@danieltmn/tamnora 0.21.2 → 0.22.0

package/harness/packages/server/test/ops.test.js

@@ -0,0 +1,511 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, mkdir, writeFile, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createTamnoraServer } from '../src/index.js';
+import { setHome, ensureApp, readApp, writeApp, makeUser, screenshotsDir } from '../../core/src/index.js';
+import { fakeProvider, startServer, HAS_GIT, gitInit } from './helpers.js';
+
+test('serves health, providers and the console', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const health = await (await fetch(`${base}/api/health`)).json();
+    assert.equal(health.ok, true);
+    assert.equal(health.name, 'tamnora');
+
+    const providers = await (await fetch(`${base}/api/providers`)).json();
+    assert.ok(providers.providers.some((p) => p.id === 'openrouter'));
+    assert.equal(providers.active.provider, 'openrouter');
+
+    const html = await (await fetch(`${base}/`)).text();
+    assert.match(html, /Tamnora Console/);
+    for (const hook of [
+      'data-panel="agente"',
+      'data-panel="sesiones"',
+      'id="settings-controls-slot"',
+      'id="slash-menu"',
+      'id="statusbar"',
+      'id="sb-activity"',
+      // Nueva sesion tambien en el topbar: en movil el sidebar es un drawer y
+      // crear una sesion eran varios toques.
+      'id="new-session-top"',
+    ]) {
+      assert.ok(html.includes(hook), `falta ${hook}`);
+    }
+    // El boton del topbar tiene que estar en el header, no escondido en el
+    // drawer (que es donde vive `#new-session`).
+    const header = html.slice(0, html.indexOf('<main'));
+    assert.ok(header.includes('id="new-session-top"'), 'nueva sesion deberia estar en el topbar');
+    assert.equal((html.match(/id="new-session-top"/g) ?? []).length, 1);
+    assert.equal((html.match(/id="new-session"/g) ?? []).length, 1);
+    // Los controles de agente se declaran una sola vez (se mueven entre slots).
+    assert.equal((html.match(/id="mode"/g) ?? []).length, 1);
+
+    const missing = await fetch(`${base}/api/nope`);
+    assert.equal(missing.status, 404);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('manages scheduled tasks from the console', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  const create = (body) => fetch(`${base}/api/schedules`, { method: 'POST', headers: json, body: JSON.stringify(body) });
+  try {
+    let res = await create({ id: 'nightly', type: 'agent', spec: 'daily 03:00', prompt: 'hacé el resumen' });
+    assert.equal(res.status, 201);
+    let data = await res.json();
+    assert.equal(data.schedule.id, 'nightly');
+    assert.equal(data.schedule.enabled, true);
+    assert.ok(data.schedule.nextRun);
+
+    res = await create({ id: 'bad', spec: 'nope', prompt: 'x' });
+    assert.equal(res.status, 400);
+
+    res = await create({ id: 'nightly', type: 'agent', spec: 'daily 03:00', prompt: 'otra' });
+    assert.equal(res.status, 409);
+
+    res = await fetch(`${base}/api/schedules/nightly/toggle`, { method: 'POST' });
+    data = await res.json();
+    assert.equal(data.enabled, false);
+
+    data = await (await fetch(`${base}/api/schedules`)).json();
+    assert.equal(data.schedules.length, 1);
+    assert.equal(data.schedules[0].enabled, false);
+
+    res = await fetch(`${base}/api/schedules/nightly`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    assert.equal(data.schedules.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('runs a scheduled task on demand (shell and agent)', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sched-'));
+  const provider = {
+    id: 'fake',
+    async streamChat(_config, { onEvent }) {
+      onEvent?.({ type: 'text', delta: 'ok', full: 'ok' });
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  const create = (body) => fetch(`${base}/api/schedules`, { method: 'POST', headers: json, body: JSON.stringify(body) });
+  let data;
+  try {
+    await create({ id: 'ver', type: 'shell', spec: 'every 1 h', command: 'node', args: ['--version'] });
+    let res = await fetch(`${base}/api/schedules/ver/run`, { method: 'POST' });
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).ok, true);
+
+    await create({ id: 'nope', type: 'shell', spec: 'every 1 h', command: 'definitely-not-allowed' });
+    res = await fetch(`${base}/api/schedules/nope/run`, { method: 'POST' });
+    assert.equal(res.status, 500);
+
+    await create({ id: 'job', type: 'agent', spec: 'every 1 h', prompt: 'hacé algo útil', model: 'm' });
+    res = await fetch(`${base}/api/schedules/job/run`, { method: 'POST' });
+    data = await res.json();
+    assert.equal(res.status, 200, JSON.stringify(data));
+    assert.equal(data.ok, true, JSON.stringify(data));
+    assert.ok(data.result.sessionId);
+
+    const sessions = await (await fetch(`${base}/api/sessions`)).json();
+    assert.ok(sessions.sessions.some((s) => s.title === 'Tarea: job'));
+  } finally {
+    await instance.close();
+  }
+});
+
+test('detects, runs and stops dev processes', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proc-'));
+  await writeFile(path.join(cwd, 'package.json'), JSON.stringify({ scripts: { dev: 'node server.js' } }));
+  const { instance, base } = await startServer({ cwd });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const detected = await (await fetch(`${base}/api/procs/detect?cwd=${encodeURIComponent(cwd)}`)).json();
+    assert.ok(detected.chips.some((c) => c.command === 'npm' && c.args.includes('dev')));
+
+    const blocked = await fetch(`${base}/api/procs/start`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ cwd, command: 'curl' }),
+    });
+    assert.equal(blocked.status, 400);
+
+    const started = await (
+      await fetch(`${base}/api/procs/start`, {
+        method: 'POST',
+        headers: json,
+        body: JSON.stringify({ cwd, command: 'node', args: ['-e', 'console.log(42)'] }),
+      })
+    ).json();
+    assert.ok(started.proc.id);
+    await new Promise((resolve) => setTimeout(resolve, 500));
+
+    const logs = await (await fetch(`${base}/api/procs/${started.proc.id}/logs`)).json();
+    assert.match(logs.logs.map((l) => l.text).join(''), /42/);
+
+    const stopped = await fetch(`${base}/api/procs/${started.proc.id}/stop`, { method: 'POST' });
+    assert.equal(stopped.status, 200);
+
+    const badTunnel = await fetch(`${base}/api/preview/tunnel`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ port: 0 }),
+    });
+    assert.equal(badTunnel.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('runs a console shell command and kills a port', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-shell-'));
+  const { instance, base } = await startServer({ cwd });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const shell = await fetch(`${base}/api/shell`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ command: 'echo hola-shell' }),
+    });
+    assert.equal(shell.status, 200);
+    const out = await shell.json();
+    assert.match(out.output, /hola-shell/);
+
+    const missing = await fetch(`${base}/api/shell`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ command: '   ' }),
+    });
+    assert.equal(missing.status, 400);
+
+    const badPort = await fetch(`${base}/api/procs/kill`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ port: 0 }),
+    });
+    assert.equal(badPort.status, 400);
+
+    const none = await fetch(`${base}/api/procs/kill`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ port: 47555 }),
+    });
+    assert.equal(none.status, 200);
+    assert.deepEqual((await none.json()).pids, []);
+
+    const status = await fetch(`${base}/api/ports/47555`);
+    assert.equal(status.status, 200);
+    const info = await status.json();
+    assert.equal(info.port, 47555);
+    assert.equal(info.listening, false);
+    assert.deepEqual(info.pids, []);
+
+    const aliasKill = await fetch(`${base}/api/ports/kill`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ port: 47555 }),
+    });
+    assert.equal(aliasKill.status, 200);
+    assert.deepEqual((await aliasKill.json()).pids, []);
+
+    const badStatus = await fetch(`${base}/api/ports/0`);
+    assert.equal(badStatus.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('runs an evaluation over HTTP and persists the run', async () => {
+  const model = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (c) => (body += c));
+    req.on('end', () => {
+      res.setHeader('Content-Type', 'text/event-stream');
+      res.write(`data: ${JSON.stringify({ choices: [{ delta: { content: 'hola' } }] })}\n\n`);
+      res.write('data: [DONE]\n\n');
+      res.end();
+    });
+  });
+  await new Promise((r) => model.listen(0, '127.0.0.1', r));
+  const modelBase = `http://127.0.0.1:${model.address().port}/v1`;
+
+  const { instance, base } = await startServer();
+  try {
+    const res = await fetch(`${base}/api/eval`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        provider: 'openai-compatible',
+        baseUrl: modelBase,
+        models: ['mock'],
+        concurrency: 1,
+        tasks: [{ id: 't1', input: 'saluda', expect: { contains: 'hola' } }],
+      }),
+    });
+    const text = await res.text();
+    assert.match(text, /event: result/);
+    assert.match(text, /event: summary/);
+    assert.match(text, /"passed":1/);
+
+    const runs = await (await fetch(`${base}/api/runs`)).json();
+    assert.equal(runs.runs.length, 1);
+    const detail = await (await fetch(`${base}/api/runs/${runs.runs[0].id}`)).json();
+    assert.equal(detail.results.length, 1);
+    assert.equal(detail.results[0].passed, 1);
+  } finally {
+    await instance.close();
+    model.close();
+  }
+});
+
+test('creates a folder over HTTP and rejects bad input', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-newdir-'));
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  const create = (body) =>
+    fetch(`${base}/api/folders`, { method: 'POST', headers: json, body: JSON.stringify(body) });
+  try {
+    const created = await create({ parent: root, name: 'mi-proyecto' });
+    assert.equal(created.status, 201);
+    const data = await created.json();
+    assert.equal(data.path, path.join(root, 'mi-proyecto'));
+    assert.ok((await stat(data.path)).isDirectory());
+
+    assert.equal((await create({ parent: root, name: 'mi-proyecto' })).status, 409);
+    assert.equal((await create({ parent: root, name: '../escape' })).status, 400);
+    assert.equal((await create({ parent: root, name: '' })).status, 400);
+    assert.equal((await create({ name: 'sin-parent' })).status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('lists and previews workspace files, confining to the root', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-files-'));
+  await mkdir(path.join(root, 'src'));
+  await mkdir(path.join(root, 'node_modules'));
+  await writeFile(path.join(root, 'README.md'), '# hola\n');
+  await writeFile(path.join(root, 'src', 'index.js'), 'export const x = 1;\n');
+  await writeFile(path.join(root, 'zeta.bin'), Buffer.from([1, 2, 0, 3]));
+
+  const { instance, base } = await startServer();
+  const list = (params) => fetch(`${base}/api/files?${new URLSearchParams(params)}`);
+  const content = (params) => fetch(`${base}/api/files/content?${new URLSearchParams(params)}`);
+  try {
+    const top = await (await list({ root, path: '' })).json();
+    assert.equal(top.path, '');
+    assert.deepEqual(
+      top.entries.map((e) => `${e.type}:${e.name}`),
+      ['dir:src', 'file:README.md', 'file:zeta.bin']
+    );
+
+    const sub = await (await list({ root, path: 'src' })).json();
+    assert.deepEqual(sub.entries.map((e) => e.name), ['index.js']);
+    assert.equal(sub.entries[0].size > 0, true);
+
+    const preview = await (await content({ root, path: 'src/index.js' })).json();
+    assert.equal(preview.content, 'export const x = 1;\n');
+
+    assert.equal((await list({ root, path: '../../' })).status, 400);
+    assert.equal((await list({ root: path.join(root, 'nope') })).status, 400);
+    assert.equal((await content({ root, path: 'zeta.bin' })).status, 415);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('reports git status and per-file diffs', { skip: !HAS_GIT }, async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-git-'));
+  gitInit(root);
+  await writeFile(path.join(root, 'app.js'), 'const a = 1;\n');
+  execFileSync('git', ['add', 'app.js'], { cwd: root });
+  execFileSync('git', ['commit', '-q', '-m', 'init'], { cwd: root });
+  await writeFile(path.join(root, 'app.js'), 'const a = 2;\n');
+  await writeFile(path.join(root, 'nuevo.txt'), 'hola\n');
+
+  const { instance, base } = await startServer();
+  try {
+    const status = await (
+      await fetch(`${base}/api/git/status?${new URLSearchParams({ cwd: root })}`)
+    ).json();
+    assert.equal(status.isRepo, true);
+    assert.ok(status.branch);
+    assert.deepEqual(
+      status.entries.map((e) => e.path).sort(),
+      ['app.js', 'nuevo.txt']
+    );
+    assert.equal(status.entries.find((e) => e.path === 'app.js').status, 'modified');
+    assert.equal(status.entries.find((e) => e.path === 'nuevo.txt').status, 'untracked');
+
+    const diff = await (
+      await fetch(`${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: 'app.js' })}`)
+    ).json();
+    assert.match(diff.diff, /-const a = 1;/);
+    assert.match(diff.diff, /\+const a = 2;/);
+
+    const untracked = await (
+      await fetch(`${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: 'nuevo.txt' })}`)
+    ).json();
+    assert.equal(untracked.untracked, true);
+    assert.match(untracked.diff, /\+hola/);
+
+    const outside = await fetch(
+      `${base}/api/git/diff?${new URLSearchParams({ cwd: root, path: '../fuera' })}`
+    );
+    assert.equal(outside.status, 400);
+
+    const plain = await mkdtemp(path.join(tmpdir(), 'tamnora-nogit-'));
+    const none = await (
+      await fetch(`${base}/api/git/status?${new URLSearchParams({ cwd: plain })}`)
+    ).json();
+    assert.equal(none.isRepo, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('previews an HTML file through a static server', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-html-'));
+  await writeFile(path.join(root, 'index.html'), '<h1>hola</h1>');
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/files/preview`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ root, path: 'index.html' }),
+    });
+    assert.equal(res.status, 200);
+    const data = await res.json();
+    assert.match(data.url, /^http:\/\/127\.0\.0\.1:\d+\/index\.html$/);
+
+    const outside = await fetch(`${base}/api/files/preview`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ root, path: '../secret.txt' }),
+    });
+    assert.equal(outside.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('lists workspace folders and rejects invalid paths', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-folders-'));
+  await mkdir(path.join(root, 'beta'));
+  await mkdir(path.join(root, 'alpha'));
+  await writeFile(path.join(root, 'solo-archivo.txt'), 'x');
+
+  const { instance, base } = await startServer();
+  try {
+    const roots = await (await fetch(`${base}/api/folders`)).json();
+    assert.ok(roots.dirs.length >= 1);
+    assert.equal(roots.path, null);
+
+    const listed = await (await fetch(`${base}/api/folders?path=${encodeURIComponent(root)}`)).json();
+    assert.equal(listed.path, path.resolve(root));
+    assert.deepEqual(
+      listed.dirs.map((d) => d.name),
+      ['alpha', 'beta']
+    );
+    assert.ok(listed.parent);
+
+    const missing = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'nope'))}`);
+    assert.equal(missing.status, 400);
+
+    const file = await fetch(`${base}/api/folders?path=${encodeURIComponent(path.join(root, 'solo-archivo.txt'))}`);
+    assert.equal(file.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('requires login and CSRF when a user is configured', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-auth-'));
+  setHome(cwd);
+  const app = ensureApp();
+  app.user = makeUser('admin', 'secreto123');
+  writeApp(app);
+  assert.equal(readApp().user.name, 'admin');
+
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+  });
+  const info = await instance.listen({ port: 0 });
+  const base = info.url;
+  try {
+    const unauth = await fetch(`${base}/api/providers`);
+    assert.equal(unauth.status, 401);
+
+    const bad = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username: 'admin', password: 'nope' }),
+    });
+    assert.equal(bad.status, 401);
+
+    const login = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username: 'admin', password: 'secreto123' }),
+    });
+    assert.equal(login.status, 200);
+    const cookie = login.headers.get('set-cookie');
+    assert.ok(cookie);
+    const csrf = (await login.json()).csrf;
+    assert.ok(csrf);
+
+    const authed = await fetch(`${base}/api/providers`, { headers: { cookie } });
+    assert.equal(authed.status, 200);
+
+    const noCsrf = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', cookie },
+      body: JSON.stringify({ provider: 'openrouter' }),
+    });
+    assert.equal(noCsrf.status, 403);
+
+    const withCsrf = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', cookie, 'x-csrf': csrf },
+      body: JSON.stringify({ provider: 'openrouter' }),
+    });
+    assert.equal(withCsrf.status, 200);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('serves browser screenshots from the home dir, confined to png names', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-shots-'));
+  const { instance, base } = await startServer({ cwd });
+  try {
+    const dir = screenshotsDir();
+    await mkdir(dir, { recursive: true });
+    const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    await writeFile(path.join(dir, 'abc-123.png'), png);
+
+    const ok = await fetch(`${base}/api/screenshots/abc-123.png`);
+    assert.equal(ok.status, 200);
+    assert.equal(ok.headers.get('content-type'), 'image/png');
+    assert.equal((await ok.arrayBuffer()).byteLength, png.length);
+
+    assert.equal((await fetch(`${base}/api/screenshots/bad.txt`)).status, 400);
+    assert.equal((await fetch(`${base}/api/screenshots/missing.png`)).status, 404);
+  } finally {
+    await instance.close();
+  }
+});
+