@danieltmn/tamnora 0.9.6 → 0.11.0

package/harness/packages/core/src/tunnel.js

@@ -4,8 +4,9 @@ import { bridgeStatePath } from './config/home.js';
 import { pidAlive, killPidTree } from './pid.js';
 
 /**
- * Tuneles publicos. v1 soporta tunnelmole (gratis, sin cuenta; URL aleatoria)
- * via `npx --yes tunnelmole <puerto>`.
+ * Acceso remoto. Proveedores:
+ *  - tailscale: VPN mesh privada + `tailscale serve` (recomendado; sin exposicion).
+ *  - tunnelmole: tunel publico gratis (URL aleatoria); solo para `preview`.
  */
 
 function killTree(child) {
@@ -32,7 +33,9 @@ export function tunnelState() {
   let state = null;
   try {
     const parsed = JSON.parse(readFileSync(statePath, 'utf8'));
-    if (parsed?.pid && pidAlive(parsed.pid)) state = parsed;
+    // Tailscale es una red privada que entra por loopback: no es un tunel
+    // publico, asi que no debe degradar los guards locales (`localOk`).
+    if (parsed?.provider !== 'tailscale' && parsed?.pid && pidAlive(parsed.pid)) state = parsed;
   } catch {
     /* sin bridge */
   }
@@ -109,6 +112,7 @@ function spawnTunnel(bin, args, opts = {}) {
   });
 }
 
+// Tunel publico para el feature `preview` (no lo usa `bridge`).
 export function startTunnelmole(port, opts = {}) {
   return spawnTunnel('npx', ['--yes', 'tunnelmole', String(port)], {
     ...opts,
@@ -120,155 +124,121 @@ export function startTunnelmole(port, opts = {}) {
 }
 
 /**
- * Relay propio (harness.tamnora.com): mailbox HTTP sobre cPanel (solo PHP).
- * El daemon no recibe conexiones: llama hacia afuera (a=poll), ejecuta cada
- * request contra el server local y empuja las respuestas (a=push).
+ * Tailscale: VPN mesh (WireGuard). `tailscale serve` publica HTTPS dentro del
+ * tailnet reenviando a loopback, asi que no hay exposicion publica y las
+ * peticiones siguen siendo "locales" para el server. Proveedor recomendado.
  */
-export function startRelay(port, opts = {}) {
-  const relayUrl = String(opts.relayUrl ?? '').replace(/\/+$/, '');
-  const token = String(opts.token ?? '');
-  if (!relayUrl || !/^https?:\/\//.test(relayUrl)) {
-    throw new Error('relay: falta tunnel.relayUrl (https://harness.tamnora.com/index.php)');
-  }
-  if (!token) throw new Error('relay: falta tunnel.token');
-  const log = opts.log ?? (() => {});
-  const local = `http://127.0.0.1:${port}`;
-  const state = { stopped: false };
-
-  const call = async (action, body = {}, { timeoutMs = 30000 } = {}) => {
-    const res = await fetch(`${relayUrl}?a=${action}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ token, ...body }),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (!res.ok) throw new Error(`relay ${action}: HTTP ${res.status}`);
-    return res.json();
-  };
-
-  async function push(rid, chunks) {
-    await call('push', { rid, chunks }, { timeoutMs: 60000 });
-  }
-
-  async function handleRequest(row) {
-    const envelope = typeof row.payload === 'string' ? JSON.parse(row.payload) : row.payload;
-    const method = envelope.method ?? 'GET';
-    const path = String(envelope.path ?? '/');
-    const target = `${local}${path.startsWith('/') ? path : `/${path}`}`;
-    const init = { method, headers: { ...envelope.headers } };
-    delete init.headers.host;
-    if (envelope.body != null) init.body = envelope.body;
-    const res = await fetch(target, init);
-    const contentType = String(res.headers.get('content-type') ?? '');
-    const flat = {};
-    for (const header of ['content-type']) {
-      const value = res.headers.get(header);
-      if (value) flat[header] = value;
-    }
-    const cookies = res.headers.getSetCookie?.() ?? [];
-    if (cookies.length) flat['set-cookie'] = cookies;
-
-    if (!contentType.includes('text/event-stream')) {
-      const buffer = Buffer.from(await res.arrayBuffer());
-      await push(row.id, [
-        {
-          status: res.status,
-          headers: flat,
-          body: buffer.toString('base64'),
-          done: true,
-        },
-      ]);
+function runTailscale(args, opts = {}) {
+  const timeoutMs = opts.timeoutMs || 15000;
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn('tailscale', args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        shell: process.platform === 'win32',
+      });
+    } catch (err) {
+      reject(err);
       return;
     }
-
-    // SSE: reenviamos cada frame tal cual (el cliente sabe reconectar con cursor).
-    let seq = 0;
-    await push(row.id, [{ seq: seq++, status: res.status, headers: flat, done: false }]);
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    for (;;) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let index;
-      while ((index = buffer.indexOf('\n\n')) !== -1) {
-        const frame = buffer.slice(0, index);
-        buffer = buffer.slice(index + 2);
-        let ev = '';
-        let data = '';
-        let id = null;
-        for (const line of frame.split('\n')) {
-          if (line.startsWith('event:')) ev = line.slice(6).trim();
-          else if (line.startsWith('data:')) data += line.slice(5).trim();
-          else if (line.startsWith('id:')) id = line.slice(3).trim();
-        }
-        if (!ev && !data) continue;
-        await push(row.id, [{ seq: seq++, ev: ev || 'message', data, id, done: false }]);
+    let out = '';
+    let err = '';
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      killTree(child);
+      reject(new Error(`tailscale ${args.join(' ')} no respondio (${Math.round(timeoutMs / 1000)} s).`));
+    }, timeoutMs);
+    child.stdout.on('data', (data) => {
+      out += String(data);
+    });
+    child.stderr.on('data', (data) => {
+      err += String(data);
+    });
+    child.on('error', (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`no se pudo ejecutar tailscale (${error.message}). Instalalo: https://tailscale.com/download`));
+    });
+    child.on('exit', (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (code === 0) resolve({ stdout: out, stderr: err });
+      else {
+        const detail = err.trim() ? `: ${err.trim().slice(0, 200)}` : '';
+        reject(new Error(`tailscale ${args.join(' ')} fallo (codigo ${code})${detail}`));
       }
-    }
-    await push(row.id, [{ done: true }]);
-  }
+    });
+  });
+}
 
-  async function pump() {
-    const registered = await call('register', {}, { timeoutMs: 20000 });
-    let cursor = Number(registered.cursor) || 0;
-    log(`relay: conectado a ${relayUrl} (inbox desde ${cursor})`);
-    while (!state.stopped) {
-      let rows;
-      try {
-        const batch = await call('poll', { after: cursor, wait: 20 }, { timeoutMs: 40000 });
-        rows = batch.rows ?? [];
-      } catch (error) {
-        if (state.stopped) break;
-        log(`relay poll: ${error?.message ?? error}`);
-        await new Promise((r) => setTimeout(r, 3000));
-        continue;
-      }
-      for (const row of rows) {
-        cursor = Math.max(cursor, Number(row.id) || 0);
-        try {
-          await handleRequest(row);
-        } catch (error) {
-          log(`relay request ${row.id}: ${error?.message ?? error}`);
-          try {
-            await push(row.id, [
-              {
-                status: 502,
-                headers: { 'content-type': 'application/json; charset=utf-8' },
-                body: Buffer.from(JSON.stringify({ error: `harness inaccesible: ${error?.message ?? error}` })).toString('base64'),
-                done: true,
-              },
-            ]);
-          } catch {
-            /* nada */
-          }
-        }
-      }
+/** Interpreta `tailscale status --json`: nombre DNS del nodo e IPv4 del tailnet. */
+export function parseTailscaleStatus(json) {
+  const data = typeof json === 'string' ? JSON.parse(json) : json ?? {};
+  const dnsName = String(data?.Self?.DNSName ?? '').replace(/\.$/, '');
+  const ipv4 = String((data?.Self?.TailscaleIPs ?? []).find((ip) => !String(ip).includes(':')) ?? '');
+  return { dnsName, ipv4, connected: Boolean(dnsName) };
+}
+
+export async function startTailscaleServe(port, opts = {}) {
+  const log = opts.log ?? (() => {});
+  let status;
+  try {
+    status = await runTailscale(['status', '--json']);
+  } catch (error) {
+    throw new Error(`tailscale no esta disponible: ${error.message}`);
+  }
+  let parsed;
+  try {
+    parsed = parseTailscaleStatus(status.stdout);
+  } catch {
+    throw new Error('no pude interpretar `tailscale status --json`.');
+  }
+  if (!parsed.connected) {
+    throw new Error('Tailscale no esta conectado. Inicia sesion con `tailscale up`.');
+  }
+  const backend = `http://127.0.0.1:${port}`;
+  try {
+    await runTailscale(['serve', '--bg', backend], { timeoutMs: 30000 });
+  } catch (first) {
+    try {
+      await runTailscale(['serve', '--bg', String(port)], { timeoutMs: 30000 });
+    } catch {
+      throw new Error(`no pude publicar con \`tailscale serve\`: ${first.message}`);
     }
   }
-
-  pump().catch((error) => {
-    if (!state.stopped) log(`relay pump: ${error?.message ?? error}`);
-  });
-
+  const url = `https://${parsed.dnsName}`;
+  log(`tailscale: ${url} -> ${backend}`);
   return {
-    url: relayUrl,
-    provider: 'relay',
+    url,
+    provider: 'tailscale',
     pid: 0,
     child: null,
-    probeUrl: `${relayUrl}?a=status`,
-    stop() {
-      state.stopped = true;
-    },
+    probeUrl: `${url}/api/health`,
+    stop: () => runTailscale(['serve', 'reset']).catch(() => {}),
   };
 }
 
+/** Estado de Tailscale (lanza si no esta instalado o no responde). */
+export async function probeTailscale() {
+  const { stdout } = await runTailscale(['status', '--json']);
+  return parseTailscaleStatus(stdout);
+}
+
+/** Quita toda la configuracion de `tailscale serve` de este nodo. */
+export function resetTailscaleServe() {
+  return runTailscale(['serve', 'reset'], { timeoutMs: 30000 });
+}
+
 /** Devuelve { url, provider, pid, stop }. provider 'none' no abre nada. */
 export async function startTunnel(port, provider = 'tunnelmole', opts = {}) {
   const p = String(provider || 'tunnelmole').toLowerCase();
   if (p === 'none' || p === 'off' || p === '') return { url: '', provider: 'none', pid: 0, stop: () => {} };
+  if (p === 'tailscale' || p === 'ts') return startTailscaleServe(port, opts);
   if (p === 'tunnelmole' || p === 'tmole') return startTunnelmole(port, opts);
-  if (p === 'relay') return startRelay(port, opts);
   throw new Error(`proveedor de tunel no soportado: ${provider}`);
 }

package/harness/packages/core/test/home.test.js

@@ -48,6 +48,17 @@ test('ensureApp creates app.json with a secret and roundtrips', async () => {
   assert.equal(readApp().port, 4599);
 });
 
+test('readApp migra los proveedores retirados (tunnelmole/relay) a tailscale', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'tamnora-home-'));
+  setHome(dir);
+  for (const provider of ['tunnelmole', 'relay']) {
+    const app = ensureApp();
+    app.tunnel = { ...app.tunnel, provider };
+    writeApp(app);
+    assert.equal(readApp().tunnel.provider, 'tailscale', provider);
+  }
+});
+
 test('migrateLegacyDb copies the legacy project database to the global home', async () => {
   const home = await mkdtemp(path.join(tmpdir(), 'tamnora-home-'));
   const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-cwd-'));

package/harness/packages/server/public/app.js

@@ -3,7 +3,6 @@
 import { renderMarkdown, speechText } from './markdown.js';
 import { streamSse, followRun } from './runStream.js';
 import { diffState, pollDelayMs, localState, summarizeArgs } from './reconcile.js';
-import { installRelayTransport, showRelayTokenGate } from './relayClient.js';
 
 const $ = (sel) => document.querySelector(sel);
 let csrfToken = '';
@@ -97,30 +96,7 @@ function icon(name, size = 16, className = '') {
 
 /* --- HTTP / SSE ---------------------------------------------------------- */
 
-// Tamnora Relay: cuando la consola se sirve desde harness.tamnora.com/console,
-// el page define `window.TAMNORA_RELAY = { base }` y todo el trafico /api pasa
-// por el mailbox del relay (relaClient). Sin esa variable es el harness local.
-const RELAY_CONFIG = window.TAMNORA_RELAY ?? null;
-const relayToken = RELAY_CONFIG
-  ? new URLSearchParams(location.search).get('t') || localStorage.getItem('tamnora-relay-token') || ''
-  : '';
-const relayTransport = RELAY_CONFIG
-  ? installRelayTransport({ base: RELAY_CONFIG.base, token: relayToken })
-  : null;
-
-if (RELAY_CONFIG && !relayTransport.enabled) {
-  showRelayTokenGate();
-  throw new Error('[relay] falta el token de acceso');
-}
-
 async function api(path, { method = 'GET', body, headers = {} } = {}) {
-  if (relayTransport?.enabled) {
-    return relayTransport.request(path, {
-      method,
-      body,
-      headers: method !== 'GET' && csrfToken ? { 'x-csrf': csrfToken, ...headers } : headers,
-    });
-  }
   const init = {};
   if (body) init['Content-Type'] = 'application/json';
   if (method !== 'GET' && csrfToken) init['x-csrf'] = csrfToken;
@@ -145,13 +121,10 @@ async function api(path, { method = 'GET', body, headers = {} } = {}) {
 }
 
 const streamPost = (url, body, onEvent, signal) =>
-  relayTransport?.enabled
-    ? relayTransport.stream(url, { method: 'POST', body, signal, headers: csrfToken ? { 'x-csrf': csrfToken } : {} }, onEvent)
-    : streamSse(url, { method: 'POST', body, csrf: csrfToken, signal }, onEvent);
+  streamSse(url, { method: 'POST', body, csrf: csrfToken, signal }, onEvent);
 
 /** SSE GET de la consola (/api/sessions/:id/stream, /api/events). */
-const openStream = (url, opts, onEvent) =>
-  relayTransport?.enabled ? relayTransport.stream(url, opts, onEvent) : streamSse(url, opts, onEvent);
+const openStream = (url, opts, onEvent) => streamSse(url, opts, onEvent);
 
 /* --- localStorage (todas las lecturas/escrituras pasan por aca) ------------ */
 
@@ -601,7 +574,7 @@ if (logout) {
     } catch {
       // igual salimos
     }
-    location.href = relayTransport?.enabled ? location.pathname : '/landing';
+    location.href = '/landing';
   });
 }
 

package/harness/packages/server/public/index.html

@@ -37,7 +37,7 @@
   </head>
   <body>
     <header class="topbar">
-      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span class="ver">v0.9.6</span></div>
+      <div class="brand"><span class="logo"><img src="/icons/logo.png" alt="Tamnora" /></span> <span class="ver">v0.11.0</span></div>
       <nav class="tabs">
         <button class="tab active" data-tab="chat">chat</button>
         <button class="tab" data-tab="providers">proveedores</button>

package/harness/packages/server/test/security.test.js

@@ -74,6 +74,21 @@ test('localOk exige loopback en remoteAddress y sin tunel activo', async () => {
   }
 });
 
+test('un bridge de tailscale no degrada localOk (red privada por loopback)', async () => {
+  const { instance } = await startServer();
+  try {
+    await writeFile(
+      bridgeStatePath(),
+      `${JSON.stringify({ pid: process.pid, url: 'https://pc.tailnet.ts.net', provider: 'tailscale', port: 4517 })}\n`
+    );
+    await new Promise((r) => setTimeout(r, 1100));
+    assert.ok(localOk({ socket: { remoteAddress: '127.0.0.1' } }), 'loopback sigue siendo local con tailscale');
+  } finally {
+    await clearTunnel();
+    await instance.close();
+  }
+});
+
 test('POST /api/shell responde 403 mientras el tunel esta activo', async () => {
   const { instance, base } = await startServer();
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danieltmn/tamnora",
-  "version": "0.9.6",
+  "version": "0.11.0",
   "description": "Harness local para IAs: agente CLI-first con TUI, consola web y evaluacion. Node puro, sin dependencias.",
   "type": "module",
   "packageManager": "pnpm@11.25.0",

package/harness/packages/server/public/relayClient.js

@@ -1,170 +0,0 @@
-// Transporte relay para la consola estatica (harness.tamnora.com/console/).
-//
-// La misma consola corre en el harness local y en el tamnora del sitio: aqui
-// cada llamada a `api()` y cada stream se manda por el mailbox del relay y el
-// daemon local (`tamnora bridge --tunnel relay`) la ejecuta contra su propio
-// server. El token (?t=...) es la credencial compartida con el mailbox.
-//
-// Requiere runStream.js (streamSse/delay) que ya carga la consola.
-
-import { streamSse, delay } from './runStream.js';
-
-export function installRelayTransport({ base, token }) {
-  const cleanToken = String(token ?? '').trim();
-  if (!cleanToken) {
-    console.warn('[relay] sin token: la consola vera solo la pantalla de login');
-  }
-
-  const b64decode = (value) =>
-    new TextDecoder().decode(Uint8Array.from(atob(String(value ?? '')), (c) => c.charCodeAt(0)));
-
-  const relayUrl = (action) => `${base}?a=${action}&t=${encodeURIComponent(cleanToken)}`;
-
-  async function post(action, payload, signal) {
-    const res = await fetch(relayUrl(action), {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload),
-      signal,
-    });
-    if (!res.ok) {
-      const error = new Error(`relay HTTP ${res.status}`);
-      error.status = res.status;
-      throw error;
-    }
-    return res.json();
-  }
-
-  function applyCookies(headers) {
-    for (const cookie of headers?.['set-cookie'] ?? []) {
-      const kv = String(cookie).split(';')[0];
-      if (kv && kv.includes('=')) document.cookie = `${kv}; Path=/`;
-    }
-  }
-
-  /** Request sincrono: PHP espera inline la respuesta completa del mailbox. */
-  async function request(path, { method = 'GET', body, headers = {} } = {}) {
-    const envelope = {
-      method,
-      path,
-      headers,
-      body: body === undefined ? null : JSON.stringify(body),
-      stream: false,
-    };
-    const data = await post('send', envelope);
-    if (data.error) {
-      const error = new Error(data.error);
-      error.status = Number(data.status) || 0;
-      throw error;
-    }
-    applyCookies(data.headers);
-    const text = b64decode(data.body);
-    let parsed = null;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      parsed = { raw: text };
-    }
-    if (Number(data.status) >= 400) {
-      const error = new Error(parsed?.error ?? `HTTP ${data.status}`);
-      error.status = Number(data.status);
-      throw error;
-    }
-    return parsed;
-  }
-
-  const parseOrRaw = (text) => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return { raw: text };
-    }
-  };
-
-  /**
-   * Stream via mailbox: abre el rid y consume `a=stream` (SSE con cursor).
-   * Si el PHP corta (max_execution_time) reconecta y repite desde el cursor:
-   * el replay es del mailbox, NO re-ejecuta el request original.
-   */
-  async function stream(path, { method = 'POST', body, headers = {}, signal, silenceMs } = {}, onEvent) {
-    const envelope = {
-      method,
-      path,
-      headers,
-      body: body === undefined ? null : JSON.stringify(body),
-      stream: true,
-    };
-    const opened = await post('send', envelope, signal);
-    if (opened.error) {
-      const error = new Error(opened.error);
-      error.status = Number(opened.status) || 0;
-      throw error;
-    }
-    const rid = opened.rid;
-    let cursor = 0;
-    let attempt = 0;
-    for (;;) {
-      if (signal?.aborted) {
-        const error = new Error('Aborted', 'AbortError');
-        error.name = 'AbortError';
-        throw error;
-      }
-      try {
-        let finished = false;
-        await streamSse(
-          `${base}?a=stream&t=${encodeURIComponent(cleanToken)}&rid=${encodeURIComponent(rid)}&from=${cursor}`,
-          { signal, silenceMs },
-          (event, data, id) => {
-            if (id != null) cursor = Number(id) || cursor;
-            if (event === 'chunk') {
-              const payload = data?.payload ?? {};
-              if (!payload.done) {
-                onEvent(payload.ev || 'message', payload.data != null ? parseOrRaw(payload.data) : {}, payload.id ?? null);
-              }
-              return;
-            }
-            // meta: headers del run o cierre del daemon.
-            if (data?.payload?.done) finished = true;
-            else if (data?.payload?.error) {
-              const error = new Error(data.payload.error);
-              error.fatalRelay = true;
-              throw error;
-            }
-          }
-        );
-        return { finished };
-      } catch (error) {
-        if (error?.name === 'AbortError' || error?.fatalRelay) throw error;
-        attempt += 1;
-        await delay(Math.min(8000, 1000 * 2 ** (attempt - 1)), signal);
-      }
-    }
-  }
-
-  window.relayTransport = { token: cleanToken, base, request, stream, enabled: Boolean(cleanToken) };
-  return window.relayTransport;
-}
-
-/** Pantalla minima si no hay token: pide uno y recarga. */
-export function showRelayTokenGate() {
-  document.body.innerHTML = '';
-  document.body.style.visibility = 'visible';
-  const form = document.createElement('form');
-  form.style.cssText = 'max-width:420px;margin:15vh auto;font-family:ui-sans-serif,system-ui;padding:0 16px';
-  form.innerHTML = `
-    <h1 style="font-size:20px">Tamnora Console</h1>
-    <p style="color:#777;font-size:14px">Pegá el token del bridge (o escaneá el QR del <code>tamnora bridge --tunnel relay</code>).</p>
-    <input name="t" placeholder="token" style="width:100%;padding:10px;font-size:14px" autocomplete="off" />
-    <button style="margin-top:10px;padding:10px 16px">entrar</button>`;
-  form.addEventListener('submit', (event) => {
-    event.preventDefault();
-    const value = form.elements.t.value.trim();
-    if (!value) return;
-    localStorage.setItem('tamnora-relay-token', value);
-    const params = new URLSearchParams(location.search);
-    params.delete('t');
-    location.href = location.pathname + (params.toString() ? `?${params}` : '');
-    location.reload();
-  });
-  document.body.append(form);
-}