@danieltmn/tamnora 0.25.1 → 0.26.1

package/harness/packages/server/test/security.test.js

@@ -1,370 +1,194 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import http from 'node:http';
-import { mkdtemp, writeFile, unlink, mkdir } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { createTamnoraServer } from '../src/index.js';
-import { setHome, ensureApp, writeApp, makeUser, bridgeStatePath } from '../../core/src/index.js';
-import { isLoopback, localOk } from '../src/lib/workspace.js';
-import { loginClear } from '../src/auth.js';
-
-const fakeProvider = {
-  id: 'fake',
-  async streamChat(_config, { onEvent }) {
-    onEvent?.({ type: 'text', delta: 'hola', full: 'hola' });
-    return { content: 'hola', reasoning: '', toolCalls: [] };
-  },
-};
-
-async function startServer(overrides = {}) {
-  const cwd = overrides.cwd ?? (await mkdtemp(path.join(tmpdir(), 'tamnora-sec-')));
-  setHome(cwd);
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-    ...overrides,
-  });
-  const info = await instance.listen({ port: 0 });
-  return { instance, base: info.url, port: info.port, cwd, home: cwd };
-}
-
-/** Deja un bridge.json apuntando a un supervisor vivo (este proceso). */
-async function fakeTunnel() {
-  await writeFile(bridgeStatePath(), `${JSON.stringify({ pid: process.pid, url: 'https://fake.tunnelmole.net', provider: 'tunnelmole', port: 4517 })}\n`);
-}
-
-async function clearTunnel() {
-  try {
-    await unlink(bridgeStatePath());
-  } catch {
-    /* nada */
-  }
-}
-
-test('isLoopback solo acepta direcciones de loopback', () => {
-  for (const good of ['127.0.0.1', '127.9.9.9', '::1', '0:0:0:0:0:0:0:1', '::ffff:127.0.0.1']) {
-    assert.ok(isLoopback(good), good);
-  }
-  for (const bad of ['192.168.1.5', '::ffff:192.168.1.5', '', null, 'fe80::1']) {
-    assert.ok(!isLoopback(bad), String(bad));
-  }
-});
-
-test('localOk exige loopback en remoteAddress y sin tunel activo', async () => {
-  const fake = (remote) => ({ socket: { remoteAddress: remote } });
-  assert.ok(localOk(fake('127.0.0.1')));
-  assert.ok(!localOk(fake('192.168.1.5')));
-  // localAddress (la direccion de bind) ya no engana.
-  assert.ok(!localOk({ socket: { remoteAddress: '10.0.0.8', localAddress: '127.0.0.1' } }));
-
-  const { instance, home } = await startServer();
-  try {
-    // Con tunel activo, hasta una conexion loopback deja de ser local.
-    await fakeTunnel();
-    assert.ok(!localOk({ socket: { remoteAddress: '127.0.0.1' } }));
-    assert.equal(home, path.dirname(bridgeStatePath()));
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-test('un bridge de tailscale no degrada localOk (red privada por loopback)', async () => {
-  const { instance } = await startServer();
-  try {
-    await writeFile(
-      bridgeStatePath(),
-      `${JSON.stringify({ pid: process.pid, url: 'https://pc.tailnet.ts.net', provider: 'tailscale', port: 4517 })}\n`
-    );
-    assert.ok(localOk({ socket: { remoteAddress: '127.0.0.1' } }), 'loopback sigue siendo local con tailscale');
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-test('POST /api/shell responde 403 mientras el tunel esta activo', async () => {
-  const { instance, base } = await startServer();
-  try {
-    const shell = (extraHeaders = {}) =>
-      fetch(`${base}/api/shell`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...extraHeaders },
-        body: JSON.stringify({ command: 'echo tamnora-ok' }),
-      });
-
-    const ok = await shell();
-    assert.equal(ok.status, 200);
-    const body = await ok.json();
-    assert.match(String(body.output), /tamnora-ok/);
-
-    await fakeTunnel();
-    const blocked = await shell();
-    assert.equal(blocked.status, 403);
-
-    // Con header falsificado tampoco pasa: remoteAddress manda.
-    const spoofed = await shell({ 'x-forwarded-for': '203.0.113.9' });
-    assert.equal(spoofed.status, 403);
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-test('GET /api/files: sin tunel acepta ?root; con tunel y sin auth responde 403', async () => {
-  const { instance, base } = await startServer();
-  try {
-    // Sin tunel y desde loopback el request es local: cualquier raiz va.
-    const outside = await mkdtemp(path.join(tmpdir(), 'tamnora-fuera-'));
-    mkdir(path.join(outside, 'sub'));
-    const free = await (await fetch(`${base}/api/files?root=${encodeURIComponent(outside)}`)).json();
-    assert.equal(free.root, outside, 'conexion local puede explorar otra raiz');
-
-    const escape = await fetch(`${base}/api/files?path=..%2F..&root=${encodeURIComponent(outside)}`);
-    assert.equal(escape.status, 400);
-
-    await fakeTunnel();
-    const viaTunnel = await fetch(`${base}/api/files`);
-    assert.equal(viaTunnel.status, 403);
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-test('con auth, git/files quedan usables por el tunel y confinados al workspace', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-auth-'));
-  setHome(cwd);
-  const app = ensureApp();
-  app.user = makeUser('admin', 'secreto123');
-  writeApp(app);
-
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-  });
-  const info = await instance.listen({ port: 0 });
-  const base = info.url;
-  try {
-    const login = await fetch(`${base}/api/auth/login`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username: 'admin', password: 'secreto123' }),
-    });
-    assert.equal(login.status, 200);
-    const cookie = login.headers.get('set-cookie');
-    const { csrf } = await login.json();
-
-    await fakeTunnel();
-
-    const files = await fetch(`${base}/api/files`, { headers: { cookie } });
-    assert.equal(files.status, 200);
-    const listing = await files.json();
-    assert.equal(listing.root, cwd, 'por el tunel la raiz es el workspace');
-
-    const shell = await fetch(`${base}/api/shell`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', cookie, 'x-csrf': csrf },
-      body: JSON.stringify({ command: 'echo nope' }),
-    });
-    assert.equal(shell.status, 403, 'el shell directo sigue cerrado por el tunel');
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-test('el lockout de login no se esquiva falsificando X-Forwarded-For', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-lock-'));
-  setHome(cwd);
-  const app = ensureApp();
-  app.user = makeUser('locktest', 'secreto123');
-  writeApp(app);
-
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-  });
-  const info = await instance.listen({ port: 0 });
-  const base = info.url;
-  try {
-    const attempt = (xff) =>
-      fetch(`${base}/api/auth/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...(xff ? { 'x-forwarded-for': xff } : {}) },
-        body: JSON.stringify({ username: 'locktest', password: 'mala' }),
-      });
-
-    for (let i = 0; i < 5; i++) {
-      await attempt(i % 2 ? '203.0.113.1' : '203.0.113.2');
-    }
-    const lockedPlain = await attempt();
-    assert.equal(lockedPlain.status, 429);
-
-    const lockedSpoof = await attempt('198.51.100.7');
-    assert.equal(lockedSpoof.status, 429, 'XFF falsificado no resetea el contador');
-  } finally {
-    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
-    await instance.close();
-  }
-});
-
-test('la cookie va con Secure cuando hay tunel y el Host es publico', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-cookie-'));
-  setHome(cwd);
-  const app = ensureApp();
-  app.user = makeUser('admin', 'secreto123');
-  writeApp(app);
-
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-  });
-  const info = await instance.listen({ port: 0 });
-  try {
-    await fakeTunnel();
-
-    const rawLogin = (host) =>
-      new Promise((resolve, reject) => {
-        const body = JSON.stringify({ username: 'admin', password: 'secreto123' });
-        const req = http.request(
-          { host: '127.0.0.1', port: info.port, path: '/api/auth/login', method: 'POST', headers: { Host: host, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } },
-          (res) => {
-            let out = '';
-            res.on('data', (c) => (out += c));
-            res.on('end', () => resolve({ status: res.statusCode, setCookie: res.headers['set-cookie']?.[0] ?? '' }));
-          }
-        );
-        req.on('error', reject);
-        req.end(body);
-      });
-
-    const viaTunnel = await rawLogin('algo.tunnelmole.net');
-    assert.match(String(viaTunnel.setCookie), /Secure/, 'por el tunel la cookie es Secure');
-
-    const local = await rawLogin('localhost:4517');
-    assert.ok(!/Secure/i.test(String(local.setCookie)), 'local http no fuerza Secure');
-  } finally {
-    await clearTunnel();
-    await instance.close();
-  }
-});
-
-/** Request crudo para poder fijar headers que `fetch` no deja (Host, Origin). */
-function rawRequest({ port, path: reqPath, method = 'GET', headers = {}, body = '' }) {
-  return new Promise((resolve, reject) => {
-    const req = http.request(
-      {
-        host: '127.0.0.1',
-        port,
-        path: reqPath,
-        method,
-        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), ...headers },
-      },
-      (res) => {
-        let out = '';
-        res.on('data', (c) => (out += c));
-        res.on('end', () => resolve({ status: res.statusCode, body: out }));
-      }
-    );
-    req.on('error', reject);
-    req.end(body);
-  });
-}
-
-test('las mutaciones rechazan un Origin ajeno, con o sin auth (CSRF drive-by)', async () => {
-  const { instance, port } = await startServer();
-  try {
-    const shell = (headers) =>
-      rawRequest({
-        port,
-        path: '/api/shell',
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ command: 'echo pwned' }),
-      });
-
-    // Una web maliciosa: simple request con Origin ajeno no ejecuta nada.
-    const driveBy = await shell({ Origin: 'https://evil.example' });
-    assert.equal(driveBy.status, 403, 'Origin ajeno bloqueado');
-
-    const nullOrigin = await shell({ Origin: 'null' });
-    assert.equal(nullOrigin.status, 403, 'Origin: null bloqueado');
-
-    // Mismo origen (la consola) y clientes sin navegador (CLI) siguen pasando.
-    const sameOrigin = await shell({ Origin: `http://127.0.0.1:${port}` });
-    assert.equal(sameOrigin.status, 200, 'mismo origen permitido');
-    assert.match(sameOrigin.body, /pwned/);
-
-    const noOrigin = await shell({});
-    assert.equal(noOrigin.status, 200, 'cliente sin Origin (no navegador) permitido');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('el Host de un dominio ajeno se rechaza (DNS rebinding)', async () => {
-  const { instance, port } = await startServer();
-  try {
-    const health = (host) => rawRequest({ port, path: '/api/health', headers: { Host: host } });
-
-    const rebinding = await health('evil.example:8080');
-    assert.equal(rebinding.status, 403, 'Host de un dominio ajeno bloqueado');
-
-    const local = await health('127.0.0.1');
-    assert.equal(local.status, 200, 'IP literal permitida');
-
-    const named = await health('mi-pc.tailnet.ts.net');
-    assert.equal(named.status, 200, 'dominio de tailscale permitido');
-
-    const viaTunnelHost = await health('abc.tunnelmole.net');
-    assert.equal(viaTunnelHost.status, 200, 'dominio del tunel permitido');
-  } finally {
-    await instance.close();
-  }
-});
-
-test('el lockout de login no se esquiva rotando el username', async () => {
-  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-lock2-'));
-  setHome(cwd);
-  const app = ensureApp();
-  app.user = makeUser('locktest2', 'secreto123');
-  writeApp(app);
-
-  const instance = await createTamnoraServer({
-    cwd,
-    dbPath: path.join(cwd, 'tamnora.db'),
-    loadMcp: false,
-    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
-  });
-  const info = await instance.listen({ port: 0 });
-  const base = info.url;
-  try {
-    const attempt = (username) =>
-      fetch(`${base}/api/auth/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, password: 'mala' }),
-      });
-
-    // Cada intento con un nombre distinto: el contador es por IP, no por usuario.
-    for (let i = 0; i < 5; i++) {
-      const res = await attempt(`intruso${i}`);
-      assert.equal(res.status, 401, `intento ${i} sin bloquear todavia`);
-    }
-    const locked = await attempt('locktest2');
-    assert.equal(locked.status, 429, 'tras 5 fallos el bloqueo aplica a toda la IP');
-  } finally {
-    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
-    await instance.close();
-  }
-});
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createTamnoraServer } from '../src/index.js';
+import { setHome, ensureApp, writeApp, makeUser } from '../../core/src/index.js';
+import { isLoopback, localOk } from '../src/lib/workspace.js';
+import { loginClear } from '../src/auth.js';
+
+const fakeProvider = {
+  id: 'fake',
+  async streamChat(_config, { onEvent }) {
+    onEvent?.({ type: 'text', delta: 'hola', full: 'hola' });
+    return { content: 'hola', reasoning: '', toolCalls: [] };
+  },
+};
+
+async function startServer(overrides = {}) {
+  const cwd = overrides.cwd ?? (await mkdtemp(path.join(tmpdir(), 'tamnora-sec-')));
+  setHome(cwd);
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+    ...overrides,
+  });
+  const info = await instance.listen({ port: 0 });
+  return { instance, base: info.url, port: info.port, cwd, home: cwd };
+}
+
+test('isLoopback solo acepta direcciones de loopback', () => {
+  for (const good of ['127.0.0.1', '127.9.9.9', '::1', '0:0:0:0:0:0:0:1', '::ffff:127.0.0.1']) {
+    assert.ok(isLoopback(good), good);
+  }
+  for (const bad of ['192.168.1.5', '::ffff:192.168.1.5', '', null, 'fe80::1']) {
+    assert.ok(!isLoopback(bad), String(bad));
+  }
+});
+
+test('localOk exige loopback en remoteAddress', () => {
+  const fake = (remote) => ({ socket: { remoteAddress: remote } });
+  assert.ok(localOk(fake('127.0.0.1')));
+  assert.ok(!localOk(fake('192.168.1.5')));
+  // localAddress (la direccion de bind) ya no engana.
+  assert.ok(!localOk({ socket: { remoteAddress: '10.0.0.8', localAddress: '127.0.0.1' } }));
+});
+
+
+test('el lockout de login no se esquiva falsificando X-Forwarded-For', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-lock-'));
+  setHome(cwd);
+  const app = ensureApp();
+  app.user = makeUser('locktest', 'secreto123');
+  writeApp(app);
+
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+  });
+  const info = await instance.listen({ port: 0 });
+  const base = info.url;
+  try {
+    const attempt = (xff) =>
+      fetch(`${base}/api/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...(xff ? { 'x-forwarded-for': xff } : {}) },
+        body: JSON.stringify({ username: 'locktest', password: 'mala' }),
+      });
+
+    for (let i = 0; i < 5; i++) {
+      await attempt(i % 2 ? '203.0.113.1' : '203.0.113.2');
+    }
+    const lockedPlain = await attempt();
+    assert.equal(lockedPlain.status, 429);
+
+    const lockedSpoof = await attempt('198.51.100.7');
+    assert.equal(lockedSpoof.status, 429, 'XFF falsificado no resetea el contador');
+  } finally {
+    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
+    await instance.close();
+  }
+});
+
+/** Request crudo para poder fijar headers que `fetch` no deja (Host, Origin). */
+function rawRequest({ port, path: reqPath, method = 'GET', headers = {}, body = '' }) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port,
+        path: reqPath,
+        method,
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), ...headers },
+      },
+      (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => resolve({ status: res.statusCode, body: out }));
+      }
+    );
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+
+test('las mutaciones rechazan un Origin ajeno, con o sin auth (CSRF drive-by)', async () => {
+  const { instance, port } = await startServer();
+  try {
+    const shell = (headers) =>
+      rawRequest({
+        port,
+        path: '/api/shell',
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ command: 'echo pwned' }),
+      });
+
+    // Una web maliciosa: simple request con Origin ajeno no ejecuta nada.
+    const driveBy = await shell({ Origin: 'https://evil.example' });
+    assert.equal(driveBy.status, 403, 'Origin ajeno bloqueado');
+
+    const nullOrigin = await shell({ Origin: 'null' });
+    assert.equal(nullOrigin.status, 403, 'Origin: null bloqueado');
+
+    // Mismo origen (la consola) y clientes sin navegador (CLI) siguen pasando.
+    const sameOrigin = await shell({ Origin: `http://127.0.0.1:${port}` });
+    assert.equal(sameOrigin.status, 200, 'mismo origen permitido');
+    assert.match(sameOrigin.body, /pwned/);
+
+    const noOrigin = await shell({});
+    assert.equal(noOrigin.status, 200, 'cliente sin Origin (no navegador) permitido');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('el Host de un dominio ajeno se rechaza (DNS rebinding)', async () => {
+  const { instance, port } = await startServer();
+  try {
+    const health = (host) => rawRequest({ port, path: '/api/health', headers: { Host: host } });
+
+    const rebinding = await health('evil.example:8080');
+    assert.equal(rebinding.status, 403, 'Host de un dominio ajeno bloqueado');
+
+    const local = await health('127.0.0.1');
+    assert.equal(local.status, 200, 'IP literal permitida');
+
+    const named = await health('mi-pc.tailnet.ts.net');
+    assert.equal(named.status, 200, 'dominio de tailscale permitido');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('el lockout de login no se esquiva rotando el username', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-lock2-'));
+  setHome(cwd);
+  const app = ensureApp();
+  app.user = makeUser('locktest2', 'secreto123');
+  writeApp(app);
+
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+  });
+  const info = await instance.listen({ port: 0 });
+  const base = info.url;
+  try {
+    const attempt = (username) =>
+      fetch(`${base}/api/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password: 'mala' }),
+      });
+
+    // Cada intento con un nombre distinto: el contador es por IP, no por usuario.
+    for (let i = 0; i < 5; i++) {
+      const res = await attempt(`intruso${i}`);
+      assert.equal(res.status, 401, `intento ${i} sin bloquear todavia`);
+    }
+    const locked = await attempt('locktest2');
+    assert.equal(locked.status, 429, 'tras 5 fallos el bloqueo aplica a toda la IP');
+  } finally {
+    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
+    await instance.close();
+  }
+});

package/harness/packages/server/test/settingsNav.test.js

@@ -16,7 +16,7 @@ test('foldText ignora mayusculas y acentos', () => {
 test('sin consulta devuelve todas las secciones, en el orden de los grupos', () => {
   assert.deepEqual(ids(filterSettings('')), ids(SETTINGS_SECTIONS));
   assert.deepEqual(ids(filterSettings('   ')), ids(SETTINGS_SECTIONS));
-  assert.equal(SETTINGS_SECTIONS.length, 14);
+  assert.equal(SETTINGS_SECTIONS.length, 13);
 });
 
 test('busca por nombre sin importar acentos ni mayusculas', () => {
@@ -27,7 +27,7 @@ test('busca por nombre sin importar acentos ni mayusculas', () => {
 
 test('el nombre del grupo no tapa a la seccion: "voz" da Voz, no todo "Voz y canales"', () => {
   assert.deepEqual(ids(filterSettings('voz')), ['voz']);
-  assert.deepEqual(ids(filterSettings('canales')), ['voz', 'transcripcion', 'asesor', 'telegram']);
+  assert.deepEqual(ids(filterSettings('canales')), ['voz', 'transcripcion', 'telegram']);
 });
 
 test('busca por palabra clave y por grupo', () => {

package/harness/packages/server/test/tts.test.js

@@ -80,25 +80,25 @@ test('los ajustes de voz exponen defaults y sanitizan lo guardado', async () =>
     assert.equal(initial.announce.start, true);
     assert.equal(initial.announce.tools, true);
     assert.equal(initial.announce.end, true);
-    assert.equal(initial.announce.summary, false);
+    assert.equal(initial.announce.answer, false);
 
     const put = await fetch(`${base}/api/tts/settings`, {
       method: 'PUT',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ enabled: true, voice: '<script>', rate: '150%', pitch: '999Hz', announce: { summary: true } }),
+      body: JSON.stringify({ enabled: true, voice: '<script>', rate: '150%', pitch: '999Hz', announce: { answer: true } }),
     });
     const saved = await put.json();
     assert.equal(saved.enabled, true);
     assert.equal(saved.voice, 'es-AR-ElenaNeural');
     assert.equal(saved.rate, '+100%');
     assert.equal(saved.pitch, '+50Hz');
-    assert.equal(saved.announce.summary, true);
+    assert.equal(saved.announce.answer, true);
 
     const reread = await (await fetch(`${base}/api/tts/settings`)).json();
     assert.equal(reread.enabled, true);
     assert.equal(reread.rate, '+100%');
     assert.equal(reread.pitch, '+50Hz');
-    assert.equal(reread.announce.summary, true);
+    assert.equal(reread.announce.answer, true);
   } finally {
     global.WebSocket = original;
     await instance.close();

package/harness/tamnora.example.json

@@ -54,7 +54,7 @@
     "enabled": true,
     "allow": ["npm", "node", "npx", "pnpm", "yarn", "bun", "php", "python", "composer"]
   },
-  "preview": { "provider": "tailscale", "tailscalePort": 8443, "fallback": false },
+  "preview": { "provider": "tailscale", "tailscalePort": 8443 },
   "telegram": { "token": "", "allowedChatIds": [], "transcribeModel": "whisper-1" },
   "agents": { "maxRounds": 6 }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.25.1",
-  "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
+  "version": "0.26.1",
+  "description": "Harness local para IAs: agente CLI-first con TUI y consola web. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",
   "author": "tamnora",