pinokiod 8.2.15 → 8.2.17

package/kernel/api/launcher_target.js

@@ -1,5 +1,7 @@
 const path = require("path")
 
+const isWebUrl = (value) => typeof value === "string" && /^https?:\/\//i.test(value)
+
 const filterSelectors = (preferred) => {
   if (Array.isArray(preferred)) {
     return preferred.filter((value) => typeof value === "string" && value.trim().length > 0)
@@ -108,6 +110,26 @@ const loadMenu = async (api, repoPath) => {
   return Array.isArray(config.menu) ? config.menu : []
 }
 
+// every menu item with an href, nested groups flattened in menu order, with its parsed target
+const menuTargets = async (api, repoPath) => {
+  let out = []
+  let stack = [...(await loadMenu(api, repoPath))]
+  while (stack.length > 0) {
+    let item = stack.shift()
+    if (!item || typeof item !== "object") {
+      continue
+    }
+    if (Array.isArray(item.menu)) {
+      stack.unshift(...item.menu)
+    }
+    let target = menuTarget(item)
+    if (target) {
+      out.push({ item, target })
+    }
+  }
+  return out
+}
+
 module.exports = async (api, repoPath, preferred = []) => {
   repoPath = await api.launcher_path(repoPath)
   let defaultTarget = await api.get_default(repoPath)
@@ -120,24 +142,12 @@ module.exports = async (api, repoPath, preferred = []) => {
   if (selectors.length === 0) {
     return undefined
   }
-  let stack = [...(await loadMenu(api, repoPath))]
-  while (stack.length > 0) {
-    let item = stack.shift()
-    if (!item || typeof item !== "object") {
-      continue
-    }
-    if (Array.isArray(item.menu)) {
-      stack.unshift(...item.menu)
-    }
-    let target = menuTarget(item)
-    if (!target) {
-      continue
-    }
+  for (let { target } of await menuTargets(api, repoPath)) {
     for (let selector of selectors) {
       if (!selectorMatches(selector, target)) {
         continue
       }
-      if (target.uri.startsWith("http")) {
+      if (isWebUrl(target.uri)) {
         return {
           uri: target.href
         }
@@ -149,3 +159,6 @@ module.exports = async (api, repoPath, preferred = []) => {
     }
   }
 }
+
+module.exports.menuTargets = menuTargets
+module.exports.isWebUrl = isWebUrl

package/kernel/bin/brew.js

@@ -54,7 +54,10 @@ class Brew {
     await this.kernel.bin.exec({
       message: "brew install gettext --force-bottle",
       conda: { skip: true },
-      env: this.nonInteractiveEnv()
+      env: {
+        ...this.nonInteractiveEnv(),
+        HOMEBREW_NO_RELOCATE_BUILD_PREFIX: "1"
+      }
     }, (stream) => { ondata(stream) })
 //
     ondata({ raw: `Install finished\r\n` })

package/kernel/bin/conda.js

@@ -15,19 +15,19 @@ const {
   isExpectedPythonPinned,
 } = require('./conda-pins')
 
-const MINIFORGE_RELEASE = "26.9.4-0"
+const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
-// GitHub's published SHA-256 asset digests for Miniforge 26.9.4-0.
+// GitHub's published SHA-256 asset digests for Miniforge 26.3.2-3.
 const MINIFORGE_SHA256 = {
   darwin: {
-    x64: '4bf8d162f90a9ae79fbe1c3b152a9957b6cf4e7385758fa21e0340229d444df1',
-    arm64: '85512f5495465644e09655d84bc1df79d978353abd9ef0d0a8f3df75da44c760',
+    x64: '39273e4c89a0a1af4538010615d44ae8f44e1af41007e02def593d20f316b003',
+    arm64: '59168f1e24d0a4ad9932021170809fca836cd240e183eeeb331d5bcfc0098168',
   },
   linux: {
-    x64: '621428f40496a90702753b09237794518a081d9979d9f845a525de761b6056f7',
-    arm64: 'd265b10be348403a3bb8d475ff989beba48db9baa5fe7ee28eb38213538056bb',
+    x64: '848194851a98903134187fbb4ab50efe87b003e0c0f808f97644b7524a62bf2c',
+    arm64: '2c113a69297e612b01ca0f320c22a3107a11f2ab9b573d79ac868a175945ce29',
   },
-  win32: { x64: '43638698f5ee811debae27b0dc3ab5c0300129bd400a847376c4bd2f6be15ceb' },
+  win32: { x64: '14a8635465b5190537ddad6286746ffebbc55a1ed2a7bb14a506595fe3191e1e' },
 }
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.15",
+  "version": "8.2.17",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -34,9 +34,13 @@ const Git = require("../kernel/git")
 const TerminalApi = require('../kernel/api/terminal')
 const PluginSources = require("../kernel/plugin_sources")
 const ManagedSkills = require("../kernel/managed_skills")
-const { rewriteHref: rewriteAnywhereHref } = require("../kernel/anywhere/serve")
+const { rewriteHref: rewriteAnywhereHref, LOOPBACK_HOSTS: ANYWHERE_LOOPBACK_HOSTS } = require("../kernel/anywhere/serve")
+const { menuTargets: launcherMenuTargets, isWebUrl } = require("../kernel/api/launcher_target")
 const { isPathRemovalBlockedError, removePath } = require("../kernel/path_removal")
 
+// a menu href whose query says "show, don't run" on the desktop (file view, editor, raw file, view source)
+const isInterfaceLink = (input) => "fs" in input || "command" in input || "raw" in input || input.mode === "source"
+
 const git = require('isomorphic-git')
 const http = require('isomorphic-git/http/node')
 const marked = require('marked')
@@ -1028,6 +1032,78 @@ class Server {
     } catch (_) { }
     return null
   }
+  // the installed catalog for the phone dashboard (spec/requirements/pinokio-anywhere-api.md)
+  async composeAnywhereApps() {
+    const entries = await this.kernel.api.listApps()
+    return { apps: entries.map((entry) => ({ id: entry.id, name: entry.title || entry.name || entry.id, icon: entry.icon })) }
+  }
+  // launch is a side effect: only pinokio.co and this computer may call it
+  anywhereOriginAllowed(origin) {
+    if (!origin) return true
+    let parsed
+    try { parsed = new URL(origin) } catch (_) { return false }
+    if (parsed.origin === "https://pinokio.co") return true
+    const host = parsed.hostname.toLowerCase()
+    if (host === "localhost" || host === "127.0.0.1" || host === "[::1]") return true
+    const anywhere = this.kernel ? this.kernel.anywhere : null
+    const dnsName = anywhere && typeof anywhere.dnsNameFrom === "function" ? anywhere.dnsNameFrom(anywhere.lastStatus) : null
+    return !!dnsName && parsed.protocol === "https:" && host === dnsName.toLowerCase()
+  }
+  // the app's menu as launch targets: scripts and web addresses, never interface links
+  async anywhereMenu(api, repoPath) {
+    const items = []
+    for (const { item, target } of await launcherMenuTargets(api, repoPath)) {
+      const web = isWebUrl(target.uri)
+      if (!web && !/\.(js|json)$/i.test(target.uri)) continue
+      if (isInterfaceLink(target.input)) continue
+      items.push({
+        text: item.text || "",
+        icon: item.icon || "",
+        href: target.href,
+        default: !!item.default,
+        uri: web ? target.href : path.resolve(repoPath, target.uri),
+        input: !web && Object.keys(target.input).length > 0 ? target.input : undefined,
+      })
+    }
+    return items
+  }
+  async composeAnywhereLaunch({ id, href } = {}) {
+    const api = this.kernel.api
+    const dir = typeof id === "string" ? this.kernel.path("api", id) : ""
+    if (!dir || path.dirname(dir) !== this.kernel.path("api") || path.basename(dir) !== id || !(await api.exists(dir))) {
+      return { status: 400, body: { error: `Unknown app: ${id}` } }
+    }
+    const menu = await this.anywhereMenu(api, await api.launcher_path(id))
+    const target = href ? menu.find((item) => item.href === href) : menu.find((item) => item.default)
+    if (!target) {
+      if (href) return { status: 400, body: { error: `Not in the menu: ${href}` } }
+      return { status: 200, body: { action: "menu", menu: menu.map(({ text, icon, href }) => ({ text, icon, href })) } }
+    }
+    if (isWebUrl(target.uri)) {
+      // a local address becomes its Anywhere address, or null until a Serve route carries it; any other URL passes through
+      let url = target.uri
+      if (ANYWHERE_LOOPBACK_HOSTS.has(new URL(url).hostname)) {
+        const snap = this.kernel.anywhere ? await this.kernel.anywhere.snapshot() : null
+        const rewritten = snap && snap.phase === "ready" ? rewriteAnywhereHref(url, snap.serve || []) : url
+        url = rewritten === url ? null : rewritten
+      }
+      return { status: 200, body: { action: "open", url } }
+    }
+    // the same steps as a desktop launch (server/socket.js), so logs, launch counts and the home screen agree
+    if (api.logSessions && typeof api.logSessions.reserveLaunch === "function") {
+      await api.logSessions.reserveLaunch(target.uri)
+    }
+    if (!this.kernel.status(target.uri)) {
+      this.appPreferences.recordLaunchByPath(target.uri, { source: "ui", timestamp: Date.now() }).catch((err) => {
+        console.warn("[anywhere] launch count not recorded", err && err.message ? err.message : err)
+      })
+      await this.kernel.clearLog(target.uri)
+      api.process({ uri: target.uri, input: target.input }).catch((err) => {
+        console.error("[anywhere] launch failed", err && err.stack ? err.stack : err)
+      })
+    }
+    return { status: 200, body: { action: "started" } }
+  }
   async composeAnywhereStatus({ light } = {}) {
     const anywhere = this.kernel ? this.kernel.anywhere : null
     if (!anywhere) {
@@ -1042,14 +1118,13 @@ class Server {
     if (light) {
       return snap
     }
-    let entries = []
-    try {
-      entries = await this.kernel.api.listApps()
-    } catch (error) {
-      return Object.assign(snap, { phase: "error", error: `Could not list apps: ${error.message}` })
-    }
-    snap.installed = entries.length
     if (snap.phase === "ready") {
+      let entries = []
+      try {
+        entries = await this.kernel.api.listApps()
+      } catch (error) {
+        return Object.assign(snap, { phase: "error", error: `Could not list apps: ${error.message}` })
+      }
       const serveByLocalPort = new Map((snap.serve || []).map((entry) => [entry.local, entry]))
       let running = []
       try {
@@ -14265,17 +14340,27 @@ class Server {
         agent: req.agent,
       })
     }))
-    // the phone-first launcher: running apps with their stable Tailscale addresses
-    this.app.get("/remote", ex(async (req, res) => {
-      res.render("remote", {
-        status: await this.composeAnywhereStatus(),
-        theme: this.theme,
-      })
-    }))
     this.app.get("/anywhere/status", ex(async (req, res) => {
       res.set("Cache-Control", "no-store")
       res.json(await this.composeAnywhereStatus({ light: req.query.light === "1" }))
     }))
+    this.app.get("/anywhere/apps", ex(async (req, res) => {
+      res.set("Cache-Control", "no-store")
+      res.json(await this.composeAnywhereApps())
+    }))
+    this.app.post("/anywhere/launch", ex(async (req, res) => {
+      res.set("Cache-Control", "no-store")
+      if (!this.anywhereOriginAllowed(req.get("Origin"))) {
+        res.status(403).json({ error: "Launching is allowed only from pinokio.co or this computer" })
+        return
+      }
+      try {
+        const { status, body } = await this.composeAnywhereLaunch(req.body || {})
+        res.status(status).json(body)
+      } catch (error) {
+        res.status(500).json({ error: error && error.message ? error.message : String(error) })
+      }
+    }))
     const anywhereAction = (label, fn) => ex(async (req, res) => {
       const anywhere = this.kernel.anywhere
       if (!anywhere) {

package/server/public/anywhere.webmanifest

@@ -1 +1 @@
-{"name":"Pinokio","short_name":"Pinokio","start_url":"/remote","scope":"/","display":"standalone","background_color":"#ffffff","theme_color":"#000000","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png","purpose":"any maskable"},{"src":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}]}
+{"name":"Pinokio","short_name":"Pinokio","start_url":"/","scope":"/","display":"standalone","background_color":"#ffffff","theme_color":"#000000","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png","purpose":"any maskable"},{"src":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}]}

package/server/views/partials/home_server_popover.ejs

@@ -1,4 +1,3 @@
-<a class="btn2 home-server-popover__trigger" href="/remote" data-tippy-content="Launcher" title="Launcher" aria-label="Launcher"><i class="fa-solid fa-table-cells-large"></i></a>
 <div class="home-server-popover" data-home-server-popover data-home-server-status="loading">
   <button
     type="button"

package/test/anywhere-api.test.js

@@ -0,0 +1,216 @@
+const assert = require('node:assert/strict')
+const path = require('node:path')
+const test = require('node:test')
+const Server = require('../server/index.js')
+const Anywhere = require('../kernel/anywhere')
+const { buildServeConfig, describeServeConfig } = require('../kernel/anywhere/serve')
+
+// The Anywhere API (spec/requirements/pinokio-anywhere-api.md) with its
+// collaborators stubbed: status, the installed catalog and launch.
+
+const readyAnywhere = () => {
+  const anywhere = new Anywhere({})
+  anywhere.config = { enabled: true }
+  anywhere.lastStatus = { Self: { DNSName: 'pinokio.tail1.ts.net.' } }
+  anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
+  anywhere.snapshot = async () => ({ phase: 'ready', dnsName: 'pinokio.tail1.ts.net', serve: describeServeConfig(anywhere.lastServe) })
+  return anywhere
+}
+
+test('status carries app ids and complete remote addresses, and no installed count', async () => {
+  const anywhere = readyAnywhere()
+  let readyUrl
+  const fake = {
+    kernel: { anywhere, api: { listApps: async () => [{ id: 'comfy' }, { id: 'forge' }, { id: 'idle' }] } },
+    collectHomeServerApps: async () => [
+      { id: 'comfy', name: 'ComfyUI', icon: '/c.png', ready_url: readyUrl, state: 'ready' },
+      { id: 'forge', name: 'Forge', icon: '/f.png', ready_url: '', state: 'starting' },
+    ],
+    portFromUrl: Server.prototype.portFromUrl,
+  }
+  for (const [url, expected] of [
+    ['http://127.0.0.1:7860/ui/?token=keep%20me#view', 'https://pinokio.tail1.ts.net:43000/ui/?token=keep%20me#view'],
+    ['http://127.0.0.1:7860', 'https://pinokio.tail1.ts.net:43000/'],
+  ]) {
+    readyUrl = url
+    const status = await Server.prototype.composeAnywhereStatus.call(fake, {})
+    assert.equal(status.installed, undefined)
+    assert.deepEqual(status.apps.map((a) => [a.id, a.remote]), [['comfy', expected], ['forge', null]])
+  }
+  const light = await Server.prototype.composeAnywhereStatus.call(fake, { light: true })
+  assert.equal(light.apps, undefined, 'the light status is unchanged')
+})
+
+test('remote links use captured routes when Anywhere stops during app collection', async () => {
+  for (const stage of ['list', 'runtime']) {
+    const anywhere = readyAnywhere()
+    const stop = () => { anywhere.config.enabled = false; anywhere.lastServe = undefined; anywhere.lastStatus = null }
+    const fake = {
+      kernel: { anywhere, api: { listApps: async () => { if (stage === 'list') stop(); return [{ id: 'app' }] } } },
+      collectHomeServerApps: async () => {
+        if (stage === 'runtime') stop()
+        return [{ id: 'app', state: 'ready', ready_url: 'http://127.0.0.1:7860/ui/?token=keep%20me#view' }]
+      },
+      portFromUrl: Server.prototype.portFromUrl,
+    }
+    const status = await Server.prototype.composeAnywhereStatus.call(fake)
+    assert.equal(status.apps[0].remote, 'https://pinokio.tail1.ts.net:43000/ui/?token=keep%20me#view', stage)
+    assert.equal(status.apps[0].exposed, true)
+  }
+})
+
+test('apps are listed only in the ready phase, and a failed listing is an error', async () => {
+  for (const phase of ['setup', 'off', 'starting', 'login', 'machine_auth', 'https', 'error']) {
+    let listed = false
+    const status = await Server.prototype.composeAnywhereStatus.call({
+      kernel: { anywhere: { snapshot: async () => ({ phase }) }, api: { listApps: async () => { listed = true; return [] } } },
+    })
+    assert.equal(status.apps, undefined, phase)
+    assert.equal(listed, false, phase)
+  }
+  const failed = await Server.prototype.composeAnywhereStatus.call({
+    kernel: { anywhere: { snapshot: async () => ({ phase: 'ready' }) }, api: { listApps: async () => { throw new Error('unavailable') } } },
+  })
+  assert.equal(failed.phase, 'error')
+  assert.match(failed.error, /unavailable/)
+  assert.equal(failed.apps, undefined)
+})
+
+test('status reports runtime inspection failures while Home Server keeps its existing behavior', async () => {
+  const fake = {
+    kernel: {
+      path: (...parts) => path.join('/managed', ...parts),
+      anywhere: { snapshot: async () => ({ phase: 'ready', enabled: true, serve: [] }) },
+      api: { listApps: async () => [{ id: 'comfy', name: 'ComfyUI' }] },
+    },
+    appRegistry: { collectAppRuntime() { throw new Error('runtime inspection failed') } },
+    collectHomeServerApps: Server.prototype.collectHomeServerApps,
+    portFromUrl: Server.prototype.portFromUrl,
+  }
+  const status = await Server.prototype.composeAnywhereStatus.call(fake)
+  assert.equal(status.phase, 'error')
+  assert.match(status.error, /runtime inspection failed/)
+  assert.equal(status.apps, undefined)
+  assert.deepEqual(await fake.collectHomeServerApps(), [])
+})
+
+test('the catalog maps installed apps to id, name and icon', async () => {
+  const fake = { kernel: { api: { listApps: async () => [
+    { id: 'comfy', name: 'comfy', title: 'ComfyUI', icon: '/api/comfy/icon.png', description: 'x' },
+    { id: 'bare', name: 'bare', title: '', icon: '/pinokio-black.png' },
+  ] } } }
+  assert.deepEqual(await Server.prototype.composeAnywhereApps.call(fake), { apps: [
+    { id: 'comfy', name: 'ComfyUI', icon: '/api/comfy/icon.png' },
+    { id: 'bare', name: 'bare', icon: '/pinokio-black.png' },
+  ] })
+})
+
+// a launch harness: one app "comfy" at /managed/api/comfy whose menu is set per case;
+// kernel.status mirrors the kernel's session-aware running check
+const launchHarness = ({ menu = [], running = {}, anywhere = readyAnywhere() } = {}) => {
+  const calls = { process: [], cleared: [], reserved: [], counted: [] }
+  const api = {
+    exists: async (p) => p === '/managed/api/comfy',
+    launcher_path: async (name) => `/managed/api/${name}`,
+    launcher: async () => ({ script: { menu } }),
+    running,
+    logSessions: { reserveLaunch: async (uri) => { calls.reserved.push(uri) } },
+    process: (req) => { calls.process.push(req); return Promise.resolve() },
+  }
+  const server = Object.assign(Object.create(Server.prototype), {
+    kernel: {
+      api, anywhere,
+      path: (...parts) => path.posix.join('/managed', ...parts),
+      status: (uri) => Object.entries(running).some(([key, value]) => value && (key === uri || key.startsWith(uri + '&session='))),
+      clearLog: async (id) => { calls.cleared.push(id) },
+    },
+    appPreferences: { recordLaunchByPath: async (p, options) => { calls.counted.push([p, options.source]) } },
+  })
+  return { server, calls, launch: (body) => server.composeAnywhereLaunch(body) }
+}
+
+test('launch opens a loopback URL default at its Anywhere address, null until Serve carries it, other URLs as they are', async () => {
+  const carried = launchHarness({ menu: [{ default: true, href: 'http://127.0.0.1:7860/?x=1' }] })
+  assert.deepEqual(await carried.launch({ id: 'comfy' }), { status: 200, body: { action: 'open', url: 'https://pinokio.tail1.ts.net:43000/?x=1' } })
+  const uncarried = launchHarness({ menu: [{ default: true, href: 'http://127.0.0.1:9999/' }] })
+  assert.deepEqual(await uncarried.launch({ id: 'comfy' }), { status: 200, body: { action: 'open', url: null } })
+  const elsewhere = launchHarness({ menu: [{ default: true, href: 'https://docs.example/x' }] })
+  assert.deepEqual(await elsewhere.launch({ id: 'comfy' }), { status: 200, body: { action: 'open', url: 'https://docs.example/x' } })
+  assert.deepEqual(carried.calls.process, [])
+})
+
+test('launch starts a script default as a desktop launch would, once', async () => {
+  const h = launchHarness({ menu: [{ default: true, href: 'start.js?mode=fast' }] })
+  assert.deepEqual(await h.launch({ id: 'comfy' }), { status: 200, body: { action: 'started' } })
+  assert.deepEqual(h.calls.reserved, ['/managed/api/comfy/start.js'])
+  assert.deepEqual(h.calls.counted, [['/managed/api/comfy/start.js', 'ui']])
+  assert.deepEqual(h.calls.cleared, ['/managed/api/comfy/start.js'])
+  assert.deepEqual(h.calls.process, [{ uri: '/managed/api/comfy/start.js', input: { mode: 'fast' } }])
+  for (const key of ['/managed/api/comfy/start.js', '/managed/api/comfy/start.js&session=abc']) {
+    const already = launchHarness({ menu: [{ default: true, href: 'start.js' }], running: { [key]: true } })
+    assert.deepEqual(await already.launch({ id: 'comfy' }), { status: 200, body: { action: 'started' } })
+    assert.deepEqual(already.calls.process, [], `${key}: not started again`)
+    assert.deepEqual(already.calls.cleared, [], `${key}: log kept`)
+  }
+})
+
+const menu = [
+  { text: 'Install', icon: 'fa-solid fa-plug', href: 'install.js' },
+  { text: 'Start', icon: 'fa-solid fa-power-off', menu: [
+    { text: 'Start', href: 'start.js' },
+    { text: 'Start (low VRAM)', href: 'start.js', params: { lowvram: true } },
+  ] },
+  { text: 'Web UI', icon: 'fa-solid fa-rocket', href: 'http://127.0.0.1:7860' },
+  { text: 'Edit start', href: 'start.js?fs=view' },
+  { text: 'View source', href: 'start.js?mode=source' },
+  { text: 'Models', href: 'models?fs=true' },
+  { text: 'README', href: 'README.md?raw=true' },
+  { text: 'Section' },
+]
+
+test('launch returns the flattened launchable menu when there is no default', async () => {
+  const h = launchHarness({ menu })
+  assert.deepEqual(await h.launch({ id: 'comfy' }), { status: 200, body: { action: 'menu', menu: [
+    { text: 'Install', icon: 'fa-solid fa-plug', href: 'install.js' },
+    { text: 'Start', icon: '', href: 'start.js' },
+    { text: 'Start (low VRAM)', icon: '', href: 'start.js?lowvram=true' },
+    { text: 'Web UI', icon: 'fa-solid fa-rocket', href: 'http://127.0.0.1:7860' },
+  ] } })
+  assert.deepEqual(h.calls.process, [])
+})
+
+test('launch runs a chosen menu item with its input, and rejects anything else', async () => {
+  const h = launchHarness({ menu })
+  assert.deepEqual(await h.launch({ id: 'comfy', href: 'start.js?lowvram=true' }), { status: 200, body: { action: 'started' } })
+  assert.deepEqual(h.calls.process, [{ uri: '/managed/api/comfy/start.js', input: { lowvram: 'true' } }])
+  assert.deepEqual(await h.launch({ id: 'comfy', href: 'http://127.0.0.1:7860' }), { status: 200, body: { action: 'open', url: 'https://pinokio.tail1.ts.net:43000/' } })
+  for (const href of ['start.js?fs=view', 'start.js?mode=source', 'models?fs=true', 'reset.js']) {
+    assert.equal((await h.launch({ id: 'comfy', href })).status, 400, href)
+  }
+  for (const id of ['nope', '../comfy', 'comfy/start.js', 'comfy/..', '.', '..', '', 7, undefined]) {
+    assert.equal((await h.launch({ id })).status, 400, String(id))
+  }
+  assert.equal(h.calls.process.length, 1)
+})
+
+// drive-relative ids ("D:", "D:comfy") resolve outside api/ on Windows; the containment rule
+// uses the platform path module, so this case is only real on a Windows host
+test('a drive-relative app id is refused on Windows', { skip: process.platform !== 'win32' }, async () => {
+  const harness = launchHarness({ menu: [{ default: true, href: 'start.js' }] })
+  harness.server.kernel.path = (...parts) => path.resolve('C:\\u\\pinokio', ...parts)
+  harness.server.kernel.api.exists = async () => true
+  assert.equal((await harness.launch({ id: 'comfy' })).status, 200)
+  for (const id of ['D:', 'D:comfy', 'C:\\u\\pinokio\\api\\comfy', '..\\comfy']) {
+    assert.equal((await harness.launch({ id })).status, 400, id)
+  }
+})
+
+test('launch is allowed from pinokio.co and this computer only', () => {
+  const server = Object.assign(Object.create(Server.prototype), { kernel: { anywhere: readyAnywhere() } })
+  for (const origin of [undefined, 'https://pinokio.co', 'http://localhost:42000', 'http://127.0.0.1:42000', 'https://pinokio.tail1.ts.net']) {
+    assert.equal(server.anywhereOriginAllowed(origin), true, String(origin))
+  }
+  for (const origin of ['https://evil.example', 'http://pinokio.co', 'https://pinokio.co.evil.example', 'http://pinokio.tail1.ts.net', 'not a url']) {
+    assert.equal(server.anywhereOriginAllowed(origin), false, origin)
+  }
+})

package/server/views/remote.ejs

@@ -1,105 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<title>Pinokio</title>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
-<base target="_top">
-<% if (locals.anywhere_host) { %>
-<link rel="manifest" href="/anywhere.webmanifest">
-<link rel="apple-touch-icon" href="/apple-touch-icon.png">
-<meta name="apple-mobile-web-app-capable" content="yes">
-<meta name="apple-mobile-web-app-title" content="Pinokio">
-<% } %>
-<link href="/css/fontawesome.min.css" rel="stylesheet">
-<link href="/css/solid.min.css" rel="stylesheet">
-<style>
-:root { --bg: #f6f5f1; --card: #fff; --text: #1a1a1a; --muted: #6b6a66; --line: #dcdad2; --accent: #1a1a1a; --on: #fff; }
-body.dark { --bg: #141414; --card: #1e1e1e; --text: #f1f1f1; --muted: #a8a69f; --line: #333; --accent: #f1f1f1; --on: #141414; }
-* { box-sizing: border-box; }
-body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; -webkit-text-size-adjust: 100%; }
-main { max-width: 480px; margin: 0 auto; padding: 24px 16px 48px; }
-h1 { font-size: 22px; font-weight: 600; margin: 0 0 18px; }
-h2 { font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.05em; color: var(--muted); margin: 0 0 8px; }
-.card { display: flex; align-items: center; gap: 12px; background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px; margin: 0 0 10px; }
-.card img { width: 44px; height: 44px; border-radius: 10px; object-fit: cover; background: var(--bg); flex: none; }
-.card .body { flex: 1; min-width: 0; }
-.card .name { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.card .sub { font-size: 13px; color: var(--muted); }
-.card .sub a { color: inherit; }
-.open { flex: none; padding: 10px 16px; border-radius: 10px; background: var(--accent); color: var(--on); font-weight: 600; text-decoration: none; }
-.state { flex: none; font-size: 13px; color: var(--muted); }
-.notice { text-align: center; padding: 28px 16px; color: var(--muted); }
-.notice strong { display: block; color: var(--text); font-size: 17px; margin-bottom: 4px; }
-.door { display: flex; align-items: center; gap: 12px; border-radius: 14px; padding: 14px; text-decoration: none; color: var(--text); margin-top: 14px; }
-.door.dashed { border: 1px dashed var(--muted); }
-.door.solid { background: var(--accent); color: var(--on); }
-.door .body { flex: 1; }
-.door .title { font-weight: 600; }
-.door .cap { font-size: 13px; opacity: 0.75; }
-.door i { font-size: 18px; }
-.full { display: block; text-align: center; margin-top: 18px; color: var(--muted); font-size: 14px; text-decoration: none; }
-.full i { margin-right: 6px; }
-[hidden] { display: none !important; }
-</style>
-</head>
-<body class="<%=theme%>">
-<main>
-  <h1>Pinokio</h1>
-  <section id="running" hidden>
-    <h2>Running now</h2>
-    <div id="cards"></div>
-  </section>
-  <div id="notice" class="notice" hidden></div>
-  <a id="door" class="door" href="/home">
-    <i class="fa-solid fa-plus"></i>
-    <div class="body"><div class="title" id="door-title"></div><div class="cap" id="door-cap"></div></div>
-    <i class="fa-solid fa-chevron-right"></i>
-  </a>
-  <a class="full" href="/home"><i class="fa-solid fa-house"></i> Open full Pinokio</a>
-</main>
-<script>
-(() => {
-  let current = <%- JSON.stringify(status || {}).replace(/</g, '\\u003c') %>
-  const esc = (v) => String(v == null ? '' : v).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
-  const port = (url) => { try { return new URL(url).port } catch (_) { return '' } }
-  const render = (status) => {
-    current = status || {}
-    const apps = Array.isArray(current.apps) ? current.apps : []
-    const available = current.phase === 'ready' && Array.isArray(current.apps)
-    document.getElementById('running').hidden = apps.length === 0
-    document.getElementById('notice').hidden = apps.length > 0
-    const states = { setup: 'Set up Pinokio Anywhere', off: 'Pinokio Anywhere is off', starting: 'Starting Pinokio Anywhere…', login: 'Sign in to Tailscale', machine_auth: 'Device approval required', https: 'HTTPS approval required' }
-    document.getElementById('notice').innerHTML = available
-      ? '<strong>Nothing is running</strong>Start an app on your computer and it shows up here.'
-      : `<strong>${esc(current.error || current.serveError || states[current.phase] || 'Pinokio Anywhere is unavailable')}</strong><a href="/anywhere">Open Anywhere</a>`
-    document.getElementById('cards').innerHTML = apps.map((app) => `
-      <div class="card">
-        <img src="${esc(app.icon || '/pinokio-black.png')}" alt="">
-        <div class="body">
-          <div class="name">${esc(app.name)}</div>
-          <div class="sub">${app.remote ? ':' + esc(port(app.remote)) + ' · ' : ''}<a href="/p/${encodeURIComponent(app.id || '')}">${app.remote ? 'manage' : 'terminal'}</a></div>
-        </div>
-        ${app.remote ? `<a class="open" href="${esc(app.remote)}">Open</a>` : `<span class="state">${esc(app.state || 'starting')}…</span>`}
-      </div>`).join('')
-    const door = document.getElementById('door')
-    door.className = 'door ' + (apps.length > 0 ? 'dashed' : 'solid')
-    document.getElementById('door-title').textContent = apps.length > 0 ? 'Start another app' : 'Start an app'
-    document.getElementById('door-cap').textContent = typeof current.installed === 'number' ? `${current.installed} installed apps in Pinokio` : ''
-  }
-  const poll = async () => {
-    try {
-      const response = await fetch('/anywhere/status', { cache: 'no-store' })
-      if (!response.ok) throw new Error(`Could not refresh app status (${response.status})`)
-      render(await response.json())
-    } catch (error) {
-      render({ ...current, phase: 'error', error: error.message, apps: undefined })
-    }
-    setTimeout(poll, 5000)
-  }
-  render(current)
-  setTimeout(poll, 5000)
-})()
-</script>
-</body>
-</html>

package/test/anywhere-remote.test.js

@@ -1,222 +0,0 @@
-const assert = require('node:assert/strict')
-const path = require('node:path')
-const test = require('node:test')
-const ejs = require('ejs')
-const Server = require('../server/index.js')
-const Anywhere = require('../kernel/anywhere')
-const { buildServeConfig, describeServeConfig } = require('../kernel/anywhere/serve')
-const { JSDOM } = require('jsdom')
-
-const view = path.resolve(__dirname, '..', 'server', 'views', 'remote.ejs')
-
-// composeAnywhereStatus with its collaborators stubbed: the launcher needs the
-// installed count and each running app's id next to its remote address.
-test('anywhere status carries the installed count, app ids and complete app URLs', async () => {
-  const anywhere = new Anywhere({})
-  anywhere.config = { enabled: true }
-  anywhere.lastStatus = { Self: { DNSName: 'pinokio.tail1.ts.net.' } }
-  anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
-  anywhere.snapshot = async () => ({ phase: 'ready', dnsName: 'pinokio.tail1.ts.net', serve: describeServeConfig(anywhere.lastServe) })
-  let readyUrl
-  const fake = {
-    kernel: {
-      anywhere,
-      api: { listApps: async () => [{ id: 'comfy' }, { id: 'forge' }, { id: 'idle' }] },
-    },
-    collectHomeServerApps: async () => [
-      { id: 'comfy', name: 'ComfyUI', icon: '/c.png', ready_url: readyUrl, state: 'ready' },
-      { id: 'forge', name: 'Forge', icon: '/f.png', ready_url: '', state: 'starting' },
-    ],
-    portFromUrl: Server.prototype.portFromUrl,
-  }
-  for (const [url, expected] of [
-    ['http://127.0.0.1:7860/ui/?token=keep%20me#view', 'https://pinokio.tail1.ts.net:43000/ui/?token=keep%20me#view'],
-    ['http://127.0.0.1:7860', 'https://pinokio.tail1.ts.net:43000/'],
-  ]) {
-    readyUrl = url
-    const status = await Server.prototype.composeAnywhereStatus.call(fake, {})
-    assert.equal(status.installed, 3)
-    assert.deepEqual(status.apps.map((a) => [a.id, a.remote]), [['comfy', expected], ['forge', null]])
-  }
-  const light = await Server.prototype.composeAnywhereStatus.call(fake, { light: true })
-  assert.equal(light.installed, undefined, 'the light status is unchanged')
-})
-
-test('remote links use captured routes when Anywhere stops during app collection', async () => {
-  for (const stage of ['list', 'runtime']) {
-    const anywhere = new Anywhere({})
-    anywhere.config = { enabled: true }
-    anywhere.lastStatus = { Self: { DNSName: 'pinokio.tail1.ts.net.' } }
-    anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
-    anywhere.snapshot = async () => ({ phase: 'ready', dnsName: 'pinokio.tail1.ts.net', serve: describeServeConfig(anywhere.lastServe) })
-    const stop = () => { anywhere.config.enabled = false; anywhere.lastServe = undefined; anywhere.lastStatus = null }
-    const fake = {
-      kernel: { anywhere, api: { listApps: async () => { if (stage === 'list') stop(); return [{ id: 'app' }] } } },
-      collectHomeServerApps: async () => {
-        if (stage === 'runtime') stop()
-        return [{ id: 'app', state: 'ready', ready_url: 'http://127.0.0.1:7860/ui/?token=keep%20me#view' }]
-      },
-      portFromUrl: Server.prototype.portFromUrl,
-    }
-    const status = await Server.prototype.composeAnywhereStatus.call(fake)
-    assert.equal(status.apps[0].remote, 'https://pinokio.tail1.ts.net:43000/ui/?token=keep%20me#view', stage)
-    assert.equal(status.apps[0].exposed, true)
-  }
-})
-
-test('unavailable app lists remain distinct from a confirmed empty list', async () => {
-  for (const phase of ['setup', 'off', 'starting', 'login', 'machine_auth', 'https', 'error']) {
-    const status = await Server.prototype.composeAnywhereStatus.call({
-      kernel: { anywhere: { snapshot: async () => ({ phase }) }, api: { listApps: async () => [] } },
-    })
-    assert.equal(status.apps, undefined, phase)
-  }
-  const failed = await Server.prototype.composeAnywhereStatus.call({
-    kernel: { anywhere: { snapshot: async () => ({ phase: 'ready' }) }, api: { listApps: async () => { throw new Error('unavailable') } } },
-  })
-  assert.equal(failed.phase, 'error')
-  assert.match(failed.error, /unavailable/)
-  assert.equal(failed.apps, undefined)
-})
-
-test('Anywhere reports runtime inspection failures while Home Server keeps its existing behavior', async () => {
-  const fake = {
-    kernel: {
-      path: (...parts) => path.join('/managed', ...parts),
-      anywhere: { snapshot: async () => ({ phase: 'ready', enabled: true, serve: [] }) },
-      api: { listApps: async () => [{ id: 'comfy', name: 'ComfyUI' }] },
-    },
-    appRegistry: { collectAppRuntime() { throw new Error('runtime inspection failed') } },
-    collectHomeServerApps: Server.prototype.collectHomeServerApps,
-    portFromUrl: Server.prototype.portFromUrl,
-  }
-  const status = await Server.prototype.composeAnywhereStatus.call(fake)
-  assert.equal(status.phase, 'error')
-  assert.match(status.error, /runtime inspection failed/)
-  assert.equal(status.apps, undefined)
-  const html = await ejs.renderFile(view, { status, theme: 'light', locals: {} })
-  const dom = new JSDOM(html, { runScripts: 'outside-only', url: 'http://localhost:42000' })
-  try {
-    dom.window.setTimeout = () => 0
-    dom.window.eval(dom.window.document.querySelector('script').textContent)
-    assert.match(dom.window.document.getElementById('notice').textContent, /runtime inspection failed/)
-    assert.doesNotMatch(dom.window.document.getElementById('notice').textContent, /Nothing is running/)
-  } finally { dom.window.close() }
-  assert.deepEqual(await fake.collectHomeServerApps(), [])
-})
-
-test('launcher renders actual states, top-level links and polling failures', async () => {
-  for (const status of [
-    { phase: 'off' }, { phase: 'setup' }, { phase: 'error', error: '<broken>' },
-    { phase: 'ready', installed: 0, apps: [] },
-    { phase: 'ready', installed: 2, apps: [
-      { id: 'comfy', name: 'Comfy', remote: 'https://pinokio.tail1.ts.net:43000' },
-      { id: 'forge', name: 'Forge', state: 'starting', remote: null },
-    ] },
-  ]) {
-    const html = await ejs.renderFile(view, { status, theme: 'light', locals: {} })
-    const dom = new JSDOM(html, { runScripts: 'outside-only', url: 'http://localhost:42000' })
-    try {
-      const timers = []
-      dom.window.setTimeout = (fn) => timers.push(fn)
-      dom.window.fetch = async () => ({ ok: false, status: 503 })
-      dom.window.eval(dom.window.document.querySelector('script').textContent)
-      const doc = dom.window.document
-      assert.equal(doc.querySelector('base').target, '_top')
-      assert.equal(doc.querySelector('#notice').textContent.includes('Nothing is running'), status.phase === 'ready')
-      assert.equal(doc.querySelectorAll('a.open').length, status.apps && status.apps.length ? 1 : 0)
-      if (status.error) assert.ok(doc.querySelector('#notice').textContent.includes('<broken>'))
-      await timers.shift()()
-      assert.equal(doc.querySelectorAll('a.open').length, 0)
-      assert.match(doc.querySelector('#notice').textContent, /503/)
-      assert.doesNotMatch(doc.querySelector('#notice').textContent, /Nothing is running/)
-    } finally { dom.window.close() }
-  }
-})
-
-test('the launcher page renders the running apps and one door to the full interface', async () => {
-  const render = (status) => ejs.renderFile(view, { status, theme: 'light', locals: {} })
-
-  const none = await render({ installed: 12, apps: [] })
-  assert.match(none, /Nothing is running/)
-  assert.match(none, /href="\/home"/)
-  assert.match(none, /Open full Pinokio/)
-  assert.match(none, /"installed":12/)
-
-  const some = await render({ installed: 12, apps: [
-    { id: 'comfy', name: 'ComfyUI', icon: '/c.png', state: 'ready', remote: 'https://pinokio.tail1.ts.net:43000' },
-    { id: 'forge', name: 'Forge', icon: '/f.png', state: 'starting', remote: null },
-  ] })
-  assert.match(some, /"remote":"https:\/\/pinokio\.tail1\.ts\.net:43000"/)
-  assert.match(some, /"id":"forge"/)
-  assert.doesNotMatch(some, /<link rel="manifest"/, 'manifest tags only for the Tailscale host')
-})
-
-test('Anywhere shows polling failures and recovers on the next successful response', async () => {
-  for (const failure of ['http', 'network']) {
-    const status = { phase: 'ready', enabled: true }
-    const html = await ejs.renderFile(path.resolve(__dirname, '..', 'server/views/anywhere.ejs'), {
-      status, theme: 'light', agent: 'browser',
-    }, { includer: () => ({ template: '' }) })
-    const dom = new JSDOM(html, { runScripts: 'outside-only', url: 'http://localhost:42000' })
-    try {
-      const timers = []
-      let requests = 0
-      dom.window.setTimeout = fn => timers.push(fn)
-      dom.window.fetch = async () => {
-        if (++requests === 1) {
-          if (failure === 'network') throw new Error('Connection failed')
-          return { ok: false, status: 503 }
-        }
-        return { ok: true, json: async () => status }
-      }
-      const { document } = dom.window
-      dom.window.eval([...document.querySelectorAll('script')].at(-1).textContent)
-      await timers.shift()()
-      assert.equal(document.getElementById('anywhere-root').dataset.phase, 'error')
-      assert.match(document.getElementById('anywhere-error').textContent, failure === 'http' ? /503/ : /Connection failed/)
-      await timers.shift()()
-      assert.equal(document.getElementById('anywhere-root').dataset.phase, 'ready')
-    } finally { dom.window.close() }
-  }
-})
-
-test('Anywhere retries the requested start or stop after API and network failures', async () => {
-  for (const action of ['start', 'stop']) {
-    for (const failure of ['saved', 'api', 'network']) {
-      const enabled = action === 'start'
-      const status = failure === 'saved'
-        ? { phase: 'error', enabled, error: 'Previous failure' }
-        : { phase: enabled ? 'off' : 'ready', enabled: !enabled }
-      const html = await ejs.renderFile(path.resolve(__dirname, '..', 'server/views/anywhere.ejs'), {
-        status, theme: 'light', agent: 'browser',
-      }, { includer: () => ({ template: '' }) })
-      const dom = new JSDOM(html, { runScripts: 'outside-only', url: 'http://localhost:42000' })
-      try {
-        const requests = []
-        const { document } = dom.window
-        dom.window.setTimeout = () => 0
-        dom.window.fetch = async (url, options) => {
-          requests.push(url)
-          assert.equal(options.method, 'POST')
-          if (requests.length === 1 && failure !== 'saved') {
-            if (failure === 'network') throw new Error('Connection failed')
-            return { json: async () => ({ error: 'Operation failed' }) }
-          }
-          return { json: async () => ({ status: { phase: enabled ? 'starting' : 'off', enabled } }) }
-        }
-        dom.window.eval([...document.querySelectorAll('script')].at(-1).textContent)
-        if (failure !== 'saved') {
-          document.getElementById('anywhere-switch').click()
-          await new Promise(setImmediate)
-          assert.equal(document.getElementById('anywhere-root').dataset.phase, 'error')
-          assert.match(document.getElementById('anywhere-error').textContent, /failed/)
-        }
-        document.getElementById('anywhere-retry').click()
-        await new Promise(setImmediate)
-        assert.deepEqual(requests, Array(failure === 'saved' ? 1 : 2).fill(`/anywhere/${action}`))
-        assert.equal(document.getElementById('anywhere-root').dataset.phase, enabled ? 'starting' : 'off')
-      } finally { dom.window.close() }
-    }
-  }
-})