@danieltmn/tamnora 0.1.0

package/harness/packages/server/test/server.test.js

@@ -0,0 +1,809 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { mkdtemp, mkdir, writeFile, readFile, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createTamnoraServer } from '../src/index.js';
+import { setHome, ensureApp, readApp, writeApp, makeUser } from '../../core/src/index.js';
+
+const fakeProvider = {
+  id: 'fake',
+  async streamChat(_config, { onEvent }) {
+    onEvent?.({ type: 'text', delta: 'hola', full: 'hola' });
+    return { content: 'hola', reasoning: '', toolCalls: [] };
+  },
+};
+
+async function startServer(overrides = {}) {
+  const cwd = overrides.cwd ?? (await mkdtemp(path.join(tmpdir(), 'tamnora-srv-')));
+  setHome(cwd);
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+    ...overrides,
+  });
+  const info = await instance.listen({ port: 0 });
+  return { instance, base: info.url };
+}
+
+test('serves health, providers and the console', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const health = await (await fetch(`${base}/api/health`)).json();
+    assert.equal(health.ok, true);
+    assert.equal(health.name, 'tamnora');
+
+    const providers = await (await fetch(`${base}/api/providers`)).json();
+    assert.ok(providers.providers.some((p) => p.id === 'openrouter'));
+    assert.equal(providers.active.provider, 'openrouter');
+
+    const html = await (await fetch(`${base}/`)).text();
+    assert.match(html, /Tamnora Console/);
+
+    const missing = await fetch(`${base}/api/nope`);
+    assert.equal(missing.status, 404);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('creates, lists, reads and deletes sessions', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Prueba', model: 'm' }),
+      })
+    ).json();
+    assert.ok(created.session.id);
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(list.sessions.length, 1);
+    assert.equal(list.sessions[0].title, 'Prueba');
+
+    const detail = await (await fetch(`${base}/api/sessions/${created.session.id}`)).json();
+    assert.deepEqual(detail.messages, []);
+
+    const deleted = await fetch(`${base}/api/sessions/${created.session.id}`, { method: 'DELETE' });
+    assert.equal(deleted.status, 200);
+    const afterList = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(afterList.sessions.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('streams a chat turn over SSE and persists the messages', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm' }),
+    });
+    assert.equal(res.status, 200);
+    assert.match(res.headers.get('content-type'), /text\/event-stream/);
+    const text = await res.text();
+    assert.match(text, /event: start/);
+    assert.match(text, /event: text/);
+    assert.match(text, /event: done/);
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(list.sessions.length, 1);
+    const detail = await (await fetch(`${base}/api/sessions/${list.sessions[0].id}`)).json();
+    const assistant = detail.messages.find((m) => m.role === 'assistant');
+    assert.equal(assistant.content, 'hola');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('rejects chat without input or model', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const noInput = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ model: 'm' }),
+    });
+    assert.equal(noInput.status, 400);
+
+    const noModel = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola' }),
+    });
+    assert.equal(noModel.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages providers and active settings', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const put = await fetch(`${base}/api/providers/deepseek`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        label: 'DeepSeek',
+        baseUrl: 'https://api.deepseek.com/v1',
+        apiKey: 'sk-secret-1234',
+        models: ['deepseek-chat'],
+      }),
+    });
+    const data = await put.json();
+    const ds = data.providers.find((p) => p.id === 'deepseek');
+    assert.equal(ds.hasKey, true);
+    assert.equal(ds.apiKeyHint.endsWith('1234'), true);
+    assert.deepEqual(ds.models, ['deepseek-chat']);
+
+    await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ provider: 'deepseek', model: 'deepseek-chat' }),
+    });
+    const settings = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(settings.settings.provider, 'deepseek');
+    assert.equal(settings.settings.model, 'deepseek-chat');
+
+    const list = await (await fetch(`${base}/api/providers`)).json();
+    assert.equal(list.active.provider, 'deepseek');
+
+    const deleted = await fetch(`${base}/api/providers/deepseek`, { method: 'DELETE' });
+    assert.equal(deleted.status, 200);
+    const after = await (await fetch(`${base}/api/providers`)).json();
+    assert.equal(after.providers.find((p) => p.id === 'deepseek').hasKey, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('runs an evaluation over HTTP and persists the run', async () => {
+  const model = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (c) => (body += c));
+    req.on('end', () => {
+      res.setHeader('Content-Type', 'text/event-stream');
+      res.write(`data: ${JSON.stringify({ choices: [{ delta: { content: 'hola' } }] })}\n\n`);
+      res.write('data: [DONE]\n\n');
+      res.end();
+    });
+  });
+  await new Promise((r) => model.listen(0, '127.0.0.1', r));
+  const modelBase = `http://127.0.0.1:${model.address().port}/v1`;
+
+  const { instance, base } = await startServer();
+  try {
+    const res = await fetch(`${base}/api/eval`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        provider: 'openai-compatible',
+        baseUrl: modelBase,
+        models: ['mock'],
+        concurrency: 1,
+        tasks: [{ id: 't1', input: 'saluda', expect: { contains: 'hola' } }],
+      }),
+    });
+    const text = await res.text();
+    assert.match(text, /event: result/);
+    assert.match(text, /event: summary/);
+    assert.match(text, /"passed":1/);
+
+    const runs = await (await fetch(`${base}/api/runs`)).json();
+    assert.equal(runs.runs.length, 1);
+    const detail = await (await fetch(`${base}/api/runs/${runs.runs[0].id}`)).json();
+    assert.equal(detail.results.length, 1);
+    assert.equal(detail.results[0].passed, 1);
+  } finally {
+    await instance.close();
+    model.close();
+  }
+});
+
+test('creates a folder over HTTP and rejects bad input', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-newdir-'));
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  const create = (body) =>
+    fetch(`${base}/api/folders`, { method: 'POST', headers: json, body: JSON.stringify(body) });
+  try {
+    const created = await create({ parent: root, name: 'mi-proyecto' });
+    assert.equal(created.status, 201);
+    const data = await created.json();
+    assert.equal(data.path, path.join(root, 'mi-proyecto'));
+    assert.ok((await stat(data.path)).isDirectory());
+
+    assert.equal((await create({ parent: root, name: 'mi-proyecto' })).status, 409);
+    assert.equal((await create({ parent: root, name: '../escape' })).status, 400);
+    assert.equal((await create({ parent: root, name: '' })).status, 400);
+    assert.equal((await create({ name: 'sin-parent' })).status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('lists and previews workspace files, confining to the root', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-files-'));
+  await mkdir(path.join(root, 'src'));
+  await mkdir(path.join(root, 'node_modules'));
+  await writeFile(path.join(root, 'README.md'), '# hola\n');
+  await writeFile(path.join(root, 'src', 'index.js'), 'export const x = 1;\n');
+  await writeFile(path.join(root, 'zeta.bin'), Buffer.from([1, 2, 0, 3]));
+
+  const { instance, base } = await startServer();
+  const list = (params) => fetch(`${base}/api/files?${new URLSearchParams(params)}`);
+  const content = (params) => fetch(`${base}/api/files/content?${new URLSearchParams(params)}`);
+  try {
+    const top = await (await list({ root, path: '' })).json();
+    assert.equal(top.path, '');
+    assert.deepEqual(
+      top.entries.map((e) => `${e.type}:${e.name}`),
+      ['dir:src', 'file:README.md', 'file:zeta.bin']
+    );
+
+    const sub = await (await list({ root, path: 'src' })).json();
+    assert.deepEqual(sub.entries.map((e) => e.name), ['index.js']);
+    assert.equal(sub.entries[0].size > 0, true);
+
+    const preview = await (await content({ root, path: 'src/index.js' })).json();
+    assert.equal(preview.content, 'export const x = 1;\n');
+
+    assert.equal((await list({ root, path: '../../' })).status, 400);
+    assert.equal((await list({ root: path.join(root, 'nope') })).status, 400);
+    assert.equal((await content({ root, path: 'zeta.bin' })).status, 415);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('lists workspace folders and rejects invalid paths', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-folders-'));
+  await mkdir(path.join(root, 'beta'));
+  await mkdir(path.join(root, 'alpha'));
+  await writeFile(path.join(root, 'solo-archivo.txt'), 'x');
+
+  const { instance, base } = await startServer();
+  try {
+    const roots = await (await fetch(`${base}/api/folders`)).json();
+    assert.ok(roots.dirs.length >= 1);
+    assert.equal(roots.path, null);
+
+    const listed = await (await fetch(`${base}/api/folders?path=${encodeURIComponent(root)}`)).json();
+    assert.equal(listed.path, path.resolve(root));
+    assert.deepEqual(
+      listed.dirs.map((d) => d.name),
+      ['alpha', 'beta']
+    );
+    assert.ok(listed.parent);
+
+    const missing = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'nope'))}`);
+    assert.equal(missing.status, 400);
+
+    const file = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'solo-archivo.txt'))}`);
+    assert.equal(file.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('the system prompt follows the session workspace, not the server cwd', async () => {
+  const serverCwd = await mkdtemp(path.join(tmpdir(), 'tamnora-srv-cwd-'));
+  const projectCwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proj-cwd-'));
+  await writeFile(path.join(serverCwd, 'AGENTS.md'), 'REGLAS_DEL_SERVER');
+  await writeFile(path.join(projectCwd, 'AGENTS.md'), 'REGLAS_DEL_PROYECTO');
+
+  let captured = null;
+  const provider = {
+    id: 'capture',
+    async streamChat(_config, opts) {
+      captured = opts.messages.find((m) => m.role === 'system')?.content ?? '';
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+
+  const { instance, base } = await startServer({
+    cwd: serverCwd,
+    resolveProvider: () => ({ provider, config: {} }),
+  });
+  try {
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm', cwd: projectCwd }),
+    });
+    await res.text();
+    assert.ok(captured.includes(path.resolve(projectCwd)), 'nombra la carpeta de la sesión');
+    assert.match(captured, /REGLAS_DEL_PROYECTO/);
+    assert.doesNotMatch(captured, /REGLAS_DEL_SERVER/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('asks for approval before running a gated tool and runs it once approved', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-ask-'));
+  let calls = 0;
+  const provider = {
+    id: 'tooly',
+    async streamChat() {
+      calls += 1;
+      if (calls === 1) {
+        return {
+          content: '',
+          reasoning: '',
+          toolCalls: [
+            { id: 'call_1', function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'hi' }) } },
+          ],
+        };
+      }
+      return { content: 'listo', reasoning: '', toolCalls: [] };
+    },
+  };
+
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  try {
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'creá nota.txt con hi', model: 'm' }),
+    });
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let askId = null;
+    let done = false;
+    while (!done) {
+      const { value } = await reader.read();
+      if (!value) break;
+      buffer += decoder.decode(value, { stream: true });
+      if (!askId) {
+        const match = buffer.match(/"askId":"([0-9a-f-]+)"/);
+        if (match && buffer.includes('event: permission')) {
+          askId = match[1];
+          const decision = await fetch(`${base}/api/permissions/${askId}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ allow: true }),
+          });
+          assert.equal(decision.status, 200);
+        }
+      }
+      if (buffer.includes('event: done')) done = true;
+    }
+    assert.ok(askId, 'emitió el evento permission');
+    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'hi');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('rejects unknown permission requests', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const res = await fetch(`${base}/api/permissions/does-not-exist`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ allow: true }),
+    });
+    assert.equal(res.status, 404);
+  } finally {
+    await instance.close();
+  }
+});
+
+async function readEvents(res, onFrame) {
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  let done = false;
+  while (!done) {
+    const { value } = await reader.read();
+    if (!value) break;
+    buffer += decoder.decode(value, { stream: true });
+    if (onFrame) await onFrame(buffer);
+    if (buffer.includes('event: done')) done = true;
+  }
+  return buffer;
+}
+
+test('forwards attached images as multimodal content', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-img-'));
+  let captured = null;
+  const provider = {
+    id: 'vision',
+    async streamChat(_config, opts) {
+      captured = opts.messages.find((m) => m.role === 'user');
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  try {
+    const image = 'data:image/png;base64,iVBORw0KGgo=';
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'mirá', model: 'm', images: [image] }),
+    });
+    await res.text();
+    assert.ok(Array.isArray(captured.content));
+    assert.deepEqual(captured.content[0], { type: 'text', text: 'mirá' });
+    assert.equal(captured.content[1].type, 'image_url');
+    assert.equal(captured.content[1].image_url.url, image);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('scope=session approves later asks without prompting again', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-scope-'));
+  let round = 0;
+  const provider = {
+    id: 'twice',
+    async streamChat() {
+      round += 1;
+      if (round <= 2) {
+        return {
+          content: '',
+          reasoning: '',
+          toolCalls: [
+            {
+              id: `call_${round}`,
+              function: { name: 'write', arguments: JSON.stringify({ path: `f${round}.txt`, content: 'x' }) },
+            },
+          ],
+        };
+      }
+      return { content: 'fin', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  try {
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'creá dos archivos', model: 'm' }),
+    });
+    let decisions = 0;
+    const text = await readEvents(res, async (buffer) => {
+      if (decisions === 0 && buffer.includes('event: permission')) {
+        decisions += 1;
+        const askId = buffer.match(/"askId":"([0-9a-f-]+)"/)[1];
+        await fetch(`${base}/api/permissions/${askId}`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ allow: true, scope: 'session' }),
+        });
+      }
+    });
+    assert.equal(decisions, 1, 'solo pidió permiso una vez');
+    assert.equal((text.match(/event: permission\n/g) ?? []).length, 1);
+    assert.equal(await readFile(path.join(cwd, 'f1.txt'), 'utf8'), 'x');
+    assert.equal(await readFile(path.join(cwd, 'f2.txt'), 'utf8'), 'x');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('stores and injects the session goal', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-goal-'));
+  let captured = null;
+  const provider = {
+    id: 'goal',
+    async streamChat(_config, opts) {
+      captured = opts.messages;
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'G' }) })
+    ).json();
+    const id = created.session.id;
+    const updated = await (
+      await fetch(`${base}/api/sessions/${id}`, {
+        method: 'PUT',
+        headers: json,
+        body: JSON.stringify({ goal: 'migrar a ESM' }),
+      })
+    ).json();
+    assert.equal(updated.session.goal, 'migrar a ESM');
+
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+    assert.ok(captured.some((m) => m.content === 'Objetivo de la sesión: migrar a ESM'));
+  } finally {
+    await instance.close();
+  }
+});
+
+test('compact summarizes the session and clears its messages', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-compact-'));
+  let compacting = false;
+  const provider = {
+    id: 'sum',
+    async streamChat(_config, opts) {
+      const system = opts.messages.find((m) => m.role === 'system')?.content ?? '';
+      if (system.includes('Resumí la conversación')) compacting = true;
+      return { content: compacting ? 'RESUMEN FINAL' : 'hola', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'C' }) })
+    ).json();
+    const id = created.session.id;
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+
+    const compact = await (
+      await fetch(`${base}/api/sessions/${id}/compact`, { method: 'POST', headers: json })
+    ).json();
+    assert.equal(compact.summary, 'RESUMEN FINAL');
+
+    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
+    assert.deepEqual(detail.messages, []);
+    assert.equal(detail.session.hasSummary, true);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('exposes modes and persists the active mode', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const modes = await (await fetch(`${base}/api/modes`)).json();
+    assert.deepEqual(
+      modes.modes.map((m) => m.id),
+      ['agent', 'plan']
+    );
+    await fetch(`${base}/api/settings`, { method: 'PUT', headers: json, body: JSON.stringify({ mode: 'plan' }) });
+    const settings = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(settings.settings.mode, 'plan');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('plan mode exposes only read-only tools and adds guidance', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-plan-'));
+  let captured = null;
+  const provider = {
+    id: 'plan',
+    async streamChat(_config, opts) {
+      captured = {
+        tools: (opts.tools ?? []).map((t) => t.function.name).sort(),
+        system: opts.messages.find((m) => m.role === 'system').content,
+      };
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  try {
+    await (
+      await fetch(`${base}/api/chat`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ input: 'planificá', model: 'm', mode: 'plan' }),
+      })
+    ).text();
+    assert.deepEqual(captured.tools, ['git_diff', 'git_log', 'git_status', 'glob', 'grep', 'list', 'read']);
+    assert.match(captured.system, /modo PLAN/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('aggregates the token usage of a session', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-tokens-'));
+  const provider = {
+    id: 'tok',
+    async streamChat() {
+      return {
+        content: 'ok',
+        reasoning: '',
+        toolCalls: [],
+        usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+      };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'T' }) })
+    ).json();
+    const id = created.session.id;
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
+    assert.deepEqual(detail.tokens, { in: 10, out: 5 });
+  } finally {
+    await instance.close();
+  }
+});
+
+test('sessions and chat accept a workspace cwd', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-cwd-'));
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Con carpeta', model: 'm', cwd: root }),
+      })
+    ).json();
+    assert.equal(created.session.cwd, path.resolve(root));
+
+    const bad = await fetch(`${base}/api/sessions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ title: 'Mala', cwd: path.join(root, 'nope') }),
+    });
+    assert.equal(bad.status, 400);
+
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm', cwd: root }),
+    });
+    const text = await res.text();
+    assert.match(text, /event: start/);
+    assert.ok(text.includes(`"cwd":${JSON.stringify(path.resolve(root))}`));
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    const fromChat = list.sessions.find((s) => s.cwd === path.resolve(root) && s.title !== 'Con carpeta');
+    assert.ok(fromChat);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('requires login and CSRF when a user is configured', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-auth-'));
+  setHome(cwd);
+  const app = ensureApp();
+  app.user = makeUser('admin', 'secreto123');
+  writeApp(app);
+  assert.equal(readApp().user.name, 'admin');
+
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+  });
+  const info = await instance.listen({ port: 0 });
+  const base = info.url;
+  try {
+    const unauth = await fetch(`${base}/api/providers`);
+    assert.equal(unauth.status, 401);
+
+    const bad = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username: 'admin', password: 'nope' }),
+    });
+    assert.equal(bad.status, 401);
+
+    const login = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username: 'admin', password: 'secreto123' }),
+    });
+    assert.equal(login.status, 200);
+    const cookie = login.headers.get('set-cookie');
+    assert.ok(cookie);
+    const csrf = (await login.json()).csrf;
+    assert.ok(csrf);
+
+    const authed = await fetch(`${base}/api/providers`, { headers: { cookie } });
+    assert.equal(authed.status, 200);
+
+    const noCsrf = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', cookie },
+      body: JSON.stringify({ provider: 'openrouter' }),
+    });
+    assert.equal(noCsrf.status, 403);
+
+    const withCsrf = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', cookie, 'x-csrf': csrf },
+      body: JSON.stringify({ provider: 'openrouter' }),
+    });
+    assert.equal(withCsrf.status, 200);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('searches sessions and messages', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Busqueda pepita' }),
+      })
+    ).json();
+    const sessionId = created.session.id;
+
+    await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'contenido único zanahoria', model: 'm', sessionId }),
+    });
+
+    const bySession = await (await fetch(`${base}/api/search?q=pepita`)).json();
+    assert.ok(bySession.sessions.some((s) => s.id === sessionId));
+
+    const byMessage = await (await fetch(`${base}/api/search?q=zanahoria`)).json();
+    assert.ok(byMessage.messages.some((m) => m.sessionId === sessionId));
+
+    const tooShort = await (await fetch(`${base}/api/search?q=p`)).json();
+    assert.deepEqual(tooShort, { sessions: [], messages: [] });
+  } finally {
+    await instance.close();
+  }
+});
+
+test('truncates a session from a message id', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'T' }),
+      })
+    ).json();
+    const sessionId = created.session.id;
+
+    await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId }),
+    });
+
+    let detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
+    assert.ok(detail.messages.length >= 2);
+    const firstId = detail.messages[0].id;
+    assert.ok(firstId);
+
+    const res = await fetch(`${base}/api/sessions/${sessionId}/truncate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ fromId: firstId }),
+    });
+    assert.equal(res.status, 200);
+
+    detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
+    assert.equal(detail.messages.length, 0);
+  } finally {
+    await instance.close();
+  }
+});