@danieltmn/tamnora 0.23.0 → 0.23.1

package/CHANGELOG.md

@@ -5,6 +5,12 @@ Todos los cambios relevantes de este proyecto se documentan en este archivo.
 El formato sigue [Keep a Changelog](https://keepachangelog.com/es-ES/1.1.0/)
 y el proyecto usa [Versionado Semantico](https://semver.org/lang/es/).
 
+## [0.23.1] - 2026-10-28
+
+### Cambios
+
+- fix(spawn): evita el warning DEP0190 y hace puntual el stop del bridge
+
 ## [0.23.0] - 2026-10-28
 
 ### Cambios

package/harness/packages/cli/bin/tamnora.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 // node:sqlite sigue siendo "experimental" en Node 22, que avisa aunque ande. El
-// aviso no le aporta nada al usuario, asi que se filtra aca (lo que no sea un
-// warning de Node se imprime igual).
+// aviso no le aporta nada al usuario, asi que se filtra aca. Se quita el
+// impresor default de Node para que lo que si se imprime (lo que no sea
+// ExperimentalWarning) salga una sola vez, no dos.
+process.removeAllListeners('warning');
 process.on('warning', (warning) => {
   if (warning.name !== 'ExperimentalWarning') console.warn(warning.stack ?? warning);
 });

package/harness/packages/cli/src/commands/bridge.js

@@ -11,7 +11,7 @@ import {
   tailLines,
   bridgeLogPath,
 } from '../lib/daemon.js';
-import { startTunnel, probeTailscale, resetTailscaleServe } from '../lib/tunnel.js';
+import { startTunnel, probeTailscale, stopTailscaleServe } from '../lib/tunnel.js';
 import { qrTerminal } from '../lib/qr.js';
 
 const OPTIONS = {
@@ -193,10 +193,10 @@ async function cmdStop() {
     return 0;
   }
   try {
-    await resetTailscaleServe();
+    await stopTailscaleServe();
     stopped.push('tailscale serve');
   } catch (error) {
-    console.log(`No pude ejecutar tailscale serve reset: ${error.message}`);
+    console.log(`No pude detener tailscale serve: ${error.message}`);
   }
   // Mata el supervisor si quedo vivo.
   if (state.pid && pidAlive(state.pid)) {

package/harness/packages/cli/src/commands/update.js

@@ -16,8 +16,15 @@ const OPTIONS = {
   help: { type: 'boolean', short: 'h' },
 };
 
+// Con `shell: true` (npm.cmd en Windows) Node concatena los args sin escapar
+// (warning DEP0190): se manda un unico comando con args internos ya validados.
+function npmSpawn(args, extra = {}) {
+  const [cmd, cmdArgs] = IS_WIN ? [[NPM, ...args].join(' '), []] : [NPM, args];
+  return spawnSync(cmd, cmdArgs, { windowsHide: true, shell: IS_WIN, timeout: 180000, ...extra });
+}
+
 function npm(args) {
-  return spawnSync(NPM, args, { encoding: 'utf8', windowsHide: true, shell: IS_WIN, timeout: 180000 });
+  return npmSpawn(args, { encoding: 'utf8' });
 }
 
 /** Version del paquete instalado globalmente (la que resuelve `npm ls -g`). */
@@ -78,6 +85,10 @@ export async function updateCommand(argv) {
   }
 
   const tag = typeof values.tag === 'string' && values.tag ? values.tag : 'latest';
+  if (!/^[\w.-]+$/.test(tag)) {
+    console.error(`Tag invalido: ${tag}`);
+    return 1;
+  }
   const spec = `${PACKAGE}@${tag}`;
   const version = readPackageVersion();
   console.log(`Version actual: ${version}`);
@@ -115,7 +126,7 @@ export async function updateCommand(argv) {
   }
 
   console.log(`Actualizando a ${spec}...`);
-  const result = spawnSync(NPM, ['i', '-g', spec], { stdio: 'inherit', windowsHide: true, shell: IS_WIN });
+  const result = npmSpawn(['i', '-g', spec], { stdio: 'inherit' });
   if (result.status !== 0) {
     console.error(`La actualizacion fallo. Proba a mano: npm i -g ${spec}`);
     if (wasRunning) restartServer(wasRunning);

package/harness/packages/cli/test/bin-warning.test.js

@@ -0,0 +1,27 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const BIN = fileURLToPath(new URL('../bin/tamnora.mjs', import.meta.url));
+
+// El bin filtra el ExperimentalWarning de node:sqlite, pero no debe duplicar el
+// resto: sin quitar el impresor default de Node, cada warning salia dos veces.
+// El probe difiere el warning para que salte con el handler del bin ya instalado.
+test('el bin imprime cada warning una sola vez', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'tamnora-bin-'));
+  const probe = path.join(dir, 'probe.cjs');
+  await writeFile(probe, `setTimeout(() => process.emitWarning('aviso de prueba', 'CustomWarning'), 100);`);
+  const res = spawnSync(process.execPath, ['--require', probe, BIN, '--help'], {
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: 30000,
+  });
+  const out = `${res.stdout}\n${res.stderr}`;
+  const count = out.split('aviso de prueba').length - 1;
+  assert.equal(count, 1, `se esperaba 1 impresion del warning, hubo ${count}`);
+  assert.equal(res.status, 0);
+});

package/harness/packages/cli/test/tunnel.test.js

@@ -1,8 +1,26 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { parseTunnelmoleUrls, parseTailscaleStatus, startTunnel, tailscalePreviewUrl } from '../src/lib/tunnel.js';
+import { EventEmitter } from 'node:events';
+import {
+  parseTunnelmoleUrls,
+  parseTailscaleStatus,
+  startTunnel,
+  startTunnelmole,
+  stopTailscaleServe,
+  tailscalePreviewUrl,
+} from '../src/lib/tunnel.js';
 import { qrTerminal } from '../src/lib/qr.js';
 
+function fakeChild(exitCode = 0) {
+  const child = new EventEmitter();
+  child.stdout = new EventEmitter();
+  child.stderr = new EventEmitter();
+  child.pid = 0;
+  child.killed = false;
+  setImmediate(() => child.emit('exit', exitCode));
+  return child;
+}
+
 test('parseTunnelmoleUrls extracts the https URL', () => {
   const out = parseTunnelmoleUrls('Listening at https://abc-123.tunnelmole.net (forwarding to 4517)');
   assert.equal(out.https, 'https://abc-123.tunnelmole.net');
@@ -38,6 +56,36 @@ test('startTunnel con provider none no abre nada', async () => {
   assert.equal(tun.url, '');
 });
 
+test('stopTailscaleServe apaga solo el handler 443 y lanza tailscale sin shell', async () => {
+  const calls = [];
+  const spawnImpl = (cmd, args, options) => {
+    calls.push({ cmd, args, options });
+    return fakeChild();
+  };
+  await stopTailscaleServe({ spawnImpl });
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].cmd, 'tailscale');
+  assert.deepEqual(calls[0].args, ['serve', '--https=443', 'off']);
+  assert.equal(calls[0].options.shell, undefined);
+});
+
+test(
+  'startTunnelmole con shell manda un unico comando (Node no concatena args)',
+  { skip: process.platform !== 'win32' },
+  async () => {
+    const calls = [];
+    const spawnImpl = (cmd, args, options) => {
+      calls.push({ cmd, args, options });
+      return fakeChild(1);
+    };
+    await assert.rejects(() => startTunnelmole(4517, { spawnImpl }), /termino/);
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].cmd, 'npx --yes tunnelmole 4517');
+    assert.deepEqual(calls[0].args, []);
+    assert.equal(calls[0].options.shell, true);
+  }
+);
+
 test('tailscalePreviewUrl usa el 8443 y omite el 443', () => {
   assert.equal(tailscalePreviewUrl('pc.tailnet.ts.net'), 'https://pc.tailnet.ts.net:8443');
   assert.equal(tailscalePreviewUrl('pc.tailnet.ts.net', 9000), 'https://pc.tailnet.ts.net:9000');

package/harness/packages/core/src/index.js

@@ -150,7 +150,7 @@ export {
   parseTunnelmoleUrls,
   parseTailscaleStatus,
   probeTailscale,
-  resetTailscaleServe,
+  stopTailscaleServe,
   startTailscaleServe,
   startTailscalePreview,
   startTunnelmole,

package/harness/packages/core/src/tunnel.js

@@ -71,14 +71,19 @@ function spawnTunnel(bin, args, opts = {}) {
   const parse = opts.parse || (() => ({ https: '', http: '' }));
   const timeoutMs = opts.timeoutMs || 90000;
   const label = opts.label || bin;
+  const useShell = process.platform === 'win32';
   return new Promise((resolve, reject) => {
     let child;
     try {
-      child = spawn(bin, args, {
+      // En Windows `npx` es un shim .cmd y exige shell; ahi se manda un unico
+      // comando (ver shellCommandLine): con array de args Node concatena sin
+      // escapar y emite el warning DEP0190.
+      const [cmd, cmdArgs] = useShell ? [shellCommandLine(bin, args), []] : [bin, args];
+      child = (opts.spawnImpl || spawn)(cmd, cmdArgs, {
         stdio: ['ignore', 'pipe', 'pipe'],
         windowsHide: true,
-        shell: process.platform === 'win32',
-        detached: process.platform !== 'win32',
+        shell: useShell,
+        detached: !useShell,
       });
     } catch (err) {
       reject(new Error(`no se pudo iniciar ${label}: ${err.message}`));
@@ -138,15 +143,29 @@ export function startTunnelmole(port, opts = {}) {
  * tailnet reenviando a loopback, asi que no hay exposicion publica y las
  * peticiones siguen siendo "locales" para el server. Proveedor recomendado.
  */
+// Con `shell: true` Node concatena los args sin escapar (warning DEP0190): se
+// arma un unico comando con args validados contra metacaracteres del shell.
+const SAFE_SHELL_ARG = /^[^&|<>^%!"\r\n]+$/;
+
+function shellCommandLine(bin, args) {
+  for (const arg of args) {
+    if (!SAFE_SHELL_ARG.test(String(arg))) {
+      throw new Error(`argumento no permitido para ${bin}: "${arg}"`);
+    }
+  }
+  return [bin, ...args].join(' ');
+}
+
 function runTailscale(args, opts = {}) {
   const timeoutMs = opts.timeoutMs || 15000;
   return new Promise((resolve, reject) => {
     let child;
     try {
-      child = spawn('tailscale', args, {
+      // `tailscale` es un ejecutable real (.exe en Windows): resuelve por PATH
+      // sin shell, que ademas evita el warning DEP0190 de Node.
+      child = (opts.spawnImpl || spawn)('tailscale', args, {
         stdio: ['ignore', 'pipe', 'pipe'],
         windowsHide: true,
-        shell: process.platform === 'win32',
       });
     } catch (err) {
       reject(err);
@@ -241,7 +260,7 @@ export async function startTailscaleServe(port, opts = {}) {
     pid: 0,
     child: null,
     probeUrl: `${url}/api/health`,
-    stop: () => runTailscale(['serve', 'reset']).catch(() => {}),
+    stop: () => stopTailscaleServe().catch(() => {}),
   };
 }
 
@@ -279,9 +298,13 @@ export async function probeTailscale() {
   return parseTailscaleStatus(stdout);
 }
 
-/** Quita toda la configuracion de `tailscale serve` de este nodo. */
-export function resetTailscaleServe() {
-  return runTailscale(['serve', 'reset'], { timeoutMs: 30000 });
+/**
+ * Apaga el handler `serve` de la consola (https 443) de forma puntual: un
+ * `serve reset` borraria tambien los otros handlers (p.ej. el preview en 8443).
+ */
+export function stopTailscaleServe(opts = {}) {
+  const httpsPort = Number(opts.httpsPort) || 443;
+  return runTailscale(['serve', `--https=${httpsPort}`, 'off'], { timeoutMs: 30000, spawnImpl: opts.spawnImpl });
 }
 
 /**

package/harness/packages/server/bin/tamnora-server.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 // node:sqlite sigue siendo "experimental" en Node 22, que avisa aunque ande. El
-// aviso no le aporta nada al usuario, asi que se filtra aca (lo que no sea un
-// warning de Node se imprime igual).
+// aviso no le aporta nada al usuario, asi que se filtra aca. Se quita el
+// impresor default de Node para que lo que si se imprime (lo que no sea
+// ExperimentalWarning) salga una sola vez, no dos.
+process.removeAllListeners('warning');
 process.on('warning', (warning) => {
   if (warning.name !== 'ExperimentalWarning') console.warn(warning.stack ?? warning);
 });

package/harness/packages/server/public/index.html

@@ -75,7 +75,7 @@
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span id="topbar-section" class="topbar-section">chat</span> <span class="ver">v0.23.0</span></div>
+      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span id="topbar-section" class="topbar-section">chat</span> <span class="ver">v0.23.1</span></div>
       <div class="settings">
         <button id="new-session-top" type="button" class="btn topbar-new" title="nueva sesión" aria-label="nueva sesión">
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" aria-hidden="true">

package/harness/packages/server/src/lib/procs.js

@@ -76,7 +76,10 @@ export function createProcManager({ allow } = {}) {
         throw new Error(`Argumento no permitido con shell en Windows: "${bad}".`);
       }
     }
-    const child = spawn(bin, list, {
+    // Con `shell: true` y array de args Node concatena sin escapar (warning
+    // DEP0190): se manda un unico comando (los args ya pasaron SAFE_SHELL_ARG).
+    const [cmd, cmdArgs] = shell ? [`${bin} ${list.join(' ')}`, []] : [bin, list];
+    const child = spawn(cmd, cmdArgs, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,

package/harness/packages/server/test/procs-manager.test.js

@@ -29,6 +29,23 @@ test('en Windows los args no admiten metacaracteres del shell', { skip: process.
   }
 });
 
+test('un comando bare con args no dispara el warning DEP0190 de Node', { skip: process.platform !== 'win32' }, async () => {
+  const cwd = await workspace();
+  const procs = createProcManager({ allow: ['node'] });
+  const warnings = [];
+  const onWarn = (warning) => warnings.push(warning);
+  process.on('warning', onWarn);
+  let proc;
+  try {
+    proc = procs.start({ cwd, command: 'node', args: ['-e', 'process.exit(0)'] });
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  } finally {
+    process.removeListener('warning', onWarn);
+    if (proc) procs.stop(proc.id);
+  }
+  assert.deepEqual(warnings.filter((w) => w.code === 'DEP0190'), []);
+});
+
 test('procs arranca y detiene un proceso permitido', async () => {
   const cwd = await workspace();
   const procs = createProcManager({ allow: ['node'] });

package/harness/scripts/self-update.mjs

@@ -77,8 +77,11 @@ async function waitDead(p, ms = 15000) {
   return true;
 }
 
+// Con `shell: true` (npm.cmd en Windows) Node concatena los args sin escapar
+// (warning DEP0190): se manda un unico comando con args internos.
 function runNpm(args) {
-  return spawnSync(NPM, args, { encoding: 'utf8', windowsHide: true, shell: IS_WIN, timeout: 180000 });
+  const [cmd, cmdArgs] = IS_WIN ? [[NPM, ...args].join(' '), []] : [NPM, args];
+  return spawnSync(cmd, cmdArgs, { encoding: 'utf8', windowsHide: true, shell: IS_WIN, timeout: 180000 });
 }
 
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",