@danieltmn/tamnora 0.21.2 → 0.22.0

package/CHANGELOG.md

@@ -5,6 +5,15 @@ Todos los cambios relevantes de este proyecto se documentan en este archivo.
 El formato sigue [Keep a Changelog](https://keepachangelog.com/es-ES/1.1.0/)
 y el proyecto usa [Versionado Semantico](https://semver.org/lang/es/).
 
+## [0.22.0] - 2026-10-22
+
+### Cambios
+
+- docs: AGENTS.md al dia con la auditoria, los modulos de la consola y el preview opt-in
+- refactor(test): parte server.test.js en archivos por dominio
+- refactor(consola): parte app.js en modulos y pule la UX
+- fix: cierra los hallazgos de seguridad de la auditoria y agrega regresiones
+
 ## [0.21.2] - 2026-10-20
 
 ### Cambios

package/harness/packages/core/src/agent/runAgent.js

@@ -1,4 +1,5 @@
 import { withRetry, isRetryableError } from '../providers/resilience.js';
+import { redactSecrets, redactDeep } from '../redact.js';
 import { trimContext, estimateTokens } from './context.js';
 
 // 0 = sin limite de rondas: el loop sigue hasta que el modelo deja de pedir
@@ -66,6 +67,7 @@ export async function runAgent({
   retryDelayMs = 500,
   contextTokens = 0,
   onLifecycle,
+  redactExtra = [],
 }) {
   const working = [...messages];
   // Mensajes efimeros (p. ej. reglas por path inyectadas en runtime): entran al
@@ -234,7 +236,7 @@ export async function runAgent({
         }
       }
 
-      const normalized = normalizeToolOutput(output);
+      const normalized = normalizeToolOutput(output, { extra: redactExtra });
       onEvent?.({
         type: 'tool_result',
         id: call.id,
@@ -357,14 +359,16 @@ function createStallGuard(onEvent, stallWarnMs) {
  * Normaliza el resultado de un tool a `{ content, meta }`. Un executor puede
  * devolver un string (lo normal) o `{ content, meta }` cuando necesita mandar
  * metadata al cliente sin ensuciar lo que ve el modelo (p. ej. una captura).
+ * El contenido va redactado (`redactSecrets`): un tool result que pegue una
+ * API key no puede llegar al historial, la UI ni los canales.
  */
-export function normalizeToolOutput(output) {
-  if (typeof output === 'string') return { content: output };
+export function normalizeToolOutput(output, opts = {}) {
+  if (typeof output === 'string') return { content: redactSecrets(output, opts) };
   if (output && typeof output === 'object' && typeof output.content === 'string') {
-    return { content: output.content, meta: output.meta };
+    return { content: redactSecrets(output.content, opts), meta: redactDeep(output.meta, opts) };
   }
   if (output == null) return { content: '' };
-  return { content: JSON.stringify(output) };
+  return { content: redactSecrets(JSON.stringify(output), opts) };
 }
 
 async function defaultExecute(name) {

package/harness/packages/core/src/index.js

@@ -83,6 +83,7 @@ export {
   bashGuard,
   resolveInRoot,
   toRel,
+  realpathDeep,
   MCP_ROUTER_NAME,
   MCP_AUTO_THRESHOLD,
   useLazyMcp,

package/harness/packages/core/src/mcp/stdio.js

@@ -26,6 +26,20 @@ function shouldUseShell(server, command) {
   return true;
 }
 
+// Con `shell: true` Node concatena los args sin escapar: un arg con
+// metacaracteres (`&`, `|`, `<`, `>`, `^`, `%`, `!`) inyectaria comandos. Misma
+// regla que `lib/procs.js` del server.
+const SAFE_SHELL_ARG = /^[^&|<>^%!"\r\n]+$/;
+
+function assertSafeShellArgs(server, command, args = []) {
+  if (!shouldUseShell(server, command)) return;
+  for (const arg of args) {
+    if (!SAFE_SHELL_ARG.test(String(arg))) {
+      throw new Error(`MCP stdio: argumento no permitido con shell en Windows: "${arg}".`);
+    }
+  }
+}
+
 // Variables minimas para que un proceso hijo comun (node, npx, uvx) arranque.
 const BASE_ENV_KEYS = [
   'PATH',
@@ -73,6 +87,7 @@ export function childEnv(server = {}) {
 export async function connectMcpStdioServer(server, { signal, timeout = 30000 } = {}) {
   const command = server.command;
   if (!command) throw new Error(`MCP stdio: falta "command" en el servidor ${server.id ?? ''}`);
+  assertSafeShellArgs(server, command, server.args ?? []);
 
   const child = spawn(command, server.args ?? [], {
     cwd: server.cwd,

package/harness/packages/core/src/net/hosts.js

@@ -3,6 +3,7 @@
 // `fetch_url` (tambien en cada redirect) y el navegador headless.
 
 import net from 'node:net';
+import { lookup } from 'node:dns/promises';
 
 const BLOCKED_SUFFIXES = ['.localhost', '.local', '.internal', '.intranet', '.lan', '.home.arpa'];
 
@@ -109,3 +110,72 @@ export function checkHttpUrl(value) {
   }
   return { url: parsed.toString(), parsed };
 }
+
+/**
+ * Validacion para `preview_url`: la vista previa embebe un dev server, que casi
+ * siempre es local (127.0.0.1, LAN), asi que NO aplica la guarda de hosts
+ * privados de `checkHttpUrl`. Se bloquean igual los hosts de metadatos de la
+ * nube y las direcciones link-local/multicast.
+ */
+export function checkPreviewUrl(value) {
+  const raw = String(value ?? '').trim();
+  if (!raw) return { error: 'falta "url".' };
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { error: `URL inválida: "${raw}".` };
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return { error: 'Solo se admite http(s).' };
+  }
+  const host = normalizeHost(parsed.hostname);
+  if (!host) return { error: 'URL inválida (sin host).' };
+  if (host === 'metadata' || host.endsWith('.internal')) {
+    return { error: `host bloqueado (${host}).` };
+  }
+  if (net.isIP(host) && isLinkLocalOrReserved(host)) {
+    return { error: `host bloqueado (${host}).` };
+  }
+  return { url: parsed.toString(), parsed };
+}
+
+function isLinkLocalOrReserved(address) {
+  const value = normalizeHost(address);
+  const family = net.isIP(value);
+  if (family === 4) {
+    const [a, b] = parseV4(value) ?? [];
+    return a === 0 || (a === 169 && b === 254) || a >= 224;
+  }
+  if (family === 6) {
+    const groups = parseV6(value) ?? [];
+    const [g0] = groups;
+    return groups.every((g) => g === 0) || (g0 & 0xffc0) === 0xfe80 || (g0 & 0xff00) === 0xff00;
+  }
+  return true;
+}
+
+/**
+ * Como `checkHttpUrl`, pero ademas resuelve el hostname y valida las IPs: un
+ * dominio publico que resuelva a una IP interna (DNS rebinding) no pasa. Vale
+ * para la URL inicial y para cada redirect.
+ */
+export async function checkHttpUrlResolved(value) {
+  const checked = checkHttpUrl(value);
+  if (checked.error) return checked;
+  const host = normalizeHost(checked.parsed.hostname);
+  if (net.isIP(host)) return checked;
+  let addresses;
+  try {
+    addresses = await lookup(host, { all: true });
+  } catch {
+    return { error: `No pude resolver el host "${host}".` };
+  }
+  if (!addresses.length) return { error: `No pude resolver el host "${host}".` };
+  for (const { address } of addresses) {
+    if (isBlockedAddress(address)) {
+      return { error: `host bloqueado (${host} resuelve a ${normalizeHost(address)}).` };
+    }
+  }
+  return checked;
+}

package/harness/packages/core/src/redact.js

@@ -17,6 +17,8 @@ const SECRET_PATTERNS = [
   /AIza[0-9A-Za-z_-]{30,}/g,
   /xox[baprs]-[A-Za-z0-9-]{10,}/g,
   /ya29\.[A-Za-z0-9_-]{20,}/g,
+  /gsk_[A-Za-z0-9]{20,}/g, // Groq
+  /\b\d{8,10}:[A-Za-z0-9_-]{30,}\b/g, // token de bot de Telegram
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
 ];
 

package/harness/packages/core/src/tools/executors.js

@@ -7,7 +7,7 @@ import { diffLines } from './diff.js';
 import { captureScreenshot, readConsole } from '../browser/index.js';
 import { screenshotsDir } from '../config/home.js';
 import { scrubEnv } from '../redact.js';
-import { checkHttpUrl, isBlockedHost, normalizeHost } from '../net/hosts.js';
+import { checkHttpUrlResolved, checkPreviewUrl } from '../net/hosts.js';
 
 const MAX_READ_LINES = 2000;
 const MAX_LIST = 500;
@@ -98,7 +98,7 @@ function formatBody(head, text, limit) {
 }
 
 export async function fetchUrlTool(_root, { url, maxLength, raw } = {}) {
-  const checked = checkHttpUrl(url);
+  const checked = await checkHttpUrlResolved(url);
   if (checked.error) return `Error: ${checked.error}`;
   let target = checked.parsed;
 
@@ -129,9 +129,8 @@ export async function fetchUrlTool(_root, { url, maxLength, raw } = {}) {
       if (next.protocol !== 'http:' && next.protocol !== 'https:') {
         return `Error: redirección a un protocolo no permitido (${next.protocol}).`;
       }
-      if (isBlockedHost(next.hostname)) {
-        return `Error: host bloqueado (${normalizeHost(next.hostname)}).`;
-      }
+      const recheck = await checkHttpUrlResolved(next.toString());
+      if (recheck.error) return `Error: ${recheck.error}`;
       try {
         await res.body?.cancel();
       } catch {
@@ -331,7 +330,8 @@ export function bashTool(root, { command, timeout } = {}, { signal } = {}) {
     let settled = false;
     let timer = null;
     const append = (chunk) => {
-      if (output.length < MAX_BASH_OUTPUT) output += chunk.toString();
+      const room = MAX_BASH_OUTPUT - output.length;
+      if (room > 0) output += chunk.toString().slice(0, room);
     };
 
     const finish = (text) => {
@@ -374,7 +374,8 @@ function runGit(root, args) {
     let output = '';
     let settled = false;
     const append = (chunk) => {
-      if (output.length < MAX_BASH_OUTPUT) output += chunk.toString();
+      const room = MAX_BASH_OUTPUT - output.length;
+      if (room > 0) output += chunk.toString().slice(0, room);
     };
     child.stdout?.on('data', append);
     child.stderr?.on('data', append);
@@ -399,7 +400,14 @@ export function gitStatusTool(root) {
 export function gitDiffTool(root, { path: p, staged, ref } = {}) {
   const args = ['diff', '--no-color'];
   if (staged) args.push('--staged');
-  if (ref) args.push(String(ref));
+  if (ref) {
+    // Un "ref" que empieza con '-' no es un ref: git lo tomaria como opcion
+    // (`--output=`, `--ext-diff`) y escribiria/ejecutaria cosas, siendo
+    // `git_diff` una tool de solo lectura con permiso `allow`.
+    const value = String(ref);
+    if (value.startsWith('-')) return 'Error: "ref" inválido (no puede empezar con "-").';
+    args.push(value);
+  }
   if (p) args.push('--', String(p));
   return runGit(root, args);
 }
@@ -436,19 +444,6 @@ export function speakTool(_root, { texto, voice, rate, pitch } = {}) {
   return `Audio pedido${opciones ? ` (${opciones})` : ''}: "${recortado}". El cliente lo reproduce o lo envía como nota de voz.`;
 }
 
-function normalizeHttpUrl(value) {
-  const raw = String(value ?? '').trim();
-  if (!raw) return { error: 'falta "url".' };
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return { error: `URL inválida: "${raw}".` };
-  }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return { error: 'Solo se admite http(s).' };
-  return { url: parsed.toString() };
-}
-
 function clampInt(value, fallback, min, max) {
   const n = Math.round(Number(value));
   if (!Number.isFinite(n)) return fallback;
@@ -460,7 +455,7 @@ function clampInt(value, fallback, min, max) {
  * del cliente (igual que `speak`): aca solo se valida la URL.
  */
 export function previewUrlTool(_root, { url } = {}) {
-  const parsed = normalizeHttpUrl(url);
+  const parsed = checkPreviewUrl(url);
   if (parsed.error) return `Error: ${parsed.error}`;
   return `Vista previa pedida: ${parsed.url}. La consola la abre en el panel de vista previa.`;
 }
@@ -558,7 +553,7 @@ export function showPlanTool(_root, { title, steps } = {}) {
  * muestre y Telegram la mande como foto.
  */
 export async function screenshotTool(_root, { url, fullPage, width, height } = {}) {
-  const parsed = checkHttpUrl(url);
+  const parsed = await checkHttpUrlResolved(url);
   if (parsed.error) return `Error: ${parsed.error}`;
   const size = {
     width: clampInt(width, 1280, 320, 3840),
@@ -595,7 +590,7 @@ export async function screenshotTool(_root, { url, fullPage, width, height } = {
 
 /** Errores y mensajes de consola de una pagina (ejecutando su JS). */
 export async function consoleTool(_root, { url, waitMs } = {}) {
-  const parsed = checkHttpUrl(url);
+  const parsed = await checkHttpUrlResolved(url);
   if (parsed.error) return `Error: ${parsed.error}`;
 
   let result;

package/harness/packages/core/src/tools/index.js

@@ -4,7 +4,7 @@ import { MCP_ROUTER_NAME, planMcpTools } from './mcp.js';
 export { createToolRegistry } from './registry.js';
 export { TOOL_DEFINITIONS, TOOL_NAMES } from './schema.js';
 export { DEFAULT_PERMISSIONS, evaluatePermission, bashGuard } from './permissions.js';
-export { resolveInRoot, toRel } from './paths.js';
+export { resolveInRoot, toRel, realpathDeep } from './paths.js';
 export { globToRegExp, walkFiles, DEFAULT_IGNORES } from './glob.js';
 export { MCP_ROUTER_NAME, MCP_AUTO_THRESHOLD, useLazyMcp, buildMcpIndex, mcpRouterDefinition, planMcpTools } from './mcp.js';
 export * as executors from './executors.js';

package/harness/packages/core/src/tools/paths.js

@@ -1,9 +1,36 @@
+import fs from 'node:fs';
 import path from 'node:path';
 
+/**
+ * realpath del segmento existente más profundo, más el resto del camino (que
+ * todavía no existe): `a/b/c` con `a/b` real devuelve `<real(a/b)>/c`.
+ */
+export function realpathDeep(target) {
+  let current = target;
+  const rest = [];
+  for (;;) {
+    try {
+      const real = fs.realpathSync(current);
+      return rest.length ? path.join(real, ...rest.reverse()) : real;
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return target;
+      rest.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+function escapes(base, target) {
+  const rel = path.relative(base, target);
+  return rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+}
+
 /**
  * Resolve a user-supplied path against the workspace root, refusing to escape
- * it. This is a lexical guard: `..`, absolute paths outside the root and
- * drive changes are rejected.
+ * it. Two guards: a lexical one (`..`, absolute paths outside the root, drive
+ * changes) and a real one over `fs.realpath`, because a symlink inside the
+ * workspace can point anywhere and the lexical check cannot see it.
  *
  * @param {string} root - absolute workspace root
  * @param {string} input - relative (or absolute-inside-root) path
@@ -14,11 +41,14 @@ export function resolveInRoot(root, input) {
   const raw = String(input ?? '.').trim() || '.';
   const target = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(base, raw);
 
-  const rel = path.relative(base, target);
-  const escapes = rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
-  if (escapes) {
+  if (escapes(base, target)) {
     throw new Error(`Ruta fuera del workspace: "${input}"`);
   }
+  const realBase = realpathDeep(base);
+  const realTarget = realpathDeep(target);
+  if (escapes(realBase, realTarget)) {
+    throw new Error(`Ruta fuera del workspace (symlink): "${input}"`);
+  }
   return target;
 }
 

package/harness/packages/core/src/tools/permissions.js

@@ -58,7 +58,6 @@ function subjectFor(name, args) {
 // `ask` = nunca se autoaprueba (siempre consulta, aunque bash sea `allow`).
 const BASH_DENY = [
   /:\s*\(\s*\)\s*\{[\s\S]*\}\s*;?\s*:/, // fork bomb :(){ :|:& };:
-  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\/|~|\$HOME|\/\*)(\s|$)/i,
   /\bmkfs(\.|\s|$)/i,
   /\bdd\b[^\n]*\bof=\/dev\//i,
   />\s*\/dev\/(sd|nvme|disk)/i,
@@ -67,18 +66,58 @@ const BASH_DENY = [
   /\b(?:remove-item|del|rd|rmdir|format)\b[^\n]*(?:-recurse|-r\b)[^\n]*\b[a-z]:\\?\s*$/i,
 ];
 const BASH_ASK = [
-  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\*|\.|\.\/)(\s|$)/i, // rm -rf * | . (workspace)
   /\bgit\s+push\b[^\n]*(\s-f\b|\s--force\b)/i,
   /\bgit\s+reset\s+--hard\b/i,
   /\bgit\s+clean\s+-[a-z]*f/i,
 ];
 
+// `rm` con flags peligrosos: se parsean los tokens en vez de mirar la grafia,
+// porque `rm --recursive --force /`, `rm -r -f /` y `rm -rf /` son lo mismo y
+// las regex de un solo cluster de flags solo cazaban la ultima.
+const RM_DEADLY_TARGETS = /^(\/|\/\*|\/\.\.|~|\$HOME|\$\{HOME\}|[a-z]:\\?(\*)?)$/i;
+const RM_WORKSPACE_TARGETS = /^(\*|\.{1,2}|\.\/?)$/i;
+
+/** Invocaciones de `rm` del comando: flags normalizados + primer argumento. */
+function rmInvocations(command) {
+  const out = [];
+  for (const segment of String(command).split(/[;&|\n]/)) {
+    const m = /(?:^|\s)(?:sudo\s+)?rm\s+(.*)$/i.exec(segment);
+    if (!m) continue;
+    let recursive = false;
+    let force = false;
+    let target = '';
+    for (const token of m[1].trim().split(/\s+/).filter(Boolean)) {
+      if (token === '--') continue;
+      if (token.startsWith('--')) {
+        if (/^--(recursive|no-preserve-root)$/i.test(token)) recursive = true;
+        if (/^--force$/i.test(token)) force = true;
+        continue;
+      }
+      if (token.startsWith('-')) {
+        const letters = token.slice(1);
+        if (/[rR]/.test(letters)) recursive = true;
+        if (/f/.test(letters)) force = true;
+        continue;
+      }
+      target = token.replace(/^["']|["']$/g, '');
+      break;
+    }
+    out.push({ recursive, force, target });
+  }
+  return out;
+}
+
 /** Devuelve `'deny'`/`'ask'` si el comando es peligroso, o `null`. */
 export function bashGuard(command) {
   const text = String(command ?? '');
   if (!text.trim()) return null;
   for (const re of BASH_DENY) if (re.test(text)) return 'deny';
   for (const re of BASH_ASK) if (re.test(text)) return 'ask';
+  for (const rm of rmInvocations(text)) {
+    if (!rm.recursive) continue;
+    if (RM_DEADLY_TARGETS.test(rm.target)) return 'deny';
+    if (rm.force && RM_WORKSPACE_TARGETS.test(rm.target)) return 'ask';
+  }
   return null;
 }
 

package/harness/packages/core/src/tools/registry.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { TOOL_DEFINITIONS, TOOL_NAMES } from './schema.js';
 import { EXECUTORS } from './executors.js';
-import { evaluatePermission } from './permissions.js';
+import { evaluatePermission, bashGuard } from './permissions.js';
 
 const WRITE_TOOLS = new Set(['write', 'edit']);
 
@@ -24,7 +24,9 @@ function extensionOf(p) {
  * @param {AbortSignal} [opts.signal] - cancela las tools de larga duracion (bash, git)
  */
 export function createToolRegistry({ root, enabled, permissions = {}, onAsk, onQuestion, yes = false, signal, writeExtensions } = {}) {
-  const names = new Set(enabled?.length ? enabled : TOOL_NAMES);
+  // `enabled` undefined = todas; una lista se respeta tal cual (vacía = ninguna,
+  // no "todas": un modo restringido no puede quedar sin tools por un filtro).
+  const names = new Set(Array.isArray(enabled) ? enabled : TOOL_NAMES);
   const definitions = TOOL_DEFINITIONS.filter((d) => names.has(d.function.name));
   const allowedWrite = Array.isArray(writeExtensions) && writeExtensions.length
     ? new Set(writeExtensions.map((ext) => String(ext).toLowerCase()))
@@ -38,8 +40,11 @@ export function createToolRegistry({ root, enabled, permissions = {}, onAsk, onQ
     if (!writeAllowed(name, args)) return 'deny';
     let decision = evaluatePermission(name, args, permissions);
     if (decision === 'ask') {
+      // Un `ask` del piso de seguridad (bashGuard) nunca se autoaprueba con
+      // `yes`: sin UI que pregunte (onAsk) queda denegado.
+      const guarded = name === 'bash' && bashGuard(args?.command) === 'ask';
       if (onAsk) decision = (await onAsk(name, args)) ? 'allow' : 'deny';
-      else decision = yes ? 'allow' : 'deny';
+      else decision = !guarded && yes ? 'allow' : 'deny';
     }
     return decision;
   }

package/harness/packages/core/src/tunnel.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { bridgeStatePath } from './config/home.js';
 import { pidAlive, killPidTree } from './pid.js';
 
@@ -18,9 +18,10 @@ function killTree(child) {
  * Estado del bridge (escrito por `tamnora bridge`), si el supervisor sigue
  * vivo. Lo consulta el server para saber que hay un tunel publico activo y
  * ajustar el modelo de confianza (guards locales, cookie Secure).
- * Cache de 1 s: se lee en cada request sensible y el pid no cambia tan rapido.
+ * Cache de 1 s + invalidacion por mtime del archivo: se lee en cada request
+ * sensible, pero un bridge.json nuevo (o borrado) se ve al instante.
  */
-let tunnelCache = { key: null, at: 0, state: null };
+let tunnelCache = { key: null, mtime: null, at: 0, state: null };
 export function tunnelState() {
   let statePath;
   try {
@@ -29,7 +30,16 @@ export function tunnelState() {
     return null;
   }
   const now = Date.now();
-  if (tunnelCache.key === statePath && now - tunnelCache.at < 1000) return tunnelCache.state;
+  let mtime = null;
+  try {
+    mtime = statSync(statePath).mtimeMs;
+  } catch {
+    tunnelCache = { key: statePath, mtime: null, at: now, state: null };
+    return null;
+  }
+  if (tunnelCache.key === statePath && tunnelCache.mtime === mtime && now - tunnelCache.at < 1000) {
+    return tunnelCache.state;
+  }
   let state = null;
   try {
     const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
@@ -39,7 +49,7 @@ export function tunnelState() {
   } catch {
     /* sin bridge */
   }
-  tunnelCache = { key: statePath, at: now, state };
+  tunnelCache = { key: statePath, mtime, at: now, state };
   return state;
 }
 

package/harness/packages/core/test/tools.test.js

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { mkdtemp, readFile, writeFile, mkdir, symlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { resolveInRoot, toRel } from '../src/tools/paths.js';
@@ -8,6 +8,7 @@ import { evaluatePermission, bashGuard } from '../src/tools/permissions.js';
 import { createTools, createToolRegistry } from '../src/tools/index.js';
 import {
   fetchUrlTool,
+  gitDiffTool,
   previewUrlTool,
   screenshotTool,
   consoleTool,
@@ -61,6 +62,48 @@ test('bashGuard marca comandos peligrosos (piso de seguridad)', () => {
   assert.equal(evaluatePermission('bash', { command: 'rm -rf ./dist' }, { bash: 'allow' }), 'allow');
 });
 
+test('bashGuard tolera grafías alternativas de flags en rm', () => {
+  assert.equal(bashGuard('rm --recursive --force /'), 'deny');
+  assert.equal(bashGuard('rm -r -f /'), 'deny');
+  assert.equal(bashGuard('rm -fr /'), 'deny');
+  assert.equal(bashGuard('rm -r -f ~'), 'deny');
+  assert.equal(bashGuard('rm --recursive --force *'), 'ask');
+  assert.equal(bashGuard('rm -r -f .'), 'ask');
+  assert.equal(bashGuard('rm -rf ./build'), null);
+  assert.equal(bashGuard('rm archivo.txt'), null);
+});
+
+test('el tier ask del piso de seguridad no se autoaprueba con yes', async () => {
+  const root = await makeWorkspace();
+  const auto = createToolRegistry({ root, permissions: { bash: 'allow' }, yes: true });
+  assert.equal(await auto.authorize('bash', { command: 'rm -rf *' }), 'deny', 'yes no saltea la guarda');
+
+  const interactive = createToolRegistry({ root, permissions: { bash: 'allow' }, onAsk: async () => true });
+  assert.equal(await interactive.authorize('bash', { command: 'rm -rf *' }), 'allow', 'onAsk si puede aprobar');
+
+  // Con `yes`, un ask normal (sin guarda) sigue autoaprobando.
+  assert.equal(await auto.authorize('write', { path: 'x.txt' }), 'allow');
+});
+
+test('git_diff rechaza refs que parecen opciones', async () => {
+  const root = await makeWorkspace();
+  const result = await gitDiffTool(root, { ref: '--output=/tmp/inyectado' });
+  assert.match(result, /ref.*inválido/i);
+});
+
+test('resolveInRoot no deja escapar por symlink', async () => {
+  const root = await makeWorkspace();
+  const outside = await mkdtemp(path.join(tmpdir(), 'tamnora-fuera-'));
+  await writeFile(path.join(outside, 'secreto.txt'), 'no tocar');
+  try {
+    await symlink(outside, path.join(root, 'link'), 'junction');
+  } catch {
+    return; // el fs no permite crear symlinks: nada que probar
+  }
+  assert.throws(() => resolveInRoot(root, 'link/secreto.txt'), /fuera del workspace/);
+  assert.equal(toRel(root, resolveInRoot(root, 'src/a.js')), 'src/a.js');
+});
+
 test('local tools read, write, list, glob, grep and edit', async () => {
   const root = await makeWorkspace();
   const reg = createToolRegistry({ root, permissions: { write: 'allow', edit: 'allow' } });