@danieltmn/tamnora 0.26.0 → 0.27.0

package/harness/packages/server/src/server.js

@@ -50,6 +50,7 @@ import { registerChannels } from './routes/channels.js';
 import { registerProfile } from './routes/profile.js';
 import { registerTts } from './routes/tts.js';
 import { registerTranscribe } from './routes/transcribe.js';
+import { registerImageGen } from './routes/imagegen.js';
 import { registerUpdate } from './routes/update.js';
 import { registerReload } from './routes/reload.js';
 import { registerProcs } from './routes/procs.js';
@@ -336,6 +337,7 @@ export async function createTamnoraServer({
   registerProfile(route, ctx);
   registerTts(route, ctx);
   registerTranscribe(route, ctx);
+  registerImageGen(route, ctx);
   registerUpdate(route, ctx);
   registerReload(route, ctx);
   registerProcs(route, ctx);

package/harness/packages/server/test/chart.test.js

@@ -0,0 +1,70 @@
+// Graficos SVG de la tool `show_chart`: estructura, datos y escape de markup.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { normalizeChart, renderChart } from '../public/chart.js';
+
+const SALES = {
+  title: 'Ventas',
+  type: 'bar',
+  unit: 'USD',
+  labels: ['Ene', 'Feb', 'Mar'],
+  series: [
+    { name: '2024', values: [10, 22, 18] },
+    { name: '2025', values: [14, 20, 30] },
+  ],
+};
+
+test('normalizeChart alinea labels y series y descarta lo invalido', () => {
+  const spec = normalizeChart(SALES);
+  assert.equal(spec.labels.length, 3);
+  assert.equal(spec.series.length, 2);
+  assert.deepEqual(spec.series[0].values, [10, 22, 18]);
+
+  const padded = normalizeChart({ labels: ['a', 'b'], series: [{ values: [1] }] });
+  assert.deepEqual(padded.series[0].values, [1, 0]);
+
+  assert.equal(normalizeChart({ labels: [], series: [{ values: [1] }] }), null);
+  assert.equal(normalizeChart({ labels: ['a'], series: [] }), null);
+  assert.equal(normalizeChart({ type: 'pie', labels: ['a'], series: [{ values: [-1] }] }), null);
+  assert.equal(normalizeChart({ labels: ['a'], series: [{ values: ['x'] }] }).series[0].values[0], 0);
+});
+
+test('renderChart dibuja barras, lineas y torta como SVG', () => {
+  const bar = renderChart(SALES);
+  assert.match(bar, /^<svg class="chart"/);
+  assert.match(bar, /<rect /); // barras
+  assert.match(bar, /<line /); // ejes
+  assert.match(bar, /viewBox="0 0 720 420"/);
+  assert.match(bar, /aria-label="Ventas"/);
+
+  const line = renderChart({ ...SALES, type: 'line' });
+  assert.match(line, /<polyline /);
+  assert.match(line, /<circle /);
+
+  const pie = renderChart({ type: 'pie', labels: ['a', 'b'], series: [{ values: [1, 3] }] });
+  assert.match(pie, /<path /);
+  assert.match(pie, /\(25%\)/);
+  assert.match(pie, /\(75%\)/);
+});
+
+test('renderChart escapa todo lo que viene del modelo', () => {
+  const svg = renderChart({
+    title: '<script>alert(1)</script>',
+    labels: ['"><img src=x onerror=alert(1)>', 'b'],
+    series: [{ name: '<b>x</b>', values: [1, 2] }],
+  });
+  assert.ok(!svg.includes('<script'), svg);
+  assert.ok(!svg.includes('<img'), svg);
+  assert.ok(!svg.includes('<b>'), svg);
+  assert.match(svg, /&lt;script&gt;/);
+
+  assert.equal(renderChart({ labels: [], series: [] }), '');
+  assert.equal(renderChart(null), '');
+});
+
+test('renderChart no se rompe con extremos numericos', () => {
+  const svg = renderChart({ labels: ['a', 'b', 'c'], series: [{ values: [-5, 0, 12.5] }] });
+  assert.match(svg, /<rect /);
+  const pie = renderChart({ type: 'pie', labels: ['único'], series: [{ values: [1] }] });
+  assert.match(pie, /<circle /); // 100% es un circulo, no un arco degenerado
+});

package/harness/packages/server/test/chat.test.js

@@ -481,6 +481,7 @@ test('plan mode exposes only read-only tools and adds guidance', async () => {
       'screenshot',
       'search_mcp',
       'search_skills',
+      'show_chart',
       'show_plan',
       'skill',
       'speak',

package/harness/packages/server/test/chatFormat.test.js

@@ -3,11 +3,11 @@ import assert from 'node:assert/strict';
 import {
   basename,
   formatDuration,
+  imageName,
   isFailedToolText,
   isReadOnlyTool,
   parseToolArgs,
   previewText,
-  screenshotName,
   shortText,
   toolSummary,
   userImages,
@@ -40,6 +40,8 @@ test('toolSummary resume cada tool en una linea corta', () => {
   assert.equal(toolSummary('grep', { pattern: 'foo', path: 'src' }), '"foo" en src');
   assert.equal(toolSummary('git_diff', { staged: true, path: 'a.js' }), 'staged a.js');
   assert.equal(toolSummary('git_log', { limit: 5 }), '5 commits');
+  assert.equal(toolSummary('show_chart', { type: 'pie', labels: ['a', 'b'], title: 'Ventas' }), 'Ventas · torta · 2 datos');
+  assert.equal(toolSummary('generate_image', { prompt: 'un gato astronauta' }), 'un gato astronauta');
   assert.equal(toolSummary('desconocida', {}), '');
 });
 
@@ -57,10 +59,12 @@ test('isFailedToolText detecta errores y permisos denegados', () => {
   assert.ok(!isFailedToolText(undefined));
 });
 
-test('screenshotName sale del meta o del texto del resultado', () => {
-  assert.equal(screenshotName({ meta: { screenshot: { name: 'a.png' } } }, ''), 'a.png');
-  assert.equal(screenshotName({}, 'guardado en capturas/abc-123.png'), 'abc-123.png');
-  assert.equal(screenshotName({}, 'sin captura'), null);
+test('imageName sale del meta (captura o imagen generada) o del texto del resultado', () => {
+  assert.equal(imageName({ meta: { screenshot: { name: 'a.png' } } }, ''), 'a.png');
+  assert.equal(imageName({ meta: { image: { name: 'gen-1-abc.jpg' } } }, ''), 'gen-1-abc.jpg');
+  assert.equal(imageName({}, 'guardado en capturas/abc-123.png'), 'abc-123.png');
+  assert.equal(imageName({}, 'Imagen generada → capturas/gen-9-x.webp (10 KB)'), 'gen-9-x.webp');
+  assert.equal(imageName({}, 'sin captura'), null);
 });
 
 test('previewText trunca por lineas y por caracteres', () => {

package/harness/packages/server/test/imagegen.test.js

@@ -0,0 +1,215 @@
+// Generacion de imagenes: el mismo modelo del chat primero (chat con salida de
+// imagen o endpoint /images/generations), imageGen como fallback. Todo contra un
+// proveedor stub de node:http: no se llama a ningun servicio real.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { mkdtemp, readFile, readdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { setHome, screenshotsDir } from '../../core/src/index.js';
+import { generateImage } from '../src/lib/imagegen.js';
+
+// 1x1 PNG real (magic bytes que `imageInfo` reconoce).
+const PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==',
+  'base64'
+);
+
+function stubProvider(handler) {
+  const calls = [];
+  const server = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (chunk) => (body += chunk));
+    req.on('end', () => {
+      calls.push({ url: req.url, body: body ? JSON.parse(body) : null });
+      handler(req.url, body, res);
+    });
+  });
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve({ calls, base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() });
+    });
+  });
+}
+
+function fakeCtx({ baseUrl, model = '', app = {}, providerId = 'stub' }) {
+  return {
+    app,
+    effectiveModel: () => model,
+    effectiveProviderId: () => providerId,
+    providerSettings: () => ({ baseUrl, apiKey: 'k' }),
+    apiKeyFor: () => 'k',
+    resolveProvider: () => ({ config: {} }),
+  };
+}
+
+const home = await mkdtemp(path.join(tmpdir(), 'tamnora-img-'));
+setHome(home);
+
+test('el modelo del chat con salida de imagen genera por chat', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    assert.equal(url, '/chat/completions');
+    res.end(
+      JSON.stringify({
+        choices: [
+          { message: { content: 'listo', images: [{ type: 'image_url', image_url: { url: `data:image/png;base64,${PNG.toString('base64')}` } }] } },
+        ],
+      })
+    );
+  });
+  try {
+    const out = await generateImage(fakeCtx({ baseUrl: stub.base, model: 'gemini-2.5-flash-image-preview' }), {
+      prompt: 'un gato',
+    });
+    assert.match(out.name, /^gen-.*\.png$/);
+    assert.equal(out.model, 'gemini-2.5-flash-image-preview');
+    assert.equal(stub.calls.length, 1);
+    assert.deepEqual(stub.calls[0].body.modalities, ['text', 'image']);
+    const saved = await readFile(path.join(screenshotsDir(), out.name));
+    assert.deepEqual(saved, PNG);
+  } finally {
+    stub.close();
+  }
+});
+
+test('una familia tipo dall-e usa /images/generations con el modelo del chat', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    assert.equal(url, '/images/generations');
+    res.end(JSON.stringify({ data: [{ b64_json: PNG.toString('base64') }] }));
+  });
+  try {
+    const out = await generateImage(fakeCtx({ baseUrl: stub.base, model: 'gpt-image-1' }), { prompt: 'un perro', size: '512x512' });
+    assert.match(out.name, /\.png$/);
+    assert.equal(stub.calls[0].body.model, 'gpt-image-1');
+    assert.equal(stub.calls[0].body.size, '512x512');
+  } finally {
+    stub.close();
+  }
+});
+
+test('sin capacidad en el modelo del chat cae al ajuste imageGen', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    assert.equal(url, '/images/generations');
+    res.end(JSON.stringify({ data: [{ b64_json: PNG.toString('base64') }] }));
+  });
+  try {
+    const ctx = fakeCtx({
+      baseUrl: stub.base,
+      model: 'deepseek-chat',
+      app: { imageGen: { model: 'dall-e-3' } },
+    });
+    const out = await generateImage(ctx, { prompt: 'una casa' });
+    assert.match(out.name, /\.png$/);
+    assert.equal(stub.calls[0].body.model, 'dall-e-3');
+  } finally {
+    stub.close();
+  }
+});
+
+test('el modelo explicito de la tool manda y los errores se propagan', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    res.statusCode = 402;
+    res.end(JSON.stringify({ error: { message: 'sin creditos' } }));
+  });
+  try {
+    await assert.rejects(
+      () => generateImage(fakeCtx({ baseUrl: stub.base, model: 'gemini-2.5-flash-image-preview' }), { prompt: 'x', model: 'dall-e-3' }),
+      /402.*sin creditos/
+    );
+    assert.equal(stub.calls[0].url, '/images/generations');
+  } finally {
+    stub.close();
+  }
+
+  // Un chat sin parte de imagen no es un "si" silencioso.
+  const stub2 = await stubProvider((url, _body, res) => {
+    res.end(JSON.stringify({ choices: [{ message: { content: 'no puedo' } }] }));
+  });
+  try {
+    await assert.rejects(
+      () => generateImage(fakeCtx({ baseUrl: stub2.base, model: 'gemini-2.5-flash-image-preview' }), { prompt: 'x' }),
+      /no devolvió una imagen/
+    );
+  } finally {
+    stub2.close();
+  }
+
+  // La imagen generada vive en la casa, no en el workspace.
+  const names = await readdir(screenshotsDir());
+  assert.ok(names.every((n) => /^gen-/.test(n)), names.join(','));
+});
+
+test('un baseUrl con el endpoint completo pegado no arma rutas duplicadas', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    res.end(JSON.stringify({ data: [{ b64_json: PNG.toString('base64') }] }));
+  });
+  try {
+    // El usuario pego "https://.../v1/chat/completions" como baseUrl del proveedor.
+    const out = await generateImage(fakeCtx({ baseUrl: `${stub.base}/chat/completions`, model: 'gpt-image-1' }), {
+      prompt: 'un perro',
+    });
+    assert.match(out.name, /\.png$/);
+    assert.equal(stub.calls[0].url, '/images/generations');
+  } finally {
+    stub.close();
+  }
+});
+
+test('imageGen con modelo de salida de imagen genera por chat, no por endpoint', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    assert.equal(url, '/chat/completions');
+    res.end(
+      JSON.stringify({
+        choices: [{ message: { content: '', images: [{ type: 'image_url', image_url: { url: `data:image/png;base64,${PNG.toString('base64')}` } }] } }],
+      })
+    );
+  });
+  try {
+    const ctx = fakeCtx({
+      baseUrl: stub.base,
+      model: 'deepseek-chat',
+      app: { imageGen: { model: 'google/gemini-2.5-flash-image' } },
+    });
+    const out = await generateImage(ctx, { prompt: 'una casa' });
+    assert.match(out.name, /\.png$/);
+    assert.equal(stub.calls[0].body.model, 'google/gemini-2.5-flash-image');
+    assert.deepEqual(stub.calls[0].body.modalities, ['text', 'image']);
+  } finally {
+    stub.close();
+  }
+});
+
+test('sin ajuste imageGen, openrouter cae en su default por chat', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    assert.equal(url, '/chat/completions');
+    res.end(
+      JSON.stringify({
+        choices: [{ message: { content: '', images: [{ type: 'image_url', image_url: { url: `data:image/png;base64,${PNG.toString('base64')}` } }] } }],
+      })
+    );
+  });
+  try {
+    const ctx = fakeCtx({ baseUrl: stub.base, model: 'deepseek-chat', providerId: 'openrouter' });
+    const out = await generateImage(ctx, { prompt: 'un gato' });
+    assert.match(out.name, /\.png$/);
+    assert.equal(stub.calls[0].body.model, 'google/gemini-2.5-flash-image');
+  } finally {
+    stub.close();
+  }
+});
+
+test('un error del proveedor muestra la URL intentada', async () => {
+  const stub = await stubProvider((url, _body, res) => {
+    res.statusCode = 404;
+    res.end(JSON.stringify({ error: { message: 'Not Found' } }));
+  });
+  try {
+    await assert.rejects(
+      () => generateImage(fakeCtx({ baseUrl: stub.base, model: 'dall-e-3' }), { prompt: 'x' }),
+      new RegExp(`404.*en http://127\\.0\\.0\\.1:${stub.base.split(':').pop()}/images/generations`)
+    );
+  } finally {
+    stub.close();
+  }
+});

package/harness/packages/server/test/markdown.test.js

@@ -31,6 +31,26 @@ test('only allows http(s) links', () => {
   assert.ok(!renderMarkdown('[x](javascript:alert(1))').includes('<a '));
 });
 
+test('renders markdown images inline from safe sources', () => {
+  const html = renderMarkdown('![un gato](https://a.com/gato.png)');
+  assert.match(html, /<img class="md-img" src="https:\/\/a\.com\/gato\.png" alt="un gato" loading="lazy" referrerpolicy="no-referrer">/);
+
+  assert.match(renderMarkdown('![x](capturas/abc-123.png)'), /src="capturas\/abc-123\.png"/);
+  assert.match(renderMarkdown('![x](/api/screenshots/a.png)'), /src="\/api\/screenshots\/a\.png"/);
+  assert.match(
+    renderMarkdown('![x](data:image/png;base64,iVBORw0KGgo=)'),
+    /src="data:image\/png;base64,iVBORw0KGgo="/
+  );
+
+  // El alt con codigo inline se restaura a texto plano (sin markup en el atributo).
+  const alt = renderMarkdown('![a `c` b](https://a.com/i.png)');
+  assert.match(alt, /alt="a c b"/);
+
+  // Fuente insegura: queda el texto literal, sin <img>.
+  assert.ok(!renderMarkdown('![x](javascript:alert(1))').includes('<img'));
+  assert.ok(!renderMarkdown('![x](data:text/html,x))').includes('<img'));
+});
+
 test('renders pipe tables with alignment and stops at the next block', () => {
   const md = [
     '| Archivo | Qué es | Centro | Derecha |',

package/harness/packages/server/test/markdownSecurity.test.js

@@ -61,6 +61,31 @@ test('los enlaces solo salen para http(s) y no se pueden salir del atributo href
   }
 });
 
+test('las imagenes markdown no se pueden usar para inyectar atributos ni fuentes peligrosas', () => {
+  for (const url of [
+    'javascript:alert(1)',
+    'JaVaScRiPt:alert(1)',
+    'data:text/html,<script>alert(1)</script>',
+    'vbscript:x',
+    '//evil.com/x.png',
+    'file:///etc/passwd',
+  ]) {
+    const html = renderMarkdown(`![x](${url})`);
+    assert.ok(!/<img\b/i.test(html), `no deberia haber imagen para ${url}: ${html}`);
+  }
+
+  // La fuente no se puede salir del atributo src.
+  const html = renderMarkdown('![x](https://a.com/"onmouseover="alert(1))');
+  assert.ok(!/\sonmouseover\s*=/i.test(html), `el atributo se escapo del src: ${html}`);
+  const imgs = html.match(/<img\b[^>]*>/g) ?? [];
+  assert.equal(imgs.length, 1, html);
+  for (const img of imgs) {
+    const attrs = [...img.matchAll(/\s([a-z-]+)=/gi)].map((m) => m[1]).sort();
+    assert.deepEqual(attrs, ['alt', 'class', 'loading', 'referrerpolicy', 'src'], img);
+    assert.ok(!/\son\w+\s*=/i.test(img), img);
+  }
+});
+
 test('el nombre del lenguaje del fence no se interpreta como HTML', () => {
   const html = renderMarkdown('```<img src=x onerror=alert(1)>\ncodigo\n```');
   assert.ok(!/<img\b/i.test(html), html);

package/harness/packages/server/test/modelsQuery.test.js

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { matchModel, filterModels, pickVisible } from '../public/modelsQuery.js';
+import { matchModel, filterModels, pickVisible, capabilityTags, applyView } from '../public/modelsQuery.js';
 
 const CATALOG = [
   { id: 'z-ai/glm-5.3', label: 'Z.ai: GLM 5.3' },
@@ -74,3 +74,27 @@ test('pickVisible: catalogo vacio o no-array → []', () => {
   assert.deepEqual(pickVisible(null, ['a']), []);
   assert.deepEqual(pickVisible(undefined, ['a']), []);
 });
+
+test('capabilityTags y la busqueda por capacidades', () => {
+  const model = { id: 'x', label: 'X', capabilities: { vision: true, image: true, tools: true } };
+  assert.deepEqual(capabilityTags(model.capabilities), ['visión', 'imagen', 'tools']);
+  assert.deepEqual(capabilityTags(undefined), []);
+  assert.equal(matchModel('imagen', model), true);
+  assert.equal(matchModel('visión', model), true);
+  assert.equal(matchModel('video', model), false);
+  assert.equal(matchModel('imagen vision', model), true);
+});
+
+test('applyView: todos, gratis y seleccionados', () => {
+  const models = [
+    { id: 'a', free: true },
+    { id: 'b', free: false },
+    { id: 'c', free: true },
+  ];
+  assert.deepEqual(applyView('all', models, ['b']).map((m) => m.id), ['a', 'b', 'c']);
+  assert.deepEqual(applyView('free', models, []).map((m) => m.id), ['a', 'c']);
+  assert.deepEqual(applyView('selected', models, ['b', 'c']).map((m) => m.id), ['b', 'c']);
+  assert.deepEqual(applyView('selected', models, new Set(['a'])).map((m) => m.id), ['a']);
+  assert.deepEqual(applyView('selected', models, []), []);
+  assert.deepEqual(applyView('all', null), []);
+});

package/harness/packages/server/test/securityHeaders.test.js

@@ -40,6 +40,7 @@ test('la CSP deja pasar lo que la consola necesita: preview embebido y fuentes',
   assert.match(csp, /style-src [^;]*https:\/\/fonts\.googleapis\.com/);
   assert.match(csp, /font-src [^;]*https:\/\/fonts\.gstatic\.com/);
   assert.match(csp, /img-src [^;]*data: blob:/);
+  assert.match(csp, /img-src [^;]*https?:/);
   assert.match(csp, /media-src [^;]*blob:/);
   assert.match(csp, /connect-src 'self'(;|$)/);
 });

package/harness/packages/server/test/ttsEngine.test.js

@@ -0,0 +1,58 @@
+// Motor de voz: el proveedor del chat si el modelo habla (POST /audio/speech),
+// Edge como fallback. Contra un proveedor stub: no se llama a ningun servicio.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { ttsModelFor, sintetizarVoz } from '../src/lib/ttsEngine.js';
+
+function fakeCtx({ model = '', app = {}, base = '' } = {}) {
+  return {
+    app,
+    effectiveModel: () => model,
+    effectiveProviderId: () => 'stub',
+    providerSettings: () => ({ baseUrl: base, apiKey: 'k' }),
+    apiKeyFor: () => 'k',
+    resolveProvider: () => ({ config: {} }),
+  };
+}
+
+test('ttsModelFor: ajuste propio -> modelo del chat si habla -> null (Edge)', () => {
+  assert.equal(ttsModelFor(fakeCtx({ model: 'deepseek-chat', app: { tts: { model: 'tts-1' } } })), 'tts-1');
+  assert.equal(ttsModelFor(fakeCtx({ model: 'gpt-4o-mini-tts' })), 'gpt-4o-mini-tts');
+  assert.equal(ttsModelFor(fakeCtx({ model: 'deepseek-chat' })), null);
+});
+
+test('sintetizarVoz usa /audio/speech y reintenta con la voz default del proveedor', async () => {
+  const calls = [];
+  const server = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (chunk) => (body += chunk));
+    req.on('end', () => {
+      const parsed = JSON.parse(body);
+      calls.push(parsed);
+      if (parsed.voice !== 'alloy') {
+        res.statusCode = 400;
+        res.end(JSON.stringify({ error: { message: 'voz desconocida' } }));
+        return;
+      }
+      res.end(Buffer.from('MP3'));
+    });
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const mp3 = await sintetizarVoz(fakeCtx({ base, model: 'gpt-4o-mini-tts' }), 'hola', {
+      voice: 'es-AR-ElenaNeural',
+      rate: '+10%',
+    });
+    assert.equal(mp3.toString(), 'MP3');
+    assert.equal(calls.length, 2);
+    assert.equal(calls[0].voice, 'es-AR-ElenaNeural');
+    assert.equal(calls[1].voice, 'alloy');
+    assert.equal(calls[0].speed, 1.1);
+    assert.equal(calls[0].input, 'hola');
+    assert.equal(calls[0].model, 'gpt-4o-mini-tts');
+  } finally {
+    server.close();
+  }
+});

package/harness/scripts/self-update.mjs

@@ -106,7 +106,7 @@ async function main() {
     return;
   }
 
-  const args = [bin, 'server', '--stream', '--no-open'];
+  const args = [bin, 'server', '--stream'];
   if (port) args.push('--port', port);
   if (host) args.push('--host', host);
   if (cwd) args.push('--dir', cwd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Harness local para IAs: agente CLI-first con TUI y consola web. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",