repo: parts[1], slug: null };
+  return null;
+}
+
+async function ghJson(url) {
+  const res = await fetch(url, {
+    headers: { 'User-Agent': 'tamnora-harness', Accept: 'application/vnd.github+json' },
+  });
+  if (!res.ok) throw new Error(`GitHub respondio HTTP ${res.status}`);
+  return res.json();
+}
+
+/**
+ * Baja los archivos de una skill (`SKILL.md` y los del mismo directorio) desde
+ * el repositorio de GitHub. Sin `slug`, toma el `SKILL.md` de la raiz.
+ */
+export async function fetchSkillFromGithub({ owner, repo, slug }) {
+  const meta = await ghJson(`${GITHUB_API}/repos/${owner}/${repo}`);
+  const ref = meta.default_branch || 'main';
+  const tree = await ghJson(`${GITHUB_API}/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`);
+  const entries = (tree.tree ?? []).filter((e) => e.type === 'blob');
+
+  let dir = null;
+  if (slug) {
+    const matches = entries
+      .filter((e) => e.path.endsWith(`/${slug}/SKILL.md`) || e.path === `${slug}/SKILL.md`)
+      .sort((a, b) => a.path.length - b.path.length);
+    if (matches.length) dir = matches[0].path.slice(0, -'SKILL.md'.length).replace(/\/$/, '');
+  }
+  if (dir === null && !slug) {
+    const root = entries.find((e) => e.path === 'SKILL.md');
+    if (root) dir = '';
+  }
+  if (dir === null) throw new Error(`No encontre la skill "${slug ?? repo}" en ${owner}/${repo}.`);
+
+  const prefix = dir ? `${dir}/` : '';
+  const paths = entries
+    .filter((e) => e.path.startsWith(prefix) && e.path !== prefix)
+    .map((e) => e.path);
+  if (!paths.some((p) => p === `${prefix}SKILL.md`)) throw new Error('La skill no tiene SKILL.md.');
+
+  const files = [];
+  for (const path of paths) {
+    const res = await fetch(`${RAW}/${owner}/${repo}/${encodeURIComponent(ref)}/${path}`);
+    if (!res.ok) continue;
+    files.push({ path: path.slice(prefix.length), contents: await res.text() });
+  }
+  return { id: slug || repo, source: `${owner}/${repo}`, slug: slug || repo, files };
+}

package/harness/packages/core/src/storage/sqlite.js

@@ -227,6 +227,27 @@ export class Store {
     this.db.prepare(`DELETE FROM sessions WHERE id = ?`).run(id);
   }
 
+  /** Borra todas las sesiones (y sus mensajes) de una carpeta. No toca archivos. */
+  deleteSessionsByCwd(cwd) {
+    const value = cwd === undefined || cwd === '' ? null : cwd;
+    const messages = this.db
+      .prepare(`DELETE FROM messages WHERE session_id IN (SELECT id FROM sessions WHERE cwd IS ?)`)
+      .run(value);
+    const sessions = this.db.prepare(`DELETE FROM sessions WHERE cwd IS ?`).run(value);
+    return { sessions: sessions.changes, messages: messages.changes };
+  }
+
+  /** Carpetas de trabajo con cantidad de sesiones (los "proyectos" del sidebar). */
+  listProjects() {
+    return this.db
+      .prepare(
+        `SELECT cwd, COUNT(*) AS sessions, MAX(updated_at) AS updated_at
+         FROM sessions GROUP BY cwd ORDER BY updated_at DESC`
+      )
+      .all()
+      .map((row) => ({ cwd: row.cwd, sessions: row.sessions, updatedAt: row.updated_at }));
+  }
+
   // --- Messages -----------------------------------------------------------
 
   addMessage(sessionId, message) {

package/harness/packages/core/src/tools/executors.js

@@ -11,6 +11,60 @@ const MAX_GLOB = 500;
 const MAX_GREP = 300;
 const MAX_GREP_FILE_BYTES = 2_000_000;
 const MAX_BASH_OUTPUT = 100_000;
+const FETCH_TIMEOUT_MS = 20000;
+const MAX_FETCH_CHARS = 200_000;
+
+function isBlockedHost(hostname) {
+  const h = String(hostname ?? '')
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '');
+  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+  if (h === '::1' || h === '0.0.0.0') return true;
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return false;
+  const a = Number(m[1]);
+  const b = Number(m[2]);
+  if (a === 127 || a === 10 || a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  return false;
+}
+
+export async function fetchUrlTool(_root, { url, maxLength } = {}) {
+  let target;
+  try {
+    target = new URL(String(url ?? ''));
+  } catch {
+    return 'Error: URL inválida.';
+  }
+  if (!/^https?:$/.test(target.protocol)) return 'Error: solo se permite http/https.';
+  if (isBlockedHost(target.hostname)) return `Error: host bloqueado (${target.hostname}).`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(target.toString(), {
+      redirect: 'follow',
+      signal: controller.signal,
+      headers: {
+        'User-Agent': 'tamnora-harness (+https://github.com/tamnora/tamnora-harness)',
+        Accept: '*/*',
+      },
+    });
+    const type = res.headers.get('content-type') || '';
+    const limit = Math.min(Math.max(Number(maxLength) || 20000, 500), MAX_FETCH_CHARS);
+    const text = await res.text();
+    const body = text.slice(0, limit);
+    const truncated = text.length > limit ? `\n[... truncado ${text.length - limit} caracteres]` : '';
+    return `${res.status} ${res.statusText || ''} · ${type || 'sin content-type'} · ${target.toString()}\n\n${body}${truncated}`;
+  } catch (err) {
+    if (err?.name === 'AbortError') return `Error: timeout (${FETCH_TIMEOUT_MS / 1000}s) al pedir ${target}.`;
+    return `Error de red al pedir ${target}: ${err?.message ?? err}`;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 export async function readTool(root, { path: p, offset, limit } = {}) {
   const abs = resolveInRoot(root, p);
@@ -270,6 +324,7 @@ export const EXECUTORS = {
   glob: globTool,
   grep: grepTool,
   bash: bashTool,
+  fetch_url: fetchUrlTool,
   git_status: gitStatusTool,
   git_diff: gitDiffTool,
   git_log: gitLogTool,

package/harness/packages/core/src/tools/permissions.js

@@ -12,6 +12,7 @@ export const DEFAULT_PERMISSIONS = {
   git_status: 'allow',
   git_diff: 'allow',
   git_log: 'allow',
+  fetch_url: 'allow',
   write: 'ask',
   edit: 'ask',
   bash: 'ask',
@@ -40,6 +41,7 @@ function matchPattern(pattern, subject) {
 function subjectFor(name, args) {
   if (name === 'bash') return args?.command ?? '';
   if (name === 'git_commit') return args?.message ?? '';
+  if (name === 'fetch_url') return args?.url ?? '';
   return args?.path ?? '';
 }
 

package/harness/packages/core/src/tools/schema.js

@@ -116,6 +116,22 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'fetch_url',
+      description:
+        'Fetch a URL over http(s) and return its text content (status, content-type and body). Use it to read docs, APIs or raw files.',
+      parameters: {
+        type: 'object',
+        properties: {
+          url: { type: 'string', description: 'Absolute http(s) URL' },
+          maxLength: { type: 'integer', description: 'Max characters of the body (default 20000)' },
+        },
+        required: ['url'],
+      },
+    },
+  },
   {
     type: 'function',
     function: {