pinokiod 8.2.2 → 8.2.3

package/test/anywhere.test.js

@@ -0,0 +1,443 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+const http = require('node:http')
+const os = require('node:os')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const { buildServeConfig, describeServeConfig, sameServeConfig } = require('../kernel/anywhere/serve')
+const { assignPorts } = require('../kernel/anywhere/ports')
+const { LocalAPI } = require('../kernel/anywhere/localapi')
+const Anywhere = require('../kernel/anywhere')
+const { spawn } = require('node:child_process')
+const Tailscaled = require('../kernel/bin/tailscaled')
+const Setup = require('../kernel/bin/setup')
+
+test('serve config maps pinokiod to 443 and each app to its stable remote port', () => {
+  const config = buildServeConfig({
+    dnsName: 'pinokio.tail1234.ts.net.',
+    serverPort: 42000,
+    targets: [{ listen: 43001, target: 8188 }, { listen: 43000, target: 7860 }, { listen: 43000, target: 9999 }, { listen: 443, target: 1 }, { listen: 'nope', target: 1 }, { listen: 43002, target: 70000 }],
+  })
+  assert.deepEqual(Object.keys(config.TCP), ['443', '43000', '43001'])
+  assert.equal(config.TCP['43000'].HTTPS, true)
+  assert.equal(config.Web['pinokio.tail1234.ts.net:443'].Handlers['/'].Proxy, 'http://127.0.0.1:42000')
+  assert.equal(config.Web['pinokio.tail1234.ts.net:43000'].Handlers['/'].Proxy, 'http://127.0.0.1:7860')
+  assert.equal(config.Web['pinokio.tail1234.ts.net:43001'].Handlers['/'].Proxy, 'http://127.0.0.1:8188')
+  assert.equal(config.AllowFunnel, undefined, 'serve-only: never emits funnel entries')
+
+  const described = describeServeConfig(config, 'pinokio.tail1234.ts.net', { 43000: 'comfy' })
+  assert.deepEqual(described.map((d) => [d.url, d.local, d.name]), [
+    ['https://pinokio.tail1234.ts.net', 42000, null],
+    ['https://pinokio.tail1234.ts.net:43000', 7860, 'comfy'],
+    ['https://pinokio.tail1234.ts.net:43001', 8188, null],
+  ])
+  const same = buildServeConfig({ dnsName: 'pinokio.tail1234.ts.net', serverPort: 42000, targets: [{ listen: 43000, target: 7860 }, { listen: 43001, target: 8188 }] })
+  assert.equal(sameServeConfig(config, same), true, 'order of targets does not matter')
+  const relaunched = buildServeConfig({ dnsName: 'pinokio.tail1234.ts.net', serverPort: 42000, targets: [{ listen: 43000, target: 7861 }, { listen: 43001, target: 8188 }] })
+  assert.equal(sameServeConfig(config, relaunched), false, 'a new local port changes the mapping but not the address')
+  assert.equal(describeServeConfig(relaunched, 'pinokio.tail1234.ts.net')[1].url, 'https://pinokio.tail1234.ts.net:43000')
+})
+
+test('stable ports are allocated once, lowest free first, and never move', () => {
+  let r = assignPorts({}, ['comfy', 'forge'])
+  assert.deepEqual(r.map, { comfy: 43000, forge: 43001 })
+  assert.equal(r.changed, true)
+  r = assignPorts(r.map, ['forge', 'webui'])
+  assert.deepEqual(r.map, { comfy: 43000, forge: 43001, webui: 43002 })
+  r = assignPorts(r.map, ['forge'])
+  assert.equal(r.changed, false, 'known apps need no write')
+  assert.equal(assignPorts({ a: 43000, b: 43002 }, ['c']).map.c, 43001, 'gaps are reused')
+})
+
+test('anywhere preset requires tailscaled but not caddy', () => {
+  const preset = Setup.anywhere({})
+  const names = preset.requirements.map((r) => r.name)
+  assert.ok(names.includes('tailscaled'))
+  assert.ok(!names.includes('caddy'))
+  assert.ok(preset.conda_requirements.includes('tailscaled'))
+  assert.ok(!preset.conda_requirements.includes('caddy'))
+})
+
+test('tailscaled bin module pins 1.104.1 and checks the installed version', async () => {
+  const mod = new Tailscaled()
+  assert.equal(mod.cmd(), 'tailscaled=1.104.1')
+  mod.kernel = {
+    platform: 'darwin',
+    bin: {
+      installed: { conda: new Set(['tailscaled']), conda_versions: { tailscaled: '1.104.1' } },
+      path: (...segments) => segments.join('/'),
+    },
+  }
+  assert.equal(await mod.installed(), true)
+  assert.equal(mod.binPath(), 'miniforge/bin/tailscaled')
+  mod.kernel.bin.installed.conda_versions.tailscaled = '1.98.5'
+  assert.equal(await mod.installed(), false, 'older than 1.104 (no --windows-mode=dev) is not accepted')
+  mod.kernel.bin.installed.conda = new Set()
+  assert.equal(await mod.installed(), false)
+  mod.kernel.platform = 'win32'
+  assert.equal(mod.binPath(), 'miniforge/Library/bin/tailscaled.exe')
+})
+
+function withMockDaemon(handler, fn) {
+  const socketPath = path.join(os.tmpdir(), `pk-ts-test-${process.pid}-${Date.now()}.sock`)
+  const server = http.createServer(handler)
+  return new Promise((resolve, reject) => {
+    server.listen(socketPath, async () => {
+      try {
+        resolve(await fn(socketPath))
+      } catch (e) {
+        reject(e)
+      } finally {
+        server.close()
+        fs.rmSync(socketPath, { force: true })
+      }
+    })
+  })
+}
+
+test('LocalAPI client talks plain HTTP over the socket with the Sec-Tailscale header', { skip: process.platform === 'win32' }, async () => {
+  const seen = []
+  await withMockDaemon((req, res) => {
+    let body = ''
+    req.on('data', (c) => body += c)
+    req.on('end', () => {
+      seen.push({ method: req.method, url: req.url, sec: req.headers['sec-tailscale'], ifMatch: req.headers['if-match'], body })
+      if (req.url === '/localapi/v0/status') {
+        res.setHeader('Content-Type', 'application/json')
+        res.end(JSON.stringify({ BackendState: 'Running', Self: { DNSName: 'pinokio.tail1.ts.net.' } }))
+      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'GET') {
+        res.setHeader('Etag', 'abc')
+        res.end('null')
+      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'POST') {
+        res.statusCode = 200
+        res.end()
+      } else if (req.url === '/localapi/v0/login-interactive') {
+        res.statusCode = 204
+        res.end()
+      } else {
+        res.statusCode = 404
+        res.end('nope')
+      }
+    })
+  }, async (socketPath) => {
+    const api = new LocalAPI({ socketPath })
+    const status = await api.status()
+    assert.equal(status.BackendState, 'Running')
+    const { etag } = await api.serveConfig()
+    assert.equal(etag, 'abc')
+    await api.setServeConfig({ TCP: {} }, etag)
+    await api.loginInteractive()
+    await assert.rejects(() => api.expect('GET', '/missing'), /404/)
+  })
+  const post = seen.find((s) => s.method === 'POST' && s.url === '/localapi/v0/serve-config')
+  assert.equal(post.sec, 'localapi')
+  assert.equal(post.ifMatch, 'abc')
+  assert.equal(post.body, JSON.stringify({ TCP: {} }))
+})
+
+function fakeKernel(tmp, { installed = true } = {}) {
+  return {
+    platform: 'darwin',
+    homedir: tmp,
+    server_port: 42000,
+    path: (...segments) => path.join(tmp, ...segments),
+    processes: {},
+    memory: { local: {} },
+    bin: {
+      path: (...segments) => path.join(tmp, 'bin', ...segments),
+      mod: { tailscaled: { installed: async () => installed, binPath: () => path.join(tmp, 'bin', 'tailscaled') } },
+    },
+  }
+}
+
+test('anywhere snapshot walks setup -> off -> login -> https -> ready', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp, { installed: false })
+    const anywhere = new Anywhere(kernel)
+    assert.equal((await anywhere.snapshot()).phase, 'setup')
+
+    kernel.bin.mod.tailscaled.installed = async () => true
+    assert.equal((await anywhere.snapshot()).phase, 'off')
+
+    await anywhere.saveConfig({ enabled: true })
+    assert.equal(await anywhere.configured(), true)
+    assert.equal(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'config.json'), 'utf8')).enabled, true)
+
+    // stub the daemon
+    let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, Peer: null, User: null }
+    let loginRequests = 0
+    let pushed = null
+    anywhere.pid = 123
+    anywhere.api = {
+      status: async () => status,
+      loginInteractive: async () => { loginRequests += 1 },
+      queryFeature: async () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' }),
+      serveConfig: async () => ({ config: null, etag: 'e1' }),
+      setServeConfig: async (config) => { pushed = config },
+    }
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'login')
+    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/abc')
+    assert.equal(loginRequests, 0, 'uses the AuthURL the daemon already has')
+
+    anywhere.lastStatusAt = 0
+    status = { BackendState: 'NeedsLogin', AuthURL: '', Self: {}, Peer: null, User: null }
+    snap = await anywhere.snapshot()
+    assert.equal(loginRequests, 1, 'asks the daemon for a login URL when it has none')
+
+    anywhere.lastStatusAt = 0
+    status = {
+      BackendState: 'Running',
+      Version: '1.104.1',
+      TailscaleIPs: ['100.1.2.3'],
+      CertDomains: null,
+      Self: { DNSName: 'pinokio.tail1.ts.net.', UserID: 7, KeyExpiry: '2027-04-20T04:33:03Z' },
+      User: { '7': { LoginName: 'me@example.com', DisplayName: 'Me' } },
+      Peer: { a: { HostName: 'iphone', OS: 'iOS', Online: true, DNSName: 'iphone.tail1.ts.net.', TailscaleIPs: ['100.1.2.4'], LastSeen: '0001-01-01T00:00:00Z' } },
+      CurrentTailnet: { Name: 'me@example.com', MagicDNSSuffix: 'tail1.ts.net', MagicDNSEnabled: true },
+    }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'https')
+    assert.equal(snap.approval.url, 'https://login.tailscale.com/f/serve?node=1')
+    assert.equal(snap.address, 'https://pinokio.tail1.ts.net')
+
+    anywhere.lastStatusAt = 0
+    anywhere.featureAt = 0
+    status.CertDomains = ['pinokio.tail1.ts.net']
+    kernel.memory.local = { [path.join(tmp, 'api', 'comfy', 'start.json')]: { url: 'http://localhost:7860', other: 'not a url' } }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'ready')
+    assert.equal(snap.account.email, 'me@example.com')
+    assert.equal(snap.keyExpiry, '2027-04-20T04:33:03Z')
+    assert.equal(snap.mobilePeerPresent, true)
+    assert.equal(snap.mobilePeerOnline, true)
+    assert.equal(snap.connectUrl, 'https://pinokio.co/anywhere/connect#u=https%3A%2F%2Fpinokio.tail1.ts.net&a=me%40example.com')
+    assert.deepEqual(snap.serve.map((s) => [s.url, s.local, s.name]), [['https://pinokio.tail1.ts.net', 42000, null], ['https://pinokio.tail1.ts.net:43000', 7860, 'comfy']])
+    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'ports.json'), 'utf8')), { comfy: 43000 }, 'stable port persisted')
+
+    // menu links are rewritten only for requests addressed to the node itself
+    const menu = () => [
+      { href: 'http://localhost:7860/?x=1#t', src: 'http://localhost:7860/?x=1#t', target_full: 'http://localhost:7860/?x=1#t', menu: [{ href: 'http://127.0.0.1:42000/home' }] },
+      { href: 'http://localhost:9999/' },
+      { href: '/files/api/comfy' },
+      { href: 'https://example.com:7860/' },
+    ]
+    for (const host of ['localhost:42000', '192.168.1.5:42000', 'pinokio.p5.localhost', undefined]) {
+      assert.deepEqual(await anywhere.rewriteMenu(host, menu()), menu(), `untouched for host ${host}`)
+    }
+    for (const host of ['pinokio.tail1.ts.net', 'PINOKIO.TAIL1.TS.NET:443']) {
+      const rewritten = await anywhere.rewriteMenu(host, menu())
+      assert.equal(rewritten[0].href, 'https://pinokio.tail1.ts.net:43000/?x=1#t')
+      assert.equal(rewritten[0].src, 'https://pinokio.tail1.ts.net:43000/?x=1#t')
+      assert.equal(rewritten[0].target_full, 'https://pinokio.tail1.ts.net:43000/?x=1#t', 'the popout target follows the href')
+      assert.equal(rewritten[0].menu[0].href, 'https://pinokio.tail1.ts.net/home', 'pinokiod itself maps to the bare address')
+      assert.equal(rewritten[1].href, 'http://localhost:9999/', 'unpublished ports are left alone')
+      assert.equal(rewritten[2].href, '/files/api/comfy')
+      assert.equal(rewritten[3].href, 'https://example.com:7860/')
+    }
+    // sync pushes once, then only on changes
+    assert.equal(await anywhere.sync(), true)
+    assert.deepEqual(Object.keys(pushed.TCP), ['443', '43000'])
+    pushed = null
+    assert.equal(await anywhere.sync(), false)
+    assert.equal(pushed, null)
+
+    // an app that just published its URL gets its stable port at render time
+    // and its route is pushed right away, without waiting for the next sync tick
+    kernel.memory.local[path.join(tmp, 'api', 'forge', 'start.json')] = { url: 'http://127.0.0.1:8188' }
+    const fresh = await anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: 'http://127.0.0.1:8188/' }])
+    assert.equal(fresh[0].href, 'https://pinokio.tail1.ts.net:43001/')
+    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'ports.json'), 'utf8')), { comfy: 43000, forge: 43001 })
+    await anywhere.syncing
+    assert.deepEqual(Object.keys(pushed.TCP), ['443', '43000', '43001'], 'route pushed at render time')
+    pushed = null
+    assert.equal(await anywhere.sync(), false)
+    kernel.memory.local = {}
+    assert.equal(await anywhere.sync(), true, 'stopped app removes its entry')
+    assert.deepEqual(Object.keys(pushed.TCP), ['443'])
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('anywhere uses dev mode flags on windows and a short socket path on long homes', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp)
+    kernel.platform = 'win32'
+    const win = new Anywhere(kernel)
+    assert.ok(win.daemonArgs().includes('--windows-mode=dev'))
+    assert.ok(win.daemonArgs().includes('--tun=userspace-networking'))
+    assert.equal(win.socketPath(), '\\\\.\\pipe\\pinokio-tailscaled')
+
+    const longHome = path.join(tmp, 'x'.repeat(120))
+    const deep = new Anywhere(fakeKernel(longHome))
+    assert.ok(Buffer.byteLength(deep.socketPath()) <= 100, deep.socketPath())
+    assert.ok(deep.socketPath().startsWith(os.tmpdir()))
+    const shallow = new Anywhere(fakeKernel('/Users/me/pinokio'))
+    assert.equal(shallow.socketPath(), '/Users/me/pinokio/anywhere/tailscaled/tailscaled.sock')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('while Anywhere is off, sync and the menu rewrite are no-ops and never touch the daemon', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    anywhere.api = new Proxy({}, { get() { throw new Error('LocalAPI must not be called while Anywhere is off') } })
+    assert.equal(await anywhere.sync(), false)
+    await anywhere.loadConfig()
+    assert.equal(await anywhere.sync(), false)
+    const menu = [{ href: 'http://localhost:7860/' }, { href: 'http://127.0.0.1:42000/home' }]
+    assert.deepEqual(await anywhere.rewriteMenu('pinokio.tail1.ts.net', JSON.parse(JSON.stringify(menu))), menu)
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('serve targets follow the Home Server router rules for an app\'s URL variables', () => {
+  const tmp = path.join(os.tmpdir(), 'pk-home')
+  const kernel = fakeKernel(tmp)
+  kernel.router = {
+    localhost_variable_router: {
+      domain(name, key) {
+        if (name === 'comfy') return key === 'url' ? '@' : (key === 'api_url' ? 'api' : undefined)
+        throw new Error('no pinokio config for ' + name)   // what Processor.domain does for an unknown app
+      },
+    },
+  }
+  kernel.memory.local = {
+    [path.join(tmp, 'api', 'comfy', 'start.json')]: {
+      url: 'http://localhost:7860',
+      api_url: 'http://127.0.0.1:7861',
+      other: 'http://localhost:7862',         // not dns-mapped
+      remote: 'http://192.168.1.9:7863',      // not loopback: cannot be proxied
+      noport: 'http://localhost',
+      count: 3,
+    },
+    [path.join(tmp, 'api', 'nocfg', 'start.json')]: { url: 'http://localhost:8000', other: 'http://localhost:8001' },
+    ['/elsewhere/start.json']: { url: 'http://localhost:9000' },   // outside ~/pinokio/api
+  }
+  const anywhere = new Anywhere(kernel)
+  assert.deepEqual(anywhere.appTargets(), [   // `url` first, then the other keys alphabetically
+    { key: 'comfy', name: 'comfy', local: 7860 },
+    { key: 'api.comfy', name: 'comfy', local: 7861 },
+    { key: 'nocfg', name: 'nocfg', local: 8000 },
+  ])
+})
+
+test('a failed https feature query keeps the page in starting instead of showing an approval', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.pid = 123
+    let feature = () => { throw new Error('503 no netmap') }
+    anywhere.api = {
+      status: async () => ({ BackendState: 'Running', CertDomains: null, Self: { DNSName: 'pinokio.tail1.ts.net.', UserID: 7 }, User: {}, Peer: null }),
+      queryFeature: async () => feature(),
+    }
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'starting')
+    assert.equal(snap.approval, null)
+    feature = () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' })
+    anywhere.lastStatusAt = 0
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'https')
+    assert.equal(snap.approval.url, 'https://login.tailscale.com/f/serve?node=1')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+// a stand-in daemon process we can safely signal
+function spawnIdle() {
+  const child = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], { stdio: 'ignore' })   // self-exits if a run is cut short
+  const exited = new Promise((resolve) => child.on('exit', () => resolve(true)))
+  return { child, exited: (ms = 3000) => Promise.race([exited, new Promise((resolve) => setTimeout(() => resolve(false), ms))]) }
+}
+
+test('adopting a daemon left by a previous run recovers its pid from the pid file', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  const idle = spawnIdle()
+  try {
+    const kernel = fakeKernel(tmp)
+    const anywhere = new Anywhere(kernel)
+    fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+    const dead = spawnIdle(); dead.child.kill('SIGKILL'); await dead.exited()
+    fs.writeFileSync(anywhere.pidPath(), String(dead.child.pid))
+    assert.equal(anywhere.readPid(), null, 'a pid that no longer exists is ignored')
+    fs.writeFileSync(anywhere.pidPath(), String(idle.child.pid))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.api = {
+      ping: async () => true,
+      patchPrefs: async () => ({}),
+      status: async () => ({ BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, User: null, Peer: null }),
+    }
+    await anywhere.start()
+    assert.equal(anywhere.pid, idle.child.pid)
+  } finally {
+    idle.child.kill('SIGKILL')
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+
+test('a daemon that cannot be spawned reports the cause at once instead of waiting 20 s', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp)
+    kernel.bin.mod.tailscaled.binPath = () => path.join(tmp, 'no-such-tailscaled')
+    const anywhere = new Anywhere(kernel)
+    await anywhere.saveConfig({ enabled: true })
+    const started = Date.now()
+    await assert.rejects(() => anywhere.start(), /failed to start/)
+    assert.ok(Date.now() - started < 5000, 'did not sit out the 20 s daemon timeout')
+    assert.equal((await anywhere.snapshot()).phase, 'error')
+    assert.equal(fs.existsSync(anywhere.pidPath()), false)
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('sign-out resets the login state, and a link the server rejected is replaced instead of shown', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.pid = 123
+    const calls = []
+    let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/dead', Self: {}, User: null, Peer: null,
+      Health: ['You are logged out. The last login error was: register request: http 410: auth path not found'] }
+    anywhere.api = {
+      status: async () => status,
+      logout: async () => { calls.push('logout') },
+      patchPrefs: async (p) => { calls.push('prefs:' + (p.LoggedOut === false ? 'login' : 'other')); return {} },
+      start: async () => { calls.push('start') },
+      loginInteractive: async () => { calls.push('login-interactive') },
+    }
+    await anywhere.logout()
+    assert.deepEqual(calls, ['logout', 'prefs:login', 'start'], 'sign-out: logout, then back to logged-in prefs, then reset')
+
+    calls.length = 0
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.loginUrl, null, 'the rejected link is not offered')
+    assert.equal(snap.phase, 'starting')
+    assert.deepEqual(calls, ['start', 'login-interactive'], 'a rejected link triggers a reset and a fresh request')
+
+    // after the reset the daemon keeps a stale "last login error: ... context canceled" line; that is not a rejection
+    anywhere.lastStatusAt = 0
+    calls.length = 0
+    status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/fresh', Self: {}, User: null, Peer: null,
+      Health: ['You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=148": context canceled'] }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/fresh', 'a fresh link is offered as is')
+    assert.equal(snap.phase, 'login')
+    assert.deepEqual(calls, [], 'no reset loop on a stale error line')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})