fix(seguridad): lockfile en sync, fuera localtunnel, receptores en loopback, tests en CI

.github/workflows/ci.yml

@@ -40,3 +40,22 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
+
+  test:
+    name: Tests
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      # npm ci runs postinstall (electron-rebuild), so node-pty is built for the
+      # tests that spawn real PTYs; the build gives start.sh --check its bundle.
+      - run: npm ci
+      - run: npm run build
+      - name: Focused tests
+        run: npm run test:focused
+      # proveedor.test.cjs is left out: it prompts for sudo and hangs headless.
+      - name: munder CLI tests
+        run: node --test tools/munder/link.test.cjs tools/munder/avatar.test.cjs

package.json

@@ -49,7 +49,6 @@
     "commit-graph": "^2.4.0",
     "electron-updater": "^6.8.9",
     "i18next": "^26.3.6",
-    "localtunnel": "^2.0.2",
     "monaco-editor": "^0.52.2",
     "node-pty": "^1.0.0",
     "pixi.js": "^8.5.1",
@@ -66,7 +65,6 @@
     "@electron/notarize": "^2.5.0",
     "@electron/rebuild": "^3.7.0",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/localtunnel": "^2.0.4",
     "@types/node": "^22.7.5",
     "@types/react": "^18.3.11",
     "@types/react-dom": "^18.3.0",

src/main/slack.ts

@@ -176,7 +176,9 @@ export class SlackWebhookServer {
       const server = createServer((req, res) => this.handleRequest(req, res));
       const onError = (e: Error): void => reject(e);
       server.once('error', onError);
-      server.listen(this.port, () => {
+      // Loopback only: tunnelmole forwards to localhost, so nothing else needs
+      // to reach this port. Binding every interface exposed it to the LAN too.
+      server.listen(this.port, '127.0.0.1', () => {
         server.off('error', onError);
         this.server = server;
         resolve();

src/main/webhook.ts

@@ -241,7 +241,9 @@ export class WebhookServer {
       const server = createServer((req, res) => this.handleRequest(req, res));
       const onError = (e: Error): void => reject(e);
       server.once('error', onError);
-      server.listen(this.port, () => {
+      // Loopback only: tunnelmole forwards to localhost, so nothing else needs
+      // to reach this port. Binding every interface exposed it to the LAN too.
+      server.listen(this.port, '127.0.0.1', () => {
         server.off('error', onError);
         this.server = server;
         resolve();

test/public-listeners-loopback.test.cjs

@@ -0,0 +1,42 @@
+'use strict';
+
+/**
+ * The webhook and Slack receivers are reached from the internet ONLY through
+ * tunnelmole, which forwards to localhost. Binding every interface also put
+ * them on the LAN, secret-gated but reachable by anyone on the network. Both
+ * must bind loopback. `listen()` is driven directly: `start()` would open a
+ * real tunnel, and a unit test must never reach the network.
+ */
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const loadTs = require('./load-ts.cjs');
+
+const { WebhookServer } = loadTs('src/main/webhook.ts');
+const { SlackWebhookServer } = loadTs('src/main/slack.ts');
+
+async function boundAddress(server) {
+  await server.listen();
+  try {
+    return server.server.address();
+  } finally {
+    server.stop();
+  }
+}
+
+test('webhook receiver binds loopback only', async () => {
+  const s = new WebhookServer({
+    port: 0,
+    endpoints: [{ id: 'a', name: 'A', secret: 'x'.repeat(32), schema: '' }],
+    onMessage: () => null,
+    lookupStatus: () => null
+  });
+  const addr = await boundAddress(s);
+  assert.equal(addr.address, '127.0.0.1');
+});
+
+test('Slack receiver binds loopback only', async () => {
+  const s = new SlackWebhookServer({ port: 0, signingSecret: 'secret', onMessage: () => {} });
+  const addr = await boundAddress(s);
+  assert.equal(addr.address, '127.0.0.1');
+});