@danieltmn/tamnora 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,52 @@ Todos los cambios relevantes de este proyecto se documentan en este archivo.
 El formato sigue [Keep a Changelog](https://keepachangelog.com/es-ES/1.1.0/)
 y el proyecto usa [Versionado Semantico](https://semver.org/lang/es/).
 
+## [0.4.0] - 2026-10-02
+
+### Agregado
+
+- La consola muestra el modo activo (`Plan`/`Build`) como badge junto al nombre del
+  agente en cada respuesta del chat; alternarlo con `Ctrl+.` ya no inserta un
+  mensaje en el flujo. El modo queda guardado por respuesta.
+- `fetch_url` convierte HTML a texto legible (título + cuerpo, sin scripts ni
+  estilos), avisa cuando el sitio exige JavaScript o está detrás de Cloudflare y
+  no vuelca cuerpos binarios; `raw` mantiene el comportamiento anterior.
+- El system prompt del server y `AGENTS.md` listan `fetch_url` y las tools de git,
+  para que el agente sepa que puede abrir URLs. `install_mcp` documenta el MCP de
+  navegador (Playwright) para webs con JavaScript, con preset en
+  `harness/tamnora.example.json`.
+
+### Corregido
+
+- La consola web muestra la versión real en el header (antes `v0.0.0` fijo): se lee
+  de `/api/health` y el release actualiza el HTML.
+- `tamnora update` reportaba siempre `0.0.0` por una ruta relativa mal calculada, así
+  que nunca detectaba "ya estás al día"; ahora resuelve la versión subiendo hasta el
+  `package.json` raíz y verifica la versión realmente instalada.
+
+### Cambiado
+
+- Website: se quitó el formulario de login (no tiene sentido en la web pública) y
+  el header dejó de mostrar "Ingresar". En su lugar, el hero muestra una tarjeta de
+  inicio rápido con los comandos de instalación. La consola demo ya no simula sesión.
+- Documentación actualizada: README y las páginas del website reflejan las 12 tools
+  locales (incl. `fetch_url` y las de Git), el listado completo de comandos, el MCP
+  de navegador para webs con JavaScript/Cloudflare y `tamnora update`/`autostart`.
+
+### Pendiente
+
+- Confirmar el proveedor Xiaomi (`mimo-v2.6-flash`): respondio `429 Too Many
+  Requests` (cuota/rate limit del endpoint), no del harness.
+- Telegram: audio y voz (transcribir notas de voz y responder con audio).
+- Plugins: cargador de plugins locales (fase 2 del apartado ajustes).
+
+## [0.3.1] - 2026-10-02
+
+### Agregado
+
+- Consola (ajustes): campo `env` (lineas `KEY=valor`) en el modal de MCP, para
+  cargar las variables de los servidores importados del registro.
+
 ## [0.3.0] - 2026-10-02
 
 ### Agregado
@@ -23,13 +69,6 @@ y el proyecto usa [Versionado Semantico](https://semver.org/lang/es/).
 - Consola (ajustes): barras para importar skills y MCP, con estado y aviso de
   variables de entorno requeridas.
 
-### Pendiente
-
-- Confirmar el proveedor Xiaomi (`mimo-v2.6-flash`): respondio `429 Too Many
-  Requests` (cuota/rate limit del endpoint), no del harness.
-- Telegram: audio y voz (transcribir notas de voz y responder con audio).
-- Plugins: cargador de plugins locales (fase 2 del apartado ajustes).
-
 ## [0.2.0] - 2026-10-02
 
 ### Agregado

package/README.md

@@ -5,8 +5,8 @@ con TUI, consola web, tools locales, MCP y evaluacion de modelos.
 
 - **Sin dependencias**: solo modulos de Node (`node:sqlite`, `node:crypto`, ...).
 - **Local**: corre en tu maquina y guarda el estado en tu casa local.
-- **Multi-proveedor**: OpenRouter, OpenAI-compatible (DeepSeek, Groq, Mistral,
-  xAI, Together, Fireworks, Cerebras, Perplexity) y Ollama.
+- **Multi-proveedor**: OpenRouter, OpenAI, proveedores compatibles (DeepSeek,
+  Groq, Mistral, xAI, Together, Fireworks, Cerebras, Perplexity) y Ollama.
 
 ## Instalacion
 
@@ -97,6 +97,15 @@ stdio. Las tools se exponen como `mcp__<servidor>__<tool>` y, si el servidor los
 anuncia, tambien sus **recursos** y **prompts** (`list_resources`,
 `read_resource`, `list_prompts`, `get_prompt`).
 
+## Tools
+
+Tools locales confinadas al workspace (`read`, `list`, `glob`, `grep`, `write`,
+`edit`, `bash`, `fetch_url`) y de Git (`git_status`, `git_diff`, `git_log`,
+`git_commit`), con permisos `allow`/`ask`/`deny` por tool o por patron.
+`fetch_url` lee URLs (HTML a texto) y avisa cuando un sitio exige JavaScript o
+esta detras de Cloudflare; para esos casos, registra un MCP de navegador (por
+ejemplo Playwright).
+
 ## Documentacion
 
 - [`CHANGELOG.md`](CHANGELOG.md) — historial de versiones.

package/harness/packages/cli/src/cli.js

@@ -1,6 +1,3 @@
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
 import { runCommand } from './commands/run.js';
 import { replCommand } from './commands/repl.js';
 import { evalCommand } from './commands/eval.js';
@@ -15,6 +12,7 @@ import { autostartCommand } from './commands/autostart.js';
 import { doctorCommand } from './commands/doctor.js';
 import { tuiCommand } from './commands/tui.js';
 import { ensureUtf8Console } from './lib/util.js';
+import { readPackageVersion } from './lib/core.js';
 import { color } from './ui/color.js';
 
 const COMMANDS = {
@@ -34,13 +32,7 @@ const COMMANDS = {
 };
 
 function readVersion() {
-  try {
-    const pkgPath = path.join(path.dirname(fileURLToPath(import.meta.url)), '../../../../package.json');
-    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-    return pkg.version || '0.0.0';
-  } catch {
-    return '0.0.0';
-  }
+  return readPackageVersion();
 }
 
 export async function runCli(argv) {

package/harness/packages/cli/src/commands/update.js

@@ -1,28 +1,25 @@
 import { spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
+import { readPackageVersion } from '../lib/core.js';
 import { parse } from '../lib/util.js';
 
 const PACKAGE = '@danieltmn/tamnora';
 const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const OPTIONS = { yes: { type: 'boolean', short: 'y' }, check: { type: 'boolean' }, tag: { type: 'string' }, help: { type: 'boolean', short: 'h' } };
 
-function currentVersion() {
+function npm(args) {
+  return spawnSync(NPM, args, { encoding: 'utf8', windowsHide: true });
+}
+
+function installedVersion() {
+  const out = npm(['ls', '-g', PACKAGE, '--json', '--depth=0']);
   try {
-    const pkg = JSON.parse(
-      readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '../../../../package.json'), 'utf8')
-    );
-    return pkg.version || '0.0.0';
+    const data = JSON.parse(out.stdout);
+    return data?.dependencies?.[PACKAGE]?.version || '';
   } catch {
-    return '0.0.0';
+    return '';
   }
 }
 
-function npm(args) {
-  return spawnSync(NPM, args, { encoding: 'utf8', windowsHide: true });
-}
-
 export async function updateCommand(argv) {
   const { values } = parse(argv, OPTIONS);
   if (values.help) {
@@ -32,7 +29,7 @@ export async function updateCommand(argv) {
 
   const tag = typeof values.tag === 'string' && values.tag ? values.tag : 'latest';
   const spec = `${PACKAGE}@${tag}`;
-  const version = currentVersion();
+  const version = readPackageVersion();
   console.log(`Version actual: ${version}`);
 
   const view = npm(['view', spec, 'version', '--json']);
@@ -71,6 +68,11 @@ export async function updateCommand(argv) {
     console.error(`La actualizacion fallo. Proba a mano: npm i -g ${spec}`);
     return 1;
   }
-  console.log('Listo. Reinicia el server: tamnora server --reload');
+  const installed = installedVersion() || readPackageVersion();
+  console.log(`Listo. Instalado: v${installed} (pediste ${latest}).`);
+  if (installed && installed !== latest) {
+    console.log('Ojo: la version instalada no coincide con la publicada. Cerra procesos que usen la carpeta y reintenta.');
+  }
+  console.log('Reinicia el server: tamnora server --reload');
   return 0;
 }

package/harness/packages/core/src/index.js

@@ -81,3 +81,4 @@ export {
 } from './mcp/registry.js';
 export { parseTunnelmoleUrls, startTunnelmole, startTunnel } from './tunnel.js';
 export { detectProcs, packageManager, DEFAULT_PROCESS_ALLOW } from './procs/detect.js';
+export { readPackageVersion } from './version.js';

package/harness/packages/core/src/storage/sqlite.js

@@ -27,6 +27,7 @@ CREATE TABLE IF NOT EXISTS messages (
   tool_calls TEXT,
   tool_call_id TEXT,
   name TEXT,
+  mode TEXT,
   tokens_in INTEGER,
   tokens_out INTEGER,
   created_at INTEGER
@@ -99,9 +100,15 @@ export function openDatabase(file) {
   const db = new DatabaseSync(file ?? ':memory:');
   db.exec('PRAGMA journal_mode = WAL;');
   db.exec(SCHEMA);
+  migrate(db);
   return db;
 }
 
+function migrate(db) {
+  const columns = db.prepare('PRAGMA table_info(messages)').all().map((c) => c.name);
+  if (!columns.includes('mode')) db.exec('ALTER TABLE messages ADD COLUMN mode TEXT');
+}
+
 const now = () => Date.now();
 const json = (value) => (value === undefined || value === null ? null : JSON.stringify(value));
 const parseJson = (value) => {
@@ -254,8 +261,8 @@ export class Store {
     const id = randomUUID();
     this.db
       .prepare(
-        `INSERT INTO messages (id, session_id, role, content, tool_calls, tool_call_id, name, tokens_in, tokens_out, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        `INSERT INTO messages (id, session_id, role, content, tool_calls, tool_call_id, name, mode, tokens_in, tokens_out, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       )
       .run(
         id,
@@ -265,6 +272,7 @@ export class Store {
         json(message.tool_calls),
         message.tool_call_id ?? null,
         message.name ?? null,
+        message.mode ?? null,
         message.tokens_in ?? null,
         message.tokens_out ?? null,
         now()
@@ -289,6 +297,7 @@ export class Store {
         if (row.tool_calls) message.tool_calls = parseJson(row.tool_calls);
         if (row.tool_call_id) message.tool_call_id = row.tool_call_id;
         if (row.name) message.name = row.name;
+        if (row.mode) message.mode = row.mode;
         return message;
       });
   }

package/harness/packages/core/src/tools/executors.js

@@ -14,6 +14,24 @@ const MAX_BASH_OUTPUT = 100_000;
 const FETCH_TIMEOUT_MS = 20000;
 const MAX_FETCH_CHARS = 200_000;
 
+const NAMED_ENTITIES = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  nbsp: ' ',
+  hellip: '\u2026',
+  mdash: '\u2014',
+  ndash: '\u2013',
+  laquo: '\u00ab',
+  raquo: '\u00bb',
+  middot: '\u00b7',
+  copy: '\u00a9',
+  reg: '\u00ae',
+  trade: '\u2122',
+};
+
 function isBlockedHost(hostname) {
   const h = String(hostname ?? '')
     .toLowerCase()
@@ -31,7 +49,66 @@ function isBlockedHost(hostname) {
   return false;
 }
 
-export async function fetchUrlTool(_root, { url, maxLength } = {}) {
+function isTextualType(type) {
+  const t = String(type || '').toLowerCase();
+  if (!t) return true;
+  return (
+    /^text\//.test(t) ||
+    /(?:json|xml|xhtml|javascript|ecmascript|yaml|x-yaml|x-sh|urlencoded)/.test(t)
+  );
+}
+
+function isHtmlType(type) {
+  return /text\/html|application\/xhtml/i.test(String(type || ''));
+}
+
+function decodeEntities(text) {
+  return String(text).replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (match, ent) => {
+    if (ent[0] === '#') {
+      const code = /^x/i.test(ent.slice(1)) ? parseInt(ent.slice(2), 16) : parseInt(ent.slice(1), 10);
+      if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return match;
+      try {
+        return String.fromCodePoint(code);
+      } catch {
+        return match;
+      }
+    }
+    const key = ent.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, key) ? NAMED_ENTITIES[key] : match;
+  });
+}
+
+function htmlToText(html) {
+  const source = String(html);
+  const titleMatch = source.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+  const title = titleMatch ? decodeEntities(titleMatch[1]).replace(/\s+/g, ' ').trim() : '';
+  const body = decodeEntities(
+    source
+      .replace(/<!--[\s\S]*?-->/g, ' ')
+      .replace(/<(script|style|noscript|template|svg|head)[\s\S]*?<\/\1>/gi, ' ')
+      .replace(/<(?:br|\/p|\/div|\/li|\/tr|\/h[1-6]|\/section|\/article)\s*\/?>/gi, '\n')
+      .replace(/<[^>]+>/g, ' ')
+  )
+    .replace(/[ \t\f\v]+/g, ' ')
+    .replace(/\s*\n\s*/g, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+  return { title, body };
+}
+
+function isChallenge(status, headers, body) {
+  if (/<title>\s*just a moment/i.test(body)) return true;
+  if (/cf-challenge|challenge-platform|__cf_chl|turnstile/i.test(body)) return true;
+  return status >= 403 && /cloudflare/i.test(headers.get('server') || '');
+}
+
+function formatBody(head, text, limit) {
+  const body = text.slice(0, limit);
+  const truncated = text.length > limit ? `\n[... truncado ${text.length - limit} caracteres]` : '';
+  return `${head}\n\n${body}${truncated}`;
+}
+
+export async function fetchUrlTool(_root, { url, maxLength, raw } = {}) {
   let target;
   try {
     target = new URL(String(url ?? ''));
@@ -48,16 +125,27 @@ export async function fetchUrlTool(_root, { url, maxLength } = {}) {
       redirect: 'follow',
       signal: controller.signal,
       headers: {
-        'User-Agent': 'tamnora-harness (+https://github.com/tamnora/tamnora-harness)',
-        Accept: '*/*',
+        'User-Agent': 'Mozilla/5.0 (compatible; tamnora-harness; +https://github.com/tamnora/tamnora-harness)',
+        Accept: 'text/html,application/xhtml+xml,application/json,text/plain;q=0.9,*/*;q=0.5',
+        'Accept-Language': 'es,en;q=0.8',
       },
     });
     const type = res.headers.get('content-type') || '';
     const limit = Math.min(Math.max(Number(maxLength) || 20000, 500), MAX_FETCH_CHARS);
-    const text = await res.text();
-    const body = text.slice(0, limit);
-    const truncated = text.length > limit ? `\n[... truncado ${text.length - limit} caracteres]` : '';
-    return `${res.status} ${res.statusText || ''} · ${type || 'sin content-type'} · ${target.toString()}\n\n${body}${truncated}`;
+    const full = await res.text();
+    const head = `${res.status} ${res.statusText || ''} · ${type || 'sin content-type'} · ${target.toString()}`;
+
+    if (!isTextualType(type)) {
+      return `${head}\n\n[contenido no textual (${type || 'desconocido'}); no se muestra el cuerpo. Usá raw sólo si sabés lo que hacés.]`;
+    }
+    if (!raw && isChallenge(res.status, res.headers, full)) {
+      return `${head}\n\n[sitio con challenge de Cloudflare o página que exige JavaScript; fetch_url no puede leerlo. Probá un servidor MCP de navegador (Playwright).]`;
+    }
+    if (!raw && isHtmlType(type)) {
+      const { title, body } = htmlToText(full);
+      return formatBody(head, (title ? `# ${title}\n\n` : '') + body, limit);
+    }
+    return formatBody(head, full, limit);
   } catch (err) {
     if (err?.name === 'AbortError') return `Error: timeout (${FETCH_TIMEOUT_MS / 1000}s) al pedir ${target}.`;
     return `Error de red al pedir ${target}: ${err?.message ?? err}`;

package/harness/packages/core/src/tools/schema.js

@@ -121,12 +121,13 @@ export const TOOL_DEFINITIONS = [
     function: {
       name: 'fetch_url',
       description:
-        'Fetch a URL over http(s) and return its text content (status, content-type and body). Use it to read docs, APIs or raw files.',
+        'Fetch a URL over http(s) and return its content (status, content-type and body). HTML is converted to readable text. Blocks private hosts and warns about Cloudflare/JS-only pages. Use raw to get the original body.',
       parameters: {
         type: 'object',
         properties: {
           url: { type: 'string', description: 'Absolute http(s) URL' },
           maxLength: { type: 'integer', description: 'Max characters of the body (default 20000)' },
+          raw: { type: 'boolean', description: 'Return the raw body without HTML-to-text conversion' },
         },
         required: ['url'],
       },

package/harness/packages/core/src/version.js

@@ -0,0 +1,26 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const ROOT_PACKAGE_NAME = '@danieltmn/tamnora';
+
+/**
+ * Resolve the published package version by walking up from `startUrl` until a
+ * package.json named `@danieltmn/tamnora` is found. Robust to file depth so
+ * callers don't have to count `../` levels.
+ */
+export function readPackageVersion(startUrl = import.meta.url) {
+  let dir = path.dirname(fileURLToPath(startUrl));
+  for (let i = 0; i < 10; i++) {
+    try {
+      const pkg = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+      if (pkg.name === ROOT_PACKAGE_NAME && pkg.version) return pkg.version;
+    } catch {
+      /* no hay package.json acá: seguir subiendo */
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return '0.0.0';
+}

package/harness/packages/core/test/tools.test.js

@@ -84,6 +84,59 @@ test('fetchUrlTool rejects invalid URLs and private hosts', async () => {
   assert.match(await fetchUrlTool(root, { url: 'http://169.254.169.254/' }), /host bloqueado/);
 });
 
+async function withFetch(stub, fn) {
+  const original = globalThis.fetch;
+  globalThis.fetch = stub;
+  try {
+    return await fn();
+  } finally {
+    globalThis.fetch = original;
+  }
+}
+
+test('fetchUrlTool converts HTML to readable text', async () => {
+  const html =
+    '<html><head><title>Hola &amp; chau</title><style>x{}</style></head>' +
+    '<body><nav>menu</nav><h1>Titulo</h1><p>Parrafo<br>dos</p><script>evil()</script></body></html>';
+  const out = await withFetch(
+    async () => new Response(html, { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /# Hola & chau/);
+  assert.match(out, /Titulo/);
+  assert.match(out, /Parrafo/);
+  assert.doesNotMatch(out, /evil\(\)/);
+  assert.doesNotMatch(out, /<p>/);
+});
+
+test('fetchUrlTool flags Cloudflare/JS challenges', async () => {
+  const body = '<html><head><title>Just a moment...</title></head><body>challenge-platform</body></html>';
+  const out = await withFetch(
+    async () => new Response(body, { status: 403, headers: { 'content-type': 'text/html', server: 'cloudflare' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /Cloudflare/);
+  assert.doesNotMatch(out, /challenge-platform/);
+});
+
+test('fetchUrlTool does not dump non-text bodies', async () => {
+  const out = await withFetch(
+    async () => new Response('%PDF-1.4 binary', { status: 200, headers: { 'content-type': 'application/pdf' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/x.pdf' })
+  );
+  assert.match(out, /no textual/);
+  assert.doesNotMatch(out, /%PDF/);
+});
+
+test('fetchUrlTool raw returns the original body', async () => {
+  const html = '<html><body><p>hola</p></body></html>';
+  const out = await withFetch(
+    async () => new Response(html, { status: 200, headers: { 'content-type': 'text/html' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/', raw: true })
+  );
+  assert.match(out, /<p>hola<\/p>/);
+});
+
 test('createTools combines local and MCP tool routing', async () => {
   const root = await makeWorkspace();
   const mcp = {

package/harness/packages/server/public/app.js

@@ -388,7 +388,6 @@ async function setMode(id, { persist = true } = {}) {
 async function toggleMode() {
   const next = modeSelect.value === 'plan' ? 'agent' : 'plan';
   await setMode(next);
-  notify(`Modo **${modeLabel(next)}**${next === 'plan' ? ' (solo lectura)' : ''}`);
 }
 
 modeSelect.addEventListener('change', () => setMode(modeSelect.value));
@@ -674,21 +673,39 @@ const scrollMessages = (pane = activePane) => {
 function addMessage(role, text = '', pane = activePane) {
   pane.querySelector('.empty')?.remove();
   const wrap = el('div', `msg ${role}`);
+  const label = el('div', 'msg-label');
+  let modeEl = null;
+  if (role === 'user') {
+    label.textContent = '❯ vos';
+  } else {
+    label.appendChild(el('span', 'msg-name', 'tamnora'));
+    modeEl = el('span', 'msg-mode');
+    modeEl.hidden = true;
+    label.appendChild(modeEl);
+  }
   const bubble = el('div', 'bubble');
   const textEl = el('div', 'text');
   const tools = el('div', 'tools');
   const activity = el('div', 'activity');
   activity.hidden = true;
   bubble.append(textEl, tools, activity);
-  wrap.appendChild(bubble);
+  wrap.append(label, bubble);
   pane.appendChild(wrap);
-  const message = { role, wrap, bubble, textEl, tools, activity, reasoningEl: null, id: null };
+  const message = { role, wrap, bubble, label, modeEl, textEl, tools, activity, reasoningEl: null, id: null };
   addMessageActions(message);
   if (text) setText(message, text);
   scrollMessages(pane);
   return message;
 }
 
+function setMessageMode(message, modeId) {
+  if (!message?.modeEl) return;
+  const mode = modeId === 'plan' ? 'plan' : 'build';
+  message.modeEl.textContent = mode === 'plan' ? 'Plan' : 'Build';
+  message.modeEl.dataset.mode = mode;
+  message.modeEl.hidden = false;
+}
+
 function addMessageActions(message) {
   const actions = el('div', 'msg-actions');
   actions.appendChild(button('copiar', () => copyMessage(message), 'msg-act'));
@@ -919,6 +936,7 @@ function renderStored(message, pane) {
     appendImages(bubble, userImages(message.content));
   } else if (message.role === 'assistant') {
     const bubble = addMessage('assistant', typeof message.content === 'string' ? message.content : '', pane);
+    if (message.mode) setMessageMode(bubble, message.mode);
     if (message.id) {
       bubble.id = message.id;
       bubble.wrap.dataset.messageId = message.id;
@@ -1256,10 +1274,12 @@ async function sendMessage() {
   let sawText = false;
   let lastTool = null;
   let startNewOnText = false;
+  let turnMode = modeSelect.value || 'agent';
 
   const flowTarget = () => {
     if (startNewOnText) {
       active = addMessage('assistant', '', pane);
+      setMessageMode(active, turnMode);
       startNewOnText = false;
       setActivity(active, 'thinking');
     }
@@ -1285,6 +1305,8 @@ async function sendMessage() {
       (event, data) => {
         if (event === 'start') {
           if (data.cwd) setCwd(data.cwd);
+          if (data.mode) turnMode = data.mode;
+          setMessageMode(active, turnMode);
         } else if (event === 'text') {
           sawText = true;
           const target = flowTarget();
@@ -1981,6 +2003,9 @@ function openMcpForm(server = null) {
   $('#mf-command').value = server?.command ?? '';
   $('#mf-args').value = (server?.args ?? []).join(' ');
   $('#mf-url').value = server?.url ?? '';
+  $('#mf-env').value = Object.entries(server?.env ?? {})
+    .map(([key, value]) => `${key}=${value ?? ''}`)
+    .join('\n');
   $('#mf-enabled').checked = server ? server.enabled !== false : true;
   syncMcpFormFields();
   setStatus('#mf-status', '');
@@ -2001,6 +2026,7 @@ async function toggleMcp(server) {
       command: server.command,
       args: server.args,
       url: server.url,
+      env: server.env,
       enabled: !server.enabled,
     },
   }).catch((error) => notify(`No se pudo actualizar MCP: ${error.message}`, 'notice err'));
@@ -2016,6 +2042,18 @@ async function removeMcp(id) {
   refreshMcp();
 }
 
+function parseEnv(text) {
+  const out = {};
+  for (const line of String(text ?? '').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    out[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1);
+  }
+  return out;
+}
+
 async function submitMcp(event) {
   event.preventDefault();
   const id = $('#mf-id').value.trim();
@@ -2026,6 +2064,7 @@ async function submitMcp(event) {
     command: $('#mf-command').value.trim(),
     args: $('#mf-args').value.trim(),
     url: $('#mf-url').value.trim(),
+    env: parseEnv($('#mf-env').value),
     enabled: $('#mf-enabled').checked,
   };
   try {
@@ -2657,6 +2696,10 @@ async function boot() {
     setCwd(health.cwd);
   }
   if (health?.home) state.home = health.home;
+  if (health?.version) {
+    const ver = document.querySelector('.brand .ver');
+    if (ver) ver.textContent = `v${health.version}`;
+  }
   await refreshProviders();
   await loadModes();
   await loadModels();

package/harness/packages/server/public/index.html

@@ -33,7 +33,7 @@
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo">T</span> tamnora <span class="ver">v0.0.0</span></div>
+      <div class="brand"><span class="logo">T</span> tamnora <span class="ver">v0.4.0</span></div>
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>
@@ -441,6 +441,9 @@
         <div class="row">
           <label class="field grow" id="mf-args-field"><span>args (separados por espacio)</span><input id="mf-args" spellcheck="false" placeholder="harness/scripts/mcp-echo-server.mjs" /></label>
         </div>
+        <label class="field"><span>env (KEY=valor por línea)</span>
+          <textarea id="mf-env" rows="3" spellcheck="false" placeholder="API_KEY=..."></textarea>
+        </label>
         <label class="check"><input id="mf-enabled" type="checkbox" checked /> habilitado</label>
         <div class="row between settings-actions">
           <button type="button" id="mf-cancel" class="btn">cancelar</button>

package/harness/packages/server/public/styles.css

@@ -365,16 +365,27 @@ body.resizing * { cursor: col-resize !important; }
 
 /* transcript style: role label, no bubbles */
 .msg { min-width: 0; }
-.msg::before {
-  display: block;
+.msg-label {
+  display: flex;
+  align-items: center;
+  gap: 6px;
   font: 500 10px var(--mono);
   letter-spacing: 0.14em;
   text-transform: uppercase;
   color: var(--muted);
   margin-bottom: 5px;
 }
-.msg.user::before { content: '❯ vos'; color: var(--mine); }
-.msg.assistant::before { content: 'tamnora'; }
+.msg.user .msg-label { color: var(--mine); }
+.msg-mode {
+  font: 500 9px var(--mono);
+  line-height: 1.5;
+  letter-spacing: 0.08em;
+  color: var(--accent);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 0 6px;
+}
+.msg-mode[data-mode='plan'] { color: var(--warn); }
 .bubble {
   max-width: 900px;
   min-width: 0;

package/harness/packages/server/src/lib/agentTools.js

@@ -33,7 +33,7 @@ const DEFINITIONS = [
   definition('list_mcp', 'Lista los servidores MCP configurados (de tamnora.json y de la base).', {}),
   definition(
     'install_mcp',
-    'Registra un servidor MCP. stdio: pasá command (y args). http: pasá url.',
+    'Registra un servidor MCP. stdio: pasá command (y args). http: pasá url. Para webs con JavaScript/Cloudflare (que fetch_url no lee) instalá un MCP de navegador, ej. command "npx" args ["-y","@playwright/mcp@latest"].',
     {
       id: { type: 'string', description: 'Id corto, ej. "echo"' },
       name: { type: 'string' },

package/harness/packages/server/src/lib/prompt.js

@@ -10,7 +10,8 @@ function workspacePreamble(cwd) {
     `Carpeta de trabajo: ${cwd}`,
     '',
     'Reglas:',
-    '- Tus herramientas (read, list, glob, grep, write, edit) usan rutas relativas a esa carpeta; bash se ejecuta ahí.',
+    '- Tus herramientas locales son read, list, glob, grep, write, edit, bash, fetch_url y git_status/git_diff/git_log/git_commit. Las de archivos usan rutas relativas a la carpeta de trabajo; bash se ejecuta ahí.',
+    '- Con fetch_url podés abrir una URL http(s) y leer su contenido (docs, APIs, archivos remotos): no digas que no podés acceder a la web.',
     '- No podés salir de la carpeta de trabajo.',
     '- Antes de afirmar algo sobre el proyecto, inspeccionalo con las herramientas (list, glob, grep, read). No inventes archivos ni contenido.',
     '- write, edit y bash pueden requerir aprobación del usuario; si una llamada se deniega, explicá qué querías hacer en vez de reintentar en bucle.',

package/harness/packages/server/src/routes/chat.js

@@ -207,7 +207,9 @@ export function registerChat(route, ctx) {
       });
       partials.flush();
 
-      const newMessages = result.messages.slice(1 + history.length);
+      const newMessages = result.messages
+        .slice(1 + history.length)
+        .map((message) => (message.role === 'assistant' ? { ...message, mode: mode.id } : message));
       ctx.store.addMessages(sessionId, newMessages);
       const current = ctx.store.getSession(sessionId);
       const title =

package/harness/packages/server/src/server.js

@@ -1,7 +1,6 @@
 import http from 'node:http';
 import os from 'node:os';
 import path from 'node:path';
-import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import {
   loadConfig,
@@ -13,6 +12,7 @@ import {
   resolveApiKey,
   composeProviderSettings,
   buildMcpRegistry,
+  readPackageVersion,
 } from './lib/core.js';
 import { sendJson, sendError } from './lib/http.js';
 import { createPromptBuilder, DEFAULT_SYSTEM_PROMPT } from './lib/prompt.js';
@@ -36,18 +36,7 @@ import { registerPreview } from './routes/preview.js';
 import { registerChat } from './routes/chat.js';
 import { registerEval } from './routes/eval.js';
 
-const VERSION = readVersion();
-
-function readVersion() {
-  try {
-    const pkg = JSON.parse(
-      readFileSync(fileURLToPath(new URL('../../../../package.json', import.meta.url)), 'utf8')
-    );
-    return pkg.version || '0.0.0';
-  } catch {
-    return '0.0.0';
-  }
-}
+const VERSION = readPackageVersion();
 
 const DEFAULT_PUBLIC_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 

package/harness/tamnora.example.json

@@ -13,6 +13,14 @@
       "command": "node",
       "args": ["harness/scripts/mcp-echo-server.mjs"],
       "enabled": true
+    },
+    {
+      "id": "playwright",
+      "name": "Playwright (navegador headless, para webs con JS)",
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@playwright/mcp@latest"],
+      "enabled": false
     }
   ],
   "processes": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",