npm - @danieltmn/tamnora - Versions diffs - 0.7.1 → 0.9.0 - Mend

@danieltmn/tamnora 0.7.1 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (66) hide show

package/CHANGELOG.md +95 -0
package/README.md +9 -0
package/SECURITY.md +11 -6
package/harness/packages/cli/src/cli.js +1 -1
package/harness/packages/cli/src/commands/bridge.js +180 -119
package/harness/packages/cli/src/commands/run.js +1 -1
package/harness/packages/cli/src/commands/server.js +26 -50
package/harness/packages/cli/src/commands/tui.js +1 -1
package/harness/packages/cli/src/lib/daemon.js +92 -40
package/harness/packages/cli/test/release.test.js +9 -0
package/harness/packages/core/src/agent/modes.js +1 -1
package/harness/packages/core/src/agent/runAgent.js +3 -0
package/harness/packages/core/src/git/index.js +177 -0
package/harness/packages/core/src/index.js +16 -1
package/harness/packages/core/src/open.js +43 -0
package/harness/packages/core/src/pid.js +35 -0
package/harness/packages/core/src/procs/kill.js +95 -0
package/harness/packages/core/src/tools/executors.js +16 -0
package/harness/packages/core/src/tools/labels.js +2 -0
package/harness/packages/core/src/tools/permissions.js +1 -0
package/harness/packages/core/src/tools/schema.js +17 -0
package/harness/packages/core/src/tts/edge.js +232 -0
package/harness/packages/core/src/tunnel.js +180 -19
package/harness/packages/core/test/open.test.js +19 -0
package/harness/packages/core/test/procs.test.js +50 -0
package/harness/packages/core/test/tools.test.js +12 -0
package/harness/packages/core/test/tts.test.js +41 -0
package/harness/packages/server/public/app.js +4715 -3669
package/harness/packages/server/public/index.html +94 -5
package/harness/packages/server/public/landing/index.html +5 -5
package/harness/packages/server/public/reconcile.js +121 -0
package/harness/packages/server/public/relayClient.js +170 -0
package/harness/packages/server/public/runStream.js +207 -0
package/harness/packages/server/public/styles.css +196 -23
package/harness/packages/server/src/auth.js +29 -5
package/harness/packages/server/src/lib/agentRun.js +77 -0
package/harness/packages/server/src/lib/announcer.js +92 -0
package/harness/packages/server/src/lib/approvals.js +25 -3
package/harness/packages/server/src/lib/channels/telegram.js +85 -20
package/harness/packages/server/src/lib/ffmpeg.js +48 -0
package/harness/packages/server/src/lib/procs.js +3 -18
package/harness/packages/server/src/lib/runManager.js +24 -2
package/harness/packages/server/src/lib/sessionView.js +43 -0
package/harness/packages/server/src/lib/tasks.js +4 -9
package/harness/packages/server/src/lib/ttsSettings.js +42 -0
package/harness/packages/server/src/lib/workspace.js +37 -1
package/harness/packages/server/src/routes/chat.js +51 -47
package/harness/packages/server/src/routes/events.js +35 -0
package/harness/packages/server/src/routes/files.js +22 -26
package/harness/packages/server/src/routes/folders.js +9 -17
package/harness/packages/server/src/routes/git.js +35 -0
package/harness/packages/server/src/routes/procs.js +25 -15
package/harness/packages/server/src/routes/sessions.js +12 -19
package/harness/packages/server/src/routes/shell.js +19 -0
package/harness/packages/server/src/routes/state.js +32 -0
package/harness/packages/server/src/routes/tts.js +82 -0
package/harness/packages/server/src/server.js +25 -1
package/harness/packages/server/test/announcer.test.js +51 -0
package/harness/packages/server/test/reconcile.test.js +146 -0
package/harness/packages/server/test/relay.test.js +219 -0
package/harness/packages/server/test/runStream.test.js +245 -0
package/harness/packages/server/test/security.test.js +252 -0
package/harness/packages/server/test/server.test.js +617 -1
package/harness/packages/server/test/telegram-voz.test.js +156 -0
package/harness/packages/server/test/tts.test.js +133 -0
package/package.json +1 -1

package/harness/packages/server/public/index.html CHANGED Viewed

@@ -4,6 +4,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Tamnora Console</title>
+    <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%23231a17'/%3E%3Ctext x='16' y='23' font-family='Georgia,serif' font-size='18' font-weight='700' fill='%23e8dfd6' text-anchor='middle'%3ET%3C/text%3E%3C/svg%3E" />
     <script>
       (function () {
         var theme = null;
@@ -29,11 +30,11 @@
       rel="stylesheet"
       href="https://fonts.googleapis.com/css2?family=DM+Mono:wght@400;500&family=Libre+Baskerville:wght@400;700&family=Manrope:wght@400;500;600;700&display=swap"
     />
-    <link rel="stylesheet" href="/styles.css" />
+    <link rel="stylesheet" href="styles.css" />
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo"><span class="logo-t">T</span><span class="logo-h">H</span></span> <span class="ver">v0.7.1</span></div>
+      <div class="brand"><span class="logo"><span class="logo-t">T</span><span class="logo-h">H</span></span> <span class="ver">v0.9.0</span></div>
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>
@@ -57,6 +58,12 @@
         </div>
       </nav>
       <div class="settings">
+        <button id="new-session-top" type="button" class="btn topbar-new" title="nueva sesión" aria-label="nueva sesión">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" aria-hidden="true">
+            <path d="M12 5v14M5 12h14" />
+          </svg>
+          <span class="topbar-new-label">nueva sesión</span>
+        </button>
         <button id="search-toggle" type="button" class="btn icon" title="buscar (Ctrl/Cmd+K)" aria-label="buscar">
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
             <circle cx="11" cy="11" r="8" />
@@ -130,8 +137,11 @@
             </div>
           </div>
           <form id="chat-form" class="composer">
-            <div id="slash-menu" class="slash-menu" hidden></div>
-            <div id="attach-preview" class="attach-preview" hidden></div>
+<div id="slash-menu" class="slash-menu" hidden></div>
+        <div id="toasts" class="toasts" aria-live="polite"></div>
+        <div id="perm-banner" class="perm-banner" role="alert" aria-live="assertive" hidden></div>
+        <div id="attach-preview" class="attach-preview" hidden></div>
+            <div id="chat-queue" class="chat-queue" hidden></div>
             <div class="composer-row">
               <span class="prompt-mark">❯</span>
               <button type="button" id="attach-image" class="btn icon" title="Adjuntar imagen (o pegala / arrastrala)" aria-label="adjuntar imagen">
@@ -155,6 +165,8 @@
             <span id="sb-model">—</span>
             <span class="dot">·</span>
             <span id="sb-activity" class="sb-activity" hidden></span>
+            <span id="sb-sync" class="sb-channel retrying" hidden title="sin sincronía con el server"></span>
+            <span id="sb-channel" class="sb-channel" hidden title="canal de eventos entre dispositivos"></span>
             <span id="sb-rounds">listo</span>
             <span class="spacer"></span>
             <span id="sb-context" class="ctx muted" title="uso del contexto del modelo">
@@ -172,6 +184,7 @@
               <button type="button" class="xtab is-active" data-xp="files">estructura</button>
               <button type="button" class="xtab" data-xp="preview">preview</button>
               <button type="button" class="xtab" data-xp="procs">procs</button>
+              <button type="button" class="xtab" data-xp="git">git</button>
             </div>
             <span class="spacer"></span>
             <button id="explorer-refresh" type="button" class="btn icon" title="refrescar" aria-label="refrescar">
@@ -234,6 +247,18 @@
             <ul id="procs-list" class="providers"></ul>
             <pre id="procs-log" class="procs-log"></pre>
           </div>
+          <div id="xp-git" class="xp-pane" hidden>
+            <div class="xp-bar">
+              <span id="git-branch" class="git-branch">…</span>
+              <span id="git-sync" class="muted grow"></span>
+            </div>
+            <div class="explorer-filter">
+              <input id="git-filter" placeholder="filtrar por nombre…" spellcheck="false" />
+            </div>
+            <ul id="git-list" class="git-list"></ul>
+            <div id="git-status" class="explorer-status"></div>
+          </div>
         </aside>
         <button id="sidebar-handle" type="button" class="panel-handle panel-handle-left" title="mostrar sesiones" aria-label="mostrar panel de sesiones" aria-pressed="false">
@@ -280,6 +305,23 @@
             </div>
           </div>
         </dialog>
+        <dialog id="git-modal" class="modal file-modal">
+          <div class="modal-card">
+            <div class="row between">
+              <h3 id="git-title">cambios</h3>
+              <div class="file-actions">
+                <span id="git-meta" class="muted"></span>
+                <button id="git-close" type="button" class="btn icon" title="cerrar" aria-label="cerrar">
+                  <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                    <path d="M18 6 6 18M6 6l12 12" />
+                  </svg>
+                </button>
+              </div>
+            </div>
+            <pre id="git-diff" class="file-preview git-diff"></pre>
+          </div>
+        </dialog>
       </section>
       <section id="view-providers" class="view">
@@ -364,6 +406,7 @@
             <button type="button" class="ajustes-tab" data-panel="mcp" role="tab">MCP</button>
             <button type="button" class="ajustes-tab" data-panel="skills" role="tab">Skills</button>
             <button type="button" class="ajustes-tab" data-panel="telegram" role="tab">Telegram</button>
+            <button type="button" class="ajustes-tab" data-panel="voz" role="tab">Voz</button>
             <button type="button" class="ajustes-tab" data-panel="limites" role="tab">Límites</button>
           </nav>
@@ -486,6 +529,52 @@
           </div>
         </div>
+        <div class="panel ajustes-panel" data-panel="voz">
+          <div class="row between">
+            <h2>Voz</h2>
+            <span id="voz-status" class="summary">cargando…</span>
+          </div>
+          <p class="muted verify-line">
+            El agente cuenta lo que hace con frases cortas (voces neuronales de Edge, sin API
+            key): arranque, herramientas y cierre. No lee la respuesta entera. En Telegram llega
+            como nota de voz al terminar.
+          </p>
+          <label class="check" title="hablar mientras trabaja">
+            <input id="voz-enabled" type="checkbox" /> Hablar mientras trabaja
+          </label>
+          <label class="field"><span>voz</span>
+            <select id="voz-voice" title="voz del catálogo de Edge"></select>
+          </label>
+          <label class="field"><span>velocidad</span>
+            <select id="voz-rate" title="velocidad del habla">
+              <option value="-20%">más lenta</option>
+              <option value="+0%">normal</option>
+              <option value="+20%">más rápida</option>
+            </select>
+          </label>
+          <div class="voz-announce">
+            <span class="muted">qué cuenta:</span>
+            <label class="check" title="avisar al arrancar el turno">
+              <input id="voz-ann-start" type="checkbox" /> el arranque
+            </label>
+            <label class="check" title="avisar las herramientas (como mucho una cada 20 s)">
+              <input id="voz-ann-tools" type="checkbox" /> las herramientas
+            </label>
+            <label class="check" title="avisar al terminar">
+              <input id="voz-ann-end" type="checkbox" /> el cierre
+            </label>
+          </div>
+          <p id="voz-ffmpeg" class="muted" hidden>
+            Sin <code>ffmpeg</code> en el PATH, en Telegram llega como audio MP3 en vez de nota
+            de voz.
+          </p>
+          <div class="row">
+            <button id="voz-save" class="btn primary" type="button">guardar</button>
+            <button id="voz-test" class="btn" type="button">probar voz</button>
+            <span id="voz-msg" class="summary"></span>
+          </div>
+        </div>
         <div class="panel ajustes-panel" data-panel="limites">
           <div class="row between">
             <h2>Límites del agente</h2>
@@ -667,6 +756,6 @@
       </div>
     </dialog>
-    <script type="module" src="/app.js"></script>
+      <script type="module" src="app.js"></script>
   </body>
 </html>

package/harness/packages/server/public/landing/index.html CHANGED Viewed

@@ -450,8 +450,8 @@
           <h1>Tamnora<br /><span>Harness</span></h1>
           <p class="hero-copy">
-            Un harness simple y centralizado para orquestar agentes de IA, gestionar procesos y mantener
-            el control de tu operación desde cualquier dispositivo.
+            Un harness local para orquestar agentes de IA, ejecutar tools en tu workspace y mantener el
+            control desde tu máquina o el celular (túnel + QR o Telegram).
           </p>
           <div class="actions">
@@ -462,15 +462,15 @@
           <div class="features" id="caracteristicas">
             <div class="feature">
               <div class="feature-icon">◈</div>
-              <div><b>Centralizado</b><span>Tus agentes y flujos en un solo lugar.</span></div>
+              <div><b>Local</b><span>Corre en tu máquina; el estado vive en tu casa.</span></div>
             </div>
             <div class="feature">
               <div class="feature-icon">↗</div>
-              <div><b>Accesible</b><span>Disponible desde cualquier dispositivo.</span></div>
+              <div><b>Accesible</b><span>Consola web, TUI y Telegram; túnel con QR.</span></div>
             </div>
             <div class="feature">
               <div class="feature-icon">✓</div>
-              <div><b>Control</b><span>Ejecuciones claras y trazables.</span></div>
+              <div><b>Control</b><span>Permisos allow/ask/deny y runs trazables.</span></div>
             </div>
           </div>
         </section>

package/harness/packages/server/public/reconcile.js ADDED Viewed

@@ -0,0 +1,121 @@
+/**
+ * Reconciliacion entre el estado remoto (`GET /api/state`) y el local.
+ *
+ * Es puro a proposito: sin DOM, sin fetch, sin timers. Los tres intentos
+ * anteriores de arreglar "la consola no ve lo que pasa en otro dispositivo"
+ * fallaron porque esa logica vivia enterrada en un `app.js` de miles de lineas
+ * sin un solo test, asi que cada fix era una hipotesis. Este modulo se testea
+ * con `node:test` y cubre los casos que nos quemaron.
+ *
+ * Principio: los streams SSE son un **atajo de latencia**, nunca la verdad. La
+ * verdad se lee con un request corto, que es lo unico que sobrevive a un tunel
+ * con 4G (y a iOS matando los timers al mandar la pestana a background).
+ */
+/** Estado local minimo: que sesiones tiene abiertas la consola y como. */
+export function localState({ panes, asks }) {
+  return {
+    panes: [...panes].map(([id, pane]) => ({
+      id,
+      working: Boolean(pane.working),
+      attached: Boolean(pane.attached),
+    })),
+    asks: [...asks],
+  };
+}
+/**
+ * Compara el estado remoto con el local y dice que hay que hacer.
+ *
+ * @param {{panes: Array, asks: Array<string>}} local
+ * @param {{sessions: Array, permissions: Array}} remote
+ */
+export function diffState(local, remote) {
+  const sessions = remote?.sessions ?? [];
+  const permissions = remote?.permissions ?? [];
+  const panes = new Map((local?.panes ?? []).map((pane) => [pane.id, pane]));
+  const knownAsks = new Set(local?.asks ?? []);
+  const serverAsks = new Set(permissions.map((ask) => ask.askId));
+  const toAttach = [];
+  const toDetach = [];
+  const gone = [];
+  for (const session of sessions) {
+    const busy = session.running || session.awaiting > 0;
+    const pane = panes.get(session.id);
+    if (!pane) continue;
+    const attached = pane.working && pane.attached;
+    // Un permiso pendiente obliga a estar enganchado aunque `running` sea false:
+    // el permiso no se reconstruye desde los mensajes, vive en /api/state.
+    if (busy && !attached) toAttach.push(session.id);
+    else if (!busy && attached) toDetach.push(session.id);
+  }
+  for (const id of panes.keys()) {
+    if (!sessions.some((session) => session.id === id)) gone.push(id);
+  }
+  const newAsks = permissions.filter((ask) => !knownAsks.has(ask.askId));
+  const resolvedAsks = [...knownAsks].filter((askId) => !serverAsks.has(askId));
+  return {
+    toAttach,
+    toDetach,
+    gone,
+    newAsks,
+    resolvedAsks,
+    // Los permisos siguen esperando: el banner no se baja.
+    pending: permissions,
+    // Para repintar insignias sin volver a pegarle al server.
+    sessions,
+    remoteActive: sessions.filter((session) => session.running || session.awaiting > 0).map((session) => session.id),
+  };
+}
+/**
+ * Cada cuanto preguntar. Un permiso pendiente es algo que te esta esperando:
+ * ahí la latencia se nota y se paga. Idle, se aburre al server.
+ */
+export function pollDelayMs(state) {
+  const permissions = state?.permissions?.length ?? 0;
+  const running = (state?.sessions ?? []).some((session) => session.running);
+  if (permissions > 0) return 5000;
+  if (running) return 10000;
+  return 25000;
+}
+export function humanSize(text) {
+  const bytes = new TextEncoder().encode(String(text ?? '')).length;
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} kB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/**
+ * Resumen legible de los argumentos de una tool, para un permiso.
+ *
+ * Volcar el JSON crudo era inutil: al pedir permiso para `write` se veia medio
+ * archivo entero con los `\n` escapados, que es justo lo contrario de una
+ * pantalla hecha para decidir. Para `bash` lo que interesa es el comando; para
+ * las tools de archivo, la ruta y cuanto se esta escribiendo.
+ */
+export function summarizeArgs(name, args, max = 240) {
+  const cut = (value) => {
+    const text = String(value ?? '');
+    return text.length > max ? `${text.slice(0, max)}…` : text;
+  };
+  const a = args ?? {};
+  if (name === 'bash' && a.command) return cut(a.command);
+  if ((name === 'write' || name === 'edit' || name === 'read') && a.path) {
+    return a.content ? `${a.path} · ${humanSize(a.content)}` : String(a.path);
+  }
+  if ((name === 'fetch_url' || name === 'preview_url') && a.url) return cut(a.url);
+  if (name === 'task' && (a.description || a.prompt)) return cut(a.description || a.prompt);
+  const keys = Object.keys(a);
+  if (keys.length === 1 && typeof a[keys[0]] === 'string') return cut(a[keys[0]]);
+  if (!keys.length) return '';
+  // Cualquier otra tool: el JSON, pero en una linea para que no aparezca un
+  // muro con los saltos de linea escapados.
+  return cut(JSON.stringify(a).replace(/\\n/g, ' '));
+}

package/harness/packages/server/public/relayClient.js ADDED Viewed

@@ -0,0 +1,170 @@
+// Transporte relay para la consola estatica (harness.tamnora.com/console/).
+//
+// La misma consola corre en el harness local y en el tamnora del sitio: aqui
+// cada llamada a `api()` y cada stream se manda por el mailbox del relay y el
+// daemon local (`tamnora bridge --tunnel relay`) la ejecuta contra su propio
+// server. El token (?t=...) es la credencial compartida con el mailbox.
+//
+// Requiere runStream.js (streamSse/delay) que ya carga la consola.
+import { streamSse, delay } from './runStream.js';
+export function installRelayTransport({ base, token }) {
+  const cleanToken = String(token ?? '').trim();
+  if (!cleanToken) {
+    console.warn('[relay] sin token: la consola vera solo la pantalla de login');
+  }
+  const b64decode = (value) =>
+    new TextDecoder().decode(Uint8Array.from(atob(String(value ?? '')), (c) => c.charCodeAt(0)));
+  const relayUrl = (action) => `${base}?a=${action}&t=${encodeURIComponent(cleanToken)}`;
+  async function post(action, payload, signal) {
+    const res = await fetch(relayUrl(action), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+      signal,
+    });
+    if (!res.ok) {
+      const error = new Error(`relay HTTP ${res.status}`);
+      error.status = res.status;
+      throw error;
+    }
+    return res.json();
+  }
+  function applyCookies(headers) {
+    for (const cookie of headers?.['set-cookie'] ?? []) {
+      const kv = String(cookie).split(';')[0];
+      if (kv && kv.includes('=')) document.cookie = `${kv}; Path=/`;
+    }
+  }
+  /** Request sincrono: PHP espera inline la respuesta completa del mailbox. */
+  async function request(path, { method = 'GET', body, headers = {} } = {}) {
+    const envelope = {
+      method,
+      path,
+      headers,
+      body: body === undefined ? null : JSON.stringify(body),
+      stream: false,
+    };
+    const data = await post('send', envelope);
+    if (data.error) {
+      const error = new Error(data.error);
+      error.status = Number(data.status) || 0;
+      throw error;
+    }
+    applyCookies(data.headers);
+    const text = b64decode(data.body);
+    let parsed = null;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = { raw: text };
+    }
+    if (Number(data.status) >= 400) {
+      const error = new Error(parsed?.error ?? `HTTP ${data.status}`);
+      error.status = Number(data.status);
+      throw error;
+    }
+    return parsed;
+  }
+  const parseOrRaw = (text) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return { raw: text };
+    }
+  };
+  /**
+   * Stream via mailbox: abre el rid y consume `a=stream` (SSE con cursor).
+   * Si el PHP corta (max_execution_time) reconecta y repite desde el cursor:
+   * el replay es del mailbox, NO re-ejecuta el request original.
+   */
+  async function stream(path, { method = 'POST', body, headers = {}, signal, silenceMs } = {}, onEvent) {
+    const envelope = {
+      method,
+      path,
+      headers,
+      body: body === undefined ? null : JSON.stringify(body),
+      stream: true,
+    };
+    const opened = await post('send', envelope, signal);
+    if (opened.error) {
+      const error = new Error(opened.error);
+      error.status = Number(opened.status) || 0;
+      throw error;
+    }
+    const rid = opened.rid;
+    let cursor = 0;
+    let attempt = 0;
+    for (;;) {
+      if (signal?.aborted) {
+        const error = new Error('Aborted', 'AbortError');
+        error.name = 'AbortError';
+        throw error;
+      }
+      try {
+        let finished = false;
+        await streamSse(
+          `${base}?a=stream&t=${encodeURIComponent(cleanToken)}&rid=${encodeURIComponent(rid)}&from=${cursor}`,
+          { signal, silenceMs },
+          (event, data, id) => {
+            if (id != null) cursor = Number(id) || cursor;
+            if (event === 'chunk') {
+              const payload = data?.payload ?? {};
+              if (!payload.done) {
+                onEvent(payload.ev || 'message', payload.data != null ? parseOrRaw(payload.data) : {}, payload.id ?? null);
+              }
+              return;
+            }
+            // meta: headers del run o cierre del daemon.
+            if (data?.payload?.done) finished = true;
+            else if (data?.payload?.error) {
+              const error = new Error(data.payload.error);
+              error.fatalRelay = true;
+              throw error;
+            }
+          }
+        );
+        return { finished };
+      } catch (error) {
+        if (error?.name === 'AbortError' || error?.fatalRelay) throw error;
+        attempt += 1;
+        await delay(Math.min(8000, 1000 * 2 ** (attempt - 1)), signal);
+      }
+    }
+  }
+  window.relayTransport = { token: cleanToken, base, request, stream, enabled: Boolean(cleanToken) };
+  return window.relayTransport;
+}
+/** Pantalla minima si no hay token: pide uno y recarga. */
+export function showRelayTokenGate() {
+  document.body.innerHTML = '';
+  document.body.style.visibility = 'visible';
+  const form = document.createElement('form');
+  form.style.cssText = 'max-width:420px;margin:15vh auto;font-family:ui-sans-serif,system-ui;padding:0 16px';
+  form.innerHTML = `
+    <h1 style="font-size:20px">Tamnora Console</h1>
+    <p style="color:#777;font-size:14px">Pegá el token del bridge (o escaneá el QR del <code>tamnora bridge --tunnel relay</code>).</p>
+    <input name="t" placeholder="token" style="width:100%;padding:10px;font-size:14px" autocomplete="off" />
+    <button style="margin-top:10px;padding:10px 16px">entrar</button>`;
+  form.addEventListener('submit', (event) => {
+    event.preventDefault();
+    const value = form.elements.t.value.trim();
+    if (!value) return;
+    localStorage.setItem('tamnora-relay-token', value);
+    const params = new URLSearchParams(location.search);
+    params.delete('t');
+    location.href = location.pathname + (params.toString() ? `?${params}` : '');
+    location.reload();
+  });
+  document.body.append(form);
+}