@danieltmn/tamnora 0.21.0 → 0.21.2

package/harness/packages/core/src/tools/executors.js

@@ -7,6 +7,7 @@ import { diffLines } from './diff.js';
 import { captureScreenshot, readConsole } from '../browser/index.js';
 import { screenshotsDir } from '../config/home.js';
 import { scrubEnv } from '../redact.js';
+import { checkHttpUrl, isBlockedHost, normalizeHost } from '../net/hosts.js';
 
 const MAX_READ_LINES = 2000;
 const MAX_LIST = 500;
@@ -16,6 +17,8 @@ const MAX_GREP_FILE_BYTES = 2_000_000;
 const MAX_BASH_OUTPUT = 100_000;
 const FETCH_TIMEOUT_MS = 20000;
 const MAX_FETCH_CHARS = 200_000;
+const MAX_REDIRECTS = 5;
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
 
 const NAMED_ENTITIES = {
   amp: '&',
@@ -35,23 +38,6 @@ const NAMED_ENTITIES = {
   trade: '\u2122',
 };
 
-function isBlockedHost(hostname) {
-  const h = String(hostname ?? '')
-    .toLowerCase()
-    .replace(/^\[|\]$/g, '');
-  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
-  if (h === '::1' || h === '0.0.0.0') return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!m) return false;
-  const a = Number(m[1]);
-  const b = Number(m[2]);
-  if (a === 127 || a === 10 || a === 0) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  return false;
-}
-
 function isTextualType(type) {
   const t = String(type || '').toLowerCase();
   if (!t) return true;
@@ -112,27 +98,47 @@ function formatBody(head, text, limit) {
 }
 
 export async function fetchUrlTool(_root, { url, maxLength, raw } = {}) {
-  let target;
-  try {
-    target = new URL(String(url ?? ''));
-  } catch {
-    return 'Error: URL inválida.';
-  }
-  if (!/^https?:$/.test(target.protocol)) return 'Error: solo se permite http/https.';
-  if (isBlockedHost(target.hostname)) return `Error: host bloqueado (${target.hostname}).`;
+  const checked = checkHttpUrl(url);
+  if (checked.error) return `Error: ${checked.error}`;
+  let target = checked.parsed;
 
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
-    const res = await fetch(target.toString(), {
-      redirect: 'follow',
-      signal: controller.signal,
-      headers: {
-        'User-Agent': 'Mozilla/5.0 (compatible; tamnora-harness; +https://github.com/tamnora/tamnora-harness)',
-        Accept: 'text/html,application/xhtml+xml,application/json,text/plain;q=0.9,*/*;q=0.5',
-        'Accept-Language': 'es,en;q=0.8',
-      },
-    });
+    let res;
+    for (let hop = 0; ; hop++) {
+      res = await fetch(target.toString(), {
+        redirect: 'manual',
+        signal: controller.signal,
+        headers: {
+          'User-Agent': 'Mozilla/5.0 (compatible; tamnora-harness; +https://github.com/tamnora/tamnora-harness)',
+          Accept: 'text/html,application/xhtml+xml,application/json,text/plain;q=0.9,*/*;q=0.5',
+          'Accept-Language': 'es,en;q=0.8',
+        },
+      });
+      if (!REDIRECT_STATUS.has(res.status)) break;
+      const location = res.headers.get('location');
+      if (!location) break;
+      if (hop >= MAX_REDIRECTS) return `Error: demasiadas redirecciones (${MAX_REDIRECTS}).`;
+      let next;
+      try {
+        next = new URL(location, target);
+      } catch {
+        return `Error: redirección inválida (${location}).`;
+      }
+      if (next.protocol !== 'http:' && next.protocol !== 'https:') {
+        return `Error: redirección a un protocolo no permitido (${next.protocol}).`;
+      }
+      if (isBlockedHost(next.hostname)) {
+        return `Error: host bloqueado (${normalizeHost(next.hostname)}).`;
+      }
+      try {
+        await res.body?.cancel();
+      } catch {
+        /* el cuerpo del redirect no importa */
+      }
+      target = next;
+    }
     const type = res.headers.get('content-type') || '';
     const limit = Math.min(Math.max(Number(maxLength) || 20000, 500), MAX_FETCH_CHARS);
     const full = await res.text();
@@ -552,7 +558,7 @@ export function showPlanTool(_root, { title, steps } = {}) {
  * muestre y Telegram la mande como foto.
  */
 export async function screenshotTool(_root, { url, fullPage, width, height } = {}) {
-  const parsed = normalizeHttpUrl(url);
+  const parsed = checkHttpUrl(url);
   if (parsed.error) return `Error: ${parsed.error}`;
   const size = {
     width: clampInt(width, 1280, 320, 3840),
@@ -589,7 +595,7 @@ export async function screenshotTool(_root, { url, fullPage, width, height } = {
 
 /** Errores y mensajes de consola de una pagina (ejecutando su JS). */
 export async function consoleTool(_root, { url, waitMs } = {}) {
-  const parsed = normalizeHttpUrl(url);
+  const parsed = checkHttpUrl(url);
   if (parsed.error) return `Error: ${parsed.error}`;
 
   let result;

package/harness/packages/core/test/hooks.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { normalizeHookModule, loadHooks } from '../src/hooks/index.js';
+import { normalizeHookModule, loadHooks, DEFAULT_HOOK_PATTERNS } from '../src/hooks/index.js';
 
 test('normalizeHookModule acepta objeto events, funcion y onEvent', () => {
   const byEvents = normalizeHookModule({ default: { name: 'a', events: { 'run.end': () => {} } } }, 'x');
@@ -14,7 +14,7 @@ test('normalizeHookModule acepta objeto events, funcion y onEvent', () => {
   assert.equal(normalizeHookModule({ default: {} }, 'n'), null);
 });
 
-test('loadHooks carga .tamnora/hooks/*.mjs e ignora lo roto', async () => {
+test('loadHooks no ejecuta nada por presencia: exige un patron explicito', async () => {
   const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-hooks-'));
   await mkdir(path.join(cwd, '.tamnora', 'hooks'), { recursive: true });
   await writeFile(
@@ -22,7 +22,10 @@ test('loadHooks carga .tamnora/hooks/*.mjs e ignora lo roto', async () => {
     "export default { name: 'demo', events: { 'run.end': () => {} } };\n"
   );
   await writeFile(path.join(cwd, '.tamnora', 'hooks', 'roto.mjs'), 'this is not valid javascript {{{\n');
-  const hooks = await loadHooks(cwd, []);
+
+  assert.deepEqual(await loadHooks(cwd, []), [], 'sin patrones no se importa nada');
+
+  const hooks = await loadHooks(cwd, DEFAULT_HOOK_PATTERNS);
   assert.equal(hooks.length, 1);
   assert.equal(hooks[0].id, 'demo');
   assert.deepEqual(Object.keys(hooks[0].events), ['run.end']);

package/harness/packages/core/test/hosts.test.js

@@ -0,0 +1,50 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { checkHttpUrl, isBlockedAddress, isBlockedHost } from '../src/net/hosts.js';
+
+test('isBlockedHost bloquea loopback, redes privadas y sufijos internos', () => {
+  for (const host of [
+    'localhost',
+    'foo.localhost',
+    'app.local',
+    'intranet',
+    'metadata.internal',
+    '127.0.0.1',
+    '10.1.2.3',
+    '172.16.0.1',
+    '192.168.1.10',
+    '169.254.169.254',
+    '100.64.0.1',
+    '0.0.0.0',
+    '224.0.0.1',
+  ]) {
+    assert.equal(isBlockedHost(host), true, `deberia bloquear ${host}`);
+  }
+  for (const host of ['example.com', 'api.openai.com', '8.8.8.8', '2606:4700:4700::1111']) {
+    assert.equal(isBlockedHost(host), false, `no deberia bloquear ${host}`);
+  }
+});
+
+test('isBlockedHost cubre IPv6-mapped y rangos IPv6 internos', () => {
+  for (const host of ['[::1]', '::1', '[::ffff:127.0.0.1]', '[::ffff:7f00:1]', '[fd00::1]', '[fe80::1]', '[::]']) {
+    assert.equal(isBlockedHost(host), true, `deberia bloquear ${host}`);
+  }
+  assert.equal(isBlockedHost('[2001:db8::1]'), false);
+});
+
+test('isBlockedAddress valida el rango de una IP', () => {
+  assert.equal(isBlockedAddress('127.0.0.1'), true);
+  assert.equal(isBlockedAddress('::ffff:10.0.0.1'), true);
+  assert.equal(isBlockedAddress('100.64.1.1'), true);
+  assert.equal(isBlockedAddress('8.8.4.4'), false);
+  assert.equal(isBlockedAddress('nope'), true);
+});
+
+test('checkHttpUrl valida protocolo y host', () => {
+  assert.match(checkHttpUrl('').error, /falta "url"/);
+  assert.match(checkHttpUrl('nope').error, /URL inválida/);
+  assert.match(checkHttpUrl('ftp://example.com').error, /http\(s\)/);
+  assert.match(checkHttpUrl('http://127.0.0.1:4517/').error, /host bloqueado/);
+  assert.match(checkHttpUrl('http://[::ffff:127.0.0.1]/').error, /host bloqueado/);
+  assert.equal(checkHttpUrl('https://example.com/x').url, 'https://example.com/x');
+});

package/harness/packages/core/test/plugins.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { normalizePlugin, loadPlugins } from '../src/plugins/index.js';
+import { normalizePlugin, loadPlugins, DEFAULT_PLUGIN_PATTERNS } from '../src/plugins/index.js';
 
 test('normalizePlugin filtra tools invalidas', () => {
   const plugin = normalizePlugin({ default: { name: 'demo', tools: [{ name: 'x', handler: () => {} }, { name: 'bad' }] } }, 'z');
@@ -12,14 +12,16 @@ test('normalizePlugin filtra tools invalidas', () => {
   assert.equal(normalizePlugin({ default: {} }, 'n'), null);
 });
 
-test('loadPlugins carga .tamnora/plugins/*.mjs', async () => {
+test('loadPlugins exige un patron explicito (no ejecuta por presencia)', async () => {
   const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-plugins-'));
   await mkdir(path.join(cwd, '.tamnora', 'plugins'), { recursive: true });
   await writeFile(
     path.join(cwd, '.tamnora', 'plugins', 'demo.mjs'),
     "export default { name: 'demo', tools: [{ name: 'saludar', handler: () => 'hi' }] };\n"
   );
-  const plugins = await loadPlugins(cwd, []);
+  assert.deepEqual(await loadPlugins(cwd, []), []);
+
+  const plugins = await loadPlugins(cwd, DEFAULT_PLUGIN_PATTERNS);
   assert.equal(plugins.length, 1);
   assert.equal(plugins[0].tools[0].name, 'saludar');
 });

package/harness/packages/core/test/portable.test.js

@@ -0,0 +1,150 @@
+import { test, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import {
+  setHome,
+  databasePath,
+  Store,
+  ensureApp,
+  readApp,
+  writeApp,
+  exportConfig,
+  importConfig,
+  MASKED,
+} from '../src/index.js';
+
+const prevHome = process.env.TAMNORA_HOME;
+const prevDb = process.env.TAMNORA_DB;
+
+afterEach(() => {
+  setHome(null);
+  if (prevHome === undefined) delete process.env.TAMNORA_HOME;
+  else process.env.TAMNORA_HOME = prevHome;
+  if (prevDb === undefined) delete process.env.TAMNORA_DB;
+  else process.env.TAMNORA_DB = prevDb;
+});
+
+async function freshHome() {
+  const dir = await mkdtemp(path.join(tmpdir(), 'tamnora-portable-'));
+  setHome(dir);
+  process.env.TAMNORA_DB = path.join(dir, 'tamnora.db');
+  return dir;
+}
+
+test('exportConfig enmascara los secretos y respeta las referencias env:', async () => {
+  await freshHome();
+  ensureApp();
+  const app = readApp();
+  app.user = { name: 'daniel', password: { algo: 'scrypt', salt: 'x', hash: 'y' } };
+  app.telegram = { token: '123:abc', allowedChatIds: ['7'] };
+  writeApp(app);
+
+  const store = new Store(databasePath());
+  store.saveProvider({ id: 'deepseek', apiKey: 'sk-real', baseUrl: 'https://deepseek', enabled: true });
+  store.saveProvider({ id: 'env', apiKey: 'env:OPENAI_API_KEY' });
+  store.setSetting('activeProvider', 'deepseek');
+  store.setSetting('telegram:chat:7', 'sess-1');
+  const data = exportConfig({ store, now: 0 });
+  store.close();
+
+  assert.equal(data.kind, 'tamnora-config');
+  assert.equal(data.version, 1);
+  assert.equal(data.secrets, false);
+  assert.equal(data.app.authSecret, MASKED);
+  assert.equal(data.app.user, MASKED);
+  assert.equal(data.app.telegram.token, MASKED);
+  assert.deepEqual(data.app.telegram.allowedChatIds, ['7']);
+  assert.equal(data.providers.find((p) => p.id === 'deepseek').apiKey, MASKED);
+  assert.equal(data.providers.find((p) => p.id === 'env').apiKey, 'env:OPENAI_API_KEY');
+  assert.equal(data.settings.activeProvider, 'deepseek');
+  assert.equal('telegram:chat:7' in data.settings, false);
+});
+
+test('exportConfig con withSecrets incluye las claves reales', async () => {
+  await freshHome();
+  ensureApp();
+  const app = readApp();
+  app.authSecret = 'super-secret';
+  writeApp(app);
+
+  const store = new Store(databasePath());
+  store.saveProvider({ id: 'deepseek', apiKey: 'sk-real' });
+  const data = exportConfig({ store, withSecrets: true });
+  store.close();
+
+  assert.equal(data.secrets, true);
+  assert.equal(data.app.authSecret, 'super-secret');
+  assert.equal(data.providers[0].apiKey, 'sk-real');
+});
+
+test('importConfig aplica proveedores y ajustes y conserva los secretos enmascarados', async () => {
+  await freshHome();
+  ensureApp();
+  const current = readApp();
+  current.authSecret = 'keep-me';
+  writeApp(current);
+
+  const store = new Store(databasePath());
+  store.saveProvider({ id: 'deepseek', apiKey: 'old-key' });
+  store.close();
+
+  const payload = {
+    kind: 'tamnora-config',
+    version: 1,
+    app: { port: 4599, authSecret: MASKED, user: MASKED, profile: { name: 'Daniel' } },
+    providers: [
+      { id: 'deepseek', baseUrl: 'https://api.deepseek.com', apiKey: MASKED, models: ['chat'], enabled: true },
+      { id: 'groq', baseUrl: 'https://groq', apiKey: 'gsk-new', enabled: true },
+    ],
+    settings: { activeProvider: 'groq', strictScope: true, 'telegram:chat:7': 'ignored' },
+  };
+
+  const store2 = new Store(databasePath());
+  const summary = importConfig(store2, payload);
+  const deepseek = store2.getProvider('deepseek');
+  const groq = store2.getProvider('groq');
+  const strict = store2.getSetting('strictScope');
+  store2.close();
+
+  assert.equal(summary.providers, 2);
+  assert.equal(summary.settings, 2);
+  assert.equal(readApp().port, 4599);
+  assert.equal(readApp().authSecret, 'keep-me');
+  assert.equal(readApp().profile.name, 'Daniel');
+  assert.equal(deepseek.apiKey, 'old-key');
+  assert.equal(deepseek.baseUrl, 'https://api.deepseek.com');
+  assert.equal(groq.apiKey, 'gsk-new');
+  assert.equal(strict, true);
+});
+
+test('importConfig avisa cuando una clave enmascarada no tiene existente y no escribe con dryRun', async () => {
+  await freshHome();
+  const store = new Store(databasePath());
+  const payload = {
+    kind: 'tamnora-config',
+    version: 1,
+    providers: [{ id: 'nuevo', apiKey: MASKED }],
+    settings: { activeModel: 'x' },
+  };
+
+  const dry = importConfig(store, payload, { dryRun: true });
+  assert.deepEqual(dry.missingKeys, ['nuevo']);
+  assert.equal(store.getProvider('nuevo'), null);
+  assert.equal(store.getSetting('activeModel'), null);
+
+  const real = importConfig(store, payload);
+  assert.deepEqual(real.missingKeys, ['nuevo']);
+  assert.ok(store.getProvider('nuevo'));
+  assert.equal(store.getSetting('activeModel'), 'x');
+  store.close();
+});
+
+test('importConfig rechaza archivos que no son un export de Tamnora', async () => {
+  await freshHome();
+  const store = new Store(databasePath());
+  assert.throws(() => importConfig(store, { hello: 'world' }), /no parece un export/i);
+  assert.throws(() => importConfig(store, { kind: 'tamnora-config', version: 99 }), /no soportada/i);
+  store.close();
+});

package/harness/packages/core/test/tools.test.js

@@ -133,7 +133,7 @@ test('permission "ask" is denied by default and allowed with yes', async () => {
 test('fetchUrlTool rejects invalid URLs and private hosts', async () => {
   const root = await makeWorkspace();
   assert.match(await fetchUrlTool(root, { url: 'not-a-url' }), /URL inválida/);
-  assert.match(await fetchUrlTool(root, { url: 'ftp://example.com' }), /http\/https/);
+  assert.match(await fetchUrlTool(root, { url: 'ftp://example.com' }), /http\(s\)/);
   assert.match(await fetchUrlTool(root, { url: 'http://127.0.0.1:9/' }), /host bloqueado/);
   assert.match(await fetchUrlTool(root, { url: 'http://192.168.1.10/' }), /host bloqueado/);
   assert.match(await fetchUrlTool(root, { url: 'http://169.254.169.254/' }), /host bloqueado/);
@@ -192,6 +192,55 @@ test('fetchUrlTool raw returns the original body', async () => {
   assert.match(out, /<p>hola<\/p>/);
 });
 
+test('fetchUrlTool revalida el host en cada redirect', async () => {
+  let calls = 0;
+  const out = await withFetch(
+    async () => {
+      calls++;
+      return new Response(null, { status: 302, headers: { location: 'http://127.0.0.1:9/admin' } });
+    },
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /host bloqueado/);
+  assert.equal(calls, 1, 'no debe pedir el destino bloqueado');
+});
+
+test('fetchUrlTool bloquea redirects a IPv6 internos y protocolos no http', async () => {
+  const mapped = await withFetch(
+    async () => new Response(null, { status: 301, headers: { location: 'http://[::ffff:127.0.0.1]/' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(mapped, /host bloqueado/);
+
+  const file = await withFetch(
+    async () => new Response(null, { status: 302, headers: { location: 'file:///etc/passwd' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(file, /protocolo no permitido/);
+});
+
+test('fetchUrlTool sigue redirects a hosts publicos', async () => {
+  const out = await withFetch(
+    async (url) => {
+      if (String(url) === 'https://example.com/') {
+        return new Response(null, { status: 301, headers: { location: 'https://example.org/final' } });
+      }
+      return new Response('ok', { status: 200, headers: { 'content-type': 'text/plain' } });
+    },
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /200 .*example\.org\/final/);
+  assert.match(out, /ok/);
+});
+
+test('fetchUrlTool corta cadenas de redirects demasiado largas', async () => {
+  const out = await withFetch(
+    async () => new Response(null, { status: 302, headers: { location: 'https://example.com/loop' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /demasiadas redirecciones/);
+});
+
 test('createTools combines local and MCP tool routing', async () => {
   const root = await makeWorkspace();
   const mcp = {
@@ -265,10 +314,14 @@ test('la tool speak valida el texto y la recorta', async () => {
 
 test('screenshot, console_errors y preview_url validan la URL sin lanzar el navegador', async () => {
   assert.match(previewUrlTool(null, { url: 'https://example.com/x' }), /example\.com/);
+  assert.match(previewUrlTool(null, { url: 'http://127.0.0.1:5173/' }), /127\.0\.0\.1/, 'preview permite loopback');
   assert.match(previewUrlTool(null, {}), /falta "url"/);
   assert.match(await screenshotTool(null, { url: 'ftp://x' }), /Solo se admite http/);
   assert.match(await screenshotTool(null, {}), /falta "url"/);
+  assert.match(await screenshotTool(null, { url: 'http://127.0.0.1:4517/' }), /host bloqueado/);
+  assert.match(await screenshotTool(null, { url: 'http://[fd00::1]/' }), /host bloqueado/);
   assert.match(await consoleTool(null, { url: 'no-url' }), /URL inválida/);
+  assert.match(await consoleTool(null, { url: 'http://localhost:4517/' }), /host bloqueado/);
   assert.equal(evaluatePermission('screenshot', {}, {}), 'allow');
   assert.equal(evaluatePermission('console_errors', {}, {}), 'allow');
   assert.equal(evaluatePermission('preview_url', {}, {}), 'allow');

package/harness/packages/server/public/app.js

@@ -1892,18 +1892,39 @@ function addAdvisorCard(container, { text, kind } = {}) {
  * el resumen que pasa a ser el contexto del modelo. Lo de arriba sigue visible
  * como histórico; al modelo solo le llega lo de abajo (más los mensajes nuevos).
  */
-function addCompactCard(container, { text, label = 'contexto compactado' } = {}) {
+function addCompactCard(container, { text, label, running = false } = {}) {
   if (!container) return null;
-  const card = el('div', 'compact-card');
-  card.append(el('div', 'compact-rule', label));
+  const card = el('div', `compact-card${running ? ' running' : ''}`);
+  const rule = el('div', 'compact-rule', label ?? (running ? 'compactando…' : 'contexto compactado'));
+  card.append(rule);
+  if (running) {
+    // La compactación puede tardar (el modelo resume el historial): mostramos el
+    // corte con un loader animado hasta que el resumen llegue.
+    rule.append(el('span', 'loader loader-thinking'));
+  } else {
+    const clean = String(text ?? '').trim();
+    if (clean) {
+      const body = el('div', 'compact-text text');
+      body.innerHTML = renderMarkdown(clean);
+      card.append(body);
+    }
+  }
+  container.appendChild(card);
+  return card;
+}
+
+/** Completa la tarjeta de compactación en curso con el resumen del modelo. */
+function finishCompactCard(card, text) {
+  if (!card) return;
+  card.classList.remove('running');
+  const rule = card.querySelector('.compact-rule');
+  if (rule) rule.textContent = 'contexto compactado';
   const clean = String(text ?? '').trim();
-  if (clean) {
+  if (clean && !card.querySelector('.compact-text')) {
     const body = el('div', 'compact-text text');
     body.innerHTML = renderMarkdown(clean);
     card.append(body);
   }
-  container.appendChild(card);
-  return card;
 }
 
 function renderStored(message, pane) {
@@ -3853,17 +3874,21 @@ async function runCommand(name, arg) {
     }
     case 'compact': {
       if (!state.sessionId) return needSession();
-      toast('Compactando la conversación…');
+      // Animación en el pane: el corte queda a la vista con un loader mientras
+      // el modelo resume (puede tardar), y se completa con el resumen.
+      const card = addCompactCard(activePane, { running: true });
+      scrollMessages();
       const out = await api(`/api/sessions/${state.sessionId}/compact`, { method: 'POST' }).catch((error) => ({
         error: error.message,
       }));
       if (out.error) {
+        card?.remove();
         notify(`No se pudo compactar: ${out.error}`, 'notice err');
         return { handled: true };
       }
       // No borramos el pane: el historial queda a la vista y marcamos el corte
       // con la línea + el resumen que ahora ve el modelo.
-      addCompactCard(activePane, { text: out.summary });
+      finishCompactCard(card, out.summary);
       scrollMessages();
       refreshSessions();
       return { handled: true };

package/harness/packages/server/public/index.html

@@ -75,7 +75,7 @@
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span id="topbar-section" class="topbar-section">chat</span> <span class="ver">v0.21.0</span></div>
+      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span id="topbar-section" class="topbar-section">chat</span> <span class="ver">v0.21.2</span></div>
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>

package/harness/packages/server/public/styles.css

@@ -2505,6 +2505,10 @@ dialog.modal::backdrop { background: rgba(24, 22, 16, 0.55); backdrop-filter: bl
 }
 .compact-rule::before,
 .compact-rule::after { content: ''; flex: 1; height: 1px; background: var(--border); }
+.compact-card.running .compact-rule { color: var(--accent); }
+.compact-card.running .compact-rule::before,
+.compact-card.running .compact-rule::after { background: var(--accent-soft); }
+.compact-rule .loader-thinking { width: 22px; height: 6px; }
 .compact-text {
   margin-top: 10px;
   padding-left: 12px;

package/harness/packages/server/src/lib/procs.js

@@ -4,6 +4,25 @@ import path from 'node:path';
 import { DEFAULT_PROCESS_ALLOW, killPidTree } from './core.js';
 
 const MAX_LOG_LINES = 400;
+const MAX_ARGS = 32;
+const MAX_ARG_LENGTH = 1000;
+// Con `shell: true` (Windows y comando sin ruta) Node pega los args sin
+// escapar: cualquier metacaracter del shell permitiria inyectar comandos.
+const SAFE_SHELL_ARG = /^[^&|<>^%!"\r\n]+$/;
+
+function normalizeArgs(args) {
+  if (args === undefined || args === null) return [];
+  if (!Array.isArray(args)) throw new Error('"args" debe ser una lista de strings.');
+  if (args.length > MAX_ARGS) throw new Error(`Demasiados argumentos (máximo ${MAX_ARGS}).`);
+  return args.map((arg) => {
+    const value = String(arg);
+    if (value.length > MAX_ARG_LENGTH) {
+      throw new Error(`Un argumento supera los ${MAX_ARG_LENGTH} caracteres.`);
+    }
+    if (/[\0\r\n]/.test(value)) throw new Error('Argumento inválido.');
+    return value;
+  });
+}
 
 function killTree(child) {
   if (!child || child.killed) return;
@@ -49,18 +68,26 @@ export function createProcManager({ allow } = {}) {
     if (!allows(bin)) {
       throw new Error(`Comando no permitido: ${bin}. Agregalo a processes.allow en tamnora.json.`);
     }
-    const child = spawn(bin, args.map(String), {
+    const list = normalizeArgs(args);
+    const shell = process.platform === 'win32' && !path.isAbsolute(bin);
+    if (shell) {
+      const bad = list.find((arg) => !SAFE_SHELL_ARG.test(arg));
+      if (bad !== undefined) {
+        throw new Error(`Argumento no permitido con shell en Windows: "${bad}".`);
+      }
+    }
+    const child = spawn(bin, list, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,
-      shell: process.platform === 'win32' && !path.isAbsolute(bin),
+      shell,
       detached: process.platform !== 'win32',
     });
     const id = randomUUID().slice(0, 8);
     const record = {
       id,
       command: bin,
-      args: args.map(String),
+      args: list,
       cwd,
       port: port ? Number(port) : null,
       pid: child.pid,

package/harness/packages/server/src/routes/procs.js

@@ -16,9 +16,7 @@ export function registerProcs(route, ctx) {
   });
 
   route('POST', '/api/procs/start', async ({ req, res }) => {
-    if (!ctx.authEnabled && !requireLocal(req, res, 'Iniciar procesos solo está disponible en conexiones locales.')) {
-      return;
-    }
+    if (!requireLocal(req, res, 'Iniciar procesos solo está disponible en conexiones locales.')) return;
     if (!ctx.procsEnabled) return sendError(res, 403, 'Los procesos están deshabilitados (processes.enabled = false).');
     const body = await readJson(req);
     const dir = resolveDirOr400(res, body.cwd, ctx.cwd);
@@ -38,9 +36,7 @@ export function registerProcs(route, ctx) {
   });
 
   route('POST', '/api/procs/:id/stop', ({ req, res, params }) => {
-    if (!ctx.authEnabled && !requireLocal(req, res, 'Detener procesos solo está disponible en conexiones locales.')) {
-      return;
-    }
+    if (!requireLocal(req, res, 'Detener procesos solo está disponible en conexiones locales.')) return;
     if (!ctx.procs.stop(params.id)) return sendError(res, 404, 'Proceso no encontrado.');
     sendJson(res, 200, { ok: true });
   });

package/harness/packages/server/src/server.js

@@ -254,11 +254,18 @@ export async function createTamnoraServer({
   ctx.systemPrompt = (await ctx.systemPromptFor(cwd)) || DEFAULT_SYSTEM_PROMPT;
   ctx.agentTools = createAgentTools(ctx);
 
-  // Hooks locales (opt-in: solo si hay archivos). Observan el ciclo de vida.
+  // Hooks locales (opt-in explicito: solo los patrones de `config.hooks[]`).
+  // Observan el ciclo de vida.
   ctx.hooks = await createHookRunner(ctx, config.hooks ?? []);
+  if (ctx.hooks.count) {
+    process.stderr.write(`tamnora: ${ctx.hooks.count} hook(s) cargados desde config.hooks\n`);
+  }
 
-  // Plugins locales: tools propias del usuario (`.tamnora/plugins/*.mjs`).
+  // Plugins locales: tools propias del usuario (solo `config.plugins[]`).
   ctx.plugins = await createPlugins(ctx, config.plugins ?? []);
+  if (ctx.plugins.count) {
+    process.stderr.write(`tamnora: ${ctx.plugins.count} tool(s) de plugin cargadas desde config.plugins\n`);
+  }
 
   // Canales de mensajeria (Telegram via long polling) si hay token.
   const channels = createChannelsManager(ctx, {