@danieltmn/tamnora 0.21.1 → 0.22.0

package/harness/packages/server/test/server.test.js

@@ -1,2878 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import http from 'node:http';
-import { execFileSync } from 'node:child_process';
-import { mkdtemp, mkdir, writeFile, readFile, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { createTamnoraServer } from '../src/index.js';
-import { setHome, ensureApp, readApp, writeApp, makeUser, screenshotsDir } from '../../core/src/index.js';
-import { completionFooter } from '../src/lib/channels/telegram.js';
-
-const fakeProvider = {
-  id: 'fake',
-  async streamChat(_config, { onEvent }) {
-    onEvent?.({ type: 'text', delta: 'hola', full: 'hola' });
-    return { content: 'hola', reasoning: '', toolCalls: [] };
-  },
-};
-
-async function startServer(overrides = {}) {
-  const cwd = overrides.cwd ?? (await mkdtemp(path.join(tmpdir(), 'tamnora-srv-')));
-  setHome(cwd);
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-    ...overrides,
-  });
-  const info = await instance.listen({ port: 0 });
-  return { instance, base: info.url };
-}
-
-const HAS_GIT = (() => {
-  try {
-    execFileSync('git', ['--version'], { stdio: 'ignore' });
-    return true;
-  } catch {
-    return false;
-  }
-})();
-
-function gitInit(root) {
-  execFileSync('git', ['init', '-q'], { cwd: root });
-  execFileSync('git', ['config', 'user.email', 'test@tamnora.dev'], { cwd: root });
-  execFileSync('git', ['config', 'user.name', 'Test'], { cwd: root });
-}
-
-test('serves health, providers and the console', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const health = await (await fetch(`${base}/api/health`)).json();
-    assert.equal(health.ok, true);
-    assert.equal(health.name, 'tamnora');
-
-    const providers = await (await fetch(`${base}/api/providers`)).json();
-    assert.ok(providers.providers.some((p) => p.id === 'openrouter'));
-    assert.equal(providers.active.provider, 'openrouter');
-
-    const html = await (await fetch(`${base}/`)).text();
-    assert.match(html, /Tamnora Console/);
-    for (const hook of [
-      'data-panel="agente"',
-      'data-panel="sesiones"',
-      'id="settings-controls-slot"',
-      'id="slash-menu"',
-      'id="statusbar"',
-      'id="sb-activity"',
-      // Nueva sesion tambien en el topbar: en movil el sidebar es un drawer y
-      // crear una sesion eran varios toques.
-      'id="new-session-top"',
-    ]) {
-      assert.ok(html.includes(hook), `falta ${hook}`);
-    }
-    // El boton del topbar tiene que estar en el header, no escondido en el
-    // drawer (que es donde vive `#new-session`).
-    const header = html.slice(0, html.indexOf('<main'));
-    assert.ok(header.includes('id="new-session-top"'), 'nueva sesion deberia estar en el topbar');
-    assert.equal((html.match(/id="new-session-top"/g) ?? []).length, 1);
-    assert.equal((html.match(/id="new-session"/g) ?? []).length, 1);
-    // Los controles de agente se declaran una sola vez (se mueven entre slots).
-    assert.equal((html.match(/id="mode"/g) ?? []).length, 1);
-
-    const missing = await fetch(`${base}/api/nope`);
-    assert.equal(missing.status, 404);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('creates, lists, reads and deletes sessions', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ title: 'Prueba', model: 'm' }),
-      })
-    ).json();
-    assert.ok(created.session.id);
-
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(list.sessions.length, 1);
-    assert.equal(list.sessions[0].title, 'Prueba');
-
-    const detail = await (await fetch(`${base}/api/sessions/${created.session.id}`)).json();
-    assert.deepEqual(detail.messages, []);
-
-    const deleted = await fetch(`${base}/api/sessions/${created.session.id}`, { method: 'DELETE' });
-    assert.equal(deleted.status, 200);
-    const afterList = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(afterList.sessions.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('lists and deletes sessions grouped by project (cwd)', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proj-'));
-  const dirA = path.join(cwd, 'a');
-  const dirB = path.join(cwd, 'b');
-  await mkdir(dirA);
-  await mkdir(dirB);
-  const { instance, base } = await startServer({ cwd });
-  const create = (body) =>
-    fetch(`${base}/api/sessions`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-    });
-  try {
-    await create({ title: 'a1', model: 'm', cwd: dirA });
-    await create({ title: 'a2', model: 'm', cwd: dirA });
-    await create({ title: 'b1', model: 'm', cwd: dirB });
-
-    const projects = await (await fetch(`${base}/api/projects`)).json();
-    assert.equal(projects.projects.find((p) => p.cwd === dirA).sessions, 2);
-    assert.equal(projects.projects.find((p) => p.cwd === dirB).sessions, 1);
-
-    const removed = await (
-      await fetch(`${base}/api/projects?cwd=${encodeURIComponent(dirA)}`, { method: 'DELETE' })
-    ).json();
-    assert.equal(removed.sessions, 2);
-
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(list.sessions.length, 1);
-    assert.equal(list.sessions[0].cwd, dirB);
-
-    const missing = await fetch(`${base}/api/projects`, { method: 'DELETE' });
-    assert.equal(missing.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('cada sesión recuerda su propio tipo de agente (proveedor/modelo/modo)', async () => {
-  const calls = [];
-  const provider = {
-    id: 'recorder',
-    async streamChat(_config, { model }) {
-      calls.push(model);
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  const create = (body) =>
-    fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify(body) }).then((r) => r.json());
-  const chat = (sessionId, body = {}) =>
-    fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', sessionId, ...body }),
-    }).then((r) => r.text());
-  try {
-    const a = await create({ title: 'A', provider: 'openrouter', model: 'modelo-a', mode: 'plan' });
-    const b = await create({ title: 'B', provider: 'openai', model: 'modelo-b' });
-    assert.equal(a.session.mode, 'plan');
-
-    // Aunque el cuerpo no manda modelo, cada sesión corre con el suyo.
-    await chat(a.session.id);
-    await chat(b.session.id);
-    assert.deepEqual(calls, ['modelo-a', 'modelo-b']);
-
-    // El tipo de agente se puede fijar sin correr (PUT) y se persiste.
-    const updated = await (
-      await fetch(`${base}/api/sessions/${b.session.id}`, {
-        method: 'PUT',
-        headers: json,
-        body: JSON.stringify({ provider: 'openrouter', model: 'modelo-c', mode: 'agent' }),
-      })
-    ).json();
-    assert.equal(updated.session.model, 'modelo-c');
-    assert.equal(updated.session.mode, 'agent');
-
-    await chat(b.session.id);
-    assert.equal(calls.at(-1), 'modelo-c');
-
-    // El default global no se toca por cambiar el de una sesión.
-    const settings = await (await fetch(`${base}/api/settings`)).json();
-    assert.notEqual(settings.settings.model, 'modelo-c');
-  } finally {
-    await instance.close();
-  }
-});
-
-
-test('streams a chat turn over SSE and persists the messages', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'hola', model: 'm' }),
-    });
-    assert.equal(res.status, 200);
-    assert.match(res.headers.get('content-type'), /text\/event-stream/);
-    const text = await res.text();
-    assert.match(text, /event: start/);
-    assert.match(text, /event: text/);
-    assert.match(text, /event: done/);
-
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(list.sessions.length, 1);
-    const detail = await (await fetch(`${base}/api/sessions/${list.sessions[0].id}`)).json();
-    const assistant = detail.messages.find((m) => m.role === 'assistant');
-    assert.equal(assistant.content, 'hola');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('persists the run log and replays it on the stream endpoint', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ input: 'hola', model: 'm' }),
-      })
-    ).text();
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    const id = list.sessions[0].id;
-
-    const stream = await (await fetch(`${base}/api/sessions/${id}/stream?from=0`)).text();
-    assert.match(stream, /event: start/);
-    assert.match(stream, /event: text/);
-    assert.match(stream, /event: done/);
-    assert.match(stream, /event: idle/);
-    assert.match(stream, /^id: \d+$/m);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('keeps a run alive after the client disconnects and can stop it', async () => {
-  let release;
-  const gate = new Promise((resolve) => (release = resolve));
-  const slowProvider = {
-    id: 'slow',
-    async streamChat(_config, { onEvent, signal }) {
-      onEvent?.({ type: 'text', delta: '…', full: '…' });
-      await new Promise((resolve, reject) => {
-        if (signal?.aborted) return reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
-        signal?.addEventListener('abort', () =>
-          reject(Object.assign(new Error('aborted'), { name: 'AbortError' }))
-        );
-        gate.then(resolve);
-      });
-      return { content: 'fin', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: slowProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ model: 'm' }),
-      })
-    ).json();
-    const id = created.session.id;
-
-    const controller = new AbortController();
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-      signal: controller.signal,
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 80));
-    controller.abort();
-    await chat;
-
-    const during = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.equal(during.running, true);
-
-    const stopped = await (
-      await fetch(`${base}/api/sessions/${id}/stop`, { method: 'POST', headers: json })
-    ).json();
-    assert.equal(stopped.stopped, true);
-
-    release();
-    await new Promise((resolve) => setTimeout(resolve, 80));
-    const after = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.equal(after.running, false);
-  } finally {
-    release();
-    await instance.close();
-  }
-});
-
-test('interrupt cancels the running turn and starts the new message right away', async () => {
-  const calls = { n: 0 };
-  let abortedFirst = false;
-  const provider = {
-    id: 'interrupt',
-    async streamChat(_config, { onEvent, signal }) {
-      calls.n += 1;
-      if (calls.n === 1) {
-        onEvent?.({ type: 'text', delta: 'trabajando', full: 'trabajando' });
-        await new Promise((resolve, reject) => {
-          const timer = setTimeout(resolve, 5000);
-          const onAbort = () => {
-            clearTimeout(timer);
-            abortedFirst = true;
-            reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
-          };
-          if (signal?.aborted) return onAbort();
-          signal?.addEventListener('abort', onAbort, { once: true });
-        });
-      }
-      onEvent?.({ type: 'text', delta: 'listo', full: 'listo' });
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ model: 'm' }),
-      })
-    ).json();
-    const id = created.session.id;
-
-    const first = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'uno', model: 'm', sessionId: id }),
-    })
-      .then((res) => res.text())
-      .catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 80));
-
-    const second = await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ input: 'dos', model: 'm', sessionId: id, interrupt: true }),
-      })
-    ).text();
-
-    assert.match(second, /event: text/);
-    assert.match(second, /listo/);
-    assert.equal(abortedFirst, true);
-    await first;
-
-    await new Promise((resolve) => setTimeout(resolve, 60));
-    const after = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.equal(after.running, false);
-  } finally {
-    await instance.close();
-  }
-});
-
-/** Lee un SSE hasta que `until(data)` se cumpla, y devuelve lo acumulado. */
-async function readSse(url, options, until, timeoutMs = 5000) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const frames = [];
-  try {
-    const res = await fetch(url, { ...options, signal: controller.signal });
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    for (;;) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let index;
-      while ((index = buffer.indexOf('\n\n')) !== -1) {
-        const frame = buffer.slice(0, index);
-        buffer = buffer.slice(index + 2);
-        let event = null;
-        let data = '';
-        for (const line of frame.split('\n')) {
-          if (line.startsWith('event:')) event = line.slice(6).trim();
-          else if (line.startsWith('data:')) data += line.slice(5).trim();
-        }
-        if (!event) continue;
-        const parsed = data ? JSON.parse(data) : {};
-        frames.push({ event, data: parsed });
-        if (until(parsed, event)) return frames;
-      }
-    }
-  } catch (error) {
-    if (error?.name !== 'AbortError') throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-  return frames;
-}
-
-test('the global channel announces run_start and run_end to another client', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    // Cliente B: abre el canal global antes de que arranque nada.
-    const events = readSse(`${base}/api/events`, {}, (data, event) => event === 'run_end');
-    await new Promise((resolve) => setTimeout(resolve, 50));
-
-    // Cliente A: pide una tarea.
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-      })
-    ).text();
-
-    const frames = await events;
-    const names = frames.map((frame) => frame.event);
-    assert.deepEqual(names[0], 'snapshot');
-    assert.ok(names.includes('run_start'), 'esperaba run_start');
-    assert.ok(names.includes('run_end'), 'esperaba run_end');
-
-    const start = frames.find((frame) => frame.event === 'run_start');
-    const end = frames.find((frame) => frame.event === 'run_end');
-    assert.equal(start.data.sessionId, id);
-    assert.equal(end.data.sessionId, id);
-    assert.ok(typeof end.data.durationMs === 'number');
-
-    // El canal global no debe filtrar el detalle del turno: eso va por el
-    // stream de la sesion, o seria duplicarlo.
-    for (const detail of ['start', 'user', 'text', 'tool_call', 'done']) {
-      assert.ok(!names.includes(detail), `el canal global no debe emitir ${detail}`);
-    }
-  } finally {
-    await instance.close();
-  }
-});
-
-test('connecting to the global channel mid-run returns it in the snapshot', async () => {
-  let release;
-  const gate = new Promise((resolve) => (release = resolve));
-  const slowProvider = {
-    id: 'slow',
-    async streamChat() {
-      await gate;
-      return { content: 'fin', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: slowProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 120));
-
-    // Cliente nuevo: el snapshot tiene que informarle que hay un run vivo, y
-    // por eso el cliente se engancha sin que nadie le avise.
-    const frames = await readSse(`${base}/api/events`, {}, (data, event) => event === 'snapshot');
-    assert.equal(frames[0].event, 'snapshot');
-    assert.ok(frames[0].data.active.includes(id), 'el snapshot deberia listar la sesion activa');
-
-    release();
-    await chat;
-  } finally {
-    release();
-    await instance.close();
-  }
-});
-
-test('the session list reports which sessions are running', async () => {
-  let release;
-  const gate = new Promise((resolve) => (release = resolve));
-  const slowProvider = {
-    id: 'slow',
-    async streamChat() {
-      await gate;
-      return { content: 'fin', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: slowProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    const idle = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(idle.sessions.find((session) => session.id === id).running, false);
-
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 120));
-
-    const busy = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(busy.sessions.find((session) => session.id === id).running, true);
-
-    release();
-    await chat;
-  } finally {
-    release();
-    await instance.close();
-  }
-});
-
-test('resuming a run from a cursor replays only what was missed', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-      })
-    ).text();
-
-    const full = await (await fetch(`${base}/api/sessions/${id}/stream?from=0`)).text();
-    const ids = [...full.matchAll(/^id: (\d+)$/gm)].map((match) => Number(match[1]));
-    assert.ok(ids.length > 2, 'esperaba varios eventos con id');
-    const last = ids[ids.length - 1];
-
-    // Cliente que se cortó justo antes del ultimo evento: al volver no debe
-    // recibir lo que ya tenia.
-    const tail = await (await fetch(`${base}/api/sessions/${id}/stream?from=${last - 1}`)).text();
-    const tailIds = [...tail.matchAll(/^id: (\d+)$/gm)].map((match) => Number(match[1]));
-    assert.deepEqual(tailIds, [last]);
-
-    // Y el log del run no secontamination con el canal global.
-    assert.ok(!/event: run_start/.test(full));
-    assert.ok(!/event: run_end/.test(full));
-  } finally {
-    await instance.close();
-  }
-});
-
-test('a pending permission is visible to any client, not only the one streaming', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-ask-'));
-  let calls = 0;
-  const provider = {
-    id: 'tooly',
-    async streamChat() {
-      calls += 1;
-      if (calls === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [{ id: 'call_1', function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'hi' }) } }],
-        };
-      }
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    // Cliente B: canal global abierto, sin ningun stream de la sesion.
-    const seen = [];
-    const watching = readSse(`${base}/api/events`, {}, (data, event) => event === 'permission');
-    await new Promise((resolve) => setTimeout(resolve, 50));
-
-    // Cliente A: pide la tarea y se queda esperando el permiso.
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'crea nota.txt', model: 'm', sessionId: id }),
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 200));
-
-    const frames = await watching;
-    const permission = frames.find((frame) => frame.event === 'permission');
-    assert.ok(permission, 'el canal global deberia avisar del permiso');
-    assert.equal(permission.data.sessionId, id);
-    assert.equal(permission.data.name, 'write');
-    seen.push(permission.data.askId);
-
-    // Y tambien se puede consultar, que es lo que cubre una recarga de pagina.
-    const list = await (await fetch(`${base}/api/permissions`)).json();
-    assert.equal(list.pending.length, 1);
-    assert.equal(list.pending[0].askId, permission.data.askId);
-    assert.equal(list.pending[0].sessionId, id);
-    assert.deepEqual(list.pending[0].args, { path: 'nota.txt', content: 'hi' });
-
-    const scoped = await (await fetch(`${base}/api/permissions?sessionId=${id}`)).json();
-    assert.equal(scoped.pending.length, 1);
-    const other = await (await fetch(`${base}/api/permissions?sessionId=otra`)).json();
-    assert.equal(other.pending.length, 0);
-
-    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.equal(detail.permissions.length, 1, 'el detalle debe traer los pendientes para reengancharse');
-    const listSessions = await (await fetch(`${base}/api/sessions`)).json();
-    assert.equal(listSessions.sessions.find((s) => s.id === id).awaiting, 1);
-
-    const decision = await (
-      await fetch(`${base}/api/permissions/${permission.data.askId}`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ allow: true }),
-      })
-    ).json();
-    assert.equal(decision.ok, true);
-
-    const after = await (await fetch(`${base}/api/permissions`)).json();
-    assert.equal(after.pending.length, 0);
-    await chat;
-  } finally {
-    await instance.close();
-  }
-});
-
-/**
- * Espera a que la sesion se quede sin run.
- *
- * Hace falta antes de `instance.close()`: un run que sigue vivo emite `aborted`
- * en otro tick y escribe sobre la base ya cerrada.
- */
-async function waitIdle(base, id, attempts = 60) {
-  for (let i = 0; i < attempts; i += 1) {
-    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    if (!detail.running) return true;
-    await fetch(`${base}/api/sessions/${id}/stop`, { method: 'POST' }).catch(() => {});
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  return false;
-}
-
-test('/api/state carries liveness and pending permissions in one request', async () => {
-  let release;
-  const gate = new Promise((resolve) => (release = resolve));
-  let calls = 0;
-  const provider = {
-    id: 'tooly',
-    async streamChat() {
-      calls += 1;
-      if (calls === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [{ id: 'call_1', function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'hi' }) } }],
-        };
-      }
-      await gate;
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    const idle = await (await fetch(`${base}/api/state`)).json();
-    assert.equal(idle.sessions.find((s) => s.id === id).running, false);
-    assert.equal(idle.sessions.find((s) => s.id === id).awaiting, 0);
-    assert.deepEqual(idle.permissions, []);
-    assert.equal(typeof idle.now, 'number');
-    // El snapshot no lleva mensajes: es lo que se puede pedir seguido.
-    assert.equal(idle.sessions[0].messages, undefined);
-
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'crea nota.txt', model: 'm', sessionId: id }),
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 200));
-
-    // Un permiso creado despues aparece en el siguiente read: esto es lo que
-    // hace que la consola se recupere sin ningun SSE.
-    const busy = await (await fetch(`${base}/api/state`)).json();
-    const session = busy.sessions.find((s) => s.id === id);
-    assert.equal(session.running, true);
-    assert.equal(session.awaiting, 1);
-    assert.equal(busy.permissions.length, 1);
-    assert.equal(busy.permissions[0].name, 'write');
-    assert.deepEqual(busy.permissions[0].args, { path: 'nota.txt', content: 'hi' });
-    assert.equal(busy.permissions[0].sessionId, id);
-
-    const askId = busy.permissions[0].askId;
-    await fetch(`${base}/api/permissions/${askId}`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ allow: true }),
-    });
-
-    const after = await (await fetch(`${base}/api/state`)).json();
-    assert.deepEqual(after.permissions, []);
-    assert.equal(after.sessions.find((s) => s.id === id).awaiting, 0);
-
-    release();
-    await chat;
-    await waitIdle(base, id);
-  } finally {
-    release();
-    await instance.close();
-  }
-});
-
-test('a client with no streams at all can find and resolve a permission', async () => {
-  // El escenario que reporto el celular: sin stream de sesion y sin canal global.
-  let release;
-  const gate = new Promise((resolve) => (release = resolve));
-  let calls = 0;
-  const provider = {
-    id: 'tooly',
-    async streamChat() {
-      calls += 1;
-      if (calls === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [{ id: 'call_1', function: { name: 'bash', arguments: JSON.stringify({ command: 'ls' }) } }],
-        };
-      }
-      await gate;
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'lista los archivos', model: 'm', sessionId: id }),
-    }).catch(() => null);
-    await new Promise((resolve) => setTimeout(resolve, 200));
-
-    // Solo requests cortos: es lo que sobrevive en un enlace movil.
-    const state = await (await fetch(`${base}/api/state`)).json();
-    assert.equal(state.permissions.length, 1);
-    assert.equal(state.permissions[0].name, 'bash');
-
-    const decision = await (
-      await fetch(`${base}/api/permissions/${state.permissions[0].askId}`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ allow: true, scope: 'once' }),
-      })
-    ).json();
-    assert.equal(decision.ok, true);
-    assert.deepEqual((await (await fetch(`${base}/api/state`)).json()).permissions, []);
-
-    release();
-    await chat;
-    await waitIdle(base, id);
-  } finally {
-    release();
-    await instance.close();
-  }
-});
-
-test('approving clears the permission instead of bringing it back', async () => {
-  // El sintoma era "le doy que si y me vuelve a pedir lo mismo". Dos causas
-  // distintas y esta las separa: el server vacia el estado al resolver, y una
-  // peticion nueva del agente es un `askId` nuevo (no el mismo permiso
-  // revivido).
-  let round = 0;
-  const provider = {
-    id: 'loopish',
-    async streamChat() {
-      round += 1;
-      if (round <= 3) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [{ id: `c${round}`, function: { name: 'bash', arguments: JSON.stringify({ command: `echo paso-${round}` }) } }],
-        };
-      }
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ model: 'm' }) })
-    ).json();
-    const id = created.session.id;
-    const chat = fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hacé tres pasos', model: 'm', sessionId: id }),
-    }).catch(() => null);
-
-    const approved = [];
-    for (let i = 0; i < 40 && approved.length < 3; i += 1) {
-      await new Promise((resolve) => setTimeout(resolve, 100));
-      const state = await (await fetch(`${base}/api/state`)).json();
-      for (const ask of state.permissions) {
-        const decision = await fetch(`${base}/api/permissions/${ask.askId}`, {
-          method: 'POST',
-          headers: json,
-          body: JSON.stringify({ allow: true }),
-        });
-        assert.equal(decision.status, 200);
-        approved.push(ask.askId);
-        // Inmediatamente despues de resolver, ese permiso no queda pendiente: si
-        // volviera, el cliente lo re-pintaria en bucle. (Puede haber otro askId
-        // nuevo del siguiente paso, pero el resuelto no puede reaparecer.)
-        const after = await (await fetch(`${base}/api/state`)).json();
-        assert.ok(
-          !after.permissions.some((p) => p.askId === ask.askId),
-          'el permiso resuelto no debe reaparecer'
-        );
-      }
-    }
-    // Tres peticiones del agente -> tres askId distintos, ninguno revivido.
-    assert.equal(approved.length, 3);
-    assert.equal(new Set(approved).size, 3);
-
-    await waitIdle(base, id);
-    await chat;
-  } finally {
-    await instance.close();
-  }
-});
-
-test('resolving a permission that no longer exists reports 404', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    // Un askId inventado: la tarjeta era vieja. Con esto el cliente puede
-    // decir "ya no aplica" en vez de dejar el permiso esperando.
-    const res = await fetch(`${base}/api/permissions/inexistente`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ allow: true }),
-    });
-    assert.equal(res.status, 404);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('done reports max_rounds and the tool count when the model never answers', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-loop-'));
-  await writeFile(path.join(cwd, 'a.txt'), 'hola');
-  let seq = 0;
-  const provider = {
-    id: 'loop',
-    async streamChat() {
-      seq += 1;
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          { id: `call_${seq}`, function: { name: 'read', arguments: JSON.stringify({ path: 'a.txt' }) } },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const sse = await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ input: 'leé', model: 'm', maxRounds: 2 }),
-      })
-    ).text();
-    assert.match(sse, /event: done/);
-    assert.match(sse, /"stopReason":"max_rounds"/);
-    const match = sse.match(/"toolCalls":(\d+)/);
-    assert.ok(match && Number(match[1]) >= 2, 'el done debe reportar las tools usadas');
-    assert.match(sse, /"durationMs":\d+/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('completionFooter resume el cierre del turno', () => {
-  assert.equal(completionFooter('end_turn', 1, 0, 0), '✓ terminado · 1 ronda');
-  assert.equal(completionFooter('end_turn', 3, 5, 1200), '✓ terminado · 3 rondas · 5 herramientas · 1.2s');
-  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ corte de seguridad · 2 rondas · 2 herramientas · 300ms$/);
-  assert.match(completionFooter('no_progress', 2, 2, 300), /^⚠ corte de seguridad/);
-});
-
-test('configures Telegram from the console (masked token)', async () => {
-  const { instance, base } = await startServer({ telegram: false });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    let data = await (await fetch(`${base}/api/channels`)).json();
-    assert.equal(data.telegram.tokenSet, false);
-    assert.equal(data.telegram.transcribeModel, 'whisper-1');
-
-    let res = await fetch(`${base}/api/channels/telegram`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ allowedChatIds: '123, 456', transcribeModel: '' }),
-    });
-    data = await res.json();
-    assert.deepEqual(data.telegram.allowedChatIds, ['123', '456']);
-    assert.equal(data.telegram.transcribeModel, 'whisper-1');
-
-    res = await fetch(`${base}/api/channels/telegram`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ token: '123456:ABCDEFghij', transcribeProvider: 'openai' }),
-    });
-    data = await res.json();
-    assert.equal(data.telegram.tokenSet, true);
-    assert.equal(data.telegram.transcribeProvider, 'openai');
-    assert.match(data.telegram.tokenHint, /ghij$/);
-    assert.doesNotMatch(JSON.stringify(data), /ABCDEF/);
-
-    // Mandar la mascara no pisa el token real.
-    res = await fetch(`${base}/api/channels/telegram`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ token: data.telegram.tokenHint, allowedChatIds: ['1'] }),
-    });
-    data = await res.json();
-    assert.equal(data.telegram.tokenSet, true);
-    assert.match(data.telegram.tokenHint, /ghij$/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('manages MCP servers from the console', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    let data = await (await fetch(`${base}/api/mcp`)).json();
-    assert.deepEqual(data.servers, []);
-
-    let res = await fetch(`${base}/api/mcp/servers/echo`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ name: 'Echo', transport: 'stdio', command: 'node', args: ['a.mjs'], enabled: true }),
-    });
-    assert.equal(res.status, 200);
-    data = await res.json();
-    const echo = data.servers.find((s) => s.id === 'echo');
-    assert.equal(echo.source, 'store');
-    assert.deepEqual(echo.args, ['a.mjs']);
-
-    const bad = await fetch(`${base}/api/mcp/servers/bad`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ transport: 'http' }),
-    });
-    assert.equal(bad.status, 400);
-
-    res = await fetch(`${base}/api/mcp/servers/echo`, { method: 'DELETE' });
-    assert.equal(res.status, 200);
-    data = await res.json();
-    assert.equal(data.servers.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('sirve el catálogo de MCP/skills y los instala deshabilitados', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const catalog = await (await fetch(`${base}/api/mcp/catalog`)).json();
-    assert.ok(catalog.catalog.some((e) => e.id === 'playwright' && e.installed === false));
-
-    const add = await fetch(`${base}/api/mcp/import`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ catalog: 'playwright' }),
-    });
-    assert.equal(add.status, 200);
-    const added = await add.json();
-    assert.equal(added.imported, 'playwright');
-    assert.equal(added.servers.find((s) => s.id === 'playwright').enabled, false);
-
-    const again = await (await fetch(`${base}/api/mcp/catalog`)).json();
-    assert.equal(again.catalog.find((e) => e.id === 'playwright').installed, true);
-
-    const skills = await (await fetch(`${base}/api/skills/catalog`)).json();
-    assert.ok(skills.catalog.some((e) => e.id === 'code-review' && e.installed === false));
-    const skillAdd = await fetch(`${base}/api/skills`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ id: 'code-review' }),
-    });
-    assert.equal(skillAdd.status, 200);
-    const skillData = await skillAdd.json();
-    assert.equal(skillData.installed, 'code-review');
-    assert.equal(skillData.skills.find((s) => s.id === 'code-review').enabled, false);
-
-    const unknown = await fetch(`${base}/api/mcp/import`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ catalog: 'nope' }),
-    });
-    assert.equal(unknown.status, 404);
-    const unknownSkill = await fetch(`${base}/api/skills`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ id: 'nope' }),
-    });
-    assert.equal(unknownSkill.status, 404);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('los buscadores devuelven vacío sin query', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const mcp = await (await fetch(`${base}/api/mcp/search`)).json();
-    assert.deepEqual(mcp.results, []);
-    const skills = await (await fetch(`${base}/api/skills/search`)).json();
-    assert.deepEqual(skills.results, []);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('MCP: el env se enmascara y no se pisa al guardar sin cambios', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    await fetch(`${base}/api/mcp/servers/db`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({
-        name: 'DB',
-        transport: 'stdio',
-        command: 'node',
-        args: ['db.mjs'],
-        env: { MYSQL_HOST: 'localhost', MYSQL_PASSWORD: 'supersecret' },
-      }),
-    });
-
-    let data = await (await fetch(`${base}/api/mcp`)).json();
-    const db = data.servers.find((s) => s.id === 'db');
-    assert.equal(db.env.MYSQL_HOST, 'localhost');
-    assert.equal(db.env.MYSQL_PASSWORD, '••••cret');
-
-    // Un toggle manda de vuelta el env enmascarado: no debe pisar el secreto.
-    await fetch(`${base}/api/mcp/servers/db`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({
-        name: db.name,
-        transport: 'stdio',
-        command: db.command,
-        args: db.args,
-        env: db.env,
-        enabled: false,
-      }),
-    });
-    const stored = instance.store.listMcpServers().find((s) => s.id === 'db');
-    assert.equal(stored.config.env.MYSQL_PASSWORD, 'supersecret');
-    assert.equal(stored.enabled, false);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('guarda los límites del agente desde Ajustes', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const res = await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ maxRounds: 20, maxTokens: 50000, maxDurationMs: 600000 }),
-    });
-    const data = await res.json();
-    assert.equal(data.settings.maxRounds, 20);
-    assert.equal(data.settings.maxTokens, 50000);
-    assert.equal(data.settings.maxDurationMs, 600000);
-
-    const again = await (await fetch(`${base}/api/settings`)).json();
-    assert.equal(again.settings.maxRounds, 20);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('guarda el modo de carga y las tools fijas de MCP', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const res = await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ mcpMode: 'lazy', mcpPinned: 'mcp__postgres__query, postgres' }),
-    });
-    const data = await res.json();
-    assert.equal(data.settings.mcpMode, 'lazy');
-    assert.deepEqual(data.settings.mcpPinned, ['mcp__postgres__query', 'postgres']);
-
-    const mcp = await (await fetch(`${base}/api/mcp`)).json();
-    assert.equal(mcp.mode, 'lazy');
-    assert.deepEqual(mcp.pinned, ['mcp__postgres__query', 'postgres']);
-    assert.equal(mcp.threshold, 12);
-    assert.equal(mcp.toolCount, null);
-
-    const bad = await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ mcpMode: 'nope' }),
-    });
-    assert.equal((await bad.json()).settings.mcpMode, 'auto');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('imports an MCP server from a JSON snippet', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const res = await fetch(`${base}/api/mcp/import`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ json: '{"mcpServers":{"demo":{"command":"npx","args":["-y","pkg"]}}}' }),
-    });
-    assert.equal(res.status, 200);
-    const data = await res.json();
-    assert.equal(data.imported, 'demo');
-    assert.ok(data.servers.some((s) => s.id === 'demo' && s.transport === 'stdio'));
-  } finally {
-    await instance.close();
-  }
-});
-
-test('rejects unknown import refs (skills and mcpservers.org)', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const badSkill = await fetch(`${base}/api/skills/import`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ ref: 'nope' }),
-    });
-    assert.equal(badSkill.status, 400);
-
-    const blocked = await fetch(`${base}/api/mcp/import`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ url: 'https://mcpservers.org/es/official' }),
-    });
-    assert.equal(blocked.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('manages skills from the console', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  const put = (id, body) => fetch(`${base}/api/skills/${id}`, { method: 'PUT', headers: json, body: JSON.stringify(body) });
-  try {
-    let res = await put('demo', { name: 'Demo', description: 'para pruebas', body: 'Hacé X.' });
-    assert.equal(res.status, 200);
-    let data = await res.json();
-    const demo = data.skills.find((s) => s.id === 'demo');
-    assert.equal(demo.enabled, true);
-    assert.equal(demo.removable, true);
-
-    const detail = await (await fetch(`${base}/api/skills/demo`)).json();
-    assert.match(detail.skill.body, /Hacé X/);
-
-    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
-    data = await (await fetch(`${base}/api/skills`)).json();
-    assert.equal(data.skills.find((s) => s.id === 'demo').enabled, false);
-
-    res = await fetch(`${base}/api/skills/demo`, { method: 'DELETE' });
-    assert.equal(res.status, 200);
-    data = await (await fetch(`${base}/api/skills`)).json();
-    assert.equal(data.skills.length, 0);
-
-    res = await put('vacia', { body: '   ' });
-    assert.equal(res.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('skills: indice lazy por defecto (sin body)', async () => {
-  let captured = '';
-  const captureProvider = {
-    id: 'capture',
-    async streamChat(_config, { messages }) {
-      captured = messages?.[0]?.content ?? '';
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: captureProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  const chat = (sessionId) =>
-    fetch(`${base}/api/chat`, { method: 'POST', headers: json, body: JSON.stringify({ sessionId, model: 'm', input: 'hola' }) });
-  const newSession = async () => {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
-    ).json();
-    return created.session.id;
-  };
-  try {
-    await fetch(`${base}/api/skills/demo`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ name: 'Demo', body: 'Regla secreta de la skill.' }),
-    });
-
-    // Lazy: se inyecta el indice (id), no el cuerpo.
-    await (await chat(await newSession())).text();
-    assert.match(captured, /demo/);
-    assert.doesNotMatch(captured, /Regla secreta de la skill/);
-
-    // Deshabilitada: no aparece ni en el indice.
-    await fetch(`${base}/api/skills/demo/toggle`, { method: 'POST' });
-    await (await chat(await newSession())).text();
-    assert.doesNotMatch(captured, /demo/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('manages project memory from the console', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-mem-'));
-  const { instance, base } = await startServer({ cwd });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    let res = await fetch(`${base}/api/memory/arquitectura`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ title: 'Arquitectura', body: 'Usa SQLite.' }),
-    });
-    assert.equal(res.status, 200);
-    let data = await res.json();
-    assert.equal(data.topics.length, 1);
-    assert.match(data.index, /arquitectura\.md/);
-
-    const detail = await (await fetch(`${base}/api/memory/arquitectura`)).json();
-    assert.match(detail.topic.body, /Usa SQLite/);
-
-    await fetch(`${base}/api/memory`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ index: '# Memoria\n\n- propio' }),
-    });
-    data = await (await fetch(`${base}/api/memory`)).json();
-    assert.match(data.index, /propio/);
-
-    res = await fetch(`${base}/api/memory/arquitectura`, { method: 'DELETE' });
-    assert.equal(res.status, 200);
-    data = await res.json();
-    assert.equal(data.topics.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('project memory is injected into the system prompt', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-mem-prompt-'));
-  await mkdir(path.join(cwd, '.tamnora', 'memory'), { recursive: true });
-  await writeFile(path.join(cwd, '.tamnora', 'memory', 'MEMORY.md'), '# Memoria\n\n- [Dato](dato.md) — clave\n');
-  let captured = '';
-  const provider = {
-    id: 'capture',
-    async streamChat(_config, { messages }) {
-      captured = messages?.[0]?.content ?? '';
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
-    ).json();
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'hola' }),
-      })
-    ).text();
-    assert.match(captured, /Memoria del proyecto/);
-    assert.match(captured, /dato\.md/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('the memory tool writes project memory', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-mem-tool-'));
-  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ permissions: { memory: 'allow' } }));
-  const provider = {
-    id: 'memtool',
-    async streamChat(_config, { messages }) {
-      if (messages.some((m) => m.role === 'tool' && m.name === 'memory')) {
-        return { content: 'listo', reasoning: '', toolCalls: [] };
-      }
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          {
-            id: '1',
-            type: 'function',
-            function: { name: 'memory', arguments: JSON.stringify({ action: 'write', topic: 'nota', content: 'Hola memoria.' }) },
-          },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
-    ).json();
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'recordá esto' }),
-      })
-    ).text();
-    const file = await readFile(path.join(cwd, '.tamnora', 'memory', 'nota.md'), 'utf8');
-    assert.match(file, /Hola memoria/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('rules by path are injected (transiently) when a tool touches a matching file', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-rules-inject-'));
-  await mkdir(path.join(cwd, '.tamnora', 'rules'), { recursive: true });
-  await writeFile(path.join(cwd, '.tamnora', 'rules', 'estilo.md'), '---\npaths: src/**\n---\nMARCADOR_ESTILO: usá 2 espacios.');
-  await mkdir(path.join(cwd, 'src'), { recursive: true });
-  await writeFile(path.join(cwd, 'src', 'index.js'), 'export const x = 1;\n');
-  let captured = null;
-  const provider = {
-    id: 'rules',
-    async streamChat(_config, { messages }) {
-      if (messages.some((m) => m.role === 'tool' && m.name === 'read')) {
-        captured = messages;
-        return { content: 'ok', reasoning: '', toolCalls: [] };
-      }
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          { id: 'r1', type: 'function', function: { name: 'read', arguments: JSON.stringify({ path: 'src/index.js' }) } },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
-    ).json();
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'mirá src/index.js' }),
-      })
-    ).text();
-    assert.ok(captured, 'el provider no recibió una segunda ronda');
-    assert.ok(
-      captured.some((m) => m.role === 'system' && /MARCADOR_ESTILO/.test(m.content)),
-      'no se inyectó la regla por path'
-    );
-    // No se persiste: el historial guardado no incluye la regla efímera.
-    const session = await (await fetch(`${base}/api/sessions/${created.session.id}`)).json();
-    assert.ok(
-      session.messages.every((m) => !(m.role === 'system' && /MARCADOR_ESTILO/.test(String(m.content ?? '')))),
-      'la regla efímera se persistió en el historial'
-    );
-  } finally {
-    await instance.close();
-  }
-});
-
-test('manages scheduled tasks from the console', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  const create = (body) => fetch(`${base}/api/schedules`, { method: 'POST', headers: json, body: JSON.stringify(body) });
-  try {
-    let res = await create({ id: 'nightly', type: 'agent', spec: 'daily 03:00', prompt: 'hacé el resumen' });
-    assert.equal(res.status, 201);
-    let data = await res.json();
-    assert.equal(data.schedule.id, 'nightly');
-    assert.equal(data.schedule.enabled, true);
-    assert.ok(data.schedule.nextRun);
-
-    res = await create({ id: 'bad', spec: 'nope', prompt: 'x' });
-    assert.equal(res.status, 400);
-
-    res = await create({ id: 'nightly', type: 'agent', spec: 'daily 03:00', prompt: 'otra' });
-    assert.equal(res.status, 409);
-
-    res = await fetch(`${base}/api/schedules/nightly/toggle`, { method: 'POST' });
-    data = await res.json();
-    assert.equal(data.enabled, false);
-
-    data = await (await fetch(`${base}/api/schedules`)).json();
-    assert.equal(data.schedules.length, 1);
-    assert.equal(data.schedules[0].enabled, false);
-
-    res = await fetch(`${base}/api/schedules/nightly`, { method: 'DELETE' });
-    assert.equal(res.status, 200);
-    data = await res.json();
-    assert.equal(data.schedules.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('runs a scheduled task on demand (shell and agent)', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sched-'));
-  const provider = {
-    id: 'fake',
-    async streamChat(_config, { onEvent }) {
-      onEvent?.({ type: 'text', delta: 'ok', full: 'ok' });
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  const create = (body) => fetch(`${base}/api/schedules`, { method: 'POST', headers: json, body: JSON.stringify(body) });
-  let data;
-  try {
-    await create({ id: 'ver', type: 'shell', spec: 'every 1 h', command: 'node', args: ['--version'] });
-    let res = await fetch(`${base}/api/schedules/ver/run`, { method: 'POST' });
-    assert.equal(res.status, 200);
-    assert.equal((await res.json()).ok, true);
-
-    await create({ id: 'nope', type: 'shell', spec: 'every 1 h', command: 'definitely-not-allowed' });
-    res = await fetch(`${base}/api/schedules/nope/run`, { method: 'POST' });
-    assert.equal(res.status, 500);
-
-    await create({ id: 'job', type: 'agent', spec: 'every 1 h', prompt: 'hacé algo útil', model: 'm' });
-    res = await fetch(`${base}/api/schedules/job/run`, { method: 'POST' });
-    data = await res.json();
-    assert.equal(res.status, 200, JSON.stringify(data));
-    assert.equal(data.ok, true, JSON.stringify(data));
-    assert.ok(data.result.sessionId);
-
-    const sessions = await (await fetch(`${base}/api/sessions`)).json();
-    assert.ok(sessions.sessions.some((s) => s.title === 'Tarea: job'));
-  } finally {
-    await instance.close();
-  }
-});
-
-test('rewind restores files and truncates the turn', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-rewind-'));
-  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ permissions: { write: 'allow' } }));
-  await writeFile(path.join(cwd, 'nota.txt'), 'original');
-  const provider = {
-    id: 'rw',
-    async streamChat(_config, { messages }) {
-      if (messages.some((m) => m.role === 'tool' && m.name === 'write')) {
-        return { content: 'listo', reasoning: '', toolCalls: [] };
-      }
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          {
-            id: 'w1',
-            type: 'function',
-            function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'cambiado' }) },
-          },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
-    ).json();
-    const sid = created.session.id;
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ sessionId: sid, model: 'm', input: 'cambiá la nota' }),
-      })
-    ).text();
-    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'cambiado');
-
-    const detail = await (await fetch(`${base}/api/sessions/${sid}`)).json();
-    const userMsg = detail.messages.find((m) => m.role === 'user');
-    assert.ok(userMsg, 'no se persistió el mensaje del usuario');
-
-    const cps = await (await fetch(`${base}/api/sessions/${sid}/checkpoints`)).json();
-    assert.ok(cps.turns.includes(userMsg.id), 'no se registró el checkpoint del turno');
-
-    const res = await fetch(`${base}/api/sessions/${sid}/rewind`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ turn: userMsg.id }),
-    });
-    assert.equal(res.status, 200);
-    const out = await res.json();
-    assert.equal(out.restored, 1);
-    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'original');
-
-    const after = await (await fetch(`${base}/api/sessions/${sid}`)).json();
-    assert.equal(after.messages.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('hooks observe tool events and plugins add custom tools', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-hooks-plugins-'));
-  await mkdir(path.join(cwd, '.tamnora', 'hooks'), { recursive: true });
-  await mkdir(path.join(cwd, '.tamnora', 'plugins'), { recursive: true });
-  await writeFile(
-    path.join(cwd, '.tamnora', 'hooks', 'audit.mjs'),
-    "import { appendFileSync } from 'node:fs';\nimport path from 'node:path';\n" +
-      "export default { name: 'audit', events: { 'tool.after': (event, ctx) => { appendFileSync(path.join(ctx.cwd, 'hook.log'), `${event.type}:${event.name}\\n`); } } };\n"
-  );
-  await writeFile(
-    path.join(cwd, '.tamnora', 'plugins', 'demo.mjs'),
-    "export default { name: 'demo', tools: [{ name: 'saludar', description: 'saluda', parameters: { quien: { type: 'string' } }, handler: (args) => `Hola ${args.quien}` }] };\n"
-  );
-  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ permissions: { plugin__demo__saludar: 'allow' } }));
-
-  let captured = null;
-  const provider = {
-    id: 'hp',
-    async streamChat(_config, { messages }) {
-      const toolMsg = messages.find((m) => m.role === 'tool' && String(m.name).startsWith('plugin__'));
-      if (toolMsg) {
-        captured = toolMsg.content;
-        return { content: 'ok', reasoning: '', toolCalls: [] };
-      }
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          {
-            id: 't1',
-            type: 'function',
-            function: { name: 'plugin__demo__saludar', arguments: JSON.stringify({ quien: 'mundo' }) },
-          },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const hooks = await (await fetch(`${base}/api/hooks`)).json();
-    assert.ok(hooks.hooks.some((h) => h.id === 'audit'));
-
-    const plugins = await (await fetch(`${base}/api/plugins`)).json();
-    assert.ok(plugins.plugins.some((p) => p.name === 'plugin__demo__saludar'));
-
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
-    ).json();
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'saludá' }),
-      })
-    ).text();
-    assert.equal(captured, 'Hola mundo');
-
-    await new Promise((resolve) => setTimeout(resolve, 150));
-    const log = await readFile(path.join(cwd, 'hook.log'), 'utf8').catch(() => '');
-    assert.match(log, /tool\.after:plugin__demo__saludar/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('skills: modo eager inyecta el body en el system prompt', async () => {
-  let captured = '';
-  const captureProvider = {
-    id: 'capture',
-    async streamChat(_config, { messages }) {
-      captured = messages?.[0]?.content ?? '';
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-srv-'));
-  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ skills: { mode: 'eager' } }));
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider: captureProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    await fetch(`${base}/api/skills/demo`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ name: 'Demo', body: 'Regla secreta de la skill.' }),
-    });
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
-    ).json();
-    await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'hola' }),
-    }).then((r) => r.text());
-    assert.match(captured, /Regla secreta de la skill/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('auto-compact resume el historial cuando el contexto se pasa', async () => {
-  let captured = '';
-  const provider = {
-    id: 'capture',
-    async streamChat(_config, { messages }) {
-      captured = (messages ?? [])
-        .map((m) => (typeof m.content === 'string' ? m.content : ''))
-        .join('\n');
-      return { content: 'RESUMEN OK', reasoning: '', toolCalls: [] };
-    },
-  };
-  const json = { 'Content-Type': 'application/json' };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ title: 't', model: 'm' }),
-      })
-    ).json();
-    const id = created.session.id;
-    const big = 'x'.repeat(4000);
-    instance.store.addMessages(
-      id,
-      Array.from({ length: 12 }, (_, i) => ({ role: i % 2 ? 'assistant' : 'user', content: `m${i} ${big}` }))
-    );
-
-    await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ sessionId: id, model: 'm', input: 'hola', contextTokens: 1000 }),
-    }).then((r) => r.text());
-
-    const meta = instance.store.getSession(id).meta;
-    assert.ok(meta.summaryCursor, 'debe guardar el cursor de compactación');
-    assert.match(captured, /Resumen de la conversación anterior/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('detects, runs and stops dev processes', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proc-'));
-  await writeFile(path.join(cwd, 'package.json'), JSON.stringify({ scripts: { dev: 'node server.js' } }));
-  const { instance, base } = await startServer({ cwd });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const detected = await (await fetch(`${base}/api/procs/detect?cwd=${encodeURIComponent(cwd)}`)).json();
-    assert.ok(detected.chips.some((c) => c.command === 'npm' && c.args.includes('dev')));
-
-    const blocked = await fetch(`${base}/api/procs/start`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ cwd, command: 'curl' }),
-    });
-    assert.equal(blocked.status, 400);
-
-    const started = await (
-      await fetch(`${base}/api/procs/start`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ cwd, command: 'node', args: ['-e', 'console.log(42)'] }),
-      })
-    ).json();
-    assert.ok(started.proc.id);
-    await new Promise((resolve) => setTimeout(resolve, 500));
-
-    const logs = await (await fetch(`${base}/api/procs/${started.proc.id}/logs`)).json();
-    assert.match(logs.logs.map((l) => l.text).join(''), /42/);
-
-    const stopped = await fetch(`${base}/api/procs/${started.proc.id}/stop`, { method: 'POST' });
-    assert.equal(stopped.status, 200);
-
-    const badTunnel = await fetch(`${base}/api/preview/tunnel`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ port: 0 }),
-    });
-    assert.equal(badTunnel.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('runs a console shell command and kills a port', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-shell-'));
-  const { instance, base } = await startServer({ cwd });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const shell = await fetch(`${base}/api/shell`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ command: 'echo hola-shell' }),
-    });
-    assert.equal(shell.status, 200);
-    const out = await shell.json();
-    assert.match(out.output, /hola-shell/);
-
-    const missing = await fetch(`${base}/api/shell`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ command: '   ' }),
-    });
-    assert.equal(missing.status, 400);
-
-    const badPort = await fetch(`${base}/api/procs/kill`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ port: 0 }),
-    });
-    assert.equal(badPort.status, 400);
-
-    const none = await fetch(`${base}/api/procs/kill`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ port: 47555 }),
-    });
-    assert.equal(none.status, 200);
-    assert.deepEqual((await none.json()).pids, []);
-
-    const status = await fetch(`${base}/api/ports/47555`);
-    assert.equal(status.status, 200);
-    const info = await status.json();
-    assert.equal(info.port, 47555);
-    assert.equal(info.listening, false);
-    assert.deepEqual(info.pids, []);
-
-    const aliasKill = await fetch(`${base}/api/ports/kill`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ port: 47555 }),
-    });
-    assert.equal(aliasKill.status, 200);
-    assert.deepEqual((await aliasKill.json()).pids, []);
-
-    const badStatus = await fetch(`${base}/api/ports/0`);
-    assert.equal(badStatus.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('the agent can install a skill from chat (with approval)', async () => {
-  const calls = { n: 0 };
-  const toolProvider = {
-    id: 'tooly',
-    async streamChat() {
-      calls.n += 1;
-      if (calls.n === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [
-            {
-              id: 't1',
-              function: {
-                name: 'install_skill',
-                arguments: JSON.stringify({ id: 'demo-skill', content: '---\nname: Demo\n---\nCuerpo de prueba.' }),
-              },
-            },
-          ],
-        };
-      }
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ resolveProvider: () => ({ provider: toolProvider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm' }) })
-    ).json();
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ sessionId: created.session.id, model: 'm', input: 'instalá una skill', yes: true }),
-    });
-    await res.text();
-
-    const skills = await (await fetch(`${base}/api/skills`)).json();
-    assert.ok(skills.skills.some((s) => s.id === 'demo-skill'));
-  } finally {
-    await instance.close();
-  }
-});
-
-test('rejects chat without input or model', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const noInput = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ model: 'm' }),
-    });
-    assert.equal(noInput.status, 400);
-
-    const noModel = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'hola' }),
-    });
-    assert.equal(noModel.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('manages providers and active settings', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const put = await fetch(`${base}/api/providers/deepseek`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({
-        label: 'DeepSeek',
-        baseUrl: 'https://api.deepseek.com/v1',
-        apiKey: 'sk-secret-1234',
-        models: ['deepseek-chat'],
-      }),
-    });
-    const data = await put.json();
-    const ds = data.providers.find((p) => p.id === 'deepseek');
-    assert.equal(ds.hasKey, true);
-    assert.equal(ds.apiKeyHint.endsWith('1234'), true);
-    assert.deepEqual(ds.models, ['deepseek-chat']);
-
-    await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: json,
-      body: JSON.stringify({ provider: 'deepseek', model: 'deepseek-chat' }),
-    });
-    const settings = await (await fetch(`${base}/api/settings`)).json();
-    assert.equal(settings.settings.provider, 'deepseek');
-    assert.equal(settings.settings.model, 'deepseek-chat');
-
-    const list = await (await fetch(`${base}/api/providers`)).json();
-    assert.equal(list.active.provider, 'deepseek');
-
-    const deleted = await fetch(`${base}/api/providers/deepseek`, { method: 'DELETE' });
-    assert.equal(deleted.status, 200);
-    const after = await (await fetch(`${base}/api/providers`)).json();
-    assert.equal(after.providers.find((p) => p.id === 'deepseek').hasKey, false);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('runs an evaluation over HTTP and persists the run', async () => {
-  const model = http.createServer((req, res) => {
-    let body = '';
-    req.on('data', (c) => (body += c));
-    req.on('end', () => {
-      res.setHeader('Content-Type', 'text/event-stream');
-      res.write(`data: ${JSON.stringify({ choices: [{ delta: { content: 'hola' } }] })}\n\n`);
-      res.write('data: [DONE]\n\n');
-      res.end();
-    });
-  });
-  await new Promise((r) => model.listen(0, '127.0.0.1', r));
-  const modelBase = `http://127.0.0.1:${model.address().port}/v1`;
-
-  const { instance, base } = await startServer();
-  try {
-    const res = await fetch(`${base}/api/eval`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        provider: 'openai-compatible',
-        baseUrl: modelBase,
-        models: ['mock'],
-        concurrency: 1,
-        tasks: [{ id: 't1', input: 'saluda', expect: { contains: 'hola' } }],
-      }),
-    });
-    const text = await res.text();
-    assert.match(text, /event: result/);
-    assert.match(text, /event: summary/);
-    assert.match(text, /"passed":1/);
-
-    const runs = await (await fetch(`${base}/api/runs`)).json();
-    assert.equal(runs.runs.length, 1);
-    const detail = await (await fetch(`${base}/api/runs/${runs.runs[0].id}`)).json();
-    assert.equal(detail.results.length, 1);
-    assert.equal(detail.results[0].passed, 1);
-  } finally {
-    await instance.close();
-    model.close();
-  }
-});
-
-test('creates a folder over HTTP and rejects bad input', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-newdir-'));
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  const create = (body) =>
-    fetch(`${base}/api/folders`, { method: 'POST', headers: json, body: JSON.stringify(body) });
-  try {
-    const created = await create({ parent: root, name: 'mi-proyecto' });
-    assert.equal(created.status, 201);
-    const data = await created.json();
-    assert.equal(data.path, path.join(root, 'mi-proyecto'));
-    assert.ok((await stat(data.path)).isDirectory());
-
-    assert.equal((await create({ parent: root, name: 'mi-proyecto' })).status, 409);
-    assert.equal((await create({ parent: root, name: '../escape' })).status, 400);
-    assert.equal((await create({ parent: root, name: '' })).status, 400);
-    assert.equal((await create({ name: 'sin-parent' })).status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('lists and previews workspace files, confining to the root', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-files-'));
-  await mkdir(path.join(root, 'src'));
-  await mkdir(path.join(root, 'node_modules'));
-  await writeFile(path.join(root, 'README.md'), '# hola\n');
-  await writeFile(path.join(root, 'src', 'index.js'), 'export const x = 1;\n');
-  await writeFile(path.join(root, 'zeta.bin'), Buffer.from([1, 2, 0, 3]));
-
-  const { instance, base } = await startServer();
-  const list = (params) => fetch(`${base}/api/files?${new URLSearchParams(params)}`);
-  const content = (params) => fetch(`${base}/api/files/content?${new URLSearchParams(params)}`);
-  try {
-    const top = await (await list({ root, path: '' })).json();
-    assert.equal(top.path, '');
-    assert.deepEqual(
-      top.entries.map((e) => `${e.type}:${e.name}`),
-      ['dir:src', 'file:README.md', 'file:zeta.bin']
-    );
-
-    const sub = await (await list({ root, path: 'src' })).json();
-    assert.deepEqual(sub.entries.map((e) => e.name), ['index.js']);
-    assert.equal(sub.entries[0].size > 0, true);
-
-    const preview = await (await content({ root, path: 'src/index.js' })).json();
-    assert.equal(preview.content, 'export const x = 1;\n');
-
-    assert.equal((await list({ root, path: '../../' })).status, 400);
-    assert.equal((await list({ root: path.join(root, 'nope') })).status, 400);
-    assert.equal((await content({ root, path: 'zeta.bin' })).status, 415);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('reports git status and per-file diffs', { skip: !HAS_GIT }, async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-git-'));
-  gitInit(root);
-  await writeFile(path.join(root, 'app.js'), 'const a = 1;\n');
-  execFileSync('git', ['add', 'app.js'], { cwd: root });
-  execFileSync('git', ['commit', '-q', '-m', 'init'], { cwd: root });
-  await writeFile(path.join(root, 'app.js'), 'const a = 2;\n');
-  await writeFile(path.join(root, 'nuevo.txt'), 'hola\n');
-
-  const { instance, base } = await startServer();
-  try {
-    const status = await (
-      await fetch(`${base}/api/git/status?${new URLSearchParams({ cwd: root })}`)
-    ).json();
-    assert.equal(status.isRepo, true);
-    assert.ok(status.branch);
-    assert.deepEqual(
-      status.entries.map((e) => e.path).sort(),
-      ['app.js', 'nuevo.txt']
-    );
-    assert.equal(status.entries.find((e) => e.path === 'app.js').status, 'modified');
-    assert.equal(status.entries.find((e) => e.path === 'nuevo.txt').status, 'untracked');
-
-    const diff = await (
-      await fetch(`${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: 'app.js' })}`)
-    ).json();
-    assert.match(diff.diff, /-const a = 1;/);
-    assert.match(diff.diff, /\+const a = 2;/);
-
-    const untracked = await (
-      await fetch(`${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: 'nuevo.txt' })}`)
-    ).json();
-    assert.equal(untracked.untracked, true);
-    assert.match(untracked.diff, /\+hola/);
-
-    const outside = await fetch(
-      `${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: '../fuera' })}`
-    );
-    assert.equal(outside.status, 400);
-
-    const plain = await mkdtemp(path.join(tmpdir(), 'tamnora-nogit-'));
-    const none = await (
-      await fetch(`${base}/api/git/status?${new URLSearchParams({ cwd: plain })}`)
-    ).json();
-    assert.equal(none.isRepo, false);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('previews an HTML file through a static server', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-html-'));
-  await writeFile(path.join(root, 'index.html'), '<h1>hola</h1>');
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const res = await fetch(`${base}/api/files/preview`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ root, path: 'index.html' }),
-    });
-    assert.equal(res.status, 200);
-    const data = await res.json();
-    assert.match(data.url, /^http:\/\/127\.0\.0\.1:\d+\/index\.html$/);
-
-    const outside = await fetch(`${base}/api/files/preview`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ root, path: '../secret.txt' }),
-    });
-    assert.equal(outside.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('lists workspace folders and rejects invalid paths', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-folders-'));
-  await mkdir(path.join(root, 'beta'));
-  await mkdir(path.join(root, 'alpha'));
-  await writeFile(path.join(root, 'solo-archivo.txt'), 'x');
-
-  const { instance, base } = await startServer();
-  try {
-    const roots = await (await fetch(`${base}/api/folders`)).json();
-    assert.ok(roots.dirs.length >= 1);
-    assert.equal(roots.path, null);
-
-    const listed = await (await fetch(`${base}/api/folders?path=${encodeURIComponent(root)}`)).json();
-    assert.equal(listed.path, path.resolve(root));
-    assert.deepEqual(
-      listed.dirs.map((d) => d.name),
-      ['alpha', 'beta']
-    );
-    assert.ok(listed.parent);
-
-    const missing = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'nope'))}`);
-    assert.equal(missing.status, 400);
-
-    const file = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'solo-archivo.txt'))}`);
-    assert.equal(file.status, 400);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('the system prompt follows the session workspace, not the server cwd', async () => {
-  const serverCwd = await mkdtemp(path.join(tmpdir(), 'tamnora-srv-cwd-'));
-  const projectCwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proj-cwd-'));
-  await writeFile(path.join(serverCwd, 'AGENTS.md'), 'REGLAS_DEL_SERVER');
-  await writeFile(path.join(projectCwd, 'AGENTS.md'), 'REGLAS_DEL_PROYECTO');
-
-  let captured = null;
-  const provider = {
-    id: 'capture',
-    async streamChat(_config, opts) {
-      captured = opts.messages.find((m) => m.role === 'system')?.content ?? '';
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-
-  const { instance, base } = await startServer({
-    cwd: serverCwd,
-    resolveProvider: () => ({ provider, config: {} }),
-  });
-  try {
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'hola', model: 'm', cwd: projectCwd }),
-    });
-    await res.text();
-    assert.ok(captured.includes(path.resolve(projectCwd)), 'nombra la carpeta de la sesión');
-    assert.match(captured, /REGLAS_DEL_PROYECTO/);
-    assert.doesNotMatch(captured, /REGLAS_DEL_SERVER/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('asks for approval before running a gated tool and runs it once approved', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-ask-'));
-  let calls = 0;
-  const provider = {
-    id: 'tooly',
-    async streamChat() {
-      calls += 1;
-      if (calls === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [
-            { id: 'call_1', function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'hi' }) } },
-          ],
-        };
-      }
-      return { content: 'listo', reasoning: '', toolCalls: [] };
-    },
-  };
-
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'creá nota.txt con hi', model: 'm' }),
-    });
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    let askId = null;
-    let done = false;
-    while (!done) {
-      const { value } = await reader.read();
-      if (!value) break;
-      buffer += decoder.decode(value, { stream: true });
-      if (!askId) {
-        const match = buffer.match(/"askId":"([0-9a-f-]+)"/);
-        if (match && buffer.includes('event: permission')) {
-          askId = match[1];
-          const decision = await fetch(`${base}/api/permissions/${askId}`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ allow: true }),
-          });
-          assert.equal(decision.status, 200);
-        }
-      }
-      if (buffer.includes('event: done')) done = true;
-    }
-    assert.ok(askId, 'emitió el evento permission');
-    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'hi');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('rejects unknown permission requests', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const res = await fetch(`${base}/api/permissions/does-not-exist`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ allow: true }),
-    });
-    assert.equal(res.status, 404);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('ask_user muestra un formulario y recibe las respuestas', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-askuser-'));
-  let calls = 0;
-  let captured = null;
-  const provider = {
-    id: 'formy',
-    async streamChat(_config, opts) {
-      calls += 1;
-      if (calls === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [
-            {
-              id: 'q1',
-              function: {
-                name: 'ask_user',
-                arguments: JSON.stringify({
-                  questions: [
-                    { id: 'nombre', label: '¿Tu nombre?' },
-                    { id: 'color', label: 'Color', type: 'select', options: ['rojo', 'verde'] },
-                  ],
-                }),
-              },
-            },
-          ],
-        };
-      }
-      captured = opts.messages;
-      return { content: 'Gracias', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'preguntame', model: 'm' }),
-    });
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    let askId = null;
-    let done = false;
-    while (!done) {
-      const { value } = await reader.read();
-      if (!value) break;
-      buffer += decoder.decode(value, { stream: true });
-      if (!askId && buffer.includes('event: question')) {
-        const match = buffer.match(/"askId":"([0-9a-f-]+)"/);
-        if (match) {
-          askId = match[1];
-          const answer = await fetch(`${base}/api/questions/${askId}`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ answers: { nombre: 'Ana', color: 'verde' } }),
-          });
-          assert.equal(answer.status, 200);
-        }
-      }
-      if (buffer.includes('event: done')) done = true;
-    }
-    assert.ok(askId, 'emitió el evento question');
-    const toolMsg = (captured ?? []).find((m) => m.role === 'tool');
-    assert.match(String(toolMsg?.content ?? ''), /Ana/);
-    assert.match(String(toolMsg?.content ?? ''), /verde/);
-  } finally {
-    await instance.close();
-  }
-});
-
-async function readEvents(res, onFrame) {
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = '';
-  let done = false;
-  while (!done) {
-    const { value } = await reader.read();
-    if (!value) break;
-    buffer += decoder.decode(value, { stream: true });
-    if (onFrame) await onFrame(buffer);
-    if (buffer.includes('event: done')) done = true;
-  }
-  return buffer;
-}
-
-test('forwards attached images as multimodal content', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-img-'));
-  let captured = null;
-  const provider = {
-    id: 'vision',
-    async streamChat(_config, opts) {
-      captured = opts.messages.find((m) => m.role === 'user');
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const image = 'data:image/png;base64,iVBORw0KGgo=';
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'mirá', model: 'm', images: [image] }),
-    });
-    await res.text();
-    assert.ok(Array.isArray(captured.content));
-    assert.deepEqual(captured.content[0], { type: 'text', text: 'mirá' });
-    assert.equal(captured.content[1].type, 'image_url');
-    assert.equal(captured.content[1].image_url.url, image);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('scope=session approves later asks without prompting again', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-scope-'));
-  let round = 0;
-  const provider = {
-    id: 'twice',
-    async streamChat() {
-      round += 1;
-      if (round <= 2) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [
-            {
-              id: `call_${round}`,
-              function: { name: 'write', arguments: JSON.stringify({ path: `f${round}.txt`, content: 'x' }) },
-            },
-          ],
-        };
-      }
-      return { content: 'fin', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'creá dos archivos', model: 'm' }),
-    });
-    let decisions = 0;
-    const text = await readEvents(res, async (buffer) => {
-      if (decisions === 0 && buffer.includes('event: permission')) {
-        decisions += 1;
-        const askId = buffer.match(/"askId":"([0-9a-f-]+)"/)[1];
-        await fetch(`${base}/api/permissions/${askId}`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ allow: true, scope: 'session' }),
-        });
-      }
-    });
-    assert.equal(decisions, 1, 'solo pidió permiso una vez');
-    assert.equal((text.match(/event: permission\n/g) ?? []).length, 1);
-    assert.equal(await readFile(path.join(cwd, 'f1.txt'), 'utf8'), 'x');
-    assert.equal(await readFile(path.join(cwd, 'f2.txt'), 'utf8'), 'x');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('stores and injects the session goal', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-goal-'));
-  let captured = null;
-  const provider = {
-    id: 'goal',
-    async streamChat(_config, opts) {
-      captured = opts.messages;
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'G' }) })
-    ).json();
-    const id = created.session.id;
-    const updated = await (
-      await fetch(`${base}/api/sessions/${id}`, {
-        method: 'PUT',
-        headers: json,
-        body: JSON.stringify({ goal: 'migrar a ESM' }),
-      })
-    ).json();
-    assert.equal(updated.session.goal, 'migrar a ESM');
-
-    await (await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    })).text();
-    assert.ok(captured.some((m) => m.content === 'Objetivo de la sesión: migrar a ESM'));
-  } finally {
-    await instance.close();
-  }
-});
-
-test('compact summarizes and keeps the history with a marker', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-compact-'));
-  let compacting = false;
-  const provider = {
-    id: 'sum',
-    async streamChat(_config, opts) {
-      const system = opts.messages.find((m) => m.role === 'system')?.content ?? '';
-      if (system.includes('Resumí la conversación')) compacting = true;
-      return { content: compacting ? 'RESUMEN FINAL' : 'hola', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'C' }) })
-    ).json();
-    const id = created.session.id;
-    await (await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    })).text();
-
-    const compact = await (
-      await fetch(`${base}/api/sessions/${id}/compact`, { method: 'POST', headers: json })
-    ).json();
-    assert.equal(compact.summary, 'RESUMEN FINAL');
-    assert.ok(compact.cursor, 'debe devolver el cursor de compactación');
-
-    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    const marker = detail.messages.find((m) => m.name === 'compact');
-    assert.ok(marker, 'debe dejar una marca de compactación');
-    assert.equal(marker.content, 'RESUMEN FINAL');
-    assert.ok(detail.messages.length > 1, 'no borra el historial');
-    assert.equal(detail.session.hasSummary, true);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('the summary endpoint returns a summary without clearing the messages', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-summary-'));
-  const provider = {
-    id: 'sum',
-    async streamChat(_config, opts) {
-      const system = opts.messages.find((m) => m.role === 'system')?.content ?? '';
-      return { content: system.includes('Resumí la conversación') ? 'RESUMEN FINAL' : 'hola', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'S' }) })
-    ).json();
-    const id = created.session.id;
-    await (await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    })).text();
-
-    const summary = await (
-      await fetch(`${base}/api/sessions/${id}/summary`, { method: 'POST', headers: json })
-    ).json();
-    assert.equal(summary.summary, 'RESUMEN FINAL');
-
-    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.ok(detail.messages.length > 0, 'no borra el historial');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('exposes modes and persists the active mode', async () => {
-  const { instance, base } = await startServer();
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const modes = await (await fetch(`${base}/api/modes`)).json();
-    assert.deepEqual(
-      modes.modes.map((m) => m.id),
-      ['agent', 'plan', 'voice']
-    );
-    await fetch(`${base}/api/settings`, { method: 'PUT', headers: json, body: JSON.stringify({ mode: 'plan' }) });
-    const settings = await (await fetch(`${base}/api/settings`)).json();
-    assert.equal(settings.settings.mode, 'plan');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('plan mode exposes only read-only tools and adds guidance', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-plan-'));
-  let captured = null;
-  const provider = {
-    id: 'plan',
-    async streamChat(_config, opts) {
-      captured = {
-        tools: (opts.tools ?? []).map((t) => t.function.name).sort(),
-        system: opts.messages.find((m) => m.role === 'system').content,
-      };
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ input: 'planificá', model: 'm', mode: 'plan' }),
-      })
-    ).text();
-    assert.deepEqual(captured.tools, [
-      'ask_user',
-      'console_errors',
-      'fetch_url',
-      'git_diff',
-      'git_log',
-      'git_status',
-      'glob',
-      'grep',
-      'list',
-      'list_mcp',
-      'list_skills',
-      'offer_choices',
-      'preview_url',
-      'read',
-      'screenshot',
-      'search_mcp',
-      'search_skills',
-      'show_plan',
-      'skill',
-      'speak',
-      'task',
-    ]);
-    assert.match(captured.system, /modo PLAN/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('voice mode expone write/edit pero solo para .md y .json', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-voice-'));
-  let seenTools = null;
-  let seenSystem = null;
-  let toolResult = null;
-  let round = 0;
-  const provider = {
-    id: 'voice',
-    async streamChat(_config, opts) {
-      round += 1;
-      seenTools = (opts.tools ?? []).map((t) => t.function.name).sort();
-      seenSystem = opts.messages.find((m) => m.role === 'system').content;
-      if (round === 1) {
-        return {
-          content: '',
-          reasoning: '',
-          toolCalls: [
-            {
-              id: 'w1',
-              type: 'function',
-              function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'x' }) },
-            },
-          ],
-        };
-      }
-      toolResult = opts.messages.find((m) => m.role === 'tool')?.content ?? '';
-      return { content: 'ok', reasoning: '', toolCalls: [] };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  try {
-    await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ input: 'tomá nota', model: 'm', mode: 'voice' }),
-      })
-    ).text();
-    assert.ok(seenTools.includes('write'));
-    assert.ok(seenTools.includes('edit'));
-    assert.match(seenSystem, /modo VOZ/);
-    assert.match(toolResult, /solo se permite crear o editar/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('the agent can delegate to a subagent with the task tool', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-task-'));
-  const provider = {
-    id: 'multi',
-    async streamChat(_config, { messages, onEvent }) {
-      const isSub = messages.some((m) => m.role === 'system' && /subagente/i.test(String(m.content)));
-      if (isSub) {
-        onEvent?.({ type: 'text', delta: 'resumen', full: 'resumen subagente' });
-        return { content: 'resumen subagente', reasoning: '', toolCalls: [] };
-      }
-      const done = messages.some((m) => m.role === 'tool' && m.name === 'task');
-      if (done) return { content: 'listo', reasoning: '', toolCalls: [] };
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [
-          { id: 't1', function: { name: 'task', arguments: JSON.stringify({ description: 'explorar', prompt: 'leé el proyecto' }) } },
-        ],
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const stream = await (
-      await fetch(`${base}/api/chat`, {
-        method: 'POST',
-        headers: json,
-        body: JSON.stringify({ input: 'delegá', model: 'm' }),
-      })
-    ).text();
-    assert.match(stream, /event: agent_start/);
-    assert.match(stream, /event: agent_end/);
-
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    const id = list.sessions[0].id;
-    const agents = await (await fetch(`${base}/api/sessions/${id}/agents`)).json();
-    assert.equal(agents.agents.length, 1);
-    assert.equal(agents.agents[0].status, 'done');
-    assert.match(agents.agents[0].summary, /resumen subagente/);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('aggregates the token usage of a session', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-tokens-'));
-  const provider = {
-    id: 'tok',
-    async streamChat() {
-      return {
-        content: 'ok',
-        reasoning: '',
-        toolCalls: [],
-        usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
-      };
-    },
-  };
-  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
-  const json = { 'Content-Type': 'application/json' };
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'T' }) })
-    ).json();
-    const id = created.session.id;
-    await (await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: json,
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
-    })).text();
-    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
-    assert.deepEqual(detail.tokens, { in: 10, out: 5 });
-  } finally {
-    await instance.close();
-  }
-});
-
-test('sessions and chat accept a workspace cwd', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-cwd-'));
-  const { instance, base } = await startServer();
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ title: 'Con carpeta', model: 'm', cwd: root }),
-      })
-    ).json();
-    assert.equal(created.session.cwd, path.resolve(root));
-
-    const bad = await fetch(`${base}/api/sessions`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ title: 'Mala', cwd: path.join(root, 'nope') }),
-    });
-    assert.equal(bad.status, 400);
-
-    const res = await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'hola', model: 'm', cwd: root }),
-    });
-    const text = await res.text();
-    assert.match(text, /event: start/);
-    assert.ok(text.includes(`"cwd":${JSON.stringify(path.resolve(root))}`));
-
-    const list = await (await fetch(`${base}/api/sessions`)).json();
-    const fromChat = list.sessions.find((s) => s.cwd === path.resolve(root) && s.title !== 'Con carpeta');
-    assert.ok(fromChat);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('requires login and CSRF when a user is configured', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-auth-'));
-  setHome(cwd);
-  const app = ensureApp();
-  app.user = makeUser('admin', 'secreto123');
-  writeApp(app);
-  assert.equal(readApp().user.name, 'admin');
-
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-  });
-  const info = await instance.listen({ port: 0 });
-  const base = info.url;
-  try {
-    const unauth = await fetch(`${base}/api/providers`);
-    assert.equal(unauth.status, 401);
-
-    const bad = await fetch(`${base}/api/auth/login`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username: 'admin', password: 'nope' }),
-    });
-    assert.equal(bad.status, 401);
-
-    const login = await fetch(`${base}/api/auth/login`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username: 'admin', password: 'secreto123' }),
-    });
-    assert.equal(login.status, 200);
-    const cookie = login.headers.get('set-cookie');
-    assert.ok(cookie);
-    const csrf = (await login.json()).csrf;
-    assert.ok(csrf);
-
-    const authed = await fetch(`${base}/api/providers`, { headers: { cookie } });
-    assert.equal(authed.status, 200);
-
-    const noCsrf = await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json', cookie },
-      body: JSON.stringify({ provider: 'openrouter' }),
-    });
-    assert.equal(noCsrf.status, 403);
-
-    const withCsrf = await fetch(`${base}/api/settings`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json', cookie, 'x-csrf': csrf },
-      body: JSON.stringify({ provider: 'openrouter' }),
-    });
-    assert.equal(withCsrf.status, 200);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('searches sessions and messages', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ title: 'Busqueda pepita' }),
-      })
-    ).json();
-    const sessionId = created.session.id;
-
-    await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'contenido único zanahoria', model: 'm', sessionId }),
-    });
-
-    const bySession = await (await fetch(`${base}/api/search?q=pepita`)).json();
-    assert.ok(bySession.sessions.some((s) => s.id === sessionId));
-
-    const byMessage = await (await fetch(`${base}/api/search?q=zanahoria`)).json();
-    assert.ok(byMessage.messages.some((m) => m.sessionId === sessionId));
-
-    const tooShort = await (await fetch(`${base}/api/search?q=p`)).json();
-    assert.deepEqual(tooShort, { sessions: [], messages: [] });
-  } finally {
-    await instance.close();
-  }
-});
-
-test('truncates a session from a message id', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const created = await (
-      await fetch(`${base}/api/sessions`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ title: 'T' }),
-      })
-    ).json();
-    const sessionId = created.session.id;
-
-    await fetch(`${base}/api/chat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ input: 'hola', model: 'm', sessionId }),
-    });
-
-    let detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
-    assert.ok(detail.messages.length >= 2);
-    const firstId = detail.messages[0].id;
-    assert.ok(firstId);
-
-    const res = await fetch(`${base}/api/sessions/${sessionId}/truncate`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ fromId: firstId }),
-    });
-    assert.equal(res.status, 200);
-
-    detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
-    assert.equal(detail.messages.length, 0);
-  } finally {
-    await instance.close();
-  }
-});
-
-test('serves browser screenshots from the home dir, confined to png names', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-shots-'));
-  const { instance, base } = await startServer({ cwd });
-  try {
-    const dir = screenshotsDir();
-    await mkdir(dir, { recursive: true });
-    const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-    await writeFile(path.join(dir, 'abc-123.png'), png);
-
-    const ok = await fetch(`${base}/api/screenshots/abc-123.png`);
-    assert.equal(ok.status, 200);
-    assert.equal(ok.headers.get('content-type'), 'image/png');
-    assert.equal((await ok.arrayBuffer()).byteLength, png.length);
-
-    assert.equal((await fetch(`${base}/api/screenshots/bad.txt`)).status, 400);
-    assert.equal((await fetch(`${base}/api/screenshots/missing.png`)).status, 404);
-  } finally {
-    await instance.close();
-  }
-});
-