@danieltmn/tamnora 0.7.1 → 0.9.0

package/harness/packages/core/src/procs/kill.js

@@ -0,0 +1,95 @@
+import { spawn } from 'node:child_process';
+
+const RUN_TIMEOUT_MS = 8000;
+
+/** Run a command, resolving `{ code, stdout }` (never rejects). */
+function run(command, args, { timeout = RUN_TIMEOUT_MS } = {}) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(command, args, { windowsHide: true });
+    } catch {
+      resolve({ code: -1, stdout: '' });
+      return;
+    }
+    let stdout = '';
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+        // already gone
+      }
+      finish({ code: -1, stdout });
+    }, timeout);
+    child.stdout?.on('data', (chunk) => {
+      if (stdout.length < 20000) stdout += chunk.toString();
+    });
+    child.on('error', () => finish({ code: -1, stdout }));
+    child.on('close', (code) => finish({ code: code ?? -1, stdout }));
+  });
+}
+
+function uniquePids(values) {
+  return [...new Set(values.map(Number).filter((pid) => Number.isInteger(pid) && pid > 0))];
+}
+
+/** Find PIDs listening on a TCP/UDP port (Windows `netstat`). */
+async function pidsOnWindows(port) {
+  const { stdout } = await run('netstat', ['-ano']);
+  const pids = [];
+  for (const line of stdout.split(/\r?\n/)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 4) continue;
+    if (fields[0].toUpperCase() !== 'TCP' && fields[0].toUpperCase() !== 'UDP') continue;
+    if (!fields[1].endsWith(`:${port}`)) continue;
+    pids.push(fields[fields.length - 1]);
+  }
+  return uniquePids(pids);
+}
+
+/** Find PIDs listening on a port (Unix: lsof, fuser or ss). */
+async function pidsOnUnix(port) {
+  const lsof = await run('lsof', ['-ti', `tcp:${port}`]);
+  if (lsof.code === 0 && lsof.stdout.trim()) {
+    return uniquePids(lsof.stdout.split(/\s+/));
+  }
+  const fuser = await run('fuser', [`${port}/tcp`]);
+  if (fuser.code === 0 && fuser.stdout.trim()) {
+    return uniquePids(fuser.stdout.match(/\d+/g) ?? []);
+  }
+  const ss = await run('ss', ['-ltnp', `sport = :${port}`]);
+  if (ss.code === 0 && ss.stdout.trim()) {
+    return uniquePids([...ss.stdout.matchAll(/pid=(\d+)/g)].map((match) => match[1]));
+  }
+  return [];
+}
+
+/**
+ * Kill every process listening on `port`.
+ * @returns {Promise<{port:number,pids:number[],killed:number[],errors:string[]}>}
+ */
+export async function killPort(port) {
+  const value = Number(port);
+  if (!Number.isInteger(value) || value < 1 || value > 65535) {
+    throw new Error('Puerto inválido (usá 1-65535).');
+  }
+  const pids = process.platform === 'win32' ? await pidsOnWindows(value) : await pidsOnUnix(value);
+  const killed = [];
+  const errors = [];
+  for (const pid of pids) {
+    const result =
+      process.platform === 'win32'
+        ? await run('taskkill', ['/PID', String(pid), '/T', '/F'])
+        : await run('kill', ['-9', String(pid)]);
+    if (result.code === 0) killed.push(pid);
+    else errors.push(String(pid));
+  }
+  return { port: value, pids, killed, errors };
+}

package/harness/packages/core/src/tools/executors.js

@@ -404,6 +404,21 @@ export async function gitCommitTool(root, { message, files } = {}) {
   return runGit(root, ['commit', '-m', message]);
 }
 
+const MAX_SPEAK_TEXT = 1200;
+
+/**
+ * Pedido de audio: valida el texto y lo devuelve. La sintesis y la reproduccion
+ * son del cliente (la consola lo reproduce y Telegram lo manda como nota de
+ * voz), asi que aca solo se normaliza el pedido y se acota el largo.
+ */
+export function speakTool(_root, { texto, voice, rate } = {}) {
+  const value = String(texto ?? '').replace(/\s+/g, ' ').trim();
+  if (!value) return 'Error: falta "texto".';
+  const recortado = value.length > MAX_SPEAK_TEXT ? `${value.slice(0, MAX_SPEAK_TEXT - 1).trimEnd()}…` : value;
+  const opciones = [voice, rate].filter(Boolean).join(', ');
+  return `Audio pedido${opciones ? ` (${opciones})` : ''}: "${recortado}". El cliente lo reproduce o lo envía como nota de voz.`;
+}
+
 export const EXECUTORS = {
   read: readTool,
   write: writeTool,
@@ -417,4 +432,5 @@ export const EXECUTORS = {
   git_diff: gitDiffTool,
   git_log: gitLogTool,
   git_commit: gitCommitTool,
+  speak: speakTool,
 };

package/harness/packages/core/src/tools/labels.js

@@ -50,6 +50,8 @@ export function summarizeToolCall(name, args = {}) {
     }
     case 'fetch_url':
       return shorten(a.url, 90);
+    case 'speak':
+      return shorten(a.texto, 90);
     case 'git_diff':
       return [a.ref ? `vs ${shorten(a.ref, 30)}` : a.staged ? 'staged' : 'unstaged', a.path ? path(a.path) : '']
         .filter(Boolean)

package/harness/packages/core/src/tools/permissions.js

@@ -13,6 +13,7 @@ export const DEFAULT_PERMISSIONS = {
   git_diff: 'allow',
   git_log: 'allow',
   fetch_url: 'allow',
+  speak: 'allow',
   write: 'ask',
   edit: 'ask',
   bash: 'ask',

package/harness/packages/core/src/tools/schema.js

@@ -133,6 +133,23 @@ export const TOOL_DEFINITIONS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'speak',
+      description:
+        'Speak a short text aloud to the user with text-to-speech. Use it when the user asks to hear something (e.g. an audio summary). Keep it concise: the web console plays it and Telegram sends it as a voice note.',
+      parameters: {
+        type: 'object',
+        properties: {
+          texto: { type: 'string', description: 'Text to speak (long text is trimmed)' },
+          voice: { type: 'string', description: 'Optional voice id, e.g. "es-AR-ElenaNeural"' },
+          rate: { type: 'string', description: 'Optional speed, e.g. "+10%"' },
+        },
+        required: ['texto'],
+      },
+    },
+  },
   {
     type: 'function',
     function: {

package/harness/packages/core/src/tts/edge.js

@@ -0,0 +1,232 @@
+// Sintesis de voz (TTS) con el servicio Edge Read Aloud de Microsoft: las
+// voces neuronales gratuitas de Edge, sin API key ni cuenta de Azure.
+//
+// Port del cliente de streaming de voice-tts, adaptado al WebSocket global de
+// Node (>=22, undici): ese WebSocket acepta `origin` y `headers` como bag de
+// opciones (extension no estandar de undici), que el servicio exige (User-Agent
+// de Edge + token anti-abuso Sec-MS-GEC en la URL). Sin dependencias.
+//
+// Aqui la salida es buffered (Promise<Buffer>): las frases que habla el harness
+// son cortas, el MP3 completo ronda los 50-150 KB y no vale la pena exponer un
+// stream con backpressure. Trampas heredadas del original:
+//   - sin Sec-MS-GEC (SHA-256 del file time de Windows + token) el servicio da 403;
+//   - un cierre del socket antes de `turn.end` deja un MP3 "truncado pero
+//     reproducible": eso se convierte en error, no en silencio.
+
+import { createHash, randomBytes } from 'node:crypto';
+
+/** Token publico del cliente de Edge (via en el codigo del navegador). */
+export const TRUSTED_CLIENT_TOKEN = '6A5AA1D4EAFF4E9FB37E23D68491D6F4';
+
+/** Version de Edge que declaramos. Si el servicio empieza a rechazar, subirla. */
+export const EDGE_VERSION = process.env.TTS_EDGE_VERSION ?? '143.0.3650.75';
+
+/** Formato por defecto: MP3 a 24 kHz, 48 kbps, mono (CBR). */
+export const FORMATO_POR_DEFECTO = 'audio-24khz-48kbitrate-mono-mp3';
+
+/** Tope de texto por sintesis: el servicio rechaza mas de ~3000 caracteres. */
+export const MAX_TEXTO = 2000;
+
+/** Voz por defecto del harness. */
+export const VOZ_POR_DEFECTO = 'es-AR-ElenaNeural';
+
+const URL_BASE = 'wss://speech.platform.bing.com/consumer/speech/synthesize/readaloud/edge/v1';
+const URL_VOCES = `https://speech.platform.bing.com/consumer/speech/synthesize/readaloud/voices/list?trustedclienttoken=${TRUSTED_CLIENT_TOKEN}`;
+const ORIGEN_EDGE = 'chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold';
+const SEGUNDOS_EPOCA_WINDOWS = 11644473600;
+const VENTANA_TICKS = 3000000000n; // 5 minutos en ticks de 100 ns
+const DELIMITADOR_AUDIO = Buffer.from('Path:audio\r\n');
+
+const UA_EDGE = `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${EDGE_VERSION.split('.')[0]}.0.0.0 Safari/537.36 Edg/${EDGE_VERSION.split('.')[0]}.0.0.0`;
+
+/**
+ * Token anti-abuso `Sec-MS-GEC` que exige el servicio: SHA-256 del file time
+ * de Windows redondeado a 5 minutos + el client token.
+ *
+ * @param {number} [ahora] Marca de tiempo en ms (inyectable para pruebas).
+ * @returns {string} SHA-256 en mayusculas.
+ */
+export function generarSecMsGec(ahora = Date.now()) {
+  const segundos = Math.floor(ahora / 1000 + SEGUNDOS_EPOCA_WINDOWS);
+  const ticks = BigInt(segundos) * 10000000n;
+  const redondeado = ticks - (ticks % VENTANA_TICKS);
+  return createHash('sha256').update(`${redondeado}${TRUSTED_CLIENT_TOKEN}`, 'ascii').digest('hex').toUpperCase();
+}
+
+function escaparXml(valor) {
+  return String(valor).replace(/[<>&"']/g, (c) => {
+    switch (c) {
+      case '<': return '&lt;';
+      case '>': return '&gt;';
+      case '&': return '&amp;';
+      case '"': return '&quot;';
+      default: return '&apos;';
+    }
+  });
+}
+
+/** SSML de una sintesis. Exportado para probar el escape y la prosodia. */
+export function generarSsml({ voz, lang, rate, pitch, volume, texto }) {
+  const locale = lang ?? (/\w{2}-\w{2}/.exec(String(voz ?? ''))?.[0] ?? '');
+  if (!locale) throw new Error(`No se pudo deducir el locale de la voz "${voz}".`);
+  return (
+    `<speak version="1.0" xmlns="http://www.w3.org/2001/10/synthesis" xml:lang="${escaparXml(locale)}">` +
+    `<voice name="${escaparXml(voz)}">` +
+    `<prosody rate="${escaparXml(rate)}" pitch="${escaparXml(pitch)}" volume="${escaparXml(volume)}">` +
+    `${escaparXml(texto)}` +
+    '</prosody></voice></speak>'
+  );
+}
+
+function urlSintesis() {
+  const parametros = new URLSearchParams({
+    TrustedClientToken: TRUSTED_CLIENT_TOKEN,
+    'Sec-MS-GEC': generarSecMsGec(),
+    'Sec-MS-GEC-Version': `1-${EDGE_VERSION}`,
+    ConnectionId: randomBytes(16).toString('hex'),
+  });
+  return `${URL_BASE}?${parametros.toString()}`;
+}
+
+/**
+ * Sintetiza texto y devuelve el MP3 completo.
+ *
+ * @param {string} texto Texto a sintetizar (se recorta a MAX_TEXTO).
+ * @param {object} [opciones]
+ * @param {string} [opciones.voice] Voz (ej. "es-AR-ElenaNeural").
+ * @param {string} [opciones.rate] Velocidad, ej. "+20%".
+ * @param {string} [opciones.pitch] Tono, ej. "-10Hz".
+ * @param {string} [opciones.volume] Volumen, ej. "+0%".
+ * @param {string} [opciones.outputFormat] Formato de salida del servicio.
+ * @param {number} [opciones.idleTimeout] Maximo de ms sin frames antes de abortar.
+ * @param {AbortSignal} [opciones.signal] Para cancelar la sintesis.
+ * @returns {Promise<Buffer>} MP3.
+ */
+export function sintetizar(texto, opciones = {}) {
+  const {
+    voice: voz = VOZ_POR_DEFECTO,
+    rate = '+0%',
+    pitch = '+0Hz',
+    volume = '+0%',
+    outputFormat = FORMATO_POR_DEFECTO,
+    idleTimeout = 15000,
+    signal,
+  } = opciones;
+
+  const contenido = String(texto ?? '').slice(0, MAX_TEXTO).trim();
+  if (!contenido) throw new Error('El texto está vacío: no hay nada que sintetizar.');
+  if (signal?.aborted) throw new Error('La síntesis se canceló antes de empezar.');
+  if (typeof WebSocket === 'undefined') {
+    throw new Error('Este Node no trae WebSocket global (se necesita Node 22+).');
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const ws = new WebSocket(urlSintesis(), {
+      origin: ORIGEN_EDGE,
+      headers: {
+        Pragma: 'no-cache',
+        'Cache-Control': 'no-cache',
+        'Accept-Encoding': 'gzip, deflate, br, zstd',
+        'Accept-Language': 'en-US,en;q=0.9',
+        'User-Agent': UA_EDGE,
+      },
+    });
+    ws.binaryType = 'arraybuffer';
+
+    let termino = false;
+    let vigilante = null;
+
+    const fallar = (error) => {
+      if (termino) return;
+      termino = true;
+      clearTimeout(vigilante);
+      signal?.removeEventListener('abort', alAbortar);
+      try {
+        ws.close();
+      } catch {
+        // ya cerrado
+      }
+      reject(error);
+    };
+
+    const alAbortar = () => fallar(new Error('La síntesis se canceló.'));
+    const vigilar = () => {
+      clearTimeout(vigilante);
+      vigilante = setTimeout(() => fallar(new Error(`El servicio no envió audio en ${idleTimeout} ms.`)), idleTimeout);
+      vigilante.unref?.();
+    };
+
+    signal?.addEventListener('abort', alAbortar, { once: true });
+    vigilar();
+
+    ws.addEventListener('open', () => {
+      ws.send(
+        'Content-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n' +
+          JSON.stringify({
+            context: {
+              synthesis: {
+                audio: {
+                  metadataoptions: { sentenceBoundaryEnabled: false, wordBoundaryEnabled: false },
+                  outputFormat,
+                },
+              },
+            },
+          })
+      );
+      ws.send(
+        `X-RequestId:${randomBytes(16).toString('hex')}\r\nContent-Type:application/ssml+xml\r\nPath:ssml\r\n\r\n` +
+          generarSsml({ voz, rate, pitch, volume, texto: contenido })
+      );
+    });
+
+    ws.addEventListener('message', (event) => {
+      vigilar();
+      if (event.data instanceof ArrayBuffer) {
+        const frame = Buffer.from(event.data);
+        const corte = frame.indexOf(DELIMITADOR_AUDIO);
+        if (corte === -1) return;
+        const audio = frame.subarray(corte + DELIMITADOR_AUDIO.length);
+        if (audio.length) chunks.push(Buffer.from(audio));
+        return;
+      }
+      const frame = typeof event.data === 'string' ? event.data : Buffer.from(event.data).toString();
+      if (frame.includes('Path:turn.end')) {
+        termino = true;
+        clearTimeout(vigilante);
+        signal?.removeEventListener('abort', alAbortar);
+        ws.close();
+        if (!chunks.length) reject(new Error('El servicio cerró sin entregar audio.'));
+        else resolve(Buffer.concat(chunks));
+      }
+    });
+
+    ws.addEventListener('error', (event) => {
+      fallar(new Error(`Error de WebSocket con el servicio: ${event.message ?? 'sin detalle'}`));
+    });
+
+    ws.addEventListener('close', () => {
+      fallar(new Error('El servicio cerró la conexión antes de terminar: el audio quedaría truncado.'));
+    });
+  });
+}
+
+/**
+ * Catalogo de voces del servicio (endpoint publico, con cache propio).
+ *
+ * @param {string} [filtro] Prefijo de locale (ej. "es-"). Vacio = todas.
+ * @param {object} [opciones]
+ * @param {AbortSignal} [opciones.signal] Para cancelar la peticion.
+ * @returns {Promise<Array<object>>} Voces que empiezan con el filtro.
+ */
+export async function listarVoces(filtro = 'es-', { signal } = {}) {
+  const respuesta = await fetch(URL_VOCES, {
+    headers: { 'User-Agent': UA_EDGE, Accept: 'application/json' },
+    signal,
+  });
+  if (!respuesta.ok) throw new Error(`El servicio de voces respondió HTTP ${respuesta.status}.`);
+  const voces = await respuesta.json();
+  if (!Array.isArray(voces)) throw new Error('La respuesta del servicio de voces no es una lista.');
+  if (!filtro) return voces;
+  return voces.filter((v) => String(v.Locale ?? '').startsWith(filtro));
+}

package/harness/packages/core/src/tunnel.js

@@ -1,4 +1,7 @@
 import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { bridgeStatePath } from './config/home.js';
+import { pidAlive, killPidTree } from './pid.js';
 
 /**
  * Tuneles publicos. v1 soporta tunnelmole (gratis, sin cuenta; URL aleatoria)
@@ -7,27 +10,39 @@ import { spawn } from 'node:child_process';
 
 function killTree(child) {
   if (!child || child.killed) return;
-  const pid = child.pid;
+  killPidTree(child.pid);
+}
+
+/**
+ * Estado del bridge (escrito por `tamnora bridge`), si el supervisor sigue
+ * vivo. Lo consulta el server para saber que hay un tunel publico activo y
+ * ajustar el modelo de confianza (guards locales, cookie Secure).
+ * Cache de 1 s: se lee en cada request sensible y el pid no cambia tan rapido.
+ */
+let tunnelCache = { key: null, at: 0, state: null };
+export function tunnelState() {
+  let statePath;
   try {
-    if (process.platform === 'win32' && pid) {
-      spawn('taskkill', ['/PID', String(pid), '/T', '/F'], { windowsHide: true });
-    } else {
-      if (pid) {
-        try {
-          process.kill(-pid, 'SIGTERM');
-        } catch {
-          /* sin grupo */
-        }
-      }
-      try {
-        child.kill('SIGTERM');
-      } catch {
-        /* ya murio */
-      }
-    }
+    statePath = bridgeStatePath();
+  } catch {
+    return null;
+  }
+  const now = Date.now();
+  if (tunnelCache.key === statePath && now - tunnelCache.at < 1000) return tunnelCache.state;
+  let state = null;
+  try {
+    const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
+    if (parsed?.pid && pidAlive(parsed.pid)) state = parsed;
   } catch {
-    /* ya murio */
+    /* sin bridge */
   }
+  tunnelCache = { key: statePath, at: now, state };
+  return state;
+}
+
+/** True si hay un tunel publico activo hacia este server. */
+export function tunnelActive() {
+  return Boolean(tunnelState());
 }
 
 export function parseTunnelmoleUrls(text) {
@@ -74,7 +89,7 @@ function spawnTunnel(bin, args, opts = {}) {
         settled = true;
         clearTimeout(timer);
         log(`${label}: ${url} -> localhost:${opts.port}`);
-        resolve({ url, provider: opts.provider, pid: child.pid, stop: () => killTree(child) });
+        resolve({ url, provider: opts.provider, pid: child.pid, child, stop: () => killTree(child) });
       }
     };
     child.stdout.on('data', feed);
@@ -104,10 +119,156 @@ export function startTunnelmole(port, opts = {}) {
   });
 }
 
+/**
+ * Relay propio (harness.tamnora.com): mailbox HTTP sobre cPanel (solo PHP).
+ * El daemon no recibe conexiones: llama hacia afuera (a=poll), ejecuta cada
+ * request contra el server local y empuja las respuestas (a=push).
+ */
+export function startRelay(port, opts = {}) {
+  const relayUrl = String(opts.relayUrl ?? '').replace(/\/+$/, '');
+  const token = String(opts.token ?? '');
+  if (!relayUrl || !/^https?:\/\//.test(relayUrl)) {
+    throw new Error('relay: falta tunnel.relayUrl (https://harness.tamnora.com/index.php)');
+  }
+  if (!token) throw new Error('relay: falta tunnel.token');
+  const log = opts.log ?? (() => {});
+  const local = `http://127.0.0.1:${port}`;
+  const state = { stopped: false };
+
+  const call = async (action, body = {}, { timeoutMs = 30000 } = {}) => {
+    const res = await fetch(`${relayUrl}?a=${action}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token, ...body }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) throw new Error(`relay ${action}: HTTP ${res.status}`);
+    return res.json();
+  };
+
+  async function push(rid, chunks) {
+    await call('push', { rid, chunks }, { timeoutMs: 60000 });
+  }
+
+  async function handleRequest(row) {
+    const envelope = typeof row.payload === 'string' ? JSON.parse(row.payload) : row.payload;
+    const method = envelope.method ?? 'GET';
+    const path = String(envelope.path ?? '/');
+    const target = `${local}${path.startsWith('/') ? path : `/${path}`}`;
+    const init = { method, headers: { ...envelope.headers } };
+    delete init.headers.host;
+    if (envelope.body != null) init.body = envelope.body;
+    const res = await fetch(target, init);
+    const contentType = String(res.headers.get('content-type') ?? '');
+    const flat = {};
+    for (const header of ['content-type']) {
+      const value = res.headers.get(header);
+      if (value) flat[header] = value;
+    }
+    const cookies = res.headers.getSetCookie?.() ?? [];
+    if (cookies.length) flat['set-cookie'] = cookies;
+
+    if (!contentType.includes('text/event-stream')) {
+      const buffer = Buffer.from(await res.arrayBuffer());
+      await push(row.id, [
+        {
+          status: res.status,
+          headers: flat,
+          body: buffer.toString('base64'),
+          done: true,
+        },
+      ]);
+      return;
+    }
+
+    // SSE: reenviamos cada frame tal cual (el cliente sabe reconectar con cursor).
+    let seq = 0;
+    await push(row.id, [{ seq: seq++, status: res.status, headers: flat, done: false }]);
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let index;
+      while ((index = buffer.indexOf('\n\n')) !== -1) {
+        const frame = buffer.slice(0, index);
+        buffer = buffer.slice(index + 2);
+        let ev = '';
+        let data = '';
+        let id = null;
+        for (const line of frame.split('\n')) {
+          if (line.startsWith('event:')) ev = line.slice(6).trim();
+          else if (line.startsWith('data:')) data += line.slice(5).trim();
+          else if (line.startsWith('id:')) id = line.slice(3).trim();
+        }
+        if (!ev && !data) continue;
+        await push(row.id, [{ seq: seq++, ev: ev || 'message', data, id, done: false }]);
+      }
+    }
+    await push(row.id, [{ done: true }]);
+  }
+
+  async function pump() {
+    const registered = await call('register', {}, { timeoutMs: 20000 });
+    let cursor = Number(registered.cursor) || 0;
+    log(`relay: conectado a ${relayUrl} (inbox desde ${cursor})`);
+    while (!state.stopped) {
+      let rows;
+      try {
+        const batch = await call('poll', { after: cursor, wait: 20 }, { timeoutMs: 40000 });
+        rows = batch.rows ?? [];
+      } catch (error) {
+        if (state.stopped) break;
+        log(`relay poll: ${error?.message ?? error}`);
+        await new Promise((r) => setTimeout(r, 3000));
+        continue;
+      }
+      for (const row of rows) {
+        cursor = Math.max(cursor, Number(row.id) || 0);
+        try {
+          await handleRequest(row);
+        } catch (error) {
+          log(`relay request ${row.id}: ${error?.message ?? error}`);
+          try {
+            await push(row.id, [
+              {
+                status: 502,
+                headers: { 'content-type': 'application/json; charset=utf-8' },
+                body: Buffer.from(JSON.stringify({ error: `harness inaccesible: ${error?.message ?? error}` })).toString('base64'),
+                done: true,
+              },
+            ]);
+          } catch {
+            /* nada */
+          }
+        }
+      }
+    }
+  }
+
+  pump().catch((error) => {
+    if (!state.stopped) log(`relay pump: ${error?.message ?? error}`);
+  });
+
+  return {
+    url: relayUrl,
+    provider: 'relay',
+    pid: 0,
+    child: null,
+    probeUrl: `${relayUrl}?a=status`,
+    stop() {
+      state.stopped = true;
+    },
+  };
+}
+
 /** Devuelve { url, provider, pid, stop }. provider 'none' no abre nada. */
 export async function startTunnel(port, provider = 'tunnelmole', opts = {}) {
   const p = String(provider || 'tunnelmole').toLowerCase();
   if (p === 'none' || p === 'off' || p === '') return { url: '', provider: 'none', pid: 0, stop: () => {} };
   if (p === 'tunnelmole' || p === 'tmole') return startTunnelmole(port, opts);
+  if (p === 'relay') return startRelay(port, opts);
   throw new Error(`proveedor de tunel no soportado: ${provider}`);
 }

package/harness/packages/core/test/open.test.js

@@ -0,0 +1,19 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { openerFor } from '../src/open.js';
+
+test('usa el abridor nativo de cada plataforma', () => {
+  // En Windows `rundll32` evita el shell: una URL con & o ? no debe pasar por cmd.
+  assert.deepEqual(openerFor('http://127.0.0.1:4517', 'win32'), [
+    'rundll32.exe',
+    ['url.dll,FileProtocolHandler', 'http://127.0.0.1:4517'],
+  ]);
+  assert.deepEqual(openerFor('http://127.0.0.1:4517', 'darwin'), ['open', ['http://127.0.0.1:4517']]);
+  assert.deepEqual(openerFor('http://127.0.0.1:4517', 'linux'), ['xdg-open', ['http://127.0.0.1:4517']]);
+});
+
+test('mantiene la query string intacta', () => {
+  const url = 'http://127.0.0.1:4517/?a=1&b=2';
+  const [, args] = openerFor(url, 'linux');
+  assert.deepEqual(args, [url]);
+});