@danieltmn/tamnora 0.1.0 → 0.3.0

package/harness/packages/server/public/index.html

@@ -37,6 +37,7 @@
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>
+        <button class="tab" data-tab="ajustes">ajustes</button>
         <div class="menu">
           <button id="more-tab" class="tab" title="más" aria-haspopup="true" aria-expanded="false" aria-label="más">
             <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
@@ -150,7 +151,11 @@
 
         <aside id="explorer" class="explorer" hidden>
           <div class="explorer-head">
-            <span class="explorer-title">estructura</span>
+            <div class="xtabs">
+              <button type="button" class="xtab is-active" data-xp="files">estructura</button>
+              <button type="button" class="xtab" data-xp="preview">preview</button>
+              <button type="button" class="xtab" data-xp="procs">procs</button>
+            </div>
             <span class="spacer"></span>
             <button id="explorer-refresh" type="button" class="btn icon" title="refrescar" aria-label="refrescar">
               <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
@@ -166,12 +171,35 @@
               </svg>
             </button>
           </div>
-          <div id="explorer-root" class="explorer-cwd" title=""></div>
-          <div class="explorer-filter">
-            <input id="explorer-filter" placeholder="filtrar por nombre…" spellcheck="false" />
+
+          <div id="xp-files" class="xp-pane">
+            <div id="explorer-root" class="explorer-cwd" title=""></div>
+            <div class="explorer-filter">
+              <input id="explorer-filter" placeholder="filtrar por nombre…" spellcheck="false" />
+            </div>
+            <ul id="explorer-tree" class="tree"></ul>
+            <div id="explorer-status" class="explorer-status"></div>
+          </div>
+
+          <div id="xp-preview" class="xp-pane" hidden>
+            <div class="xp-bar">
+              <input id="preview-url" placeholder="http://127.0.0.1:5173" spellcheck="false" />
+              <button id="preview-open" class="btn" type="button">abrir</button>
+              <button id="preview-tunnel" class="btn" type="button" title="Abrir un túnel público al puerto (para el celular)">túnel</button>
+            </div>
+            <div id="preview-status" class="explorer-status"></div>
+            <iframe id="preview-frame" class="preview-frame" title="vista previa" referrerpolicy="no-referrer"></iframe>
+          </div>
+
+          <div id="xp-procs" class="xp-pane" hidden>
+            <div class="xp-bar">
+              <button id="procs-detect" class="btn" type="button">detectar</button>
+              <span id="procs-cwd" class="muted grow"></span>
+            </div>
+            <div id="procs-chips" class="chips"></div>
+            <ul id="procs-list" class="providers"></ul>
+            <pre id="procs-log" class="procs-log"></pre>
           </div>
-          <ul id="explorer-tree" class="tree"></ul>
-          <div id="explorer-status" class="explorer-status"></div>
         </aside>
 
         <dialog id="file-modal" class="modal file-modal">
@@ -266,6 +294,43 @@
         </div>
       </section>
 
+      <section id="view-ajustes" class="view">
+        <div class="panel">
+          <div class="row between">
+            <h2>Servidores MCP</h2>
+            <div class="row">
+              <button id="mcp-reload" class="btn">recargar</button>
+              <button id="mcp-new" class="btn">+ nuevo</button>
+            </div>
+          </div>
+          <p class="muted verify-line">
+            Se combinan con <code>mcp[]</code> de <code>tamnora.json</code>; los guardados acá viven en la base.
+          </p>
+          <div class="import-bar">
+            <input id="mcp-import" placeholder="nombre del registro oficial, URL o JSON (bloque mcpServers)" spellcheck="false" />
+            <button id="mcp-import-btn" class="btn" type="button">importar</button>
+          </div>
+          <div id="mcp-import-status" class="summary"></div>
+          <ul id="mcp-list" class="providers"></ul>
+        </div>
+
+        <div class="panel">
+          <div class="row between">
+            <h2>Skills</h2>
+            <button id="skill-new" class="btn">+ nueva</button>
+          </div>
+          <p class="muted verify-line">
+            Instrucciones especializadas en la casa de Tamnora (<code>skills/</code>). Las habilitadas se inyectan al system prompt.
+          </p>
+          <div class="import-bar">
+            <input id="skill-import" placeholder="https://skills.sh/owner/repo/skill" spellcheck="false" />
+            <button id="skill-import-btn" class="btn" type="button">importar</button>
+          </div>
+          <div id="skill-import-status" class="summary"></div>
+          <ul id="skill-list" class="providers"></ul>
+        </div>
+      </section>
+
       <dialog id="folder-modal" class="modal folder-modal">
         <div class="modal-card">
           <div class="row between">
@@ -349,6 +414,69 @@
       </div>
     </dialog>
 
+    <dialog id="mcp-modal" class="modal">
+      <form id="mcp-form" class="modal-card">
+        <div class="row between">
+          <h3 id="mcp-title">nuevo servidor MCP</h3>
+          <button type="button" id="mcp-close" class="btn icon" title="cerrar" aria-label="cerrar">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+              <path d="M18 6 6 18M6 6l12 12" />
+            </svg>
+          </button>
+        </div>
+        <div class="row">
+          <label class="field"><span>id</span><input id="mf-id" spellcheck="false" placeholder="echo" /></label>
+          <label class="field grow"><span>nombre</span><input id="mf-name" spellcheck="false" placeholder="Echo" /></label>
+        </div>
+        <div class="row">
+          <label class="field"><span>transporte</span>
+            <select id="mf-transport">
+              <option value="stdio">stdio</option>
+              <option value="http">http</option>
+            </select>
+          </label>
+          <label class="field grow" id="mf-command-field"><span>comando</span><input id="mf-command" spellcheck="false" placeholder="node" /></label>
+          <label class="field grow" id="mf-url-field" hidden><span>url</span><input id="mf-url" spellcheck="false" placeholder="https://…/mcp" /></label>
+        </div>
+        <div class="row">
+          <label class="field grow" id="mf-args-field"><span>args (separados por espacio)</span><input id="mf-args" spellcheck="false" placeholder="harness/scripts/mcp-echo-server.mjs" /></label>
+        </div>
+        <label class="check"><input id="mf-enabled" type="checkbox" checked /> habilitado</label>
+        <div class="row between settings-actions">
+          <button type="button" id="mf-cancel" class="btn">cancelar</button>
+          <button type="submit" class="btn primary">guardar</button>
+        </div>
+        <div id="mf-status" class="summary"></div>
+      </form>
+    </dialog>
+
+    <dialog id="skill-modal" class="modal">
+      <form id="skill-form" class="modal-card">
+        <div class="row between">
+          <h3 id="skill-title">nueva skill</h3>
+          <button type="button" id="skill-close" class="btn icon" title="cerrar" aria-label="cerrar">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+              <path d="M18 6 6 18M6 6l12 12" />
+            </svg>
+          </button>
+        </div>
+        <div class="row">
+          <label class="field"><span>id</span><input id="sf-id" spellcheck="false" placeholder="revisar-pr" /></label>
+          <label class="field grow"><span>nombre</span><input id="sf-name" spellcheck="false" placeholder="Revisar PR" /></label>
+        </div>
+        <label class="field"><span>descripción</span><input id="sf-description" spellcheck="false" placeholder="Cuándo conviene usarla" /></label>
+        <label class="field"><span>cuándo usarla (opcional)</span><input id="sf-when" spellcheck="false" placeholder="al revisar un pull request" /></label>
+        <label class="field"><span>cuerpo (markdown)</span>
+          <textarea id="sf-body" rows="10" spellcheck="false" placeholder="Pasos e instrucciones de la skill…"></textarea>
+        </label>
+        <div class="row between settings-actions">
+          <button type="button" id="sf-cancel" class="btn">cancelar</button>
+          <button type="submit" class="btn primary">guardar</button>
+        </div>
+        <div id="sf-status" class="summary"></div>
+      </form>
+    </dialog>
+
     <dialog id="palette-modal" class="modal palette-modal">
       <div class="palette">
         <div class="palette-row">

package/harness/packages/server/public/styles.css

@@ -234,18 +234,45 @@ main { flex: 1; min-height: 0; min-width: 0; display: flex; }
 .group-head .gcount { font: 500 10px var(--mono); opacity: 0.65; }
 .group-sessions { list-style: none; margin: 0; padding: 3px 0 0 15px; display: flex; flex-direction: column; gap: 2px; }
 .session-item {
+  display: flex;
+  align-items: center;
+  gap: 6px;
   padding: 6px 9px;
   border-radius: 6px;
   cursor: pointer;
   color: var(--muted);
   white-space: nowrap;
   overflow: hidden;
-  text-overflow: ellipsis;
   border: 1px solid transparent;
 }
 .session-item:hover { background: var(--panel); color: var(--text); }
 .session-item.active { background: var(--theirs); color: var(--text); border-color: var(--border); }
 .session-item .sub { color: var(--muted); font-size: 11px; overflow: hidden; text-overflow: ellipsis; }
+.session-item .session-title { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
+.session-del,
+.group-del {
+  flex: 0 0 auto;
+  display: grid;
+  place-items: center;
+  padding: 2px;
+  border: 0;
+  border-radius: 5px;
+  background: none;
+  color: var(--muted);
+  cursor: pointer;
+  opacity: 0;
+  transition: opacity 0.12s ease, color 0.12s ease, background 0.12s ease;
+}
+.session-item:hover .session-del,
+.session-item:focus-within .session-del,
+.group-head:hover .group-del,
+.group-head:focus-within .group-del { opacity: 1; }
+.session-del:hover,
+.group-del:hover { color: var(--danger); background: var(--panel); }
+@media (hover: none) {
+  .session-del,
+  .group-del { opacity: 0.7; }
+}
 .rail-footer { border-top: 1px solid var(--border); padding-top: 8px; color: var(--muted); font-size: 12px; }
 .rail-footer b { color: var(--text); display: block; word-break: break-all; font-weight: 500; }
 .rail-exit {
@@ -717,6 +744,23 @@ pre.code code { background: none; border: 0; padding: 0; font-size: 12.5px; }
 .explorer-status { padding: 6px 12px; border-top: 1px solid var(--border); color: var(--muted); font: 500 11px var(--mono); min-height: 27px; }
 .explorer-status.err { color: var(--danger); }
 
+.xtabs { display: flex; gap: 4px; }
+.xtab { border: 0; background: none; color: var(--muted); cursor: pointer; font: 600 12px var(--sans); padding: 4px 7px; border-radius: 7px; }
+.xtab:hover { background: var(--theirs); color: var(--text); }
+.xtab.is-active { background: var(--theirs); color: var(--text); }
+.xp-pane { display: flex; flex-direction: column; flex: 1; min-height: 0; }
+.xp-bar { display: flex; gap: 6px; align-items: center; padding: 9px 12px; }
+.xp-bar input { flex: 1; min-width: 0; }
+.xp-bar .grow { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.chips { display: flex; flex-wrap: wrap; gap: 6px; padding: 0 12px 8px; }
+.xchip { border: 1px solid var(--border); background: var(--panel); color: var(--text); border-radius: 999px; padding: 4px 10px; font: 500 11px var(--mono); cursor: pointer; }
+.xchip:hover { border-color: var(--accent); color: var(--accent); }
+.preview-frame { flex: 1; width: 100%; border: 0; background: #fff; min-height: 0; }
+#procs-list { flex: 1; min-height: 0; overflow-y: auto; }
+.procs-log { margin: 0; padding: 8px 12px; height: 150px; overflow: auto; background: var(--theirs); border-top: 1px solid var(--border); font: 500 11px var(--mono); white-space: pre-wrap; word-break: break-word; }
+.import-bar { display: flex; gap: 6px; margin: 4px 0 10px; }
+.import-bar input { flex: 1; min-width: 0; }
+
 .file-actions { display: flex; align-items: center; gap: 10px; }
 .file-modal { width: min(880px, calc(100vw - 40px)); }
 .file-preview {

package/harness/packages/server/src/cli.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { parseArgs } from 'node:util';
+import { ensureUtf8Console } from './lib/core.js';
 import { createTamnoraServer } from './server.js';
 
 const OPTIONS = {
@@ -13,6 +14,7 @@ const OPTIONS = {
 
 /** Entry point shared by `tamnora serve` and the standalone server bin. */
 export async function serveCommand(argv) {
+  ensureUtf8Console();
   const { values } = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: false });
   if (values.help) {
     printHelp();

package/harness/packages/server/src/lib/agentTools.js

@@ -0,0 +1,238 @@
+// Tools de administracion que el agente puede usar desde el chat: registrar
+// MCP, instalar skills (contenido o URL) y listarlos. Pasarlas por permisos
+// porque instalar MCP/skills puede ejecutar codigo.
+
+import path from 'node:path';
+import {
+  parseSkillMarkdown,
+  parseSkillRef,
+  fetchSkillFromGithub,
+  writeSkillFiles,
+  getMcpRegistryServer,
+  registryServerToConfig,
+  normalizeMcpConfig,
+  homeDir,
+} from './core.js';
+import { SKILL_ID_PATTERN, skillsView, writeSkill, setSkillEnabled } from './skills.js';
+
+function sanitizeId(value) {
+  return String(value ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+}
+
+const MCP_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,39}$/i;
+
+function definition(name, description, parameters, required = []) {
+  return { type: 'function', function: { name, description, parameters: { type: 'object', properties: parameters, required } } };
+}
+
+const DEFINITIONS = [
+  definition('list_mcp', 'Lista los servidores MCP configurados (de tamnora.json y de la base).', {}),
+  definition(
+    'install_mcp',
+    'Registra un servidor MCP. stdio: pasá command (y args). http: pasá url.',
+    {
+      id: { type: 'string', description: 'Id corto, ej. "echo"' },
+      name: { type: 'string' },
+      registry: { type: 'string', description: 'Nombre en el registro oficial de MCP, ej. "io.github.foo/bar"' },
+      json: { type: 'string', description: 'Snippet JSON (bloque mcpServers o {command,args}/{url})' },
+      transport: { type: 'string', enum: ['stdio', 'http'] },
+      command: { type: 'string', description: 'Para stdio, ej. "node" o "npx"' },
+      args: { type: 'array', items: { type: 'string' } },
+      url: { type: 'string', description: 'Para http' },
+      enabled: { type: 'boolean' },
+    },
+    []
+  ),
+  definition('remove_mcp', 'Elimina un servidor MCP guardado desde la consola.', { id: { type: 'string' } }, ['id']),
+  definition('list_skills', 'Lista las skills instaladas y si están habilitadas.', {}),
+  definition(
+    'install_skill',
+    'Crea o actualiza una skill en la casa. Pasá "content" (markdown, opcionalmente con frontmatter) o "url" para descargarla.',
+    {
+      id: { type: 'string', description: 'Slug de la skill, ej. "revisar-pr"' },
+      name: { type: 'string' },
+      description: { type: 'string' },
+      content: { type: 'string', description: 'Contenido markdown de la skill' },
+      url: { type: 'string', description: 'URL para descargar el contenido' },
+      ref: { type: 'string', description: 'URL/id de skills.sh (https://skills.sh/owner/repo/skill)' },
+      enabled: { type: 'boolean' },
+    },
+    []
+  ),
+];
+
+async function fetchText(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 15000);
+  timer.unref?.();
+  try {
+    const res = await fetch(url, { signal: controller.signal, redirect: 'follow' });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const type = res.headers.get('content-type') || '';
+    if (type && !/text|json|markdown|xml|plain/i.test(type)) {
+      throw new Error(`tipo de contenido no textual: ${type}`);
+    }
+    return await res.text();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function decisionFor(ctx, name) {
+  const perms = ctx.config.permissions ?? {};
+  const value = perms[name];
+  if (value === 'allow' || value === 'ask' || value === 'deny') return value;
+  return name.startsWith('list_') ? 'allow' : 'ask';
+}
+
+/**
+ * Crea las tools de administracion. `execute(name, args, { approve })`, donde
+ * `approve(name, args)` resuelve true/false para los permisos "ask".
+ */
+export function createAgentTools(ctx) {
+  function handles(name) {
+    return DEFINITIONS.some((d) => d.function.name === name);
+  }
+
+  async function execute(name, args = {}, { approve } = {}) {
+    const decision = decisionFor(ctx, name);
+    if (decision === 'deny') return `Permiso denegado para "${name}".`;
+    if (decision === 'ask') {
+      const ok = approve ? await approve(name, args) : false;
+      if (!ok) return `Permiso denegado para "${name}".`;
+    }
+
+    switch (name) {
+      case 'list_mcp':
+        return JSON.stringify(ctx.mergedMcpServers().map((s) => ({
+          id: s.id,
+          name: s.name,
+          transport: s.url ? 'http' : 'stdio',
+          enabled: s.enabled !== false,
+          source: s.source ?? 'config',
+        })), null, 2);
+
+      case 'install_mcp': {
+        if (args.registry || args.name) {
+          let server;
+          try {
+            server = await getMcpRegistryServer(String(args.registry || args.name), { strict: true });
+          } catch (error) {
+            return `No se pudo consultar el registro MCP: ${error.message}`;
+          }
+          if (!server) return 'No encontré ese servidor en el registro oficial.';
+          const cfg = registryServerToConfig(server);
+          ctx.store.saveMcpServer({
+            id: cfg.id,
+            name: cfg.name,
+            transport: cfg.type === 'http' ? 'http' : 'stdio',
+            command: cfg.command ?? null,
+            url: cfg.url ?? null,
+            enabled: true,
+            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+          });
+          await ctx.reloadMcp();
+          const required = (cfg.requiredEnv ?? []).length ? ` Requiere env: ${cfg.requiredEnv.join(', ')}.` : '';
+          return `MCP "${cfg.id}" importado del registro oficial.${required}`;
+        }
+        if (args.json || args.config) {
+          let cfg;
+          try {
+            cfg = normalizeMcpConfig(args.json ?? args.config, args.id);
+          } catch (error) {
+            return `Config MCP inválida: ${error.message}`;
+          }
+          if (!MCP_ID_PATTERN.test(cfg.id)) return 'Id de MCP inválido.';
+          ctx.store.saveMcpServer({
+            id: cfg.id,
+            name: cfg.name,
+            transport: cfg.type === 'http' ? 'http' : 'stdio',
+            command: cfg.command ?? null,
+            url: cfg.url ?? null,
+            enabled: cfg.enabled !== false,
+            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+          });
+          await ctx.reloadMcp();
+          return `MCP "${cfg.id}" importado.`;
+        }
+
+        const id = String(args.id ?? '').trim();
+        if (!MCP_ID_PATTERN.test(id)) return 'Id de MCP inválido.';
+        const transport = args.transport === 'http' || (!args.command && args.url) ? 'http' : 'stdio';
+        const command = String(args.command ?? '').trim();
+        const url = String(args.url ?? '').trim();
+        if (transport === 'stdio' && !command) return 'Un MCP stdio necesita "command".';
+        if (transport === 'http' && !url) return 'Un MCP http necesita "url".';
+        ctx.store.saveMcpServer({
+          id,
+          name: String(args.name ?? id).trim() || id,
+          transport,
+          command: transport === 'stdio' ? command : null,
+          url: transport === 'http' ? url : null,
+          enabled: args.enabled !== false,
+          config: { args: Array.isArray(args.args) ? args.args : [], env: args.env ?? null },
+        });
+        await ctx.reloadMcp();
+        return `MCP "${id}" registrado (${transport}).`;
+      }
+
+      case 'remove_mcp': {
+        const id = String(args.id ?? '').trim();
+        if (!ctx.store.listMcpServers().some((s) => s.id === id)) return `No hay un MCP guardado con id "${id}".`;
+        ctx.store.deleteMcpServer(id);
+        await ctx.reloadMcp();
+        return `MCP "${id}" eliminado.`;
+      }
+
+      case 'list_skills':
+        return JSON.stringify(skillsView(ctx).map(({ id, name, enabled, description }) => ({ id, name, enabled, description })), null, 2);
+
+      case 'install_skill': {
+        const ref = parseSkillRef(args.ref ?? args.url ?? '');
+        if (ref && (args.ref || (args.url && !/\.md(\?|$)/i.test(String(args.url))))) {
+          let remote;
+          try {
+            remote = await fetchSkillFromGithub(ref);
+          } catch (error) {
+            return `No se pudo importar desde GitHub: ${error.message}`;
+          }
+          const imported = sanitizeId(remote.slug || ref.slug || ref.repo);
+          if (!SKILL_ID_PATTERN.test(imported)) return 'No se pudo derivar un id de skill válido.';
+          await writeSkillFiles(path.join(homeDir(), 'skills', imported), remote.files);
+          setSkillEnabled(ctx.store, imported, true);
+          return `Skill "${imported}" importada desde ${remote.source}.`;
+        }
+
+        const id = String(args.id ?? '').trim();
+        if (!SKILL_ID_PATTERN.test(id)) return 'Id de skill inválido (a-z, 0-9, - y _).';
+        let content = String(args.content ?? '');
+        if (!content.trim() && args.url) {
+          try {
+            content = await fetchText(String(args.url));
+          } catch (error) {
+            return `No se pudo descargar la skill: ${error.message}`;
+          }
+        }
+        if (!content.trim()) return 'Pasá "content" (markdown) o "url".';
+        const parsed = parseSkillMarkdown(content, id);
+        await writeSkill(id, {
+          name: args.name || parsed.name || id,
+          description: args.description || parsed.description,
+          when: parsed.when,
+          body: parsed.body || content,
+        });
+        if (args.enabled === false) setSkillEnabled(ctx.store, id, false);
+        return `Skill "${id}" instalada.`;
+      }
+
+      default:
+        return `Herramienta desconocida: ${name}`;
+    }
+  }
+
+  return { definitions: DEFINITIONS, handles, execute };
+}

package/harness/packages/server/src/lib/procs.js

@@ -0,0 +1,125 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { DEFAULT_PROCESS_ALLOW } from './core.js';
+
+const MAX_LOG_LINES = 400;
+
+function killTree(child) {
+  if (!child || child.killed) return;
+  const pid = child.pid;
+  try {
+    if (process.platform === 'win32' && pid) {
+      spawn('taskkill', ['/PID', String(pid), '/T', '/F'], { windowsHide: true });
+    } else {
+      if (pid) {
+        try {
+          process.kill(-pid, 'SIGTERM');
+        } catch {
+          /* sin grupo */
+        }
+      }
+      try {
+        child.kill('SIGTERM');
+      } catch {
+        /* ya murio */
+      }
+    }
+  } catch {
+    /* ya murio */
+  }
+}
+
+function view(record) {
+  return {
+    id: record.id,
+    command: record.command,
+    args: record.args,
+    cwd: record.cwd,
+    port: record.port,
+    pid: record.pid,
+    startedAt: record.startedAt,
+    status: record.status,
+    running: Boolean(record.child),
+  };
+}
+
+/** Gestiona dev servers (procesos) con lista blanca de binarios. */
+export function createProcManager({ allow } = {}) {
+  const allowed = new Set(
+    (Array.isArray(allow) && allow.length ? allow : DEFAULT_PROCESS_ALLOW).map((b) => String(b).toLowerCase())
+  );
+  const procs = new Map();
+
+  function start({ cwd, command, args = [], port } = {}) {
+    const bin = String(command ?? '').trim();
+    if (!bin) throw new Error('Falta el comando.');
+    const base = path.basename(bin).replace(/\.(exe|cmd|bat)$/i, '').toLowerCase();
+    if (!allowed.has(base) && !allowed.has(bin.toLowerCase())) {
+      throw new Error(`Comando no permitido: ${bin}. Agregalo a processes.allow en tamnora.json.`);
+    }
+    const child = spawn(bin, args.map(String), {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      windowsHide: true,
+      shell: process.platform === 'win32' && !path.isAbsolute(bin),
+      detached: process.platform !== 'win32',
+    });
+    const id = randomUUID().slice(0, 8);
+    const record = {
+      id,
+      command: bin,
+      args: args.map(String),
+      cwd,
+      port: port ? Number(port) : null,
+      pid: child.pid,
+      startedAt: Date.now(),
+      logs: [],
+      status: 'running',
+      child,
+    };
+    const push = (stream, data) => {
+      record.logs.push({ t: Date.now(), stream, text: String(data) });
+      while (record.logs.length > MAX_LOG_LINES) record.logs.shift();
+    };
+    child.stdout.on('data', (d) => push('out', d));
+    child.stderr.on('data', (d) => push('err', d));
+    child.on('error', (err) => {
+      record.status = 'error';
+      push('err', err.message);
+      record.child = null;
+    });
+    child.on('exit', (code) => {
+      record.status = code === 0 ? 'exited' : `exit ${code}`;
+      record.child = null;
+    });
+    procs.set(id, record);
+    return view(record);
+  }
+
+  function stop(id) {
+    const record = procs.get(id);
+    if (!record) return false;
+    if (record.child) killTree(record.child);
+    record.status = 'stopped';
+    record.child = null;
+    return true;
+  }
+
+  function list() {
+    return [...procs.values()].map(view);
+  }
+
+  function logs(id, since = 0) {
+    const record = procs.get(id);
+    if (!record) return null;
+    return { status: record.status, running: Boolean(record.child), logs: record.logs.slice(since) };
+  }
+
+  function close() {
+    for (const record of procs.values()) if (record.child) killTree(record.child);
+    procs.clear();
+  }
+
+  return { start, stop, list, logs, close, allowed: [...allowed] };
+}

package/harness/packages/server/src/lib/prompt.js

@@ -30,8 +30,9 @@ function workspacePreamble(cwd) {
  * @param {object} opts
  * @param {string} opts.cwd - server default workspace
  * @param {string[]} opts.files - instruction file names (e.g. ['AGENTS.md'])
+ * @param {() => string} [opts.skillsText] - skills block, re-read on every call
  */
-export function createPromptBuilder({ cwd, files }) {
+export function createPromptBuilder({ cwd, files, skillsText }) {
   const cache = new Map();
 
   async function buildFor(workspace) {
@@ -40,9 +41,11 @@ export function createPromptBuilder({ cwd, files }) {
     return instructions ? `${base}\n\n---\n\n${instructions}` : base;
   }
 
-  return function systemPromptFor(workspace = cwd) {
+  return async function systemPromptFor(workspace = cwd) {
     const key = workspace || cwd;
     if (!cache.has(key)) cache.set(key, buildFor(key));
-    return cache.get(key);
+    const base = await cache.get(key);
+    const extra = typeof skillsText === 'function' ? String(skillsText() ?? '').trim() : '';
+    return extra ? `${base}\n\n---\n\n${extra}` : base;
   };
 }