pinokiod 8.2.29 → 8.2.31

package/kernel/anywhere/forward.js

@@ -0,0 +1,162 @@
+/*
+  Forwarders for Remote from computer to computer
+  (spec/requirements/pinokio-anywhere.md, Other Pinokios; the routes in
+  spec/requirements/pinokio-anywhere-api.md, Peers).
+
+  The bundled tailscaled runs in userspace networking mode, so the browser on
+  this computer has no route to tailnet addresses. The daemon does, and
+  exposes it as a plain HTTP proxy on loopback (--outbound-http-proxy-listen).
+  A forwarder is one loopback port that relays HTTP requests and upgrades
+  through that proxy, with TLS to one peer's .ts.net name on one remote port.
+  The peer sees an ordinary tailnet client; the browser talks plain HTTP to
+  127.0.0.1, as it does to Pinokio itself.
+
+  Every forwarder answers /.pinokio/open itself, never relaying it: a peer on
+  this revision rewrites the links inside its interface to that path, and the
+  redirect lands on this node's `open` route, which maps the port on demand.
+*/
+const http = require('http')
+const https = require('https')
+const httpProxy = require('http-proxy')
+const { ProxyAgent } = require('proxy-agent')
+const { OPEN_PATH } = require('./serve')
+
+const FORWARDED_HEADER = 'x-pinokio-forwarded'
+// honoured by the peer middleware's trust; a forwarder never sends them
+const STRIPPED_HEADERS = ['x-pinokio-peer', 'x-pinokio-source-host', 'x-pinokio-source-proto']
+
+// This node's `open` route for a peer and port, relative for the page's links.
+function openPath(label, port, to) {
+  return `/anywhere/peers/${encodeURIComponent(label)}/open?port=${Number(port)}&to=${encodeURIComponent(to || '/')}`
+}
+
+class Forwarders {
+  // proxyUrl: () => 'http://127.0.0.1:<port>' or null while the daemon is down
+  // serverPort: () => pinokiod's own port
+  // scheme exists for the tests, which forward to a plain local server instead of
+  // TLS through the proxy; the product never passes it.
+  constructor({ proxyUrl, serverPort, scheme = 'https' } = {}) {
+    this.proxyUrl = proxyUrl
+    this.serverPort = serverPort
+    this.scheme = scheme
+    this.agents = new Map()          // proxy URL -> agent, one per daemon start
+    this.servers = new Map()         // "<dnsName>:<port>" -> { port, server, proxy, sockets } or { pending }
+  }
+  agent() {
+    const url = this.proxyUrl()
+    if (this.scheme === 'https' && !url) throw new Error('Remote is not running on this computer')
+    if (!url) return undefined
+    // proxy-agent picks CONNECT-then-TLS for an http:// proxy and an https target
+    if (!this.agents.has(url)) this.agents.set(url, new ProxyAgent({ keepAlive: true, getProxyForUrl: () => url }))
+    return this.agents.get(url)
+  }
+  // One request to a peer through the proxy, for the status probe and the launch/stop relay.
+  async request(url, options) {
+    return requestThroughProxy(this.agent(), url, options)
+  }
+  // Finds or starts the forwarder for (dnsName, port); resolves to its loopback port.
+  async open(dnsName, port) {
+    const key = `${String(dnsName).toLowerCase()}:${Number(port)}`
+    const existing = this.servers.get(key)
+    if (existing) return existing.port || (await existing.pending).port
+    const pending = this.start(dnsName, Number(port))
+    this.servers.set(key, { pending })
+    try {
+      const entry = await pending
+      this.servers.set(key, entry)
+      return entry.port
+    } catch (error) {
+      this.servers.delete(key)
+      throw error
+    }
+  }
+  async start(dnsName, port) {
+    const label = String(dnsName).split('.')[0]
+    const target = `${this.scheme}://${dnsName}:${port}`
+    const proxy = httpProxy.createProxyServer({ target, agent: this.agent(), changeOrigin: true, secure: true, ws: true })
+    proxy.on('proxyReq', (proxyReq) => { proxyReq.setHeader(FORWARDED_HEADER, '1') })
+    proxy.on('proxyReqWs', (proxyReq) => { proxyReq.setHeader(FORWARDED_HEADER, '1') })
+    proxy.on('error', (error, req, res) => {
+      const message = `Could not reach ${dnsName}: ${error && error.message ? error.message : error}`
+      if (res && typeof res.writeHead === 'function' && !res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' })
+        res.end(message)
+      } else if (res && typeof res.destroy === 'function') {
+        res.destroy()
+      }
+    })
+    const strip = (req) => { for (const name of STRIPPED_HEADERS) delete req.headers[name] }
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1')
+      if (url.pathname === OPEN_PATH) {
+        const port = Number(url.searchParams.get('port'))
+        if (!Number.isInteger(port) || port <= 0) {
+          res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+          res.end('Not a Remote port')
+          return
+        }
+        const route = openPath(label, port, url.searchParams.get('to') || '/')
+        res.writeHead(302, { Location: `http://127.0.0.1:${this.serverPort()}${route}`, 'Cache-Control': 'no-store' })
+        res.end()
+        return
+      }
+      strip(req)
+      proxy.web(req, res)
+    })
+    server.on('upgrade', (req, socket, head) => {
+      strip(req)
+      proxy.ws(req, socket, head)
+    })
+    // every connection on both sides, upgraded ones included, so stopAll can end a stream a
+    // tab still holds; destroying only the browser's side would leave the peer's side piped open
+    const sockets = new Set()
+    const track = (socket) => {
+      sockets.add(socket)
+      socket.once('close', () => sockets.delete(socket))
+    }
+    server.on('connection', track)
+    proxy.on('open', track)
+    await new Promise((resolve, reject) => {
+      server.once('error', reject)
+      server.listen(0, '127.0.0.1', () => { server.off('error', reject); resolve() })
+    })
+    return { port: server.address().port, server, proxy, sockets }
+  }
+  // Ends every forwarder, open streams included: they belong to the daemon that is going away.
+  async stopAll() {
+    const entries = [...this.servers.values()]
+    this.servers.clear()
+    for (const agent of this.agents.values()) if (typeof agent.destroy === 'function') agent.destroy()
+    this.agents.clear()
+    await Promise.all(entries.map(async (entry) => {
+      const live = entry.server ? entry : await entry.pending.catch(() => null)
+      if (!live) return
+      live.proxy.close()
+      for (const socket of live.sockets) socket.destroy()
+      await new Promise((resolve) => live.server.close(resolve))
+    }))
+  }
+}
+
+// Resolves { status, body }; rejects on a transport failure or when the whole
+// request, the proxy's CONNECT included, exceeds the deadline.
+function requestThroughProxy(agent, url, { method = 'GET', headers = {}, body = null, timeoutMs = 4000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const target = new URL(url)
+    const lib = target.protocol === 'https:' ? https : http
+    // the deadline is kept here, not as the request's signal: while the agent's CONNECT is still
+    // pending the request has no socket, and Node reports an abort only once it gets one
+    const deadline = setTimeout(() => { reject(new Error(`no answer in ${Math.round(timeoutMs / 1000)} s`)); req.destroy() }, timeoutMs)
+    const req = lib.request(target, { method, headers, agent }, (res) => {
+      const chunks = []
+      res.on('data', (chunk) => chunks.push(chunk))
+      res.on('end', () => { clearTimeout(deadline); resolve({ status: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }) })
+      res.on('error', (error) => { clearTimeout(deadline); reject(error) })
+    })
+    req.on('error', (error) => { clearTimeout(deadline); reject(error) })
+    if (body != null) req.write(body)
+    req.end()
+  })
+}
+
+module.exports = { Forwarders, openPath, FORWARDED_HEADER }

package/kernel/anywhere/index.js

@@ -22,8 +22,10 @@ const crypto = require('crypto')
 const { spawn, execFile, execFileSync } = require('child_process')
 const TailscaleCLI = require('./cli')
 const writeJson = require('./state')
-const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS } = require('./serve')
+const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS } = require('./serve')
 const { loadPortMap, savePortMap, assignPorts } = require('./ports')
+const { Forwarders } = require('./forward')
+const net = require('net')
 const Util = require('../util')
 
 const DEFAULT_HOSTNAME = 'pinokio'
@@ -39,6 +41,10 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 class Anywhere {
   constructor(kernel) {
     this.kernel = kernel
+    // the daemon's outbound HTTP proxy, picked by pinokiod at each daemon start; null while down
+    this.proxyPort = null
+    this.ownedProxyPort = null     // the port on an adopted daemon's command line, set by ownedPid
+    this.forwarders = new Forwarders({ proxyUrl: () => this.proxyUrl(), serverPort: () => this.serverPort() })
     this.platform = kernel && kernel.platform ? kernel.platform : os.platform()
     this.child = null
     this.api = null
@@ -76,6 +82,9 @@ class Anywhere {
   pidPath() {
     return this.stateDir('tailscaled.pid')
   }
+  proxyUrl() {
+    return this.proxyPort ? `http://127.0.0.1:${this.proxyPort}` : null
+  }
   socketPath() {
     if (this._socketPath) return this._socketPath
     if (this.platform === 'win32') {
@@ -98,7 +107,8 @@ class Anywhere {
     }
     return null
   }
-  daemonArgs() {
+  // proxyPort: the outbound proxy's loopback port; null describes a daemon from before the proxy existed
+  daemonArgs(proxyPort = this.proxyPort) {
     const args = [
       '--tun=userspace-networking',
       '--state', this.stateDir('tailscaled.state'),
@@ -106,6 +116,7 @@ class Anywhere {
       '--socket', this.socketPath(),
       '--port', '0',
     ]
+    if (proxyPort) args.push(`--outbound-http-proxy-listen=127.0.0.1:${proxyPort}`)
     if (this.platform === 'win32') {
       // 1.104+: run as a per-user console process, no service / admin needed
       args.push('--windows-mode=dev')
@@ -215,7 +226,7 @@ class Anywhere {
     if (!this.config.enabled) return false
     if (!(await this.installed())) {
       if (automatic) return false
-      throw new Error('Install the matching Tailscale daemon and CLI through Anywhere setup.')
+      throw new Error('Install the matching Tailscale daemon and CLI through Remote setup.')
     }
     if (this.stopping) return false
     this.error = null
@@ -234,10 +245,17 @@ class Anywhere {
     const alive = await this.daemonAlive()
     if (this.stopping) return false
     if (alive && (!(await this.assertOwnership()) || this.stopping)) return false
+    // a daemon this process started keeps its port; an adopted one gives the port on its command
+    // line, none for a daemon from before the proxy existed, so forwarding waits for its next start
+    if (alive) this.proxyPort = this.child ? this.proxyPort : this.ownedProxyPort
     if (!alive) {
       const pid = await this.readPid()
       if (this.stopping) return false
       if (pid) throw new Error('tailscaled is still running but its private endpoint is unavailable; no second daemon was started.')
+      // forwarders of a daemon that died relay to its proxy port; a new daemon gets new ones
+      await this.forwarders.stopAll()
+      // a free port now; the daemon fails to start if something takes it first, and Try again picks another
+      this.proxyPort = await freeLoopbackPort()
       const logFd = fs.openSync(this.logPath(), 'a')
       const env = Object.assign({}, process.env, {
         TS_LOGS_DIR: this.stateDir(),
@@ -255,6 +273,7 @@ class Anywhere {
         if (this.child === child) {
           // not a stop() of ours: surface it, the page offers "Try again"
           this.child = null
+          this.proxyPort = null   // its proxy went with it; the next start replaces the forwarders
           if (!this.stopping && !this.error) this.error = `tailscaled exited (code=${code} signal=${signal})`
           try { fs.rmSync(this.pidPath(), { force: true }) }
           catch (error) { this.error = `Could not remove tailscaled PID record: ${error.message}` }
@@ -325,12 +344,18 @@ class Anywhere {
   }
   ownedPid(inspection, command) {
     command = command.trim()
-    let expected = [this.binPath(), ...this.daemonArgs()].join(' ')
+    // the proxy port is whatever the running daemon was given; a daemon from before the
+    // proxy existed has none and is still ours. A match records the port for adoption.
+    const match = command.match(/--outbound-http-proxy-listen=127\.0\.0\.1:(\d+)/i)
+    const port = match ? Number(match[1]) : null
+    let expected = [this.binPath(), ...this.daemonArgs(port)].join(' ')
     if (this.platform === 'win32') {
       command = command.replace(/"/g, '').toLowerCase()
       expected = expected.toLowerCase()
     }
-    return command === expected ? inspection.pid : null
+    if (command !== expected) return null
+    this.ownedProxyPort = port
+    return inspection.pid
   }
   async readPid() {
     const inspection = this.pidInspection()
@@ -372,6 +397,8 @@ class Anywhere {
     this.child = null
     this.login = null
     this.api = null
+    this.proxyPort = null
+    await this.forwarders.stopAll()
     fs.rmSync(this.pidPath(), { force: true })
     this.lastStatus = null
     this.lastStatusAt = 0
@@ -518,6 +545,7 @@ class Anywhere {
       const generic = !hostName || /^(localhost|iphone|ipad|android)$/i.test(hostName)
       peers.push({
         name: (generic && dnsLabel) ? dnsLabel : (hostName || dnsLabel || key),
+        dnsName: p.DNSName ? String(p.DNSName).replace(/\.$/, '') : null,
         os: osName,
         mobile: MOBILE_OS.has(osName.toLowerCase()),
         online: !!p.Online,
@@ -613,15 +641,24 @@ class Anywhere {
     if (!dnsName || !this.config || !this.config.enabled) return false
     return String(host || '').toLowerCase().replace(/:443$/, '') === dnsName.toLowerCase()
   }
+  // A peer from `status --json` by the first label of its DNS name, the key
+  // of the peer routes; null for a name that is not a peer.
+  peerFor(label) {
+    if (!this.lastStatus || typeof label !== 'string') return null
+    const wanted = label.toLowerCase()
+    return this.peersFrom(this.lastStatus).find((p) => p.dnsName && p.dnsName.split('.')[0].toLowerCase() === wanted) || null
+  }
   // Rewrites one menu link for a visitor arriving through the Tailscale
   // address. Only a loopback link with a port is touched, and only when the
   // request's Host header is this node's name; any other request gets the
-  // href back unchanged.
-  rewriteHref(host, href) {
+  // href back unchanged. A visitor forwarded by another Pinokio gets the
+  // relative path its forwarder answers instead of this node's address.
+  rewriteHref(host, href, forwarded = false) {
     if (!this.isNodeHost(host)) return href
-    return rewriteHref(href, describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus)))
+    const routes = describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus))
+    return forwarded ? rewriteHrefForwarded(href, routes) : rewriteHref(href, routes)
   }
-  async rewriteMenu(host, menu) {
+  async rewriteMenu(host, menu, forwarded = false) {
     if (!Array.isArray(menu) || !this.isNodeHost(host)) return menu
     // Confirm new or changed routes on first render; refresh checks unchanged ones.
     const apps = this.appTargets()
@@ -634,7 +671,7 @@ class Anywhere {
       for (const item of items) {
         if (!item || typeof item !== 'object') continue
         if (typeof item.href === 'string') {
-          const next = this.rewriteHref(host, item.href)
+          const next = this.rewriteHref(host, item.href, forwarded)
           if (next !== item.href) {
             if (item.src === item.href) item.src = next
             if (item.target_full === item.href) item.target_full = next
@@ -742,7 +779,7 @@ class Anywhere {
     const dnsName = this.dnsNameFrom(status)
     const address = dnsName ? `https://${dnsName}` : null
     const account = this.accountFrom(status)
-    const peers = this.peersFrom(status)
+    const peers = this.peersFrom(status).map(({ dnsName, ...peer }) => peer)   // DNS names serve the peer routes, not the payload
     const out = Object.assign(base, {
       running: true,
       version: status.Version,
@@ -809,4 +846,16 @@ class Anywhere {
 }
 
 
+// A loopback port nothing is listening on right now, for the daemon's proxy.
+function freeLoopbackPort() {
+  return new Promise((resolve, reject) => {
+    const probe = net.createServer()
+    probe.once('error', reject)
+    probe.listen(0, '127.0.0.1', () => {
+      const { port } = probe.address()
+      probe.close(() => resolve(port))
+    })
+  })
+}
+
 module.exports = Anywhere

package/kernel/anywhere/ports.js

@@ -37,7 +37,7 @@ function assignPorts(map, keys) {
   for (const key of keys) {
     if (Number.isInteger(out[key])) continue
     while (used.has(next)) next += 1
-    if (next > LAST_PORT) throw new Error('Pinokio Anywhere has no free remote ports left')
+    if (next > LAST_PORT) throw new Error('Remote has no free remote ports left')
     out[key] = next
     used.add(next)
     changed = true

package/kernel/anywhere/serve.js

@@ -94,12 +94,28 @@ function sameServeConfig(a, b) {
   return isDeepStrictEqual(a || null, b || null)
 }
 
-function rewriteHref(href, routes) {
+// the path every forwarder answers itself (spec/requirements/pinokio-anywhere-api.md, Peers)
+const OPEN_PATH = '/.pinokio/open'
+
+// A loopback link with a port that a Serve route carries: its route and the
+// link's path, query and fragment; null for any other link.
+function routedLink(href, routes) {
   let url
-  try { url = new URL(String(href)) } catch (_) { return href }
-  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
+  try { url = new URL(String(href)) } catch (_) { return null }
+  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return null
   const route = routes.find((entry) => entry.local === Number(url.port))
-  return route ? route.url + url.pathname + url.search + url.hash : href
+  return route ? { route, path: url.pathname + url.search + url.hash } : null
+}
+function rewriteHref(href, routes) {
+  const link = routedLink(href, routes)
+  return link ? link.route.url + link.path : href
+}
+// The same link for a visitor arriving through another Pinokio's forwarder: the
+// published port and the path on the relative path the forwarder answers, so
+// the caller maps the port on demand.
+function rewriteHrefForwarded(href, routes) {
+  const link = routedLink(href, routes)
+  return link ? `${OPEN_PATH}?port=${link.route.port}&to=${encodeURIComponent(link.path)}` : href
 }
 
-module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT }
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT, OPEN_PATH }

package/kernel/bin/conda.js

@@ -274,7 +274,7 @@ report_errors: false`)
     }
 
     if (this.kernel.anywhere) {
-      ondata({ raw: `stopping Pinokio Anywhere before replacing Miniforge...\r\n` })
+      ondata({ raw: `stopping Remote before replacing Miniforge...\r\n` })
       await this.kernel.anywhere.stop()
     }
 

package/kernel/bin/setup.js

@@ -275,7 +275,7 @@ module.exports = {
     ]
     return {
       icon: "fa-solid fa-mobile-screen",
-      title: "Pinokio Anywhere",
+      title: "Remote",
       description: "Reach this Pinokio and its apps from your phone or another computer over a private Tailscale network",
       requirements,
       conda_requirements: [

package/kernel/bin/tailscaled.js

@@ -7,7 +7,7 @@ const run = promisify(execFile)
 const VERSION = '1.104.1'
 
 class Tailscaled {
-  description = "Installs the Tailscale daemon for Pinokio Anywhere: reach this Pinokio and its apps from your phone or another computer over a private network."
+  description = "Installs the Tailscale daemon for Remote: reach this Pinokio and its apps from your phone or another computer over a private network."
   cmd() {
     return `tailscaled=${VERSION} tailscale=${VERSION}`
   }
@@ -67,7 +67,7 @@ class Tailscaled {
     })
   }
   async uninstall(req, ondata) {
-    ondata({ raw: "stopping Pinokio Anywhere\r\n" })
+    ondata({ raw: "stopping Remote\r\n" })
     if (this.kernel.anywhere && typeof this.kernel.anywhere.stop === "function") {
       await this.kernel.anywhere.stop()
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.29",
+  "version": "8.2.31",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -35,6 +35,8 @@ const TerminalApi = require('../kernel/api/terminal')
 const PluginSources = require("../kernel/plugin_sources")
 const ManagedSkills = require("../kernel/managed_skills")
 const { rewriteHref: rewriteAnywhereHref, LOOPBACK_HOSTS: ANYWHERE_LOOPBACK_HOSTS } = require("../kernel/anywhere/serve")
+const { openPath: anywhereOpenPath, FORWARDED_HEADER: ANYWHERE_FORWARDED_HEADER } = require("../kernel/anywhere/forward")
+const { FIRST_PORT: ANYWHERE_FIRST_PORT, LAST_PORT: ANYWHERE_LAST_PORT } = require("../kernel/anywhere/ports")
 const { menuTargets: launcherMenuTargets, isWebUrl } = require("../kernel/api/launcher_target")
 const { isPathRemovalBlockedError, removePath } = require("../kernel/path_removal")
 
@@ -1049,6 +1051,117 @@ class Server {
     const dnsName = anywhere && typeof anywhere.dnsNameFrom === "function" ? anywhere.dnsNameFrom(anywhere.lastStatus) : null
     return !!dnsName && parsed.protocol === "https:" && host === dnsName.toLowerCase()
   }
+  // a Host header on this computer itself (localhost, 127.0.0.1, [::1], with or without a port)
+  isLoopbackHost(host) {
+    const name = String(host || "").toLowerCase().replace(/:\d+$/, "")
+    return name === "localhost" || name === "127.0.0.1" || name === "[::1]"
+  }
+  // A request from a browser on this computer, as opposed to one that came through Tailscale
+  // Serve or another Pinokio: those also arrive on loopback, and a tailnet client chooses its
+  // own Host, but it cannot strip the headers Serve adds on the way or the peer marker.
+  isLocalRequest(req) {
+    const socket = req.socket && req.socket.remoteAddress
+    const loopback = socket === "127.0.0.1" || socket === "::1" || socket === "::ffff:127.0.0.1"
+    return loopback && this.isLoopbackHost(req.get("host")) && !req.get("X-Forwarded-For") && !req.get("X-Pinokio-Peer")
+  }
+  // the peer routes act on this computer's behalf: served on this computer only, to its own
+  // page only. Their redirects end on 127.0.0.1, which mean nothing anywhere else.
+  anywherePeerAllowed(req) {
+    if (!this.isLocalRequest(req)) return false
+    const origin = req.get("Origin")
+    if (!origin) return true
+    try { return new URL(origin).host.toLowerCase() === String(req.get("host")).toLowerCase() } catch (_) { return false }
+  }
+  // the reason the peer routes cannot work right now, or null
+  anywherePeerUnavailable() {
+    const anywhere = this.kernel.anywhere
+    if (anywhere.proxyUrl()) return null
+    return anywhere.lastStatus && !anywhere.error ? "Turn Remote off and on to reach your other Pinokios" : "Remote is not running on this computer"
+  }
+  // Remote from computer to computer (spec/requirements/pinokio-anywhere-api.md, Peers):
+  // the other Pinokios on the tailnet, found by asking each online computer for its status
+  // through the daemon's proxy, their running apps linked through this node's forwarders.
+  async composeAnywherePeers() {
+    const anywhere = this.kernel.anywhere
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    const candidates = anywhere.peersFrom(anywhere.lastStatus).filter((peer) => peer.online && !peer.mobile && peer.dnsName)
+    const probes = await Promise.allSettled(candidates.map(async (peer) => {
+      const answer = await anywhere.forwarders.request(`https://${peer.dnsName}/anywhere/status`, { timeoutMs: 4000 })
+      if (answer.status !== 200) return null
+      let status
+      try { status = JSON.parse(answer.body) } catch (_) { return null }
+      if (!status || typeof status.phase !== "string") return null
+      const label = peer.dnsName.split(".")[0]
+      const apps = Array.isArray(status.apps) ? status.apps : []
+      return {
+        name: label,
+        apps: apps.map((app) => {
+          const { remote, ...rest } = app
+          return Object.assign(rest, { open: this.anywherePeerOpenPath(label, remote) })
+        }),
+      }
+    }))
+    return { status: 200, body: { peers: probes.map((probe) => probe.status === "fulfilled" ? probe.value : null).filter(Boolean) } }
+  }
+  // this node's open route for a peer's published address, or null for no address
+  anywherePeerOpenPath(label, remote) {
+    if (typeof remote !== "string") return null
+    let url
+    try { url = new URL(remote) } catch (_) { return null }
+    return anywhereOpenPath(label, url.port ? Number(url.port) : 443, url.pathname + url.search + url.hash)
+  }
+  // GET /anywhere/peers/<name>/open?port=<n>&to=<path>: { status, headers } or { status, body }
+  async anywherePeerOpen(name, query = {}) {
+    const anywhere = this.kernel.anywhere
+    const peer = anywhere.peerFor(name)
+    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
+    const port = Number(query.port)
+    if (!(port === 443 || (Number.isInteger(port) && port >= ANYWHERE_FIRST_PORT && port <= ANYWHERE_LAST_PORT))) {
+      return { status: 400, body: { error: `Not a Remote port: ${query.port}` } }
+    }
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    let local
+    try {
+      local = await anywhere.forwarders.open(peer.dnsName, port)
+    } catch (error) {
+      return { status: 500, body: { error: error && error.message ? error.message : String(error) } }
+    }
+    // `to` resolved against the forwarder: encoded for the header, and never another origin
+    const base = `http://127.0.0.1:${local}/`
+    let location
+    try { location = new URL(typeof query.to === "string" ? query.to : "/", base) } catch (_) { location = new URL(base) }
+    if (location.origin !== new URL(base).origin) location = new URL(base)
+    return { status: 302, headers: { Location: location.href, "Cache-Control": "no-store" } }
+  }
+  // POST /anywhere/peers/<name>/apps/<launch|stop>: the peer's answer, an open URL turned into this node's open route
+  async relayAnywherePeerAction(name, action, body = {}) {
+    const anywhere = this.kernel.anywhere
+    const peer = anywhere.peerFor(name)
+    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    let answer
+    try {
+      answer = await anywhere.forwarders.request(`https://${peer.dnsName}/anywhere/apps/${action}`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body || {}), timeoutMs: 30000,
+      })
+    } catch (error) {
+      return { status: 502, body: { error: `Could not reach ${peer.name}: ${error && error.message ? error.message : error}` } }
+    }
+    let parsed
+    try { parsed = JSON.parse(answer.body) } catch (_) {
+      return { status: 502, body: { error: `${peer.name} did not answer with JSON (HTTP ${answer.status})` } }
+    }
+    // only the peer's own published address becomes this node's open route; any other URL passes through
+    if (parsed && parsed.action === "open" && typeof parsed.url === "string") {
+      let host = null
+      try { host = new URL(parsed.url).hostname.toLowerCase() } catch (_) { }
+      if (host === peer.dnsName.toLowerCase()) parsed.url = this.anywherePeerOpenPath(peer.dnsName.split(".")[0], parsed.url)
+    }
+    return { status: answer.status, body: parsed }
+  }
   // the app's menu as launch targets: scripts and web addresses, never interface links;
   // text is plain: a launcher may write HTML, which the desktop renders and the phone does not
   async anywhereMenu(api, repoPath) {
@@ -5076,7 +5189,8 @@ class Server {
       // published app's fixed https address; any other host is left for the
       // Home Server rewrite below, exactly as before.
       if (this.kernel.anywhere) {
-        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu)
+        // a visitor forwarded by another Pinokio gets links its forwarder answers (API spec, Peers)
+        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu, req.get(ANYWHERE_FORWARDED_HEADER) === "1")
       }
       config = Util.rewrite_localhost(this.kernel, config, req.$source)
       return config
@@ -14360,6 +14474,8 @@ class Server {
         status,
         theme: this.theme,
         agent: req.agent,
+        // Your other Pinokios links end on 127.0.0.1, which mean nothing to a phone reading this page
+        loopback: this.isLocalRequest(req),
       })
     }))
     this.app.get("/anywhere/status", ex(async (req, res) => {
@@ -14386,10 +14502,30 @@ class Server {
     })
     this.app.post("/anywhere/apps/launch", anywhereAppAction((body) => this.composeAnywhereLaunch(body)))
     this.app.post("/anywhere/apps/stop", anywhereAppAction((body) => this.composeAnywhereStop(body)))
+    // the other Pinokios on the tailnet, for this computer's own Remote page (API spec, Peers)
+    const anywherePeerRoute = (fn) => ex(async (req, res) => {
+      res.set("Cache-Control", "no-store")
+      if (!this.anywherePeerAllowed(req)) {
+        res.status(403).json({ error: "Allowed only on this computer" })
+        return
+      }
+      try {
+        const answer = await fn(req)
+        if (answer.headers) res.set(answer.headers)
+        if (answer.body === undefined) res.status(answer.status).end()
+        else res.status(answer.status).json(answer.body)
+      } catch (error) {
+        res.status(500).json({ error: error && error.message ? error.message : String(error) })
+      }
+    })
+    this.app.get("/anywhere/peers", anywherePeerRoute(() => this.composeAnywherePeers()))
+    this.app.get("/anywhere/peers/:name/open", anywherePeerRoute((req) => this.anywherePeerOpen(req.params.name, req.query)))
+    this.app.post("/anywhere/peers/:name/apps/launch", anywherePeerRoute((req) => this.relayAnywherePeerAction(req.params.name, "launch", req.body)))
+    this.app.post("/anywhere/peers/:name/apps/stop", anywherePeerRoute((req) => this.relayAnywherePeerAction(req.params.name, "stop", req.body)))
     const anywhereAction = (label, fn) => ex(async (req, res) => {
       const anywhere = this.kernel.anywhere
       if (!anywhere) {
-        res.status(500).json({ success: false, error: "Pinokio Anywhere is not available" })
+        res.status(500).json({ success: false, error: "Remote is not available" })
         return
       }
       try {