@danieltmn/tamnora 0.1.0

package/harness/packages/server/src/routes/chat.js

@@ -0,0 +1,222 @@
+import { randomUUID } from 'node:crypto';
+import { runAgent, createTools, resolveMode, MAX_TOOL_ROUNDS } from '../lib/core.js';
+import { openSse, readJson, sendJson, sendError } from '../lib/http.js';
+import { workspaceForRequest, resolveExistingDir } from '../lib/workspace.js';
+
+/**
+ * Emit streaming partials at most once per `ms` window, keeping only the
+ * latest payload per event (openbridge-style throttling: the payload carries
+ * the cumulative `full`, so last-wins is lossless).
+ */
+function createPartialThrottle(ms, emit) {
+  const pending = new Map();
+  let timer = null;
+
+  const drain = () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    const entries = [...pending.entries()];
+    pending.clear();
+    for (const [name, payload] of entries) emit(name, payload);
+  };
+
+  return {
+    push(name, payload) {
+      pending.set(name, payload);
+      if (timer) return;
+      timer = setTimeout(drain, ms);
+      timer.unref?.();
+    },
+    flush: drain,
+  };
+}
+
+export function registerChat(route, ctx) {
+  const askMeta = new Map();
+
+  route('POST', '/api/permissions/:askId', async ({ req, res, params }) => {
+    const body = await readJson(req);
+    const meta = askMeta.get(params.askId);
+    const allow = Boolean(body.allow);
+    if (!ctx.approvals.decide(params.askId, allow)) {
+      return sendError(res, 404, 'Solicitud de permiso expirada o inexistente.');
+    }
+    askMeta.delete(params.askId);
+    const scope = body.scope === 'session' ? 'session' : 'once';
+    if (allow && scope === 'session' && meta?.sessionId) ctx.setAutoApprove(meta.sessionId, true);
+    sendJson(res, 200, { ok: true, allow, scope });
+  });
+
+  route('POST', '/api/chat', async ({ req, res }) => {
+    const body = await readJson(req);
+    const input = String(body.input ?? '').trim();
+    const images = (Array.isArray(body.images) ? body.images : []).filter(
+      (url) => typeof url === 'string' && url.startsWith('data:image/')
+    );
+    if (!input && !images.length) return sendError(res, 400, 'Falta "input".');
+
+    const providerId = body.provider || ctx.effectiveProviderId();
+    const model = body.model || ctx.effectiveModel();
+    if (!model) return sendError(res, 400, 'Falta "model" (en el cuerpo, en Ajustes o en tamnora.json).');
+
+    let sessionId = body.sessionId;
+    let history = [];
+    let sessionCwd;
+    if (sessionId) {
+      const existing = ctx.store.getSession(sessionId);
+      if (!existing) return sendError(res, 404, 'Sesión no encontrada.');
+      history = ctx.store.getMessages(sessionId);
+      try {
+        sessionCwd = resolveExistingDir(existing.cwd || ctx.cwd);
+      } catch {
+        sessionCwd = ctx.cwd;
+      }
+    } else {
+      try {
+        sessionCwd = workspaceForRequest({ req, raw: body.cwd, fallback: ctx.cwd });
+      } catch (error) {
+        return sendError(res, 400, error.message);
+      }
+      sessionId = ctx.store.createSession({
+        title: (input || 'Imagen').slice(0, 60),
+        provider: providerId,
+        model,
+        cwd: sessionCwd,
+      });
+    }
+
+    const mode = resolveMode(body.mode ?? ctx.store.getSetting('activeMode'));
+
+    const sse = openSse(req, res);
+    const controller = new AbortController();
+    const autoApprove = body.yes ?? ctx.yes;
+    const asked = new Set();
+    req.on('close', () => {
+      controller.abort();
+      ctx.approvals.cancel(asked);
+    });
+
+    sse.event('start', { sessionId, provider: providerId, model, mode: mode.id, cwd: sessionCwd });
+    sse.event('user', { content: input });
+
+    let mcp = null;
+    try {
+      mcp = await ctx.getMcp();
+    } catch (error) {
+      sse.event('warning', { message: `MCP: ${error?.message ?? error}` });
+    }
+
+    const enabled = Array.isArray(body.tools) && body.tools.length ? body.tools : mode.tools ?? undefined;
+    const onAsk = autoApprove
+      ? undefined
+      : async (name, args) => {
+          if (ctx.isAutoApprove(sessionId)) return true;
+          const askId = randomUUID();
+          asked.add(askId);
+          askMeta.set(askId, { sessionId });
+          sse.event('permission', { askId, sessionId, name, args });
+          const allow = await ctx.approvals.ask(askId);
+          asked.delete(askId);
+          askMeta.delete(askId);
+          sse.event('permission_resolved', { askId, allow });
+          return allow;
+        };
+    const { definitions, execute } = createTools({
+      root: sessionCwd,
+      enabled,
+      permissions: ctx.config.permissions,
+      yes: autoApprove,
+      onAsk,
+      mcp,
+    });
+
+    const { provider, config } = ctx.resolveProvider({
+      ...ctx.providerSettings(providerId),
+      apiKey: ctx.apiKeyFor(providerId),
+      baseUrl: body.baseUrl || ctx.providerSettings(providerId).baseUrl,
+    });
+
+    const userMessage = images.length
+      ? {
+          role: 'user',
+          content: [
+            { type: 'text', text: input },
+            ...images.map((url) => ({ type: 'image_url', image_url: { url } })),
+          ],
+        }
+      : { role: 'user', content: input };
+
+    const sessionRecord = ctx.store.getSession(sessionId);
+    const goal = sessionRecord?.meta?.goal;
+    const summary = sessionRecord?.meta?.summary;
+    const basePrompt = await ctx.systemPromptFor(sessionCwd);
+    const messages = [
+      { role: 'system', content: mode.systemPrompt ? `${basePrompt}\n\n${mode.systemPrompt}` : basePrompt },
+      ...(goal ? [{ role: 'system', content: `Objetivo de la sesión: ${goal}` }] : []),
+      ...(summary ? [{ role: 'system', content: `Resumen de la conversación anterior:\n${summary}` }] : []),
+      ...history,
+      userMessage,
+    ];
+
+    try {
+      const partials = createPartialThrottle(300, (name, payload) => sse.event(name, payload));
+      const result = await runAgent({
+        provider,
+        config,
+        model,
+        messages,
+        tools: definitions,
+        execute,
+        signal: controller.signal,
+        maxRounds: Number(body.maxRounds) || ctx.config.maxRounds || MAX_TOOL_ROUNDS,
+        stallWarnMs: body.stallWarnMs ?? ctx.config.stallWarnMs,
+        contextTokens: Number(body.contextTokens) || ctx.config.contextTokens || 0,
+        onEvent(event) {
+          if (event.type === 'text') partials.push('text', { delta: event.delta, full: event.full });
+          else if (event.type === 'reasoning') partials.push('reasoning', { delta: event.delta, full: event.full });
+          else if (event.type === 'stall') {
+            partials.flush();
+            sse.event('stall', { seconds: event.seconds });
+          } else if (event.type === 'retry') {
+            partials.flush();
+            sse.event('retry', { attempt: event.attempt, delayMs: event.delayMs, message: event.message });
+          } else if (event.type === 'trim') {
+            partials.flush();
+            sse.event('trim', { trimmed: event.trimmed, dropped: event.dropped, tokens: event.tokens });
+          } else if (event.type === 'tool_round') {
+            partials.flush();
+            sse.event('tools', { toolCalls: event.toolCalls });
+          } else if (event.type === 'tool_call') {
+            partials.flush();
+            sse.event('tool_call', { name: event.name, args: event.args });
+          } else if (event.type === 'tool_result') {
+            partials.flush();
+            sse.event('tool_result', { name: event.name, result: String(event.result).slice(0, 8000) });
+          }
+        },
+      });
+      partials.flush();
+
+      const newMessages = result.messages.slice(1 + history.length);
+      ctx.store.addMessages(sessionId, newMessages);
+      const current = ctx.store.getSession(sessionId);
+      const title =
+        current && (!current.title || current.title === 'Nueva sesión') ? input.slice(0, 60) : undefined;
+      ctx.store.touchSession(sessionId, { provider: providerId, model, title });
+      sse.event('done', {
+        sessionId,
+        content: result.content,
+        rounds: result.rounds,
+        stopReason: result.stopReason,
+        tokens: result.usage ?? null,
+      });
+    } catch (error) {
+      if (error?.name === 'AbortError') sse.event('aborted', {});
+      else sse.event('error', { message: error?.message ?? String(error) });
+    } finally {
+      sse.close();
+    }
+  });
+}

package/harness/packages/server/src/routes/eval.js

@@ -0,0 +1,100 @@
+import path from 'node:path';
+import { loadDataset, runDataset, summarize, createJudge } from '../lib/core.js';
+import { openSse, readJson, sendError, sendJson } from '../lib/http.js';
+
+function toNumber(value, fallback) {
+  const n = Number(value);
+  return Number.isFinite(n) ? n : fallback;
+}
+
+export function registerEval(route, ctx) {
+  route('POST', '/api/eval', async ({ req, res }) => {
+    const body = await readJson(req);
+
+    let tasks = Array.isArray(body.tasks) ? body.tasks : [];
+    if (!tasks.length && body.dataset) {
+      try {
+        tasks = await loadDataset(path.resolve(ctx.cwd, String(body.dataset)));
+      } catch (error) {
+        return sendError(res, 400, `No se pudo leer el dataset: ${error?.message ?? error}`);
+      }
+    }
+    if (!tasks.length) return sendError(res, 400, 'Faltan tareas ("tasks" o "dataset").');
+
+    const models = (Array.isArray(body.models) ? body.models : [body.model])
+      .filter(Boolean)
+      .map(String);
+    if (!models.length) return sendError(res, 400, 'Falta "models".');
+
+    const providerId = body.provider || ctx.effectiveProviderId();
+    const trials = toNumber(body.trials, 1);
+    const concurrency = toNumber(body.concurrency, 1);
+    const baseUrl = body.baseUrl || ctx.providerSettings(providerId).baseUrl;
+    const apiKey = ctx.apiKeyFor(providerId);
+
+    const enabledTools = Array.isArray(body.tools) && body.tools.length ? body.tools : ctx.config.tools;
+
+    const judge = body.judgeModel
+      ? createJudge({ providerId, model: body.judgeModel, baseUrl, apiKey })
+      : undefined;
+
+    const sse = openSse(req, res);
+    const controller = new AbortController();
+    req.on('close', () => controller.abort());
+
+    const runId = ctx.store.createRun({
+      dataset: body.name || body.dataset || 'inline',
+      config: { providerId, models, trials, concurrency, tools: enabledTools ?? 'all' },
+    });
+    sse.event('run', { runId, total: tasks.length * models.length * trials });
+
+    const startedAt = Date.now();
+    try {
+      const results = await runDataset({
+        tasks,
+        models,
+        providerId,
+        baseUrl,
+        apiKey,
+        systemPrompt: ctx.systemPrompt,
+        rootDir: ctx.cwd,
+        trials,
+        concurrency,
+        enabledTools: Array.isArray(enabledTools) && enabledTools.length ? enabledTools : undefined,
+        permissions: ctx.config.permissions,
+        yes: body.yes ?? ctx.yes,
+        judge,
+        store: ctx.store,
+        runId,
+        signal: controller.signal,
+        onProgress: (entry) => sse.event('result', entry),
+      });
+
+      const summary = summarize(results);
+      summary.durationMs = Date.now() - startedAt;
+      const status =
+        summary.errors && summary.passed === 0
+          ? 'failed'
+          : summary.errors
+            ? 'done_with_errors'
+            : 'done';
+      ctx.store.finishRun(runId, { status, summary });
+      sse.event('summary', { runId, summary });
+    } catch (error) {
+      if (error?.name === 'AbortError') sse.event('aborted', {});
+      else sse.event('error', { message: error?.message ?? String(error) });
+    } finally {
+      sse.close();
+    }
+  });
+
+  route('GET', '/api/runs', ({ res }) => {
+    sendJson(res, 200, { runs: ctx.store.listRuns(50) });
+  });
+
+  route('GET', '/api/runs/:id', ({ res, params }) => {
+    const run = ctx.store.getRun(params.id);
+    if (!run) return sendError(res, 404, 'Run no encontrado.');
+    sendJson(res, 200, { run, results: ctx.store.getRunResults(params.id) });
+  });
+}

package/harness/packages/server/src/routes/files.js

@@ -0,0 +1,117 @@
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { sendJson, sendError } from '../lib/http.js';
+import { isLoopback, resolveExistingDir } from '../lib/workspace.js';
+
+const MAX_PREVIEW = 200 * 1024;
+const IGNORED = new Set(['node_modules', '.git', '.tamnora', '.playwright-mcp', 'dist', '.cache']);
+
+function isInside(root, target) {
+  const rel = path.relative(root, target);
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+/** Resolve `?root` + `?path` into a confined filesystem target, or send an error. */
+function resolveTarget(req, res, query, fallback) {
+  if (!isLoopback(req.socket.localAddress)) {
+    sendError(res, 403, 'Explorar archivos solo está disponible en conexiones locales.');
+    return null;
+  }
+  let root;
+  try {
+    root = resolveExistingDir(query.get('root') || fallback);
+  } catch (error) {
+    sendError(res, 400, error.message);
+    return null;
+  }
+  const rel = String(query.get('path') ?? '').replace(/^[/\\]+/, '');
+  const target = path.resolve(root, rel);
+  if (!isInside(root, target)) {
+    sendError(res, 400, 'La ruta queda fuera del workspace.');
+    return null;
+  }
+  return { root, target };
+}
+
+const toPosix = (value) => value.split(path.sep).join('/');
+
+export function registerFiles(route, ctx) {
+  route('GET', '/api/files', ({ req, res, query }) => {
+    const resolved = resolveTarget(req, res, query, ctx.cwd);
+    if (!resolved) return;
+
+    let stat;
+    try {
+      stat = fs.statSync(resolved.target);
+    } catch {
+      return sendError(res, 404, 'La carpeta no existe.');
+    }
+    if (!stat.isDirectory()) return sendError(res, 400, 'No es una carpeta.');
+
+    let dirents;
+    try {
+      dirents = fs.readdirSync(resolved.target, { withFileTypes: true });
+    } catch (error) {
+      return sendError(res, 500, error.message);
+    }
+
+    const entries = [];
+    for (const dirent of dirents) {
+      if (IGNORED.has(dirent.name)) continue;
+      const full = path.join(resolved.target, dirent.name);
+      let isDir = dirent.isDirectory();
+      if (!isDir && dirent.isSymbolicLink()) {
+        try {
+          isDir = fs.statSync(full).isDirectory();
+        } catch {
+          isDir = false;
+        }
+      }
+      let size = 0;
+      if (!isDir) {
+        try {
+          size = fs.statSync(full).size;
+        } catch {
+          size = 0;
+        }
+      }
+      entries.push({ name: dirent.name, type: isDir ? 'dir' : 'file', size });
+    }
+    entries.sort((a, b) =>
+      a.type === b.type ? a.name.localeCompare(b.name, 'es') : a.type === 'dir' ? -1 : 1
+    );
+
+    sendJson(res, 200, { root: resolved.root, path: toPosix(path.relative(resolved.root, resolved.target)), entries });
+  });
+
+  route('GET', '/api/files/content', async ({ req, res, query }) => {
+    const resolved = resolveTarget(req, res, query, ctx.cwd);
+    if (!resolved) return;
+
+    let stat;
+    try {
+      stat = await fsp.stat(resolved.target);
+    } catch {
+      return sendError(res, 404, 'El archivo no existe.');
+    }
+    if (!stat.isFile()) return sendError(res, 400, 'No es un archivo.');
+    if (stat.size > MAX_PREVIEW) {
+      return sendError(res, 413, `Archivo demasiado grande (${stat.size} bytes; máximo ${MAX_PREVIEW}).`);
+    }
+
+    let buffer;
+    try {
+      buffer = await fsp.readFile(resolved.target);
+    } catch (error) {
+      return sendError(res, 500, error.message);
+    }
+    if (buffer.includes(0)) return sendError(res, 415, 'Vista previa no disponible para archivos binarios.');
+
+    sendJson(res, 200, {
+      path: toPosix(path.relative(resolved.root, resolved.target)),
+      size: stat.size,
+      content: buffer.toString('utf8'),
+    });
+  });
+}

package/harness/packages/server/src/routes/folders.js

@@ -0,0 +1,80 @@
+import path from 'node:path';
+import { mkdir } from 'node:fs/promises';
+import { readJson, sendJson, sendError } from '../lib/http.js';
+import { isLoopback, rootDirs, listSubdirs, resolveExistingDir } from '../lib/workspace.js';
+
+const INVALID_NAME = /[\\/:*?"<>|]/;
+
+function validFolderName(name) {
+  if (!name || name === '.' || name === '..' || INVALID_NAME.test(name)) return false;
+  return [...name].every((char) => char.charCodeAt(0) >= 32);
+}
+
+export function registerFolders(route) {
+  route('GET', '/api/folders', ({ req, res, query }) => {
+    if (!isLoopback(req.socket.localAddress)) {
+      return sendError(res, 403, 'El navegador de carpetas solo está disponible en conexiones locales.');
+    }
+
+    const raw = String(query.get('path') ?? '').trim();
+    const atRoot = !raw || raw === '/' || /^[A-Za-z]:?$/.test(raw);
+    if (atRoot) {
+      return sendJson(res, 200, {
+        path: null,
+        parent: null,
+        dirs: rootDirs().map((drive) => ({ name: drive, path: drive })),
+      });
+    }
+
+    let dir;
+    try {
+      dir = resolveExistingDir(raw);
+    } catch (error) {
+      return sendError(res, 400, error.message);
+    }
+
+    let dirs;
+    try {
+      dirs = listSubdirs(dir);
+    } catch (error) {
+      return sendError(res, 400, `No se pudo leer la carpeta: ${error.message}`);
+    }
+
+    const parent = path.dirname(dir);
+    sendJson(res, 200, {
+      path: dir,
+      parent: parent === dir ? null : parent,
+      dirs,
+    });
+  });
+
+  route('POST', '/api/folders', async ({ req, res }) => {
+    if (!isLoopback(req.socket.localAddress)) {
+      return sendError(res, 403, 'Crear carpetas solo está disponible en conexiones locales.');
+    }
+    const body = await readJson(req);
+    const name = String(body.name ?? '').trim();
+    if (!validFolderName(name)) {
+      return sendError(res, 400, 'Nombre de carpeta inválido.');
+    }
+
+    if (!String(body.parent ?? '').trim()) {
+      return sendError(res, 400, 'Elegí la carpeta contenedora primero.');
+    }
+    let parent;
+    try {
+      parent = resolveExistingDir(body.parent);
+    } catch (error) {
+      return sendError(res, 400, error.message);
+    }
+
+    const target = path.join(parent, name);
+    try {
+      await mkdir(target);
+    } catch (error) {
+      if (error.code === 'EEXIST') return sendError(res, 409, `Ya existe una carpeta "${name}" acá.`);
+      return sendError(res, 400, `No se pudo crear la carpeta: ${error.message}`);
+    }
+    sendJson(res, 201, { path: target });
+  });
+}

package/harness/packages/server/src/routes/mcp.js

@@ -0,0 +1,50 @@
+import { buildMcpRegistry, mcpTransport } from '../lib/core.js';
+import { sendJson } from '../lib/http.js';
+
+function safeTransport(server) {
+  try {
+    return mcpTransport(server);
+  } catch {
+    return '?';
+  }
+}
+
+export function registerMcp(route, ctx) {
+  route('GET', '/api/mcp', async ({ res, query }) => {
+    const servers = (ctx.config.mcp ?? []).map((server) => ({
+      id: server.id,
+      name: server.name,
+      transport: safeTransport(server),
+      enabled: server.enabled !== false,
+    }));
+
+    if (query.get('connect')) {
+      const registry = await buildMcpRegistry(ctx.config.mcp ?? []);
+      try {
+        for (const server of servers) {
+          const session = registry.sessions.find((s) => s.server.id === server.id);
+          const failure = registry.errors.find((e) => e.server.id === server.id);
+          server.ok = !failure;
+          server.error = failure?.error;
+          server.tools = (session?.tools ?? []).map((t) => ({
+            name: t.name,
+            description: t.description,
+          }));
+          server.resources = (session?.resources ?? []).map((r) => ({
+            uri: r.uri,
+            name: r.name,
+            mimeType: r.mimeType,
+          }));
+          server.prompts = (session?.prompts ?? []).map((p) => ({
+            name: p.name,
+            description: p.description,
+          }));
+        }
+      } finally {
+        registry.close();
+      }
+    }
+
+    sendJson(res, 200, { servers });
+  });
+}

package/harness/packages/server/src/routes/models.js

@@ -0,0 +1,26 @@
+import { listProviderModels } from '../lib/core.js';
+import { sendJson } from '../lib/http.js';
+import { createModelCache } from '../lib/modelCache.js';
+
+export function registerModels(route, ctx) {
+  const modelCache = createModelCache();
+
+  route('GET', '/api/models', async ({ res, query }) => {
+    const providerId = query.get('provider') || ctx.effectiveProviderId();
+    const settings = { ...ctx.providerSettings(providerId), apiKey: ctx.apiKeyFor(providerId) };
+    if (query.get('baseUrl')) settings.baseUrl = query.get('baseUrl');
+    const key = [providerId, settings.baseUrl ?? '', (settings.models ?? []).join(',')].join('|');
+
+    try {
+      const { models, cached, stale } = await modelCache.get(key, () => listProviderModels(settings));
+      sendJson(res, 200, {
+        provider: providerId,
+        models,
+        cached: Boolean(cached),
+        ...(stale ? { stale } : {}),
+      });
+    } catch (error) {
+      sendJson(res, 200, { provider: providerId, models: [], error: error?.message ?? String(error) });
+    }
+  });
+}