@danieltmn/tamnora 0.6.2 → 0.7.1

package/harness/packages/server/src/routes/chat.js

@@ -250,7 +250,9 @@ export function registerChat(route, ctx) {
           tools: definitions,
           execute,
           signal: ctx.runs.signal(sessionId),
-          maxRounds: Number(body.maxRounds) || ctx.config.maxRounds || MAX_TOOL_ROUNDS,
+          maxRounds: Number(body.maxRounds) || ctx.effectiveMaxRounds?.() || MAX_TOOL_ROUNDS,
+          maxTokens: Number(body.maxTokens) || ctx.effectiveMaxTokens?.() || 0,
+          maxDurationMs: Number(body.maxDurationMs) || ctx.effectiveMaxDurationMs?.() || 0,
           stallWarnMs: body.stallWarnMs ?? ctx.config.stallWarnMs,
           contextTokens: Number(body.contextTokens) || ctx.config.contextTokens || 0,
           onEvent(event) {
@@ -281,6 +283,9 @@ export function registerChat(route, ctx) {
               const { preview, truncated } = previewToolResult(event.name, event.result);
               const failed = /^Error|^Permiso denegado/i.test(String(event.result));
               ctx.runs.emit(sessionId, 'tool_result', { id: event.id, name: event.name, preview, truncated, failed });
+            } else if (event.type === 'repeat') {
+              partials.flush();
+              ctx.runs.emit(sessionId, 'repeat', { name: event.name, count: event.count });
             }
           },
         });
@@ -303,6 +308,8 @@ export function registerChat(route, ctx) {
             content: result.content,
             rounds: result.rounds,
             stopReason: result.stopReason,
+            wrappedUp: result.wrappedUp === true,
+            continuable: result.stopReason !== 'end_turn',
             tokens: result.usage ?? null,
             toolCalls,
             durationMs,

package/harness/packages/server/src/routes/mcp.js

@@ -4,6 +4,7 @@ import {
   getMcpRegistryServer,
   registryServerToConfig,
   normalizeMcpConfig,
+  maskEnv,
 } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
 
@@ -27,11 +28,26 @@ function listServers(ctx) {
     command: server.command ?? null,
     args: Array.isArray(server.args) ? server.args : [],
     url: server.url ?? null,
-    env: server.env ?? null,
+    inheritEnv: server.inheritEnv === true,
+    env: maskEnv(server.env),
   }));
 }
 
-function parseServer(body, id) {
+/**
+ * Conserva los valores secretos que la API devuelve enmascarados (`••••…`):
+ * un cliente que solo cambia `enabled` o un campo no debe pisar el secreto.
+ */
+function mergeEnv(existing, incoming) {
+  const stored = existing?.config?.env ?? existing?.env ?? {};
+  const result = {};
+  for (const [key, value] of Object.entries(incoming ?? {})) {
+    const text = String(value ?? '');
+    result[key] = text.startsWith('••••') && stored[key] !== undefined ? stored[key] : value;
+  }
+  return result;
+}
+
+function parseServer(body, id, existing = null) {
   const transport = body.transport === 'http' ? 'http' : 'stdio';
   const command = String(body.command ?? '').trim();
   const url = String(body.url ?? '').trim();
@@ -49,7 +65,14 @@ function parseServer(body, id) {
     command: transport === 'stdio' ? command : null,
     url: transport === 'http' ? url : null,
     enabled: body.enabled !== false,
-    config: { args, env: body.env ?? null },
+    config: {
+      args,
+      env: mergeEnv(existing, body.env),
+      inheritEnv:
+        body.inheritEnv === undefined
+          ? Boolean(existing?.config?.inheritEnv ?? existing?.inheritEnv)
+          : body.inheritEnv === true,
+    },
   };
 }
 
@@ -128,7 +151,7 @@ export function registerMcp(route, ctx) {
       command: record.command ?? null,
       url: record.url ?? null,
       enabled: record.enabled !== false,
-      config: { args: record.args ?? [], env: record.env ?? null },
+      config: { args: record.args ?? [], env: record.env ?? null, inheritEnv: record.inheritEnv === true },
     });
     await ctx.reloadMcp();
     sendJson(res, 200, {
@@ -142,9 +165,10 @@ export function registerMcp(route, ctx) {
     const id = String(params.id);
     if (!ID_PATTERN.test(id)) return sendError(res, 400, 'Id de servidor inválido.');
     const body = await readJson(req);
+    const existing = ctx.mergedMcpServers().find((s) => s.id === id) ?? null;
     let record;
     try {
-      record = parseServer(body, id);
+      record = parseServer(body, id, existing);
     } catch (error) {
       return sendError(res, 400, error.message);
     }

package/harness/packages/server/src/routes/providers.js

@@ -68,15 +68,17 @@ export function registerProviders(route, ctx) {
     });
   });
 
+  const settingsView = () => ({
+    provider: ctx.effectiveProviderId(),
+    model: ctx.effectiveModel(),
+    mode: ctx.effectiveMode(),
+    maxRounds: ctx.effectiveMaxRounds(),
+    maxTokens: ctx.effectiveMaxTokens(),
+    maxDurationMs: ctx.effectiveMaxDurationMs(),
+  });
+
   route('GET', '/api/settings', ({ res }) => {
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-        maxRounds: ctx.config.maxRounds,
-      },
-    });
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/settings', async ({ req, res }) => {
@@ -84,13 +86,12 @@ export function registerProviders(route, ctx) {
     if (body.provider !== undefined) ctx.store.setSetting('activeProvider', String(body.provider) || null);
     if (body.model !== undefined) ctx.store.setSetting('activeModel', String(body.model) || null);
     if (body.mode !== undefined) ctx.store.setSetting('activeMode', resolveMode(String(body.mode)).id);
-    sendJson(res, 200, {
-      settings: {
-        provider: ctx.effectiveProviderId(),
-        model: ctx.effectiveModel(),
-        mode: ctx.effectiveMode(),
-      },
-    });
+    for (const key of ['maxRounds', 'maxTokens', 'maxDurationMs']) {
+      if (body[key] === undefined) continue;
+      const value = Number(body[key]);
+      ctx.store.setSetting(key, Number.isFinite(value) && value > 0 ? Math.round(value) : 0);
+    }
+    sendJson(res, 200, { settings: settingsView() });
   });
 
   route('PUT', '/api/providers/:id', async ({ req, res, params }) => {

package/harness/packages/server/src/server.js

@@ -92,6 +92,7 @@ export async function createTamnoraServer({
       args: Array.isArray(row.config?.args) ? row.config.args : [],
       url: row.url ?? undefined,
       env: row.config?.env ?? undefined,
+      inheritEnv: row.config?.inheritEnv === true,
       enabled: row.enabled !== false,
       source: 'store',
     }));
@@ -137,6 +138,15 @@ export async function createTamnoraServer({
   const effectiveProviderId = () => store.getSetting('activeProvider') || config.provider;
   const effectiveModel = () => store.getSetting('activeModel') || config.model;
   const effectiveMode = () => store.getSetting('activeMode') || 'agent';
+  const settingNumber = (key, fallback) => {
+    const value = store.getSetting(key);
+    if (value === null || value === undefined || value === '') return fallback ?? 0;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback ?? 0;
+  };
+  const effectiveMaxRounds = () => settingNumber('maxRounds', config.maxRounds);
+  const effectiveMaxTokens = () => settingNumber('maxTokens', config.maxTokens);
+  const effectiveMaxDurationMs = () => settingNumber('maxDurationMs', config.maxDurationMs);
 
   const ctx = {
     cwd,
@@ -152,6 +162,9 @@ export async function createTamnoraServer({
     effectiveProviderId,
     effectiveModel,
     effectiveMode,
+    effectiveMaxRounds,
+    effectiveMaxTokens,
+    effectiveMaxDurationMs,
     providerSettings,
     customProviderDefs,
     apiKeyFor: (id) => resolveApiKey(providerSettings(id).apiKey, process.env),

package/harness/packages/server/test/markdown.test.js

@@ -31,6 +31,39 @@ test('only allows http(s) links', () => {
   assert.ok(!renderMarkdown('[x](javascript:alert(1))').includes('<a '));
 });
 
+test('renders pipe tables with alignment and stops at the next block', () => {
+  const md = [
+    '| Archivo | Qué es | Centro | Derecha |',
+    '| --- | :-- | :-: | --: |',
+    '| index.html | Landing | x | y |',
+    '| `a.js` | **script** | z | w |',
+    '',
+    'sigue el texto',
+  ].join('\n');
+  const html = renderMarkdown(md);
+  assert.match(html, /<div class="table-wrap"><table>/);
+  assert.match(html, /<th>Archivo<\/th>/);
+  assert.match(html, /<th style="text-align:center">Centro<\/th>/);
+  assert.match(html, /<th style="text-align:right">Derecha<\/th>/);
+  assert.match(html, /<td style="text-align:left">Landing<\/td>/);
+  assert.match(html, /<td><code>a\.js<\/code><\/td>/);
+  assert.match(html, /<td style="text-align:left"><strong>script<\/strong><\/td>/);
+  assert.match(html, /<\/tbody><\/table><\/div>\n<p>sigue el texto<\/p>/);
+});
+
+test('table cells are escaped and escaped pipes stay in one cell', () => {
+  const html = renderMarkdown('| col | col2 |\n| --- | --- |\n| a \\| b | <script> |');
+  assert.match(html, /<td>a \| b<\/td>/);
+  assert.ok(!html.includes('<script>'));
+  assert.match(html, /&lt;script&gt;/);
+});
+
+test('a lone pipe line without a delimiter row stays a paragraph', () => {
+  const html = renderMarkdown('foo | bar');
+  assert.ok(!html.includes('<table'));
+  assert.equal(html, '<p>foo | bar</p>');
+});
+
 test('highlight escapes code content', () => {
   assert.equal(highlight('a < b', 'bash'), 'a &lt; b');
 });

package/harness/packages/server/test/server.test.js

@@ -43,6 +43,18 @@ test('serves health, providers and the console', async () => {
 
     const html = await (await fetch(`${base}/`)).text();
     assert.match(html, /Tamnora Console/);
+    for (const hook of [
+      'data-panel="agente"',
+      'data-panel="sesiones"',
+      'id="settings-controls-slot"',
+      'id="slash-menu"',
+      'id="statusbar"',
+      'id="sb-activity"',
+    ]) {
+      assert.ok(html.includes(hook), `falta ${hook}`);
+    }
+    // Los controles de agente se declaran una sola vez (se mueven entre slots).
+    assert.equal((html.match(/id="mode"/g) ?? []).length, 1);
 
     const missing = await fetch(`${base}/api/nope`);
     assert.equal(missing.status, 404);
@@ -264,7 +276,8 @@ test('done reports max_rounds and the tool count when the model never answers',
 test('completionFooter resume el cierre del turno', () => {
   assert.equal(completionFooter('end_turn', 1, 0, 0), '✓ terminado · 1 ronda');
   assert.equal(completionFooter('end_turn', 3, 5, 1200), '✓ terminado · 3 rondas · 5 herramientas · 1.2s');
-  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ máximo de rondas · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('max_rounds', 2, 2, 300), /^⚠ corte de seguridad · 2 rondas · 2 herramientas · 300ms$/);
+  assert.match(completionFooter('no_progress', 2, 2, 300), /^⚠ corte de seguridad/);
 });
 
 test('configures Telegram from the console (masked token)', async () => {
@@ -343,6 +356,69 @@ test('manages MCP servers from the console', async () => {
   }
 });
 
+test('MCP: el env se enmascara y no se pisa al guardar sin cambios', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: 'DB',
+        transport: 'stdio',
+        command: 'node',
+        args: ['db.mjs'],
+        env: { MYSQL_HOST: 'localhost', MYSQL_PASSWORD: 'supersecret' },
+      }),
+    });
+
+    let data = await (await fetch(`${base}/api/mcp`)).json();
+    const db = data.servers.find((s) => s.id === 'db');
+    assert.equal(db.env.MYSQL_HOST, 'localhost');
+    assert.equal(db.env.MYSQL_PASSWORD, '••••cret');
+
+    // Un toggle manda de vuelta el env enmascarado: no debe pisar el secreto.
+    await fetch(`${base}/api/mcp/servers/db`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({
+        name: db.name,
+        transport: 'stdio',
+        command: db.command,
+        args: db.args,
+        env: db.env,
+        enabled: false,
+      }),
+    });
+    const stored = instance.store.listMcpServers().find((s) => s.id === 'db');
+    assert.equal(stored.config.env.MYSQL_PASSWORD, 'supersecret');
+    assert.equal(stored.enabled, false);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('guarda los límites del agente desde Ajustes', async () => {
+  const { instance, base } = await startServer();
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const res = await fetch(`${base}/api/settings`, {
+      method: 'PUT',
+      headers: json,
+      body: JSON.stringify({ maxRounds: 20, maxTokens: 50000, maxDurationMs: 600000 }),
+    });
+    const data = await res.json();
+    assert.equal(data.settings.maxRounds, 20);
+    assert.equal(data.settings.maxTokens, 50000);
+    assert.equal(data.settings.maxDurationMs, 600000);
+
+    const again = await (await fetch(`${base}/api/settings`)).json();
+    assert.equal(again.settings.maxRounds, 20);
+  } finally {
+    await instance.close();
+  }
+});
+
 test('imports an MCP server from a JSON snippet', async () => {
   const { instance, base } = await startServer();
   const json = { 'Content-Type': 'application/json' };

package/harness/tamnora.example.json

@@ -2,7 +2,9 @@
   "provider": "openrouter",
   "model": "meta-llama/llama-3.3-8b-instruct:free",
   "instructions": ["AGENTS.md"],
-  "maxRounds": 8,
+  "maxRounds": 0,
+  "maxTokens": 0,
+  "maxDurationMs": 0,
   "tools": [],
   "permissions": {},
   "mcp": [
@@ -14,6 +16,20 @@
       "args": ["harness/scripts/mcp-echo-server.mjs"],
       "enabled": true
     },
+    {
+      "id": "database",
+      "name": "DB (ejemplo: credenciales por env, no por parametros)",
+      "type": "stdio",
+      "command": "node",
+      "args": ["ruta/al/servidor-mcp-db.mjs"],
+      "env": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "env:MYSQL_PASSWORD",
+        "MYSQL_DATABASE": "app"
+      },
+      "enabled": false
+    },
     {
       "id": "playwright",
       "name": "Playwright (navegador headless, para webs con JS)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",