@danieltmn/tamnora 0.6.2 → 0.7.0

package/harness/packages/server/public/index.html

@@ -33,7 +33,7 @@
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo"><span class="logo-t">T</span><span class="logo-h">H</span></span> <span class="ver">v0.6.2</span></div>
+      <div class="brand"><span class="logo"><span class="logo-t">T</span><span class="logo-h">H</span></span> <span class="ver">v0.7.0</span></div>
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>
@@ -118,6 +118,7 @@
             </div>
           </div>
           <form id="chat-form" class="composer">
+            <div id="slash-menu" class="slash-menu" hidden></div>
             <div id="attach-preview" class="attach-preview" hidden></div>
             <div class="composer-row">
               <span class="prompt-mark">❯</span>
@@ -134,7 +135,7 @@
               <button class="btn" type="button" id="stop-btn" title="Detener la respuesta" hidden>parar</button>
             </div>
           </form>
-          <div class="statusbar">
+          <div id="statusbar" class="statusbar" title="cambiar modo, proveedor y modelo" role="button" tabindex="0">
             <span id="sb-mode">agent</span>
             <span class="dot">·</span>
             <span id="sb-provider">—</span>
@@ -343,7 +344,62 @@
       </section>
 
       <section id="view-ajustes" class="view">
-        <div class="panel">
+        <div class="ajustes-wrap">
+          <nav class="ajustes-tabs" role="tablist" aria-label="secciones de ajustes">
+            <button type="button" class="ajustes-tab active" data-panel="agente" role="tab">Agente</button>
+            <button type="button" class="ajustes-tab" data-panel="sesiones" role="tab">Sesiones</button>
+            <button type="button" class="ajustes-tab" data-panel="mcp" role="tab">MCP</button>
+            <button type="button" class="ajustes-tab" data-panel="skills" role="tab">Skills</button>
+            <button type="button" class="ajustes-tab" data-panel="telegram" role="tab">Telegram</button>
+            <button type="button" class="ajustes-tab" data-panel="limites" role="tab">Límites</button>
+          </nav>
+
+        <div class="panel ajustes-panel active" data-panel="agente">
+          <div class="row between">
+            <h2>Agente</h2>
+          </div>
+          <p class="muted verify-line">
+            Modo, proveedor, modelo y aprobación automática del agente.
+          </p>
+          <div id="agent-controls-slot">
+            <div id="agent-settings-controls">
+              <label for="mode">Modo</label>
+              <select id="mode" title="modo de agente"></select>
+              <label for="provider">Proveedor</label>
+              <select id="provider" title="proveedor"></select>
+              <label for="model">Modelo</label>
+              <select id="model" title="modelo"></select>
+              <label class="check" title="aprobar automáticamente tools con permiso ask">
+                <input id="yes" type="checkbox" /> Aprobar automáticamente las tools (auto)
+              </label>
+            </div>
+          </div>
+          <div class="row">
+            <button type="button" id="agent-settings-open" class="btn">abrir en ventana</button>
+            <button type="button" id="agent-providers" class="btn">gestionar proveedores</button>
+          </div>
+        </div>
+
+        <div class="panel ajustes-panel" data-panel="sesiones">
+          <div class="row between">
+            <h2>Sesiones</h2>
+          </div>
+          <p class="muted verify-line">
+            Carpeta donde se abre el selector de carpetas y <code>/new</code> cuando no hay sesión.
+          </p>
+          <label for="default-cwd">Carpeta predeterminada para nuevas sesiones</label>
+          <div class="row default-cwd-row">
+            <input id="default-cwd" type="text" readonly placeholder="(la casa del usuario)" title="carpeta donde se abre el selector y /new sin sesión" />
+            <button type="button" id="default-cwd-pick" class="btn">elegir</button>
+            <button type="button" id="default-cwd-clear" class="btn icon" title="quitar la carpeta predeterminada" aria-label="quitar la carpeta predeterminada">
+              <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                <path d="M18 6 6 18M6 6l12 12" />
+              </svg>
+            </button>
+          </div>
+        </div>
+
+        <div class="panel ajustes-panel" data-panel="mcp">
           <div class="row between">
             <h2>Servidores MCP</h2>
             <div class="row">
@@ -362,7 +418,7 @@
           <ul id="mcp-list" class="providers"></ul>
         </div>
 
-        <div class="panel">
+        <div class="panel ajustes-panel" data-panel="skills">
           <div class="row between">
             <h2>Skills</h2>
             <button id="skill-new" class="btn">+ nueva</button>
@@ -378,7 +434,7 @@
           <ul id="skill-list" class="providers"></ul>
         </div>
 
-        <div class="panel">
+        <div class="panel ajustes-panel" data-panel="telegram">
           <div class="row between">
             <h2>Telegram</h2>
             <span id="tg-status" class="summary">cargando…</span>
@@ -416,6 +472,30 @@
             <span id="tg-msg" class="summary"></span>
           </div>
         </div>
+
+        <div class="panel ajustes-panel" data-panel="limites">
+          <div class="row between">
+            <h2>Límites del agente</h2>
+          </div>
+          <p class="muted verify-line">
+            El agente trabaja hasta terminar solo (<code>end_turn</code>). Estos topes son
+            opcionales: <code>0</code> = sin límite. Al cortarse, cierra con un resumen.
+          </p>
+          <label class="field"><span>máximo de rondas de herramientas (0 = sin límite)</span>
+            <input id="limits-rounds" type="number" min="0" step="1" placeholder="0" />
+          </label>
+          <label class="field"><span>presupuesto de tokens (0 = sin límite)</span>
+            <input id="limits-tokens" type="number" min="0" step="1000" placeholder="0" />
+          </label>
+          <label class="field"><span>presupuesto de tiempo en segundos (0 = sin límite)</span>
+            <input id="limits-duration" type="number" min="0" step="1" placeholder="0" />
+          </label>
+          <div class="row">
+            <button id="limits-save" class="btn primary" type="button">guardar</button>
+            <span id="limits-msg" class="summary"></span>
+          </div>
+        </div>
+        </div>
       </section>
 
       <dialog id="folder-modal" class="modal folder-modal">
@@ -485,25 +565,7 @@
             </svg>
           </button>
         </div>
-        <label for="mode">Modo</label>
-        <select id="mode" title="modo de agente"></select>
-        <label for="provider">Proveedor</label>
-        <select id="provider" title="proveedor"></select>
-        <label for="model">Modelo</label>
-        <select id="model" title="modelo"></select>
-        <label for="default-cwd">Carpeta predeterminada para nuevas sesiones</label>
-        <div class="row default-cwd-row">
-          <input id="default-cwd" type="text" readonly placeholder="(la casa del usuario)" title="carpeta donde se abre el selector y /new sin sesión" />
-          <button type="button" id="default-cwd-pick" class="btn">elegir</button>
-          <button type="button" id="default-cwd-clear" class="btn icon" title="quitar la carpeta predeterminada" aria-label="quitar la carpeta predeterminada">
-            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-              <path d="M18 6 6 18M6 6l12 12" />
-            </svg>
-          </button>
-        </div>
-        <label class="check" title="aprobar automáticamente tools con permiso ask">
-          <input id="yes" type="checkbox" /> Aprobar automáticamente las tools (auto)
-        </label>
+        <div id="settings-controls-slot"></div>
         <div class="row between settings-actions">
           <button type="button" id="settings-providers" class="btn">gestionar proveedores</button>
           <button type="button" id="settings-done" class="btn primary">listo</button>
@@ -538,9 +600,10 @@
         <div class="row">
           <label class="field grow" id="mf-args-field"><span>args (separados por espacio)</span><input id="mf-args" spellcheck="false" placeholder="harness/scripts/mcp-echo-server.mjs" /></label>
         </div>
-        <label class="field"><span>env (KEY=valor por línea)</span>
-          <textarea id="mf-env" rows="3" spellcheck="false" placeholder="API_KEY=..."></textarea>
+        <label class="field" id="mf-env-field"><span>env (KEY=valor por línea · usá <code>env:VAR</code> para no hardcodear secretos)</span>
+          <textarea id="mf-env" rows="3" spellcheck="false" placeholder="API_KEY=env:MY_API_KEY"></textarea>
         </label>
+        <label class="check" id="mf-inherit-field"><input id="mf-inherit-env" type="checkbox" /> heredar todo el entorno (<code>inheritEnv</code>, solo MCPs de confianza)</label>
         <label class="check"><input id="mf-enabled" type="checkbox" checked /> habilitado</label>
         <div class="row between settings-actions">
           <button type="button" id="mf-cancel" class="btn">cancelar</button>

package/harness/packages/server/public/styles.css

@@ -621,7 +621,7 @@ details.reasoning .body { color: var(--muted); white-space: pre-wrap; margin-top
 
 @keyframes pulse { 50% { opacity: 0.35; } }
 
-.composer { display: flex; flex-direction: column; gap: 8px; padding: 12px 14px; border-top: 1px solid var(--border); background: var(--panel); backdrop-filter: blur(14px); }
+.composer { position: relative; display: flex; flex-direction: column; gap: 8px; padding: 12px 14px; border-top: 1px solid var(--border); background: var(--panel); backdrop-filter: blur(14px); }
 .composer.dragging { outline: 1px dashed var(--accent); outline-offset: -4px; }
 .composer-row { display: flex; align-items: flex-end; gap: 8px; }
 .prompt-mark { color: var(--mine); font-weight: 700; padding-bottom: 8px; }
@@ -707,6 +707,46 @@ pre.code code { background: none; border: 0; padding: 0; font-size: 12.5px; }
 }
 .statusbar .dot { opacity: 0.5; }
 .statusbar .spacer { flex: 1; }
+.statusbar[role="button"] { cursor: pointer; }
+.statusbar[role="button"]:hover { color: var(--fg); }
+
+/* menú de comandos "/" en el composer */
+.slash-menu {
+  position: absolute;
+  left: 14px;
+  right: 14px;
+  bottom: calc(100% - 6px);
+  max-height: 260px;
+  overflow-y: auto;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding: 6px;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  background: var(--panel);
+  box-shadow: 0 12px 32px rgb(0 0 0 / 0.22);
+  z-index: 30;
+}
+.slash-menu[hidden] { display: none; }
+.slash-item {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  width: 100%;
+  padding: 7px 9px;
+  border: 0;
+  border-radius: 8px;
+  background: none;
+  color: var(--fg);
+  text-align: left;
+  cursor: pointer;
+  font: 500 13px var(--mono);
+}
+.slash-item.active,
+.slash-item:hover { background: var(--theirs); }
+.slash-cmd { color: var(--accent); font-weight: 700; }
+.slash-desc { color: var(--muted); font: 400 12px var(--serif); }
 .ctx { display: inline-flex; align-items: center; gap: 8px; }
 .ctx-bar { width: 76px; height: 6px; border-radius: 999px; background: var(--border); overflow: hidden; }
 .ctx-fill { display: block; height: 100%; width: 0; border-radius: 999px; background: currentColor; transition: width 0.35s ease; }
@@ -724,6 +764,26 @@ pre.code code { background: none; border: 0; padding: 0; font-size: 12.5px; }
 
 .card { border: 1px solid var(--border); background: var(--panel); backdrop-filter: blur(14px); border-radius: 14px; padding: 14px; display: flex; flex-direction: column; gap: 10px; }
 
+/* ajustes: pestañas internas ---------------------------------------------- */
+#view-ajustes.active { display: block; overflow-y: auto; }
+.ajustes-wrap { width: 100%; max-width: 780px; margin: 0 auto; padding: 18px; display: flex; flex-direction: column; gap: 12px; min-height: 100%; }
+.ajustes-tabs { display: flex; gap: 2px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
+.ajustes-tab {
+  appearance: none; background: none; border: 0; border-bottom: 2px solid transparent;
+  padding: 8px 14px; margin-bottom: -1px; color: var(--muted); cursor: pointer;
+  font: 600 13px var(--serif); letter-spacing: 0.01em;
+}
+.ajustes-tab:hover { color: var(--fg); }
+.ajustes-tab.active { color: var(--fg); border-bottom-color: var(--accent); }
+.ajustes-panel { display: none; }
+.ajustes-panel.active { display: flex; }
+.ajustes-panel.panel { flex: none; max-width: none; overflow: visible; padding: 6px 2px 18px; }
+.ajustes-panel .verify-line code { font-size: 11px; }
+#agent-settings-controls { display: flex; flex-direction: column; gap: 7px; }
+#agent-settings-controls label { color: var(--muted); font-size: 12px; }
+#agent-settings-controls select { width: 100%; }
+#agent-controls-slot:empty { display: none; }
+
 .providers { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 4px; }
 .providers li {
   display: flex;

package/harness/packages/server/src/lib/agentTools.js

@@ -42,6 +42,8 @@ const DEFINITIONS = [
       transport: { type: 'string', enum: ['stdio', 'http'] },
       command: { type: 'string', description: 'Para stdio, ej. "node" o "npx"' },
       args: { type: 'array', items: { type: 'string' } },
+      env: { type: 'object', description: 'Variables para el MCP (usá "env:VAR" para no hardcodear secretos)' },
+      inheritEnv: { type: 'boolean', description: 'Heredar process.env (solo MCPs de confianza; default false)' },
       url: { type: 'string', description: 'Para http' },
       enabled: { type: 'boolean' },
     },
@@ -133,7 +135,7 @@ export function createAgentTools(ctx) {
             command: cfg.command ?? null,
             url: cfg.url ?? null,
             enabled: true,
-            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+            config: { args: cfg.args ?? [], env: cfg.env ?? null, inheritEnv: cfg.inheritEnv === true },
           });
           await ctx.reloadMcp();
           const required = (cfg.requiredEnv ?? []).length ? ` Requiere env: ${cfg.requiredEnv.join(', ')}.` : '';
@@ -154,7 +156,7 @@ export function createAgentTools(ctx) {
             command: cfg.command ?? null,
             url: cfg.url ?? null,
             enabled: cfg.enabled !== false,
-            config: { args: cfg.args ?? [], env: cfg.env ?? null },
+            config: { args: cfg.args ?? [], env: cfg.env ?? null, inheritEnv: cfg.inheritEnv === true },
           });
           await ctx.reloadMcp();
           return `MCP "${cfg.id}" importado.`;
@@ -174,7 +176,11 @@ export function createAgentTools(ctx) {
           command: transport === 'stdio' ? command : null,
           url: transport === 'http' ? url : null,
           enabled: args.enabled !== false,
-          config: { args: Array.isArray(args.args) ? args.args : [], env: args.env ?? null },
+          config: {
+            args: Array.isArray(args.args) ? args.args : [],
+            env: args.env ?? null,
+            inheritEnv: args.inheritEnv === true,
+          },
         });
         await ctx.reloadMcp();
         return `MCP "${id}" registrado (${transport}).`;

package/harness/packages/server/src/lib/channels/telegram.js

@@ -75,8 +75,8 @@ export function completionFooter(stopReason, rounds, toolCalls, durationMs) {
   const parts = [`${rounds ?? '?'} ronda${rounds === 1 ? '' : 's'}`];
   if (toolCalls) parts.push(`${toolCalls} herramienta${toolCalls === 1 ? '' : 's'}`);
   if (durationMs > 0) parts.push(durationMs >= 1000 ? `${(durationMs / 1000).toFixed(1)}s` : `${durationMs}ms`);
-  const maxed = stopReason === 'max_rounds';
-  return `${maxed ? '⚠ máximo de rondas' : '✓ terminado'} · ${parts.join(' · ')}`;
+  const maxed = ['max_rounds', 'no_progress', 'budget'].includes(stopReason);
+  return `${maxed ? '⚠ corte de seguridad' : '✓ terminado'} · ${parts.join(' · ')}`;
 }
 
 /**
@@ -249,7 +249,9 @@ export function startTelegramChannel(
         tools: definitions,
         execute,
         signal: controller.signal,
-        maxRounds: ctx.config.maxRounds,
+        maxRounds: ctx.effectiveMaxRounds?.() ?? ctx.config.maxRounds,
+        maxTokens: ctx.effectiveMaxTokens?.() ?? 0,
+        maxDurationMs: ctx.effectiveMaxDurationMs?.() ?? 0,
         onEvent(event) {
           if (event.type === 'text') {
             full = event.full;
@@ -272,10 +274,14 @@ export function startTelegramChannel(
       const durationMs = Date.now() - startedAt;
       let body = result.content?.trim() || full.trim();
       if (!body) {
-        if (result.stopReason === 'max_rounds') {
+        if (result.stopReason === 'no_progress') {
+          body = '⚠ El agente se quedó repitiendo las mismas herramientas sin avanzar.';
+        } else if (result.stopReason === 'budget') {
+          body = '⚠ El agente alcanzó el presupuesto de tokens/tiempo sin respuesta final.';
+        } else if (result.stopReason === 'max_rounds') {
           body = `⚠ El agente alcanzó el máximo de rondas (${result.rounds}) sin respuesta final.${
             toolCalls ? ` Hizo ${toolCalls} herramientas.` : ''
-          } Pedile que continúe o subí maxRounds.`;
+          }`;
         } else if (toolCalls) {
           body = '✓ El agente terminó sus herramientas, pero no devolvió un mensaje final.';
         } else {

package/harness/packages/server/src/routes/chat.js

@@ -250,7 +250,9 @@ export function registerChat(route, ctx) {
           tools: definitions,
           execute,
           signal: ctx.runs.signal(sessionId),
-          maxRounds: Number(body.maxRounds) || ctx.config.maxRounds || MAX_TOOL_ROUNDS,
+          maxRounds: Number(body.maxRounds) || ctx.effectiveMaxRounds?.() || MAX_TOOL_ROUNDS,
+          maxTokens: Number(body.maxTokens) || ctx.effectiveMaxTokens?.() || 0,
+          maxDurationMs: Number(body.maxDurationMs) || ctx.effectiveMaxDurationMs?.() || 0,
           stallWarnMs: body.stallWarnMs ?? ctx.config.stallWarnMs,
           contextTokens: Number(body.contextTokens) || ctx.config.contextTokens || 0,
           onEvent(event) {
@@ -281,6 +283,9 @@ export function registerChat(route, ctx) {
               const { preview, truncated } = previewToolResult(event.name, event.result);
               const failed = /^Error|^Permiso denegado/i.test(String(event.result));
               ctx.runs.emit(sessionId, 'tool_result', { id: event.id, name: event.name, preview, truncated, failed });
+            } else if (event.type === 'repeat') {
+              partials.flush();
+              ctx.runs.emit(sessionId, 'repeat', { name: event.name, count: event.count });
             }
           },
         });
@@ -303,6 +308,8 @@ export function registerChat(route, ctx) {
             content: result.content,
             rounds: result.rounds,
             stopReason: result.stopReason,
+            wrappedUp: result.wrappedUp === true,
+            continuable: result.stopReason !== 'end_turn',
             tokens: result.usage ?? null,
             toolCalls,
             durationMs,

package/harness/packages/server/src/routes/mcp.js

@@ -4,6 +4,7 @@ import {
   getMcpRegistryServer,
   registryServerToConfig,
   normalizeMcpConfig,
+  maskEnv,
 } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
 
@@ -27,11 +28,26 @@ function listServers(ctx) {
     command: server.command ?? null,
     args: Array.isArray(server.args) ? server.args : [],
     url: server.url ?? null,
-    env: server.env ?? null,
+    inheritEnv: server.inheritEnv === true,
+    env: maskEnv(server.env),
   }));
 }
 
-function parseServer(body, id) {
+/**
+ * Conserva los valores secretos que la API devuelve enmascarados (`••••…`):
+ * un cliente que solo cambia `enabled` o un campo no debe pisar el secreto.
+ */
+function mergeEnv(existing, incoming) {
+  const stored = existing?.config?.env ?? existing?.env ?? {};
+  const result = {};
+  for (const [key, value] of Object.entries(incoming ?? {})) {
+    const text = String(value ?? '');
+    result[key] = text.startsWith('••••') && stored[key] !== undefined ? stored[key] : value;
+  }
+  return result;
+}
+
+function parseServer(body, id, existing = null) {
   const transport = body.transport === 'http' ? 'http' : 'stdio';
   const command = String(body.command ?? '').trim();
   const url = String(body.url ?? '').trim();
@@ -49,7 +65,14 @@ function parseServer(body, id) {
     command: transport === 'stdio' ? command : null,
     url: transport === 'http' ? url : null,
     enabled: body.enabled !== false,
-    config: { args, env: body.env ?? null },
+    config: {
+      args,
+      env: mergeEnv(existing, body.env),
+      inheritEnv:
+        body.inheritEnv === undefined
+          ? Boolean(existing?.config?.inheritEnv ?? existing?.inheritEnv)
+          : body.inheritEnv === true,
+    },
   };
 }
 
@@ -128,7 +151,7 @@ export function registerMcp(route, ctx) {
       command: record.command ?? null,
       url: record.url ?? null,
       enabled: record.enabled !== false,
-      config: { args: record.args ?? [], env: record.env ?? null },
+      config: { args: record.args ?? [], env: record.env ?? null, inheritEnv: record.inheritEnv === true },
     });
     await ctx.reloadMcp();
     sendJson(res, 200, {
@@ -142,9 +165,10 @@ export function registerMcp(route, ctx) {
     const id = String(params.id);
     if (!ID_PATTERN.test(id)) return sendError(res, 400, 'Id de servidor inválido.');
     const body = await readJson(req);
+    const existing = ctx.mergedMcpServers().find((s) => s.id === id) ?? null;
     let record;
     try {
-      record = parseServer(body, id);
+      record = parseServer(body, id, existing);
     } catch (error) {
       return sendError(res, 400, error.message);
     }

package/harness/packages/server/src/routes/providers.js

@@ -68,15 +68,17 @@ export function registerProviders(route, ctx) {
     });
   });
 
+  const settingsView = () => ({
+    provider: ctx.effectiveProviderId(),
+    model: ctx.effectiveModel(),
+    mode: ctx.effectiveMode(),
+    maxRounds: ctx.effectiveMaxRounds(),
+    maxTokens: ctx.effectiveMaxTokens(),
+    maxDurationMs: ctx.effectiveMaxDurationMs(),
+  });
+
   route('GET', '/api/settings', ({ res }) => {
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-        maxRounds: ctx.config.maxRounds,
-      },
-    });
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/settings', async ({ req, res }) => {
@@ -84,13 +86,12 @@ export function registerProviders(route, ctx) {
     if (body.provider !== undefined) ctx.store.setSetting('activeProvider', String(body.provider) || null);
     if (body.model !== undefined) ctx.store.setSetting('activeModel', String(body.model) || null);
     if (body.mode !== undefined) ctx.store.setSetting('activeMode', resolveMode(String(body.mode)).id);
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-      },
-    });
+    for (const key of ['maxRounds', 'maxTokens', 'maxDurationMs']) {
+      if (body[key] === undefined) continue;
+      const value = Number(body[key]);
+      ctx.store.setSetting(key, Number.isFinite(value) && value > 0 ? Math.round(value) : 0);
+    }
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/providers/:id', async ({ req, res, params }) => {

package/harness/packages/server/src/server.js

@@ -92,6 +92,7 @@ export async function createTamnoraServer({
       args: Array.isArray(row.config?.args) ? row.config.args : [],
       url: row.url ?? undefined,
       env: row.config?.env ?? undefined,
+      inheritEnv: row.config?.inheritEnv === true,
       enabled: row.enabled !== false,
       source: 'store',
     }));
@@ -137,6 +138,15 @@ export async function createTamnoraServer({
   const effectiveProviderId = () => store.getSetting('activeProvider') || config.provider;
   const effectiveModel = () => store.getSetting('activeModel') || config.model;
   const effectiveMode = () => store.getSetting('activeMode') || 'agent';
+  const settingNumber = (key, fallback) => {
+    const value = store.getSetting(key);
+    if (value === null || value === undefined || value === '') return fallback ?? 0;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback ?? 0;
+  };
+  const effectiveMaxRounds = () => settingNumber('maxRounds', config.maxRounds);
+  const effectiveMaxTokens = () => settingNumber('maxTokens', config.maxTokens);
+  const effectiveMaxDurationMs = () => settingNumber('maxDurationMs', config.maxDurationMs);
 
   const ctx = {
     cwd,
@@ -152,6 +162,9 @@ export async function createTamnoraServer({
     effectiveProviderId,
     effectiveModel,
     effectiveMode,
+    effectiveMaxRounds,
+    effectiveMaxTokens,
+    effectiveMaxDurationMs,
     providerSettings,
     customProviderDefs,
     apiKeyFor: (id) => resolveApiKey(providerSettings(id).apiKey, process.env),

package/harness/packages/server/test/server.test.js

@@ -43,6 +43,17 @@ test('serves health, providers and the console', async () => {
 
     const html = await (await fetch(`${base}/`)).text();
     assert.match(html, /Tamnora Console/);
+    for (const hook of [
+      'data-panel="agente"',
+      'data-panel="sesiones"',
+      'id="settings-controls-slot"',
+      'id="slash-menu"',
+      'id="statusbar"',
+    ]) {
+      assert.ok(html.includes(hook), `falta ${hook}`);
+    }
+    // Los controles de agente se declaran una sola vez (se mueven entre slots).
+    assert.equal((html.match(/id="mode"/g) ?? []).length, 1);
 
     const missing = await fetch(`${base}/api/nope`);
     assert.equal(missing.status, 404);
@@ -264,7 +275,8 @@ test('done reports max_rounds and the tool count when the model never answers',
 test('completionFooter resume el cierre del turno', () => {
   assert.equal(completionFooter('end_turn', 1, 0, 0), '✓ terminado · 1 ronda');
   assert.equal(completionFooter('end_turn', 3, 5, 1200), '✓ terminado · 3 rondas · 5 herramientas · 1.2s');
-  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ máximo de rondas · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ corte de seguridad · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('no_progress', 2, 2, 300), /^⚠ corte de seguridad/);
 });
 
 test('configures Telegram from the console (masked token)', async () => {
@@ -343,6 +355,69 @@ test('manages MCP servers from the console', async () => {
   }
 });
 
+test('MCP: el env se enmascara y no se pisa al guardar sin cambios', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'DB',
+        transport: 'stdio',
+        command: 'node',
+        args: ['db.mjs'],
+        env: { MYSQL_HOST: 'localhost', MYSQL_PASSWORD: 'supersecret' },
+      }),
+    });
+
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    const db = data.servers.find((s) => s.id === 'db');
+    assert.equal(db.env.MYSQL_HOST, 'localhost');
+    assert.equal(db.env.MYSQL_PASSWORD, '••••cret');
+
+    // Un toggle manda de vuelta el env enmascarado: no debe pisar el secreto.
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: db.name,
+        transport: 'stdio',
+        command: db.command,
+        args: db.args,
+        env: db.env,
+        enabled: false,
+      }),
+    });
+    const stored = instance.store.listMcpServers().find((s) => s.id === 'db');
+    assert.equal(stored.config.env.MYSQL_PASSWORD, 'supersecret');
+    assert.equal(stored.enabled, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('guarda los límites del agente desde Ajustes', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ maxRounds: 20, maxTokens: 50000, maxDurationMs: 600000 }),
+    });
+    const data = await res.json();
+    assert.equal(data.settings.maxRounds, 20);
+    assert.equal(data.settings.maxTokens, 50000);
+    assert.equal(data.settings.maxDurationMs, 600000);
+
+    const again = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(again.settings.maxRounds, 20);
+  } finally {
+    await instance.close();
+  }
+});
+
 test('imports an MCP server from a JSON snippet', async () => {
   const { instance, base } = await startServer();
   const json = { 'Content-Type': 'application/json' };

package/harness/tamnora.example.json

@@ -2,7 +2,9 @@
   "provider": "openrouter",
   "model": "meta-llama/llama-3.3-8b-instruct:free",
   "instructions": ["AGENTS.md"],
-  "maxRounds": 8,
+  "maxRounds": 0,
+  "maxTokens": 0,
+  "maxDurationMs": 0,
   "tools": [],
   "permissions": {},
   "mcp": [
@@ -14,6 +16,20 @@
       "args": ["harness/scripts/mcp-echo-server.mjs"],
       "enabled": true
     },
+    {
+      "id": "database",
+      "name": "DB (ejemplo: credenciales por env, no por parametros)",
+      "type": "stdio",
+      "command": "node",
+      "args": ["ruta/al/servidor-mcp-db.mjs"],
+      "env": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "env:MYSQL_PASSWORD",
+        "MYSQL_DATABASE": "app"
+      },
+      "enabled": false
+    },
     {
       "id": "playwright",
       "name": "Playwright (navegador headless, para webs con JS)",