pinokiod 8.2.30 → 8.2.32

package/kernel/anywhere/forward.js

@@ -0,0 +1,166 @@
+/*
+  Forwarders for Remote from computer to computer
+  (spec/requirements/pinokio-anywhere.md, Other Pinokios; the routes in
+  spec/requirements/pinokio-anywhere-api.md, Peers).
+
+  The bundled tailscaled runs in userspace networking mode, so the browser on
+  this computer has no route to tailnet addresses. The daemon does, and
+  exposes it as a plain HTTP proxy on loopback (--outbound-http-proxy-listen).
+  A forwarder is one loopback port that relays HTTP requests and upgrades
+  through that proxy, with TLS to one peer's .ts.net name on one remote port.
+  The peer sees an ordinary tailnet client; the browser talks plain HTTP to
+  127.0.0.1, as it does to Pinokio itself.
+
+  Every forwarder answers /.pinokio/open itself, never relaying it: a peer on
+  this revision rewrites the links inside its interface to that path, and the
+  redirect lands on this node's `open` route, which maps the port on demand.
+*/
+const http = require('http')
+const https = require('https')
+const httpProxy = require('http-proxy')
+const { ProxyAgent } = require('proxy-agent')
+const { OPEN_PATH } = require('./serve')
+
+const FORWARDED_HEADER = 'x-pinokio-forwarded'
+// honoured by the peer middleware's trust; a forwarder never sends them
+const STRIPPED_HEADERS = ['x-pinokio-peer', 'x-pinokio-source-host', 'x-pinokio-source-proto']
+
+// This node's `open` route for a peer and port, relative for the page's links.
+function openPath(label, port, to) {
+  return `/anywhere/peers/${encodeURIComponent(label)}/open?port=${Number(port)}&to=${encodeURIComponent(to || '/')}`
+}
+
+class Forwarders {
+  // proxyUrl: () => 'http://127.0.0.1:<port>' or null while the daemon is down
+  // serverPort: () => pinokiod's own port
+  // scheme exists for the tests, which forward to a plain local server instead of
+  // TLS through the proxy; the product never passes it.
+  constructor({ proxyUrl, serverPort, scheme = 'https' } = {}) {
+    this.proxyUrl = proxyUrl
+    this.serverPort = serverPort
+    this.scheme = scheme
+    this.agents = new Map()          // proxy URL -> agent, one per daemon start
+    this.servers = new Map()         // "<dnsName>:<port>" -> { port, server, proxy, sockets } or { pending }
+  }
+  agent() {
+    const url = this.proxyUrl()
+    if (this.scheme === 'https' && !url) throw new Error('Remote is not running on this computer')
+    if (!url) return undefined
+    // proxy-agent picks CONNECT-then-TLS for an http:// proxy and an https target
+    if (!this.agents.has(url)) this.agents.set(url, new ProxyAgent({ keepAlive: true, getProxyForUrl: () => url }))
+    return this.agents.get(url)
+  }
+  // One request to a peer through the proxy, for the status probe and the launch/stop relay.
+  async request(url, options) {
+    return requestThroughProxy(this.agent(), url, options)
+  }
+  // Finds or starts the forwarder for (dnsName, port); resolves to its loopback port.
+  async open(dnsName, port) {
+    const key = `${String(dnsName).toLowerCase()}:${Number(port)}`
+    const existing = this.servers.get(key)
+    if (existing) return existing.port || (await existing.pending).port
+    const pending = this.start(dnsName, Number(port))
+    this.servers.set(key, { pending })
+    try {
+      const entry = await pending
+      this.servers.set(key, entry)
+      return entry.port
+    } catch (error) {
+      this.servers.delete(key)
+      throw error
+    }
+  }
+  async start(dnsName, port) {
+    const label = String(dnsName).split('.')[0]
+    const target = `${this.scheme}://${dnsName}:${port}`
+    const proxy = httpProxy.createProxyServer({ target, agent: this.agent(), changeOrigin: true, secure: true, ws: true })
+    proxy.on('error', (error, req, res) => {
+      const message = `Could not reach ${dnsName}: ${error && error.message ? error.message : error}`
+      if (res && typeof res.writeHead === 'function' && !res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' })
+        res.end(message)
+      } else if (res && typeof res.destroy === 'function') {
+        res.destroy()
+      }
+    })
+    // The headers go out as the incoming request's headers. Setting them in http-proxy's proxyReq
+    // hook instead would throw: with the proxy agent the hook fires once the CONNECT completes, and
+    // by then the outgoing headers are already written.
+    const mark = (req) => {
+      for (const name of STRIPPED_HEADERS) delete req.headers[name]
+      req.headers[FORWARDED_HEADER] = '1'
+    }
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1')
+      if (url.pathname === OPEN_PATH) {
+        const port = Number(url.searchParams.get('port'))
+        if (!Number.isInteger(port) || port <= 0) {
+          res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+          res.end('Not a Remote port')
+          return
+        }
+        const route = openPath(label, port, url.searchParams.get('to') || '/')
+        res.writeHead(302, { Location: `http://127.0.0.1:${this.serverPort()}${route}`, 'Cache-Control': 'no-store' })
+        res.end()
+        return
+      }
+      mark(req)
+      proxy.web(req, res)
+    })
+    server.on('upgrade', (req, socket, head) => {
+      mark(req)
+      proxy.ws(req, socket, head)
+    })
+    // every connection on both sides, upgraded ones included, so stopAll can end a stream a
+    // tab still holds; destroying only the browser's side would leave the peer's side piped open
+    const sockets = new Set()
+    const track = (socket) => {
+      sockets.add(socket)
+      socket.once('close', () => sockets.delete(socket))
+    }
+    server.on('connection', track)
+    proxy.on('open', track)
+    await new Promise((resolve, reject) => {
+      server.once('error', reject)
+      server.listen(0, '127.0.0.1', () => { server.off('error', reject); resolve() })
+    })
+    return { port: server.address().port, server, proxy, sockets }
+  }
+  // Ends every forwarder, open streams included: they belong to the daemon that is going away.
+  async stopAll() {
+    const entries = [...this.servers.values()]
+    this.servers.clear()
+    for (const agent of this.agents.values()) if (typeof agent.destroy === 'function') agent.destroy()
+    this.agents.clear()
+    await Promise.all(entries.map(async (entry) => {
+      const live = entry.server ? entry : await entry.pending.catch(() => null)
+      if (!live) return
+      live.proxy.close()
+      for (const socket of live.sockets) socket.destroy()
+      await new Promise((resolve) => live.server.close(resolve))
+    }))
+  }
+}
+
+// Resolves { status, body }; rejects on a transport failure or when the whole
+// request, the proxy's CONNECT included, exceeds the deadline.
+function requestThroughProxy(agent, url, { method = 'GET', headers = {}, body = null, timeoutMs = 4000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const target = new URL(url)
+    const lib = target.protocol === 'https:' ? https : http
+    // the deadline is kept here, not as the request's signal: while the agent's CONNECT is still
+    // pending the request has no socket, and Node reports an abort only once it gets one
+    const deadline = setTimeout(() => { reject(new Error(`no answer in ${Math.round(timeoutMs / 1000)} s`)); req.destroy() }, timeoutMs)
+    const req = lib.request(target, { method, headers, agent }, (res) => {
+      const chunks = []
+      res.on('data', (chunk) => chunks.push(chunk))
+      res.on('end', () => { clearTimeout(deadline); resolve({ status: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }) })
+      res.on('error', (error) => { clearTimeout(deadline); reject(error) })
+    })
+    req.on('error', (error) => { clearTimeout(deadline); reject(error) })
+    if (body != null) req.write(body)
+    req.end()
+  })
+}
+
+module.exports = { Forwarders, openPath, FORWARDED_HEADER }

package/kernel/anywhere/index.js

@@ -22,8 +22,10 @@ const crypto = require('crypto')
 const { spawn, execFile, execFileSync } = require('child_process')
 const TailscaleCLI = require('./cli')
 const writeJson = require('./state')
-const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS } = require('./serve')
+const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS } = require('./serve')
 const { loadPortMap, savePortMap, assignPorts } = require('./ports')
+const { Forwarders } = require('./forward')
+const net = require('net')
 const Util = require('../util')
 
 const DEFAULT_HOSTNAME = 'pinokio'
@@ -39,6 +41,10 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 class Anywhere {
   constructor(kernel) {
     this.kernel = kernel
+    // the daemon's outbound HTTP proxy, picked by pinokiod at each daemon start; null while down
+    this.proxyPort = null
+    this.ownedProxyPort = null     // the port on an adopted daemon's command line, set by ownedPid
+    this.forwarders = new Forwarders({ proxyUrl: () => this.proxyUrl(), serverPort: () => this.serverPort() })
     this.platform = kernel && kernel.platform ? kernel.platform : os.platform()
     this.child = null
     this.api = null
@@ -76,6 +82,9 @@ class Anywhere {
   pidPath() {
     return this.stateDir('tailscaled.pid')
   }
+  proxyUrl() {
+    return this.proxyPort ? `http://127.0.0.1:${this.proxyPort}` : null
+  }
   socketPath() {
     if (this._socketPath) return this._socketPath
     if (this.platform === 'win32') {
@@ -98,7 +107,8 @@ class Anywhere {
     }
     return null
   }
-  daemonArgs() {
+  // proxyPort: the outbound proxy's loopback port; null describes a daemon from before the proxy existed
+  daemonArgs(proxyPort = this.proxyPort) {
     const args = [
       '--tun=userspace-networking',
       '--state', this.stateDir('tailscaled.state'),
@@ -106,6 +116,7 @@ class Anywhere {
       '--socket', this.socketPath(),
       '--port', '0',
     ]
+    if (proxyPort) args.push(`--outbound-http-proxy-listen=127.0.0.1:${proxyPort}`)
     if (this.platform === 'win32') {
       // 1.104+: run as a per-user console process, no service / admin needed
       args.push('--windows-mode=dev')
@@ -234,10 +245,17 @@ class Anywhere {
     const alive = await this.daemonAlive()
     if (this.stopping) return false
     if (alive && (!(await this.assertOwnership()) || this.stopping)) return false
+    // a daemon this process started keeps its port; an adopted one gives the port on its command
+    // line, none for a daemon from before the proxy existed, so forwarding waits for its next start
+    if (alive) this.proxyPort = this.child ? this.proxyPort : this.ownedProxyPort
     if (!alive) {
       const pid = await this.readPid()
       if (this.stopping) return false
       if (pid) throw new Error('tailscaled is still running but its private endpoint is unavailable; no second daemon was started.')
+      // forwarders of a daemon that died relay to its proxy port; a new daemon gets new ones
+      await this.forwarders.stopAll()
+      // a free port now; the daemon fails to start if something takes it first, and Try again picks another
+      this.proxyPort = await freeLoopbackPort()
       const logFd = fs.openSync(this.logPath(), 'a')
       const env = Object.assign({}, process.env, {
         TS_LOGS_DIR: this.stateDir(),
@@ -255,6 +273,7 @@ class Anywhere {
         if (this.child === child) {
           // not a stop() of ours: surface it, the page offers "Try again"
           this.child = null
+          this.proxyPort = null   // its proxy went with it; the next start replaces the forwarders
           if (!this.stopping && !this.error) this.error = `tailscaled exited (code=${code} signal=${signal})`
           try { fs.rmSync(this.pidPath(), { force: true }) }
           catch (error) { this.error = `Could not remove tailscaled PID record: ${error.message}` }
@@ -325,12 +344,18 @@ class Anywhere {
   }
   ownedPid(inspection, command) {
     command = command.trim()
-    let expected = [this.binPath(), ...this.daemonArgs()].join(' ')
+    // the proxy port is whatever the running daemon was given; a daemon from before the
+    // proxy existed has none and is still ours. A match records the port for adoption.
+    const match = command.match(/--outbound-http-proxy-listen=127\.0\.0\.1:(\d+)/i)
+    const port = match ? Number(match[1]) : null
+    let expected = [this.binPath(), ...this.daemonArgs(port)].join(' ')
     if (this.platform === 'win32') {
       command = command.replace(/"/g, '').toLowerCase()
       expected = expected.toLowerCase()
     }
-    return command === expected ? inspection.pid : null
+    if (command !== expected) return null
+    this.ownedProxyPort = port
+    return inspection.pid
   }
   async readPid() {
     const inspection = this.pidInspection()
@@ -372,6 +397,8 @@ class Anywhere {
     this.child = null
     this.login = null
     this.api = null
+    this.proxyPort = null
+    await this.forwarders.stopAll()
     fs.rmSync(this.pidPath(), { force: true })
     this.lastStatus = null
     this.lastStatusAt = 0
@@ -518,6 +545,7 @@ class Anywhere {
       const generic = !hostName || /^(localhost|iphone|ipad|android)$/i.test(hostName)
       peers.push({
         name: (generic && dnsLabel) ? dnsLabel : (hostName || dnsLabel || key),
+        dnsName: p.DNSName ? String(p.DNSName).replace(/\.$/, '') : null,
         os: osName,
         mobile: MOBILE_OS.has(osName.toLowerCase()),
         online: !!p.Online,
@@ -613,15 +641,24 @@ class Anywhere {
     if (!dnsName || !this.config || !this.config.enabled) return false
     return String(host || '').toLowerCase().replace(/:443$/, '') === dnsName.toLowerCase()
   }
+  // A peer from `status --json` by the first label of its DNS name, the key
+  // of the peer routes; null for a name that is not a peer.
+  peerFor(label) {
+    if (!this.lastStatus || typeof label !== 'string') return null
+    const wanted = label.toLowerCase()
+    return this.peersFrom(this.lastStatus).find((p) => p.dnsName && p.dnsName.split('.')[0].toLowerCase() === wanted) || null
+  }
   // Rewrites one menu link for a visitor arriving through the Tailscale
   // address. Only a loopback link with a port is touched, and only when the
   // request's Host header is this node's name; any other request gets the
-  // href back unchanged.
-  rewriteHref(host, href) {
+  // href back unchanged. A visitor forwarded by another Pinokio gets the
+  // relative path its forwarder answers instead of this node's address.
+  rewriteHref(host, href, forwarded = false) {
     if (!this.isNodeHost(host)) return href
-    return rewriteHref(href, describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus)))
+    const routes = describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus))
+    return forwarded ? rewriteHrefForwarded(href, routes) : rewriteHref(href, routes)
   }
-  async rewriteMenu(host, menu) {
+  async rewriteMenu(host, menu, forwarded = false) {
     if (!Array.isArray(menu) || !this.isNodeHost(host)) return menu
     // Confirm new or changed routes on first render; refresh checks unchanged ones.
     const apps = this.appTargets()
@@ -634,7 +671,7 @@ class Anywhere {
       for (const item of items) {
         if (!item || typeof item !== 'object') continue
         if (typeof item.href === 'string') {
-          const next = this.rewriteHref(host, item.href)
+          const next = this.rewriteHref(host, item.href, forwarded)
           if (next !== item.href) {
             if (item.src === item.href) item.src = next
             if (item.target_full === item.href) item.target_full = next
@@ -742,7 +779,7 @@ class Anywhere {
     const dnsName = this.dnsNameFrom(status)
     const address = dnsName ? `https://${dnsName}` : null
     const account = this.accountFrom(status)
-    const peers = this.peersFrom(status)
+    const peers = this.peersFrom(status).map(({ dnsName, ...peer }) => peer)   // DNS names serve the peer routes, not the payload
     const out = Object.assign(base, {
       running: true,
       version: status.Version,
@@ -809,4 +846,16 @@ class Anywhere {
 }
 
 
+// A loopback port nothing is listening on right now, for the daemon's proxy.
+function freeLoopbackPort() {
+  return new Promise((resolve, reject) => {
+    const probe = net.createServer()
+    probe.once('error', reject)
+    probe.listen(0, '127.0.0.1', () => {
+      const { port } = probe.address()
+      probe.close(() => resolve(port))
+    })
+  })
+}
+
 module.exports = Anywhere

package/kernel/anywhere/serve.js

@@ -94,12 +94,28 @@ function sameServeConfig(a, b) {
   return isDeepStrictEqual(a || null, b || null)
 }
 
-function rewriteHref(href, routes) {
+// the path every forwarder answers itself (spec/requirements/pinokio-anywhere-api.md, Peers)
+const OPEN_PATH = '/.pinokio/open'
+
+// A loopback link with a port that a Serve route carries: its route and the
+// link's path, query and fragment; null for any other link.
+function routedLink(href, routes) {
   let url
-  try { url = new URL(String(href)) } catch (_) { return href }
-  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
+  try { url = new URL(String(href)) } catch (_) { return null }
+  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return null
   const route = routes.find((entry) => entry.local === Number(url.port))
-  return route ? route.url + url.pathname + url.search + url.hash : href
+  return route ? { route, path: url.pathname + url.search + url.hash } : null
+}
+function rewriteHref(href, routes) {
+  const link = routedLink(href, routes)
+  return link ? link.route.url + link.path : href
+}
+// The same link for a visitor arriving through another Pinokio's forwarder: the
+// published port and the path on the relative path the forwarder answers, so
+// the caller maps the port on demand.
+function rewriteHrefForwarded(href, routes) {
+  const link = routedLink(href, routes)
+  return link ? `${OPEN_PATH}?port=${link.route.port}&to=${encodeURIComponent(link.path)}` : href
 }
 
-module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT }
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT, OPEN_PATH }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.30",
+  "version": "8.2.32",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -35,6 +35,8 @@ const TerminalApi = require('../kernel/api/terminal')
 const PluginSources = require("../kernel/plugin_sources")
 const ManagedSkills = require("../kernel/managed_skills")
 const { rewriteHref: rewriteAnywhereHref, LOOPBACK_HOSTS: ANYWHERE_LOOPBACK_HOSTS } = require("../kernel/anywhere/serve")
+const { openPath: anywhereOpenPath, FORWARDED_HEADER: ANYWHERE_FORWARDED_HEADER } = require("../kernel/anywhere/forward")
+const { FIRST_PORT: ANYWHERE_FIRST_PORT, LAST_PORT: ANYWHERE_LAST_PORT } = require("../kernel/anywhere/ports")
 const { menuTargets: launcherMenuTargets, isWebUrl } = require("../kernel/api/launcher_target")
 const { isPathRemovalBlockedError, removePath } = require("../kernel/path_removal")
 
@@ -1049,6 +1051,117 @@ class Server {
     const dnsName = anywhere && typeof anywhere.dnsNameFrom === "function" ? anywhere.dnsNameFrom(anywhere.lastStatus) : null
     return !!dnsName && parsed.protocol === "https:" && host === dnsName.toLowerCase()
   }
+  // a Host header on this computer itself (localhost, 127.0.0.1, [::1], with or without a port)
+  isLoopbackHost(host) {
+    const name = String(host || "").toLowerCase().replace(/:\d+$/, "")
+    return name === "localhost" || name === "127.0.0.1" || name === "[::1]"
+  }
+  // A request from a browser on this computer, as opposed to one that came through Tailscale
+  // Serve or another Pinokio: those also arrive on loopback, and a tailnet client chooses its
+  // own Host, but it cannot strip the headers Serve adds on the way or the peer marker.
+  isLocalRequest(req) {
+    const socket = req.socket && req.socket.remoteAddress
+    const loopback = socket === "127.0.0.1" || socket === "::1" || socket === "::ffff:127.0.0.1"
+    return loopback && this.isLoopbackHost(req.get("host")) && !req.get("X-Forwarded-For") && !req.get("X-Pinokio-Peer")
+  }
+  // the peer routes act on this computer's behalf: served on this computer only, to its own
+  // page only. Their redirects end on 127.0.0.1, which mean nothing anywhere else.
+  anywherePeerAllowed(req) {
+    if (!this.isLocalRequest(req)) return false
+    const origin = req.get("Origin")
+    if (!origin) return true
+    try { return new URL(origin).host.toLowerCase() === String(req.get("host")).toLowerCase() } catch (_) { return false }
+  }
+  // the reason the peer routes cannot work right now, or null
+  anywherePeerUnavailable() {
+    const anywhere = this.kernel.anywhere
+    if (anywhere.proxyUrl()) return null
+    return anywhere.lastStatus && !anywhere.error ? "Turn Remote off and on to reach your other Pinokios" : "Remote is not running on this computer"
+  }
+  // Remote from computer to computer (spec/requirements/pinokio-anywhere-api.md, Peers):
+  // the other Pinokios on the tailnet, found by asking each online computer for its status
+  // through the daemon's proxy, their running apps linked through this node's forwarders.
+  async composeAnywherePeers() {
+    const anywhere = this.kernel.anywhere
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    const candidates = anywhere.peersFrom(anywhere.lastStatus).filter((peer) => peer.online && !peer.mobile && peer.dnsName)
+    const probes = await Promise.allSettled(candidates.map(async (peer) => {
+      const answer = await anywhere.forwarders.request(`https://${peer.dnsName}/anywhere/status`, { timeoutMs: 4000 })
+      if (answer.status !== 200) return null
+      let status
+      try { status = JSON.parse(answer.body) } catch (_) { return null }
+      if (!status || typeof status.phase !== "string") return null
+      const label = peer.dnsName.split(".")[0]
+      const apps = Array.isArray(status.apps) ? status.apps : []
+      return {
+        name: label,
+        apps: apps.map((app) => {
+          const { remote, ...rest } = app
+          return Object.assign(rest, { open: this.anywherePeerOpenPath(label, remote) })
+        }),
+      }
+    }))
+    return { status: 200, body: { peers: probes.map((probe) => probe.status === "fulfilled" ? probe.value : null).filter(Boolean) } }
+  }
+  // this node's open route for a peer's published address, or null for no address
+  anywherePeerOpenPath(label, remote) {
+    if (typeof remote !== "string") return null
+    let url
+    try { url = new URL(remote) } catch (_) { return null }
+    return anywhereOpenPath(label, url.port ? Number(url.port) : 443, url.pathname + url.search + url.hash)
+  }
+  // GET /anywhere/peers/<name>/open?port=<n>&to=<path>: { status, headers } or { status, body }
+  async anywherePeerOpen(name, query = {}) {
+    const anywhere = this.kernel.anywhere
+    const peer = anywhere.peerFor(name)
+    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
+    const port = Number(query.port)
+    if (!(port === 443 || (Number.isInteger(port) && port >= ANYWHERE_FIRST_PORT && port <= ANYWHERE_LAST_PORT))) {
+      return { status: 400, body: { error: `Not a Remote port: ${query.port}` } }
+    }
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    let local
+    try {
+      local = await anywhere.forwarders.open(peer.dnsName, port)
+    } catch (error) {
+      return { status: 500, body: { error: error && error.message ? error.message : String(error) } }
+    }
+    // `to` resolved against the forwarder: encoded for the header, and never another origin
+    const base = `http://127.0.0.1:${local}/`
+    let location
+    try { location = new URL(typeof query.to === "string" ? query.to : "/", base) } catch (_) { location = new URL(base) }
+    if (location.origin !== new URL(base).origin) location = new URL(base)
+    return { status: 302, headers: { Location: location.href, "Cache-Control": "no-store" } }
+  }
+  // POST /anywhere/peers/<name>/apps/<launch|stop>: the peer's answer, an open URL turned into this node's open route
+  async relayAnywherePeerAction(name, action, body = {}) {
+    const anywhere = this.kernel.anywhere
+    const peer = anywhere.peerFor(name)
+    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
+    const unavailable = this.anywherePeerUnavailable()
+    if (unavailable) return { status: 502, body: { error: unavailable } }
+    let answer
+    try {
+      answer = await anywhere.forwarders.request(`https://${peer.dnsName}/anywhere/apps/${action}`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body || {}), timeoutMs: 30000,
+      })
+    } catch (error) {
+      return { status: 502, body: { error: `Could not reach ${peer.name}: ${error && error.message ? error.message : error}` } }
+    }
+    let parsed
+    try { parsed = JSON.parse(answer.body) } catch (_) {
+      return { status: 502, body: { error: `${peer.name} did not answer with JSON (HTTP ${answer.status})` } }
+    }
+    // only the peer's own published address becomes this node's open route; any other URL passes through
+    if (parsed && parsed.action === "open" && typeof parsed.url === "string") {
+      let host = null
+      try { host = new URL(parsed.url).hostname.toLowerCase() } catch (_) { }
+      if (host === peer.dnsName.toLowerCase()) parsed.url = this.anywherePeerOpenPath(peer.dnsName.split(".")[0], parsed.url)
+    }
+    return { status: answer.status, body: parsed }
+  }
   // the app's menu as launch targets: scripts and web addresses, never interface links;
   // text is plain: a launcher may write HTML, which the desktop renders and the phone does not
   async anywhereMenu(api, repoPath) {
@@ -5076,7 +5189,8 @@ class Server {
       // published app's fixed https address; any other host is left for the
       // Home Server rewrite below, exactly as before.
       if (this.kernel.anywhere) {
-        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu)
+        // a visitor forwarded by another Pinokio gets links its forwarder answers (API spec, Peers)
+        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu, req.get(ANYWHERE_FORWARDED_HEADER) === "1")
       }
       config = Util.rewrite_localhost(this.kernel, config, req.$source)
       return config
@@ -14360,6 +14474,8 @@ class Server {
         status,
         theme: this.theme,
         agent: req.agent,
+        // Your other Pinokios links end on 127.0.0.1, which mean nothing to a phone reading this page
+        loopback: this.isLocalRequest(req),
       })
     }))
     this.app.get("/anywhere/status", ex(async (req, res) => {
@@ -14386,6 +14502,26 @@ class Server {
     })
     this.app.post("/anywhere/apps/launch", anywhereAppAction((body) => this.composeAnywhereLaunch(body)))
     this.app.post("/anywhere/apps/stop", anywhereAppAction((body) => this.composeAnywhereStop(body)))
+    // the other Pinokios on the tailnet, for this computer's own Remote page (API spec, Peers)
+    const anywherePeerRoute = (fn) => ex(async (req, res) => {
+      res.set("Cache-Control", "no-store")
+      if (!this.anywherePeerAllowed(req)) {
+        res.status(403).json({ error: "Allowed only on this computer" })
+        return
+      }
+      try {
+        const answer = await fn(req)
+        if (answer.headers) res.set(answer.headers)
+        if (answer.body === undefined) res.status(answer.status).end()
+        else res.status(answer.status).json(answer.body)
+      } catch (error) {
+        res.status(500).json({ error: error && error.message ? error.message : String(error) })
+      }
+    })
+    this.app.get("/anywhere/peers", anywherePeerRoute(() => this.composeAnywherePeers()))
+    this.app.get("/anywhere/peers/:name/open", anywherePeerRoute((req) => this.anywherePeerOpen(req.params.name, req.query)))
+    this.app.post("/anywhere/peers/:name/apps/launch", anywherePeerRoute((req) => this.relayAnywherePeerAction(req.params.name, "launch", req.body)))
+    this.app.post("/anywhere/peers/:name/apps/stop", anywherePeerRoute((req) => this.relayAnywherePeerAction(req.params.name, "stop", req.body)))
     const anywhereAction = (label, fn) => ex(async (req, res) => {
       const anywhere = this.kernel.anywhere
       if (!anywhere) {

package/server/views/anywhere.ejs

@@ -40,7 +40,7 @@ body.dark .anywhere-card { border-color: rgba(255,255,255,0.1); background: rgba
 .anywhere-muted { opacity: 0.7; font-size: 13px; }
 .anywhere-grid { display: grid; grid-template-columns: minmax(280px, 380px) 1fr; gap: 16px; align-items: start; }
 @media (max-width: 900px) { .anywhere-grid { grid-template-columns: 1fr; } }
-.anywhere-signout { background: none; border: none; padding: 0; font: inherit; color: inherit; text-decoration: underline; cursor: pointer; }
+.anywhere-signout, .anywhere-linkbtn { background: none; border: none; padding: 0; font: inherit; color: inherit; text-decoration: underline; cursor: pointer; }
 /* which device is connecting: a segmented control, the phone panel by default */
 .anywhere-segments { display: grid; grid-template-columns: 1fr 1fr; width: 100%; padding: 4px; border-radius: 12px; background: rgba(0,0,0,0.05); }
 body.dark .anywhere-segments { background: rgba(255,255,255,0.08); }
@@ -258,6 +258,13 @@ document.addEventListener('DOMContentLoaded', function() {
                 <h3>Published addresses</h3>
                 <div id='anywhere-ports' class='anywhere-muted'></div>
               </div>
+              <% if (locals.loopback) { %>
+              <div class='anywhere-card'>
+                <h2>Your other Pinokios</h2>
+                <p class='anywhere-muted'>Computers on your network with Remote on. They open through this Pinokio; nothing else to install.</p>
+                <div id='anywhere-others'><p class='anywhere-muted'>Looking…</p></div>
+              </div>
+              <% } %>
               <div class='anywhere-card'>
                 <h2>Devices on your network</h2>
                 <div id='anywhere-peers'></div>
@@ -470,6 +477,56 @@ document.addEventListener('DOMContentLoaded', function() {
     }
   }
 
+  // Your other Pinokios: only on a loopback host, refreshed with each status poll while ready
+  const others = document.getElementById('anywhere-others')
+  let othersBusy = false
+  let othersNote = ''   // the last failed action, shown until the next one
+  const renderOthers = (peers) => {
+    if (!others) return
+    others.innerHTML = (othersNote ? `<p class='anywhere-error'>${esc(othersNote)}</p>` : '') + (peers.length === 0
+      ? `<p class='anywhere-muted'>No other Pinokio with Remote on is online.</p>`
+      : peers.map((peer) => `
+        <div class='anywhere-row anywhere-other' data-peer='${esc(peer.name)}'>
+          <i class='fa-solid fa-desktop'></i>
+          <div class='grow'>
+            <div class='title'>${esc(peer.name)} <a class='remote' href='/anywhere/peers/${encodeURIComponent(peer.name)}/open?port=443&to=%2F' target='_blank' rel='noopener'>Open Pinokio</a></div>
+            ${(peer.apps || []).length === 0 ? `<div class='sub'>no app running</div>` : peer.apps.map((app) => `
+              <div class='sub'>${esc(app.name)} ${app.open ? `<a class='remote' href='${esc(app.open)}' target='_blank' rel='noopener'>Open</a>` : `<span class='anywhere-badge'>${esc(app.state || 'starting')}</span>`} · <button type='button' class='anywhere-linkbtn' data-stop='${esc(app.id)}'>Stop</button></div>`).join('')}
+          </div>
+        </div>`).join(''))
+  }
+  const refreshOthers = async () => {
+    if (!others || othersBusy || current.phase !== 'ready') return
+    othersBusy = true
+    try {
+      const response = await fetch('/anywhere/peers', { cache: 'no-store' })
+      const answer = await response.json().catch(() => ({}))
+      if (!response.ok) throw new Error(answer.error || `HTTP ${response.status}`)
+      renderOthers(answer.peers || [])
+    } catch (e) {
+      others.innerHTML = `<p class='anywhere-muted'>Could not look for other Pinokios: ${esc(e.message)}</p>`
+    } finally {
+      othersBusy = false
+    }
+  }
+  if (others) {
+    others.addEventListener('click', async (event) => {
+      const button = event.target.closest('button[data-stop]')
+      if (!button) return
+      const peer = button.closest('[data-peer]').dataset.peer
+      button.disabled = true
+      othersNote = ''
+      try {
+        const response = await fetch(`/anywhere/peers/${encodeURIComponent(peer)}/apps/stop`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ id: button.dataset.stop }) })
+        const answer = await response.json().catch(() => ({}))
+        if (!response.ok) othersNote = `Could not stop it on ${peer}: ${answer.error || `HTTP ${response.status}`}`
+      } catch (e) {
+        othersNote = `Could not stop it on ${peer}: ${e.message}`
+      }
+      await refreshOthers()
+    })
+  }
+
   const poll = async () => {
     try {
       const response = await fetch('/anywhere/status', { cache: 'no-store' })
@@ -478,6 +535,7 @@ document.addEventListener('DOMContentLoaded', function() {
     } catch (e) {
       render(Object.assign({}, current, { phase: 'error', error: e.message }))
     }
+    refreshOthers()
     const phase = current.phase || ''
     const delay = (phase === 'ready' || phase === 'off') ? 5000 : 2000
     setTimeout(poll, delay)
@@ -537,6 +595,7 @@ document.addEventListener('DOMContentLoaded', function() {
   })
 
   render(current)
+  refreshOthers()
   setTimeout(poll, 1500)
 })()
 </script>

package/test/anywhere-forward.test.js

@@ -0,0 +1,168 @@
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const test = require('node:test')
+const { once } = require('node:events')
+const WebSocket = require('ws')
+const { Forwarders } = require('../kernel/anywhere/forward')
+
+// Forwarders (spec/requirements/pinokio-anywhere.md, Other Pinokios; the
+// API spec, Peers): one loopback port relaying to one peer and port. The
+// peer here is a plain local server, so the TLS-through-proxy layer is
+// replaced by the http scheme and no agent; what is checked is the relay.
+
+async function peer(t) {
+  const seen = []
+  const server = http.createServer((req, res) => {
+    seen.push({ url: req.url, headers: req.headers, method: req.method })
+    let body = ''
+    req.on('data', (chunk) => { body += chunk })
+    req.on('end', () => {
+      res.writeHead(200, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ url: req.url, host: req.headers.host, forwarded: req.headers['x-pinokio-forwarded'] || null, peer: req.headers['x-pinokio-peer'] || null, body }))
+    })
+  })
+  const wss = new WebSocket.Server({ server })
+  wss.on('connection', (socket, req) => {
+    socket.on('message', (message) => socket.send(`echo:${message} forwarded=${req.headers['x-pinokio-forwarded'] || 'none'} peer=${req.headers['x-pinokio-peer'] || 'none'}`))
+  })
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  t.after(() => new Promise((resolve) => { wss.close(); server.close(resolve); server.closeAllConnections() }))
+  return { port: server.address().port, seen }
+}
+
+const get = (port, path, headers = {}) => new Promise((resolve, reject) => {
+  http.get({ host: '127.0.0.1', port, path, headers }, (res) => {
+    let body = ''
+    res.on('data', (chunk) => { body += chunk })
+    res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }))
+  }).on('error', reject)
+})
+
+test('a forwarder relays requests with the forwarded header, the peer as Host, and no trusted peer headers', async (t) => {
+  const target = await peer(t)
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  t.after(() => forwarders.stopAll())
+  const local = await forwarders.open('127.0.0.1', target.port)
+  assert.equal(await forwarders.open('127.0.0.1', target.port), local, 'the same peer and port reuse the forwarder')
+  const answer = await get(local, '/ui/?a=1', { 'X-Pinokio-Peer': '1', 'X-Pinokio-Source-Host': 'evil', 'X-Pinokio-Source-Proto': 'https' })
+  assert.equal(answer.status, 200)
+  const body = JSON.parse(answer.body)
+  assert.equal(body.url, '/ui/?a=1')
+  assert.equal(body.host, `127.0.0.1:${target.port}`, 'Host names the peer, not the loopback port')
+  assert.equal(body.forwarded, '1')
+  assert.equal(body.peer, null, 'the existing peer-trust headers never pass through')
+  assert.equal(target.seen[0].headers['x-pinokio-source-host'], undefined)
+})
+
+// A forward proxy for plain http targets: the real ProxyAgent sends it absolute URLs, and
+// connects asynchronously, which is what broke the proxyReq-hook version in production.
+async function forwardProxy(t) {
+  const server = http.createServer((req, res) => {
+    const target = new URL(req.url)
+    const upstream = http.request({ host: target.hostname, port: target.port, path: target.pathname + target.search, method: req.method, headers: req.headers }, (answer) => {
+      res.writeHead(answer.statusCode, answer.headers)
+      answer.pipe(res)
+    })
+    upstream.on('error', (error) => { res.writeHead(502); res.end(error.message) })
+    req.pipe(upstream)
+  })
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  t.after(() => { server.closeAllConnections(); server.close() })
+  return `http://127.0.0.1:${server.address().port}`
+}
+
+test('through the real proxy agent, whose connection completes later, the forwarded header still goes out and nothing throws', async (t) => {
+  const target = await peer(t)
+  const proxyUrl = await forwardProxy(t)
+  const forwarders = new Forwarders({ proxyUrl: () => proxyUrl, serverPort: () => 42000, scheme: 'http' })
+  t.after(() => forwarders.stopAll())
+  const local = await forwarders.open('127.0.0.1', target.port)
+  const answer = await get(local, '/ui/?a=1', { 'X-Pinokio-Peer': '1' })
+  assert.equal(answer.status, 200)
+  const body = JSON.parse(answer.body)
+  assert.equal(body.forwarded, '1')
+  assert.equal(body.peer, null)
+  assert.equal(body.host, `127.0.0.1:${target.port}`)
+  assert.equal(target.seen.length, 1)
+})
+
+test('two opens of the same peer and port at once share one forwarder', async (t) => {
+  const target = await peer(t)
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  t.after(() => forwarders.stopAll())
+  const [a, b] = await Promise.all([forwarders.open('127.0.0.1', target.port), forwarders.open('127.0.0.1', target.port)])
+  assert.ok(Number.isInteger(a) && a > 0)
+  assert.equal(a, b)
+})
+
+test('a forwarder answers /.pinokio/open itself with a redirect to this node\'s open route', async (t) => {
+  const target = await peer(t)
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  t.after(() => forwarders.stopAll())
+  const local = await forwarders.open('pinokio-1.tail1.ts.net', target.port)
+  const answer = await get(local, '/.pinokio/open?port=43001&to=%2Fui%2F%3Fa%3D1%23view')
+  assert.equal(answer.status, 302)
+  assert.equal(answer.headers.location, 'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43001&to=%2Fui%2F%3Fa%3D1%23view')
+  assert.equal((await get(local, '/.pinokio/open?to=%2F')).status, 400, 'a link without a port does not bounce through pinokiod')
+  assert.equal(target.seen.length, 0, 'never relayed')
+})
+
+test('a forwarder relays a WebSocket upgrade', async (t) => {
+  const target = await peer(t)
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  t.after(() => forwarders.stopAll())
+  const local = await forwarders.open('127.0.0.1', target.port)
+  const socket = new WebSocket(`ws://127.0.0.1:${local}/socket`, { headers: { 'X-Pinokio-Peer': '1' } })
+  await once(socket, 'open')
+  socket.send('hi')
+  const [message] = await once(socket, 'message')
+  assert.equal(String(message), 'echo:hi forwarded=1 peer=none', 'the forwarded header is added and the trust header dropped on the upgrade path too')
+  socket.close()
+})
+
+test('a peer that cannot be reached answers 502, and stopAll closes every forwarder, an open WebSocket included', async (t) => {
+  const target = await peer(t)
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  const dead = await forwarders.open('127.0.0.1', 1)
+  const answer = await get(dead, '/')
+  assert.equal(answer.status, 502)
+  assert.match(answer.body, /Could not reach 127\.0\.0\.1/)
+  const live = await forwarders.open('127.0.0.1', target.port)
+  const socket = new WebSocket(`ws://127.0.0.1:${live}/socket`)
+  await once(socket, 'open')
+  const closed = once(socket, 'close')
+  const stopped = forwarders.stopAll()
+  await Promise.race([stopped, new Promise((_, reject) => setTimeout(() => reject(new Error('stopAll hung on the open WebSocket')), 2000))])
+  await closed
+  await assert.rejects(get(live, '/'), /ECONNREFUSED/)
+})
+
+test('the https scheme refuses to forward while the daemon is down', () => {
+  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000 })
+  assert.throws(() => forwarders.agent(), /Remote is not running/)
+})
+
+test('a request to a peer returns status and body, and the deadline covers the connection itself', async (t) => {
+  const target = await peer(t)
+  const plain = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
+  const answer = await plain.request(`http://127.0.0.1:${target.port}/anywhere/status`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{"id":"x"}' })
+  assert.equal(answer.status, 200)
+  assert.equal(JSON.parse(answer.body).body, '{"id":"x"}')
+  const silent = http.createServer(() => { /* never answers */ })
+  silent.listen(0, '127.0.0.1')
+  await once(silent, 'listening')
+  t.after(() => { silent.closeAllConnections(); silent.close() })
+  await assert.rejects(plain.request(`http://127.0.0.1:${silent.address().port}/`, { timeoutMs: 200 }), /no answer in 0 s/)
+  // a proxy that accepts and never answers the CONNECT, through the real agent: the deadline
+  // still fires there, where a socket timeout would not have started yet
+  const held = []
+  const stuckProxy = require('node:net').createServer((socket) => { held.push(socket) /* never answers */ })
+  stuckProxy.listen(0, '127.0.0.1')
+  await once(stuckProxy, 'listening')
+  t.after(() => { for (const socket of held) socket.destroy(); stuckProxy.close() })
+  const forwarders = new Forwarders({ proxyUrl: () => `http://127.0.0.1:${stuckProxy.address().port}`, serverPort: () => 42000 })
+  t.after(() => forwarders.stopAll())
+  await assert.rejects(forwarders.request('https://peer.tail1.ts.net/anywhere/status', { timeoutMs: 300 }), /no answer in 0 s/)
+})

package/test/anywhere-others.test.js

@@ -0,0 +1,96 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const test = require('node:test')
+const ejs = require('ejs')
+const { JSDOM, VirtualConsole } = require('jsdom')
+
+// The Remote page's "Your other Pinokios" section (spec/requirements/
+// pinokio-anywhere.md, Other Pinokios): on a loopback host only, filled from
+// /anywhere/peers at each status poll while ready, stop relayed per app.
+const filename = path.resolve(__dirname, '../server/views/anywhere.ejs')
+const template = fs.readFileSync(filename, 'utf8')
+const address = 'https://pinokio.tail123.ts.net'
+const ready = { phase: 'ready', enabled: true, address, connectUrl: 'https://pinokio.co/anywhere/connect#u=x', dnsName: 'pinokio.tail123.ts.net', account: { email: 'me@example.com' }, peers: [{ name: 'STUDIO', os: 'windows', online: true }], apps: [], serve: [] }
+
+function render(t, { loopback, peers }) {
+  const state = { calls: [], timers: [], peers }
+  const html = ejs.render(template, { theme: 'light', agent: 'electron', status: ready, loopback }, { filename, includer: () => ({ template: ' ' }) })
+  const virtualConsole = new VirtualConsole()
+  virtualConsole.on('jsdomError', (error) => { throw error })
+  const dom = new JSDOM(html, {
+    url: 'http://127.0.0.1:42000/anywhere', runScripts: 'dangerously', pretendToBeVisual: true, virtualConsole,
+    beforeParse(window) {
+      window.setTimeout = (callback, delay) => state.timers.push({ callback, delay })
+      window.fetch = async (url, options = {}) => {
+        state.calls.push({ url, method: options.method || 'GET', body: options.body })
+        if (url === '/anywhere/status') return { ok: true, json: async () => ({ ...ready }) }
+        if (url === '/anywhere/peers') return state.peersError ? { ok: false, status: 502, json: async () => ({ error: state.peersError }) } : { ok: true, json: async () => ({ peers: state.peers }) }
+        if (state.stopFails) return { ok: false, status: 502, json: async () => ({ error: 'no answer in 30 s' }) }
+        return { ok: true, json: async () => ({ action: 'stopped' }) }
+      }
+      window.open = () => {}
+    },
+  })
+  t.after(() => dom.window.close())
+  const document = dom.window.document
+  // the poll: status, then the peers refresh it starts; let both settle
+  const poll = async () => { state.timers.shift().callback(); await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve)) }
+  return { state, document, poll, section: () => document.getElementById('anywhere-others') }
+}
+
+test('on a loopback host the section lists each other Pinokio with Open Pinokio and its apps through the open route', async (t) => {
+  const h = render(t, { loopback: true, peers: [
+    { name: 'pinokio-1', apps: [
+      { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2F' },
+      { id: 'forge', name: 'Forge', state: 'starting', exposed: false, open: null },
+    ] },
+    { name: 'other', apps: [] },
+  ] })
+  assert.ok(h.section(), 'the card exists before the first answer')
+  await h.poll()
+  assert.deepEqual(h.state.calls.map((call) => call.url), ['/anywhere/peers', '/anywhere/status', '/anywhere/peers'], 'once on load, then with each status poll')
+  const rows = [...h.section().querySelectorAll('[data-peer]')]
+  assert.deepEqual(rows.map((row) => row.dataset.peer), ['pinokio-1', 'other'])
+  const links = [...rows[0].querySelectorAll('a')].map((a) => [a.textContent, a.getAttribute('href')])
+  assert.deepEqual(links, [['Open Pinokio', '/anywhere/peers/pinokio-1/open?port=443&to=%2F'], ['Open', '/anywhere/peers/pinokio-1/open?port=43000&to=%2F']])
+  assert.match(rows[0].textContent, /Forge/)
+  assert.ok(rows[0].querySelector('.anywhere-badge'), 'an app without an address shows its state instead of a link')
+  assert.match(rows[1].textContent, /no app running/)
+  assert.doesNotMatch(h.section().textContent, /Looking…/)
+})
+
+test('with none found the section says so, and a stop is relayed to the peer then refreshed', async (t) => {
+  const h = render(t, { loopback: true, peers: [] })
+  await h.poll()
+  assert.match(h.section().textContent, /No other Pinokio with Remote on is online/)
+  h.state.peers = [{ name: 'pinokio-1', apps: [{ id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2F' }] }]
+  await h.poll()
+  const stop = h.section().querySelector('button[data-stop="comfy"]')
+  assert.ok(stop)
+  stop.click()
+  await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve))
+  const posted = h.state.calls.find((call) => call.method === 'POST')
+  assert.deepEqual([posted.url, posted.body], ['/anywhere/peers/pinokio-1/apps/stop', '{"id":"comfy"}'])
+  assert.equal(h.state.calls.filter((call) => call.url === '/anywhere/peers').length, 4, 'load, two polls, and once more after the stop')
+  assert.equal(h.section().querySelector('.anywhere-error'), null)
+  h.state.stopFails = true
+  h.section().querySelector('button[data-stop="comfy"]').click()
+  await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve))
+  assert.match(h.section().querySelector('.anywhere-error').textContent, /Could not stop it on pinokio-1: no answer in 30 s/)
+  assert.ok(h.section().querySelector('[data-peer="pinokio-1"]'), 'the list is still there under the note')
+})
+
+test('while the daemon runs without the proxy, the section shows the reason the server gives', async (t) => {
+  const h = render(t, { loopback: true, peers: [] })
+  h.state.peersError = 'Turn Remote off and on to reach your other Pinokios'
+  await h.poll()
+  assert.match(h.section().textContent, /Could not look for other Pinokios: Turn Remote off and on to reach your other Pinokios/)
+})
+
+test('through the node\'s own Tailscale name there is no section and no peers request', async (t) => {
+  const h = render(t, { loopback: false, peers: [{ name: 'pinokio-1', apps: [] }] })
+  assert.equal(h.section(), null)
+  await h.poll()
+  assert.deepEqual(h.state.calls.map((call) => call.url), ['/anywhere/status'], 'no peers request at load or at the poll')
+})

package/test/anywhere-peers.test.js

@@ -0,0 +1,199 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+const Server = require('../server/index.js')
+const Anywhere = require('../kernel/anywhere')
+const { buildServeConfig } = require('../kernel/anywhere/serve')
+
+// The peer routes (spec/requirements/pinokio-anywhere-api.md, Peers) and the
+// forwarded link rewrite, with the proxy request and the forwarders stubbed.
+
+const status = {
+  Self: { DNSName: 'pinokio.tail1.ts.net.' },
+  Peer: {
+    a: { HostName: 'STUDIO', DNSName: 'pinokio-1.tail1.ts.net.', OS: 'windows', Online: true, TailscaleIPs: ['100.1.1.1'] },
+    b: { HostName: 'iphone', DNSName: 'iphone-14-pro.tail1.ts.net.', OS: 'iOS', Online: true },
+    c: { HostName: 'asleep', DNSName: 'asleep.tail1.ts.net.', OS: 'macOS', Online: false },
+    d: { HostName: 'other', DNSName: 'other.tail1.ts.net.', OS: 'linux', Online: true },
+  },
+}
+
+function anywhereWith(requests = {}, { proxy = true } = {}) {
+  const anywhere = new Anywhere({})
+  anywhere.config = { enabled: true }
+  anywhere.lastStatus = status
+  anywhere.proxyPort = proxy ? 1055 : null
+  anywhere.forwarders.request = async (url, options) => {
+    const handler = requests[url]
+    if (!handler) throw new Error(`no route to ${url}`)
+    return handler(options)
+  }
+  anywhere.forwarders.open = async (dnsName, port) => 51000 + (port % 1000)
+  return anywhere
+}
+const json = (body, code = 200) => async () => ({ status: code, headers: {}, body: JSON.stringify(body) })
+const fake = (anywhere) => ({ kernel: { anywhere }, anywherePeerOpenPath: Server.prototype.anywherePeerOpenPath, anywherePeerUnavailable: Server.prototype.anywherePeerUnavailable })
+
+test('peers lists the online computers that answered a status, with apps linked through the open route', async () => {
+  const anywhere = anywhereWith({
+    'https://pinokio-1.tail1.ts.net/anywhere/status': json({ phase: 'ready', apps: [
+      { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, remote: 'https://pinokio-1.tail1.ts.net:43000/ui/?a=1#v' },
+      { id: 'forge', name: 'Forge', state: 'starting', exposed: false, remote: null },
+    ] }),
+    'https://other.tail1.ts.net/anywhere/status': async () => ({ status: 404, headers: {}, body: 'not pinokio' }),
+  })
+  const out = await Server.prototype.composeAnywherePeers.call(fake(anywhere))
+  assert.equal(out.status, 200)
+  assert.deepEqual(out.body, { peers: [{ name: 'pinokio-1', apps: [
+    { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v' },
+    { id: 'forge', name: 'Forge', state: 'starting', exposed: false, open: null },
+  ] }] })
+})
+
+test('peers skips phones and offline peers, tolerates a peer that fails, and says why while the proxy is missing', async () => {
+  const asked = []
+  const anywhere = anywhereWith({
+    'https://pinokio-1.tail1.ts.net/anywhere/status': async () => { asked.push('pinokio-1'); throw new Error('no answer in 4 s') },
+    'https://other.tail1.ts.net/anywhere/status': async () => { asked.push('other'); return { status: 200, headers: {}, body: 'not json' } },
+  })
+  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(anywhere))).body, { peers: [] })
+  assert.deepEqual(asked.sort(), ['other', 'pinokio-1'], 'the phone and the offline computer are never asked')
+  const adopted = anywhereWith({}, { proxy: false })
+  assert.deepEqual(await Server.prototype.composeAnywherePeers.call(fake(adopted)), { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
+  adopted.error = 'tailscaled exited (code=1 signal=null)'
+  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(adopted))).body, { error: 'Remote is not running on this computer' }, 'a daemon that died')
+})
+
+test('open validates the peer, the port and the path, then redirects to the forwarder', async () => {
+  const server = fake(anywhereWith())
+  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'nobody', { port: '443' })).status, 400)
+  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '8080' })).status, 400)
+  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443.5' })).status, 400)
+  const root = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443' })
+  assert.equal(root.status, 302)
+  assert.equal(root.headers.Location, 'http://127.0.0.1:51443/')
+  const deep = await Server.prototype.anywherePeerOpen.call(server, 'PINOKIO-1', { port: '43000', to: '/ui/?a=1#v' })
+  assert.equal(deep.headers.Location, 'http://127.0.0.1:51000/ui/?a=1#v', 'the path, query and fragment survive; the name is case-insensitive')
+  for (const bad of ['//evil.example', 'https://evil.example/', '\\\\evil.example', 'http://127.0.0.1:51443@evil.example/']) {
+    const answer = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: bad })
+    assert.equal(new URL(answer.headers.Location).origin, 'http://127.0.0.1:51443', `a path that could leave the forwarder (${bad}) stays on it`)
+  }
+  const odd = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: '/ui/?q=caf\u00e9 x#\u00fc' })
+  assert.equal(odd.headers.Location, 'http://127.0.0.1:51443/ui/?q=caf%C3%A9%20x#%C3%BC', 'a path with characters a header cannot carry is encoded, fragment kept')
+  const unavailable = await Server.prototype.anywherePeerOpen.call(fake(anywhereWith({}, { proxy: false })), 'pinokio-1', { port: '443' })
+  assert.deepEqual(unavailable, { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
+})
+
+test('launch and stop relay the peer\'s status and body, turning an open URL into the open route', async () => {
+  const sent = []
+  const anywhere = anywhereWith({
+    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': async (options) => { sent.push(options); return { status: 200, headers: {}, body: JSON.stringify({ action: 'open', url: 'https://pinokio-1.tail1.ts.net:43000/' }) } },
+    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': json({ error: 'Unknown app: x' }, 400),
+  })
+  const server = fake(anywhere)
+  const launch = await Server.prototype.relayAnywherePeerAction.call(server, 'pinokio-1', 'launch', { id: 'comfy' })
+  assert.deepEqual(launch, { status: 200, body: { action: 'open', url: '/anywhere/peers/pinokio-1/open?port=43000&to=%2F' } })
+  assert.equal(sent[0].method, 'POST')
+  assert.equal(sent[0].body, '{"id":"comfy"}')
+  assert.equal(sent[0].headers['Content-Type'], 'application/json')
+  assert.deepEqual(await Server.prototype.relayAnywherePeerAction.call(server, 'pinokio-1', 'stop', { id: 'x' }), { status: 400, body: { error: 'Unknown app: x' } })
+  assert.equal((await Server.prototype.relayAnywherePeerAction.call(server, 'nobody', 'stop', {})).status, 400)
+})
+
+test('a launch whose default is an outside address passes through unchanged', async () => {
+  const anywhere = anywhereWith({
+    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': json({ action: 'open', url: 'https://github.com/x/y' }),
+  })
+  const launch = await Server.prototype.relayAnywherePeerAction.call(fake(anywhere), 'pinokio-1', 'launch', { id: 'docs' })
+  assert.deepEqual(launch.body, { action: 'open', url: 'https://github.com/x/y' })
+})
+
+test('a peer that cannot be reached or answers without JSON relays as 502', async () => {
+  const anywhere = anywhereWith({
+    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': async () => { throw new Error('no answer in 30 s') },
+    'https://other.tail1.ts.net/anywhere/apps/stop': async () => ({ status: 404, headers: {}, body: '<html>' }),
+  })
+  const server = fake(anywhere)
+  const down = await Server.prototype.relayAnywherePeerAction.call(server, 'pinokio-1', 'stop', { id: 'x' })
+  assert.equal(down.status, 502)
+  assert.match(down.body.error, /Could not reach STUDIO: no answer/)
+  const old = await Server.prototype.relayAnywherePeerAction.call(server, 'other', 'stop', { id: 'x' })
+  assert.deepEqual(old, { status: 502, body: { error: 'other did not answer with JSON (HTTP 404)' } })
+  const stopped = await Server.prototype.relayAnywherePeerAction.call(fake(anywhereWith({}, { proxy: false })), 'other', 'stop', {})
+  assert.equal(stopped.status, 502)
+})
+
+test('the peer routes answer a browser on this computer only, never a tailnet client through Serve, whatever Host it sends', () => {
+  const server = { kernel: { anywhere: anywhereWith() }, isLoopbackHost: Server.prototype.isLoopbackHost, isLocalRequest: Server.prototype.isLocalRequest }
+  const request = ({ remote = '127.0.0.1', host = 'localhost:42000', origin, headers = {} } = {}) => ({
+    socket: { remoteAddress: remote },
+    get: (name) => ({ host, origin, ...Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])) })[name.toLowerCase()],
+  })
+  const allowed = (req) => Server.prototype.anywherePeerAllowed.call(server, req)
+  assert.equal(allowed(request()), true, 'a top-level navigation on this computer')
+  assert.equal(allowed(request({ remote: '::1', host: '[::1]:42000', origin: 'http://[::1]:42000' })), true)
+  assert.equal(allowed(request({ remote: '::ffff:127.0.0.1', host: '127.0.0.1:42000', origin: 'http://127.0.0.1:42000' })), true)
+  assert.equal(allowed(request({ origin: 'http://localhost:3000' })), false, 'another local site is not this page')
+  assert.equal(allowed(request({ origin: 'https://pinokio.co' })), false)
+  assert.equal(allowed(request({ origin: 'not a url' })), false)
+  assert.equal(allowed(request({ host: 'pinokio.tail1.ts.net' })), false, 'the node\'s own name')
+  assert.equal(allowed(request({ headers: { 'X-Forwarded-For': '100.1.1.1' } })), false, 'through Serve with a forged loopback Host')
+  assert.equal(allowed(request({ headers: { 'X-Pinokio-Peer': '1', 'X-Pinokio-Source-Host': 'localhost' } })), false, 'through another Pinokio')
+  assert.equal(allowed(request({ remote: '192.168.1.5' })), false, 'Home Server on the LAN')
+  assert.equal(allowed(request({ remote: null })), false, 'no socket address at all')
+  assert.equal(Server.prototype.isLoopbackHost('LOCALHOST'), true)
+  assert.equal(Server.prototype.isLoopbackHost('localhost.evil'), false)
+})
+
+test('a live daemon is still ours across a pinokiod restart, its proxy port read from its command line', () => {
+  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/'), bin: { mod: { tailscaled: { binPath: () => '/opt/tailscaled' } } } })
+  const line = (port) => ['/opt/tailscaled', ...anywhere.daemonArgs(port)].join(' ')
+  assert.equal(anywhere.proxyPort, null, 'a fresh pinokiod process knows no port yet')
+  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055)), 7)
+  assert.equal(anywhere.ownedProxyPort, 1055, 'the port the daemon was given, for adoption')
+  assert.equal(anywhere.ownedPid({ pid: 7 }, line(null)), 7, 'a daemon started before the proxy existed')
+  assert.equal(anywhere.ownedProxyPort, null, 'and it has no proxy to use')
+  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055) + ' --extra'), null, 'anything else is not ours')
+  assert.equal(anywhere.ownedPid({ pid: 7 }, '/usr/bin/tailscaled --tun=userspace-networking'), null)
+  anywhere.platform = 'win32'
+  assert.equal(anywhere.ownedPid({ pid: 9 }, `"${line(1055).toUpperCase()}"`), 9, 'Windows compares without quotes, case-insensitively')
+})
+
+test('peerFor finds a peer by the first label of its DNS name, which may differ from its displayed name', () => {
+  const anywhere = anywhereWith()
+  assert.equal(anywhere.peerFor('pinokio-1').name, 'STUDIO')
+  assert.equal(anywhere.peerFor('iphone-14-pro').mobile, true)
+  assert.equal(anywhere.peerFor('STUDIO'), null, 'the hostname is not the key')
+  assert.equal(anywhere.peerFor(''), null)
+  assert.equal(anywhere.peerFor(null), null)
+})
+
+test('a forwarded visitor gets menu links on the forwarder\'s open path; every other visitor gets today\'s links', async () => {
+  const anywhere = new Anywhere({})
+  anywhere.config = { enabled: true }
+  anywhere.lastStatus = status
+  anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
+  const href = 'http://127.0.0.1:7860/ui/?a=1#v'
+  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, true), '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
+  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
+  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, false), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
+  assert.equal(anywhere.rewriteHref('localhost:42000', href, true), href, 'the Host gate still applies with the header')
+  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', 'http://127.0.0.1:9999/', true), 'http://127.0.0.1:9999/', 'a port without a route is left alone, as today')
+  const menu = [{ href, src: href, menu: [{ href: 'https://example.com/' }] }]
+  await anywhere.rewriteMenu('pinokio.tail1.ts.net', menu, true)
+  assert.equal(menu[0].href, '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
+  assert.equal(menu[0].src, menu[0].href)
+  assert.equal(menu[0].menu[0].href, 'https://example.com/')
+})
+
+test('the daemon is started with the proxy on the port pinokiod picked, and peers carry their DNS name', () => {
+  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/') })
+  anywhere.proxyPort = 1055
+  assert.ok(anywhere.daemonArgs().includes('--outbound-http-proxy-listen=127.0.0.1:1055'))
+  assert.equal(anywhere.proxyUrl(), 'http://127.0.0.1:1055')
+  anywhere.proxyPort = null
+  assert.equal(anywhere.proxyUrl(), null)
+  assert.ok(!anywhere.daemonArgs().some((arg) => arg.includes('proxy')), 'no port, no flag')
+  assert.deepEqual(anywhere.peersFrom(status).map((p) => [p.name, p.dnsName]), [
+    ['iphone-14-pro', 'iphone-14-pro.tail1.ts.net'], ['other', 'other.tail1.ts.net'], ['STUDIO', 'pinokio-1.tail1.ts.net'], ['asleep', 'asleep.tail1.ts.net'],
+  ])
+})