@danieltmn/tamnora 0.1.0

package/harness/packages/server/src/routes/providers.js

@@ -0,0 +1,135 @@
+import { MODES, MODE_IDS, resolveMode, PROVIDER_META, testProviderConnection } from '../lib/core.js';
+import { readJson, sendJson, sendError } from '../lib/http.js';
+
+const ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,39}$/i;
+
+function hint(apiKey) {
+  if (!apiKey) return '';
+  if (apiKey.startsWith('env:')) return apiKey;
+  return apiKey.length <= 4 ? '••••' : `••••${apiKey.slice(-4)}`;
+}
+
+/** Merge built-in metadata with stored overrides into the provider view. */
+export function providerList(ctx) {
+  const stored = new Map(ctx.store.listProviders().map((p) => [p.id, p]));
+  const items = [];
+
+  for (const meta of PROVIDER_META) {
+    const row = stored.get(meta.id);
+    items.push({
+      id: meta.id,
+      label: row?.label || meta.label,
+      baseUrl: row?.baseUrl || '',
+      defaultBaseUrl: meta.defaultBaseUrl,
+      requiresKey: row?.requiresKey ?? meta.requiresKey,
+      custom: false,
+      builtin: true,
+      stored: Boolean(row),
+      hasKey: Boolean(row?.apiKey),
+      apiKeyHint: hint(row?.apiKey),
+      models: row?.models ?? [],
+    });
+  }
+
+  for (const row of stored.values()) {
+    if (row.custom) {
+      items.push({
+        id: row.id,
+        label: row.label,
+        baseUrl: row.baseUrl,
+        defaultBaseUrl: '',
+        requiresKey: row.requiresKey ?? true,
+        custom: true,
+        builtin: false,
+        stored: true,
+        hasKey: Boolean(row.apiKey),
+        apiKeyHint: hint(row.apiKey),
+        models: row.models,
+      });
+    }
+  }
+
+  return {
+    providers: items,
+    active: { provider: ctx.effectiveProviderId(), model: ctx.effectiveModel() },
+  };
+}
+
+export function registerProviders(route, ctx) {
+  route('GET', '/api/providers', ({ res }) => sendJson(res, 200, providerList(ctx)));
+
+  route('GET', '/api/modes', ({ res }) => {
+    sendJson(res, 200, {
+      modes: MODE_IDS.map((id) => ({
+        id,
+        label: MODES[id].label,
+        description: MODES[id].description,
+      })),
+    });
+  });
+
+  route('GET', '/api/settings', ({ res }) => {
+    sendJson(res, 200, {
+      settings: {
+        provider: ctx.effectiveProviderId(),
+        model: ctx.effectiveModel(),
+        mode: ctx.effectiveMode(),
+        maxRounds: ctx.config.maxRounds,
+      },
+    });
+  });
+
+  route('PUT', '/api/settings', async ({ req, res }) => {
+    const body = await readJson(req);
+    if (body.provider !== undefined) ctx.store.setSetting('activeProvider', String(body.provider) || null);
+    if (body.model !== undefined) ctx.store.setSetting('activeModel', String(body.model) || null);
+    if (body.mode !== undefined) ctx.store.setSetting('activeMode', resolveMode(String(body.mode)).id);
+    sendJson(res, 200, {
+      settings: {
+        provider: ctx.effectiveProviderId(),
+        model: ctx.effectiveModel(),
+        mode: ctx.effectiveMode(),
+      },
+    });
+  });
+
+  route('PUT', '/api/providers/:id', async ({ req, res, params }) => {
+    const id = String(params.id);
+    if (!ID_PATTERN.test(id)) return sendError(res, 400, 'Id de proveedor inválido.');
+
+    const body = await readJson(req);
+    const existing = ctx.store.getProvider(id) ?? {};
+    const builtin = PROVIDER_META.find((p) => p.id === id);
+
+    const record = {
+      id,
+      label: body.label ?? existing.label ?? builtin?.label ?? id,
+      baseUrl: body.baseUrl ?? existing.baseUrl ?? '',
+      apiKey: 'apiKey' in body ? String(body.apiKey ?? '') : existing.apiKey ?? '',
+      models: Array.isArray(body.models)
+        ? body.models.map((m) => String(m).trim()).filter(Boolean)
+        : existing.models ?? [],
+      requiresKey: body.requiresKey ?? existing.requiresKey ?? builtin?.requiresKey,
+      custom: builtin ? Boolean(body.custom ?? existing.custom ?? false) : true,
+      enabled: body.enabled ?? existing.enabled ?? true,
+    };
+
+    ctx.store.saveProvider(record);
+    sendJson(res, 200, providerList(ctx));
+  });
+
+  route('DELETE', '/api/providers/:id', ({ res, params }) => {
+    const id = String(params.id);
+    if (!ctx.store.getProvider(id)) return sendError(res, 404, 'El proveedor no tiene configuración guardada.');
+    ctx.store.deleteProvider(id);
+    sendJson(res, 200, providerList(ctx));
+  });
+
+  route('POST', '/api/providers/:id/test', async ({ res, params }) => {
+    const id = String(params.id);
+    const settings = ctx.providerSettings(id);
+    const apiKey = ctx.apiKeyFor(id);
+    const result = await testProviderConnection({ ...settings, apiKey });
+    sendJson(res, 200, { provider: id, ...result });
+  });
+}

package/harness/packages/server/src/routes/sessions.js

@@ -0,0 +1,157 @@
+import { runAgent } from '../lib/core.js';
+import { readJson, sendJson, sendError } from '../lib/http.js';
+import { workspaceForRequest } from '../lib/workspace.js';
+
+function view(session) {
+  return {
+    id: session.id,
+    title: session.title,
+    provider: session.provider,
+    model: session.model,
+    cwd: session.cwd,
+    goal: session.meta?.goal ?? null,
+    hasSummary: Boolean(session.meta?.summary),
+    createdAt: session.created_at,
+    updatedAt: session.updated_at,
+  };
+}
+
+const COMPACT_INSTRUCTION =
+  'Resumí la conversación en un texto conciso que preserve decisiones tomadas, archivos tocados, hallazgos y el estado actual, para poder continuar el trabajo sin el historial completo.';
+
+export function registerSessions(route, ctx) {
+  route('GET', '/api/sessions', ({ res }) => {
+    sendJson(res, 200, { sessions: ctx.store.listSessions(50).map(view) });
+  });
+
+  route('GET', '/api/search', ({ res, query }) => {
+    const q = String(query.get('q') || '').trim();
+    if (q.length < 2) return sendJson(res, 200, { sessions: [], messages: [] });
+    const limit = Math.min(Math.max(Number(query.get('limit')) || 20, 1), 50);
+    const snippet = (content) => {
+      const text =
+        typeof content === 'string'
+          ? content
+          : Array.isArray(content)
+            ? content.map((part) => part?.text ?? '').join(' ')
+            : JSON.stringify(content ?? '');
+      return text.replace(/\s+/g, ' ').trim().slice(0, 200);
+    };
+    sendJson(res, 200, {
+      sessions: ctx.store.searchSessions(q, limit).map(view),
+      messages: ctx.store.searchMessages(q, limit).map((m) => ({
+        id: m.id,
+        sessionId: m.sessionId,
+        role: m.role,
+        title: m.title,
+        cwd: m.cwd,
+        snippet: snippet(m.content),
+      })),
+    });
+  });
+
+  route('POST', '/api/sessions', async ({ req, res }) => {
+    const body = await readJson(req);
+    let cwd;
+    try {
+      cwd = workspaceForRequest({ req, raw: body.cwd, fallback: ctx.cwd });
+    } catch (error) {
+      return sendError(res, 400, error.message);
+    }
+    const meta = body.goal ? { goal: String(body.goal) } : undefined;
+    const id = ctx.store.createSession({
+      title: String(body.title || 'Nueva sesión').slice(0, 80),
+      provider: body.provider || ctx.config.provider,
+      model: body.model || ctx.config.model,
+      cwd,
+      meta,
+    });
+    sendJson(res, 201, { session: view(ctx.store.getSession(id)) });
+  });
+
+  route('GET', '/api/sessions/:id', ({ res, params }) => {
+    const session = ctx.store.getSession(params.id);
+    if (!session) return sendError(res, 404, 'Sesión no encontrada.');
+    sendJson(res, 200, {
+      session: view(session),
+      tokens: ctx.store.sessionTokens(params.id),
+      messages: ctx.store.getMessages(params.id),
+    });
+  });
+
+  route('PUT', '/api/sessions/:id', async ({ req, res, params }) => {
+    const session = ctx.store.getSession(params.id);
+    if (!session) return sendError(res, 404, 'Sesión no encontrada.');
+    const body = await readJson(req);
+    const patch = {};
+    if ('title' in body) patch.title = String(body.title || '').slice(0, 80) || session.title;
+    if ('goal' in body) patch.meta = { goal: body.goal ? String(body.goal) : undefined };
+    ctx.store.touchSession(params.id, patch);
+    sendJson(res, 200, { session: view(ctx.store.getSession(params.id)) });
+  });
+
+  route('DELETE', '/api/sessions/:id/messages', ({ res, params }) => {
+    const session = ctx.store.getSession(params.id);
+    if (!session) return sendError(res, 404, 'Sesión no encontrada.');
+    ctx.store.clearMessages(params.id);
+    ctx.store.touchSession(params.id, { meta: { summary: undefined } });
+    sendJson(res, 200, { ok: true });
+  });
+
+  route('POST', '/api/sessions/:id/truncate', async ({ req, res, params }) => {
+    const session = ctx.store.getSession(params.id);
+    if (!session) return sendError(res, 404, 'Sesión no encontrada.');
+    const body = await readJson(req);
+    const fromId = String(body.fromId || '');
+    if (!fromId) return sendError(res, 400, 'Falta "fromId".');
+    const removed = ctx.store.deleteMessagesFrom(params.id, fromId);
+    if (!removed) return sendError(res, 404, 'Mensaje no encontrado.');
+    ctx.store.touchSession(params.id, {});
+    sendJson(res, 200, { ok: true, removed });
+  });
+
+  route('POST', '/api/sessions/:id/compact', async ({ res, params }) => {
+    const session = ctx.store.getSession(params.id);
+    if (!session) return sendError(res, 404, 'Sesión no encontrada.');
+    const messages = ctx.store.getMessages(params.id);
+    if (!messages.length) return sendError(res, 400, 'La sesión no tiene mensajes para compactar.');
+
+    const providerId = session.provider || ctx.effectiveProviderId();
+    const model = session.model || ctx.effectiveModel();
+    if (!model) return sendError(res, 400, 'Falta el modelo para compactar.');
+
+    const transcript = messages
+      .map((m) => `${m.role}: ${typeof m.content === 'string' ? m.content : JSON.stringify(m.content)}`)
+      .join('\n');
+
+    try {
+      const { provider, config } = ctx.resolveProvider({
+        ...ctx.providerSettings(providerId),
+        apiKey: ctx.apiKeyFor(providerId),
+      });
+      const result = await runAgent({
+        provider,
+        config,
+        model,
+        messages: [
+          { role: 'system', content: COMPACT_INSTRUCTION },
+          { role: 'user', content: transcript.slice(0, 60000) },
+        ],
+        tools: [],
+      });
+      const summary = result.content?.trim();
+      if (!summary) return sendError(res, 502, 'El modelo no devolvió un resumen.');
+      ctx.store.clearMessages(params.id);
+      ctx.store.touchSession(params.id, { meta: { summary } });
+      sendJson(res, 200, { summary, messages: 0 });
+    } catch (error) {
+      sendError(res, 502, `No se pudo compactar: ${error?.message ?? error}`);
+    }
+  });
+
+  route('DELETE', '/api/sessions/:id', ({ res, params }) => {
+    if (!ctx.store.getSession(params.id)) return sendError(res, 404, 'Sesión no encontrada.');
+    ctx.store.deleteSession(params.id);
+    sendJson(res, 200, { ok: true });
+  });
+}

package/harness/packages/server/src/server.js

@@ -0,0 +1,249 @@
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import {
+  loadConfig,
+  Store,
+  databasePath,
+  homeDir,
+  readApp,
+  resolveProviderRuntime,
+  resolveApiKey,
+  composeProviderSettings,
+  buildMcpRegistry,
+} from './lib/core.js';
+import { sendJson, sendError } from './lib/http.js';
+import { createPromptBuilder, DEFAULT_SYSTEM_PROMPT } from './lib/prompt.js';
+import { createApprovalBroker } from './lib/approvals.js';
+import { createStaticHandler } from './static.js';
+import { requireLogin, requireCsrf } from './auth.js';
+import { registerAuth } from './routes/auth.js';
+import { registerSessions } from './routes/sessions.js';
+import { registerFolders } from './routes/folders.js';
+import { registerFiles } from './routes/files.js';
+import { registerModels } from './routes/models.js';
+import { registerProviders } from './routes/providers.js';
+import { registerMcp } from './routes/mcp.js';
+import { registerChat } from './routes/chat.js';
+import { registerEval } from './routes/eval.js';
+
+const VERSION = readVersion();
+
+function readVersion() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(fileURLToPath(new URL('../../../../package.json', import.meta.url)), 'utf8')
+    );
+    return pkg.version || '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+}
+
+const DEFAULT_PUBLIC_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
+
+const AUTH_OPEN = new Set(['/api/health', '/api/auth/login', '/api/auth/me']);
+
+/**
+ * Create the harness HTTP server (REST + SSE) bound to a project directory.
+ * Does not start listening; call `listen()`.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.cwd] - project dir (tamnora.json / AGENTS.md)
+ * @param {string} [opts.host]
+ * @param {number} [opts.port]
+ * @param {string} [opts.staticDir] - override the console directory
+ * @param {Function} [opts.resolveProvider] - injection point (tests)
+ * @param {boolean} [opts.yes] - auto-approve tools with permission "ask"
+ * @param {boolean} [opts.loadMcp] - connect configured MCP servers (default true)
+ */
+export async function createTamnoraServer({
+  cwd = process.cwd(),
+  host,
+  port,
+  staticDir,
+  resolveProvider,
+  yes = false,
+  loadMcp = true,
+  dbPath,
+} = {}) {
+  const config = await loadConfig(cwd);
+  const app = readApp();
+  const authEnabled = Boolean(app.user && app.user.password);
+  const store = new Store(dbPath ?? databasePath(cwd));
+  const systemPromptFor = createPromptBuilder({ cwd, files: config.instructions });
+  const systemPrompt = (await systemPromptFor(cwd)) || DEFAULT_SYSTEM_PROMPT;
+  const approvals = createApprovalBroker({ timeoutMs: config.approvalTimeoutMs });
+  const autoApproved = new Set();
+  const isAutoApprove = (sessionId) => autoApproved.has(sessionId);
+  const setAutoApprove = (sessionId, value) => (value ? autoApproved.add(sessionId) : autoApproved.delete(sessionId));
+
+  let mcpPromise = null;
+  const getMcp = async () => {
+    if (!loadMcp || !(config.mcp?.length)) return null;
+    if (!mcpPromise) mcpPromise = buildMcpRegistry(config.mcp);
+    return mcpPromise;
+  };
+
+  const customProviderDefs = () =>
+    store
+      .listProviders()
+      .filter((p) => p.custom)
+      .map((p) => ({ id: p.id, label: p.label, baseUrl: p.baseUrl, models: p.models }));
+
+  const providerSettings = (id) =>
+    composeProviderSettings({
+      providerId: id,
+      stored: store.getProvider(id) ?? {},
+      config,
+      customProviders: customProviderDefs(),
+    });
+
+  const effectiveProviderId = () => store.getSetting('activeProvider') || config.provider;
+  const effectiveModel = () => store.getSetting('activeModel') || config.model;
+  const effectiveMode = () => store.getSetting('activeMode') || 'agent';
+
+  const ctx = {
+    cwd,
+    config,
+    app,
+    authEnabled,
+    store,
+    systemPrompt,
+    systemPromptFor,
+    approvals,
+    isAutoApprove,
+    setAutoApprove,
+    yes,
+    effectiveProviderId,
+    effectiveModel,
+    effectiveMode,
+    providerSettings,
+    customProviderDefs,
+    apiKeyFor: (id) => resolveApiKey(providerSettings(id).apiKey, process.env),
+    resolveProvider: resolveProvider ?? ((settings) => resolveProviderRuntime(settings)),
+    getMcp,
+  };
+
+  const routes = [];
+  const route = (method, pattern, handler) =>
+    routes.push({ method, segments: pattern.split('/').filter(Boolean), handler });
+
+  route('GET', '/api/health', ({ res }) => {
+    sendJson(res, 200, {
+      ok: true,
+      name: 'tamnora',
+      cwd,
+      home: os.homedir(),
+      tamnoraHome: homeDir(),
+      version: VERSION,
+    });
+  });
+
+  registerAuth(route, ctx);
+  registerSessions(route, ctx);
+  registerFolders(route, ctx);
+  registerFiles(route, ctx);
+  registerModels(route, ctx);
+  registerProviders(route, ctx);
+  registerMcp(route, ctx);
+  registerChat(route, ctx);
+  registerEval(route, ctx);
+
+  function matchRoute(method, pathname) {
+    const parts = pathname.split('/').filter(Boolean);
+    for (const r of routes) {
+      if (r.method !== method || r.segments.length !== parts.length) continue;
+      const params = {};
+      let ok = true;
+      for (let i = 0; i < r.segments.length; i++) {
+        const segment = r.segments[i];
+        if (segment.startsWith(':')) params[segment.slice(1)] = decodeURIComponent(parts[i]);
+        else if (segment !== parts[i]) {
+          ok = false;
+          break;
+        }
+      }
+      if (ok) return { handler: r.handler, params };
+    }
+    return null;
+  }
+
+  const serveStatic = createStaticHandler(staticDir ?? DEFAULT_PUBLIC_DIR);
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
+
+    if (url.pathname.startsWith('/api/')) {
+      const matched = matchRoute(req.method, url.pathname);
+      if (!matched) return sendError(res, 404, `Ruta no encontrada: ${req.method} ${url.pathname}`);
+      if (authEnabled && !AUTH_OPEN.has(url.pathname)) {
+        if (!requireLogin(app, req, res)) return;
+        if (req.method !== 'GET' && req.method !== 'HEAD' && !requireCsrf(app, req, res)) return;
+      }
+      try {
+        await matched.handler({ req, res, params: matched.params, query: url.searchParams });
+      } catch (error) {
+        if (res.headersSent) {
+          try {
+            res.end();
+          } catch {
+            // already closed
+          }
+        } else {
+          sendError(res, 500, error?.message ?? String(error));
+        }
+      }
+      return;
+    }
+
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('405');
+      return;
+    }
+    try {
+      await serveStatic(req, res, url.pathname);
+    } catch (error) {
+      res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end(String(error?.message ?? error));
+    }
+  });
+
+  const listen = (options = {}) =>
+    new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(
+        options.port ?? port ?? config.server?.port ?? 4517,
+        options.host ?? host ?? config.server?.host ?? '127.0.0.1',
+        () => {
+          const address = server.address();
+          resolve({
+            host: address.address,
+            port: address.port,
+            url: `http://${address.address === '::' ? '127.0.0.1' : address.address}:${address.port}`,
+          });
+        }
+      );
+    });
+
+  const close = async () => {
+    approvals.cancelAll();
+    try {
+      const registry = mcpPromise ? await mcpPromise : null;
+      registry?.close?.();
+    } catch {
+      // ignore MCP shutdown errors
+    }
+    try {
+      store.close();
+    } catch {
+      // already closed
+    }
+    await new Promise((resolve) => server.close(() => resolve()));
+  };
+
+  return { server, config, store, ctx, listen, close, staticDir: staticDir ?? DEFAULT_PUBLIC_DIR };
+}

package/harness/packages/server/src/static.js

@@ -0,0 +1,67 @@
+// Static file server for the built-in console (and any --static dir).
+// Guards against path traversal and falls back to index.html.
+
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import path from 'node:path';
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+  '.txt': 'text/plain; charset=utf-8',
+  '.woff2': 'font/woff2',
+};
+
+/** Build a `(req, res, pathname) => Promise<void>` static handler. */
+export function createStaticHandler(rootDir) {
+  const root = path.resolve(rootDir);
+
+  return async function serveStatic(req, res, pathname) {
+    const relative = decodeURIComponent(pathname).replace(/^\/+/, '');
+    let file = path.resolve(root, relative || 'index.html');
+
+    if (file !== root && !file.startsWith(root + path.sep)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('403');
+      return;
+    }
+
+    let info = await stat(file).catch(() => null);
+    if (info?.isDirectory()) {
+      file = path.join(file, 'index.html');
+      info = await stat(file).catch(() => null);
+    }
+    if (!info?.isFile()) {
+      const index = path.join(root, 'index.html');
+      const indexInfo = await stat(index).catch(() => null);
+      if (indexInfo?.isFile()) {
+        file = index;
+        info = indexInfo;
+      }
+    }
+    if (!info?.isFile()) {
+      res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('404');
+      return;
+    }
+
+    res.writeHead(200, {
+      'Content-Type': MIME[path.extname(file).toLowerCase()] ?? 'application/octet-stream',
+      'Content-Length': info.size,
+      'Cache-Control': 'no-cache',
+    });
+    if (req.method === 'HEAD') {
+      res.end();
+      return;
+    }
+    createReadStream(file).pipe(res);
+  };
+}

package/harness/packages/server/test/markdown.test.js

@@ -0,0 +1,36 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { renderMarkdown, highlight } from '../public/markdown.js';
+
+test('escapes raw HTML from model output', () => {
+  const html = renderMarkdown('<script>alert(1)</script>');
+  assert.ok(!html.includes('<script>'));
+  assert.match(html, /&lt;script&gt;/);
+});
+
+test('renders headings, bold, inline code and lists', () => {
+  const html = renderMarkdown('# Título\n\n**negrita** y `code`');
+  assert.match(html, /<h1>Título<\/h1>/);
+  assert.match(html, /<strong>negrita<\/strong>/);
+  assert.match(html, /<code>code<\/code>/);
+
+  const list = renderMarkdown('- uno\n- dos');
+  assert.equal(list, '<ul><li>uno</li><li>dos</li></ul>');
+});
+
+test('renders fenced code blocks and highlights keywords/strings', () => {
+  const html = renderMarkdown('```js\nconst x = "hola"; // nota\n```');
+  assert.match(html, /class="code-block"/);
+  assert.match(html, /tok-keyword">const</);
+  assert.match(html, /tok-string">&quot;hola&quot;</);
+  assert.match(html, /tok-comment">\/\/ nota</);
+});
+
+test('only allows http(s) links', () => {
+  assert.match(renderMarkdown('[x](https://a.com)'), /<a href="https:\/\/a\.com"/);
+  assert.ok(!renderMarkdown('[x](javascript:alert(1))').includes('<a '));
+});
+
+test('highlight escapes code content', () => {
+  assert.equal(highlight('a < b', 'bash'), 'a &lt; b');
+});