@danieltmn/tamnora 0.26.0 → 0.27.0

package/harness/packages/server/public/settings.js

@@ -104,7 +104,12 @@ export function openProviderForm(provider = null) {
   $('#pf-id').value = provider?.id ?? '';
   $('#pf-id').readOnly = Boolean(provider);
   $('#pf-label').value = provider?.label ?? '';
-  $('#pf-baseurl').value = provider?.baseUrl ?? '';
+  // Sin base URL propia, se autocompleta la del preset conocido (no el ejemplo
+  // del placeholder). `data-autofill` recuerda que lo pusimos nosotros: si el
+  // usuario escribe otra cosa, no se vuelve a pisar.
+  const base = $('#pf-baseurl');
+  base.value = provider?.baseUrl || provider?.defaultBaseUrl || '';
+  base.dataset.autofill = provider?.defaultBaseUrl ?? base.value;
   $('#pf-key').value = '';
   $('#pf-key').placeholder = provider?.apiKeyHint ? `guardada (${provider.apiKeyHint})` : 'dejar vacío para no cambiar';
   $('#pf-models').value = (provider?.models ?? []).join(', ');
@@ -113,6 +118,25 @@ export function openProviderForm(provider = null) {
   if (!provider) $('#pf-id').focus();
 }
 
+/** Base URL del preset conocido con ese id ('' si no hay preset). */
+function presetBaseUrl(id) {
+  return state.providers?.find((p) => p.id === id)?.defaultBaseUrl ?? '';
+}
+
+/**
+ * Mientras se tipea el id de un proveedor nuevo, se autocompleta el base URL
+ * del preset conocido (deepseek, openai, ...) salvo que el usuario haya
+ * escrito el suyo.
+ */
+export function syncProviderDefaults() {
+  const known = presetBaseUrl($('#pf-id').value.trim());
+  const base = $('#pf-baseurl');
+  if (known && (!base.value.trim() || base.dataset.autofill === base.value)) {
+    base.value = known;
+    base.dataset.autofill = known;
+  }
+}
+
 export function closeProviderForm() {
   if (providerModal.open) providerModal.close();
 }
@@ -1167,10 +1191,24 @@ export async function searchMcp() {
   setStatus('#mcp-search-status', `${data.results.length} resultado(s)`);
   for (const r of data.results) {
     const li = el('li', r.installed ? 'active' : '');
+    if (r.registry) li.title = r.registry;
     const main = el('div', 'grow');
     main.append(el('div', '', r.name || r.id), el('div', 'pmeta', r.description || r.id));
+    const meta = [r.publisher, r.version ? `v${r.version}` : '', r.transport === 'http' ? 'http' : 'stdio']
+      .filter(Boolean)
+      .join(' · ');
+    if (meta) main.append(el('div', 'pmeta', meta));
     li.appendChild(main);
     const actions = el('div', 'pactions');
+    if (r.official) actions.appendChild(el('span', 'chip ok', 'oficial'));
+    else if (r.status && r.status !== 'active') actions.appendChild(el('span', 'chip warn', r.status));
+    if (r.repository) {
+      const repo = el('a', 'pmeta', 'repo');
+      repo.href = r.repository;
+      repo.target = '_blank';
+      repo.rel = 'noopener noreferrer';
+      actions.appendChild(repo);
+    }
     if (r.requiredEnv?.length) actions.appendChild(el('span', 'pmeta', `env: ${r.requiredEnv.join(', ')}`));
     if (r.installed) actions.appendChild(el('span', 'pmeta', 'instalado'));
     else actions.appendChild(button('instalar', (event) => { event.stopPropagation(); installMcpFromRegistry(r.registry || r.name); }));

package/harness/packages/server/public/styles.css

@@ -1021,6 +1021,30 @@ body.resizing * { cursor: col-resize !important; }
 .plan-step.active .plan-mark { color: var(--accent); }
 .plan-step.active .plan-text { color: var(--text); font-weight: 600; }
 
+/* chart card (show_chart) --------------------------------------------------- */
+.chart-card {
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 10px 12px;
+  background: var(--theirs);
+  margin-top: 6px;
+}
+.chart-figure { margin: 0; }
+.chart-figure .chart { display: block; width: 100%; height: auto; color: var(--text); }
+.chart-tick { font: 11px var(--mono); fill: var(--muted); }
+.chart-legend { font: 12px var(--sans); fill: var(--text); }
+
+/* imagenes inline del markdown ( ![alt](url) ) ------------------------------ */
+.md-img {
+  display: block;
+  max-width: 100%;
+  max-height: 420px;
+  width: auto;
+  margin: 6px 0;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+}
+
 /* activity indicators ------------------------------------------------------ */
 .activity { display: flex; align-items: center; gap: 9px; margin-top: 10px; color: var(--muted); font-size: 12.5px; }
 .activity .loader { color: var(--accent); }
@@ -2248,6 +2272,15 @@ dialog.modal::backdrop { background: rgba(24, 22, 16, 0.55); backdrop-filter: bl
 .model-item-id { color: var(--muted); font: 500 11px var(--mono); flex: 0 0 auto; }
 .model-item-price { color: var(--muted); font: 500 11px var(--mono); flex: 0 0 auto; }
 .model-item-free { color: var(--ok); font: 600 10px var(--sans); flex: 0 0 auto; }
+.model-actions .btn.active { border-color: var(--accent); color: var(--accent); font-weight: 700; }
+.model-cap {
+  flex: 0 0 auto;
+  font: 600 10px var(--sans);
+  color: var(--accent);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 1px 7px;
+}
 .model-empty { padding: 16px; color: var(--muted); text-align: center; }
 .confirm-text { margin: 0; color: var(--muted, inherit); line-height: 1.5; }
 .confirm-actions { display: flex; justify-content: flex-end; gap: 8px; }

package/harness/packages/server/src/lib/channels/telegram/media.js

@@ -3,7 +3,8 @@
 
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
-import { sintetizar, MAX_TEXTO, screenshotsDir } from '../../core.js';
+import { MAX_TEXTO, screenshotsDir } from '../../core.js';
+import { sintetizarVoz } from '../../ttsEngine.js';
 import { mp3AOgg } from '../../ffmpeg.js';
 import { resolveTts } from '../../ttsSettings.js';
 import { tgForm } from './api.js';
@@ -17,7 +18,7 @@ export async function enviarNotaDeVoz(T, chatId, texto, { voice, rate, pitch } =
   const frase = String(texto ?? '').trim().slice(0, MAX_TEXTO);
   if (!frase) return;
   try {
-    const mp3 = await sintetizar(frase, {
+    const mp3 = await sintetizarVoz(T.ctx, frase, {
       voice: voice || tts.voice,
       rate: rate || tts.rate,
       pitch: pitch || tts.pitch,
@@ -37,28 +38,30 @@ export async function enviarNotaDeVoz(T, chatId, texto, { voice, rate, pitch } =
   }
 }
 
-/** Manda una imagen (una captura del tool `screenshot`). */
-export async function enviarFoto(T, chatId, buffer, caption) {
+/** Manda una imagen (una captura del tool `screenshot` o una imagen generada). */
+export async function enviarFoto(T, chatId, buffer, caption, ext = 'png') {
+  const mime = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif' }[String(ext).toLowerCase()] ?? 'image/png';
   try {
     const form = new FormData();
     form.append('chat_id', chatId);
     if (caption) form.append('caption', String(caption).slice(0, 1000));
-    form.append('photo', new Blob([buffer], { type: 'image/png' }), 'captura.png');
+    form.append('photo', new Blob([buffer], { type: mime }), `imagen.${ext}`);
     await tgForm(T.token, 'sendPhoto', form);
   } catch (error) {
     T.log(`telegram: foto falló: ${error?.message ?? error}`);
   }
 }
 
-/** Entrega una captura guardada en la casa (por nombre, sin path traversal). */
+/** Entrega una imagen guardada en la casa (por nombre, sin path traversal). */
 export async function enviarCaptura(T, chatId, name, caption) {
   const safe = String(name ?? '');
-  if (!/^[a-z0-9][a-z0-9-]*\.png$/i.test(safe)) return;
+  const match = /^([a-z0-9][a-z0-9-]*)\.(png|jpe?g|webp|gif)$/i.exec(safe);
+  if (!match) return;
   let buffer;
   try {
     buffer = await readFile(path.join(screenshotsDir(), safe));
   } catch {
     return;
   }
-  await enviarFoto(T, chatId, buffer, caption);
+  await enviarFoto(T, chatId, buffer, caption, match[2]);
 }

package/harness/packages/server/src/lib/channels/telegram/run.js

@@ -16,6 +16,7 @@ import { edit, send, tg } from './api.js';
 import { completionFooter } from './text.js';
 import { permissionMessage, permissionKeyboard } from './permissions.js';
 import { enviarCaptura, enviarNotaDeVoz } from './media.js';
+import { generateImage } from '../../imagegen.js';
 import { activeSessionId, projectLabel, sendProjectPicker } from './projects.js';
 
 const RESUME_INSTRUCTION =
@@ -93,6 +94,7 @@ export async function run(T, chatId, input, images = []) {
     mcp,
     mcpMode: T.ctx.effectiveMcpMode(),
     mcpPinned: T.ctx.effectiveMcpPinned(),
+    onImage: (req) => generateImage(T.ctx, req),
   });
   const exposeAdmin = !mode.tools;
   const admin = T.ctx.agentTools;
@@ -158,6 +160,9 @@ export async function run(T, chatId, input, images = []) {
           if (event.name === 'screenshot' && event.meta?.screenshot?.name) {
             enviarCaptura(T, chatId, event.meta.screenshot.name, event.meta.screenshot.url);
           }
+          if (event.name === 'generate_image' && event.meta?.image?.name) {
+            enviarCaptura(T, chatId, event.meta.image.name, event.meta.image.prompt);
+          }
         } else {
           return;
         }

package/harness/packages/server/src/lib/imagegen.js

@@ -0,0 +1,201 @@
+// Generacion de imagenes, compartida por la consola y los canales que arman
+// tools. Regla de resolucion: **el mismo modelo del chat primero** — si el
+// modelo activo sabe generar imagenes, genera el (endpoint `/images/generations`
+// para las familias tipo dall-e/gpt-image, o una respuesta de chat con parte de
+// imagen para las tipo gemini-*-image). Si no, cae al ajuste `app.json` ->
+// `imageGen` (provider/model/size) y recien ahi al proveedor activo con
+// `dall-e-3`. La imagen se guarda en la casa (`screenshots/`), igual que las
+// capturas, para que los endpoints y canales existentes la sirvan.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { apiRoot, modelCapabilities, screenshotsDir } from './core.js';
+
+export const DEFAULT_IMAGE_MODEL = 'dall-e-3';
+export const DEFAULT_IMAGE_SIZE = '1024x1024';
+
+/** Familias que generan por el endpoint de imagenes (no por chat). */
+const IMAGE_API = /dall-e|gpt-image|imagen-/i;
+
+/**
+ * Defaults cuando ni el modelo del chat ni `imageGen` generan imagenes.
+ * OpenRouter enruta la generacion por chat (con `modalities`), y su catalogo
+ * no usa ids `dall-e-*`; el resto asume el endpoint de imagenes estandar.
+ */
+const PROVIDER_IMAGE_DEFAULTS = {
+  openrouter: { model: 'google/gemini-2.5-flash-image', viaChat: true },
+};
+
+/** Como genera este modelo: por chat (salida de imagen) o por /images/generations. */
+const viaChatFor = (model) => !IMAGE_API.test(model) && modelCapabilities(model).image;
+
+/** Detalle legible del error del proveedor (OpenAI devuelve `{error:{message}}`). */
+async function providerError(res) {
+  const body = await res.text().catch(() => '');
+  try {
+    const json = JSON.parse(body);
+    return json?.error?.message || json?.error || json?.message || body;
+  } catch {
+    return body;
+  }
+}
+
+/** Formato por magic bytes + dimensiones cuando se pueden leer (PNG/JPEG). */
+function imageInfo(buffer) {
+  if (buffer.length > 24 && buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
+    return {
+      ext: 'png',
+      width: buffer.readUInt32BE(16),
+      height: buffer.readUInt32BE(20),
+    };
+  }
+  if (buffer.length > 4 && buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) {
+    // JPEG: buscar el marcador SOF (el alto/ancho viven ahi).
+    let i = 2;
+    while (i + 9 < buffer.length) {
+      if (buffer[i] !== 0xff) break;
+      const marker = buffer[i + 1];
+      const size = buffer.readUInt16BE(i + 2);
+      if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+        return { ext: 'jpg', height: buffer.readUInt16BE(i + 5), width: buffer.readUInt16BE(i + 7) };
+      }
+      i += 2 + size;
+    }
+    return { ext: 'jpg' };
+  }
+  if (buffer.length > 12 && buffer.toString('ascii', 0, 4) === 'RIFF' && buffer.toString('ascii', 8, 12) === 'WEBP') {
+    return { ext: 'webp' };
+  }
+  if (buffer.toString('ascii', 0, 3) === 'GIF') return { ext: 'gif' };
+  return null;
+}
+
+/** Data URL o URL remota -> buffer. */
+async function urlToBuffer(url, signal) {
+  const text = String(url ?? '');
+  const data = /^data:([^,]+);base64,(.+)$/s.exec(text);
+  if (data) return Buffer.from(data[2], 'base64');
+  const res = await fetch(text, { signal });
+  if (!res.ok) throw new Error(`no se pudo descargar la imagen devuelta (HTTP ${res.status})`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+/** POST /images/generations (familia dall-e/gpt-image). */
+async function viaImagesApi(baseUrl, apiKey, { model, prompt, size, signal }) {
+  const url = `${baseUrl}/images/generations`;
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    },
+    body: JSON.stringify({ model, prompt, n: 1, size: size || DEFAULT_IMAGE_SIZE }),
+    signal,
+  });
+  if (!res.ok) {
+    const detail = String((await providerError(res)) ?? '').replace(/\s+/g, ' ').trim().slice(0, 200);
+    throw new Error(`generación falló (HTTP ${res.status}) en ${url}${detail ? `: ${detail}` : ''}`);
+  }
+  const data = await res.json().catch(() => null);
+  const item = Array.isArray(data?.data) ? data.data[0] : null;
+  if (item?.b64_json) return Buffer.from(String(item.b64_json), 'base64');
+  if (item?.url) return urlToBuffer(item.url, signal);
+  throw new Error('el proveedor no devolvió una imagen');
+}
+
+/** Busca una parte de imagen en la respuesta de un chat (OpenAI-compatible). */
+function imageFromMessage(message) {
+  const fromImages = Array.isArray(message?.images) ? message.images : [];
+  const fromContent = Array.isArray(message?.content) ? message.content : [];
+  for (const part of [...fromImages, ...fromContent]) {
+    const url = part?.image_url?.url ?? part?.url;
+    if (url) return url;
+  }
+  return null;
+}
+
+/** Chat con salida de imagen (familia gemini-*-image y afines). */
+async function viaChatImage(baseUrl, apiKey, { model, prompt, signal }) {
+  const endpoint = `${baseUrl}/chat/completions`;
+  const res = await fetch(endpoint, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    },
+    body: JSON.stringify({
+      model,
+      modalities: ['text', 'image'],
+      messages: [{ role: 'user', content: prompt }],
+    }),
+    signal,
+  });
+  if (!res.ok) {
+    const detail = String((await providerError(res)) ?? '').replace(/\s+/g, ' ').trim().slice(0, 200);
+    throw new Error(`generación falló (HTTP ${res.status}) en ${endpoint}${detail ? `: ${detail}` : ''}`);
+  }
+  const data = await res.json().catch(() => null);
+  const message = data?.choices?.[0]?.message;
+  const url = imageFromMessage(message);
+  if (!url) {
+    const text = typeof message?.content === 'string' ? message.content.slice(0, 160) : '';
+    throw new Error(`el modelo no devolvió una imagen${text ? `: ${text}` : ''}`);
+  }
+  return urlToBuffer(url, signal);
+}
+
+function resolveTarget(ctx, { model, providerId: override }, saved) {
+  // 1) modelo explicito de la tool; 2) el modelo del chat si genera imagenes;
+  // 3) el ajuste imageGen; 4) el default conocido del proveedor.
+  const explicit = String(model ?? '').trim();
+  if (explicit) {
+    const id = String(override ?? '').trim() || String(ctx.effectiveProviderId?.() ?? '');
+    return { providerId: id, model: explicit, viaChat: viaChatFor(explicit) };
+  }
+  const chatModel = String(ctx.effectiveModel?.() ?? '').trim();
+  if (chatModel && modelCapabilities(chatModel).image) {
+    return {
+      providerId: String(override ?? '').trim() || String(ctx.effectiveProviderId?.() ?? ''),
+      model: chatModel,
+      viaChat: viaChatFor(chatModel),
+    };
+  }
+  const providerId =
+    String(override ?? '').trim() || String(saved.provider ?? '').trim() || String(ctx.effectiveProviderId?.() ?? '');
+  const savedModel = String(saved.model ?? '').trim();
+  if (savedModel) return { providerId, model: savedModel, viaChat: viaChatFor(savedModel) };
+  const fallback = PROVIDER_IMAGE_DEFAULTS[providerId] ?? { model: DEFAULT_IMAGE_MODEL, viaChat: false };
+  return { providerId, model: fallback.model, viaChat: fallback.viaChat };
+}
+
+/**
+ * Pide una imagen y la guarda en la casa. Devuelve
+ * `{ name, bytes, width, height, model }`. Lanza `Error` con detalle legible.
+ */
+export async function generateImage(ctx, { prompt, size, model, providerId: override, signal } = {}) {
+  const app = ctx.app ?? {};
+  const saved = app.imageGen && typeof app.imageGen === 'object' ? app.imageGen : {};
+  const target = resolveTarget(ctx, { model, providerId: override }, saved);
+
+  const settings = { ...(ctx.providerSettings(target.providerId) ?? {}), apiKey: ctx.apiKeyFor(target.providerId) };
+  // `providerSettings` no trae el baseUrl de los proveedores builtin (lo resuelve
+  // el runtime), asi que resolvemos como lo hace el agente. `apiRoot` recorta el
+  // sufijo de endpoint si el usuario pego la URL completa como baseUrl.
+  const resolved = ctx.resolveProvider?.(settings)?.config ?? {};
+  const baseUrl = apiRoot(settings.baseUrl || resolved.baseUrl || '');
+  const apiKey = settings.apiKey || resolved.apiKey || '';
+  if (!baseUrl) throw new Error(`el proveedor "${target.providerId}" no tiene baseUrl para generar imágenes`);
+
+  const buffer = target.viaChat
+    ? await viaChatImage(baseUrl, apiKey, { model: target.model, prompt, signal })
+    : await viaImagesApi(baseUrl, apiKey, { model: target.model, prompt, size, signal });
+  if (!buffer?.length) throw new Error('el proveedor no devolvió una imagen');
+  const info = imageInfo(buffer);
+  if (!info) throw new Error('el proveedor devolvió un formato de imagen desconocido');
+
+  const dir = screenshotsDir();
+  await mkdir(dir, { recursive: true });
+  const name = `gen-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${info.ext}`;
+  await writeFile(path.join(dir, name), buffer);
+  return { name, bytes: buffer.length, width: info.width, height: info.height, model: target.model };
+}

package/harness/packages/server/src/lib/scheduler.js

@@ -12,6 +12,7 @@ import {
   toolResultPayload,
 } from './agentRun.js';
 import { createSubagentTool } from './tasks.js';
+import { generateImage } from './imagegen.js';
 import { createRulesInjector } from './rules.js';
 import { enabledAgents } from './agents.js';
 
@@ -65,6 +66,7 @@ async function runAgentSchedule(ctx, schedule) {
     mcpMode: ctx.effectiveMcpMode(),
     mcpPinned: ctx.effectiveMcpPinned(),
     signal,
+    onImage: (req) => generateImage(ctx, req),
   });
   const exposeAdmin = !mode.tools;
   const admin = ctx.agentTools;

package/harness/packages/server/src/lib/securityHeaders.js

@@ -10,7 +10,7 @@ export const CSP_DIRECTIVES = {
   'script-src': ["'self'"],
   'style-src': ["'self'", "'unsafe-inline'", FONTS_CSS],
   'font-src': ["'self'", FONTS_FILES, 'data:'],
-  'img-src': ["'self'", 'data:', 'blob:'],
+  'img-src': ["'self'", 'data:', 'blob:', 'http:', 'https:'],
   'media-src': ["'self'", 'blob:', 'data:'],
   'connect-src': ["'self'"],
   // La pestaña preview embebe el dev server del usuario (local o por tunel).

package/harness/packages/server/src/lib/tasks.js

@@ -8,6 +8,7 @@
 
 import { runAgent, createTools, resolveMode, normalizeEffort, buildSubagentPrompt } from './core.js';
 import { toolCallPayload, toolResultPayload } from './agentRun.js';
+import { generateImage } from './imagegen.js';
 import { skillsBlockFor } from './skills.js';
 
 function definition(name, description, parameters, required = []) {
@@ -127,6 +128,7 @@ export function createSubagentTool(ctx, options) {
       mcpMode,
       mcpPinned,
       signal,
+      onImage: (req) => generateImage(ctx, req),
     });
     // Un subagente con skills declaradas ve solo esas skills (arbol de contexto
     // acotado); sin declaracion hereda el bloque general.

package/harness/packages/server/src/lib/transcribe.js

@@ -2,6 +2,8 @@
 // consola (microfono en el input). Usa el endpoint OpenAI-compatible
 // `/audio/transcriptions` del proveedor (OpenAI, Groq, ...).
 
+import { apiRoot } from './core.js';
+
 export const DEFAULT_TRANSCRIBE_MODEL = 'whisper-1';
 
 /** Detalle legible del error del proveedor (OpenAI/Groq devuelven `{error:{message}}`). */
@@ -24,7 +26,7 @@ export async function transcribeAudio(
   // `providerSettings` no trae el baseUrl de los proveedores builtin (lo resuelve
   // el runtime), asi que resolvemos como lo hace el agente.
   const resolved = ctx.resolveProvider?.(settings)?.config ?? {};
-  const baseUrl = String(settings.baseUrl || resolved.baseUrl || '').replace(/\/+$/, '');
+  const baseUrl = apiRoot(settings.baseUrl || resolved.baseUrl || '');
   const apiKey = settings.apiKey || resolved.apiKey || '';
   if (!baseUrl) throw new Error(`el proveedor "${id}" no tiene baseUrl para transcribir`);
   const form = new FormData();

package/harness/packages/server/src/lib/ttsEngine.js

@@ -0,0 +1,69 @@
+// Sintesis de voz con eleccion de motor: si el modelo del chat sabe hablar
+// (familia tts, o el ajuste `app.json` -> `tts.model`), se usa el endpoint
+// OpenAI-compatible `POST /audio/speech` del proveedor; si no (o si falla), cae
+// a Edge Read Aloud (gratis, sin API key) como siempre.
+
+import { apiRoot, modelCapabilities, sintetizar } from './core.js';
+
+/** '+10%' / '1.25' -> 1.1 / 1.25, default 1. */
+function speedFromRate(rate) {
+  const text = String(rate ?? '').trim();
+  const pct = /^([+-]?\d+)%$/.exec(text);
+  if (pct) return Math.min(4, Math.max(0.25, 1 + Number(pct[1]) / 100));
+  const n = Number(text);
+  return Number.isFinite(n) && n > 0 ? Math.min(4, Math.max(0.25, n)) : 1;
+}
+
+/** Modelo TTS efectivo: ajuste propio -> el modelo del chat si habla -> null (Edge). */
+export function ttsModelFor(ctx) {
+  const saved = ctx.app?.tts && typeof ctx.app.tts === 'object' ? ctx.app.tts : {};
+  const explicit = String(saved.model ?? '').trim();
+  if (explicit) return explicit;
+  const active = String(ctx.effectiveModel?.() ?? '').trim();
+  return active && modelCapabilities(active).tts ? active : null;
+}
+
+async function providerSpeech(ctx, model, texto, { voice, rate, signal } = {}) {
+  const id = ctx.effectiveProviderId?.();
+  const settings = { ...(ctx.providerSettings(id) ?? {}), apiKey: ctx.apiKeyFor(id) };
+  const resolved = ctx.resolveProvider?.(settings)?.config ?? {};
+  const baseUrl = apiRoot(settings.baseUrl || resolved.baseUrl || '');
+  const apiKey = settings.apiKey || resolved.apiKey || '';
+  if (!baseUrl) throw new Error(`el proveedor "${id}" no tiene baseUrl para sintetizar`);
+  const speak = (v) =>
+    fetch(`${baseUrl}/audio/speech`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+      },
+      body: JSON.stringify({ model, input: texto, voice: v || 'alloy', speed: speedFromRate(rate), response_format: 'mp3' }),
+      signal,
+    });
+  // Las voces de Edge no existen en el proveedor: si rechaza la voz, una
+  // segunda chance con la default antes de caer a Edge entero.
+  let res = await speak(voice);
+  if (!res.ok && voice && voice !== 'alloy') res = await speak('alloy');
+  if (!res.ok) {
+    const detail = String((await res.text().catch(() => '')) ?? '').replace(/\s+/g, ' ').trim().slice(0, 200);
+    throw new Error(`audio/speech falló (HTTP ${res.status})${detail ? `: ${detail}` : ''}`);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+/**
+ * Sintetiza voz y devuelve el MP3: proveedor del chat si el modelo habla,
+ * Edge como fallback (tambien cuando el proveedor falla).
+ */
+export async function sintetizarVoz(ctx, texto, opciones = {}) {
+  const model = ttsModelFor(ctx);
+  if (model) {
+    try {
+      return await providerSpeech(ctx, model, texto, opciones);
+    } catch (error) {
+      if (opciones.signal?.aborted) throw error;
+      console.error(`[tts] el proveedor no pudo sintetizar (${error?.message ?? error}); cae a Edge`);
+    }
+  }
+  return sintetizar(texto, opciones);
+}

package/harness/packages/server/src/routes/chat.js

@@ -9,6 +9,7 @@ import {
 import { openSse, readJson, sendJson, sendError } from '../lib/http.js';
 import { workspaceForRequest, resolveExistingDir, localOk } from '../lib/workspace.js';
 import { createSubagentTool } from '../lib/tasks.js';
+import { generateImage } from '../lib/imagegen.js';
 import { enabledAgents } from '../lib/agents.js';
 import {
   combineToolset,
@@ -264,6 +265,7 @@ export function registerChat(route, ctx) {
       mcpMode: ctx.effectiveMcpMode(),
       mcpPinned: ctx.effectiveMcpPinned(),
       signal: ctx.runs.signal(sessionId),
+      onImage: (req) => generateImage(ctx, req),
     });
     // En modo plan (solo lectura) no exponemos las tools de administración.
     const exposeAdmin = !mode.tools;

package/harness/packages/server/src/routes/files.js

@@ -145,14 +145,16 @@ export function registerFiles(route, ctx) {
     });
   });
 
-  // Capturas del tool `screenshot`: viven en la casa, no en el workspace.
+  // Imagenes de la casa: capturas del tool `screenshot` e imagenes generadas
+  // (`generate_image`). No viven en el workspace.
   route('GET', '/api/screenshots/:name', ({ req, res, params }) => {
     const local = localOk(req);
     if (!local && !ctx.authEnabled) {
       return sendError(res, 403, 'Las capturas solo están disponibles en conexiones locales.');
     }
     const name = String(params.name ?? '');
-    if (!/^[a-z0-9][a-z0-9-]*\.png$/i.test(name)) return sendError(res, 400, 'Nombre de captura inválido.');
+    const match = /^([a-z0-9][a-z0-9-]*)\.(png|jpe?g|webp|gif)$/i.exec(name);
+    if (!match) return sendError(res, 400, 'Nombre de captura inválido.');
     const file = path.join(screenshotsDir(), name);
     let info;
     try {
@@ -161,7 +163,10 @@ export function registerFiles(route, ctx) {
       return sendError(res, 404, 'La captura no existe.');
     }
     if (!info.isFile()) return sendError(res, 404, 'La captura no existe.');
-    res.writeHead(200, { 'Content-Type': 'image/png', 'Content-Length': info.size, 'Cache-Control': 'no-store' });
+    const mime = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif' }[
+      match[2].toLowerCase()
+    ];
+    res.writeHead(200, { 'Content-Type': mime, 'Content-Length': info.size, 'Cache-Control': 'no-store' });
     if (req.method === 'HEAD') {
       res.end();
       return;

package/harness/packages/server/src/routes/imagegen.js

@@ -0,0 +1,35 @@
+// Ajustes de generacion de imagenes (`app.json` -> `imageGen`). No hay UI todavia:
+// se configuran por aca (o editando app.json) igual que los de transcripcion.
+// El proveedor/modelo efectivos tienen fallback al proveedor activo.
+
+import { readApp, writeApp } from '../lib/core.js';
+import { readJson, sendJson } from '../lib/http.js';
+import { DEFAULT_IMAGE_MODEL, DEFAULT_IMAGE_SIZE } from '../lib/imagegen.js';
+
+function settingsView(app) {
+  const saved = app.imageGen && typeof app.imageGen === 'object' ? app.imageGen : {};
+  return {
+    provider: String(saved.provider ?? ''),
+    model: String(saved.model ?? ''),
+    size: String(saved.size ?? '') || DEFAULT_IMAGE_SIZE,
+  };
+}
+
+export function registerImageGen(route, ctx) {
+  route('GET', '/api/imagegen/settings', ({ res }) => {
+    sendJson(res, 200, settingsView(ctx.app));
+  });
+
+  route('PUT', '/api/imagegen/settings', async ({ req, res }) => {
+    const body = await readJson(req);
+    const app = readApp();
+    const next = { ...(app.imageGen ?? {}) };
+    if ('provider' in body) next.provider = String(body.provider ?? '').trim();
+    if ('model' in body) next.model = String(body.model ?? '').trim() || DEFAULT_IMAGE_MODEL;
+    if ('size' in body) next.size = String(body.size ?? '').trim() || DEFAULT_IMAGE_SIZE;
+    app.imageGen = next;
+    writeApp(app);
+    ctx.app = app;
+    sendJson(res, 200, settingsView(app));
+  });
+}

package/harness/packages/server/src/routes/models.js

@@ -9,7 +9,8 @@ export function registerModels(route, ctx) {
     const providerId = query.get('provider') || ctx.effectiveProviderId();
     const settings = { ...ctx.providerSettings(providerId), apiKey: ctx.apiKeyFor(providerId) };
     if (query.get('baseUrl')) settings.baseUrl = query.get('baseUrl');
-    const key = [providerId, settings.baseUrl ?? '', (settings.models ?? []).join(',')].join('|');
+    const manual = settings.providerModels?.[providerId] ?? [];
+    const key = [providerId, settings.baseUrl ?? '', manual.join(',')].join('|');
 
     try {
       const { models, cached, stale } = await modelCache.get(key, () => listProviderModels(settings));

package/harness/packages/server/src/routes/tts.js

@@ -2,10 +2,11 @@
 // app.json (la casa). La config no necesita recarga: cada consumidor la lee
 // cuando va a hablar.
 
-import { sintetizar, listarVoces, MAX_TEXTO } from '../lib/core.js';
+import { listarVoces, MAX_TEXTO } from '../lib/core.js';
 import { readApp, writeApp } from '../lib/core.js';
 import { ffmpegDisponible } from '../lib/ffmpeg.js';
 import { resolveTts, sanearVoz, sanearRate, sanearPitch } from '../lib/ttsSettings.js';
+import { sintetizarVoz } from '../lib/ttsEngine.js';
 import { sendJson, sendError, readJson } from '../lib/http.js';
 
 const cacheVoces = { at: 0, data: null, filtro: 'es-' };
@@ -38,6 +39,7 @@ export function registerTts(route, ctx) {
     if ('voice' in body) next.voice = sanearVoz(body.voice, actual.voice);
     if ('rate' in body) next.rate = sanearRate(body.rate, actual.rate);
     if ('pitch' in body) next.pitch = sanearPitch(body.pitch, actual.pitch);
+    if ('model' in body) next.model = String(body.model ?? '').trim();
     if (body.announce && typeof body.announce === 'object') {
       const announce = { ...actual.announce };
       for (const key of ['start', 'tools', 'end', 'answer']) {
@@ -71,7 +73,7 @@ export function registerTts(route, ctx) {
     const rate = sanearRate(query.get('rate'), config.rate);
     const pitch = sanearPitch(query.get('pitch'), config.pitch);
     try {
-      const mp3 = await sintetizar(texto, { voice: voz, rate, pitch });
+      const mp3 = await sintetizarVoz(ctx, texto, { voice: voz, rate, pitch });
       res.writeHead(200, {
         'Content-Type': 'audio/mpeg',
         'Content-Length': mp3.length,