@danieltmn/tamnora 0.8.0 → 0.9.1

package/harness/packages/server/src/routes/folders.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { mkdir } from 'node:fs/promises';
 import { readJson, sendJson, sendError } from '../lib/http.js';
-import { isLoopback, rootDirs, listSubdirs, resolveExistingDir } from '../lib/workspace.js';
+import { requireLocal, rootDirs, listSubdirs, resolveDirOr400 } from '../lib/workspace.js';
 
 const INVALID_NAME = /[\\/:*?"<>|]/;
 
@@ -12,8 +12,8 @@ function validFolderName(name) {
 
 export function registerFolders(route) {
   route('GET', '/api/folders', ({ req, res, query }) => {
-    if (!isLoopback(req.socket.localAddress)) {
-      return sendError(res, 403, 'El navegador de carpetas solo está disponible en conexiones locales.');
+    if (!requireLocal(req, res, 'El navegador de carpetas solo está disponible en conexiones locales.')) {
+      return;
     }
 
     const raw = String(query.get('path') ?? '').trim();
@@ -26,12 +26,8 @@ export function registerFolders(route) {
       });
     }
 
-    let dir;
-    try {
-      dir = resolveExistingDir(raw);
-    } catch (error) {
-      return sendError(res, 400, error.message);
-    }
+    const dir = resolveDirOr400(res, raw);
+    if (!dir) return;
 
     let dirs;
     try {
@@ -49,8 +45,8 @@ export function registerFolders(route) {
   });
 
   route('POST', '/api/folders', async ({ req, res }) => {
-    if (!isLoopback(req.socket.localAddress)) {
-      return sendError(res, 403, 'Crear carpetas solo está disponible en conexiones locales.');
+    if (!requireLocal(req, res, 'Crear carpetas solo está disponible en conexiones locales.')) {
+      return;
     }
     const body = await readJson(req);
     const name = String(body.name ?? '').trim();
@@ -61,12 +57,8 @@ export function registerFolders(route) {
     if (!String(body.parent ?? '').trim()) {
       return sendError(res, 400, 'Elegí la carpeta contenedora primero.');
     }
-    let parent;
-    try {
-      parent = resolveExistingDir(body.parent);
-    } catch (error) {
-      return sendError(res, 400, error.message);
-    }
+    const parent = resolveDirOr400(res, body.parent);
+    if (!parent) return;
 
     const target = path.join(parent, name);
     try {

package/harness/packages/server/src/routes/git.js

@@ -1,25 +1,17 @@
 import path from 'node:path';
 import { gitStatus, gitDiff } from '../lib/core.js';
 import { sendJson, sendError } from '../lib/http.js';
-import { isLoopback, resolveExistingDir } from '../lib/workspace.js';
-
-function isInside(root, target) {
-  const rel = path.relative(root, target);
-  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
-}
+import { isInside, localOk, requireLocal, resolveDirOr400 } from '../lib/workspace.js';
 
 export function registerGit(route, ctx) {
   const resolveRoot = (req, res, raw) => {
-    if (!isLoopback(req.socket.localAddress)) {
-      sendError(res, 403, 'El estado de git solo está disponible en conexiones locales.');
-      return null;
-    }
-    try {
-      return resolveExistingDir(raw || ctx.cwd);
-    } catch (error) {
-      sendError(res, 400, error.message);
+    if (!ctx.authEnabled && !requireLocal(req, res, 'El estado de git solo está disponible en conexiones locales.')) {
       return null;
     }
+    // Con auth (sesion ya validada) se permite por el tunel, pero el cwd
+    // pedido queda confinado al workspace salvo conexion local de verdad.
+    const root = resolveDirOr400(res, localOk(req) ? raw : null, ctx.cwd);
+    return root;
   };
 
   route('GET', '/api/git/status', async ({ req, res, query }) => {

package/harness/packages/server/src/routes/procs.js

@@ -1,6 +1,6 @@
 import { detectProcs, killPort } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
-import { isLoopback, resolveExistingDir } from '../lib/workspace.js';
+import { requireLocal, resolveDirOr400 } from '../lib/workspace.js';
 
 export function registerProcs(route, ctx) {
   route('GET', '/api/procs', ({ res }) => {
@@ -8,24 +8,19 @@ export function registerProcs(route, ctx) {
   });
 
   route('GET', '/api/procs/detect', ({ res, query }) => {
-    let dir;
-    try {
-      dir = resolveExistingDir(query.get('cwd') || ctx.cwd);
-    } catch (error) {
-      return sendError(res, 400, error.message);
-    }
+    const dir = resolveDirOr400(res, query.get('cwd'), ctx.cwd);
+    if (!dir) return;
     sendJson(res, 200, { cwd: dir, chips: detectProcs(dir) });
   });
 
   route('POST', '/api/procs/start', async ({ req, res }) => {
+    if (!ctx.authEnabled && !requireLocal(req, res, 'Iniciar procesos solo está disponible en conexiones locales.')) {
+      return;
+    }
     if (!ctx.procsEnabled) return sendError(res, 403, 'Los procesos están deshabilitados (processes.enabled = false).');
     const body = await readJson(req);
-    let dir;
-    try {
-      dir = resolveExistingDir(body.cwd || ctx.cwd);
-    } catch (error) {
-      return sendError(res, 400, error.message);
-    }
+    const dir = resolveDirOr400(res, body.cwd, ctx.cwd);
+    if (!dir) return;
     try {
       const proc = ctx.procs.start({ cwd: dir, command: body.command, args: body.args, port: body.port });
       sendJson(res, 201, { proc });
@@ -40,14 +35,17 @@ export function registerProcs(route, ctx) {
     sendJson(res, 200, data);
   });
 
-  route('POST', '/api/procs/:id/stop', ({ res, params }) => {
+  route('POST', '/api/procs/:id/stop', ({ req, res, params }) => {
+    if (!ctx.authEnabled && !requireLocal(req, res, 'Detener procesos solo está disponible en conexiones locales.')) {
+      return;
+    }
     if (!ctx.procs.stop(params.id)) return sendError(res, 404, 'Proceso no encontrado.');
     sendJson(res, 200, { ok: true });
   });
 
   route('POST', '/api/procs/kill', async ({ req, res }) => {
-    if (!isLoopback(req.socket.localAddress)) {
-      return sendError(res, 403, 'Matar procesos solo está disponible en conexiones locales.');
+    if (!requireLocal(req, res, 'Matar procesos solo está disponible en conexiones locales.')) {
+      return;
     }
     const body = await readJson(req);
     try {

package/harness/packages/server/src/routes/sessions.js

@@ -1,27 +1,16 @@
 import { runAgent } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
 import { workspaceForRequest } from '../lib/workspace.js';
-
-function view(session) {
-  return {
-    id: session.id,
-    title: session.title,
-    provider: session.provider,
-    model: session.model,
-    cwd: session.cwd,
-    goal: session.meta?.goal ?? null,
-    hasSummary: Boolean(session.meta?.summary),
-    createdAt: session.created_at,
-    updatedAt: session.updated_at,
-  };
-}
+import { sessionView, sessionState, awaitingBySession } from '../lib/sessionView.js';
 
 const COMPACT_INSTRUCTION =
   'Resumí la conversación en un texto conciso que preserve decisiones tomadas, archivos tocados, hallazgos y el estado actual, para poder continuar el trabajo sin el historial completo.';
 
 export function registerSessions(route, ctx) {
   route('GET', '/api/sessions', ({ res }) => {
-    sendJson(res, 200, { sessions: ctx.store.listSessions(50).map(view) });
+    const awaiting = awaitingBySession(ctx.approvals.list());
+    const sessions = ctx.store.listSessions(50).map((session) => sessionState(session, ctx, awaiting.get(session.id) ?? 0));
+    sendJson(res, 200, { sessions });
   });
 
   route('GET', '/api/search', ({ res, query }) => {
@@ -38,7 +27,7 @@ export function registerSessions(route, ctx) {
       return text.replace(/\s+/g, ' ').trim().slice(0, 200);
     };
     sendJson(res, 200, {
-      sessions: ctx.store.searchSessions(q, limit).map(view),
+      sessions: ctx.store.searchSessions(q, limit).map(sessionView),
       messages: ctx.store.searchMessages(q, limit).map((m) => ({
         id: m.id,
         sessionId: m.sessionId,
@@ -66,17 +55,21 @@ export function registerSessions(route, ctx) {
       cwd,
       meta,
     });
-    sendJson(res, 201, { session: view(ctx.store.getSession(id)) });
+    sendJson(res, 201, { session: sessionView(ctx.store.getSession(id)) });
   });
 
   route('GET', '/api/sessions/:id', ({ res, params }) => {
     const session = ctx.store.getSession(params.id);
     if (!session) return sendError(res, 404, 'Sesión no encontrada.');
     sendJson(res, 200, {
-      session: view(session),
+      session: sessionView(session),
       tokens: ctx.store.sessionTokens(params.id),
       messages: ctx.store.getMessages(params.id),
       running: ctx.runs?.isActive(params.id) ?? false,
+      // Un permiso pendiente NO se reconstruye desde los mensajes (no son
+      // mensajes), asi que va aparte: sin esto, recargar la pagina dejaba el run
+      // esperando una decision que no se podia tomar.
+      permissions: ctx.approvals.list({ sessionId: params.id }),
     });
   });
 
@@ -104,7 +97,7 @@ export function registerSessions(route, ctx) {
     if ('title' in body) patch.title = String(body.title || '').slice(0, 80) || session.title;
     if ('goal' in body) patch.meta = { goal: body.goal ? String(body.goal) : undefined };
     ctx.store.touchSession(params.id, patch);
-    sendJson(res, 200, { session: view(ctx.store.getSession(params.id)) });
+    sendJson(res, 200, { session: sessionView(ctx.store.getSession(params.id)) });
   });
 
   route('DELETE', '/api/sessions/:id/messages', ({ res, params }) => {

package/harness/packages/server/src/routes/shell.js

@@ -1,21 +1,17 @@
 import { createTools } from '../lib/core.js';
 import { readJson, sendJson, sendError } from '../lib/http.js';
-import { isLoopback, resolveExistingDir } from '../lib/workspace.js';
+import { requireLocal, resolveDirOr400 } from '../lib/workspace.js';
 
 export function registerShell(route, ctx) {
   route('POST', '/api/shell', async ({ req, res }) => {
-    if (!isLoopback(req.socket.localAddress)) {
-      return sendError(res, 403, 'El shell solo está disponible en conexiones locales.');
+    if (!requireLocal(req, res, 'El shell solo está disponible en conexiones locales.')) {
+      return;
     }
     const body = await readJson(req);
     const command = String(body.command ?? '').trim();
     if (!command) return sendError(res, 400, 'Falta "command".');
-    let root;
-    try {
-      root = resolveExistingDir(body.cwd || ctx.cwd);
-    } catch (error) {
-      return sendError(res, 400, error.message);
-    }
+    const root = resolveDirOr400(res, body.cwd, ctx.cwd);
+    if (!root) return;
     const tools = createTools({ root, enabled: ['bash'], yes: true });
     const output = await tools.execute('bash', { command });
     sendJson(res, 200, { command, cwd: root, output: String(output ?? '') });

package/harness/packages/server/src/routes/state.js

@@ -0,0 +1,32 @@
+import { sendJson } from '../lib/http.js';
+import { sessionState, awaitingBySession } from '../lib/sessionView.js';
+
+/**
+ * Snapshot de todo lo que el cliente necesita para reconciliar, en un solo
+ * request.
+ *
+ * Este endpoint es la **verdad**: los streams SSE son un atajo de latencia que
+ * se cae en cualquier enlace movil (y que iOS corta cuando manda la pestana a
+ * background). Por eso no lleva mensajes ni tool results — solo liveness, que es
+ * chico y se puede pedir seguido. El detalle de una sesion sigue bajo demanda
+ * en `/api/sessions/:id`.
+ */
+export function registerState(route, ctx) {
+  route('GET', '/api/state', ({ res }) => {
+    const permissions = ctx.approvals.list();
+    const awaiting = awaitingBySession(permissions);
+    const sessions = ctx.store.listSessions(50).map((session) => sessionState(session, ctx, awaiting.get(session.id) ?? 0));
+    sendJson(res, 200, {
+      sessions,
+      permissions: permissions.map(({ askId, sessionId, name, args, requestedAt }) => ({
+        askId,
+        sessionId,
+        name,
+        args,
+        requestedAt,
+      })),
+      // Para que el cliente pueda detectar que el server va en otro reloj.
+      now: Date.now(),
+    });
+  });
+}

package/harness/packages/server/src/routes/tts.js

@@ -0,0 +1,82 @@
+// Voz (TTS): sintesis bajo demanda de la consola + ajustes persistidos en
+// app.json (la casa). La config no necesita recarga: cada consumidor la lee
+// cuando va a hablar.
+
+import { sintetizar, listarVoces, MAX_TEXTO } from '../lib/core.js';
+import { readApp, writeApp } from '../lib/core.js';
+import { ffmpegDisponible } from '../lib/ffmpeg.js';
+import { resolveTts, sanearVoz, sanearRate } from '../lib/ttsSettings.js';
+import { sendJson, sendError, readJson } from '../lib/http.js';
+
+const cacheVoces = { at: 0, data: null, filtro: 'es-' };
+
+async function catalogoVoces(filtro) {
+  const now = Date.now();
+  if (cacheVoces.data && cacheVoces.filtro === filtro && now - cacheVoces.at < 600000) {
+    return cacheVoces.data;
+  }
+  const voces = await listarVoces(filtro);
+  cacheVoces.at = now;
+  cacheVoces.data = voces;
+  cacheVoces.filtro = filtro;
+  return voces;
+}
+
+export function registerTts(route, ctx) {
+  route('GET', '/api/tts/settings', async ({ res }) => {
+    const config = resolveTts(ctx.app);
+    sendJson(res, 200, { ...config, ffmpeg: await ffmpegDisponible() });
+  });
+
+  route('PUT', '/api/tts/settings', async ({ req, res }) => {
+    const body = await readJson(req);
+    const app = readApp();
+    const actual = resolveTts(ctx.app);
+    const next = { ...actual };
+
+    if ('enabled' in body) next.enabled = body.enabled === true;
+    if ('voice' in body) next.voice = sanearVoz(body.voice, actual.voice);
+    if ('rate' in body) next.rate = sanearRate(body.rate, actual.rate);
+    if (body.announce && typeof body.announce === 'object') {
+      const announce = { ...actual.announce };
+      for (const key of ['start', 'tools', 'end']) {
+        if (key in body.announce) announce[key] = body.announce[key] === true;
+      }
+      next.announce = announce;
+    }
+
+    app.tts = next;
+    writeApp(app);
+    ctx.app = app;
+    sendJson(res, 200, { ...next, ffmpeg: await ffmpegDisponible() });
+  });
+
+  route('GET', '/api/tts/voices', async ({ res, query }) => {
+    const filtro = /^[a-zA-Z]{2}-?$/.test(String(query.get('filter') ?? 'es-')) ? query.get('filter') : 'es-';
+    try {
+      const voces = await catalogoVoces(filtro);
+      sendJson(res, 200, { voices: voces });
+    } catch (error) {
+      sendError(res, 502, `No pude listar las voces: ${error?.message ?? error}`);
+    }
+  });
+
+  route('GET', '/api/tts', async ({ res, query }) => {
+    const config = resolveTts(ctx.app);
+    const texto = String(query.get('texto') ?? '').trim().slice(0, MAX_TEXTO);
+    if (!texto) return sendError(res, 400, 'Falta "texto".');
+    const voz = sanearVoz(query.get('voice'), config.voice);
+    const rate = sanearRate(query.get('rate'), config.rate);
+    try {
+      const mp3 = await sintetizar(texto, { voice: voz, rate });
+      res.writeHead(200, {
+        'Content-Type': 'audio/mpeg',
+        'Content-Length': mp3.length,
+        'Cache-Control': 'no-store',
+      });
+      res.end(mp3);
+    } catch (error) {
+      sendError(res, 502, `No pude sintetizar: ${error?.message ?? error}`);
+    }
+  });
+}

package/harness/packages/server/src/server.js

@@ -34,10 +34,13 @@ import { registerProviders } from './routes/providers.js';
 import { registerMcp } from './routes/mcp.js';
 import { registerSkills } from './routes/skills.js';
 import { registerChannels } from './routes/channels.js';
+import { registerTts } from './routes/tts.js';
 import { registerProcs } from './routes/procs.js';
 import { registerShell } from './routes/shell.js';
 import { registerPreview } from './routes/preview.js';
 import { registerChat } from './routes/chat.js';
+import { registerEvents } from './routes/events.js';
+import { registerState } from './routes/state.js';
 import { registerEval } from './routes/eval.js';
 
 const VERSION = readPackageVersion();
@@ -220,10 +223,13 @@ export async function createTamnoraServer({
   registerMcp(route, ctx);
   registerSkills(route, ctx);
   registerChannels(route, ctx);
+  registerTts(route, ctx);
   registerProcs(route, ctx);
   registerShell(route, ctx);
   const preview = registerPreview(route, ctx);
   registerChat(route, ctx);
+  registerEvents(route, ctx);
+  registerState(route, ctx);
   registerEval(route, ctx);
 
   function matchRoute(method, pathname) {
@@ -247,6 +253,10 @@ export async function createTamnoraServer({
 
   const serveStatic = createStaticHandler(staticDir ?? DEFAULT_PUBLIC_DIR);
 
+  // Los SSE (turno, stream de sesion, canal global) son conexiones que no
+  // terminan solas: sin registrarlas, `server.close()` espera indefinidamente y
+  // `tamnora server --stop` queda colgado.
+  const sockets = new Set();
   const server = http.createServer(async (req, res) => {
     const url = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
 
@@ -286,6 +296,11 @@ export async function createTamnoraServer({
     }
   });
 
+  server.on('connection', (socket) => {
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+  });
+
   const listen = (options = {}) =>
     new Promise((resolve, reject) => {
       server.once('error', reject);
@@ -315,12 +330,17 @@ export async function createTamnoraServer({
     } catch {
       // ignore MCP shutdown errors
     }
+    // Cortar las conexiones abiertas ANTES de esperar al server, y la base
+    // DESPUES: un run abortado termina en otro tick y emite `aborted`.
+    for (const socket of sockets) socket.destroy();
+    sockets.clear();
+    await new Promise((resolve) => server.close(() => resolve()));
+    await new Promise((resolve) => setTimeout(resolve, 50));
     try {
       store.close();
     } catch {
       // already closed
     }
-    await new Promise((resolve) => server.close(() => resolve()));
   };
 
   return { server, config, store, ctx, listen, close, staticDir: staticDir ?? DEFAULT_PUBLIC_DIR };

package/harness/packages/server/test/announcer.test.js

@@ -0,0 +1,51 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { fraseTool, fraseInicio, fraseFin, fraseError, createFiltroTools } from '../src/lib/announcer.js';
+
+test('fraseTool arma verbos con el resumen de la tool', () => {
+  assert.equal(fraseTool('read', 'src/app.js'), 'Leyendo src/app.js');
+  assert.equal(fraseTool('write', 'a/b.txt'), 'Escribiendo a/b.txt');
+  assert.equal(fraseTool('bash', 'npm test'), 'Ejecutando npm test');
+  assert.equal(fraseTool('grep', '"foo" *.js'), 'Buscando "foo" *.js');
+});
+
+test('fraseTool sin resumen, tools mudas y MCP', () => {
+  assert.equal(fraseTool('read', ''), 'Leyendo');
+  assert.equal(fraseTool('desconocida', 'x'), '');
+  assert.equal(fraseTool('git_status', ''), 'Mirando el estado de git');
+  assert.equal(fraseTool('git_commit', 'feat: algo'), 'Commiteando: feat: algo');
+  assert.equal(fraseTool('mcp__db__query', 'x'), 'Usando una herramienta de db');
+});
+
+test('fraseTool recorta frases largas sin cortar palabras', () => {
+  const frase = fraseTool('bash', 'x'.repeat(400));
+  assert.ok(frase.length <= 200, frase.length);
+  assert.ok(frase.endsWith('…'));
+});
+
+test('fraseFin resume el cierre del turno', () => {
+  assert.equal(fraseFin({ stopReason: 'aborted' }), 'Cancelado.');
+  assert.match(fraseFin({ stopReason: 'end_turn', rounds: 3, toolCalls: 5, durationMs: 12000 }), /^Listo\. 3 rondas, 5 herramientas, 12 segundos\.$/);
+  assert.equal(fraseFin({ stopReason: 'end_turn', rounds: 1, toolCalls: 0, durationMs: 500 }), 'Listo. Respondí sin usar herramientas.');
+  assert.match(
+    fraseFin({ stopReason: 'max_rounds', rounds: 8, toolCalls: 12, durationMs: 60000 }),
+    /corte de seguridad tras 8 rondas, 60 segundos/
+  );
+  assert.match(fraseInicio(), /Empecé/);
+  assert.match(fraseError(), /error/);
+});
+
+test('createFiltroTools deduplica y aplica la ventana entre frases', () => {
+  const filtro = createFiltroTools({ minGapMs: 60000 });
+  assert.equal(filtro('read', 'a.js'), 'Leyendo a.js');
+  assert.equal(filtro('read', 'b.js'), '');
+  assert.equal(filtro('write', 'b.js'), '');
+  const ahora = Date.now();
+  const original = Date.now;
+  Date.now = () => ahora + 61000;
+  try {
+    assert.equal(filtro('write', 'b.js'), 'Escribiendo b.js');
+  } finally {
+    Date.now = original;
+  }
+});

package/harness/packages/server/test/reconcile.test.js

@@ -0,0 +1,146 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { diffState, pollDelayMs, localState, summarizeArgs, humanSize } from '../public/reconcile.js';
+
+const pane = (over = {}) => ({ working: false, attached: false, ...over });
+const ask = (over = {}) => ({ askId: 'a1', sessionId: 's1', name: 'bash', args: {}, requestedAt: 1, ...over });
+
+test('engancha una sesion abierta que esta trabajando sin stream propio', () => {
+  const diff = diffState({ panes: [{ id: 's1', working: false, attached: false }], asks: [] }, {
+    sessions: [{ id: 's1', running: true, awaiting: 0 }],
+    permissions: [],
+  });
+  assert.deepEqual(diff.toAttach, ['s1']);
+});
+
+test('engancha aunque no haya run si hay un permiso pendiente', () => {
+  // El permiso no se reconstruye desde los mensajes: vive en /api/state.
+  const diff = diffState({ panes: [{ id: 's1', working: false, attached: false }], asks: [] }, {
+    sessions: [{ id: 's1', running: false, awaiting: 1 }],
+    permissions: [ask()],
+  });
+  assert.deepEqual(diff.toAttach, ['s1']);
+});
+
+test('desengancha una sesion que figuraba activa y ya no', () => {
+  const diff = diffState({ panes: [{ id: 's1', working: true, attached: true }], asks: [] }, {
+    sessions: [{ id: 's1', running: false, awaiting: 0 }],
+    permissions: [],
+  });
+  assert.deepEqual(diff.toDetach, ['s1']);
+});
+
+test('no toca una sesion que ya esta enganchada', () => {
+  const diff = diffState({ panes: [{ id: 's1', working: true, attached: true }], asks: [] }, {
+    sessions: [{ id: 's1', running: true, awaiting: 0 }],
+    permissions: [],
+  });
+  assert.deepEqual(diff.toAttach, []);
+  assert.deepEqual(diff.toDetach, []);
+});
+
+test('detecta permisos nuevos y resueltos', () => {
+  const diff = diffState({ panes: [], asks: ['a1', 'a2'] }, {
+    sessions: [],
+    permissions: [ask({ askId: 'a1' }), ask({ askId: 'a3' })],
+  });
+  assert.deepEqual(diff.newAsks.map((a) => a.askId), ['a3']);
+  assert.deepEqual(diff.resolvedAsks, ['a2']);
+});
+
+test('un permiso repetido no vuelve a notificarse', () => {
+  const state = { panes: [], asks: [] };
+  const remote = { sessions: [], permissions: [ask()] };
+  const first = diffState(state, remote);
+  assert.equal(first.newAsks.length, 1);
+  const second = diffState({ panes: [], asks: ['a1'] }, remote);
+  assert.equal(second.newAsks.length, 0);
+});
+
+test('noPropone ninguna accion cuando nada cambio', () => {
+  // Esto importa: un re-render por nada borra la tarjeta de permiso.
+  const local = { panes: [{ id: 's1', working: true, attached: true }], asks: ['a1'] };
+  const remote = { sessions: [{ id: 's1', running: true, awaiting: 1 }], permissions: [ask()] };
+  const diff = diffState(local, remote);
+  assert.deepEqual(diff.toAttach, []);
+  assert.deepEqual(diff.toDetach, []);
+  assert.deepEqual(diff.gone, []);
+  assert.deepEqual(diff.newAsks, []);
+  assert.deepEqual(diff.resolvedAsks, []);
+});
+
+test('avisa las sesiones que el server ya no conoce', () => {
+  const diff = diffState({ panes: [{ id: 'borrada', working: false, attached: false }], asks: [] }, {
+    sessions: [{ id: 's1', running: false, awaiting: 0 }],
+    permissions: [],
+  });
+  assert.deepEqual(diff.gone, ['borrada']);
+});
+
+test('ignora las sesiones que el usuario no tiene abiertas', () => {
+  const diff = diffState({ panes: [], asks: [] }, {
+    sessions: [{ id: 's1', running: true, awaiting: 0 }],
+    permissions: [],
+  });
+  assert.deepEqual(diff.toAttach, []);
+  assert.deepEqual(diff.remoteActive, ['s1']);
+});
+
+test('la cadencia se apura cuando algo espera tu decision', () => {
+  const idle = { sessions: [{ running: false, awaiting: 0 }], permissions: [] };
+  const running = { sessions: [{ running: true, awaiting: 0 }], permissions: [] };
+  const waiting = { sessions: [{ running: false, awaiting: 1 }], permissions: [ask()] };
+  assert.equal(pollDelayMs(idle), 25000);
+  assert.equal(pollDelayMs(running), 10000);
+  assert.equal(pollDelayMs(waiting), 5000);
+});
+
+test('localState aplana los Map del cliente', () => {
+  const flat = localState({ panes: new Map([['s1', pane({ working: true, attached: true })]]), asks: new Set(['a1']) });
+  assert.deepEqual(flat, { panes: [{ id: 's1', working: true, attached: true }], asks: ['a1'] });
+});
+
+test('tolera un remoto vacio o corrupto sin romper', () => {
+  const diff = diffState({ panes: [{ id: 's1', working: false, attached: false }], asks: [] }, {});
+  assert.deepEqual(diff.toAttach, []);
+  assert.deepEqual(diff.pending, []);
+});
+
+test('el resumen de un permiso muestra el comando, no el JSON', () => {
+  const command = 'powershell -NoProfile -Command "Get-ChildItem -Recurse"';
+  assert.equal(summarizeArgs('bash', { command }), command);
+});
+
+test('el resumen de write muestra ruta y tamano, no el archivo entero', () => {
+  // Esto era medio archivo en pantalla con los \n escapados a la vista.
+  const summary = summarizeArgs('write', { path: 'AGENTS.md', content: 'x'.repeat(1840) });
+  assert.equal(summary, 'AGENTS.md · 1.8 kB');
+  assert.ok(!summary.includes('\\n'));
+  assert.ok(summary.length < 60);
+});
+
+test('el resumen de read y fetch_url muestra la ruta y la url', () => {
+  assert.equal(summarizeArgs('read', { path: 'src/app.js' }), 'src/app.js');
+  assert.equal(summarizeArgs('fetch_url', { url: 'https://x.dev/a' }), 'https://x.dev/a');
+});
+
+test('el resumen de task usa la descripcion', () => {
+  assert.equal(summarizeArgs('task', { description: 'auditar el repo', prompt: 'busca TODOs' }), 'auditar el repo');
+});
+
+test('una tool desconocida cae a JSON en una sola linea', () => {
+  const summary = summarizeArgs('git_diff', { path: 'a.js', staged: false, note: 'uno\ndos' });
+  assert.ok(!summary.includes('\\n'), 'no debe mostrar saltos escapados');
+  assert.match(summary, /git_diff|a\.js/);
+});
+
+test('sin argumentos el resumen queda vacio', () => {
+  assert.equal(summarizeArgs('git_status', {}), '');
+  assert.equal(summarizeArgs('git_status', null), '');
+});
+
+test('humanSize usa la unidad que corresponde', () => {
+  assert.equal(humanSize('hola'), '4 B');
+  assert.equal(humanSize('x'.repeat(2048)), '2.0 kB');
+  assert.equal(humanSize('x'.repeat(3 * 1024 * 1024)), '3.0 MB');
+});