@danieltmn/tamnora 0.6.1 → 0.7.0

package/harness/packages/server/src/lib/agentTools.js

@@ -42,6 +42,8 @@ const DEFINITIONS = [
       transport: { type: 'string', enum: ['stdio', 'http'] },
       command: { type: 'string', description: 'Para stdio, ej. "node" o "npx"' },
       args: { type: 'array', items: { type: 'string' } },
+      env: { type: 'object', description: 'Variables para el MCP (usá "env:VAR" para no hardcodear secretos)' },
+      inheritEnv: { type: 'boolean', description: 'Heredar process.env (solo MCPs de confianza; default false)' },
       url: { type: 'string', description: 'Para http' },
       enabled: { type: 'boolean' },
     },
@@ -133,7 +135,7 @@ export function createAgentTools(ctx) {
             command: cfg.command ?? null,
             url: cfg.url ?? null,
             enabled: true,
-            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+            config: { args: cfg.args ?? [], env: cfg.env ?? null, inheritEnv: cfg.inheritEnv === true },
           });
           await ctx.reloadMcp();
           const required = (cfg.requiredEnv ?? []).length ? ` Requiere env: ${cfg.requiredEnv.join(', ')}.` : '';
@@ -154,7 +156,7 @@ export function createAgentTools(ctx) {
             command: cfg.command ?? null,
             url: cfg.url ?? null,
             enabled: cfg.enabled !== false,
-            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+            config: { args: cfg.args ?? [], env: cfg.env ?? null, inheritEnv: cfg.inheritEnv === true },
           });
           await ctx.reloadMcp();
           return `MCP "${cfg.id}" importado.`;
@@ -174,7 +176,11 @@ export function createAgentTools(ctx) {
           command: transport === 'stdio' ? command : null,
           url: transport === 'http' ? url : null,
           enabled: args.enabled !== false,
-          config: { args: Array.isArray(args.args) ? args.args : [], env: args.env ?? null },
+          config: {
+            args: Array.isArray(args.args) ? args.args : [],
+            env: args.env ?? null,
+            inheritEnv: args.inheritEnv === true,
+          },
         });
         await ctx.reloadMcp();
         return `MCP "${id}" registrado (${transport}).`;

package/harness/packages/server/src/lib/channels/index.js

@@ -36,6 +36,7 @@ export function createChannelsManager(ctx, { log = () => {}, enabled = true } =
     if (cfg.token) tg.token = cfg.token;
     if (Array.isArray(cfg.allowedChatIds) && cfg.allowedChatIds.length) tg.allowedChatIds = cfg.allowedChatIds;
     if (cfg.transcribeModel) tg.transcribeModel = cfg.transcribeModel;
+    if (cfg.transcribeProvider) tg.transcribeProvider = cfg.transcribeProvider;
     return tg;
   };
 
@@ -43,7 +44,12 @@ export function createChannelsManager(ctx, { log = () => {}, enabled = true } =
     const tg = readConfig();
     const token = tg.token || process.env.TAMNORA_TELEGRAM_TOKEN || '';
     const allowedChatIds = parseAllowed(tg.allowedChatIds ?? process.env.TAMNORA_TELEGRAM_CHAT_IDS ?? []);
-    return { token, allowedChatIds, transcribeModel: tg.transcribeModel };
+    return {
+      token,
+      allowedChatIds,
+      transcribeModel: tg.transcribeModel,
+      transcribeProvider: tg.transcribeProvider,
+    };
   }
 
   function stop() {
@@ -56,9 +62,9 @@ export function createChannelsManager(ctx, { log = () => {}, enabled = true } =
   function load() {
     stop();
     if (!enabled) return { enabled: false, channels: [] };
-    const { token, allowedChatIds, transcribeModel } = effective();
+    const { token, allowedChatIds, transcribeModel, transcribeProvider } = effective();
     const channels = [];
-    const telegram = startTelegramChannel(ctx, { token, allowedChatIds, transcribeModel, log });
+    const telegram = startTelegramChannel(ctx, { token, allowedChatIds, transcribeModel, transcribeProvider, log });
     if (telegram) channels.push(telegram);
     const unsubscribe = ctx.runs?.subscribeAll?.((sessionId, event) => {
       for (const channel of channels) {
@@ -75,12 +81,13 @@ export function createChannelsManager(ctx, { log = () => {}, enabled = true } =
   }
 
   function status() {
-    const { token, allowedChatIds, transcribeModel } = effective();
+    const { token, allowedChatIds, transcribeModel, transcribeProvider } = effective();
     return {
       tokenSet: Boolean(token),
       tokenHint: tokenHint(token),
       allowedChatIds,
       transcribeModel: transcribeModel || 'whisper-1',
+      transcribeProvider: transcribeProvider || '',
       running: Boolean(active && active.channels.length),
     };
   }

package/harness/packages/server/src/lib/channels/telegram.js

@@ -75,14 +75,17 @@ export function completionFooter(stopReason, rounds, toolCalls, durationMs) {
   const parts = [`${rounds ?? '?'} ronda${rounds === 1 ? '' : 's'}`];
   if (toolCalls) parts.push(`${toolCalls} herramienta${toolCalls === 1 ? '' : 's'}`);
   if (durationMs > 0) parts.push(durationMs >= 1000 ? `${(durationMs / 1000).toFixed(1)}s` : `${durationMs}ms`);
-  const maxed = stopReason === 'max_rounds';
-  return `${maxed ? '⚠ máximo de rondas' : '✓ terminado'} · ${parts.join(' · ')}`;
+  const maxed = ['max_rounds', 'no_progress', 'budget'].includes(stopReason);
+  return `${maxed ? '⚠ corte de seguridad' : '✓ terminado'} · ${parts.join(' · ')}`;
 }
 
 /**
  * Arranca el canal de Telegram. Devuelve `{ stop, notify }` o `null` sin token.
  */
-export function startTelegramChannel(ctx, { token, allowedChatIds = [], transcribeModel = 'whisper-1', log = () => {} } = {}) {
+export function startTelegramChannel(
+  ctx,
+  { token, allowedChatIds = [], transcribeModel = 'whisper-1', transcribeProvider = '', log = () => {} } = {}
+) {
   if (!token) return null;
   const allowed = new Set(allowedChatIds.map(String));
   const controllers = new Map();
@@ -130,10 +133,11 @@ export function startTelegramChannel(ctx, { token, allowedChatIds = [], transcri
   }
 
   async function transcribe(buffer, filename) {
-    const providerId = ctx.effectiveProviderId();
-    const baseUrl = (ctx.providerSettings(providerId).baseUrl || '').replace(/\/+$/, '');
+    const providerId = transcribeProvider || ctx.effectiveProviderId();
+    const settings = ctx.providerSettings(providerId) ?? {};
+    const baseUrl = (settings.baseUrl || '').replace(/\/+$/, '');
     const apiKey = ctx.apiKeyFor(providerId);
-    if (!baseUrl) throw new Error('el proveedor no tiene baseUrl para transcribir');
+    if (!baseUrl) throw new Error(`el proveedor "${providerId}" no tiene baseUrl para transcribir`);
     const form = new FormData();
     form.append('file', new Blob([buffer]), filename);
     form.append('model', transcribeModel);
@@ -142,7 +146,15 @@ export function startTelegramChannel(ctx, { token, allowedChatIds = [], transcri
       headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
       body: form,
     });
-    if (!res.ok) throw new Error(`transcripción falló (HTTP ${res.status})`);
+    if (!res.ok) {
+      const hint =
+        res.status === 404
+          ? ` — "${providerId}" no expone /audio/transcriptions`
+          : '';
+      throw new Error(
+        `transcripción falló (HTTP ${res.status})${hint}. Elegí un proveedor con voz (OpenAI, Groq…) en Ajustes → Telegram.`
+      );
+    }
     const data = await res.json();
     return String(data.text ?? '').trim();
   }
@@ -237,7 +249,9 @@ export function startTelegramChannel(ctx, { token, allowedChatIds = [], transcri
         tools: definitions,
         execute,
         signal: controller.signal,
-        maxRounds: ctx.config.maxRounds,
+        maxRounds: ctx.effectiveMaxRounds?.() ?? ctx.config.maxRounds,
+        maxTokens: ctx.effectiveMaxTokens?.() ?? 0,
+        maxDurationMs: ctx.effectiveMaxDurationMs?.() ?? 0,
         onEvent(event) {
           if (event.type === 'text') {
             full = event.full;
@@ -260,10 +274,14 @@ export function startTelegramChannel(ctx, { token, allowedChatIds = [], transcri
       const durationMs = Date.now() - startedAt;
       let body = result.content?.trim() || full.trim();
       if (!body) {
-        if (result.stopReason === 'max_rounds') {
+        if (result.stopReason === 'no_progress') {
+          body = '⚠ El agente se quedó repitiendo las mismas herramientas sin avanzar.';
+        } else if (result.stopReason === 'budget') {
+          body = '⚠ El agente alcanzó el presupuesto de tokens/tiempo sin respuesta final.';
+        } else if (result.stopReason === 'max_rounds') {
           body = `⚠ El agente alcanzó el máximo de rondas (${result.rounds}) sin respuesta final.${
             toolCalls ? ` Hizo ${toolCalls} herramientas.` : ''
-          } Pedile que continúe o subí maxRounds.`;
+          }`;
         } else if (toolCalls) {
           body = '✓ El agente terminó sus herramientas, pero no devolvió un mensaje final.';
         } else {

package/harness/packages/server/src/routes/channels.js

@@ -30,6 +30,7 @@ export function registerChannels(route, ctx) {
     }
     if ('allowedChatIds' in body) next.allowedChatIds = sanitizeAllowed(body.allowedChatIds);
     if ('transcribeModel' in body) next.transcribeModel = String(body.transcribeModel ?? '').trim() || 'whisper-1';
+    if ('transcribeProvider' in body) next.transcribeProvider = String(body.transcribeProvider ?? '').trim();
 
     app.telegram = next;
     writeApp(app);

package/harness/packages/server/src/routes/chat.js

@@ -250,7 +250,9 @@ export function registerChat(route, ctx) {
           tools: definitions,
           execute,
           signal: ctx.runs.signal(sessionId),
-          maxRounds: Number(body.maxRounds) || ctx.config.maxRounds || MAX_TOOL_ROUNDS,
+          maxRounds: Number(body.maxRounds) || ctx.effectiveMaxRounds?.() || MAX_TOOL_ROUNDS,
+          maxTokens: Number(body.maxTokens) || ctx.effectiveMaxTokens?.() || 0,
+          maxDurationMs: Number(body.maxDurationMs) || ctx.effectiveMaxDurationMs?.() || 0,
           stallWarnMs: body.stallWarnMs ?? ctx.config.stallWarnMs,
           contextTokens: Number(body.contextTokens) || ctx.config.contextTokens || 0,
           onEvent(event) {
@@ -281,6 +283,9 @@ export function registerChat(route, ctx) {
               const { preview, truncated } = previewToolResult(event.name, event.result);
               const failed = /^Error|^Permiso denegado/i.test(String(event.result));
               ctx.runs.emit(sessionId, 'tool_result', { id: event.id, name: event.name, preview, truncated, failed });
+            } else if (event.type === 'repeat') {
+              partials.flush();
+              ctx.runs.emit(sessionId, 'repeat', { name: event.name, count: event.count });
             }
           },
         });
@@ -303,6 +308,8 @@ export function registerChat(route, ctx) {
             content: result.content,
             rounds: result.rounds,
             stopReason: result.stopReason,
+            wrappedUp: result.wrappedUp === true,
+            continuable: result.stopReason !== 'end_turn',
             tokens: result.usage ?? null,
             toolCalls,
             durationMs,

package/harness/packages/server/src/routes/mcp.js

@@ -4,6 +4,7 @@ import {
   getMcpRegistryServer,
   registryServerToConfig,
   normalizeMcpConfig,
+  maskEnv,
 } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
 
@@ -27,11 +28,26 @@ function listServers(ctx) {
     command: server.command ?? null,
     args: Array.isArray(server.args) ? server.args : [],
     url: server.url ?? null,
-    env: server.env ?? null,
+    inheritEnv: server.inheritEnv === true,
+    env: maskEnv(server.env),
   }));
 }
 
-function parseServer(body, id) {
+/**
+ * Conserva los valores secretos que la API devuelve enmascarados (`••••…`):
+ * un cliente que solo cambia `enabled` o un campo no debe pisar el secreto.
+ */
+function mergeEnv(existing, incoming) {
+  const stored = existing?.config?.env ?? existing?.env ?? {};
+  const result = {};
+  for (const [key, value] of Object.entries(incoming ?? {})) {
+    const text = String(value ?? '');
+    result[key] = text.startsWith('••••') && stored[key] !== undefined ? stored[key] : value;
+  }
+  return result;
+}
+
+function parseServer(body, id, existing = null) {
   const transport = body.transport === 'http' ? 'http' : 'stdio';
   const command = String(body.command ?? '').trim();
   const url = String(body.url ?? '').trim();
@@ -49,7 +65,14 @@ function parseServer(body, id) {
     command: transport === 'stdio' ? command : null,
     url: transport === 'http' ? url : null,
     enabled: body.enabled !== false,
-    config: { args, env: body.env ?? null },
+    config: {
+      args,
+      env: mergeEnv(existing, body.env),
+      inheritEnv:
+        body.inheritEnv === undefined
+          ? Boolean(existing?.config?.inheritEnv ?? existing?.inheritEnv)
+          : body.inheritEnv === true,
+    },
   };
 }
 
@@ -128,7 +151,7 @@ export function registerMcp(route, ctx) {
       command: record.command ?? null,
       url: record.url ?? null,
       enabled: record.enabled !== false,
-      config: { args: record.args ?? [], env: record.env ?? null },
+      config: { args: record.args ?? [], env: record.env ?? null, inheritEnv: record.inheritEnv === true },
     });
     await ctx.reloadMcp();
     sendJson(res, 200, {
@@ -142,9 +165,10 @@ export function registerMcp(route, ctx) {
     const id = String(params.id);
     if (!ID_PATTERN.test(id)) return sendError(res, 400, 'Id de servidor inválido.');
     const body = await readJson(req);
+    const existing = ctx.mergedMcpServers().find((s) => s.id === id) ?? null;
     let record;
     try {
-      record = parseServer(body, id);
+      record = parseServer(body, id, existing);
     } catch (error) {
       return sendError(res, 400, error.message);
     }

package/harness/packages/server/src/routes/providers.js

@@ -68,15 +68,17 @@ export function registerProviders(route, ctx) {
     });
   });
 
+  const settingsView = () => ({
+    provider: ctx.effectiveProviderId(),
+    model: ctx.effectiveModel(),
+    mode: ctx.effectiveMode(),
+    maxRounds: ctx.effectiveMaxRounds(),
+    maxTokens: ctx.effectiveMaxTokens(),
+    maxDurationMs: ctx.effectiveMaxDurationMs(),
+  });
+
   route('GET', '/api/settings', ({ res }) => {
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-        maxRounds: ctx.config.maxRounds,
-      },
-    });
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/settings', async ({ req, res }) => {
@@ -84,13 +86,12 @@ export function registerProviders(route, ctx) {
     if (body.provider !== undefined) ctx.store.setSetting('activeProvider', String(body.provider) || null);
     if (body.model !== undefined) ctx.store.setSetting('activeModel', String(body.model) || null);
     if (body.mode !== undefined) ctx.store.setSetting('activeMode', resolveMode(String(body.mode)).id);
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-      },
-    });
+    for (const key of ['maxRounds', 'maxTokens', 'maxDurationMs']) {
+      if (body[key] === undefined) continue;
+      const value = Number(body[key]);
+      ctx.store.setSetting(key, Number.isFinite(value) && value > 0 ? Math.round(value) : 0);
+    }
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/providers/:id', async ({ req, res, params }) => {

package/harness/packages/server/src/server.js

@@ -92,6 +92,7 @@ export async function createTamnoraServer({
       args: Array.isArray(row.config?.args) ? row.config.args : [],
       url: row.url ?? undefined,
       env: row.config?.env ?? undefined,
+      inheritEnv: row.config?.inheritEnv === true,
       enabled: row.enabled !== false,
       source: 'store',
     }));
@@ -137,6 +138,15 @@ export async function createTamnoraServer({
   const effectiveProviderId = () => store.getSetting('activeProvider') || config.provider;
   const effectiveModel = () => store.getSetting('activeModel') || config.model;
   const effectiveMode = () => store.getSetting('activeMode') || 'agent';
+  const settingNumber = (key, fallback) => {
+    const value = store.getSetting(key);
+    if (value === null || value === undefined || value === '') return fallback ?? 0;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback ?? 0;
+  };
+  const effectiveMaxRounds = () => settingNumber('maxRounds', config.maxRounds);
+  const effectiveMaxTokens = () => settingNumber('maxTokens', config.maxTokens);
+  const effectiveMaxDurationMs = () => settingNumber('maxDurationMs', config.maxDurationMs);
 
   const ctx = {
     cwd,
@@ -152,6 +162,9 @@ export async function createTamnoraServer({
     effectiveProviderId,
     effectiveModel,
     effectiveMode,
+    effectiveMaxRounds,
+    effectiveMaxTokens,
+    effectiveMaxDurationMs,
     providerSettings,
     customProviderDefs,
     apiKeyFor: (id) => resolveApiKey(providerSettings(id).apiKey, process.env),

package/harness/packages/server/test/server.test.js

@@ -43,6 +43,17 @@ test('serves health, providers and the console', async () => {
 
     const html = await (await fetch(`${base}/`)).text();
     assert.match(html, /Tamnora Console/);
+    for (const hook of [
+      'data-panel="agente"',
+      'data-panel="sesiones"',
+      'id="settings-controls-slot"',
+      'id="slash-menu"',
+      'id="statusbar"',
+    ]) {
+      assert.ok(html.includes(hook), `falta ${hook}`);
+    }
+    // Los controles de agente se declaran una sola vez (se mueven entre slots).
+    assert.equal((html.match(/id="mode"/g) ?? []).length, 1);
 
     const missing = await fetch(`${base}/api/nope`);
     assert.equal(missing.status, 404);
@@ -264,7 +275,8 @@ test('done reports max_rounds and the tool count when the model never answers',
 test('completionFooter resume el cierre del turno', () => {
   assert.equal(completionFooter('end_turn', 1, 0, 0), '✓ terminado · 1 ronda');
   assert.equal(completionFooter('end_turn', 3, 5, 1200), '✓ terminado · 3 rondas · 5 herramientas · 1.2s');
-  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ máximo de rondas · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ corte de seguridad · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('no_progress', 2, 2, 300), /^⚠ corte de seguridad/);
 });
 
 test('configures Telegram from the console (masked token)', async () => {
@@ -287,10 +299,11 @@ test('configures Telegram from the console (masked token)', async () => {
     res = await fetch(`${base}/api/channels/telegram`, {
       method: 'PUT',
       headers: json,
-      body: JSON.stringify({ token: '123456:ABCDEFghij' }),
+      body: JSON.stringify({ token: '123456:ABCDEFghij', transcribeProvider: 'openai' }),
     });
     data = await res.json();
     assert.equal(data.telegram.tokenSet, true);
+    assert.equal(data.telegram.transcribeProvider, 'openai');
     assert.match(data.telegram.tokenHint, /ghij$/);
     assert.doesNotMatch(JSON.stringify(data), /ABCDEF/);
 
@@ -342,6 +355,69 @@ test('manages MCP servers from the console', async () => {
   }
 });
 
+test('MCP: el env se enmascara y no se pisa al guardar sin cambios', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'DB',
+        transport: 'stdio',
+        command: 'node',
+        args: ['db.mjs'],
+        env: { MYSQL_HOST: 'localhost', MYSQL_PASSWORD: 'supersecret' },
+      }),
+    });
+
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    const db = data.servers.find((s) => s.id === 'db');
+    assert.equal(db.env.MYSQL_HOST, 'localhost');
+    assert.equal(db.env.MYSQL_PASSWORD, '••••cret');
+
+    // Un toggle manda de vuelta el env enmascarado: no debe pisar el secreto.
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: db.name,
+        transport: 'stdio',
+        command: db.command,
+        args: db.args,
+        env: db.env,
+        enabled: false,
+      }),
+    });
+    const stored = instance.store.listMcpServers().find((s) => s.id === 'db');
+    assert.equal(stored.config.env.MYSQL_PASSWORD, 'supersecret');
+    assert.equal(stored.enabled, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('guarda los límites del agente desde Ajustes', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ maxRounds: 20, maxTokens: 50000, maxDurationMs: 600000 }),
+    });
+    const data = await res.json();
+    assert.equal(data.settings.maxRounds, 20);
+    assert.equal(data.settings.maxTokens, 50000);
+    assert.equal(data.settings.maxDurationMs, 600000);
+
+    const again = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(again.settings.maxRounds, 20);
+  } finally {
+    await instance.close();
+  }
+});
+
 test('imports an MCP server from a JSON snippet', async () => {
   const { instance, base } = await startServer();
   const json = { 'Content-Type': 'application/json' };

package/harness/tamnora.example.json

@@ -2,7 +2,9 @@
   "provider": "openrouter",
   "model": "meta-llama/llama-3.3-8b-instruct:free",
   "instructions": ["AGENTS.md"],
-  "maxRounds": 8,
+  "maxRounds": 0,
+  "maxTokens": 0,
+  "maxDurationMs": 0,
   "tools": [],
   "permissions": {},
   "mcp": [
@@ -14,6 +16,20 @@
       "args": ["harness/scripts/mcp-echo-server.mjs"],
       "enabled": true
     },
+    {
+      "id": "database",
+      "name": "DB (ejemplo: credenciales por env, no por parametros)",
+      "type": "stdio",
+      "command": "node",
+      "args": ["ruta/al/servidor-mcp-db.mjs"],
+      "env": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "env:MYSQL_PASSWORD",
+        "MYSQL_DATABASE": "app"
+      },
+      "enabled": false
+    },
     {
       "id": "playwright",
       "name": "Playwright (navegador headless, para webs con JS)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",