@danieltmn/tamnora 0.21.1 → 0.22.0

package/harness/packages/core/src/tools/index.js

@@ -4,7 +4,7 @@ import { MCP_ROUTER_NAME, planMcpTools } from './mcp.js';
 export { createToolRegistry } from './registry.js';
 export { TOOL_DEFINITIONS, TOOL_NAMES } from './schema.js';
 export { DEFAULT_PERMISSIONS, evaluatePermission, bashGuard } from './permissions.js';
-export { resolveInRoot, toRel } from './paths.js';
+export { resolveInRoot, toRel, realpathDeep } from './paths.js';
 export { globToRegExp, walkFiles, DEFAULT_IGNORES } from './glob.js';
 export { MCP_ROUTER_NAME, MCP_AUTO_THRESHOLD, useLazyMcp, buildMcpIndex, mcpRouterDefinition, planMcpTools } from './mcp.js';
 export * as executors from './executors.js';

package/harness/packages/core/src/tools/paths.js

@@ -1,9 +1,36 @@
+import fs from 'node:fs';
 import path from 'node:path';
 
+/**
+ * realpath del segmento existente más profundo, más el resto del camino (que
+ * todavía no existe): `a/b/c` con `a/b` real devuelve `<real(a/b)>/c`.
+ */
+export function realpathDeep(target) {
+  let current = target;
+  const rest = [];
+  for (;;) {
+    try {
+      const real = fs.realpathSync(current);
+      return rest.length ? path.join(real, ...rest.reverse()) : real;
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return target;
+      rest.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+function escapes(base, target) {
+  const rel = path.relative(base, target);
+  return rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+}
+
 /**
  * Resolve a user-supplied path against the workspace root, refusing to escape
- * it. This is a lexical guard: `..`, absolute paths outside the root and
- * drive changes are rejected.
+ * it. Two guards: a lexical one (`..`, absolute paths outside the root, drive
+ * changes) and a real one over `fs.realpath`, because a symlink inside the
+ * workspace can point anywhere and the lexical check cannot see it.
  *
  * @param {string} root - absolute workspace root
  * @param {string} input - relative (or absolute-inside-root) path
@@ -14,11 +41,14 @@ export function resolveInRoot(root, input) {
   const raw = String(input ?? '.').trim() || '.';
   const target = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(base, raw);
 
-  const rel = path.relative(base, target);
-  const escapes = rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
-  if (escapes) {
+  if (escapes(base, target)) {
     throw new Error(`Ruta fuera del workspace: "${input}"`);
   }
+  const realBase = realpathDeep(base);
+  const realTarget = realpathDeep(target);
+  if (escapes(realBase, realTarget)) {
+    throw new Error(`Ruta fuera del workspace (symlink): "${input}"`);
+  }
   return target;
 }
 

package/harness/packages/core/src/tools/permissions.js

@@ -58,7 +58,6 @@ function subjectFor(name, args) {
 // `ask` = nunca se autoaprueba (siempre consulta, aunque bash sea `allow`).
 const BASH_DENY = [
   /:\s*\(\s*\)\s*\{[\s\S]*\}\s*;?\s*:/, // fork bomb :(){ :|:& };:
-  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\/|~|\$HOME|\/\*)(\s|$)/i,
   /\bmkfs(\.|\s|$)/i,
   /\bdd\b[^\n]*\bof=\/dev\//i,
   />\s*\/dev\/(sd|nvme|disk)/i,
@@ -67,18 +66,58 @@ const BASH_DENY = [
   /\b(?:remove-item|del|rd|rmdir|format)\b[^\n]*(?:-recurse|-r\b)[^\n]*\b[a-z]:\\?\s*$/i,
 ];
 const BASH_ASK = [
-  /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)(\s+--?[\w-]+)*\s+(\*|\.|\.\/)(\s|$)/i, // rm -rf * | . (workspace)
   /\bgit\s+push\b[^\n]*(\s-f\b|\s--force\b)/i,
   /\bgit\s+reset\s+--hard\b/i,
   /\bgit\s+clean\s+-[a-z]*f/i,
 ];
 
+// `rm` con flags peligrosos: se parsean los tokens en vez de mirar la grafia,
+// porque `rm --recursive --force /`, `rm -r -f /` y `rm -rf /` son lo mismo y
+// las regex de un solo cluster de flags solo cazaban la ultima.
+const RM_DEADLY_TARGETS = /^(\/|\/\*|\/\.\.|~|\$HOME|\$\{HOME\}|[a-z]:\\?(\*)?)$/i;
+const RM_WORKSPACE_TARGETS = /^(\*|\.{1,2}|\.\/?)$/i;
+
+/** Invocaciones de `rm` del comando: flags normalizados + primer argumento. */
+function rmInvocations(command) {
+  const out = [];
+  for (const segment of String(command).split(/[;&|\n]/)) {
+    const m = /(?:^|\s)(?:sudo\s+)?rm\s+(.*)$/i.exec(segment);
+    if (!m) continue;
+    let recursive = false;
+    let force = false;
+    let target = '';
+    for (const token of m[1].trim().split(/\s+/).filter(Boolean)) {
+      if (token === '--') continue;
+      if (token.startsWith('--')) {
+        if (/^--(recursive|no-preserve-root)$/i.test(token)) recursive = true;
+        if (/^--force$/i.test(token)) force = true;
+        continue;
+      }
+      if (token.startsWith('-')) {
+        const letters = token.slice(1);
+        if (/[rR]/.test(letters)) recursive = true;
+        if (/f/.test(letters)) force = true;
+        continue;
+      }
+      target = token.replace(/^["']|["']$/g, '');
+      break;
+    }
+    out.push({ recursive, force, target });
+  }
+  return out;
+}
+
 /** Devuelve `'deny'`/`'ask'` si el comando es peligroso, o `null`. */
 export function bashGuard(command) {
   const text = String(command ?? '');
   if (!text.trim()) return null;
   for (const re of BASH_DENY) if (re.test(text)) return 'deny';
   for (const re of BASH_ASK) if (re.test(text)) return 'ask';
+  for (const rm of rmInvocations(text)) {
+    if (!rm.recursive) continue;
+    if (RM_DEADLY_TARGETS.test(rm.target)) return 'deny';
+    if (rm.force && RM_WORKSPACE_TARGETS.test(rm.target)) return 'ask';
+  }
   return null;
 }
 

package/harness/packages/core/src/tools/registry.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { TOOL_DEFINITIONS, TOOL_NAMES } from './schema.js';
 import { EXECUTORS } from './executors.js';
-import { evaluatePermission } from './permissions.js';
+import { evaluatePermission, bashGuard } from './permissions.js';
 
 const WRITE_TOOLS = new Set(['write', 'edit']);
 
@@ -24,7 +24,9 @@ function extensionOf(p) {
  * @param {AbortSignal} [opts.signal] - cancela las tools de larga duracion (bash, git)
  */
 export function createToolRegistry({ root, enabled, permissions = {}, onAsk, onQuestion, yes = false, signal, writeExtensions } = {}) {
-  const names = new Set(enabled?.length ? enabled : TOOL_NAMES);
+  // `enabled` undefined = todas; una lista se respeta tal cual (vacía = ninguna,
+  // no "todas": un modo restringido no puede quedar sin tools por un filtro).
+  const names = new Set(Array.isArray(enabled) ? enabled : TOOL_NAMES);
   const definitions = TOOL_DEFINITIONS.filter((d) => names.has(d.function.name));
   const allowedWrite = Array.isArray(writeExtensions) && writeExtensions.length
     ? new Set(writeExtensions.map((ext) => String(ext).toLowerCase()))
@@ -38,8 +40,11 @@ export function createToolRegistry({ root, enabled, permissions = {}, onAsk, onQ
     if (!writeAllowed(name, args)) return 'deny';
     let decision = evaluatePermission(name, args, permissions);
     if (decision === 'ask') {
+      // Un `ask` del piso de seguridad (bashGuard) nunca se autoaprueba con
+      // `yes`: sin UI que pregunte (onAsk) queda denegado.
+      const guarded = name === 'bash' && bashGuard(args?.command) === 'ask';
       if (onAsk) decision = (await onAsk(name, args)) ? 'allow' : 'deny';
-      else decision = yes ? 'allow' : 'deny';
+      else decision = !guarded && yes ? 'allow' : 'deny';
     }
     return decision;
   }

package/harness/packages/core/src/tunnel.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { bridgeStatePath } from './config/home.js';
 import { pidAlive, killPidTree } from './pid.js';
 
@@ -18,9 +18,10 @@ function killTree(child) {
  * Estado del bridge (escrito por `tamnora bridge`), si el supervisor sigue
  * vivo. Lo consulta el server para saber que hay un tunel publico activo y
  * ajustar el modelo de confianza (guards locales, cookie Secure).
- * Cache de 1 s: se lee en cada request sensible y el pid no cambia tan rapido.
+ * Cache de 1 s + invalidacion por mtime del archivo: se lee en cada request
+ * sensible, pero un bridge.json nuevo (o borrado) se ve al instante.
  */
-let tunnelCache = { key: null, at: 0, state: null };
+let tunnelCache = { key: null, mtime: null, at: 0, state: null };
 export function tunnelState() {
   let statePath;
   try {
@@ -29,7 +30,16 @@ export function tunnelState() {
     return null;
   }
   const now = Date.now();
-  if (tunnelCache.key === statePath && now - tunnelCache.at < 1000) return tunnelCache.state;
+  let mtime = null;
+  try {
+    mtime = statSync(statePath).mtimeMs;
+  } catch {
+    tunnelCache = { key: statePath, mtime: null, at: now, state: null };
+    return null;
+  }
+  if (tunnelCache.key === statePath && tunnelCache.mtime === mtime && now - tunnelCache.at < 1000) {
+    return tunnelCache.state;
+  }
   let state = null;
   try {
     const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
@@ -39,7 +49,7 @@ export function tunnelState() {
   } catch {
     /* sin bridge */
   }
-  tunnelCache = { key: statePath, at: now, state };
+  tunnelCache = { key: statePath, mtime, at: now, state };
   return state;
 }
 

package/harness/packages/core/test/hooks.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { normalizeHookModule, loadHooks } from '../src/hooks/index.js';
+import { normalizeHookModule, loadHooks, DEFAULT_HOOK_PATTERNS } from '../src/hooks/index.js';
 
 test('normalizeHookModule acepta objeto events, funcion y onEvent', () => {
   const byEvents = normalizeHookModule({ default: { name: 'a', events: { 'run.end': () => {} } } }, 'x');
@@ -14,7 +14,7 @@ test('normalizeHookModule acepta objeto events, funcion y onEvent', () => {
   assert.equal(normalizeHookModule({ default: {} }, 'n'), null);
 });
 
-test('loadHooks carga .tamnora/hooks/*.mjs e ignora lo roto', async () => {
+test('loadHooks no ejecuta nada por presencia: exige un patron explicito', async () => {
   const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-hooks-'));
   await mkdir(path.join(cwd, '.tamnora', 'hooks'), { recursive: true });
   await writeFile(
@@ -22,7 +22,10 @@ test('loadHooks carga .tamnora/hooks/*.mjs e ignora lo roto', async () => {
     "export default { name: 'demo', events: { 'run.end': () => {} } };\n"
   );
   await writeFile(path.join(cwd, '.tamnora', 'hooks', 'roto.mjs'), 'this is not valid javascript {{{\n');
-  const hooks = await loadHooks(cwd, []);
+
+  assert.deepEqual(await loadHooks(cwd, []), [], 'sin patrones no se importa nada');
+
+  const hooks = await loadHooks(cwd, DEFAULT_HOOK_PATTERNS);
   assert.equal(hooks.length, 1);
   assert.equal(hooks[0].id, 'demo');
   assert.deepEqual(Object.keys(hooks[0].events), ['run.end']);

package/harness/packages/core/test/hosts.test.js

@@ -0,0 +1,50 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { checkHttpUrl, isBlockedAddress, isBlockedHost } from '../src/net/hosts.js';
+
+test('isBlockedHost bloquea loopback, redes privadas y sufijos internos', () => {
+  for (const host of [
+    'localhost',
+    'foo.localhost',
+    'app.local',
+    'intranet',
+    'metadata.internal',
+    '127.0.0.1',
+    '10.1.2.3',
+    '172.16.0.1',
+    '192.168.1.10',
+    '169.254.169.254',
+    '100.64.0.1',
+    '0.0.0.0',
+    '224.0.0.1',
+  ]) {
+    assert.equal(isBlockedHost(host), true, `deberia bloquear ${host}`);
+  }
+  for (const host of ['example.com', 'api.openai.com', '8.8.8.8', '2606:4700:4700::1111']) {
+    assert.equal(isBlockedHost(host), false, `no deberia bloquear ${host}`);
+  }
+});
+
+test('isBlockedHost cubre IPv6-mapped y rangos IPv6 internos', () => {
+  for (const host of ['[::1]', '::1', '[::ffff:127.0.0.1]', '[::ffff:7f00:1]', '[fd00::1]', '[fe80::1]', '[::]']) {
+    assert.equal(isBlockedHost(host), true, `deberia bloquear ${host}`);
+  }
+  assert.equal(isBlockedHost('[2001:db8::1]'), false);
+});
+
+test('isBlockedAddress valida el rango de una IP', () => {
+  assert.equal(isBlockedAddress('127.0.0.1'), true);
+  assert.equal(isBlockedAddress('::ffff:10.0.0.1'), true);
+  assert.equal(isBlockedAddress('100.64.1.1'), true);
+  assert.equal(isBlockedAddress('8.8.4.4'), false);
+  assert.equal(isBlockedAddress('nope'), true);
+});
+
+test('checkHttpUrl valida protocolo y host', () => {
+  assert.match(checkHttpUrl('').error, /falta "url"/);
+  assert.match(checkHttpUrl('nope').error, /URL inválida/);
+  assert.match(checkHttpUrl('ftp://example.com').error, /http\(s\)/);
+  assert.match(checkHttpUrl('http://127.0.0.1:4517/').error, /host bloqueado/);
+  assert.match(checkHttpUrl('http://[::ffff:127.0.0.1]/').error, /host bloqueado/);
+  assert.equal(checkHttpUrl('https://example.com/x').url, 'https://example.com/x');
+});

package/harness/packages/core/test/plugins.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { normalizePlugin, loadPlugins } from '../src/plugins/index.js';
+import { normalizePlugin, loadPlugins, DEFAULT_PLUGIN_PATTERNS } from '../src/plugins/index.js';
 
 test('normalizePlugin filtra tools invalidas', () => {
   const plugin = normalizePlugin({ default: { name: 'demo', tools: [{ name: 'x', handler: () => {} }, { name: 'bad' }] } }, 'z');
@@ -12,14 +12,16 @@ test('normalizePlugin filtra tools invalidas', () => {
   assert.equal(normalizePlugin({ default: {} }, 'n'), null);
 });
 
-test('loadPlugins carga .tamnora/plugins/*.mjs', async () => {
+test('loadPlugins exige un patron explicito (no ejecuta por presencia)', async () => {
   const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-plugins-'));
   await mkdir(path.join(cwd, '.tamnora', 'plugins'), { recursive: true });
   await writeFile(
     path.join(cwd, '.tamnora', 'plugins', 'demo.mjs'),
     "export default { name: 'demo', tools: [{ name: 'saludar', handler: () => 'hi' }] };\n"
   );
-  const plugins = await loadPlugins(cwd, []);
+  assert.deepEqual(await loadPlugins(cwd, []), []);
+
+  const plugins = await loadPlugins(cwd, DEFAULT_PLUGIN_PATTERNS);
   assert.equal(plugins.length, 1);
   assert.equal(plugins[0].tools[0].name, 'saludar');
 });

package/harness/packages/core/test/tools.test.js

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { mkdtemp, readFile, writeFile, mkdir, symlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { resolveInRoot, toRel } from '../src/tools/paths.js';
@@ -8,6 +8,7 @@ import { evaluatePermission, bashGuard } from '../src/tools/permissions.js';
 import { createTools, createToolRegistry } from '../src/tools/index.js';
 import {
   fetchUrlTool,
+  gitDiffTool,
   previewUrlTool,
   screenshotTool,
   consoleTool,
@@ -61,6 +62,48 @@ test('bashGuard marca comandos peligrosos (piso de seguridad)', () => {
   assert.equal(evaluatePermission('bash', { command: 'rm -rf ./dist' }, { bash: 'allow' }), 'allow');
 });
 
+test('bashGuard tolera grafías alternativas de flags en rm', () => {
+  assert.equal(bashGuard('rm --recursive --force /'), 'deny');
+  assert.equal(bashGuard('rm -r -f /'), 'deny');
+  assert.equal(bashGuard('rm -fr /'), 'deny');
+  assert.equal(bashGuard('rm -r -f ~'), 'deny');
+  assert.equal(bashGuard('rm --recursive --force *'), 'ask');
+  assert.equal(bashGuard('rm -r -f .'), 'ask');
+  assert.equal(bashGuard('rm -rf ./build'), null);
+  assert.equal(bashGuard('rm archivo.txt'), null);
+});
+
+test('el tier ask del piso de seguridad no se autoaprueba con yes', async () => {
+  const root = await makeWorkspace();
+  const auto = createToolRegistry({ root, permissions: { bash: 'allow' }, yes: true });
+  assert.equal(await auto.authorize('bash', { command: 'rm -rf *' }), 'deny', 'yes no saltea la guarda');
+
+  const interactive = createToolRegistry({ root, permissions: { bash: 'allow' }, onAsk: async () => true });
+  assert.equal(await interactive.authorize('bash', { command: 'rm -rf *' }), 'allow', 'onAsk si puede aprobar');
+
+  // Con `yes`, un ask normal (sin guarda) sigue autoaprobando.
+  assert.equal(await auto.authorize('write', { path: 'x.txt' }), 'allow');
+});
+
+test('git_diff rechaza refs que parecen opciones', async () => {
+  const root = await makeWorkspace();
+  const result = await gitDiffTool(root, { ref: '--output=/tmp/inyectado' });
+  assert.match(result, /ref.*inválido/i);
+});
+
+test('resolveInRoot no deja escapar por symlink', async () => {
+  const root = await makeWorkspace();
+  const outside = await mkdtemp(path.join(tmpdir(), 'tamnora-fuera-'));
+  await writeFile(path.join(outside, 'secreto.txt'), 'no tocar');
+  try {
+    await symlink(outside, path.join(root, 'link'), 'junction');
+  } catch {
+    return; // el fs no permite crear symlinks: nada que probar
+  }
+  assert.throws(() => resolveInRoot(root, 'link/secreto.txt'), /fuera del workspace/);
+  assert.equal(toRel(root, resolveInRoot(root, 'src/a.js')), 'src/a.js');
+});
+
 test('local tools read, write, list, glob, grep and edit', async () => {
   const root = await makeWorkspace();
   const reg = createToolRegistry({ root, permissions: { write: 'allow', edit: 'allow' } });
@@ -133,7 +176,7 @@ test('permission "ask" is denied by default and allowed with yes', async () => {
 test('fetchUrlTool rejects invalid URLs and private hosts', async () => {
   const root = await makeWorkspace();
   assert.match(await fetchUrlTool(root, { url: 'not-a-url' }), /URL inválida/);
-  assert.match(await fetchUrlTool(root, { url: 'ftp://example.com' }), /http\/https/);
+  assert.match(await fetchUrlTool(root, { url: 'ftp://example.com' }), /http\(s\)/);
   assert.match(await fetchUrlTool(root, { url: 'http://127.0.0.1:9/' }), /host bloqueado/);
   assert.match(await fetchUrlTool(root, { url: 'http://192.168.1.10/' }), /host bloqueado/);
   assert.match(await fetchUrlTool(root, { url: 'http://169.254.169.254/' }), /host bloqueado/);
@@ -192,6 +235,55 @@ test('fetchUrlTool raw returns the original body', async () => {
   assert.match(out, /<p>hola<\/p>/);
 });
 
+test('fetchUrlTool revalida el host en cada redirect', async () => {
+  let calls = 0;
+  const out = await withFetch(
+    async () => {
+      calls++;
+      return new Response(null, { status: 302, headers: { location: 'http://127.0.0.1:9/admin' } });
+    },
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /host bloqueado/);
+  assert.equal(calls, 1, 'no debe pedir el destino bloqueado');
+});
+
+test('fetchUrlTool bloquea redirects a IPv6 internos y protocolos no http', async () => {
+  const mapped = await withFetch(
+    async () => new Response(null, { status: 301, headers: { location: 'http://[::ffff:127.0.0.1]/' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(mapped, /host bloqueado/);
+
+  const file = await withFetch(
+    async () => new Response(null, { status: 302, headers: { location: 'file:///etc/passwd' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(file, /protocolo no permitido/);
+});
+
+test('fetchUrlTool sigue redirects a hosts publicos', async () => {
+  const out = await withFetch(
+    async (url) => {
+      if (String(url) === 'https://example.com/') {
+        return new Response(null, { status: 301, headers: { location: 'https://example.org/final' } });
+      }
+      return new Response('ok', { status: 200, headers: { 'content-type': 'text/plain' } });
+    },
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /200 .*example\.org\/final/);
+  assert.match(out, /ok/);
+});
+
+test('fetchUrlTool corta cadenas de redirects demasiado largas', async () => {
+  const out = await withFetch(
+    async () => new Response(null, { status: 302, headers: { location: 'https://example.com/loop' } }),
+    () => fetchUrlTool(null, { url: 'https://example.com/' })
+  );
+  assert.match(out, /demasiadas redirecciones/);
+});
+
 test('createTools combines local and MCP tool routing', async () => {
   const root = await makeWorkspace();
   const mcp = {
@@ -265,10 +357,14 @@ test('la tool speak valida el texto y la recorta', async () => {
 
 test('screenshot, console_errors y preview_url validan la URL sin lanzar el navegador', async () => {
   assert.match(previewUrlTool(null, { url: 'https://example.com/x' }), /example\.com/);
+  assert.match(previewUrlTool(null, { url: 'http://127.0.0.1:5173/' }), /127\.0\.0\.1/, 'preview permite loopback');
   assert.match(previewUrlTool(null, {}), /falta "url"/);
   assert.match(await screenshotTool(null, { url: 'ftp://x' }), /Solo se admite http/);
   assert.match(await screenshotTool(null, {}), /falta "url"/);
+  assert.match(await screenshotTool(null, { url: 'http://127.0.0.1:4517/' }), /host bloqueado/);
+  assert.match(await screenshotTool(null, { url: 'http://[fd00::1]/' }), /host bloqueado/);
   assert.match(await consoleTool(null, { url: 'no-url' }), /URL inválida/);
+  assert.match(await consoleTool(null, { url: 'http://localhost:4517/' }), /host bloqueado/);
   assert.equal(evaluatePermission('screenshot', {}, {}), 'allow');
   assert.equal(evaluatePermission('console_errors', {}, {}), 'allow');
   assert.equal(evaluatePermission('preview_url', {}, {}), 'allow');