@danieltmn/tamnora 0.16.1 → 0.18.0

package/harness/packages/core/src/tools/permissions.js

@@ -17,6 +17,9 @@ export const DEFAULT_PERMISSIONS = {
   screenshot: 'allow',
   console_errors: 'allow',
   preview_url: 'allow',
+  ask_user: 'allow',
+  offer_choices: 'allow',
+  show_plan: 'allow',
   write: 'ask',
   edit: 'ask',
   bash: 'ask',
@@ -50,27 +53,69 @@ function subjectFor(name, args) {
   return args?.path ?? '';
 }
 
+// Guardas de `bash`: comandos catastroficos o irreversibles que no deberian
+// colarse aunque la policy sea `allow` (o `--yes`). `deny` = nunca legitimo;
+// `ask` = nunca se autoaprueba (siempre consulta, aunque bash sea `allow`).
+const BASH_DENY = [
+  /:\s*\(\s*\)\s*\{[\s\S]*\}\s*;?\s*:/, // fork bomb :(){ :|:& };:
+  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\/|~|\$HOME|\/\*)(\s|$)/i,
+  /\bmkfs(\.|\s|$)/i,
+  /\bdd\b[^\n]*\bof=\/dev\//i,
+  />\s*\/dev\/(sd|nvme|disk)/i,
+  /\bchmod\s+-R\s+777\s+\/(\s|$)/i,
+  /\b(?:format|del|erase|rd|rmdir)\b[^\n]*\b[a-z]:[\\/]\*/i, // Windows: borrar/formatear unidad
+  /\b(?:remove-item|del|rd|rmdir|format)\b[^\n]*(?:-recurse|-r\b)[^\n]*\b[a-z]:\\?\s*$/i,
+];
+const BASH_ASK = [
+  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\*|\.|\.\/)(\s|$)/i, // rm -rf * | . (workspace)
+  /\bgit\s+push\b[^\n]*(\s-f\b|\s--force\b)/i,
+  /\bgit\s+reset\s+--hard\b/i,
+  /\bgit\s+clean\s+-[a-z]*f/i,
+];
+
+/** Devuelve `'deny'`/`'ask'` si el comando es peligroso, o `null`. */
+export function bashGuard(command) {
+  const text = String(command ?? '');
+  if (!text.trim()) return null;
+  for (const re of BASH_DENY) if (re.test(text)) return 'deny';
+  for (const re of BASH_ASK) if (re.test(text)) return 'ask';
+  return null;
+}
+
+const RANK = { allow: 0, ask: 1, deny: 2 };
+
 /**
  * Decide the permission for a tool call.
  * @returns {'allow'|'ask'|'deny'}
  */
 export function evaluatePermission(name, args = {}, permissions = {}) {
   const value = permissions[name] ?? DEFAULT_PERMISSIONS[name] ?? 'ask';
+  let decision = 'ask';
 
-  if (typeof value === 'string') return value;
-
-  if (value && typeof value === 'object') {
+  if (typeof value === 'string') {
+    decision = value;
+  } else if (value && typeof value === 'object') {
     const subject = subjectFor(name, args);
     let fallback = 'ask';
-    for (const [pattern, decision] of Object.entries(value)) {
+    let matched = false;
+    for (const [pattern, d] of Object.entries(value)) {
       if (pattern === '*') {
-        fallback = decision;
+        fallback = d;
         continue;
       }
-      if (matchPattern(pattern, subject)) return decision;
+      if (matchPattern(pattern, subject)) {
+        decision = d;
+        matched = true;
+        break;
+      }
     }
-    return fallback;
+    if (!matched) decision = fallback;
   }
 
-  return 'ask';
+  // Piso de seguridad: un comando peligroso no se puede autoaprobar por policy.
+  if (name === 'bash') {
+    const guard = bashGuard(args?.command);
+    if (guard && RANK[guard] > RANK[decision]) decision = guard;
+  }
+  return decision;
 }

package/harness/packages/core/src/tools/registry.js

@@ -10,29 +10,35 @@ import { evaluatePermission } from './permissions.js';
  * @param {string[]} [opts.enabled] - tool names to expose (default: all)
  * @param {object} [opts.permissions] - policy per tool ('allow'|'ask'|'deny' or pattern map)
  * @param {(name:string, args:object)=>Promise<boolean>} [opts.onAsk] - interactive approval
+ * @param {(payload:{title:string, questions:object[]})=>Promise<{answers:object,cancelled?:boolean}>} [opts.onQuestion] - interactive form
  * @param {boolean} [opts.yes] - auto-approve 'ask' (non-interactive)
  * @param {AbortSignal} [opts.signal] - cancela las tools de larga duracion (bash, git)
  */
-export function createToolRegistry({ root, enabled, permissions = {}, onAsk, yes = false, signal } = {}) {
+export function createToolRegistry({ root, enabled, permissions = {}, onAsk, onQuestion, yes = false, signal } = {}) {
   const names = new Set(enabled?.length ? enabled : TOOL_NAMES);
   const definitions = TOOL_DEFINITIONS.filter((d) => names.has(d.function.name));
 
-  async function execute(name, args = {}) {
-    if (!names.has(name) || !(name in EXECUTORS)) {
-      return `Error: herramienta desconocida "${name}".`;
-    }
-
+  async function authorize(name, args = {}) {
     let decision = evaluatePermission(name, args, permissions);
     if (decision === 'ask') {
       if (onAsk) decision = (await onAsk(name, args)) ? 'allow' : 'deny';
       else decision = yes ? 'allow' : 'deny';
     }
+    return decision;
+  }
+
+  async function execute(name, args = {}) {
+    if (!names.has(name) || !(name in EXECUTORS)) {
+      return `Error: herramienta desconocida "${name}".`;
+    }
+
+    const decision = await authorize(name, args);
     if (decision === 'deny') {
       const detail = args?.command ?? args?.path ?? '';
       return `Permiso denegado para "${name}"${detail ? ` (${detail})` : ''}.`;
     }
 
-    return EXECUTORS[name](root, args, { signal });
+    return EXECUTORS[name](root, args, { signal, onQuestion });
   }
 
   return {
@@ -40,6 +46,7 @@ export function createToolRegistry({ root, enabled, permissions = {}, onAsk, yes
     definitions,
     names: [...names],
     handles: (name) => names.has(name) && name in EXECUTORS,
+    authorize,
     execute,
   };
 }

package/harness/packages/core/src/tools/schema.js

@@ -197,6 +197,92 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'ask_user',
+      description:
+        'Ask the user with an interactive form when you need input before continuing (choices, confirmations, short texts). Use this instead of listing numbered questions in the text: the console renders the fields and the user answers them in one go. Each question has id, label and type (text|textarea|select|confirm); for select pass options. For a single choice, prefer type "select" (or "confirm" for yes/no).',
+      parameters: {
+        type: 'object',
+        properties: {
+          title: { type: 'string', description: 'Short form heading (optional)' },
+          questions: {
+            type: 'array',
+            description: 'Questions to show the user',
+            items: {
+              type: 'object',
+              properties: {
+                id: { type: 'string', description: 'Short id (slug) for the answer' },
+                label: { type: 'string', description: 'Question text' },
+                type: {
+                  type: 'string',
+                  enum: ['text', 'textarea', 'select', 'confirm'],
+                  description: 'Field type (default text)',
+                },
+                options: { type: 'array', items: { type: 'string' }, description: 'Options for type=select' },
+                placeholder: { type: 'string', description: 'Placeholder for text inputs' },
+                required: { type: 'boolean', description: 'Whether an answer is required' },
+              },
+              required: ['id', 'label'],
+            },
+          },
+        },
+        required: ['questions'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'offer_choices',
+      description:
+        'Offer the user 2-6 options as tappable buttons when you need them to pick a direction (instead of writing "opción A/B/C" in the text). Tapping one sends it as the user message. Use it for quick forks; for free-form input use ask_user.',
+      parameters: {
+        type: 'object',
+        properties: {
+          question: { type: 'string', description: 'Short prompt above the buttons' },
+          options: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Option labels (2-6)',
+          },
+        },
+        required: ['question', 'options'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'show_plan',
+      description:
+        'Show the user your plan or task list as an interactive checklist, so they can follow the steps and what is left. Re-emit it as you progress to update the status of each step. Read-only: it only displays, it does not track state by itself.',
+      parameters: {
+        type: 'object',
+        properties: {
+          title: { type: 'string', description: 'Short heading (optional)' },
+          steps: {
+            type: 'array',
+            description: 'Ordered steps',
+            items: {
+              type: 'object',
+              properties: {
+                text: { type: 'string', description: 'What the step is' },
+                status: {
+                  type: 'string',
+                  enum: ['pending', 'active', 'done'],
+                  description: 'Step status (default pending)',
+                },
+              },
+              required: ['text'],
+            },
+          },
+        },
+        required: ['steps'],
+      },
+    },
+  },
   {
     type: 'function',
     function: {

package/harness/packages/core/src/tts/edge.js

@@ -30,7 +30,11 @@ export const MAX_TEXTO = 2000;
 /** Voz por defecto del harness. */
 export const VOZ_POR_DEFECTO = 'es-AR-ElenaNeural';
 
-const URL_BASE = 'wss://speech.platform.bing.com/consumer/speech/synthesize/readaloud/edge/v1';
+// Desde octubre de 2026 el host viejo (`speech.platform.bing.com`) responde 403
+// a la sintesis. Edge 155 sintetiza por `api.msedgeservices.com`, que acepta el
+// mismo token legacy pero como `Ocp-Apim-Subscription-Key`. La lista de voces
+// sigue sirviendose desde el host viejo.
+const URL_SINTESIS = 'wss://api.msedgeservices.com/tts/cognitiveservices/websocket/v1';
 const URL_VOCES = `https://speech.platform.bing.com/consumer/speech/synthesize/readaloud/voices/list?trustedclienttoken=${TRUSTED_CLIENT_TOKEN}`;
 const ORIGEN_EDGE = 'chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold';
 const SEGUNDOS_EPOCA_WINDOWS = 11644473600;
@@ -80,12 +84,27 @@ export function generarSsml({ voz, lang, rate, pitch, volume, texto }) {
 
 function urlSintesis() {
   const parametros = new URLSearchParams({
-    TrustedClientToken: TRUSTED_CLIENT_TOKEN,
+    'Ocp-Apim-Subscription-Key': TRUSTED_CLIENT_TOKEN,
     'Sec-MS-GEC': generarSecMsGec(),
     'Sec-MS-GEC-Version': `1-${EDGE_VERSION}`,
     ConnectionId: randomBytes(16).toString('hex'),
   });
-  return `${URL_BASE}?${parametros.toString()}`;
+  return `${URL_SINTESIS}?${parametros.toString()}`;
+}
+
+/**
+ * Marca de tiempo con el formato que espera el servicio (UTC, en ingles).
+ * No se usa `toUTCString` porque el servicio pide este formato exacto.
+ */
+function marcaDeTiempo(ahora = new Date()) {
+  const dias = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+  const meses = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+  const dos = (n) => String(n).padStart(2, '0');
+  return (
+    `${dias[ahora.getUTCDay()]} ${meses[ahora.getUTCMonth()]} ${dos(ahora.getUTCDate())} ` +
+    `${ahora.getUTCFullYear()} ${dos(ahora.getUTCHours())}:${dos(ahora.getUTCMinutes())}:${dos(ahora.getUTCSeconds())} ` +
+    'GMT+0000 (Coordinated Universal Time)'
+  );
 }
 
 /**
@@ -162,20 +181,22 @@ export function sintetizar(texto, opciones = {}) {
 
     ws.addEventListener('open', () => {
       ws.send(
-        'Content-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n' +
+        `X-Timestamp:${marcaDeTiempo()}\r\nContent-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n` +
           JSON.stringify({
             context: {
               synthesis: {
                 audio: {
-                  metadataoptions: { sentenceBoundaryEnabled: false, wordBoundaryEnabled: false },
+                  metadataoptions: { sentenceBoundaryEnabled: 'false', wordBoundaryEnabled: 'false' },
                   outputFormat,
                 },
               },
             },
-          })
+          }) +
+          '\r\n'
       );
       ws.send(
-        `X-RequestId:${randomBytes(16).toString('hex')}\r\nContent-Type:application/ssml+xml\r\nPath:ssml\r\n\r\n` +
+        `X-RequestId:${randomBytes(16).toString('hex')}\r\nContent-Type:application/ssml+xml\r\n` +
+          `X-Timestamp:${marcaDeTiempo()}Z\r\nPath:ssml\r\n\r\n` +
           generarSsml({ voz, rate, pitch, volume, texto: contenido })
       );
     });

package/harness/packages/core/src/tunnel.js

@@ -184,8 +184,8 @@ export function parseTailscaleStatus(json) {
   return { dnsName, ipv4, connected: Boolean(dnsName) };
 }
 
-export async function startTailscaleServe(port, opts = {}) {
-  const log = opts.log ?? (() => {});
+/** DNSName del nodo si Tailscale esta instalado y conectado. */
+async function tailscaleDnsName() {
   let status;
   try {
     status = await runTailscale(['status', '--json']);
@@ -201,6 +201,18 @@ export async function startTailscaleServe(port, opts = {}) {
   if (!parsed.connected) {
     throw new Error('Tailscale no esta conectado. Inicia sesion con `tailscale up`.');
   }
+  return parsed.dnsName;
+}
+
+/** URL del handler HTTPS de `tailscale serve` (sin `:443`). */
+export function tailscalePreviewUrl(dnsName, httpsPort = 8443) {
+  const port = Number(httpsPort) || 8443;
+  return `https://${dnsName}${port === 443 ? '' : `:${port}`}`;
+}
+
+export async function startTailscaleServe(port, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const dnsName = await tailscaleDnsName();
   const backend = `http://127.0.0.1:${port}`;
   try {
     await runTailscale(['serve', '--bg', backend], { timeoutMs: 30000 });
@@ -211,7 +223,7 @@ export async function startTailscaleServe(port, opts = {}) {
       throw new Error(`no pude publicar con \`tailscale serve\`: ${first.message}`);
     }
   }
-  const url = `https://${parsed.dnsName}`;
+  const url = `https://${dnsName}`;
   log(`tailscale: ${url} -> ${backend}`);
   return {
     url,
@@ -223,6 +235,34 @@ export async function startTailscaleServe(port, opts = {}) {
   };
 }
 
+/**
+ * Publica un puerto de dev en el tailnet para el panel de vista previa, en un
+ * puerto HTTPS propio (default 8443) para NO pisar el `serve` de la consola en
+ * 443. El `stop` es puntual (`--https=<p> off`): un `serve reset` borraria
+ * tambien el bridge de la consola.
+ */
+export async function startTailscalePreview(port, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const httpsPort = Number(opts.httpsPort) || 8443;
+  const dnsName = await tailscaleDnsName();
+  const backend = `http://127.0.0.1:${port}`;
+  try {
+    await runTailscale(['serve', '--bg', `--https=${httpsPort}`, backend], { timeoutMs: 30000 });
+  } catch (error) {
+    throw new Error(`no pude publicar la vista previa con \`tailscale serve\`: ${error.message}`);
+  }
+  const url = tailscalePreviewUrl(dnsName, httpsPort);
+  log(`tailscale (preview): ${url} -> ${backend}`);
+  return {
+    url,
+    provider: 'tailscale',
+    port,
+    pid: 0,
+    child: null,
+    stop: () => runTailscale(['serve', `--https=${httpsPort}`, 'off']).catch(() => {}),
+  };
+}
+
 /** Estado de Tailscale (lanza si no esta instalado o no responde). */
 export async function probeTailscale() {
   const { stdout } = await runTailscale(['status', '--json']);
@@ -234,11 +274,17 @@ export function resetTailscaleServe() {
   return runTailscale(['serve', 'reset'], { timeoutMs: 30000 });
 }
 
-/** Devuelve { url, provider, pid, stop }. provider 'none' no abre nada. */
+/**
+ * Devuelve { url, provider, pid, stop }. provider 'none' no abre nada.
+ * `opts.preview` usa el `serve` de un puerto HTTPS propio (8443) para no pisar el
+ * bridge de la consola en 443.
+ */
 export async function startTunnel(port, provider = 'tunnelmole', opts = {}) {
   const p = String(provider || 'tunnelmole').toLowerCase();
   if (p === 'none' || p === 'off' || p === '') return { url: '', provider: 'none', pid: 0, stop: () => {} };
-  if (p === 'tailscale' || p === 'ts') return startTailscaleServe(port, opts);
+  if (p === 'tailscale' || p === 'ts') {
+    return opts.preview ? startTailscalePreview(port, opts) : startTailscaleServe(port, opts);
+  }
   if (p === 'tunnelmole' || p === 'tmole') return startTunnelmole(port, opts);
   throw new Error(`proveedor de tunel no soportado: ${provider}`);
 }

package/harness/packages/core/test/compact.test.js

@@ -8,7 +8,9 @@ test('liveHistory saca al asesor y recorta hasta el cursor', () => {
     { id: 'b', role: 'assistant', name: 'advisor', content: 'charla' },
     { id: 'c', role: 'assistant', content: '2' },
     { id: 'd', role: 'user', content: '3' },
+    { id: 'e', role: 'assistant', name: 'advisor', mode: 'summary', content: 'resumen de lo hecho' },
   ];
+  // El consejo y el resumen del asesor nunca entran al contexto del modelo.
   assert.deepEqual(liveHistory(history).map((m) => m.id), ['a', 'c', 'd']);
   assert.deepEqual(liveHistory(history, 'a').map((m) => m.id), ['c', 'd']);
   // Cursor inexistente: no perdemos contexto, devolvemos todo (sin asesor).

package/harness/packages/core/test/labels.test.js

@@ -14,6 +14,7 @@ test('summarizeToolCall describe acciones y comandos', () => {
   assert.equal(summarizeToolCall('bash', { command: 'npm test\n--watch' }), 'npm test --watch');
   assert.equal(summarizeToolCall('write', { path: 'a/b.txt' }), 'a/b.txt');
   assert.equal(summarizeToolCall('git_commit', { message: 'feat: algo' }), 'feat: algo');
+  assert.equal(summarizeToolCall('mcp_call', { tool: 'mcp__postgres__query' }), 'mcp__postgres__query');
 });
 
 test('summarizeToolCall tolera args invalidos y recorta', () => {

package/harness/packages/core/test/mcp-registry.test.js

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { registryServerToConfig, normalizeMcpConfig } from '../src/mcp/registry.js';
+import { registryServerToConfig, registryServerToCandidate, normalizeMcpConfig } from '../src/mcp/registry.js';
+import { MCP_CATALOG, mcpCatalogEntry } from '../src/mcp/catalog.js';
 
 test('registryServerToConfig maps a remote server to http', () => {
   const cfg = registryServerToConfig({
@@ -32,6 +33,41 @@ test('registryServerToConfig maps an npm package to stdio and lists required env
   assert.equal(cfg.command, 'npx');
   assert.deepEqual(cfg.args, ['-y', 'remote-filesystem-mcp-server@0.1.2']);
   assert.deepEqual(cfg.requiredEnv, ['GCS_BUCKET']);
+  assert.equal(cfg.env.GCS_BUCKET, 'env:GCS_BUCKET');
+});
+
+test('registryServerToCandidate arma una vista liviana sin instalar', () => {
+  const candidate = registryServerToCandidate({
+    name: 'com.pulsemcp/remote-filesystem',
+    title: 'Remote Filesystem',
+    description: 'Archivos remotos',
+    packages: [
+      {
+        registryType: 'npm',
+        identifier: 'remote-filesystem-mcp-server',
+        version: '0.1.2',
+        runtimeHint: 'npx',
+        runtimeArguments: [{ value: '-y', type: 'positional' }],
+        environmentVariables: [{ name: 'GCS_BUCKET', isRequired: true }],
+      },
+    ],
+  });
+  assert.equal(candidate.id, 'remote-filesystem');
+  assert.equal(candidate.name, 'Remote Filesystem');
+  assert.equal(candidate.registry, 'com.pulsemcp/remote-filesystem');
+  assert.equal(candidate.transport, 'stdio');
+  assert.deepEqual(candidate.requiredEnv, ['GCS_BUCKET']);
+  assert.deepEqual(candidate.args, ['-y', 'remote-filesystem-mcp-server@0.1.2']);
+});
+
+test('el catálogo de MCP trae entradas deshabilitadas y copias', () => {
+  assert.ok(MCP_CATALOG.length > 0);
+  assert.ok(MCP_CATALOG.every((entry) => entry.enabled === false));
+  const entry = mcpCatalogEntry('playwright');
+  assert.equal(entry.command, 'npx');
+  entry.args.push('mutado');
+  assert.ok(!MCP_CATALOG.find((e) => e.id === 'playwright').args.includes('mutado'));
+  assert.equal(mcpCatalogEntry('nope'), null);
 });
 
 test('normalizeMcpConfig handles mcpServers snippets and plain configs', () => {

package/harness/packages/core/test/mcp-routing.test.js

@@ -0,0 +1,115 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  createTools,
+  useLazyMcp,
+  buildMcpIndex,
+  planMcpTools,
+  mcpRouterDefinition,
+  MCP_ROUTER_NAME,
+  MCP_AUTO_THRESHOLD,
+} from '../src/index.js';
+
+function fakeMcp(names) {
+  const definitions = names.map((name) => ({
+    type: 'function',
+    function: { name, description: `hace ${name}`, parameters: { type: 'object', properties: {} } },
+  }));
+  const tools = names.map((name) => ({ name, server: 'srv', serverName: 'Servidor', description: `hace ${name}` }));
+  const handlers = new Map(names.map((name) => [name, async (args) => `ok:${name}:${JSON.stringify(args)}`]));
+  return {
+    definitions,
+    tools,
+    handles: (name) => handlers.has(name),
+    call: (name, args) => handlers.get(name)(args),
+  };
+}
+
+test('useLazyMcp decide por modo y umbral', () => {
+  assert.equal(useLazyMcp('eager', 100), false);
+  assert.equal(useLazyMcp('lazy', 1), true);
+  assert.equal(useLazyMcp('lazy', 0), false);
+  assert.equal(useLazyMcp('auto', MCP_AUTO_THRESHOLD), false);
+  assert.equal(useLazyMcp('auto', MCP_AUTO_THRESHOLD + 1), true);
+});
+
+test('buildMcpIndex agrupa por servidor y recorta la descripcion', () => {
+  const index = buildMcpIndex([
+    { name: 'mcp__a__x', server: 'a', serverName: 'Alpha', description: 'x'.repeat(400) },
+    { name: 'mcp__a__y', server: 'a', serverName: 'Alpha', description: 'corta' },
+    { name: 'mcp__b__z', server: 'b', serverName: 'Beta', description: '' },
+  ]);
+  assert.match(index, /## Alpha/);
+  assert.match(index, /## Beta/);
+  assert.match(index, /- mcp__a__x — x+…/);
+  assert.match(index, /- mcp__b__z$/m);
+  assert.equal(buildMcpIndex([]), '');
+});
+
+test('planMcpTools: eager y auto chico conservan todos los esquemas', () => {
+  const mcp = fakeMcp(['mcp__srv__a', 'mcp__srv__b']);
+  const eager = planMcpTools(mcp, { mode: 'eager' });
+  assert.equal(eager.routed, false);
+  assert.equal(eager.definitions.length, 2);
+  assert.equal(planMcpTools(mcp, { mode: 'auto' }).routed, false);
+  assert.deepEqual(planMcpTools(null, { mode: 'lazy' }), { definitions: [], routed: false });
+});
+
+test('planMcpTools: lazy expone las fijadas + el router', () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+  const plan = planMcpTools(mcp, { mode: 'lazy', pinned: ['mcp__srv__t3', 'srv'] });
+  assert.equal(plan.routed, true);
+  const exposed = plan.definitions.map((d) => d.function.name);
+  // 'srv' fija todas las del servidor
+  assert.equal(exposed.filter((n) => n !== MCP_ROUTER_NAME).length, 20);
+  assert.ok(exposed.includes(MCP_ROUTER_NAME));
+
+  const one = planMcpTools(mcp, { mode: 'auto', pinned: ['mcp__srv__t5'], threshold: 10 });
+  assert.equal(one.routed, true);
+  assert.deepEqual(one.definitions.map((d) => d.function.name).sort(), ['mcp__srv__t5', MCP_ROUTER_NAME].sort());
+});
+
+test('createTools enruta mcp_call solo cuando esta diferido', async () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+  const lazy = createTools({ root: '/tmp', mcp, mcpMode: 'lazy', yes: true });
+  assert.ok(lazy.definitions.some((d) => d.function.name === MCP_ROUTER_NAME));
+  assert.equal(await lazy.execute(MCP_ROUTER_NAME, { tool: 'mcp__srv__t7', args: { q: 1 } }), 'ok:mcp__srv__t7:{"q":1}');
+  assert.match(await lazy.execute(MCP_ROUTER_NAME, { tool: 'nope' }), /desconocida/);
+
+  const eager = createTools({ root: '/tmp', mcp, mcpMode: 'eager', yes: true });
+  assert.ok(!eager.definitions.some((d) => d.function.name === MCP_ROUTER_NAME));
+  assert.equal(await eager.execute('mcp__srv__t7', { q: 1 }), 'ok:mcp__srv__t7:{"q":1}');
+});
+
+test('las tools MCP pasan por permisos (default ask)', async () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+
+  // Sin onAsk y sin yes: denegado (como cualquier 'ask' en headless).
+  const denied = createTools({ root: '/tmp', mcp, mcpMode: 'eager' });
+  assert.match(await denied.execute('mcp__srv__t7', { q: 1 }), /denegado/);
+
+  // allow explicito por tool.
+  const allowed = createTools({ root: '/tmp', mcp, mcpMode: 'eager', permissions: { mcp__srv__t7: 'allow' } });
+  assert.equal(await allowed.execute('mcp__srv__t7', { q: 1 }), 'ok:mcp__srv__t7:{"q":1}');
+
+  // El router consulta con el nombre real de la tool.
+  const asked = [];
+  const routed = createTools({
+    root: '/tmp',
+    mcp,
+    mcpMode: 'lazy',
+    onAsk: async (name, args) => {
+      asked.push([name, args]);
+      return true;
+    },
+  });
+  assert.equal(await routed.execute(MCP_ROUTER_NAME, { tool: 'mcp__srv__t2', args: { x: 1 } }), 'ok:mcp__srv__t2:{"x":1}');
+  assert.deepEqual(asked, [['mcp__srv__t2', { x: 1 }]]);
+});
+
+test('mcpRouterDefinition usa el nombre reservado', () => {
+  assert.equal(mcpRouterDefinition().function.name, MCP_ROUTER_NAME);
+});

package/harness/packages/core/test/procs.test.js

@@ -5,8 +5,8 @@ import net from 'node:net';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { detectProcs, packageManager, DEFAULT_PROCESS_ALLOW } from '../src/procs/detect.js';
-import { killPort } from '../src/procs/kill.js';
+import { detectProcs, loadProjectProcs, packageManager, DEFAULT_PROCESS_ALLOW, PROCS_FILE } from '../src/procs/detect.js';
+import { killPort, portInfo } from '../src/procs/kill.js';
 
 async function waitForPort(port, attempts = 50) {
   for (let i = 0; i < attempts; i++) {
@@ -99,3 +99,71 @@ test('detectProcs does not add the static chip when there is a dev script', asyn
   await writeFile(path.join(dir, 'package.json'), JSON.stringify({ scripts: { dev: 'vite' } }));
   assert.ok(!detectProcs(dir).some((c) => c.args.some((a) => String(a).endsWith('static-server.mjs'))));
 });
+
+test('loadProjectProcs reads .tamnora/procs.json and confines dir to the root', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'tamnora-proc-'));
+  await mkdir(path.join(dir, '.tamnora'), { recursive: true });
+  await mkdir(path.join(dir, 'backend'));
+  await writeFile(
+    path.join(dir, PROCS_FILE),
+    JSON.stringify({
+      processes: [
+        { label: 'backend', dir: 'backend', command: 'node', args: ['index.js'], port: 3000 },
+        { label: 'afuera', dir: '..', command: 'node', args: ['evil.js'] },
+        { label: 'sin dir', command: 'npm', args: ['run', 'dev'] },
+      ],
+    })
+  );
+
+  const chips = loadProjectProcs(dir);
+  assert.equal(chips.length, 2, 'descarta el dir que se escapa');
+  assert.equal(chips[0].cwd, path.join(dir, 'backend'));
+  assert.equal(chips[0].port, 3000);
+  assert.equal(chips[0].source, 'project');
+  assert.equal(chips[1].cwd, dir);
+  assert.ok(chips.every((c) => c.source === 'project'));
+});
+
+test('detectProcs puts project chips first and dedupes against auto-detection', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'tamnora-proc-'));
+  await mkdir(path.join(dir, '.tamnora'), { recursive: true });
+  await writeFile(path.join(dir, 'package.json'), JSON.stringify({ scripts: { dev: 'vite' } }));
+  await writeFile(
+    path.join(dir, PROCS_FILE),
+    JSON.stringify({
+      processes: [
+        { label: 'backend', command: 'node', args: ['server.js'], port: 3000 },
+        { label: 'dev repetido', command: 'npm', args: ['run', 'dev'] },
+      ],
+    })
+  );
+
+  const chips = detectProcs(dir);
+  assert.equal(chips[0].source, 'project');
+  assert.equal(chips[0].command, 'node');
+  const devChips = chips.filter((c) => c.command === 'npm' && c.args.join(' ') === 'run dev');
+  assert.equal(devChips.length, 1, 'el chip manual gana al autodetectado');
+});
+
+test('portInfo reports whether a port is listening', async (t) => {
+  const free = await portInfo(47599);
+  assert.equal(free.listening, false);
+  assert.deepEqual(free.pids, []);
+  await assert.rejects(() => portInfo(0), /Puerto inválido/);
+
+  const port = 48000 + Math.floor(Math.random() * 1000);
+  const script = `const http=require('node:http');http.createServer((q,r)=>r.end('ok')).listen(${port},'127.0.0.1');setInterval(()=>{},1000);`;
+  const child = spawn(process.execPath, ['-e', script], { stdio: 'ignore', windowsHide: true });
+  t.after(() => {
+    try {
+      child.kill('SIGKILL');
+    } catch {
+      // already gone
+    }
+  });
+  await waitForPort(port);
+  const info = await portInfo(port);
+  assert.equal(info.port, port);
+  assert.equal(info.listening, true);
+  assert.ok(info.pids.length >= 1);
+});