@danieltmn/tamnora 0.17.0 → 0.18.0

package/harness/packages/core/src/tts/edge.js

@@ -30,7 +30,11 @@ export const MAX_TEXTO = 2000;
 /** Voz por defecto del harness. */
 export const VOZ_POR_DEFECTO = 'es-AR-ElenaNeural';
 
-const URL_BASE = 'wss://speech.platform.bing.com/consumer/speech/synthesize/readaloud/edge/v1';
+// Desde octubre de 2026 el host viejo (`speech.platform.bing.com`) responde 403
+// a la sintesis. Edge 155 sintetiza por `api.msedgeservices.com`, que acepta el
+// mismo token legacy pero como `Ocp-Apim-Subscription-Key`. La lista de voces
+// sigue sirviendose desde el host viejo.
+const URL_SINTESIS = 'wss://api.msedgeservices.com/tts/cognitiveservices/websocket/v1';
 const URL_VOCES = `https://speech.platform.bing.com/consumer/speech/synthesize/readaloud/voices/list?trustedclienttoken=${TRUSTED_CLIENT_TOKEN}`;
 const ORIGEN_EDGE = 'chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold';
 const SEGUNDOS_EPOCA_WINDOWS = 11644473600;
@@ -80,12 +84,27 @@ export function generarSsml({ voz, lang, rate, pitch, volume, texto }) {
 
 function urlSintesis() {
   const parametros = new URLSearchParams({
-    TrustedClientToken: TRUSTED_CLIENT_TOKEN,
+    'Ocp-Apim-Subscription-Key': TRUSTED_CLIENT_TOKEN,
     'Sec-MS-GEC': generarSecMsGec(),
     'Sec-MS-GEC-Version': `1-${EDGE_VERSION}`,
     ConnectionId: randomBytes(16).toString('hex'),
   });
-  return `${URL_BASE}?${parametros.toString()}`;
+  return `${URL_SINTESIS}?${parametros.toString()}`;
+}
+
+/**
+ * Marca de tiempo con el formato que espera el servicio (UTC, en ingles).
+ * No se usa `toUTCString` porque el servicio pide este formato exacto.
+ */
+function marcaDeTiempo(ahora = new Date()) {
+  const dias = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+  const meses = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+  const dos = (n) => String(n).padStart(2, '0');
+  return (
+    `${dias[ahora.getUTCDay()]} ${meses[ahora.getUTCMonth()]} ${dos(ahora.getUTCDate())} ` +
+    `${ahora.getUTCFullYear()} ${dos(ahora.getUTCHours())}:${dos(ahora.getUTCMinutes())}:${dos(ahora.getUTCSeconds())} ` +
+    'GMT+0000 (Coordinated Universal Time)'
+  );
 }
 
 /**
@@ -162,20 +181,22 @@ export function sintetizar(texto, opciones = {}) {
 
     ws.addEventListener('open', () => {
       ws.send(
-        'Content-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n' +
+        `X-Timestamp:${marcaDeTiempo()}\r\nContent-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n` +
           JSON.stringify({
             context: {
               synthesis: {
                 audio: {
-                  metadataoptions: { sentenceBoundaryEnabled: false, wordBoundaryEnabled: false },
+                  metadataoptions: { sentenceBoundaryEnabled: 'false', wordBoundaryEnabled: 'false' },
                   outputFormat,
                 },
               },
             },
-          })
+          }) +
+          '\r\n'
       );
       ws.send(
-        `X-RequestId:${randomBytes(16).toString('hex')}\r\nContent-Type:application/ssml+xml\r\nPath:ssml\r\n\r\n` +
+        `X-RequestId:${randomBytes(16).toString('hex')}\r\nContent-Type:application/ssml+xml\r\n` +
+          `X-Timestamp:${marcaDeTiempo()}Z\r\nPath:ssml\r\n\r\n` +
           generarSsml({ voz, rate, pitch, volume, texto: contenido })
       );
     });

package/harness/packages/core/src/tunnel.js

@@ -184,8 +184,8 @@ export function parseTailscaleStatus(json) {
   return { dnsName, ipv4, connected: Boolean(dnsName) };
 }
 
-export async function startTailscaleServe(port, opts = {}) {
-  const log = opts.log ?? (() => {});
+/** DNSName del nodo si Tailscale esta instalado y conectado. */
+async function tailscaleDnsName() {
   let status;
   try {
     status = await runTailscale(['status', '--json']);
@@ -201,6 +201,18 @@ export async function startTailscaleServe(port, opts = {}) {
   if (!parsed.connected) {
     throw new Error('Tailscale no esta conectado. Inicia sesion con `tailscale up`.');
   }
+  return parsed.dnsName;
+}
+
+/** URL del handler HTTPS de `tailscale serve` (sin `:443`). */
+export function tailscalePreviewUrl(dnsName, httpsPort = 8443) {
+  const port = Number(httpsPort) || 8443;
+  return `https://${dnsName}${port === 443 ? '' : `:${port}`}`;
+}
+
+export async function startTailscaleServe(port, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const dnsName = await tailscaleDnsName();
   const backend = `http://127.0.0.1:${port}`;
   try {
     await runTailscale(['serve', '--bg', backend], { timeoutMs: 30000 });
@@ -211,7 +223,7 @@ export async function startTailscaleServe(port, opts = {}) {
       throw new Error(`no pude publicar con \`tailscale serve\`: ${first.message}`);
     }
   }
-  const url = `https://${parsed.dnsName}`;
+  const url = `https://${dnsName}`;
   log(`tailscale: ${url} -> ${backend}`);
   return {
     url,
@@ -223,6 +235,34 @@ export async function startTailscaleServe(port, opts = {}) {
   };
 }
 
+/**
+ * Publica un puerto de dev en el tailnet para el panel de vista previa, en un
+ * puerto HTTPS propio (default 8443) para NO pisar el `serve` de la consola en
+ * 443. El `stop` es puntual (`--https=<p> off`): un `serve reset` borraria
+ * tambien el bridge de la consola.
+ */
+export async function startTailscalePreview(port, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const httpsPort = Number(opts.httpsPort) || 8443;
+  const dnsName = await tailscaleDnsName();
+  const backend = `http://127.0.0.1:${port}`;
+  try {
+    await runTailscale(['serve', '--bg', `--https=${httpsPort}`, backend], { timeoutMs: 30000 });
+  } catch (error) {
+    throw new Error(`no pude publicar la vista previa con \`tailscale serve\`: ${error.message}`);
+  }
+  const url = tailscalePreviewUrl(dnsName, httpsPort);
+  log(`tailscale (preview): ${url} -> ${backend}`);
+  return {
+    url,
+    provider: 'tailscale',
+    port,
+    pid: 0,
+    child: null,
+    stop: () => runTailscale(['serve', `--https=${httpsPort}`, 'off']).catch(() => {}),
+  };
+}
+
 /** Estado de Tailscale (lanza si no esta instalado o no responde). */
 export async function probeTailscale() {
   const { stdout } = await runTailscale(['status', '--json']);
@@ -234,11 +274,17 @@ export function resetTailscaleServe() {
   return runTailscale(['serve', 'reset'], { timeoutMs: 30000 });
 }
 
-/** Devuelve { url, provider, pid, stop }. provider 'none' no abre nada. */
+/**
+ * Devuelve { url, provider, pid, stop }. provider 'none' no abre nada.
+ * `opts.preview` usa el `serve` de un puerto HTTPS propio (8443) para no pisar el
+ * bridge de la consola en 443.
+ */
 export async function startTunnel(port, provider = 'tunnelmole', opts = {}) {
   const p = String(provider || 'tunnelmole').toLowerCase();
   if (p === 'none' || p === 'off' || p === '') return { url: '', provider: 'none', pid: 0, stop: () => {} };
-  if (p === 'tailscale' || p === 'ts') return startTailscaleServe(port, opts);
+  if (p === 'tailscale' || p === 'ts') {
+    return opts.preview ? startTailscalePreview(port, opts) : startTailscaleServe(port, opts);
+  }
   if (p === 'tunnelmole' || p === 'tmole') return startTunnelmole(port, opts);
   throw new Error(`proveedor de tunel no soportado: ${provider}`);
 }

package/harness/packages/core/test/compact.test.js

@@ -8,7 +8,9 @@ test('liveHistory saca al asesor y recorta hasta el cursor', () => {
     { id: 'b', role: 'assistant', name: 'advisor', content: 'charla' },
     { id: 'c', role: 'assistant', content: '2' },
     { id: 'd', role: 'user', content: '3' },
+    { id: 'e', role: 'assistant', name: 'advisor', mode: 'summary', content: 'resumen de lo hecho' },
   ];
+  // El consejo y el resumen del asesor nunca entran al contexto del modelo.
   assert.deepEqual(liveHistory(history).map((m) => m.id), ['a', 'c', 'd']);
   assert.deepEqual(liveHistory(history, 'a').map((m) => m.id), ['c', 'd']);
   // Cursor inexistente: no perdemos contexto, devolvemos todo (sin asesor).

package/harness/packages/core/test/labels.test.js

@@ -14,6 +14,7 @@ test('summarizeToolCall describe acciones y comandos', () => {
   assert.equal(summarizeToolCall('bash', { command: 'npm test\n--watch' }), 'npm test --watch');
   assert.equal(summarizeToolCall('write', { path: 'a/b.txt' }), 'a/b.txt');
   assert.equal(summarizeToolCall('git_commit', { message: 'feat: algo' }), 'feat: algo');
+  assert.equal(summarizeToolCall('mcp_call', { tool: 'mcp__postgres__query' }), 'mcp__postgres__query');
 });
 
 test('summarizeToolCall tolera args invalidos y recorta', () => {

package/harness/packages/core/test/mcp-registry.test.js

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { registryServerToConfig, normalizeMcpConfig } from '../src/mcp/registry.js';
+import { registryServerToConfig, registryServerToCandidate, normalizeMcpConfig } from '../src/mcp/registry.js';
+import { MCP_CATALOG, mcpCatalogEntry } from '../src/mcp/catalog.js';
 
 test('registryServerToConfig maps a remote server to http', () => {
   const cfg = registryServerToConfig({
@@ -32,6 +33,41 @@ test('registryServerToConfig maps an npm package to stdio and lists required env
   assert.equal(cfg.command, 'npx');
   assert.deepEqual(cfg.args, ['-y', 'remote-filesystem-mcp-server@0.1.2']);
   assert.deepEqual(cfg.requiredEnv, ['GCS_BUCKET']);
+  assert.equal(cfg.env.GCS_BUCKET, 'env:GCS_BUCKET');
+});
+
+test('registryServerToCandidate arma una vista liviana sin instalar', () => {
+  const candidate = registryServerToCandidate({
+    name: 'com.pulsemcp/remote-filesystem',
+    title: 'Remote Filesystem',
+    description: 'Archivos remotos',
+    packages: [
+      {
+        registryType: 'npm',
+        identifier: 'remote-filesystem-mcp-server',
+        version: '0.1.2',
+        runtimeHint: 'npx',
+        runtimeArguments: [{ value: '-y', type: 'positional' }],
+        environmentVariables: [{ name: 'GCS_BUCKET', isRequired: true }],
+      },
+    ],
+  });
+  assert.equal(candidate.id, 'remote-filesystem');
+  assert.equal(candidate.name, 'Remote Filesystem');
+  assert.equal(candidate.registry, 'com.pulsemcp/remote-filesystem');
+  assert.equal(candidate.transport, 'stdio');
+  assert.deepEqual(candidate.requiredEnv, ['GCS_BUCKET']);
+  assert.deepEqual(candidate.args, ['-y', 'remote-filesystem-mcp-server@0.1.2']);
+});
+
+test('el catálogo de MCP trae entradas deshabilitadas y copias', () => {
+  assert.ok(MCP_CATALOG.length > 0);
+  assert.ok(MCP_CATALOG.every((entry) => entry.enabled === false));
+  const entry = mcpCatalogEntry('playwright');
+  assert.equal(entry.command, 'npx');
+  entry.args.push('mutado');
+  assert.ok(!MCP_CATALOG.find((e) => e.id === 'playwright').args.includes('mutado'));
+  assert.equal(mcpCatalogEntry('nope'), null);
 });
 
 test('normalizeMcpConfig handles mcpServers snippets and plain configs', () => {

package/harness/packages/core/test/mcp-routing.test.js

@@ -0,0 +1,115 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  createTools,
+  useLazyMcp,
+  buildMcpIndex,
+  planMcpTools,
+  mcpRouterDefinition,
+  MCP_ROUTER_NAME,
+  MCP_AUTO_THRESHOLD,
+} from '../src/index.js';
+
+function fakeMcp(names) {
+  const definitions = names.map((name) => ({
+    type: 'function',
+    function: { name, description: `hace ${name}`, parameters: { type: 'object', properties: {} } },
+  }));
+  const tools = names.map((name) => ({ name, server: 'srv', serverName: 'Servidor', description: `hace ${name}` }));
+  const handlers = new Map(names.map((name) => [name, async (args) => `ok:${name}:${JSON.stringify(args)}`]));
+  return {
+    definitions,
+    tools,
+    handles: (name) => handlers.has(name),
+    call: (name, args) => handlers.get(name)(args),
+  };
+}
+
+test('useLazyMcp decide por modo y umbral', () => {
+  assert.equal(useLazyMcp('eager', 100), false);
+  assert.equal(useLazyMcp('lazy', 1), true);
+  assert.equal(useLazyMcp('lazy', 0), false);
+  assert.equal(useLazyMcp('auto', MCP_AUTO_THRESHOLD), false);
+  assert.equal(useLazyMcp('auto', MCP_AUTO_THRESHOLD + 1), true);
+});
+
+test('buildMcpIndex agrupa por servidor y recorta la descripcion', () => {
+  const index = buildMcpIndex([
+    { name: 'mcp__a__x', server: 'a', serverName: 'Alpha', description: 'x'.repeat(400) },
+    { name: 'mcp__a__y', server: 'a', serverName: 'Alpha', description: 'corta' },
+    { name: 'mcp__b__z', server: 'b', serverName: 'Beta', description: '' },
+  ]);
+  assert.match(index, /## Alpha/);
+  assert.match(index, /## Beta/);
+  assert.match(index, /- mcp__a__x — x+…/);
+  assert.match(index, /- mcp__b__z$/m);
+  assert.equal(buildMcpIndex([]), '');
+});
+
+test('planMcpTools: eager y auto chico conservan todos los esquemas', () => {
+  const mcp = fakeMcp(['mcp__srv__a', 'mcp__srv__b']);
+  const eager = planMcpTools(mcp, { mode: 'eager' });
+  assert.equal(eager.routed, false);
+  assert.equal(eager.definitions.length, 2);
+  assert.equal(planMcpTools(mcp, { mode: 'auto' }).routed, false);
+  assert.deepEqual(planMcpTools(null, { mode: 'lazy' }), { definitions: [], routed: false });
+});
+
+test('planMcpTools: lazy expone las fijadas + el router', () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+  const plan = planMcpTools(mcp, { mode: 'lazy', pinned: ['mcp__srv__t3', 'srv'] });
+  assert.equal(plan.routed, true);
+  const exposed = plan.definitions.map((d) => d.function.name);
+  // 'srv' fija todas las del servidor
+  assert.equal(exposed.filter((n) => n !== MCP_ROUTER_NAME).length, 20);
+  assert.ok(exposed.includes(MCP_ROUTER_NAME));
+
+  const one = planMcpTools(mcp, { mode: 'auto', pinned: ['mcp__srv__t5'], threshold: 10 });
+  assert.equal(one.routed, true);
+  assert.deepEqual(one.definitions.map((d) => d.function.name).sort(), ['mcp__srv__t5', MCP_ROUTER_NAME].sort());
+});
+
+test('createTools enruta mcp_call solo cuando esta diferido', async () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+  const lazy = createTools({ root: '/tmp', mcp, mcpMode: 'lazy', yes: true });
+  assert.ok(lazy.definitions.some((d) => d.function.name === MCP_ROUTER_NAME));
+  assert.equal(await lazy.execute(MCP_ROUTER_NAME, { tool: 'mcp__srv__t7', args: { q: 1 } }), 'ok:mcp__srv__t7:{"q":1}');
+  assert.match(await lazy.execute(MCP_ROUTER_NAME, { tool: 'nope' }), /desconocida/);
+
+  const eager = createTools({ root: '/tmp', mcp, mcpMode: 'eager', yes: true });
+  assert.ok(!eager.definitions.some((d) => d.function.name === MCP_ROUTER_NAME));
+  assert.equal(await eager.execute('mcp__srv__t7', { q: 1 }), 'ok:mcp__srv__t7:{"q":1}');
+});
+
+test('las tools MCP pasan por permisos (default ask)', async () => {
+  const names = Array.from({ length: 20 }, (_, i) => `mcp__srv__t${i}`);
+  const mcp = fakeMcp(names);
+
+  // Sin onAsk y sin yes: denegado (como cualquier 'ask' en headless).
+  const denied = createTools({ root: '/tmp', mcp, mcpMode: 'eager' });
+  assert.match(await denied.execute('mcp__srv__t7', { q: 1 }), /denegado/);
+
+  // allow explicito por tool.
+  const allowed = createTools({ root: '/tmp', mcp, mcpMode: 'eager', permissions: { mcp__srv__t7: 'allow' } });
+  assert.equal(await allowed.execute('mcp__srv__t7', { q: 1 }), 'ok:mcp__srv__t7:{"q":1}');
+
+  // El router consulta con el nombre real de la tool.
+  const asked = [];
+  const routed = createTools({
+    root: '/tmp',
+    mcp,
+    mcpMode: 'lazy',
+    onAsk: async (name, args) => {
+      asked.push([name, args]);
+      return true;
+    },
+  });
+  assert.equal(await routed.execute(MCP_ROUTER_NAME, { tool: 'mcp__srv__t2', args: { x: 1 } }), 'ok:mcp__srv__t2:{"x":1}');
+  assert.deepEqual(asked, [['mcp__srv__t2', { x: 1 }]]);
+});
+
+test('mcpRouterDefinition usa el nombre reservado', () => {
+  assert.equal(mcpRouterDefinition().function.name, MCP_ROUTER_NAME);
+});

package/harness/packages/core/test/redact.test.js

@@ -3,10 +3,12 @@ import assert from 'node:assert/strict';
 import {
   REDACTED,
   isSecretName,
+  isSensitiveEnvName,
   maskEnv,
   maskSecret,
   redactDeep,
   redactSecrets,
+  scrubEnv,
   secretValues,
 } from '../src/redact.js';
 
@@ -43,3 +45,23 @@ test('maskSecret y maskEnv enmascaran sin exponer el valor', () => {
     MYSQL_PASSWORD: '••••cret',
   });
 });
+
+test('scrubEnv quita credenciales pero conserva vars legitimas', () => {
+  const env = {
+    PATH: '/usr/bin',
+    HOME: '/home/ana',
+    OPENROUTER_API_KEY: 'sk-xxx',
+    GITHUB_TOKEN: 'ghp_yyy',
+    MYSQL_PASSWORD: 'zzz',
+    SSH_AUTH_SOCK: '/tmp/agent.sock',
+  };
+  const clean = scrubEnv(env);
+  assert.equal(clean.PATH, '/usr/bin');
+  assert.equal(clean.HOME, '/home/ana');
+  assert.equal(clean.SSH_AUTH_SOCK, '/tmp/agent.sock');
+  assert.equal(clean.OPENROUTER_API_KEY, undefined);
+  assert.equal(clean.GITHUB_TOKEN, undefined);
+  assert.equal(clean.MYSQL_PASSWORD, undefined);
+  assert.equal(isSensitiveEnvName('SSH_AUTH_SOCK'), false);
+  assert.equal(isSensitiveEnvName('OPENAI_API_KEY'), true);
+});

package/harness/packages/core/test/skills.test.js

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { parseSkillMarkdown, loadSkills, mergeSkills, buildSkillsPrompt, buildSkillsIndex } from '../src/skills/index.js';
 import { parseSkillRef } from '../src/skills/remote.js';
+import { SKILLS_CATALOG, skillCatalogEntry } from '../src/skills/catalog.js';
 
 test('parseSkillMarkdown reads frontmatter and body', () => {
   const parsed = parseSkillMarkdown(
@@ -76,3 +77,13 @@ test('buildSkillsIndex lists id + when without the body (progressive disclosure)
   assert.match(text, /skill\(\{ name \}\)/);
   assert.doesNotMatch(text, /SECRETO_BODY/);
 });
+
+test('el catálogo de skills trae cuerpo con frontmatter parseable', () => {
+  assert.ok(SKILLS_CATALOG.length > 0);
+  for (const entry of SKILLS_CATALOG) {
+    assert.match(entry.id, /^[a-z0-9][a-z0-9_-]*$/);
+    assert.ok(entry.body.trim().length > 0);
+  }
+  assert.equal(skillCatalogEntry('code-review').id, 'code-review');
+  assert.equal(skillCatalogEntry('nope'), null);
+});

package/harness/packages/core/test/tools.test.js

@@ -4,9 +4,17 @@ import { mkdtemp, readFile, writeFile, mkdir } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { resolveInRoot, toRel } from '../src/tools/paths.js';
-import { evaluatePermission } from '../src/tools/permissions.js';
+import { evaluatePermission, bashGuard } from '../src/tools/permissions.js';
 import { createTools, createToolRegistry } from '../src/tools/index.js';
-import { fetchUrlTool, previewUrlTool, screenshotTool, consoleTool } from '../src/tools/executors.js';
+import {
+  fetchUrlTool,
+  previewUrlTool,
+  screenshotTool,
+  consoleTool,
+  askUserTool,
+  offerChoicesTool,
+  showPlanTool,
+} from '../src/tools/executors.js';
 
 async function makeWorkspace() {
   const root = await mkdtemp(path.join(tmpdir(), 'tamnora-ws-'));
@@ -36,6 +44,23 @@ test('evaluatePermission applies defaults and pattern maps', () => {
   );
 });
 
+test('bashGuard marca comandos peligrosos (piso de seguridad)', () => {
+  assert.equal(bashGuard('rm -rf /'), 'deny');
+  assert.equal(bashGuard('sudo rm -rf ~'), 'deny');
+  assert.equal(bashGuard('mkfs.ext4 /dev/sda1'), 'deny');
+  assert.equal(bashGuard('dd if=/dev/zero of=/dev/sda'), 'deny');
+  assert.equal(bashGuard('git push --force origin main'), 'ask');
+  assert.equal(bashGuard('git reset --hard HEAD~3'), 'ask');
+  assert.equal(bashGuard('rm -rf .'), 'ask');
+  assert.equal(bashGuard('rm -rf ./build'), null);
+  assert.equal(bashGuard('npm test'), null);
+
+  // El piso no se saltea con una policy permisiva.
+  assert.equal(evaluatePermission('bash', { command: 'rm -rf /' }, { bash: 'allow' }), 'deny');
+  assert.equal(evaluatePermission('bash', { command: 'git push -f' }, { bash: 'allow' }), 'ask');
+  assert.equal(evaluatePermission('bash', { command: 'rm -rf ./dist' }, { bash: 'allow' }), 'allow');
+});
+
 test('local tools read, write, list, glob, grep and edit', async () => {
   const root = await makeWorkspace();
   const reg = createToolRegistry({ root, permissions: { write: 'allow', edit: 'allow' } });
@@ -144,7 +169,10 @@ test('createTools combines local and MCP tool routing', async () => {
     handles: (n) => n === 'mcp__x__ping',
     call: async () => 'pong',
   };
-  const { definitions, execute } = createTools({ root, mcp });
+  const denied = createTools({ root, mcp });
+  assert.match(await denied.execute('mcp__x__ping', {}), /denegado/);
+
+  const { definitions, execute } = createTools({ root, mcp, permissions: { 'mcp__x__ping': 'allow' } });
   assert.ok(definitions.some((d) => d.function.name === 'mcp__x__ping'));
   assert.equal(await execute('mcp__x__ping', {}), 'pong');
   assert.match(await execute('nope', {}), /desconocida/);
@@ -158,6 +186,23 @@ test('bash runs inside the workspace root', async () => {
   assert.match(out, /\[exit 0\]/);
 });
 
+test('bash no hereda variables con pinta de secreto', async () => {
+  const root = await makeWorkspace();
+  process.env.TAMNORA_TEST_API_KEY = 'supersecret123';
+  process.env.TAMNORA_TEST_OK = 'visible';
+  try {
+    const reg = createToolRegistry({ root, permissions: { bash: 'allow' } });
+    const out = await reg.execute('bash', {
+      command: `node -e "process.stdout.write('K='+String(process.env.TAMNORA_TEST_API_KEY)+' O='+process.env.TAMNORA_TEST_OK)"`,
+    });
+    assert.doesNotMatch(out, /supersecret123/);
+    assert.match(out, /visible/);
+  } finally {
+    delete process.env.TAMNORA_TEST_API_KEY;
+    delete process.env.TAMNORA_TEST_OK;
+  }
+});
+
 test('bash se cancela cuando aborta la señal del run', async () => {
   const root = await makeWorkspace();
   const ac = new AbortController();
@@ -202,3 +247,52 @@ test('screenshot, console_errors y preview_url validan la URL sin lanzar el nave
     assert.ok(definitions.some((d) => d.function.name === name), `falta ${name}`);
   }
 });
+
+test('ask_user: fallback sin canal y respuestas formateadas con onQuestion', async () => {
+  assert.match(await askUserTool(null, {}), /Error/);
+  assert.match(await askUserTool(null, { questions: [{ id: 'n', label: 'Nombre' }] }), /canal/);
+
+  const out = await askUserTool(
+    null,
+    {
+      questions: [
+        { id: 'n', label: 'Nombre' },
+        { id: 'f', label: 'Framework', type: 'select', options: ['React', 'Vue'] },
+      ],
+    },
+    { onQuestion: async () => ({ ok: true, answers: { n: 'Ana', f: 'Vue' } }) }
+  );
+  assert.match(out, /Nombre: Ana/);
+  assert.match(out, /Framework: Vue/);
+
+  const cancelled = await askUserTool(null, { questions: [{ id: 'n', label: 'N' }] }, { onQuestion: async () => ({ ok: false }) });
+  assert.match(cancelled, /no respondi/i);
+
+  assert.equal(evaluatePermission('ask_user', {}, {}), 'allow');
+  const { definitions } = createTools({ root: await makeWorkspace() });
+  assert.ok(definitions.some((d) => d.function.name === 'ask_user'));
+});
+
+test('offer_choices valida question y options', async () => {
+  assert.match(offerChoicesTool(null, {}), /Error/);
+  const out = offerChoicesTool(null, { question: '¿Sigo?', options: ['sí', 'no'] });
+  assert.match(out, /sí/);
+  assert.match(out, /no/);
+  assert.equal(evaluatePermission('offer_choices', {}, {}), 'allow');
+});
+
+test('show_plan valida steps y marca el estado', () => {
+  assert.match(showPlanTool(null, {}), /Error/);
+  const out = showPlanTool(null, {
+    title: 'Plan',
+    steps: [
+      { text: 'Uno', status: 'done' },
+      { text: 'Dos', status: 'active' },
+      { text: 'Tres' },
+    ],
+  });
+  assert.match(out, /\[x\] Uno/);
+  assert.match(out, /\[~\] Dos/);
+  assert.match(out, /\[ \] Tres/);
+  assert.equal(evaluatePermission('show_plan', {}, {}), 'allow');
+});