pinokiod 8.2.1 → 8.2.3

package/kernel/anywhere/localapi.js

@@ -0,0 +1,147 @@
+/*
+  Minimal client for the tailscaled LocalAPI.
+
+  tailscaled exposes an HTTP API over a unix socket (mac/linux) or a named
+  pipe (Windows). We talk to it with plain node `http` by passing the socket
+  path as `socketPath`; node's net layer handles both unix sockets and
+  `\\.\pipe\...` names. The conda-forge `tailscaled` package ships only the
+  daemon (no `tailscale` CLI), so every operation goes through this client.
+
+  Verified against tailscaled 1.104.1 (see spec/requirements/pinokio-anywhere.md):
+    GET   /localapi/v0/status                 -> ipnstate.Status JSON
+    GET   /localapi/v0/prefs                  -> ipn.Prefs JSON
+    PATCH /localapi/v0/prefs                  <- ipn.MaskedPrefs ({HostnameSet:true, Hostname:"pinokio", ...})
+    POST  /localapi/v0/login-interactive      -> 204; AuthURL shows up in /status and on the IPN bus (BrowseToURL)
+    POST  /localapi/v0/logout                 -> 204
+    GET   /localapi/v0/serve-config           -> ipn.ServeConfig JSON (or null) + Etag header
+    POST  /localapi/v0/serve-config           <- ipn.ServeConfig JSON, optional If-Match: <etag>
+    POST  /localapi/v0/query-feature?feature=serve -> {Complete, Text, URL} (URL = one-click tailnet approval)
+*/
+const http = require('http')
+
+class LocalAPIError extends Error {
+  constructor(message, status, body) {
+    super(message)
+    this.name = 'LocalAPIError'
+    this.status = status
+    this.body = body
+  }
+}
+
+class LocalAPI {
+  constructor({ socketPath, timeout = 10000 } = {}) {
+    if (!socketPath) {
+      throw new Error('LocalAPI requires a socketPath')
+    }
+    this.socketPath = socketPath
+    this.timeout = timeout
+    this.base = '/localapi/v0'
+  }
+  request(method, route, { body, headers, timeout } = {}) {
+    const payload = typeof body === 'undefined' || body === null
+      ? null
+      : (typeof body === 'string' || Buffer.isBuffer(body) ? body : JSON.stringify(body))
+    const reqHeaders = Object.assign({
+      // tailscaled rejects non-loopback origins without this on some
+      // transports (the Windows GUI loopback port); harmless on sockets.
+      'Sec-Tailscale': 'localapi',
+      'Host': 'local-tailscaled.sock',
+    }, headers || {})
+    if (payload !== null) {
+      reqHeaders['Content-Type'] = reqHeaders['Content-Type'] || 'application/json'
+      reqHeaders['Content-Length'] = Buffer.byteLength(payload)
+    }
+    return new Promise((resolve, reject) => {
+      const req = http.request({
+        socketPath: this.socketPath,
+        method,
+        path: this.base + route,
+        headers: reqHeaders,
+      }, (res) => {
+        const chunks = []
+        res.on('data', (chunk) => chunks.push(chunk))
+        res.on('end', () => {
+          const text = Buffer.concat(chunks).toString('utf8')
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            text,
+            json: () => {
+              if (!text || !text.trim()) return null
+              return JSON.parse(text)
+            },
+          })
+        })
+        res.on('error', reject)
+      })
+      req.setTimeout(timeout || this.timeout, () => {
+        req.destroy(new Error(`LocalAPI ${method} ${route} timed out`))
+      })
+      req.on('error', reject)
+      if (payload !== null) {
+        req.write(payload)
+      }
+      req.end()
+    })
+  }
+  async expect(method, route, options, okStatuses = [200, 204]) {
+    const res = await this.request(method, route, options)
+    if (!okStatuses.includes(res.status)) {
+      throw new LocalAPIError(`LocalAPI ${method} ${route} failed: ${res.status} ${res.text.trim()}`, res.status, res.text)
+    }
+    return res
+  }
+  async status() {
+    const res = await this.expect('GET', '/status')
+    return res.json()
+  }
+  // masked: an ipn.MaskedPrefs object, e.g. { HostnameSet: true, Hostname: 'pinokio' }
+  async patchPrefs(masked) {
+    const res = await this.expect('PATCH', '/prefs', { body: masked })
+    return res.json()
+  }
+  async loginInteractive() {
+    await this.expect('POST', '/login-interactive', { body: '' })
+    return true
+  }
+  async logout() {
+    await this.expect('POST', '/logout', { body: '' })
+    return true
+  }
+  // Restarts the backend's login state machine (what `tailscale up --force-reauth`
+  // does): a stale or invalidated login URL is dropped and a fresh one is minted
+  // on the next login-interactive.
+  async start(options = {}) {
+    await this.expect('POST', '/start', { body: options })
+    return true
+  }
+  async serveConfig() {
+    const res = await this.expect('GET', '/serve-config')
+    return { config: res.json(), etag: res.headers.etag || res.headers.Etag || null }
+  }
+  async setServeConfig(config, etag) {
+    const headers = {}
+    if (etag) {
+      headers['If-Match'] = etag
+    }
+    await this.expect('POST', '/serve-config', { body: config || {}, headers })
+    return true
+  }
+  async queryFeature(feature) {
+    const res = await this.request('POST', `/query-feature?feature=${encodeURIComponent(feature)}`, { body: '' })
+    if (res.status !== 200) {
+      throw new LocalAPIError(`query-feature ${feature} failed: ${res.status} ${res.text.trim()}`, res.status, res.text)
+    }
+    return res.json()
+  }
+  async ping() {
+    try {
+      const res = await this.request('GET', '/status', { timeout: 2000 })
+      return res.status === 200
+    } catch (e) {
+      return false
+    }
+  }
+}
+
+module.exports = { LocalAPI, LocalAPIError }

package/kernel/anywhere/ports.js

@@ -0,0 +1,51 @@
+/*
+  Stable remote ports for Pinokio Anywhere.
+
+  An app may bind a different local port from one launch to the next, but its
+  Tailscale address must not move: bookmarks, home-screen icons and links all
+  point at https://<node>.<tailnet>.ts.net:<port>. So every app is given a
+  remote port once, kept in ~/pinokio/anywhere/ports.json, and Serve maps that
+  fixed port to whatever local port the app has right now.
+
+  Remote ports live inside tailscaled's own network stack, so they never need
+  to be free on the machine itself.
+*/
+const fs = require('fs')
+const path = require('path')
+
+const FIRST_PORT = 43000
+const LAST_PORT = 43999
+
+async function loadPortMap(file) {
+  try {
+    const map = JSON.parse(await fs.promises.readFile(file, 'utf8'))
+    return map && typeof map === 'object' && !Array.isArray(map) ? map : {}
+  } catch (_) {
+    return {}
+  }
+}
+
+async function savePortMap(file, map) {
+  await fs.promises.mkdir(path.dirname(file), { recursive: true })
+  await fs.promises.writeFile(file, JSON.stringify(map, null, 2))
+}
+
+// Returns a copy of `map` with a port for every key, giving new keys the
+// lowest port not already taken. Existing assignments are never changed.
+function assignPorts(map, keys) {
+  const out = Object.assign({}, map)
+  const used = new Set(Object.values(out).map(Number))
+  let next = FIRST_PORT
+  let changed = false
+  for (const key of keys) {
+    if (Number.isInteger(out[key])) continue
+    while (used.has(next)) next += 1
+    if (next > LAST_PORT) throw new Error('Pinokio Anywhere has no free remote ports left')
+    out[key] = next
+    used.add(next)
+    changed = true
+  }
+  return { map: out, changed }
+}
+
+module.exports = { loadPortMap, savePortMap, assignPorts }

package/kernel/anywhere/serve.js

@@ -0,0 +1,95 @@
+/*
+  Builds the ipn.ServeConfig that tailscaled needs so pinokiod and each running
+  Pinokio app are reachable over HTTPS at a fixed address.
+
+  MagicDNS has no subdomains, so routes are per port. The remote port is the
+  app's stable port (see ports.js), the target is whatever local port the app
+  has right now:
+
+    https://pinokio.<tailnet>.ts.net         -> http://127.0.0.1:<pinokiod port>
+    https://pinokio.<tailnet>.ts.net:43000   -> http://127.0.0.1:7860   (comfy)
+    https://pinokio.<tailnet>.ts.net:43001   -> http://127.0.0.1:8188   (forge)
+
+  Serve-only: no AllowFunnel entries are ever emitted, so nothing is public.
+*/
+
+const DEFAULT_HTTPS_PORT = 443
+
+function normalizePort(value) {
+  const port = Number(value)
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return null
+  }
+  return port
+}
+
+/*
+  options:
+    dnsName    "pinokio.tail1234.ts.net" (no trailing dot)
+    serverPort pinokiod's own port (mapped to :443)
+    targets    [{ listen, target }]: remote port -> local port
+*/
+function buildServeConfig({ dnsName, serverPort, targets = [] } = {}) {
+  const host = String(dnsName || '').replace(/\.$/, '')
+  if (!host) {
+    throw new Error('buildServeConfig requires dnsName')
+  }
+  const config = { TCP: {}, Web: {} }
+  const add = (listenPort, targetPort) => {
+    config.TCP[String(listenPort)] = { HTTPS: true }
+    config.Web[`${host}:${listenPort}`] = {
+      Handlers: {
+        '/': { Proxy: `http://127.0.0.1:${targetPort}` }
+      }
+    }
+  }
+  const server = normalizePort(serverPort)
+  if (server) {
+    add(DEFAULT_HTTPS_PORT, server)
+  }
+  const seen = new Set([DEFAULT_HTTPS_PORT])
+  const entries = []
+  for (const raw of targets) {
+    const listen = normalizePort(raw && raw.listen)
+    const target = normalizePort(raw && raw.target)
+    if (!listen || !target || seen.has(listen)) continue
+    seen.add(listen)
+    entries.push({ listen, target })
+  }
+  // deterministic key order so unchanged mappings compare equal
+  for (const entry of entries.sort((a, b) => a.listen - b.listen)) {
+    add(entry.listen, entry.target)
+  }
+  return config
+}
+
+// Lists what a serve config exposes: [{ port, local, target, url, name }]
+// `names` maps a remote port to the app name it was assigned to.
+function describeServeConfig(config, dnsName, names = {}) {
+  const host = String(dnsName || '').replace(/\.$/, '')
+  const out = []
+  if (!config || !config.Web) return out
+  for (const key of Object.keys(config.Web)) {
+    const match = key.match(/^(.*):(\d+)$/)
+    if (!match) continue
+    const port = Number(match[2])
+    const handlers = config.Web[key].Handlers || {}
+    const root = handlers['/'] || {}
+    const local = root.Proxy ? Number((String(root.Proxy).match(/:(\d+)$/) || [])[1]) || null : null
+    out.push({
+      port,
+      local,
+      target: root.Proxy || null,
+      url: port === DEFAULT_HTTPS_PORT ? `https://${host || match[1]}` : `https://${host || match[1]}:${port}`,
+      name: names[port] || null,
+    })
+  }
+  out.sort((a, b) => a.port - b.port)
+  return out
+}
+
+function sameServeConfig(a, b) {
+  return JSON.stringify(a || null) === JSON.stringify(b || null)
+}
+
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, DEFAULT_HTTPS_PORT }

package/kernel/bin/setup.js

@@ -270,6 +270,35 @@ module.exports = {
       ]
     }
   },
+  anywhere: (kernel) => {
+    let requirements = [
+      { name: "conda", },
+      { name: "zip", },
+    ]
+    if (platform === "darwin") {
+      requirements.push({ name: "brew" })
+    }
+    requirements = requirements.concat([
+      { name: "git", },
+      { name: "uv", },
+      { name: "node", },
+      { name: "tailscaled", },
+      { name: "py" },
+      { name: "bluefairy" },
+    ])
+    return {
+      icon: "fa-solid fa-mobile-screen",
+      title: "Pinokio Anywhere",
+      description: "Reach this Pinokio and its apps from your phone or another computer over a private Tailscale network",
+      requirements,
+      conda_requirements: [
+        zip_cmd,
+        "uv",
+        "git",
+        "tailscaled"
+      ]
+    }
+  },
   connect: (kernel) => {
     let requirements = [
       { name: "conda", },

package/kernel/bin/tailscaled.js

@@ -0,0 +1,71 @@
+const path = require('path')
+const semver = require('semver')
+
+// conda-forge ships only the daemon binary (no `tailscale` CLI); Pinokio
+// drives it over its LocalAPI (see kernel/anywhere).
+const TAILSCALED_SPEC = "tailscaled=1.104.1"
+const TAILSCALED_REQUIREMENT = ">=1.104.0"   // 1.104 added --windows-mode=dev
+
+class Tailscaled {
+  description = "Installs the Tailscale daemon for Pinokio Anywhere: reach this Pinokio and its apps from your phone or another computer over a private network."
+  cmd() {
+    return TAILSCALED_SPEC
+  }
+  binPath() {
+    if (this.kernel.platform === "win32") {
+      return this.kernel.bin.path("miniforge", "Library", "bin", "tailscaled.exe")
+    }
+    return this.kernel.bin.path("miniforge", "bin", "tailscaled")
+  }
+  async install(req, ondata) {
+    await this.kernel.bin.exec({
+      message: [
+        // a stale libmamba index cache reports the package as missing even
+        // though `conda search` sees it; clearing just the index fixes that.
+        "conda clean -y -i",
+        `conda install -y --override-channels -c conda-forge ${this.cmd()}`
+      ]
+    }, ondata)
+  }
+  async installed() {
+    try {
+      const conda = this.kernel.bin.installed && this.kernel.bin.installed.conda
+      if (!conda || !conda.has("tailscaled")) {
+        return false
+      }
+      const versions = this.kernel.bin.installed.conda_versions || {}
+      const coerced = semver.coerce(versions.tailscaled)
+      if (!coerced) {
+        return false
+      }
+      return semver.satisfies(coerced, TAILSCALED_REQUIREMENT)
+    } catch (e) {
+      console.log("tailscaled installed check error", e)
+      return false
+    }
+  }
+  // Called by kernel.bin.init() for every module: resume the daemon when the
+  // user had Pinokio Anywhere switched on.
+  async start() {
+    const anywhere = this.kernel.anywhere
+    if (!anywhere || typeof anywhere.autostart !== "function") {
+      return
+    }
+    // not awaited: a slow or broken daemon must not hold up the rest of bin init
+    anywhere.autostart().catch((e) => {
+      console.log("[anywhere] autostart failed", e && e.message ? e.message : e)
+    })
+  }
+  async uninstall(req, ondata) {
+    ondata({ raw: "stopping Pinokio Anywhere\r\n" })
+    if (this.kernel.anywhere && typeof this.kernel.anywhere.stop === "function") {
+      await this.kernel.anywhere.stop().catch(() => {})
+    }
+    ondata({ raw: "cleaning up\r\n" })
+    await this.kernel.bin.exec({
+      message: `conda remove -y tailscaled`,
+    }, ondata)
+    ondata({ raw: "finished cleaning up\r\n" })
+  }
+}
+module.exports = Tailscaled

package/kernel/index.js

@@ -35,6 +35,7 @@ const Plugin = require('./plugin')
 const Router = require("./router")
 const PinokioDomainRouter = require("./router/pinokio_domain_router")
 const Procs = require('./procs')
+const Anywhere = require('./anywhere')
 const Peer = require('./peer')
 const Git = require('./git')
 const Vault = require('./vault')
@@ -711,6 +712,15 @@ class Kernel {
 
       }
     }
+    // 8b. Pinokio Anywhere: refresh the tailscale serve config from the apps'
+    // published URLs. No-op unless Anywhere is on and its daemon is running.
+    if (this.anywhere) {
+      try {
+        await this.anywhere.sync()
+      } catch (err) {
+        console.warn('[anywhere] sync failed:', err && err.message ? err.message : err)
+      }
+    }
     // 6. tell peers to refresh
     let changed
     let new_config = JSON.stringify(await this.peer.current_host())
@@ -1103,12 +1113,17 @@ class Kernel {
     if (this.peer) {
       this.peer.stop()
     }
+    if (this.anywhere) {
+      // re-initializing the kernel (home change): drop the old daemon
+      await this.anywhere.stop().catch(() => {})
+    }
 
     this.info = new Info(this)
     this.pipe = new Pipe(this)
     this.proto = new Proto(this)
     this.plugin = new Plugin(this)
     this.processes = new Procs(this)
+    this.anywhere = new Anywhere(this)
     this.kv = new KV(this)
     this.cloudflare = new Cloudflare()
     this.peer = new Peer(this)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.1",
+  "version": "8.2.3",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -497,6 +497,13 @@ class Server {
     if (this.kernel && this.kernel.processes && this.kernel.processes.caddy_pid) {
       this.killProcessTree(this.kernel.processes.caddy_pid, 'kill caddy')
     }
+    if (this.kernel && this.kernel.anywhere) {
+      try {
+        this.kernel.anywhere.killSync()
+      } catch (error) {
+        console.error('Failed to kill tailscaled', error)
+      }
+    }
     this.killProcessTree(process.pid, 'kill self')
   }
   exists (s) {
@@ -1011,6 +1018,64 @@ class Server {
     routes.sort((a, b) => String(a.name || "").localeCompare(String(b.name || "")))
     return routes
   }
+  // ---------------- Pinokio Anywhere ----------------
+  portFromUrl(value) {
+    if (!value || typeof value !== "string") return null
+    try {
+      const parsed = new URL(value)
+      if (parsed.port) return Number(parsed.port)
+      if (parsed.protocol === "https:") return 443
+      if (parsed.protocol === "http:") return 80
+    } catch (_) { }
+    return null
+  }
+  async composeAnywhereStatus({ light } = {}) {
+    const anywhere = this.kernel ? this.kernel.anywhere : null
+    if (!anywhere) {
+      return { phase: "setup", installed: false, enabled: false, running: false }
+    }
+    let snap
+    try {
+      snap = await anywhere.snapshot()
+    } catch (error) {
+      return { phase: "error", installed: true, enabled: true, running: false, error: error && error.message ? error.message : String(error) }
+    }
+    if (light) {
+      return snap
+    }
+    snap.apps = []
+    if (snap.phase === "ready") {
+      const serveByLocalPort = new Map((snap.serve || []).map((entry) => [entry.local, entry]))
+      let running = []
+      try {
+        running = await this.collectHomeServerApps()
+      } catch (_) {
+        running = []
+      }
+      for (const app of running) {
+        const port = this.portFromUrl(app.ready_url || app.url)
+        const entry = port ? serveByLocalPort.get(port) : null
+        snap.apps.push({
+          name: app.name,
+          icon: app.icon,
+          state: app.state,
+          remote: entry ? entry.url : null,
+          exposed: !!entry,
+        })
+      }
+    }
+    if (snap.connectUrl) {
+      if (!this.anywhereQrCache || this.anywhereQrCache.url !== snap.connectUrl) {
+        try {
+          this.anywhereQrCache = { url: snap.connectUrl, data: await QRCode.toDataURL(snap.connectUrl, { margin: 1, scale: 6 }) }
+        } catch (_) {
+          this.anywhereQrCache = { url: snap.connectUrl, data: null }
+        }
+      }
+      snap.qr = this.anywhereQrCache.data
+    }
+    return snap
+  }
   async collectHomeServerApps() {
     const apps = []
     if (!this.kernel || !this.kernel.api || typeof this.kernel.api.listApps !== "function") {
@@ -4900,6 +4965,12 @@ class Server {
 //          config.icon = "/pinokio-white.png"
 //        }
 //      }
+      // Pinokio Anywhere: a visitor on the node's own Tailscale name gets each
+      // published app's fixed https address; any other host is left for the
+      // Home Server rewrite below, exactly as before.
+      if (this.kernel.anywhere) {
+        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu)
+      }
       config = Util.rewrite_localhost(this.kernel, config, req.$source)
       return config
     } else {
@@ -6757,6 +6828,8 @@ class Server {
         protocol,
         host: forwardedHost || req.get("host")
       }
+      // Pinokio Anywhere: only a visitor on the node's own Tailscale name gets the web-app manifest
+      res.locals.anywhere_host = !!(this.kernel && this.kernel.anywhere && this.kernel.anywhere.isNodeHost(req.$source.host))
       next()
     })
     if (this.kernel.homedir) {
@@ -14159,6 +14232,56 @@ class Server {
         allow_dns_creation,
       })
     }))
+    this.app.get("/anywhere", ex(async (req, res) => {
+      let { requirements, install_required, requirements_pending, error } = await this.kernel.bin.check({
+        bin: this.kernel.bin.preset("anywhere"),
+      })
+      if (!requirements_pending && install_required) {
+        res.redirect("/setup/anywhere?callback=/anywhere")
+        return
+      }
+      const anywhere = this.kernel.anywhere
+      // first visit after install: switch it on, the page then walks the user
+      // through sign-in. Later visits respect the on/off switch.
+      if (anywhere && !requirements_pending && !(await anywhere.configured())) {
+        anywhere.enable().catch((err) => {
+          console.log("[anywhere] enable failed", err && err.message ? err.message : err)
+        })
+      }
+      const status = await this.composeAnywhereStatus()
+      res.render("anywhere", {
+        status,
+        requirements_pending,
+        install_required,
+        error,
+        docs: this.docs,
+        portal: this.portal,
+        logo: this.logo,
+        theme: this.theme,
+        agent: req.agent,
+      })
+    }))
+    this.app.get("/anywhere/status", ex(async (req, res) => {
+      res.set("Cache-Control", "no-store")
+      res.json(await this.composeAnywhereStatus({ light: req.query.light === "1" }))
+    }))
+    const anywhereAction = (label, fn) => ex(async (req, res) => {
+      const anywhere = this.kernel.anywhere
+      if (!anywhere) {
+        res.status(500).json({ success: false, error: "Pinokio Anywhere is not available" })
+        return
+      }
+      try {
+        await fn(anywhere, req)
+        res.json({ success: true, status: await this.composeAnywhereStatus() })
+      } catch (error) {
+        console.log(`[anywhere] ${label} failed`, error)
+        res.status(500).json({ success: false, error: error && error.message ? error.message : String(error) })
+      }
+    })
+    this.app.post("/anywhere/start", anywhereAction("start", (anywhere) => anywhere.enable()))
+    this.app.post("/anywhere/stop", anywhereAction("stop", (anywhere) => anywhere.disable()))
+    this.app.post("/anywhere/logout", anywhereAction("logout", (anywhere) => anywhere.logout()))
     this.app.get("/network", ex(async (req, res) => {
       let protocol = req.get('X-Forwarded-Proto') || "http"
       let { requirements, install_required, requirements_pending, error } = await this.kernel.bin.check({

package/server/public/anywhere.webmanifest

@@ -0,0 +1 @@
+{"name":"Pinokio","short_name":"Pinokio","start_url":"/","scope":"/","display":"standalone","background_color":"#ffffff","theme_color":"#000000","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png","purpose":"any maskable"},{"src":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}]}