@danieltmn/tamnora 0.24.2 → 0.25.1

package/harness/packages/server/src/routes/reload.js

@@ -0,0 +1,46 @@
+// Recargas operativas desde la consola: reiniciar el server y (re)abrir el
+// puente remoto (tailscale). Son privilegiadas, igual que update/shell/git:
+// solo conexion local. En ambos casos la respuesta vuelve rapido y la accion
+// corre aparte (script detached / `tailscale serve --bg`).
+import { sendJson, sendError } from '../lib/http.js';
+import { requireLocal } from '../lib/workspace.js';
+import { spawnRestart } from '../lib/restart.js';
+import { startTailscaleServe, stopTailscaleServe } from '../lib/core.js';
+
+export function registerReload(route, ctx) {
+  route('POST', '/api/server/restart', ({ req, res }) => {
+    if (!requireLocal(req, res, 'Reiniciar el servidor solo esta permitido en la conexion local.')) return;
+
+    const spawnRestarter = ctx.spawnRestarter ?? spawnRestart;
+    const started = spawnRestarter({
+      pid: process.pid,
+      argv: process.argv.slice(1),
+    });
+    if (!started.ok) return sendError(res, 500, started.error);
+
+    sendJson(res, 202, { ok: true, restarting: true });
+    // Soltar el puerto antes de que el server nuevo intente entrar.
+    setTimeout(() => {
+      Promise.resolve(ctx.shutdown?.()).catch(() => process.exit(0));
+    }, 800);
+  });
+
+  route('POST', '/api/bridge/reload', async ({ req, res }) => {
+    if (!requireLocal(req, res, 'Abrir el puente solo esta permitido en la conexion local.')) return;
+
+    const port = ctx.serverInfo?.port;
+    if (!port) return sendError(res, 500, 'No se en que puerto corre el server.');
+
+    // Reinicio puntual: apagar el handler de la consola (443) y volver a
+    // publicarlo. Un `serve reset` borraria tambien el preview en 8443.
+    const stop = ctx.tunnelStop ?? stopTailscaleServe;
+    const start = ctx.tunnelStart ?? startTailscaleServe;
+    try {
+      await stop().catch(() => {});
+      const tun = await start(port);
+      sendJson(res, 200, { ok: true, url: tun.url, provider: tun.provider ?? 'tailscale' });
+    } catch (error) {
+      sendError(res, 502, String(error?.message ?? error));
+    }
+  });
+}

package/harness/packages/server/src/routes/sessions.js

@@ -1,5 +1,5 @@
 import { readJson, sendJson, sendError } from '../lib/http.js';
-import { resolveMode } from '../lib/core.js';
+import { resolveMode, normalizeEffort } from '../lib/core.js';
 import { workspaceForRequest } from '../lib/workspace.js';
 import { sessionView, sessionState, awaitingBySession } from '../lib/sessionView.js';
 import { summarizeSession, compactSession, SUMMARY_INSTRUCTION } from '../lib/compact.js';
@@ -49,6 +49,7 @@ export function registerSessions(route, ctx) {
     const meta = {};
     if (body.goal) meta.goal = String(body.goal);
     if (body.mode) meta.mode = resolveMode(String(body.mode)).id;
+    if ('effort' in body) meta.effort = normalizeEffort(body.effort);
     const id = ctx.store.createSession({
       title: String(body.title || 'Nueva sesión').slice(0, 80),
       provider: body.provider || ctx.effectiveProviderId(),
@@ -105,6 +106,7 @@ export function registerSessions(route, ctx) {
     const meta = {};
     if ('goal' in body) meta.goal = body.goal ? String(body.goal) : undefined;
     if ('mode' in body) meta.mode = resolveMode(String(body.mode)).id;
+    if ('effort' in body) meta.effort = normalizeEffort(body.effort);
     if (Object.keys(meta).length) patch.meta = meta;
     ctx.store.touchSession(params.id, patch);
     sendJson(res, 200, { session: sessionView(ctx.store.getSession(params.id)) });

package/harness/packages/server/src/server.js

@@ -17,12 +17,15 @@ import {
   MCP_AUTO_THRESHOLD,
   readPackageVersion,
   scopeDirective,
+  normalizeEffort,
 } from './lib/core.js';
 import { sendJson, sendError } from './lib/http.js';
 import { requireTrustedHost, requireSameOrigin } from './lib/workspace.js';
+import { applySecurityHeaders, cspMode } from './lib/securityHeaders.js';
 import { createPromptBuilder, DEFAULT_SYSTEM_PROMPT } from './lib/prompt.js';
 import { profilePrompt, resolveProfile } from './lib/profile.js';
 import { skillsBlock } from './lib/skills.js';
+import { agentsIndexPrompt } from './lib/agents.js';
 import { createApprovalBroker } from './lib/approvals.js';
 import { createQuestionBroker } from './lib/questions.js';
 import { createPresence } from './lib/presence.js';
@@ -41,12 +44,14 @@ import { registerModels } from './routes/models.js';
 import { registerProviders } from './routes/providers.js';
 import { registerMcp } from './routes/mcp.js';
 import { registerSkills } from './routes/skills.js';
+import { registerAgents } from './routes/agents.js';
 import { registerMemory } from './routes/memory.js';
 import { registerChannels } from './routes/channels.js';
 import { registerProfile } from './routes/profile.js';
 import { registerTts } from './routes/tts.js';
 import { registerTranscribe } from './routes/transcribe.js';
 import { registerUpdate } from './routes/update.js';
+import { registerReload } from './routes/reload.js';
 import { registerAdvisor } from './routes/advisor.js';
 import { registerProcs } from './routes/procs.js';
 import { registerShell } from './routes/shell.js';
@@ -181,6 +186,7 @@ export async function createTamnoraServer({
   const effectiveMaxDurationMs = () => settingNumber('maxDurationMs', config.maxDurationMs);
   const effectiveMaxOutputTokens = () => settingNumber('maxOutputTokens', config.maxOutputTokens);
   const effectiveStrictScope = () => store.getSetting('strictScope') === true;
+  const effectiveEffort = () => normalizeEffort(store.getSetting('activeEffort') ?? config.effort);
   const effectivePromptCaching = () => {
     const stored = store.getSetting('promptCaching');
     if (stored === null || stored === undefined) return config.promptCaching === true;
@@ -226,6 +232,7 @@ export async function createTamnoraServer({
     effectiveMaxDurationMs,
     effectiveMaxOutputTokens,
     effectiveStrictScope,
+    effectiveEffort,
     effectivePromptCaching,
     effectiveMcpMode,
     effectiveMcpPinned,
@@ -267,6 +274,7 @@ export async function createTamnoraServer({
     files: config.instructions,
     profileText: () => profilePrompt(resolveProfile(ctx.app)),
     skillsText: () => skillsBlock(ctx),
+    agentsText: () => agentsIndexPrompt(ctx),
     mcpText: () => ctx.mcpText(),
     scopeText: () => scopeDirective(ctx.effectiveStrictScope()),
     ruleFiles: config.rules ?? [],
@@ -324,6 +332,7 @@ export async function createTamnoraServer({
   registerProviders(route, ctx);
   registerMcp(route, ctx);
   registerSkills(route, ctx);
+  registerAgents(route, ctx);
   registerMemory(route, ctx);
   registerChannels(route, ctx);
   registerProfile(route, ctx);
@@ -331,6 +340,7 @@ export async function createTamnoraServer({
   registerTranscribe(route, ctx);
   registerAdvisor(route, ctx);
   registerUpdate(route, ctx);
+  registerReload(route, ctx);
   registerProcs(route, ctx);
   registerShell(route, ctx);
   const preview = registerPreview(route, ctx);
@@ -376,8 +386,10 @@ export async function createTamnoraServer({
   const sockets = new Set();
   const server = http.createServer(async (req, res) => {
     const url = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
+    const isApi = url.pathname.startsWith('/api/');
+    applySecurityHeaders(res, { api: isApi, csp: cspMode(config) });
 
-    if (url.pathname.startsWith('/api/')) {
+    if (isApi) {
       const matched = matchRoute(req.method, url.pathname);
       if (!matched) return sendError(res, 404, `Ruta no encontrada: ${req.method} ${url.pathname}`);
       // Guardas de request SIEMPRE activas (con o sin auth): DNS-rebinding y

package/harness/packages/server/test/accessibility.test.js

@@ -0,0 +1,72 @@
+// Accesibilidad de la consola que se verifica sobre el texto de los archivos.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readdirSync, readFileSync } from 'node:fs';
+import { readStyles } from './themeCss.js';
+
+const PUBLIC = new URL('../public/', import.meta.url);
+const css = readStyles();
+
+/** Contenido del bloque `@media (...)` que empieza en `inicio`. */
+function bloqueMedia(inicio) {
+  const abre = css.indexOf('{', inicio);
+  let prof = 0;
+  for (let i = abre; i < css.length; i += 1) {
+    if (css[i] === '{') prof += 1;
+    else if (css[i] === '}') {
+      prof -= 1;
+      if (prof === 0) return css.slice(abre + 1, i);
+    }
+  }
+  throw new Error('bloque sin cerrar');
+}
+
+test('prefers-reduced-motion apaga transiciones y los pulsos decorativos', () => {
+  const inicio = css.indexOf('@media (prefers-reduced-motion: reduce)');
+  assert.ok(inicio >= 0, 'falta el bloque de movimiento reducido');
+  const bloque = bloqueMedia(inicio);
+  assert.match(bloque, /transition-duration:\s*0\.01ms/);
+  assert.match(bloque, /scroll-behavior:\s*auto/);
+  assert.match(bloque, /animation:\s*none/);
+});
+
+test('toda animacion infinita que no es un indicador de progreso se apaga con movimiento reducido', () => {
+  // Quedan fuera los loaders y el spinner: indican que el agente esta trabajando.
+  const PROGRESO = new Set(['loader-thinking', 'loader-working', 'spin']);
+  const bloque = bloqueMedia(css.indexOf('@media (prefers-reduced-motion: reduce)'));
+
+  const reglas = [...css.matchAll(/([^{}]+)\{([^{}]*animation:\s*([a-z-]+)[^;}]*infinite[^;}]*;?[^{}]*)\}/g)];
+  assert.ok(reglas.length >= 5, 'no se leyeron las animaciones');
+  for (const [, selectores, , nombre] of reglas) {
+    if (PROGRESO.has(nombre)) continue;
+    for (const selector of selectores.split(',').map((s) => s.trim()).filter(Boolean)) {
+      const limpio = selector.split('\n').pop().trim();
+      assert.ok(bloque.includes(limpio), `"${limpio}" anima (${nombre}) y no se apaga con movimiento reducido`);
+    }
+  }
+});
+
+test('el scroll animado de JS respeta el movimiento reducido', () => {
+  for (const archivo of readdirSync(PUBLIC).filter((f) => f.endsWith('.js'))) {
+    const src = readFileSync(new URL(archivo, PUBLIC), 'utf8');
+    assert.ok(!/behavior:\s*['"]smooth['"]/.test(src), `${archivo} fuerza scroll animado: usar scrollBehavior()`);
+  }
+});
+
+test('en pantallas tactiles los campos van a 16px (iOS hace zoom con menos)', () => {
+  const inicio = css.indexOf('@media (pointer: coarse), (max-width: 480px)');
+  assert.ok(inicio >= 0, 'falta el bloque tactil');
+  const bloque = bloqueMedia(inicio);
+  assert.match(bloque, /select,[\s\S]*font-size:\s*16px/);
+  assert.match(bloque, /min-height:\s*40px/);
+});
+
+test('el foco de teclado es visible en botones, enlaces y elementos enfocables', () => {
+  assert.match(css, /button:focus-visible, a:focus-visible, summary:focus-visible, \[tabindex\]:focus-visible \{\s*outline: 2px solid var\(--accent\)/);
+});
+
+test('las regiones que cambian solas se anuncian a lectores de pantalla', () => {
+  const html = readFileSync(new URL('index.html', PUBLIC), 'utf8');
+  assert.ok(/id="toasts"[^>]*aria-live="polite"/.test(html), 'los avisos (toasts) deberian ser aria-live');
+  assert.ok(/id="sb-activity"[^>]*(role="status"|aria-live)/.test(html), 'la actividad del agente deberia ser un status');
+});

package/harness/packages/server/test/agents.test.js

@@ -0,0 +1,194 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { startServer } from './helpers.js';
+
+const json = { 'Content-Type': 'application/json' };
+
+test('manages subagents from the console (CRUD + toggle)', async () => {
+  const { instance, base } = await startServer();
+  try {
+    let data = await (await fetch(`${base}/api/agents`)).json();
+    assert.deepEqual(data.agents, []);
+
+    let res = await fetch(`${base}/api/agents/revisor`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'Revisor',
+        description: 'Busca bugs',
+        provider: 'openai',
+        model: 'gpt',
+        mode: 'plan',
+        effort: 'high',
+        maxRounds: 4,
+        tools: ['read', 'grep'],
+        skills: ['code-review'],
+        body: '# Rol\nMirá el diff.',
+      }),
+    });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    const agent = data.agents.find((item) => item.id === 'revisor');
+    assert.equal(agent.name, 'Revisor');
+    assert.equal(agent.effort, 'high');
+    assert.equal(agent.mode, 'plan');
+    assert.equal(agent.maxRounds, 4);
+    assert.deepEqual(agent.tools, ['read', 'grep']);
+    assert.deepEqual(agent.skills, ['code-review']);
+    assert.equal(agent.enabled, true);
+
+    const detail = await (await fetch(`${base}/api/agents/revisor`)).json();
+    assert.match(detail.agent.body, /Mirá el diff/);
+
+    res = await fetch(`${base}/api/agents/revisor/toggle`, { method: 'POST' });
+    data = await res.json();
+    assert.equal(data.enabled, false);
+    data = await (await fetch(`${base}/api/agents`)).json();
+    assert.equal(data.agents[0].enabled, false);
+
+    res = await fetch(`${base}/api/agents/revisor/toggle`, { method: 'POST' });
+    assert.equal((await res.json()).enabled, true);
+
+    res = await fetch(`${base}/api/agents/revisor`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    data = await res.json();
+    assert.deepEqual(data.agents, []);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('rejects invalid subagent payloads', async () => {
+  const { instance, base } = await startServer();
+  try {
+    let res = await fetch(`${base}/api/agents/${encodeURIComponent('../escape')}`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ body: 'x' }),
+    });
+    assert.equal(res.status, 400);
+
+    res = await fetch(`${base}/api/agents/vacio`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ mode: 'plan' }),
+    });
+    assert.equal(res.status, 400);
+    assert.match((await res.json()).error, /cuerpo o una descripción/);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('effort persists globally and per session', async () => {
+  const { instance, base } = await startServer();
+  try {
+    let data = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(data.settings.effort, '');
+
+    let res = await fetch(`${base}/api/settings`, { method: 'PUT', headers: json, body: JSON.stringify({ effort: 'max' }) });
+    data = await res.json();
+    assert.equal(data.settings.effort, 'max');
+
+    res = await fetch(`${base}/api/settings`, { method: 'PUT', headers: json, body: JSON.stringify({ effort: 'auto' }) });
+    assert.equal((await res.json()).settings.effort, '');
+
+    res = await fetch(`${base}/api/sessions`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ title: 'con esfuerzo', model: 'm', effort: 'low' }),
+    });
+    const created = await res.json();
+    assert.equal(created.session.effort, 'low');
+
+    res = await fetch(`${base}/api/sessions/${created.session.id}`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ effort: 'high' }),
+    });
+    assert.equal((await res.json()).session.effort, 'high');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('a named subagent runs with its own model, effort and instructions', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-subagent-'));
+  const calls = { parent: 0 };
+  const sub = {};
+  const parent = {
+    id: 'parent',
+    async streamChat() {
+      calls.parent += 1;
+      if (calls.parent === 1) {
+        return {
+          content: '',
+          reasoning: '',
+          toolCalls: [
+            {
+              id: 't1',
+              type: 'function',
+              function: {
+                name: 'task',
+                arguments: JSON.stringify({ agent: 'revisor', description: 'revisión', prompt: 'revisá el cambio' }),
+              },
+            },
+          ],
+        };
+      }
+      return { content: 'listo', reasoning: '', toolCalls: [] };
+    },
+  };
+  const revisor = {
+    id: 'revisor',
+    async streamChat(_config, { model, messages, reasoningEffort }) {
+      Object.assign(sub, { model, reasoningEffort, system: messages?.[0]?.content ?? '' });
+      return { content: 'resumen del revisor', reasoning: '', toolCalls: [] };
+    },
+  };
+  const providers = { parent, revisor };
+  const { instance, base } = await startServer({
+    cwd,
+    resolveProvider: ({ providerId }) => ({ provider: providers[providerId] ?? parent, config: {} }),
+  });
+  try {
+    await fetch(`${base}/api/agents/revisor`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'Revisor',
+        description: 'Busca bugs',
+        provider: 'revisor',
+        model: 'revisor-model',
+        mode: 'plan',
+        effort: 'high',
+        body: 'MARCADOR_REVISOR',
+      }),
+    });
+
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: json,
+        body: JSON.stringify({ title: 'delegar', model: 'parent-model', provider: 'parent' }),
+      })
+    ).json();
+    await (
+      await fetch(`${base}/api/chat`, {
+        method: 'POST',
+        headers: json,
+        body: JSON.stringify({ sessionId: created.session.id, input: 'delegá al revisor', model: 'parent-model', provider: 'parent' }),
+      })
+    ).text();
+
+    assert.equal(sub.model, 'revisor-model');
+    assert.equal(sub.reasoningEffort, 'high');
+    assert.match(sub.system, /MARCADOR_REVISOR/);
+    assert.equal(calls.parent >= 2, true);
+  } finally {
+    await instance.close();
+  }
+});

package/harness/packages/server/test/appearance.test.js

@@ -79,10 +79,14 @@ test('la validacion del server coincide con el registro del cliente', () => {
       'solarized-dark',
       'bosque',
       'vino',
+      'arena',
+      'hielo',
       'vercel',
       'dark-plus',
       'github',
       'github-dark',
+      'mocha',
+      'ebano',
     ].sort()
   );
   assert.equal(resolveThemeId('solarized-dark'), 'solarized-dark');

package/harness/packages/server/test/consoleModules.test.js

@@ -53,34 +53,147 @@ function importsDe(archivo) {
 const exportsPorModulo = new Map(modulos.map((m) => [m, exportsDe(m)]));
 const importsPorModulo = new Map(modulos.map((m) => [m, importsDe(m)]));
 
+/**
+ * Copia del source con cadenas, comentarios y literales regex **vaciados**
+ * (mismos largos y saltos de linea). Contar llaves/parentesis o buscar llamadas
+ * sobre esta copia no se confunde con un `}` de un string, un `(` de un
+ * comentario ni con los grupos de un regex. Los templates se vacian enteros
+ * salvo sus interpolaciones (`${...}`, que es codigo real): un barrido naive
+ * cierra en el backtick del template anidado (`${x.map((v) => `${v}`)}`) y
+ * desbalancea todo lo que viene despues.
+ */
+function sinCadenas(src) {
+  const out = [...src];
+  const vaciar = (i) => {
+    if (out[i] !== '\n') out[i] = ' ';
+    return i + 1;
+  };
+  // Un `/` abre regex salvo que venga de un valor (division): `a / b` vs
+  // `return /re/`, `if (/re/)`, `x = /re/`.
+  const TRAS_REGEX = new Set(['return', 'typeof', 'instanceof', 'in', 'of', 'delete', 'void', 'new', 'do', 'else', 'yield', 'await', 'case']);
+  const PUNCT_REGEX = new Set(['(', '[', '{', '=', ':', ',', ';', '!', '?', '&', '|', '+', '-', '*', '%', '^', '~', '<', '>', '']);
+  let ultimaPalabra = '';
+  let ultimoChar = '';
+
+  function plantilla(i) {
+    while (i < src.length) {
+      const c = src[i];
+      if (c === '\\') i = vaciar(vaciar(i));
+      else if (c === '`') return vaciar(i);
+      else if (c === '$' && src[i + 1] === '{') {
+        i = vaciar(vaciar(i));
+        i = codigo(i, true);
+        if (i < src.length) i = vaciar(i);
+      } else i = vaciar(i);
+    }
+    return i;
+  }
+
+  function literarRegex(i) {
+    let enClase = false;
+    i = vaciar(i);
+    while (i < src.length && src[i] !== '\n') {
+      const c = src[i];
+      if (c === '\\') {
+        i = vaciar(vaciar(i));
+        continue;
+      }
+      if (c === '[') enClase = true;
+      else if (c === ']') enClase = false;
+      else if (c === '/' && !enClase) return vaciar(i) + saltarFlags(i + 1);
+      i = vaciar(i);
+    }
+    return i + saltarFlags(i);
+  }
+
+  function saltarFlags(i) {
+    let j = i;
+    while (j < src.length && /[a-z]/i.test(src[j])) j = vaciar(j);
+    return j - i;
+  }
+
+  function codigo(i, cierraInterp) {
+    let prof = 0;
+    while (i < src.length) {
+      const c = src[i];
+      const dos = src[i + 1];
+      if (c === '/' && dos === '/') {
+        while (i < src.length && src[i] !== '\n') i = vaciar(i);
+        continue;
+      }
+      if (c === '/' && dos === '*') {
+        i = vaciar(vaciar(i));
+        while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) i = vaciar(i);
+        if (i < src.length) i = vaciar(vaciar(i));
+        continue;
+      }
+      if (c === '"' || c === "'") {
+        i = vaciar(i);
+        while (i < src.length && src[i] !== c) i = src[i] === '\\' ? vaciar(vaciar(i)) : vaciar(i);
+        if (i < src.length) i = vaciar(i);
+        ultimaPalabra = '';
+        ultimoChar = ')';
+        continue;
+      }
+      if (c === '`') {
+        i = plantilla(vaciar(i));
+        ultimaPalabra = '';
+        ultimoChar = ')';
+        continue;
+      }
+      const trasPalabra = ultimaPalabra && ultimoChar === ultimaPalabra[ultimaPalabra.length - 1];
+      const abreRegex = trasPalabra ? TRAS_REGEX.has(ultimaPalabra) : PUNCT_REGEX.has(ultimoChar);
+      if (c === '/' && abreRegex) {
+        i = literarRegex(i);
+        ultimaPalabra = '';
+        ultimoChar = ')';
+        continue;
+      }
+      if (cierraInterp) {
+        if (c === '{') prof += 1;
+        else if (c === '}') {
+          if (prof === 0) return i; // el `}` de cierre lo vacia el llamador
+          prof -= 1;
+        }
+      }
+      if (/[A-Za-z0-9_$]/.test(c)) {
+        ultimaPalabra += c;
+        ultimoChar = c;
+      } else if (!/\s/.test(c)) {
+        ultimaPalabra = '';
+        ultimoChar = c;
+      }
+      i += 1;
+    }
+    return i;
+  }
+
+  codigo(0, false);
+  return out.join('');
+}
+
 /**
  * Statements de nivel superior de un modulo, agrupando por balance de llaves y
  * parentesis. Asi `const x = f();` sale como un statement, y un
- * `addEventListener(...)` con un callback multilinea tambien.
+ * `addEventListener(...)` con un callback multilinea tambien. El texto se
+ * devuelve crudo (para los mensajes de error) pero el balance se cuenta sobre
+ * `sinCadenas`, que preserva largos y offsets.
  */
 function statementsTopLevel(src) {
+  const limpio = sinCadenas(src);
   const stmts = [];
   let actual = '';
   let inicio = 0;
   let llaves = 0;
   let corchetes = 0;
   let parentesis = 0;
-  let enCadena = '';
   let pos = 0;
-  for (const linea of src.split(/\r?\n/)) {
+  for (const linea of src.matchAll(/[^\n]*(?:\r?\n|$)/g)) {
+    if (!linea[0]) continue; // match vacio al final
+    const texto = linea[0].replace(/\r?\n$/, '');
     if (!actual) inicio = pos;
-    actual += `${actual ? '\n' : ''}${linea}`;
-    for (let i = 0; i < linea.length; i += 1) {
-      const c = linea[i];
-      const previo = linea[i - 1];
-      if (enCadena) {
-        if (c === enCadena && previo !== '\\') enCadena = '';
-        continue;
-      }
-      if (c === '"' || c === "'" || c === '`') {
-        enCadena = c;
-        continue;
-      }
+    actual += `${actual ? '\n' : ''}${texto}`;
+    for (const c of limpio.slice(pos, pos + texto.length)) {
       if (c === '{') llaves += 1;
       else if (c === '}') llaves -= 1;
       else if (c === '[') corchetes += 1;
@@ -88,7 +201,7 @@ function statementsTopLevel(src) {
       else if (c === '(') parentesis += 1;
       else if (c === ')') parentesis -= 1;
     }
-    pos += linea.length + 1;
+    pos += linea[0].length;
     if (llaves <= 0 && corchetes <= 0 && parentesis <= 0) {
       if (actual.trim()) stmts.push({ texto: actual, inicio });
       actual = '';
@@ -106,54 +219,28 @@ function statementsTopLevel(src) {
  * callbacks (`=> {...}`, `=> expr`, `function () {...}`) y literales de datos
  * (`= [...]`, `= {...}`), que a lo sumo guardan referencias. Lo que queda es lo
  * que se evalua al cargar el modulo.
- *
- * Recorre con estado de cadenas: un `=>` dentro de un template no es un arrow.
  */
 function sinDiferidos(stmt) {
-  const s = stmt.replace(/\r?\n/g, ' ');
+  const s = sinCadenas(stmt).replace(/\r?\n/g, ' ');
   let out = '';
   let i = 0;
-  let cadena = '';
   const cortarBloque = (desde) => {
     // Corta hasta el cierre balanceado de `{`/`[` abierto en `desde - 1`.
     let prof = 1;
     let j = desde;
-    let cad = '';
-    for (; j < s.length; j += 1) {
+    while (j < s.length) {
       const c = s[j];
-      const previo = s[j - 1];
-      if (cad) {
-        if (c === cad && previo !== '\\') cad = '';
-        continue;
-      }
-      if (c === '"' || c === "'" || c === '`') {
-        cad = c;
-        continue;
-      }
       if (c === '{' || c === '[') prof += 1;
       else if (c === '}' || c === ']') {
         prof -= 1;
         if (prof === 0) return j + 1;
       }
+      j += 1;
     }
     return j;
   };
-
   while (i < s.length) {
     const c = s[i];
-    const previo = s[i - 1];
-    if (cadena) {
-      out += c;
-      if (c === cadena && previo !== '\\') cadena = '';
-      i += 1;
-      continue;
-    }
-    if (c === '"' || c === "'" || c === '`') {
-      cadena = c;
-      out += c;
-      i += 1;
-      continue;
-    }
     const resto = s.slice(i);
     if (c === '=' && s[i + 1] === '>') {
       const despues = s.slice(i + 2).match(/^\s*([[{])/);
@@ -186,18 +273,7 @@ function sinDiferidos(stmt) {
 /** Profundidad de llaves antes del caracter `hasta` (para saber si es nivel 0). */
 function profundidadEn(src, hasta) {
   let prof = 0;
-  let cadena = '';
-  for (let i = 0; i < hasta; i += 1) {
-    const c = src[i];
-    const previo = src[i - 1];
-    if (cadena) {
-      if (c === cadena && previo !== '\\') cadena = '';
-      continue;
-    }
-    if (c === '"' || c === "'" || c === '`') {
-      cadena = c;
-      continue;
-    }
+  for (const c of sinCadenas(src).slice(0, hasta)) {
     if (c === '{') prof += 1;
     else if (c === '}') prof -= 1;
   }