@danieltmn/tamnora 0.21.0 → 0.21.2

package/harness/packages/server/test/procs-manager.test.js

@@ -0,0 +1,43 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createProcManager } from '../src/lib/procs.js';
+
+async function workspace() {
+  return mkdtemp(path.join(tmpdir(), 'tamnora-procs-'));
+}
+
+test('procs rechaza binarios fuera de la allowlist y args invalidos', async () => {
+  const cwd = await workspace();
+  const procs = createProcManager({ allow: ['node'] });
+  assert.throws(() => procs.start({ cwd, command: 'calc' }), /no permitido/);
+  assert.throws(() => procs.start({ cwd, command: 'node', args: 'x' }), /lista de strings/);
+  assert.throws(() => procs.start({ cwd, command: 'node', args: ['a\0b'] }), /Argumento inválido/);
+  assert.throws(
+    () => procs.start({ cwd, command: 'node', args: Array.from({ length: 33 }, () => 'x') }),
+    /Demasiados argumentos/
+  );
+});
+
+test('en Windows los args no admiten metacaracteres del shell', { skip: process.platform !== 'win32' }, async () => {
+  const cwd = await workspace();
+  const procs = createProcManager({ allow: ['npm', 'node'] });
+  for (const arg of ['x & calc', 'x | calc', 'x > out.txt', 'x %PATH%', 'x^y', 'x"y']) {
+    assert.throws(() => procs.start({ cwd, command: 'npm', args: ['run', arg] }), /Argumento no permitido/);
+  }
+});
+
+test('procs arranca y detiene un proceso permitido', async () => {
+  const cwd = await workspace();
+  const procs = createProcManager({ allow: ['node'] });
+  const proc = procs.start({ cwd, command: process.execPath, args: ['-e', 'setTimeout(() => {}, 5000)'] });
+  try {
+    assert.ok(proc.id);
+    assert.equal(proc.running, true);
+    assert.equal(procs.list().length, 1);
+  } finally {
+    assert.equal(procs.stop(proc.id), true);
+  }
+});

package/harness/packages/server/test/server.test.js

@@ -1578,7 +1578,14 @@ test('hooks observe tool events and plugins add custom tools', async () => {
     path.join(cwd, '.tamnora', 'plugins', 'demo.mjs'),
     "export default { name: 'demo', tools: [{ name: 'saludar', description: 'saluda', parameters: { quien: { type: 'string' } }, handler: (args) => `Hola ${args.quien}` }] };\n"
   );
-  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ permissions: { plugin__demo__saludar: 'allow' } }));
+  await writeFile(
+    path.join(cwd, 'tamnora.json'),
+    JSON.stringify({
+      hooks: ['.tamnora/hooks/*.mjs'],
+      plugins: ['.tamnora/plugins/*.mjs'],
+      permissions: { plugin__demo__saludar: 'allow' },
+    })
+  );
 
   let captured = null;
   const provider = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",