pinokiod 8.2.1 → 8.2.3

package/kernel/anywhere/index.js

@@ -0,0 +1,698 @@
+/*
+  Pinokio Anywhere: owns the bundled `tailscaled` daemon (installed from
+  conda-forge by kernel/bin/tailscaled.js) and drives it over its LocalAPI so
+  the user can reach this Pinokio and every app it launches from their phone
+  or another computer on their private tailnet, over HTTPS.
+
+  Serve-only: nothing is ever exposed publicly (no Funnel).
+
+  Layout under the Pinokio home:
+    anywhere/config.json              { enabled, hostname }
+    anywhere/tailscaled/tailscaled.state   node key + prefs (tailscaled --state)
+    anywhere/tailscaled/               certs, logs (tailscaled --statedir, TS_LOGS_DIR)
+    anywhere/tailscaled/tailscaled.sock    LocalAPI socket (mac/linux; falls back to
+                                           os.tmpdir() when the path is too long for
+                                           a unix socket)
+    \\.\pipe\pinokio-tailscaled        LocalAPI pipe (Windows, --windows-mode=dev)
+*/
+const os = require('os')
+const fs = require('fs')
+const path = require('path')
+const crypto = require('crypto')
+const { spawn } = require('child_process')
+const { LocalAPI } = require('./localapi')
+const { buildServeConfig, describeServeConfig, sameServeConfig, DEFAULT_HTTPS_PORT } = require('./serve')
+const { loadPortMap, savePortMap, assignPorts } = require('./ports')
+const Util = require('../util')
+
+const DEFAULT_HOSTNAME = 'pinokio'
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '[::1]'])
+const DEFAULT_CONNECT_URL_TEMPLATE = 'https://pinokio.co/anywhere/connect#u={address}&a={email}'
+const MAX_UNIX_SOCKET_PATH = 100   // sun_path is 104 bytes on macOS, 108 on Linux
+const DAEMON_READY_TIMEOUT_MS = 20000
+const STATUS_CACHE_MS = 1500
+const FEATURE_QUERY_CACHE_MS = 30000
+const MOBILE_OS = new Set(['ios', 'ipados', 'android'])
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+class Anywhere {
+  constructor(kernel) {
+    this.kernel = kernel
+    this.platform = kernel && kernel.platform ? kernel.platform : os.platform()
+    this.child = null
+    this.pid = null
+    this.api = null
+    this.config = null
+    this.starting = null
+    this.lastStatus = null
+    this.lastStatusAt = 0
+    this.lastServe = undefined     // last serve config we pushed (undefined = unknown)
+    this.lastServeError = null
+    this.portMap = null            // app key -> stable remote port (ports.json)
+    this.targets = []              // [{ key, name, local, listen }] behind the current serve config
+    this.feature = null            // cached query-feature result
+    this.featureAt = 0
+    this.error = null
+    this.loginRequestedAt = 0
+  }
+
+  // ---------- paths ----------
+  dir(...args) {
+    return this.kernel.path('anywhere', ...args)
+  }
+  stateDir(...args) {
+    return this.dir('tailscaled', ...args)
+  }
+  configPath() {
+    return this.dir('config.json')
+  }
+  logPath() {
+    return this.stateDir('tailscaled.log')
+  }
+  pidPath() {
+    return this.stateDir('tailscaled.pid')
+  }
+  socketPath() {
+    if (this._socketPath) return this._socketPath
+    if (this.platform === 'win32') {
+      this._socketPath = '\\\\.\\pipe\\pinokio-tailscaled'
+    } else {
+      const candidate = this.stateDir('tailscaled.sock')
+      if (Buffer.byteLength(candidate) <= MAX_UNIX_SOCKET_PATH) {
+        this._socketPath = candidate
+      } else {
+        const hash = crypto.createHash('sha1').update(this.kernel.homedir || '').digest('hex').slice(0, 8)
+        this._socketPath = path.join(os.tmpdir(), `pinokio-ts-${hash}.sock`)
+      }
+    }
+    return this._socketPath
+  }
+  binPath() {
+    const mod = this.kernel.bin && this.kernel.bin.mod ? this.kernel.bin.mod.tailscaled : null
+    if (mod && typeof mod.binPath === 'function') {
+      return mod.binPath()
+    }
+    return null
+  }
+  daemonArgs() {
+    const args = [
+      '--tun=userspace-networking',
+      '--state', this.stateDir('tailscaled.state'),
+      '--statedir', this.stateDir(),
+      '--socket', this.socketPath(),
+      '--port', '0',
+    ]
+    if (this.platform === 'win32') {
+      // 1.104+: run as a per-user console process, no service / admin needed
+      args.push('--windows-mode=dev')
+    }
+    return args
+  }
+
+  // ---------- config ----------
+  async loadConfig() {
+    if (this.config) return this.config
+    let config = {}
+    this.configExists = false
+    try {
+      const raw = await fs.promises.readFile(this.configPath(), 'utf8')
+      config = JSON.parse(raw) || {}
+      this.configExists = true
+    } catch (e) {
+      config = {}
+    }
+    this.config = Object.assign({
+      enabled: false,
+      hostname: DEFAULT_HOSTNAME,
+    }, config)
+    return this.config
+  }
+  async saveConfig(patch) {
+    const config = await this.loadConfig()
+    Object.assign(config, patch || {})
+    await fs.promises.mkdir(this.dir(), { recursive: true })
+    await fs.promises.writeFile(this.configPath(), JSON.stringify(config, null, 2))
+    this.config = config
+    this.configExists = true
+    return config
+  }
+  // true once config.json exists (the first page visit writes it)
+  async configured() {
+    await this.loadConfig()
+    return !!this.configExists
+  }
+  async enabled() {
+    const config = await this.loadConfig()
+    return !!config.enabled
+  }
+  async hostname() {
+    const config = await this.loadConfig()
+    return String(config.hostname || DEFAULT_HOSTNAME)
+  }
+  connectUrlTemplate() {
+    const fromEnv = (process.env.PINOKIO_ANYWHERE_CONNECT_URL || '').trim()
+    if (fromEnv) return fromEnv
+    return DEFAULT_CONNECT_URL_TEMPLATE
+  }
+  connectUrl(address, email) {
+    if (!address) return null
+    return this.connectUrlTemplate()
+      .replace('{address}', encodeURIComponent(address))
+      .replace('{email}', encodeURIComponent(email || ''))
+  }
+
+  // ---------- install state ----------
+  async installed() {
+    const mod = this.kernel.bin && this.kernel.bin.mod ? this.kernel.bin.mod.tailscaled : null
+    if (!mod || typeof mod.installed !== 'function') return false
+    try {
+      return !!(await mod.installed())
+    } catch (e) {
+      return false
+    }
+  }
+
+  // ---------- daemon lifecycle ----------
+  client() {
+    if (!this.api) {
+      this.api = new LocalAPI({ socketPath: this.socketPath() })
+    }
+    return this.api
+  }
+  async daemonAlive() {
+    return this.client().ping()
+  }
+  // Called from kernel/bin/tailscaled.js start() during bin init.
+  async autostart() {
+    // a pid file left behind by a crash or reboot must never point at an unrelated process
+    if (!(await this.daemonAlive())) fs.rmSync(this.pidPath(), { force: true })
+    if (!(await this.enabled())) return false
+    if (!(await this.installed())) return false
+    await this.start()
+    return true
+  }
+  async start() {
+    if (this.starting) return this.starting
+    this.starting = this._start().finally(() => { this.starting = null })
+    return this.starting
+  }
+  async _start() {
+    this.error = null
+    await this.loadConfig()
+    await fs.promises.mkdir(this.stateDir(), { recursive: true })
+    const bin = this.binPath()
+    if (!bin) {
+      throw new Error('tailscaled module is not available')
+    }
+    if (!(await this.daemonAlive())) {
+      if (this.platform !== 'win32') {
+        // a stale socket file makes bind() fail
+        await fs.promises.rm(this.socketPath(), { force: true }).catch(() => {})
+      }
+      const logFd = fs.openSync(this.logPath(), 'w')
+      const env = Object.assign({}, process.env, {
+        TS_LOGS_DIR: this.stateDir(),
+      })
+      const child = spawn(bin, this.daemonArgs(), {
+        cwd: this.stateDir(),
+        env,
+        stdio: ['ignore', logFd, logFd],
+        windowsHide: true,
+      })
+      fs.closeSync(logFd)
+      this.child = child
+      this.pid = child.pid
+      if (child.pid) fs.writeFileSync(this.pidPath(), String(child.pid))
+      child.on('exit', (code, signal) => {
+        console.log(`[anywhere] tailscaled exited (code=${code} signal=${signal})`)
+        if (this.child === child) {
+          // not a stop() of ours: surface it, the page offers "Try again"
+          this.child = null
+          this.pid = null
+          this.error = `tailscaled exited (code=${code} signal=${signal})`
+          fs.rmSync(this.pidPath(), { force: true })
+        }
+      })
+      child.on('error', (err) => {
+        console.log('[anywhere] tailscaled spawn error', err && err.message ? err.message : err)
+        this.error = `tailscaled failed to start: ${err && err.message ? err.message : err}`
+      })
+      const ready = await this.waitForDaemon(DAEMON_READY_TIMEOUT_MS)
+      if (!ready) {
+        let tail = ''
+        try {
+          tail = (await fs.promises.readFile(this.logPath(), 'utf8')).split(/\r?\n/).slice(-10).join('\n')
+        } catch (e) { }
+        if (!this.error) {
+          this.error = `tailscaled did not answer on ${this.socketPath()} within ${DAEMON_READY_TIMEOUT_MS / 1000}s\n${tail}`
+        }
+        throw new Error(this.error)
+      }
+    } else if (!this.pid) {
+      // adopted from a previous pinokiod run: recover its pid so shutdown can still kill it
+      this.pid = this.readPid()
+    }
+    await this.applyPrefs()
+    this.lastServe = undefined
+    this.lastStatusAt = 0
+    await this.refreshStatus(true)
+    return true
+  }
+  async waitForDaemon(timeout) {
+    const started = Date.now()
+    while (Date.now() - started < timeout) {
+      if (this.error || (this.child && this.child.exitCode !== null)) {
+        return false
+      }
+      if (await this.daemonAlive()) {
+        return true
+      }
+      await sleep(250)
+    }
+    return false
+  }
+  async applyPrefs() {
+    const hostname = await this.hostname()
+    await this.client().patchPrefs({
+      HostnameSet: true,
+      Hostname: hostname,
+      WantRunningSet: true,
+      WantRunning: true,
+      LoggedOutSet: true,
+      LoggedOut: false,
+      // this node is a server; never route the machine's traffic elsewhere
+      RouteAllSet: true,
+      RouteAll: false,
+      ExitNodeIDSet: true,
+      ExitNodeID: '',
+      CorpDNSSet: true,
+      CorpDNS: false,
+    })
+  }
+  readPid() {
+    try {
+      const pid = Number(fs.readFileSync(this.pidPath(), 'utf8').trim())
+      if (!Number.isInteger(pid) || pid <= 0) return null
+      process.kill(pid, 0)   // throws when there is no such process
+      return pid
+    } catch (e) {
+      return null
+    }
+  }
+  async stop() {
+    const pid = this.pid || this.readPid()
+    this.child = null
+    this.pid = null
+    if (pid) {
+      try { process.kill(pid, 'SIGTERM') } catch (e) { }
+    }
+    fs.rmSync(this.pidPath(), { force: true })
+    this.lastStatus = null
+    this.lastStatusAt = 0
+    this.lastServe = undefined
+    return true
+  }
+  // synchronous: used from the process shutdown path
+  killSync() {
+    const pid = this.pid || this.readPid()
+    if (pid) {
+      try { process.kill(pid, 'SIGKILL') } catch (e) { }
+    }
+    fs.rmSync(this.pidPath(), { force: true })
+  }
+  async enable() {
+    await this.saveConfig({ enabled: true })
+    await this.start()
+    return true
+  }
+  async disable() {
+    await this.saveConfig({ enabled: false })
+    await this.stop()
+    return true
+  }
+  async requestLogin() {
+    this.loginRequestedAt = Date.now()
+    await this.client().loginInteractive()
+    this.lastStatusAt = 0
+    return true
+  }
+  async logout() {
+    await this.client().logout()
+    await this.applyPrefs()
+    await this.client().start()
+    this.lastStatus = null
+    this.lastStatusAt = 0
+    this.lastServe = undefined
+    this.feature = null
+    return true
+  }
+
+  // ---------- status ----------
+  async refreshStatus(force) {
+    const now = Date.now()
+    if (!force && this.lastStatus && now - this.lastStatusAt < STATUS_CACHE_MS) {
+      return this.lastStatus
+    }
+    try {
+      const status = await this.client().status()
+      this.lastStatus = status
+      this.lastStatusAt = Date.now()
+      return status
+    } catch (e) {
+      this.lastStatus = null
+      this.lastStatusAt = Date.now()
+      return null
+    }
+  }
+  dnsNameFrom(status) {
+    if (!status || !status.Self || !status.Self.DNSName) return null
+    return String(status.Self.DNSName).replace(/\.$/, '')
+  }
+  async ensureRunningPrefs(status) {
+    // the daemon persisted WantRunning=false (e.g. after `logout`): nudge it
+    if (status && status.BackendState === 'Stopped') {
+      try {
+        await this.client().patchPrefs({ WantRunningSet: true, WantRunning: true })
+        this.lastStatusAt = 0
+      } catch (e) { }
+    }
+  }
+  async ensureLoginUrl(status) {
+    if (!status || status.BackendState !== 'NeedsLogin') return null
+    // the daemon keeps offering a link even after the control server rejected it
+    // ("register request: http 410: auth path not found"); reset and ask again
+    const dead = Array.isArray(status.Health) && status.Health.some((h) => /auth path not found/i.test(String(h)))
+    if (status.AuthURL && !dead) return status.AuthURL
+    if (Date.now() - this.loginRequestedAt > 5000) {
+      try {
+        if (dead) await this.client().start()
+        await this.requestLogin()
+      } catch (e) { }
+    }
+    return null
+  }
+  async httpsFeature(status) {
+    if (!status || status.BackendState !== 'Running') return null
+    if (Array.isArray(status.CertDomains) && status.CertDomains.length > 0) {
+      this.feature = { Complete: true }
+      return this.feature
+    }
+    if (this.feature && Date.now() - this.featureAt < FEATURE_QUERY_CACHE_MS) {
+      return this.feature
+    }
+    try {
+      this.feature = await this.client().queryFeature('serve')
+      this.featureAt = Date.now()
+    } catch (e) {
+      // e.g. 503 "no netmap" right after login: not an answer yet, ask again next time
+      this.feature = null
+      this.featureAt = 0
+    }
+    return this.feature
+  }
+  peersFrom(status) {
+    const peers = []
+    if (!status || !status.Peer) return peers
+    for (const key of Object.keys(status.Peer)) {
+      const p = status.Peer[key]
+      if (!p) continue
+      const osName = String(p.OS || '')
+      const dnsLabel = p.DNSName ? String(p.DNSName).split('.')[0] : ''
+      const hostName = String(p.HostName || '').trim()
+      // phones often report a generic HostName ("localhost"); MagicDNS has the nicer one
+      const generic = !hostName || /^(localhost|iphone|ipad|android)$/i.test(hostName)
+      peers.push({
+        name: (generic && dnsLabel) ? dnsLabel : (hostName || dnsLabel || key),
+        os: osName,
+        mobile: MOBILE_OS.has(osName.toLowerCase()),
+        online: !!p.Online,
+        lastSeen: p.LastSeen && !String(p.LastSeen).startsWith('0001-') ? p.LastSeen : null,
+        ips: Array.isArray(p.TailscaleIPs) ? p.TailscaleIPs : [],
+      })
+    }
+    peers.sort((a, b) => {
+      if (a.online !== b.online) return a.online ? -1 : 1
+      if (a.mobile !== b.mobile) return a.mobile ? -1 : 1
+      return a.name.localeCompare(b.name)
+    })
+    return peers
+  }
+  accountFrom(status) {
+    if (!status || !status.Self || !status.User) return null
+    const user = status.User[String(status.Self.UserID)]
+    if (!user) return null
+    return {
+      email: user.LoginName || '',
+      name: user.DisplayName || '',
+    }
+  }
+  keyExpiryFrom(status) {
+    if (!status || !status.Self) return null
+    const value = status.Self.KeyExpiry
+    if (!value || String(value).startsWith('0001-')) return null
+    return value
+  }
+
+  // ---------- serve config ----------
+  serverPort() {
+    return Number(this.kernel.server_port || 42000)
+  }
+  portMapPath() {
+    return this.dir('ports.json')
+  }
+  // Running Pinokio apps and their web UI ports, taken from the same URL
+  // variables the Home Server router publishes (an app's `url`, plus any key
+  // its pinokio.json dns config maps). Only loopback URLs can be proxied.
+  appTargets() {
+    const local = this.kernel.memory && this.kernel.memory.local ? this.kernel.memory.local : {}
+    const router = this.kernel.router && this.kernel.router.localhost_variable_router
+    const targets = []
+    const seen = new Set()
+    for (const scriptPath of Object.keys(local).sort()) {
+      const vars = local[scriptPath]
+      if (!vars || typeof vars !== 'object') continue
+      const name = Util.api_name(scriptPath, this.kernel)
+      if (!name || name.startsWith('..')) continue
+      // `url` first so an app's main UI gets its first (and therefore lowest) stable port
+      for (const key of Object.keys(vars).sort((a, b) => a === 'url' ? -1 : b === 'url' ? 1 : a.localeCompare(b))) {
+        if (typeof vars[key] !== 'string') continue
+        let url
+        try { url = new URL(vars[key]) } catch (_) { continue }
+        if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) continue
+        let domain
+        try { domain = router ? router.domain(name, key) : (key === 'url' ? '@' : null) } catch (_) { domain = key === 'url' ? '@' : null }
+        if (!domain) continue
+        const port = Number(url.port)
+        if (seen.has(port)) continue
+        seen.add(port)
+        targets.push({ key: domain === '@' ? name : `${domain}.${name}`, name, local: port })
+      }
+    }
+    return targets
+  }
+  // Recomputes this.targets from the running apps, giving a new app its stable
+  // port (kept in ports.json). Returns true when the targets changed.
+  async refreshTargets() {
+    if (!this.portMap) this.portMap = await loadPortMap(this.portMapPath())
+    const apps = this.appTargets()
+    const { map, changed } = assignPorts(this.portMap, apps.map((app) => app.key))
+    if (changed) {
+      this.portMap = map
+      await savePortMap(this.portMapPath(), map).catch((e) => console.log('[anywhere] could not save ports.json', e.message))
+    }
+    const targets = apps.map((app) => Object.assign({}, app, { listen: map[app.key] }))
+    const differs = JSON.stringify(targets) !== JSON.stringify(this.targets)
+    this.targets = targets
+    return differs
+  }
+  async desiredServeConfig(status) {
+    const dnsName = this.dnsNameFrom(status)
+    if (!dnsName) return null
+    await this.refreshTargets()
+    return buildServeConfig({
+      dnsName,
+      serverPort: this.serverPort(),
+      targets: this.targets.map((t) => ({ listen: t.listen, target: t.local })),
+    })
+  }
+  targetNames() {
+    const names = {}
+    for (const t of this.targets) names[t.listen] = t.name
+    return names
+  }
+  // true when `host` (a Host header) is this node's own Tailscale name
+  isNodeHost(host) {
+    const dnsName = this.lastStatus ? this.dnsNameFrom(this.lastStatus) : null
+    if (!dnsName || !this.config || !this.config.enabled) return false
+    return String(host || '').toLowerCase().replace(/:443$/, '') === dnsName.toLowerCase()
+  }
+  // Rewrites one menu link for a visitor arriving through the Tailscale
+  // address. Only a loopback link with a port is touched, and only when the
+  // request's Host header is this node's name; any other request gets the
+  // href back unchanged.
+  rewriteHref(host, href) {
+    if (!this.isNodeHost(host)) return href
+    const dnsName = this.dnsNameFrom(this.lastStatus)
+    let url
+    try { url = new URL(String(href)) } catch (_) { return href }
+    if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
+    const local = Number(url.port)
+    let listen
+    if (local === this.serverPort()) {
+      listen = DEFAULT_HTTPS_PORT
+    } else {
+      const target = this.targets.find((t) => t.local === local)
+      if (!target) return href
+      listen = target.listen
+    }
+    const origin = listen === DEFAULT_HTTPS_PORT ? `https://${dnsName}` : `https://${dnsName}:${listen}`
+    return origin + url.pathname + url.search + url.hash
+  }
+  async rewriteMenu(host, menu) {
+    if (!Array.isArray(menu) || !this.isNodeHost(host)) return menu
+    // An app that just published its URL is not in the serve config until the
+    // next kernel.refresh() tick. Give it its stable port now, so the menu is
+    // right on first render, and push the route without waiting for the tick.
+    if (await this.refreshTargets()) this.sync().catch(() => {})
+    const rewrite = (items) => {
+      for (const item of items) {
+        if (!item || typeof item !== 'object') continue
+        if (typeof item.href === 'string') {
+          const next = this.rewriteHref(host, item.href)
+          if (next !== item.href) {
+            if (item.src === item.href) item.src = next
+            if (item.target_full === item.href) item.target_full = next
+            item.href = next
+          }
+        }
+        if (Array.isArray(item.menu)) rewrite(item.menu)
+      }
+    }
+    rewrite(menu)
+    return menu
+  }
+  // Regenerates the Serve config from the apps' published URLs. Called from
+  // kernel.refresh() (same trigger as router.update()) and after start.
+  async sync() {
+    // one push at a time; a call made during a push runs its own afterwards
+    if (this.syncing) return this.syncing.then(() => this.sync())
+    this.syncing = this.pushServeConfig().finally(() => { this.syncing = null })
+    return this.syncing
+  }
+  async pushServeConfig() {
+    if (!this.config || !this.config.enabled) return false
+    if (!this.pid && !this.api) return false
+    const status = await this.refreshStatus(false)
+    if (!status || status.BackendState !== 'Running') return false
+    const desired = await this.desiredServeConfig(status)
+    if (!desired) return false
+    if (this.lastServe !== undefined && sameServeConfig(desired, this.lastServe)) {
+      return false
+    }
+    try {
+      const current = await this.client().serveConfig()
+      await this.client().setServeConfig(desired, current.etag)
+      this.lastServe = desired
+      this.lastServeError = null
+      console.log(`[anywhere] serve config updated: ${Object.keys(desired.TCP).join(', ')}`)
+      return true
+    } catch (e) {
+      this.lastServeError = e && e.message ? e.message : String(e)
+      console.log('[anywhere] serve config update failed', this.lastServeError)
+      return false
+    }
+  }
+
+  // ---------- snapshot for the UI ----------
+  async snapshot() {
+    await this.loadConfig()
+    const installed = await this.installed()
+    const enabled = !!this.config.enabled
+    const base = {
+      installed,
+      enabled,
+      error: this.error,
+      serveError: this.lastServeError,
+    }
+    if (!installed) {
+      return Object.assign(base, { phase: 'setup', running: false })
+    }
+    if (!enabled) {
+      return Object.assign(base, { phase: 'off', running: false })
+    }
+    if (this.starting) {
+      return Object.assign(base, { phase: 'starting', running: false })
+    }
+    const status = await this.refreshStatus(false)
+    if (!status) {
+      return Object.assign(base, {
+        phase: this.error ? 'error' : 'starting',
+        running: false,
+      })
+    }
+    const backendState = status.BackendState
+    const dnsName = this.dnsNameFrom(status)
+    const address = dnsName ? `https://${dnsName}` : null
+    const account = this.accountFrom(status)
+    const peers = this.peersFrom(status)
+    const out = Object.assign(base, {
+      running: true,
+      version: status.Version,
+      dnsName,
+      address,
+      ips: Array.isArray(status.TailscaleIPs) ? status.TailscaleIPs : [],
+      account,
+      keyExpiry: this.keyExpiryFrom(status),
+      keyExpired: !!(status.Self && status.Self.Expired),
+      peers,
+      mobilePeerPresent: peers.some((p) => p.mobile),
+      mobilePeerOnline: peers.some((p) => p.mobile && p.online),
+      connectUrl: this.connectUrl(address, account ? account.email : ''),
+      loginUrl: null,
+      approval: null,
+      serve: [],
+    })
+    if (backendState === 'NeedsLogin') {
+      out.phase = 'login'
+      out.loginUrl = await this.ensureLoginUrl(status)
+      if (!out.loginUrl) {
+        out.phase = 'starting'
+      }
+      return out
+    }
+    if (backendState === 'NeedsMachineAuth') {
+      out.phase = 'machine_auth'
+      return out
+    }
+    if (backendState === 'Stopped') {
+      await this.ensureRunningPrefs(status)
+      out.phase = 'starting'
+      return out
+    }
+    if (backendState !== 'Running') {
+      out.phase = 'starting'
+      return out
+    }
+    const feature = await this.httpsFeature(status)
+    if (!feature) {
+      out.phase = 'starting'
+      return out
+    }
+    if (!feature.Complete) {
+      out.phase = 'https'
+      out.approval = {
+        url: feature.URL || null,
+        text: feature.Text || 'Enable HTTPS certificates for your tailnet to continue.',
+      }
+      return out
+    }
+    out.phase = 'ready'
+    const serve = this.lastServe !== undefined ? this.lastServe : await this.desiredServeConfig(status)
+    out.serve = describeServeConfig(serve, dnsName, this.targetNames())
+    return out
+  }
+}
+
+
+module.exports = Anywhere