@danieltmn/tamnora 0.1.0 → 0.3.0

package/harness/packages/server/src/routes/skills.js

@@ -0,0 +1,94 @@
+import path from 'node:path';
+import { homeDir, parseSkillRef, fetchSkillFromGithub, writeSkillFiles } from '../lib/core.js';
+import { readJson, sendJson, sendError } from '../lib/http.js';
+import {
+  SKILL_ID_PATTERN,
+  skillsView,
+  findSkill,
+  writeSkill,
+  removeSkill,
+  setSkillEnabled,
+} from '../lib/skills.js';
+
+function sanitizeId(value) {
+  return String(value ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+}
+
+export function registerSkills(route, ctx) {
+  route('POST', '/api/skills/import', async ({ req, res }) => {
+    const body = await readJson(req);
+    const ref = parseSkillRef(body.ref ?? body.url ?? body.id);
+    if (!ref) {
+      return sendError(res, 400, 'Pegá una URL de skills.sh (https://skills.sh/owner/repo/skill) o un id owner/repo/skill.');
+    }
+    let remote;
+    try {
+      remote = await fetchSkillFromGithub(ref);
+    } catch (error) {
+      return sendError(res, 502, `No se pudo importar desde GitHub: ${error.message}`);
+    }
+    const id = sanitizeId(remote.slug || ref.slug || ref.repo);
+    if (!SKILL_ID_PATTERN.test(id)) return sendError(res, 502, 'No se pudo derivar un id de skill válido.');
+    try {
+      await writeSkillFiles(path.join(homeDir(), 'skills', id), remote.files);
+    } catch (error) {
+      return sendError(res, 500, `No se pudo escribir la skill: ${error.message}`);
+    }
+    setSkillEnabled(ctx.store, id, true);
+    sendJson(res, 200, { installed: id, source: remote.source, skills: skillsView(ctx) });
+  });
+
+  route('GET', '/api/skills', ({ res }) => {
+    sendJson(res, 200, { skills: skillsView(ctx) });
+  });
+
+  route('GET', '/api/skills/:id', ({ res, params }) => {
+    const skill = findSkill(ctx, params.id);
+    if (!skill) return sendError(res, 404, 'Skill no encontrada.');
+    sendJson(res, 200, {
+      skill: {
+        id: skill.id,
+        name: skill.name || skill.id,
+        description: skill.description || '',
+        when: skill.when || '',
+        body: skill.body,
+        removable: Boolean(skill.home),
+      },
+    });
+  });
+
+  route('PUT', '/api/skills/:id', async ({ req, res, params }) => {
+    const id = String(params.id);
+    if (!SKILL_ID_PATTERN.test(id)) return sendError(res, 400, 'Id de skill inválido (a-z, 0-9, - y _).');
+    const body = await readJson(req);
+    if (!String(body.body ?? '').trim()) return sendError(res, 400, 'La skill necesita un cuerpo.');
+    await writeSkill(id, {
+      name: body.name,
+      description: body.description,
+      when: body.when,
+      body: body.body,
+    });
+    sendJson(res, 200, { skills: skillsView(ctx) });
+  });
+
+  route('DELETE', '/api/skills/:id', async ({ res, params }) => {
+    const skill = findSkill(ctx, params.id);
+    if (!skill) return sendError(res, 404, 'Skill no encontrada.');
+    if (!skill.home) return sendError(res, 400, 'Esa skill vive en el workspace y no se borra desde acá.');
+    await removeSkill(skill.id);
+    setSkillEnabled(ctx.store, skill.id, true);
+    sendJson(res, 200, { skills: skillsView(ctx) });
+  });
+
+  route('POST', '/api/skills/:id/toggle', async ({ res, params }) => {
+    const skill = findSkill(ctx, params.id);
+    if (!skill) return sendError(res, 404, 'Skill no encontrada.');
+    const enabled = !skillsView(ctx).find((s) => s.id === skill.id)?.enabled;
+    setSkillEnabled(ctx.store, skill.id, enabled);
+    sendJson(res, 200, { id: skill.id, enabled, skills: skillsView(ctx) });
+  });
+}

package/harness/packages/server/src/server.js

@@ -16,7 +16,11 @@ import {
 } from './lib/core.js';
 import { sendJson, sendError } from './lib/http.js';
 import { createPromptBuilder, DEFAULT_SYSTEM_PROMPT } from './lib/prompt.js';
+import { skillsPrompt } from './lib/skills.js';
 import { createApprovalBroker } from './lib/approvals.js';
+import { createProcManager } from './lib/procs.js';
+import { startTelegramBot } from './lib/telegram.js';
+import { createAgentTools } from './lib/agentTools.js';
 import { createStaticHandler } from './static.js';
 import { requireLogin, requireCsrf } from './auth.js';
 import { registerAuth } from './routes/auth.js';
@@ -26,6 +30,9 @@ import { registerFiles } from './routes/files.js';
 import { registerModels } from './routes/models.js';
 import { registerProviders } from './routes/providers.js';
 import { registerMcp } from './routes/mcp.js';
+import { registerSkills } from './routes/skills.js';
+import { registerProcs } from './routes/procs.js';
+import { registerPreview } from './routes/preview.js';
 import { registerChat } from './routes/chat.js';
 import { registerEval } from './routes/eval.js';
 
@@ -67,26 +74,60 @@ export async function createTamnoraServer({
   resolveProvider,
   yes = false,
   loadMcp = true,
+  telegram = true,
   dbPath,
 } = {}) {
   const config = await loadConfig(cwd);
   const app = readApp();
   const authEnabled = Boolean(app.user && app.user.password);
   const store = new Store(dbPath ?? databasePath(cwd));
-  const systemPromptFor = createPromptBuilder({ cwd, files: config.instructions });
-  const systemPrompt = (await systemPromptFor(cwd)) || DEFAULT_SYSTEM_PROMPT;
   const approvals = createApprovalBroker({ timeoutMs: config.approvalTimeoutMs });
+  const procs = createProcManager({ allow: config.processes?.allow });
+  const procsEnabled = config.processes?.enabled !== false;
   const autoApproved = new Set();
   const isAutoApprove = (sessionId) => autoApproved.has(sessionId);
   const setAutoApprove = (sessionId, value) => (value ? autoApproved.add(sessionId) : autoApproved.delete(sessionId));
 
+  // MCP servers come from tamnora.json plus the ones saved from the console;
+  // the store wins on id collisions.
+  const mergedMcpServers = () => {
+    const fromConfig = Array.isArray(config.mcp) ? config.mcp : [];
+    const fromStore = store.listMcpServers().map((row) => ({
+      id: row.id,
+      name: row.name ?? row.id,
+      type: row.transport ?? 'stdio',
+      command: row.command ?? undefined,
+      args: Array.isArray(row.config?.args) ? row.config.args : [],
+      url: row.url ?? undefined,
+      env: row.config?.env ?? undefined,
+      enabled: row.enabled !== false,
+      source: 'store',
+    }));
+    const byId = new Map();
+    for (const server of fromConfig) if (server?.id) byId.set(server.id, { ...server, source: 'config' });
+    for (const server of fromStore) byId.set(server.id, server);
+    return [...byId.values()];
+  };
+
   let mcpPromise = null;
   const getMcp = async () => {
-    if (!loadMcp || !(config.mcp?.length)) return null;
-    if (!mcpPromise) mcpPromise = buildMcpRegistry(config.mcp);
+    if (!loadMcp) return null;
+    const servers = mergedMcpServers().filter((s) => s.enabled !== false);
+    if (!servers.length) return null;
+    if (!mcpPromise) mcpPromise = buildMcpRegistry(servers);
     return mcpPromise;
   };
 
+  const reloadMcp = async () => {
+    const registry = mcpPromise ? await mcpPromise.catch(() => null) : null;
+    try {
+      registry?.close?.();
+    } catch {
+      // ignore MCP shutdown errors
+    }
+    mcpPromise = null;
+  };
+
   const customProviderDefs = () =>
     store
       .listProviders()
@@ -111,8 +152,6 @@ export async function createTamnoraServer({
     app,
     authEnabled,
     store,
-    systemPrompt,
-    systemPromptFor,
     approvals,
     isAutoApprove,
     setAutoApprove,
@@ -125,8 +164,35 @@ export async function createTamnoraServer({
     apiKeyFor: (id) => resolveApiKey(providerSettings(id).apiKey, process.env),
     resolveProvider: resolveProvider ?? ((settings) => resolveProviderRuntime(settings)),
     getMcp,
+    reloadMcp,
+    mergedMcpServers,
+    procs,
+    procsEnabled,
   };
 
+  ctx.systemPromptFor = createPromptBuilder({
+    cwd,
+    files: config.instructions,
+    skillsText: () => skillsPrompt(ctx),
+  });
+  ctx.systemPrompt = (await ctx.systemPromptFor(cwd)) || DEFAULT_SYSTEM_PROMPT;
+  ctx.agentTools = createAgentTools(ctx);
+
+  // Bot de Telegram (long polling) si hay token: config, app.json o entorno.
+  const tgConfig = { ...(app.telegram ?? {}), ...(config.telegram ?? {}) };
+  const tgToken = tgConfig.token || process.env.TAMNORA_TELEGRAM_TOKEN || '';
+  const rawAllow = tgConfig.allowedChatIds ?? process.env.TAMNORA_TELEGRAM_CHAT_IDS ?? [];
+  const tgAllow = Array.isArray(rawAllow) ? rawAllow : String(rawAllow).split(/[,\s]+/).filter(Boolean);
+  const telegramBot =
+    telegram && tgToken
+      ? startTelegramBot(ctx, {
+          token: tgToken,
+          allowedChatIds: tgAllow,
+          log: (message) => process.stderr.write(`${message}\n`),
+        })
+      : null;
+  ctx.telegram = Boolean(telegramBot);
+
   const routes = [];
   const route = (method, pattern, handler) =>
     routes.push({ method, segments: pattern.split('/').filter(Boolean), handler });
@@ -139,6 +205,7 @@ export async function createTamnoraServer({
       home: os.homedir(),
       tamnoraHome: homeDir(),
       version: VERSION,
+      telegram: ctx.telegram,
     });
   });
 
@@ -149,6 +216,9 @@ export async function createTamnoraServer({
   registerModels(route, ctx);
   registerProviders(route, ctx);
   registerMcp(route, ctx);
+  registerSkills(route, ctx);
+  registerProcs(route, ctx);
+  const preview = registerPreview(route, ctx);
   registerChat(route, ctx);
   registerEval(route, ctx);
 
@@ -231,6 +301,9 @@ export async function createTamnoraServer({
 
   const close = async () => {
     approvals.cancelAll();
+    telegramBot?.stop();
+    preview.close();
+    procs.close();
     try {
       const registry = mcpPromise ? await mcpPromise : null;
       registry?.close?.();

package/harness/packages/server/test/server.test.js

@@ -78,6 +78,44 @@ test('creates, lists, reads and deletes sessions', async () => {
   }
 });
 
+test('lists and deletes sessions grouped by project (cwd)', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proj-'));
+  const dirA = path.join(cwd, 'a');
+  const dirB = path.join(cwd, 'b');
+  await mkdir(dirA);
+  await mkdir(dirB);
+  const { instance, base } = await startServer({ cwd });
+  const create = (body) =>
+    fetch(`${base}/api/sessions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+  try {
+    await create({ title: 'a1', model: 'm', cwd: dirA });
+    await create({ title: 'a2', model: 'm', cwd: dirA });
+    await create({ title: 'b1', model: 'm', cwd: dirB });
+
+    const projects = await (await fetch(`${base}/api/projects`)).json();
+    assert.equal(projects.projects.find((p) => p.cwd === dirA).sessions, 2);
+    assert.equal(projects.projects.find((p) => p.cwd === dirB).sessions, 1);
+
+    const removed = await (
+      await fetch(`${base}/api/projects?cwd=${encodeURIComponent(dirA)}`, { method: 'DELETE' })
+    ).json();
+    assert.equal(removed.sessions, 2);
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(list.sessions.length, 1);
+    assert.equal(list.sessions[0].cwd, dirB);
+
+    const missing = await fetch(`${base}/api/projects`, { method: 'DELETE' });
+    assert.equal(missing.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
 test('streams a chat turn over SSE and persists the messages', async () => {
   const { instance, base } = await startServer();
   try {
@@ -103,6 +141,235 @@ test('streams a chat turn over SSE and persists the messages', async () => {
   }
 });
 
+test('manages MCP servers from the console', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    assert.deepEqual(data.servers, []);
+
+    let res = await fetch(`${base}/api/mcp/servers/echo`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ name: 'Echo', transport: 'stdio', command: 'node', args: ['a.mjs'], enabled: true }),
+    });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    const echo = data.servers.find((s) => s.id === 'echo');
+    assert.equal(echo.source, 'store');
+    assert.deepEqual(echo.args, ['a.mjs']);
+
+    const bad = await fetch(`${base}/api/mcp/servers/bad`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ transport: 'http' }),
+    });
+    assert.equal(bad.status, 400);
+
+    res = await fetch(`${base}/api/mcp/servers/echo`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    assert.equal(data.servers.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('imports an MCP server from a JSON snippet', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ json: '{"mcpServers":{"demo":{"command":"npx","args":["-y","pkg"]}}}' }),
+    });
+    assert.equal(res.status, 200);
+    const data = await res.json();
+    assert.equal(data.imported, 'demo');
+    assert.ok(data.servers.some((s) => s.id === 'demo' && s.transport === 'stdio'));
+  } finally {
+    await instance.close();
+  }
+});
+
+test('rejects unknown import refs (skills and mcpservers.org)', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const badSkill = await fetch(`${base}/api/skills/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ ref: 'nope' }),
+    });
+    assert.equal(badSkill.status, 400);
+
+    const blocked = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ url: 'https://mcpservers.org/es/official' }),
+    });
+    assert.equal(blocked.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages skills from the console', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  const put = (id, body) => fetch(`${base}/api/skills/${id}`, { method: 'PUT', headers: json, body: JSON.stringify(body) });
+  try {
+    let res = await put('demo', { name: 'Demo', description: 'para pruebas', body: 'Hacé X.' });
+    assert.equal(res.status, 200);
+    let data = await res.json();
+    const demo = data.skills.find((s) => s.id === 'demo');
+    assert.equal(demo.enabled, true);
+    assert.equal(demo.removable, true);
+
+    const detail = await (await fetch(`${base}/api/skills/demo`)).json();
+    assert.match(detail.skill.body, /Hacé X/);
+
+    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
+    data = await (await fetch(`${base}/api/skills`)).json();
+    assert.equal(data.skills.find((s) => s.id === 'demo').enabled, false);
+
+    res = await fetch(`${base}/api/skills/demo`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await (await fetch(`${base}/api/skills`)).json();
+    assert.equal(data.skills.length, 0);
+
+    res = await put('vacia', { body: '   ' });
+    assert.equal(res.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('injects only enabled skills into the system prompt', async () => {
+  let captured = '';
+  const captureProvider = {
+    id: 'capture',
+    async streamChat(_config, { messages }) {
+      captured = messages?.[0]?.content ?? '';
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: captureProvider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  const chat = (sessionId) =>
+    fetch(`${base}/api/chat`, { method: 'POST', headers: json, body: JSON.stringify({ sessionId, model: 'm', input: 'hola' }) });
+  const newSession = async () => {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
+    ).json();
+    return created.session.id;
+  };
+  try {
+    await fetch(`${base}/api/skills/demo`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ name: 'Demo', body: 'Regla secreta de la skill.' }),
+    });
+
+    await (await chat(await newSession())).text();
+    assert.match(captured, /Regla secreta de la skill/);
+
+    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
+    await (await chat(await newSession())).text();
+    assert.doesNotMatch(captured, /Regla secreta de la skill/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('detects, runs and stops dev processes', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proc-'));
+  await writeFile(path.join(cwd, 'package.json'), JSON.stringify({ scripts: { dev: 'node server.js' } }));
+  const { instance, base } = await startServer({ cwd });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const detected = await (await fetch(`${base}/api/procs/detect?cwd=${encodeURIComponent(cwd)}`)).json();
+    assert.ok(detected.chips.some((c) => c.command === 'npm' && c.args.includes('dev')));
+
+    const blocked = await fetch(`${base}/api/procs/start`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ cwd, command: 'curl' }),
+    });
+    assert.equal(blocked.status, 400);
+
+    const started = await (
+      await fetch(`${base}/api/procs/start`, {
+        method: 'POST',
+        headers: json,
+        body: JSON.stringify({ cwd, command: 'node', args: ['-e', 'console.log(42)'] }),
+      })
+    ).json();
+    assert.ok(started.proc.id);
+    await new Promise((resolve) => setTimeout(resolve, 500));
+
+    const logs = await (await fetch(`${base}/api/procs/${started.proc.id}/logs`)).json();
+    assert.match(logs.logs.map((l) => l.text).join(''), /42/);
+
+    const stopped = await fetch(`${base}/api/procs/${started.proc.id}/stop`, { method: 'POST' });
+    assert.equal(stopped.status, 200);
+
+    const badTunnel = await fetch(`${base}/api/preview/tunnel`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ port: 0 }),
+    });
+    assert.equal(badTunnel.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('the agent can install a skill from chat (with approval)', async () => {
+  const calls = { n: 0 };
+  const toolProvider = {
+    id: 'tooly',
+    async streamChat() {
+      calls.n += 1;
+      if (calls.n === 1) {
+        return {
+          content: '',
+          reasoning: '',
+          toolCalls: [
+            {
+              id: 't1',
+              function: {
+                name: 'install_skill',
+                arguments: JSON.stringify({ id: 'demo-skill', content: '---\nname: Demo\n---\nCuerpo de prueba.' }),
+              },
+            },
+          ],
+        };
+      }
+      return { content: 'listo', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: toolProvider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
+    ).json();
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'instalá una skill', yes: true }),
+    });
+    await res.text();
+
+    const skills = await (await fetch(`${base}/api/skills`)).json();
+    assert.ok(skills.skills.some((s) => s.id === 'demo-skill'));
+  } finally {
+    await instance.close();
+  }
+});
+
 test('rejects chat without input or model', async () => {
   const { instance, base } = await startServer();
   try {
@@ -605,7 +872,7 @@ test('plan mode exposes only read-only tools and adds guidance', async () => {
         body: JSON.stringify({ input: 'planificá', model: 'm', mode: 'plan' }),
       })
     ).text();
-    assert.deepEqual(captured.tools, ['git_diff', 'git_log', 'git_status', 'glob', 'grep', 'list', 'read']);
+    assert.deepEqual(captured.tools, ['fetch_url', 'git_diff', 'git_log', 'git_status', 'glob', 'grep', 'list', 'read']);
     assert.match(captured.system, /modo PLAN/);
   } finally {
     await instance.close();

package/harness/tamnora.example.json

@@ -14,5 +14,11 @@
       "args": ["harness/scripts/mcp-echo-server.mjs"],
       "enabled": true
     }
-  ]
+  ],
+  "processes": {
+    "enabled": true,
+    "allow": ["npm", "node", "npx", "pnpm", "yarn", "bun", "php", "python", "composer"]
+  },
+  "preview": { "provider": "tunnelmole" },
+  "telegram": { "token": "", "allowedChatIds": [] }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",