@danieltmn/tamnora 0.21.1 → 0.22.0

package/harness/packages/server/test/settings.test.js

@@ -0,0 +1,465 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { completionFooter } from '../src/lib/channels/telegram.js';
+import { startServer } from './helpers.js';
+
+test('completionFooter resume el cierre del turno', () => {
+  assert.equal(completionFooter('end_turn', 1, 0, 0), '✓ terminado · 1 ronda');
+  assert.equal(completionFooter('end_turn', 3, 5, 1200), '✓ terminado · 3 rondas · 5 herramientas · 1.2s');
+  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ corte de seguridad · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('no_progress', 2, 2, 300), /^⚠ corte de seguridad/);
+});
+
+test('configures Telegram from the console (masked token)', async () => {
+  const { instance, base } = await startServer({ telegram: false });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    let data = await (await fetch(`${base}/api/channels`)).json();
+    assert.equal(data.telegram.tokenSet, false);
+    assert.equal(data.telegram.transcribeModel, 'whisper-1');
+
+    let res = await fetch(`${base}/api/channels/telegram`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ allowedChatIds: '123, 456', transcribeModel: '' }),
+    });
+    data = await res.json();
+    assert.deepEqual(data.telegram.allowedChatIds, ['123', '456']);
+    assert.equal(data.telegram.transcribeModel, 'whisper-1');
+
+    res = await fetch(`${base}/api/channels/telegram`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ token: '123456:ABCDEFghij', transcribeProvider: 'openai' }),
+    });
+    data = await res.json();
+    assert.equal(data.telegram.tokenSet, true);
+    assert.equal(data.telegram.transcribeProvider, 'openai');
+    assert.match(data.telegram.tokenHint, /ghij$/);
+    assert.doesNotMatch(JSON.stringify(data), /ABCDEF/);
+
+    // Mandar la mascara no pisa el token real.
+    res = await fetch(`${base}/api/channels/telegram`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ token: data.telegram.tokenHint, allowedChatIds: ['1'] }),
+    });
+    data = await res.json();
+    assert.equal(data.telegram.tokenSet, true);
+    assert.match(data.telegram.tokenHint, /ghij$/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages MCP servers from the console', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    assert.deepEqual(data.servers, []);
+
+    let res = await fetch(`${base}/api/mcp/servers/echo`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ name: 'Echo', transport: 'stdio', command: 'node', args: ['a.mjs'], enabled: true }),
+    });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    const echo = data.servers.find((s) => s.id === 'echo');
+    assert.equal(echo.source, 'store');
+    assert.deepEqual(echo.args, ['a.mjs']);
+
+    const bad = await fetch(`${base}/api/mcp/servers/bad`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ transport: 'http' }),
+    });
+    assert.equal(bad.status, 400);
+
+    res = await fetch(`${base}/api/mcp/servers/echo`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    assert.equal(data.servers.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('sirve el catálogo de MCP/skills y los instala deshabilitados', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const catalog = await (await fetch(`${base}/api/mcp/catalog`)).json();
+    assert.ok(catalog.catalog.some((e) => e.id === 'playwright' && e.installed === false));
+
+    const add = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ catalog: 'playwright' }),
+    });
+    assert.equal(add.status, 200);
+    const added = await add.json();
+    assert.equal(added.imported, 'playwright');
+    assert.equal(added.servers.find((s) => s.id === 'playwright').enabled, false);
+
+    const again = await (await fetch(`${base}/api/mcp/catalog`)).json();
+    assert.equal(again.catalog.find((e) => e.id === 'playwright').installed, true);
+
+    const skills = await (await fetch(`${base}/api/skills/catalog`)).json();
+    assert.ok(skills.catalog.some((e) => e.id === 'code-review' && e.installed === false));
+    const skillAdd = await fetch(`${base}/api/skills`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ id: 'code-review' }),
+    });
+    assert.equal(skillAdd.status, 200);
+    const skillData = await skillAdd.json();
+    assert.equal(skillData.installed, 'code-review');
+    assert.equal(skillData.skills.find((s) => s.id === 'code-review').enabled, false);
+
+    const unknown = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ catalog: 'nope' }),
+    });
+    assert.equal(unknown.status, 404);
+    const unknownSkill = await fetch(`${base}/api/skills`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ id: 'nope' }),
+    });
+    assert.equal(unknownSkill.status, 404);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('los buscadores devuelven vacío sin query', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const mcp = await (await fetch(`${base}/api/mcp/search`)).json();
+    assert.deepEqual(mcp.results, []);
+    const skills = await (await fetch(`${base}/api/skills/search`)).json();
+    assert.deepEqual(skills.results, []);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('MCP: el env se enmascara y no se pisa al guardar sin cambios', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'DB',
+        transport: 'stdio',
+        command: 'node',
+        args: ['db.mjs'],
+        env: { MYSQL_HOST: 'localhost', MYSQL_PASSWORD: 'supersecret' },
+      }),
+    });
+
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    const db = data.servers.find((s) => s.id === 'db');
+    assert.equal(db.env.MYSQL_HOST, 'localhost');
+    assert.equal(db.env.MYSQL_PASSWORD, '••••cret');
+
+    // Un toggle manda de vuelta el env enmascarado: no debe pisar el secreto.
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: db.name,
+        transport: 'stdio',
+        command: db.command,
+        args: db.args,
+        env: db.env,
+        enabled: false,
+      }),
+    });
+    const stored = instance.store.listMcpServers().find((s) => s.id === 'db');
+    assert.equal(stored.config.env.MYSQL_PASSWORD, 'supersecret');
+    assert.equal(stored.enabled, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('guarda los límites del agente desde Ajustes', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ maxRounds: 20, maxTokens: 50000, maxDurationMs: 600000 }),
+    });
+    const data = await res.json();
+    assert.equal(data.settings.maxRounds, 20);
+    assert.equal(data.settings.maxTokens, 50000);
+    assert.equal(data.settings.maxDurationMs, 600000);
+
+    const again = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(again.settings.maxRounds, 20);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('guarda el modo de carga y las tools fijas de MCP', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ mcpMode: 'lazy', mcpPinned: 'mcp__postgres__query, postgres' }),
+    });
+    const data = await res.json();
+    assert.equal(data.settings.mcpMode, 'lazy');
+    assert.deepEqual(data.settings.mcpPinned, ['mcp__postgres__query', 'postgres']);
+
+    const mcp = await (await fetch(`${base}/api/mcp`)).json();
+    assert.equal(mcp.mode, 'lazy');
+    assert.deepEqual(mcp.pinned, ['mcp__postgres__query', 'postgres']);
+    assert.equal(mcp.threshold, 12);
+    assert.equal(mcp.toolCount, null);
+
+    const bad = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ mcpMode: 'nope' }),
+    });
+    assert.equal((await bad.json()).settings.mcpMode, 'auto');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('imports an MCP server from a JSON snippet', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ json: '{"mcpServers":{"demo":{"command":"npx","args":["-y","pkg"]}}}' }),
+    });
+    assert.equal(res.status, 200);
+    const data = await res.json();
+    assert.equal(data.imported, 'demo');
+    assert.ok(data.servers.some((s) => s.id === 'demo' && s.transport === 'stdio'));
+  } finally {
+    await instance.close();
+  }
+});
+
+test('rejects unknown import refs (skills and mcpservers.org)', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const badSkill = await fetch(`${base}/api/skills/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ ref: 'nope' }),
+    });
+    assert.equal(badSkill.status, 400);
+
+    const blocked = await fetch(`${base}/api/mcp/import`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ url: 'https://mcpservers.org/es/official' }),
+    });
+    assert.equal(blocked.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages skills from the console', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  const put = (id, body) => fetch(`${base}/api/skills/${id}`, { method: 'PUT', headers: json, body: JSON.stringify(body) });
+  try {
+    let res = await put('demo', { name: 'Demo', description: 'para pruebas', body: 'Hacé X.' });
+    assert.equal(res.status, 200);
+    let data = await res.json();
+    const demo = data.skills.find((s) => s.id === 'demo');
+    assert.equal(demo.enabled, true);
+    assert.equal(demo.removable, true);
+
+    const detail = await (await fetch(`${base}/api/skills/demo`)).json();
+    assert.match(detail.skill.body, /Hacé X/);
+
+    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
+    data = await (await fetch(`${base}/api/skills`)).json();
+    assert.equal(data.skills.find((s) => s.id === 'demo').enabled, false);
+
+    res = await fetch(`${base}/api/skills/demo`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await (await fetch(`${base}/api/skills`)).json();
+    assert.equal(data.skills.length, 0);
+
+    res = await put('vacia', { body: '   ' });
+    assert.equal(res.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('skills: indice lazy por defecto (sin body)', async () => {
+  let captured = '';
+  const captureProvider = {
+    id: 'capture',
+    async streamChat(_config, { messages }) {
+      captured = messages?.[0]?.content ?? '';
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: captureProvider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  const chat = (sessionId) =>
+    fetch(`${base}/api/chat`, { method: 'POST', headers: json, body: JSON.stringify({ sessionId, model: 'm', input: 'hola' }) });
+  const newSession = async () => {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
+    ).json();
+    return created.session.id;
+  };
+  try {
+    await fetch(`${base}/api/skills/demo`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ name: 'Demo', body: 'Regla secreta de la skill.' }),
+    });
+
+    // Lazy: se inyecta el indice (id), no el cuerpo.
+    await (await chat(await newSession())).text();
+    assert.match(captured, /demo/);
+    assert.doesNotMatch(captured, /Regla secreta de la skill/);
+
+    // Deshabilitada: no aparece ni en el indice.
+    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
+    await (await chat(await newSession())).text();
+    assert.doesNotMatch(captured, /demo/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages project memory from the console', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-mem-'));
+  const { instance, base } = await startServer({ cwd });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    let res = await fetch(`${base}/api/memory/arquitectura`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ title: 'Arquitectura', body: 'Usa SQLite.' }),
+    });
+    assert.equal(res.status, 200);
+    let data = await res.json();
+    assert.equal(data.topics.length, 1);
+    assert.match(data.index, /arquitectura\.md/);
+
+    const detail = await (await fetch(`${base}/api/memory/arquitectura`)).json();
+    assert.match(detail.topic.body, /Usa SQLite/);
+
+    await fetch(`${base}/api/memory`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ index: '# Memoria\n\n- propio' }),
+    });
+    data = await (await fetch(`${base}/api/memory`)).json();
+    assert.match(data.index, /propio/);
+
+    res = await fetch(`${base}/api/memory/arquitectura`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    assert.equal(data.topics.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('skills: modo eager inyecta el body en el system prompt', async () => {
+  let captured = '';
+  const captureProvider = {
+    id: 'capture',
+    async streamChat(_config, { messages }) {
+      captured = messages?.[0]?.content ?? '';
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-srv-'));
+  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ skills: { mode: 'eager' } }));
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider: captureProvider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    await fetch(`${base}/api/skills/demo`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ name: 'Demo', body: 'Regla secreta de la skill.' }),
+    });
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
+    ).json();
+    await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'hola' }),
+    }).then((r) => r.text());
+    assert.match(captured, /Regla secreta de la skill/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages providers and active settings', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const put = await fetch(`${base}/api/providers/deepseek`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        label: 'DeepSeek',
+        baseUrl: 'https://api.deepseek.com/v1',
+        apiKey: 'sk-secret-1234',
+        models: ['deepseek-chat'],
+      }),
+    });
+    const data = await put.json();
+    const ds = data.providers.find((p) => p.id === 'deepseek');
+    assert.equal(ds.hasKey, true);
+    assert.equal(ds.apiKeyHint.endsWith('1234'), true);
+    assert.deepEqual(ds.models, ['deepseek-chat']);
+
+    await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ provider: 'deepseek', model: 'deepseek-chat' }),
+    });
+    const settings = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(settings.settings.provider, 'deepseek');
+    assert.equal(settings.settings.model, 'deepseek-chat');
+
+    const list = await (await fetch(`${base}/api/providers`)).json();
+    assert.equal(list.active.provider, 'deepseek');
+
+    const deleted = await fetch(`${base}/api/providers/deepseek`, { method: 'DELETE' });
+    assert.equal(deleted.status, 200);
+    const after = await (await fetch(`${base}/api/providers`)).json();
+    assert.equal(after.providers.find((p) => p.id === 'deepseek').hasKey, false);
+  } finally {
+    await instance.close();
+  }
+});
+

package/harness/tamnora.example.json

@@ -53,7 +53,7 @@
     "enabled": true,
     "allow": ["npm", "node", "npx", "pnpm", "yarn", "bun", "php", "python", "composer"]
   },
-  "preview": { "provider": "tailscale", "tailscalePort": 8443, "fallback": true },
+  "preview": { "provider": "tailscale", "tailscalePort": 8443, "fallback": false },
   "telegram": { "token": "", "allowedChatIds": [], "transcribeModel": "whisper-1" },
   "agents": { "maxRounds": 6 }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",