Release v7.14.15

Voice lists were a single flat set from LITELLM_TTS_VOICES, so picking a
model could leave an incompatible voice selected and the request would
fail at the gateway. Voices are now resolved per model family (Kokoro,
Kitten, Supertonic, Groq Orpheus EN/AR), with a compatibility check that
falls back through user → admin → env → first valid voice. Groq Orpheus
requests also pin response_format to wav.

Also refreshes the cardiac/respiratory auscultation samples, extends the
well-visit component, and fixes the Android launch theme background
(@null → colorPrimary) so the splash does not flash through.

NOTE: this is in-progress work that was already sitting uncommitted in
the working tree; it is committed here as-is so the tree was clean for
the release bump.

docs/api-reference.md

@@ -103,8 +103,7 @@ Authenticate a user. Supports optional TOTP two-factor authentication. On succes
   {
     "email": "string",
     "password": "string",
-    "totpCode": "string (optional, required if 2FA is enabled)",
+    "totpCode": "string (optional, required if 2FA is enabled)"
-    "turnstileToken": "string"
   }
   ```
 - **Response:**

docs/authentication.md

@@ -123,9 +123,23 @@ necessary UX tradeoff over perfect indistinguishability.
 
 ## Turnstile (Cloudflare bot protection)
 
-Applied to `/api/auth/login`, `/register`, `/forgot-password` when
+Applied to `/api/auth/register` and `/api/auth/forgot-password` when
 `TURNSTILE_SECRET_KEY` is set. No-op when unset (dev mode).
 
+`/api/auth/login` is deliberately **not** gated: the widget could not
+reliably complete a challenge inside the Capacitor WebView, which locked
+mobile users out of the app. Login is covered instead by its per-IP rate
+limit (10 / 15 min), the constant-time credential check, and TOTP 2FA.
+
+The two remaining widgets are rendered explicitly (`api.js?render=explicit`)
+the first time their form becomes visible — Turnstile does not reliably
+complete a challenge inside a `display:none` container, and both forms start
+hidden. Tokens are captured from the render callback, not read back out of
+the injected `[name="cf-turnstile-response"]` input.
+
+Note that the site key is currently **hardcoded** in `public/index.html`.
+`TURNSTILE_SITE_KEY` exists in OpenBao but is not read by any code.
+
 ## Encryption at rest
 
 `src/utils/crypto.js` provides AES-256-GCM helpers. Key loaded from

e2e/tests/session-persistence.spec.js

@@ -2,14 +2,15 @@
 // SESSION PERSISTENCE — full logout → login → still on the same
 // tab + same sub-pill.
 //
-// The UI's login form is gated by a Cloudflare Turnstile token
+// The test does a programmatic logout (clear the ped_auth cookie,
-// whose site key is hardcoded in index.html, which can't be
+// same effect server-side as clicking Logout) followed by a fresh
-// completed in the e2e container (Turnstile rejects the non-prod
+// programmatic login. This exercises the same localStorage
-// origin). So the test does a programmatic logout (clear the
+// persistence path a real logout/login would.
-// ped_auth cookie, same effect server-side as clicking Logout)
+//
-// followed by a fresh programmatic login — this exercises the
+// (Historically this was a workaround for the Turnstile challenge on
-// same localStorage persistence path a real logout/login would,
+// the login form, which could not be completed in the e2e container.
-// without depending on the bot challenge.
+// Login is no longer gated, but driving it programmatically keeps
+// the test focused on persistence rather than form mechanics.)
 // ============================================================
 
 const { test, expect, E2E_BASE, loginAs } = require('../fixtures');

mobile/android/app/build.gradle

@@ -9,8 +9,8 @@ android {
         targetSdkVersion rootProject.ext.targetSdkVersion
         // Version values below are overwritten by scripts/release.sh from
         // the root package.json. versionCode auto-increments per release.
-        versionCode 714014
+        versionCode 714015
-        versionName "7.14.14"
+        versionName "7.14.15"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

mobile/android/app/src/main/java/com/pedshub/scribe/MainActivity.java

@@ -15,6 +15,7 @@ import android.print.PrintDocumentAdapter;
 import android.print.PrintManager;
 import android.provider.MediaStore;
 import android.util.Base64;
+import android.webkit.CookieManager;
 import android.webkit.PermissionRequest;
 import android.webkit.WebChromeClient;
 import android.webkit.WebViewClient;
@@ -47,6 +48,9 @@ public class MainActivity extends BridgeActivity {
                     new String[]{ Manifest.permission.RECORD_AUDIO }, MIC_PERMISSION_CODE);
         }
 
+        // Allow the Cloudflare Turnstile iframe to use storage.
+        setupThirdPartyCookies();
+
         // Setup WebView mic permission granting
         setupWebViewPermissions();
 
@@ -60,6 +64,26 @@ public class MainActivity extends BridgeActivity {
         setupFileBridge();
     }
 
+    // ── Third-Party Cookies ────────────────────────────────────
+    //
+    // Android WebView blocks third-party cookies by default (unlike Chrome,
+    // which still allows them for now). Cloudflare Turnstile runs inside a
+    // cross-origin iframe from challenges.cloudflare.com and needs its own
+    // storage to run and persist a challenge — without this the widget
+    // silently stalls or errors and never emits a token, so registration and
+    // password reset are impossible from inside the app.
+    //
+    // This is scoped to our own WebView, which only ever loads the PedScribe
+    // origin (see allowNavigation in capacitor.config.json), so it is not a
+    // general relaxation of the app's cookie policy.
+
+    private void setupThirdPartyCookies() {
+        WebView webView = this.bridge.getWebView();
+        CookieManager cookieManager = CookieManager.getInstance();
+        cookieManager.setAcceptCookie(true);
+        cookieManager.setAcceptThirdPartyCookies(webView, true);
+    }
+
     // ── WebView Microphone Permission ──────────────────────────
 
     private void setupWebViewPermissions() {

mobile/android/app/src/main/res/values/styles.xml

@@ -13,7 +13,7 @@
     <style name="AppTheme.NoActionBar" parent="Theme.AppCompat.DayNight.NoActionBar">
         <item name="windowActionBar">false</item>
         <item name="windowNoTitle">true</item>
-        <item name="android:background">@null</item>
+        <item name="android:background">@color/colorPrimary</item>
         <item name="android:statusBarColor">@color/colorPrimaryDark</item>
         <item name="android:navigationBarColor">@color/colorPrimaryDark</item>
     </style>
@@ -22,4 +22,4 @@
     <style name="AppTheme.NoActionBarLaunch" parent="Theme.SplashScreen">
         <item name="android:background">@drawable/splash</item>
     </style>
-</resources>
+</resources>

mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pedscribe-mobile",
-  "version": "7.14.14",
+  "version": "7.14.15",
   "description": "PedScribe native mobile app — Capacitor wrapper for Pediatric AI Scribe",
   "private": true,
   "scripts": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pediatric-ai-scribe",
-  "version": "7.14.14",
+  "version": "7.14.15",
   "description": "AI-powered pediatric clinical documentation platform",
   "main": "server.js",
   "scripts": {

public/components/wellvisit.html

@@ -11,6 +11,9 @@
           <button class="wv-subtab-btn" data-subtab="milestones">
             <i class="fas fa-baby"></i> Milestones
           </button>
+          <button class="wv-subtab-btn" data-subtab="lincoln">
+            <i class="fas fa-clipboard-list"></i> Lincoln
+          </button>
           <button class="wv-subtab-btn" data-subtab="shadess" style="display:none;">
             <i class="fas fa-brain"></i> SSHADESS (12+)
           </button>
@@ -119,6 +122,65 @@
 
         </div>
 
+        <!-- Lincoln quick-reference sub-panel -->
+        <div id="wv-panel-lincoln" class="wv-subpanel hidden">
+          <div class="card" style="margin-bottom:10px;">
+            <div class="card-header output-header">
+              <h3><i class="fas fa-clipboard-list"></i> Lincoln Well-Child Quick Reference</h3>
+              <div class="output-actions">
+                <button class="btn-sm btn-primary" data-action="copy" data-target="wv-lincoln-reference"><i class="fas fa-copy"></i> Copy</button>
+              </div>
+            </div>
+            <div id="wv-lincoln-reference" class="wv-lincoln-reference">
+              <div class="wv-lincoln-grid">
+                <section class="wv-lincoln-card">
+                  <h4>Infancy</h4>
+                  <ul>
+                    <li><strong>Newborn:</strong> POC visit; check for jaundice.</li>
+                    <li><strong>2 weeks:</strong> weight gain, newborn screen, umbilicus check.</li>
+                    <li><strong>1 month:</strong> maternal PHQ-9.</li>
+                    <li><strong>2 months:</strong> Vaxelis, rotavirus, Prevnar.</li>
+                    <li><strong>4 months:</strong> Vaxelis, rotavirus, Prevnar.</li>
+                    <li><strong>6 months:</strong> routine vaccines and Prevnar; confirm rotavirus eligibility by product and age.</li>
+                    <li><strong>9 months:</strong> SWYC; no routine vaccines noted.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>Toddler / Preschool</h4>
+                  <ul>
+                    <li><strong>12 months:</strong> MMR, varicella, Hep A; CBC and lead.</li>
+                    <li><strong>15 months:</strong> Pentacel, Prevnar, influenza.</li>
+                    <li><strong>18 months:</strong> POSI, SWYC; Hep A second dose.</li>
+                    <li><strong>2 years:</strong> POSI/SWYC; CBC and lead.</li>
+                    <li><strong>3 years:</strong> blood pressure check and vision screening; BP is commonly missed and can be added on diagnosis.</li>
+                    <li><strong>4 years:</strong> hearing and vision start; ProQuad and Kinrix.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>School Age / Adolescence</h4>
+                  <ul>
+                    <li><strong>Lipid screening:</strong> AAP screening at 9-11 years and 17-21 years.</li>
+                    <li><strong>Depression screening:</strong> begin at 12 years and older.</li>
+                    <li><strong>MenB:</strong> discuss Bexsero/MenB at 16-23 years, preferably 16-18 years, when chosen or indicated.</li>
+                    <li><strong>Age &ge;18 years:</strong> Hep C testing.</li>
+                    <li><strong>Cervical cancer screening:</strong> start Pap smear screening at 21 years.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>Catch-Up / Screening Reminders</h4>
+                  <ul>
+                    <li><strong>Influenza:</strong> if a child 6 months through 8 years needs 2 doses, give doses 4 weeks apart.</li>
+                    <li><strong>Lead:</strong> continue lead screening reminders through age 6 years; add diagnosis when needed.</li>
+                  </ul>
+                </section>
+              </div>
+            </div>
+          </div>
+        </div>
+
         <!-- SSHADESS sub-panel (age 12+) -->
         <div id="wv-panel-shadess" class="wv-subpanel hidden">
           <div class="card" style="margin-bottom:10px;">
@@ -305,4 +367,3 @@
             </div>
           </div>
         </div>
-

public/css/styles.css

@@ -397,6 +397,21 @@ textarea.full-input{resize:vertical;}
 .wv-section-title{font-size:14px;font-weight:700;color:var(--g700);margin-bottom:12px;display:flex;align-items:center;gap:8px;}
 .wv-section-title i{color:var(--blue);}
 
+/* Lincoln quick reference */
+.wv-lincoln-reference{padding:14px 16px;background:var(--g50);}
+.wv-lincoln-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:14px;}
+.wv-lincoln-card{border:1px solid var(--g100);border-radius:12px;padding:14px 16px;background:white;box-shadow:0 1px 2px rgba(15,23,42,0.04);}
+.wv-lincoln-card h4{margin:0 0 10px;font-size:14px;color:var(--g800);}
+.wv-lincoln-card ul{margin:0;padding-left:18px;color:var(--g700);font-size:13px;line-height:1.65;}
+.wv-lincoln-card li{margin-bottom:6px;}
+.wv-lincoln-card li:last-child{margin-bottom:0;}
+@media(max-width:640px){
+  .wv-lincoln-reference{padding:10px;}
+  .wv-lincoln-grid{grid-template-columns:1fr;gap:10px;}
+  .wv-lincoln-card{padding:12px;}
+  .wv-lincoln-card ul{font-size:12.5px;line-height:1.55;}
+}
+
 /* Billing */
 .wv-billing-grid{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
 .wv-billing-cell{display:flex;align-items:center;gap:8px;}

public/index.html

@@ -11,7 +11,11 @@
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css"
         integrity="sha384-/o6I2CkkWC//PSjvWC/eYN7l3xM3tJm8ZzVkCOfp//W05QcE3mlGskpoHB6XqI+B" crossorigin="anonymous" referrerpolicy="no-referrer">
-  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+  <!-- Explicit render mode: the register/forgot widgets live inside forms that
+       start hidden, and Turnstile's implicit auto-render does not reliably
+       complete a challenge inside a display:none container. auth.js renders
+       each widget the first time its form is shown. -->
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" async defer></script>
   <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.1.6/purify.min.js"
           integrity="sha384-+VfUPEb0PdtChMwmBcBmykRMDd+v6D/oFmB3rZM/puCMDYcIvF968OimRh4KQY9a"
           crossorigin="anonymous" referrerpolicy="no-referrer" defer></script>
@@ -70,7 +74,6 @@
           <label>2FA Code</label>
           <input type="text" id="login-totp" placeholder="6-digit code" maxlength="6">
         </div>
-        <div class="cf-turnstile" id="turnstile-login" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
         <button type="submit" class="btn-auth" id="btn-local-login">Sign In</button>
         <div id="sso-divider" class="hidden" style="display:none;text-align:center;margin:16px 0 12px;position:relative;">
           <span style="background:white;padding:0 12px;color:#9ca3af;font-size:12px;position:relative;z-index:1;">or</span>
@@ -104,7 +107,7 @@
           <label>Password (8+ characters)</label>
           <input type="password" id="reg-password" required minlength="8" placeholder="••••••••">
         </div>
-        <div class="cf-turnstile" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
+        <div id="turnstile-register" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6"></div>
         <button type="submit" class="btn-auth">Create Account</button>
         <div class="auth-links">
           <a href="#" id="show-login">Back to sign in</a>
@@ -118,7 +121,7 @@
           <label>Email</label>
           <input type="email" id="forgot-email" required placeholder="your@email.com">
         </div>
-        <div class="cf-turnstile" id="turnstile-forgot" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
+        <div id="turnstile-forgot" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6"></div>
         <button type="submit" class="btn-auth">Send Reset Link</button>
         <div class="auth-links">
           <a href="#" id="show-login-2">Back to sign in</a>

public/js/auth.js

@@ -214,6 +214,71 @@ document.addEventListener('DOMContentLoaded', function() {
     }
   }
 
+  // ---- CLOUDFLARE TURNSTILE ----
+  // Gates registration and password reset. Login is deliberately NOT gated:
+  // it is already covered by a 10-per-15-min rate limit and a constant-time
+  // credential check, and the widget is unreliable inside the Capacitor
+  // WebView — which locked mobile users out of the app entirely.
+  //
+  // Tokens are captured from the render callback rather than read back out of
+  // the injected [name="cf-turnstile-response"] input. That lookup is easy to
+  // leave unscoped, which is exactly how the register form ended up
+  // submitting the login widget's token (single-use, 5-minute expiry).
+  //
+  // Rendering is explicit and deferred until the owning form is visible:
+  // both widgets live in forms that start at display:none, and Turnstile does
+  // not reliably complete a challenge inside a hidden container.
+  var turnstileWidgets = {
+    register: { el: 'turnstile-register', id: null, token: '', pending: false },
+    forgot:   { el: 'turnstile-forgot',   id: null, token: '', pending: false }
+  };
+  var turnstileReady = false;
+
+  // api.js?render=explicit invokes this once the Turnstile API is available.
+  window.onloadTurnstileCallback = function() {
+    turnstileReady = true;
+    Object.keys(turnstileWidgets).forEach(function(name) {
+      // Catch up on any form shown before the script finished loading.
+      if (turnstileWidgets[name].pending) renderTurnstile(name);
+    });
+  };
+
+  function renderTurnstile(name) {
+    var w = turnstileWidgets[name];
+    if (!w || w.id !== null) return;            // already rendered
+    var el = document.getElementById(w.el);
+    if (!el) return;
+    if (!turnstileReady || !window.turnstile) { w.pending = true; return; }
+    w.pending = false;
+    w.id = window.turnstile.render(el, {
+      sitekey: el.getAttribute('data-sitekey'),
+      theme: 'light',
+      callback: function(token) { w.token = token; },
+      'expired-callback': function() { w.token = ''; },
+      'timeout-callback': function() { w.token = ''; },
+      // Without this a widget failure is silent and the user only ever sees
+      // the generic "complete the verification" toast with no way to tell
+      // whether the challenge failed, expired, or never loaded at all.
+      'error-callback': function(code) {
+        w.token = '';
+        console.error('[Auth] Turnstile error on ' + name + ' widget:', code);
+        showToast('Verification unavailable (' + (code || 'error') + '). Check your connection and try again.', 'error');
+      }
+    });
+  }
+
+  function turnstileToken(name) {
+    var w = turnstileWidgets[name];
+    return w ? w.token : '';
+  }
+
+  function resetTurnstile(name) {
+    var w = turnstileWidgets[name];
+    if (!w) return;
+    w.token = '';
+    if (w.id !== null && window.turnstile) window.turnstile.reset(w.id);
+  }
+
   // ---- HELPER FUNCTIONS ----
 
   function showLoginForm() {
@@ -226,12 +291,14 @@ document.addEventListener('DOMContentLoaded', function() {
     if (loginForm) loginForm.style.display = 'none';
     if (registerForm) registerForm.style.display = 'block';
     if (forgotForm) forgotForm.style.display = 'none';
+    renderTurnstile('register');
   }
 
   function showForgotForm() {
     if (loginForm) loginForm.style.display = 'none';
     if (registerForm) registerForm.style.display = 'none';
     if (forgotForm) forgotForm.style.display = 'block';
+    renderTurnstile('forgot');
   }
 
   function enterApp(user, token) {
@@ -527,7 +594,7 @@ document.addEventListener('DOMContentLoaded', function() {
   // ---- BIOMETRIC LOGIN BUTTON ----
   // Reads the email + password from the OS-secured keychain (gated behind
   // Face ID / Touch ID / fingerprint) and fills the login form. Submits the
-  // form so all the existing flow (turnstile, 2FA prompt, error handling,
+  // form so all the existing flow (2FA prompt, error handling,
   // session storage) runs unchanged. If biometric verification fails, the
   // user just gets a toast and falls through to typing the password.
   var bioBtn = document.getElementById('btn-bio-login');
@@ -544,10 +611,7 @@ document.addEventListener('DOMContentLoaded', function() {
           if (emailEl) emailEl.value = creds.username;
           if (pwEl)    pwEl.value    = creds.password;
           // Trigger the same submit path as the password form so all the
-          // existing handling (turnstile token, 2FA, session storage, etc.)
+          // existing handling (2FA, session storage, etc.) runs unchanged.
-          // runs unchanged. If turnstile hasn't auto-solved yet the form
-          // will toast "Please complete the verification" — same as a
-          // manual login attempt before turnstile resolves.
           if (loginForm && typeof loginForm.requestSubmit === 'function') loginForm.requestSubmit();
           else if (loginForm) loginForm.dispatchEvent(new Event('submit', { cancelable: true, bubbles: true }));
         })
@@ -577,17 +641,9 @@ document.addEventListener('DOMContentLoaded', function() {
         return false;
       }
 
-      // Cloudflare Turnstile
-      var loginTurnstile = document.querySelector('#login-form [name="cf-turnstile-response"]');
-      var loginToken = loginTurnstile ? loginTurnstile.value : '';
-      if (!loginToken) {
-        showToast('Please complete the verification', 'error');
-        return false;
-      }
-
       showLoading('Signing in...');
 
-      var body = { email: email, password: password, turnstileToken: loginToken };
+      var body = { email: email, password: password };
       if (totpCode) body.totpCode = totpCode;
 
       fetch('/api/auth/login', {
@@ -637,14 +693,12 @@ document.addEventListener('DOMContentLoaded', function() {
           }
         } else {
           showToast(data.error || 'Login failed', 'error');
-          if (window.turnstile) turnstile.reset('#turnstile-login');
         }
       })
       .catch(function(err) {
         hideLoading();
         console.error('[Auth] Login error:', err);
         showToast('Connection error', 'error');
-        if (window.turnstile) turnstile.reset('#turnstile-login');
       });
 
       return false;
@@ -703,9 +757,8 @@ document.addEventListener('DOMContentLoaded', function() {
       }
 
       // Cloudflare Turnstile verification
-      var turnstileResponse = document.querySelector('[name="cf-turnstile-response"]');
+      var regToken = turnstileToken('register');
-      var turnstileToken = turnstileResponse ? turnstileResponse.value : '';
+      if (!regToken) {
-      if (!turnstileToken) {
         showToast('Please complete the verification challenge', 'error');
         return false;
       }
@@ -715,7 +768,7 @@ document.addEventListener('DOMContentLoaded', function() {
       fetch('/api/auth/register', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: turnstileToken })
+        body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: regToken })
       })
       .then(function(r) { return r.json(); })
       .then(function(data) {
@@ -729,17 +782,20 @@ document.addEventListener('DOMContentLoaded', function() {
           showToast(data.message || 'Account created!', 'success');
         } else if (data.success && data.needsVerification) {
           showToast(data.message || 'Check email to verify', 'success');
+          // The token was just consumed server-side — clear it so coming back
+          // to this form doesn't resubmit a spent one.
+          resetTurnstile('register');
           showLoginForm();
         } else {
           showToast(data.error || 'Registration failed', 'error');
-          if (window.turnstile) turnstile.reset();
+          resetTurnstile('register');
         }
       })
       .catch(function(err) {
         hideLoading();
         console.error('[Auth] Register error:', err);
         showToast('Connection error', 'error');
-        if (window.turnstile) turnstile.reset();
+        resetTurnstile('register');
       });
 
       return false;
@@ -756,8 +812,7 @@ document.addEventListener('DOMContentLoaded', function() {
       if (!email) { showToast('Enter email', 'error'); return false; }
 
       // Cloudflare Turnstile
-      var forgotTurnstile = document.querySelector('#forgot-form [name="cf-turnstile-response"]');
+      var forgotToken = turnstileToken('forgot');
-      var forgotToken = forgotTurnstile ? forgotTurnstile.value : '';
       if (!forgotToken) {
         showToast('Please complete the verification', 'error');
         return false;
@@ -774,12 +829,13 @@ document.addEventListener('DOMContentLoaded', function() {
       .then(function(data) {
         hideLoading();
         showToast(data.message || 'Check your email', 'success');
+        resetTurnstile('forgot');
         showLoginForm();
       })
       .catch(function(err) {
         hideLoading();
         showToast('Error', 'error');
-        if (window.turnstile) turnstile.reset('#turnstile-forgot');
+        resetTurnstile('forgot');
       });
 
       return false;

src/routes/adminConfig.js

@@ -9,7 +9,7 @@ var { authMiddleware, adminMiddleware } = require('../middleware/auth');
 var PROMPTS = require('../utils/prompts');
 var logger = require('../utils/logger');
 var { gatewayUrl } = require('../utils/errors');
-var { getTTSEnvProvider, getLiteLLMTTSDiscoveryItems, getTTSProvider, getTTSVoiceLists } = require('../utils/ttsProvider');
+var { getTTSEnvProvider, getLiteLLMTTSDiscoveryItems, getLiteLLMTTSRequestOptions, getLiteLLMTTSVoicesForModel, isLiteLLMTTSVoiceCompatible, getTTSProvider } = require('../utils/ttsProvider');
 var { getLiteLLMHeaders, getLiteLLMAdminHeaders } = require('../utils/litellm');
 var { getSTTDependencies, getLiteLLMSTTModels, getSTTModelLists, getSTTProvider } = require('../utils/sttProvider');
 var { getLiteLLMEmbeddingModels } = require('../utils/embeddings');
@@ -550,12 +550,17 @@ router.get('/config/tts', async function(req, res) {
     var dbModel = await db.getSetting('tts.model') || '';
     var envVoice = process.env.LITELLM_TTS_VOICE || '';
     var envModel = process.env.LITELLM_TTS_MODEL || '';
+    var currentModel = dbModel || envModel;
+    var voices = getLiteLLMTTSVoicesForModel(currentModel, { currentVoice: dbVoice });
+    var currentVoice = [dbVoice, envVoice, voices[0]].find(function(voice) {
+      return isLiteLLMTTSVoiceCompatible(currentModel, voice);
+    }) || '';
     res.json({
       success: true,
       provider: activeProvider,
       envProvider: envProvider,
-      currentVoice: dbVoice || envVoice,
+      currentVoice: currentVoice,
-      currentModel: dbModel || envModel,
+      currentModel: currentModel,
       dbVoice: dbVoice,
       dbModel: dbModel,
       envVoice: envVoice,
@@ -563,7 +568,9 @@ router.get('/config/tts', async function(req, res) {
       configured: {
         litellm: !!process.env.LITELLM_API_BASE
       },
-      voices: getTTSVoiceLists()
+      voices: {
+        litellm: voices
+      }
     });
   } catch (e) { res.status(500).json({ error: 'Request failed' }); }
 });
@@ -616,11 +623,15 @@ router.post('/config/tts/test', async function(req, res) {
     var adminModel = await db.getSetting('tts.model') || '';
     var adminVoice = await db.getSetting('tts.voice') || '';
     var ttsModel = adminModel || process.env.LITELLM_TTS_MODEL || '';
-    var usedVoice = voice || adminVoice || process.env.LITELLM_TTS_VOICE || '';
+    var defaultVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: adminVoice });
+    var usedVoice = [voice, adminVoice, process.env.LITELLM_TTS_VOICE || '', defaultVoices[0]].find(function(candidate) {
+      return isLiteLLMTTSVoiceCompatible(ttsModel, candidate);
+    }) || '';
     if (!ttsModel) return res.json({ success: false, error: 'No LiteLLM TTS model configured' });
+    var payload = Object.assign({ model: ttsModel, voice: usedVoice, input: text }, getLiteLLMTTSRequestOptions(ttsModel));
 
     var ttsResp = await axios.post(gatewayUrl('/audio/speech'),
-      { model: ttsModel, voice: usedVoice, input: text },
+      payload,
       { headers: getLiteLLMHeaders('application/json'), responseType: 'arraybuffer', timeout: 60000 }
     );
     var buffer = Buffer.from(ttsResp.data);

src/routes/auth.js

@@ -299,19 +299,15 @@ router.post('/resend-verification', async (req, res) => {
 // ============================================================
 router.post('/login', async (req, res) => {
   try {
-    var { email, password, totpCode, turnstileToken } = req.body;
+    var { email, password, totpCode } = req.body;
     if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
 
-    // Cloudflare Turnstile verification
+    // No Turnstile on login. The widget could not reliably complete a
-    if (process.env.TURNSTILE_SECRET_KEY) {
+    // challenge inside the Capacitor WebView, which locked mobile users out.
-      if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification' });
+    // Brute-force cover here comes from the 10-per-15-min per-IP rate limit
-      var tsRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+    // (server.js), the constant-time bcrypt comparison below, and TOTP 2FA.
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
+    // Registration and password reset — the endpoints that actually attract
-        body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip })
+    // bots — are still gated.
-      });
-      var tsData = await tsRes.json();
-      if (!tsData.success) return res.status(400).json({ error: 'Verification failed. Please try again.' });
-    }
 
     var user = await db.get('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]);
     // Enumeration-resistant: always run bcrypt to keep timing constant, and return

src/routes/tts.js

@@ -3,7 +3,7 @@ const router  = express.Router();
 const { authMiddleware } = require('../middleware/auth');
 var logger = require('../utils/logger');
 var { gatewayUrl } = require('../utils/errors');
-var { getTTSProvider } = require('../utils/ttsProvider');
+var { getLiteLLMTTSRequestOptions, getLiteLLMTTSVoicesForModel, isLiteLLMTTSVoiceCompatible, getTTSProvider } = require('../utils/ttsProvider');
 var { getLiteLLMHeaders } = require('../utils/litellm');
 
 // TTS is intentionally routed only through LiteLLM. Provider-specific voice
@@ -22,19 +22,22 @@ router.post('/text-to-speech', authMiddleware, async (req, res) => {
     var userVoice = userPrefs?.tts_voice;
     var adminVoice = await db.getSetting('tts.voice') || '';
     var adminModel = await db.getSetting('tts.model') || '';
-    var resolvedVoice = userVoice || adminVoice || '';
 
     if (ttsProvider !== 'litellm' || !process.env.LITELLM_API_BASE) {
       return res.status(400).json({ error: 'TTS not configured. Set LITELLM_API_BASE.' });
     }
     var ttsModel = adminModel || process.env.LITELLM_TTS_MODEL || '';
-    var ttsVoice = resolvedVoice || process.env.LITELLM_TTS_VOICE || '';
+    var defaultVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: adminVoice });
+    var ttsVoice = [userVoice, adminVoice, process.env.LITELLM_TTS_VOICE || '', defaultVoices[0]].find(function(voice) {
+      return isLiteLLMTTSVoiceCompatible(ttsModel, voice);
+    }) || '';
     if (!ttsModel) return res.status(400).json({ error: 'No LiteLLM TTS model configured.' });
+    var payload = Object.assign({ model: ttsModel, input: text, voice: ttsVoice }, getLiteLLMTTSRequestOptions(ttsModel));
 
     var ttsResp = await fetch(gatewayUrl('/audio/speech'), {
       method: 'POST',
       headers: getLiteLLMHeaders('application/json'),
-      body: JSON.stringify({ model: ttsModel, input: text, voice: ttsVoice })
+      body: JSON.stringify(payload)
     });
     if (!ttsResp.ok) {
       var errBody = await ttsResp.text();

src/routes/userPreferences.js

@@ -7,7 +7,7 @@ var router = express.Router();
 var db = require('../db/database');
 var { authMiddleware } = require('../middleware/auth');
 var { getSTTModelLists, getSTTProvider } = require('../utils/sttProvider');
-var { getTTSProvider, getTTSVoiceLists } = require('../utils/ttsProvider');
+var { getLiteLLMTTSVoicesForModel, getTTSProvider } = require('../utils/ttsProvider');
 
 router.use(authMiddleware);
 
@@ -49,14 +49,18 @@ router.get('/preferences/options', async function(req, res) {
     var provider = getSTTProvider();
     var ttsProvider = getTTSProvider();
 
+    var dbModel = await db.getSetting('tts.model') || '';
+    var dbVoice = await db.getSetting('tts.voice') || '';
+    var ttsModel = dbModel || process.env.LITELLM_TTS_MODEL || '';
     var sttModels = getSTTModelLists().litellm.map(function(model) { return { value: model, label: model }; });
-    var ttsVoices = getTTSVoiceLists().litellm.map(function(voice) { return { value: voice, label: voice }; });
+    var ttsVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: dbVoice }).map(function(voice) { return { value: voice, label: voice }; });
 
     res.json({
       success: true,
       sttProvider: provider || 'none',
       sttModels: sttModels,
       ttsProvider: ttsProvider || 'browser',
+      ttsModel: ttsModel || null,
       ttsVoices: ttsVoices
     });
 

src/utils/ttsProvider.js

@@ -7,6 +7,20 @@ function parseList(value) {
     .filter(Boolean);
 }
 
+var KITTEN_TTS_VOICES = ['Bella', 'Jasper', 'Luna', 'Bruno', 'Rosie', 'Hugo', 'Kiki', 'Leo'];
+var SUPERTONIC_TTS_VOICES = ['F1', 'F2', 'F3', 'F4', 'F5', 'M1', 'M2', 'M3', 'M4', 'M5'];
+var GROQ_ORPHEUS_ENGLISH_VOICES = ['autumn', 'diana', 'hannah', 'austin', 'daniel', 'troy'];
+var GROQ_ORPHEUS_ARABIC_VOICES = ['abdullah', 'fahad', 'sultan', 'lulwa', 'noura', 'aisha'];
+
+function uniqueList(values) {
+  var seen = new Set();
+  return (values || []).filter(function(value) {
+    if (!value || seen.has(value)) return false;
+    seen.add(value);
+    return true;
+  });
+}
+
 function getTTSProvider() {
   var env = process.env.TTS_PROVIDER;
   if (env === 'litellm') return 'litellm';
@@ -20,10 +34,58 @@ function getTTSEnvProvider() {
 
 function getTTSVoiceLists() {
   return {
-    litellm: parseList(process.env.LITELLM_TTS_VOICES)
+    litellm: uniqueList(parseList(process.env.LITELLM_TTS_VOICES).concat(KITTEN_TTS_VOICES, SUPERTONIC_TTS_VOICES, GROQ_ORPHEUS_ENGLISH_VOICES, GROQ_ORPHEUS_ARABIC_VOICES))
   };
 }
 
+function getLiteLLMTTSModelFamily(model) {
+  var id = String(model || '').toLowerCase();
+  if (id === 'local-kitten-tts') return 'kitten';
+  if (id === 'local-supertonic-tts') return 'supertonic';
+  if (id === 'local-kokoro-tts') return 'kokoro';
+  if (id === 'groq-orpheus-english' || id === 'canopylabs/orpheus-v1-english') return 'groq-orpheus-english';
+  if (id === 'groq-orpheus-arabic-saudi' || id === 'canopylabs/orpheus-arabic-saudi') return 'groq-orpheus-arabic';
+  return 'unknown';
+}
+
+function getLiteLLMTTSRequestOptions(model) {
+  var family = getLiteLLMTTSModelFamily(model);
+  if (family === 'groq-orpheus-english' || family === 'groq-orpheus-arabic') {
+    return { response_format: 'wav' };
+  }
+  return {};
+}
+
+function isLiteLLMTTSVoiceCompatible(model, voice) {
+  if (!voice) return true;
+  var family = getLiteLLMTTSModelFamily(model);
+  if (family === 'kitten') return KITTEN_TTS_VOICES.indexOf(voice) !== -1;
+  if (family === 'supertonic') return SUPERTONIC_TTS_VOICES.indexOf(voice) !== -1;
+  if (family === 'groq-orpheus-english') return GROQ_ORPHEUS_ENGLISH_VOICES.indexOf(String(voice).toLowerCase()) !== -1;
+  if (family === 'groq-orpheus-arabic') return GROQ_ORPHEUS_ARABIC_VOICES.indexOf(String(voice).toLowerCase()) !== -1;
+  if (family === 'kokoro') {
+    return KITTEN_TTS_VOICES.indexOf(voice) === -1 && SUPERTONIC_TTS_VOICES.indexOf(voice) === -1 &&
+      GROQ_ORPHEUS_ENGLISH_VOICES.indexOf(String(voice).toLowerCase()) === -1 && GROQ_ORPHEUS_ARABIC_VOICES.indexOf(String(voice).toLowerCase()) === -1;
+  }
+  return true;
+}
+
+function getLiteLLMTTSVoicesForModel(model, opts) {
+  opts = opts || {};
+  var family = getLiteLLMTTSModelFamily(model);
+  var voices = [];
+  if (family === 'kitten') voices = KITTEN_TTS_VOICES.slice();
+  else if (family === 'supertonic') voices = SUPERTONIC_TTS_VOICES.slice();
+  else if (family === 'groq-orpheus-english') voices = GROQ_ORPHEUS_ENGLISH_VOICES.slice();
+  else if (family === 'groq-orpheus-arabic') voices = GROQ_ORPHEUS_ARABIC_VOICES.slice();
+  else voices = parseList(process.env.LITELLM_TTS_VOICES);
+
+  [opts.currentVoice, process.env.LITELLM_TTS_VOICE].forEach(function(voice) {
+    if (isLiteLLMTTSVoiceCompatible(model, voice)) voices.push(voice);
+  });
+  return uniqueList(voices.filter(function(voice) { return isLiteLLMTTSVoiceCompatible(model, voice); }));
+}
+
 function isLiteLLMTTSModel(model) {
   var mode = model && model.model_info && model.model_info.mode ? String(model.model_info.mode) : '';
   return mode === 'audio_speech';
@@ -56,6 +118,26 @@ function getLiteLLMTTSDiscoveryItems(models, opts) {
   getTTSVoiceLists().litellm.forEach(function(voice) {
     pushUniqueTTSItem(items, { id: voice, name: voice, source: 'configured-voice-list', kind: 'voice' });
   });
+  if (getLiteLLMTTSModels(models).indexOf('local-kitten-tts') !== -1 || opts.currentModel === 'local-kitten-tts') {
+    KITTEN_TTS_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Kitten ' + voice, source: 'local-kitten-tts', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('local-supertonic-tts') !== -1 || opts.currentModel === 'local-supertonic-tts') {
+    SUPERTONIC_TTS_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Supertonic ' + voice, source: 'local-supertonic-tts', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('groq-orpheus-english') !== -1 || opts.currentModel === 'groq-orpheus-english') {
+    GROQ_ORPHEUS_ENGLISH_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Groq Orpheus ' + voice, source: 'groq-orpheus-english', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('groq-orpheus-arabic-saudi') !== -1 || opts.currentModel === 'groq-orpheus-arabic-saudi') {
+    GROQ_ORPHEUS_ARABIC_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Groq Orpheus Arabic ' + voice, source: 'groq-orpheus-arabic-saudi', kind: 'voice' });
+    });
+  }
   return items;
 }
 
@@ -64,7 +146,10 @@ module.exports = {
   getLiteLLMTTSDiscoveryItems,
   getLiteLLMHeaders,
   getLiteLLMTTSModels,
+  getLiteLLMTTSRequestOptions,
+  getLiteLLMTTSVoicesForModel,
   getTTSProvider,
   getTTSVoiceLists,
+  isLiteLLMTTSVoiceCompatible,
   isLiteLLMTTSModel
 };

test/tts-provider.test.js

@@ -1,7 +1,7 @@
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
 
-const ENV_KEYS = ['TTS_PROVIDER', 'LITELLM_API_BASE', 'LITELLM_API_KEY', 'LITELLM_MASTER_KEY', 'LITELLM_TTS_VOICES'];
+const ENV_KEYS = ['TTS_PROVIDER', 'LITELLM_API_BASE', 'LITELLM_API_KEY', 'LITELLM_MASTER_KEY', 'LITELLM_TTS_VOICES', 'LITELLM_TTS_VOICE'];
 
 function withEnv(overrides, fn) {
   const previous = {};
@@ -36,10 +36,11 @@ test('TTS provider ignores non-LiteLLM provider overrides', () => {
 test('LiteLLM TTS voice list comes from configured voice catalog', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   withEnv({ LITELLM_TTS_VOICES: 'sherpa/kokoro:am_adam, sherpa/kokoro:af_bella' }, () => {
-    assert.deepEqual(ttsProvider.getTTSVoiceLists().litellm, [
+    const voices = ttsProvider.getTTSVoiceLists().litellm;
-      'sherpa/kokoro:am_adam',
+    assert.equal(voices[0], 'sherpa/kokoro:am_adam');
-      'sherpa/kokoro:af_bella'
+    assert.equal(voices[1], 'sherpa/kokoro:af_bella');
-    ]);
+    assert.equal(voices.includes('Jasper'), true);
+    assert.equal(voices.includes('F1'), true);
   });
 });
 
@@ -92,6 +93,19 @@ test('LiteLLM TTS discovery includes metadata models and configured fallbacks',
   });
 });
 
+test('LiteLLM TTS discovery expands Kitten and Supertonic voices', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  withEnv({}, () => {
+    const items = ttsProvider.getLiteLLMTTSDiscoveryItems([
+      { model_name: 'local-kitten-tts', model_info: { mode: 'audio_speech' } },
+      { model_name: 'local-supertonic-tts', model_info: { mode: 'audio_speech' } }
+    ], {});
+    assert.equal(items.some(function(item) { return item.id === 'local-kitten-tts' && item.kind === 'model'; }), true);
+    assert.equal(items.some(function(item) { return item.id === 'Jasper' && item.kind === 'voice'; }), true);
+    assert.equal(items.some(function(item) { return item.id === 'F1' && item.kind === 'voice'; }), true);
+  });
+});
+
 test('LiteLLM TTS discovery still shows configured model if metadata lookup fails', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   assert.deepEqual(ttsProvider.getLiteLLMTTSDiscoveryItems([], {
@@ -103,6 +117,38 @@ test('LiteLLM TTS discovery still shows configured model if metadata lookup fail
   ]);
 });
 
+test('LiteLLM TTS voices are scoped to the active local model', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  withEnv({ LITELLM_TTS_VOICES: 'sherpa/kokoro:am_adam,sherpa/kokoro:af_bella', LITELLM_TTS_VOICE: 'sherpa/kokoro:am_adam' }, () => {
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-kitten-tts'), ['Bella', 'Jasper', 'Luna', 'Bruno', 'Rosie', 'Hugo', 'Kiki', 'Leo']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-supertonic-tts'), ['F1', 'F2', 'F3', 'F4', 'F5', 'M1', 'M2', 'M3', 'M4', 'M5']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-kokoro-tts'), ['sherpa/kokoro:am_adam', 'sherpa/kokoro:af_bella']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('groq-orpheus-english'), ['autumn', 'diana', 'hannah', 'austin', 'daniel', 'troy']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('canopylabs/orpheus-arabic-saudi'), ['abdullah', 'fahad', 'sultan', 'lulwa', 'noura', 'aisha']);
+  });
+});
+
+test('LiteLLM TTS compatibility rejects cross-model local voices', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kokoro-tts', 'Bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kokoro-tts', 'M1'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kitten-tts', 'Bella'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kitten-tts', 'M1'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-supertonic-tts', 'M1'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-supertonic-tts', 'Bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-english', 'hannah'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-english', 'sherpa/kokoro:af_bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-arabic-saudi', 'aisha'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-arabic-saudi', 'troy'), false);
+});
+
+test('Groq Orpheus TTS requests force wav response format', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('groq-orpheus-english'), { response_format: 'wav' });
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('canopylabs/orpheus-arabic-saudi'), { response_format: 'wav' });
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('local-kokoro-tts'), {});
+});
+
 test('LiteLLM headers include optional content type without exposing key value', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   withEnv({ LITELLM_API_KEY: 'secret-token' }, () => {