pinokiod 8.2.33 → 8.2.34

package/kernel/anywhere/index.js

@@ -22,10 +22,8 @@ const crypto = require('crypto')
 const { spawn, execFile, execFileSync } = require('child_process')
 const TailscaleCLI = require('./cli')
 const writeJson = require('./state')
-const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS } = require('./serve')
+const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS } = require('./serve')
 const { loadPortMap, savePortMap, assignPorts } = require('./ports')
-const { Forwarders } = require('./forward')
-const net = require('net')
 const Util = require('../util')
 
 const DEFAULT_HOSTNAME = 'pinokio'
@@ -41,10 +39,6 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 class Anywhere {
   constructor(kernel) {
     this.kernel = kernel
-    // the daemon's outbound HTTP proxy, picked by pinokiod at each daemon start; null while down
-    this.proxyPort = null
-    this.ownedProxyPort = null     // the port on an adopted daemon's command line, set by ownedPid
-    this.forwarders = new Forwarders({ proxyUrl: () => this.proxyUrl(), serverPort: () => this.serverPort() })
     this.platform = kernel && kernel.platform ? kernel.platform : os.platform()
     this.child = null
     this.api = null
@@ -82,9 +76,6 @@ class Anywhere {
   pidPath() {
     return this.stateDir('tailscaled.pid')
   }
-  proxyUrl() {
-    return this.proxyPort ? `http://127.0.0.1:${this.proxyPort}` : null
-  }
   socketPath() {
     if (this._socketPath) return this._socketPath
     if (this.platform === 'win32') {
@@ -107,8 +98,7 @@ class Anywhere {
     }
     return null
   }
-  // proxyPort: the outbound proxy's loopback port; null describes a daemon from before the proxy existed
-  daemonArgs(proxyPort = this.proxyPort) {
+  daemonArgs() {
     const args = [
       '--tun=userspace-networking',
       '--state', this.stateDir('tailscaled.state'),
@@ -116,7 +106,6 @@ class Anywhere {
       '--socket', this.socketPath(),
       '--port', '0',
     ]
-    if (proxyPort) args.push(`--outbound-http-proxy-listen=127.0.0.1:${proxyPort}`)
     if (this.platform === 'win32') {
       // 1.104+: run as a per-user console process, no service / admin needed
       args.push('--windows-mode=dev')
@@ -245,17 +234,10 @@ class Anywhere {
     const alive = await this.daemonAlive()
     if (this.stopping) return false
     if (alive && (!(await this.assertOwnership()) || this.stopping)) return false
-    // a daemon this process started keeps its port; an adopted one gives the port on its command
-    // line, none for a daemon from before the proxy existed, so forwarding waits for its next start
-    if (alive) this.proxyPort = this.child ? this.proxyPort : this.ownedProxyPort
     if (!alive) {
       const pid = await this.readPid()
       if (this.stopping) return false
       if (pid) throw new Error('tailscaled is still running but its private endpoint is unavailable; no second daemon was started.')
-      // forwarders of a daemon that died relay to its proxy port; a new daemon gets new ones
-      await this.forwarders.stopAll()
-      // a free port now; the daemon fails to start if something takes it first, and Try again picks another
-      this.proxyPort = await freeLoopbackPort()
       const logFd = fs.openSync(this.logPath(), 'a')
       const env = Object.assign({}, process.env, {
         TS_LOGS_DIR: this.stateDir(),
@@ -273,7 +255,6 @@ class Anywhere {
         if (this.child === child) {
           // not a stop() of ours: surface it, the page offers "Try again"
           this.child = null
-          this.proxyPort = null   // its proxy went with it; the next start replaces the forwarders
           if (!this.stopping && !this.error) this.error = `tailscaled exited (code=${code} signal=${signal})`
           try { fs.rmSync(this.pidPath(), { force: true }) }
           catch (error) { this.error = `Could not remove tailscaled PID record: ${error.message}` }
@@ -344,18 +325,12 @@ class Anywhere {
   }
   ownedPid(inspection, command) {
     command = command.trim()
-    // the proxy port is whatever the running daemon was given; a daemon from before the
-    // proxy existed has none and is still ours. A match records the port for adoption.
-    const match = command.match(/--outbound-http-proxy-listen=127\.0\.0\.1:(\d+)/i)
-    const port = match ? Number(match[1]) : null
-    let expected = [this.binPath(), ...this.daemonArgs(port)].join(' ')
+    let expected = [this.binPath(), ...this.daemonArgs()].join(' ')
     if (this.platform === 'win32') {
       command = command.replace(/"/g, '').toLowerCase()
       expected = expected.toLowerCase()
     }
-    if (command !== expected) return null
-    this.ownedProxyPort = port
-    return inspection.pid
+    return command === expected ? inspection.pid : null
   }
   async readPid() {
     const inspection = this.pidInspection()
@@ -397,8 +372,6 @@ class Anywhere {
     this.child = null
     this.login = null
     this.api = null
-    this.proxyPort = null
-    await this.forwarders.stopAll()
     fs.rmSync(this.pidPath(), { force: true })
     this.lastStatus = null
     this.lastStatusAt = 0
@@ -545,7 +518,6 @@ class Anywhere {
       const generic = !hostName || /^(localhost|iphone|ipad|android)$/i.test(hostName)
       peers.push({
         name: (generic && dnsLabel) ? dnsLabel : (hostName || dnsLabel || key),
-        dnsName: p.DNSName ? String(p.DNSName).replace(/\.$/, '') : null,
         os: osName,
         mobile: MOBILE_OS.has(osName.toLowerCase()),
         online: !!p.Online,
@@ -641,24 +613,15 @@ class Anywhere {
     if (!dnsName || !this.config || !this.config.enabled) return false
     return String(host || '').toLowerCase().replace(/:443$/, '') === dnsName.toLowerCase()
   }
-  // A peer from `status --json` by the first label of its DNS name, the key
-  // of the peer routes; null for a name that is not a peer.
-  peerFor(label) {
-    if (!this.lastStatus || typeof label !== 'string') return null
-    const wanted = label.toLowerCase()
-    return this.peersFrom(this.lastStatus).find((p) => p.dnsName && p.dnsName.split('.')[0].toLowerCase() === wanted) || null
-  }
   // Rewrites one menu link for a visitor arriving through the Tailscale
   // address. Only a loopback link with a port is touched, and only when the
   // request's Host header is this node's name; any other request gets the
-  // href back unchanged. A visitor forwarded by another Pinokio gets the
-  // relative path its forwarder answers instead of this node's address.
-  rewriteHref(host, href, forwarded = false) {
+  // href back unchanged.
+  rewriteHref(host, href) {
     if (!this.isNodeHost(host)) return href
-    const routes = describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus))
-    return forwarded ? rewriteHrefForwarded(href, routes) : rewriteHref(href, routes)
+    return rewriteHref(href, describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus)))
   }
-  async rewriteMenu(host, menu, forwarded = false) {
+  async rewriteMenu(host, menu) {
     if (!Array.isArray(menu) || !this.isNodeHost(host)) return menu
     // Confirm new or changed routes on first render; refresh checks unchanged ones.
     const apps = this.appTargets()
@@ -671,7 +634,7 @@ class Anywhere {
       for (const item of items) {
         if (!item || typeof item !== 'object') continue
         if (typeof item.href === 'string') {
-          const next = this.rewriteHref(host, item.href, forwarded)
+          const next = this.rewriteHref(host, item.href)
           if (next !== item.href) {
             if (item.src === item.href) item.src = next
             if (item.target_full === item.href) item.target_full = next
@@ -779,7 +742,7 @@ class Anywhere {
     const dnsName = this.dnsNameFrom(status)
     const address = dnsName ? `https://${dnsName}` : null
     const account = this.accountFrom(status)
-    const peers = this.peersFrom(status).map(({ dnsName, ...peer }) => peer)   // DNS names serve the peer routes, not the payload
+    const peers = this.peersFrom(status)
     const out = Object.assign(base, {
       running: true,
       version: status.Version,
@@ -846,16 +809,4 @@ class Anywhere {
 }
 
 
-// A loopback port nothing is listening on right now, for the daemon's proxy.
-function freeLoopbackPort() {
-  return new Promise((resolve, reject) => {
-    const probe = net.createServer()
-    probe.once('error', reject)
-    probe.listen(0, '127.0.0.1', () => {
-      const { port } = probe.address()
-      probe.close(() => resolve(port))
-    })
-  })
-}
-
 module.exports = Anywhere

package/kernel/anywhere/serve.js

@@ -94,28 +94,12 @@ function sameServeConfig(a, b) {
   return isDeepStrictEqual(a || null, b || null)
 }
 
-// the path every forwarder answers itself (spec/requirements/pinokio-anywhere-api.md, Peers)
-const OPEN_PATH = '/.pinokio/open'
-
-// A loopback link with a port that a Serve route carries: its route and the
-// link's path, query and fragment; null for any other link.
-function routedLink(href, routes) {
+function rewriteHref(href, routes) {
   let url
-  try { url = new URL(String(href)) } catch (_) { return null }
-  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return null
+  try { url = new URL(String(href)) } catch (_) { return href }
+  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
   const route = routes.find((entry) => entry.local === Number(url.port))
-  return route ? { route, path: url.pathname + url.search + url.hash } : null
-}
-function rewriteHref(href, routes) {
-  const link = routedLink(href, routes)
-  return link ? link.route.url + link.path : href
-}
-// The same link for a visitor arriving through another Pinokio's forwarder: the
-// published port and the path on the relative path the forwarder answers, so
-// the caller maps the port on demand.
-function rewriteHrefForwarded(href, routes) {
-  const link = routedLink(href, routes)
-  return link ? `${OPEN_PATH}?port=${link.route.port}&to=${encodeURIComponent(link.path)}` : href
+  return route ? route.url + url.pathname + url.search + url.hash : href
 }
 
-module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, rewriteHrefForwarded, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT, OPEN_PATH }
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.33",
+  "version": "8.2.34",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -35,8 +35,6 @@ const TerminalApi = require('../kernel/api/terminal')
 const PluginSources = require("../kernel/plugin_sources")
 const ManagedSkills = require("../kernel/managed_skills")
 const { rewriteHref: rewriteAnywhereHref, LOOPBACK_HOSTS: ANYWHERE_LOOPBACK_HOSTS } = require("../kernel/anywhere/serve")
-const { openPath: anywhereOpenPath, FORWARDED_HEADER: ANYWHERE_FORWARDED_HEADER } = require("../kernel/anywhere/forward")
-const { FIRST_PORT: ANYWHERE_FIRST_PORT, LAST_PORT: ANYWHERE_LAST_PORT } = require("../kernel/anywhere/ports")
 const { menuTargets: launcherMenuTargets, isWebUrl } = require("../kernel/api/launcher_target")
 const { isPathRemovalBlockedError, removePath } = require("../kernel/path_removal")
 
@@ -1051,122 +1049,6 @@ class Server {
     const dnsName = anywhere && typeof anywhere.dnsNameFrom === "function" ? anywhere.dnsNameFrom(anywhere.lastStatus) : null
     return !!dnsName && parsed.protocol === "https:" && host === dnsName.toLowerCase()
   }
-  // a Host header on this computer itself (localhost, 127.0.0.1, [::1], with or without a port)
-  isLoopbackHost(host) {
-    const name = String(host || "").toLowerCase().replace(/:\d+$/, "")
-    return name === "localhost" || name === "127.0.0.1" || name === "[::1]"
-  }
-  // A request from a browser on this computer, as opposed to one that came through Tailscale
-  // Serve or another Pinokio: those also arrive on loopback, and a tailnet client chooses its
-  // own Host, but it cannot strip the headers Serve adds on the way or the peer marker.
-  isLocalRequest(req) {
-    const socket = req.socket && req.socket.remoteAddress
-    const loopback = socket === "127.0.0.1" || socket === "::1" || socket === "::ffff:127.0.0.1"
-    return loopback && this.isLoopbackHost(req.get("host")) && !req.get("X-Forwarded-For") && !req.get("X-Pinokio-Peer")
-  }
-  // the peer routes act on this computer's behalf: served on this computer only, to its own
-  // page only. Their redirects end on 127.0.0.1, which mean nothing anywhere else.
-  anywherePeerAllowed(req) {
-    if (!this.isLocalRequest(req)) return false
-    const origin = req.get("Origin")
-    if (!origin || origin === "https://pinokio.co") return true
-    try { return new URL(origin).host.toLowerCase() === String(req.get("host")).toLowerCase() } catch (_) { return false }
-  }
-  // the reason the peer routes cannot work right now, or null
-  anywherePeerUnavailable() {
-    const anywhere = this.kernel.anywhere
-    if (anywhere.proxyUrl()) return null
-    return anywhere.lastStatus && !anywhere.error ? "Turn Remote off and on to reach your other Pinokios" : "Remote is not running on this computer"
-  }
-  // Remote from computer to computer (spec/requirements/pinokio-anywhere-api.md, Peers):
-  // the other Pinokios on the tailnet, found by asking each online computer for its status
-  // through the daemon's proxy, their running apps linked through this node's forwarders.
-  async composeAnywherePeers() {
-    const anywhere = this.kernel.anywhere
-    const unavailable = this.anywherePeerUnavailable()
-    if (unavailable) return { status: 502, body: { error: unavailable } }
-    const candidates = anywhere.peersFrom(anywhere.lastStatus).filter((peer) => peer.online && !peer.mobile && peer.dnsName)
-    const probes = await Promise.allSettled(candidates.map(async (peer) => {
-      const answer = await anywhere.forwarders.request(`https://${peer.dnsName}/anywhere/status`, { timeoutMs: 4000 })
-      if (answer.status !== 200) return null
-      let status
-      try { status = JSON.parse(answer.body) } catch (_) { return null }
-      if (!status || typeof status.phase !== "string") return null
-      const label = peer.dnsName.split(".")[0]
-      const apps = Array.isArray(status.apps) ? status.apps : []
-      return {
-        name: label,
-        address: `https://${peer.dnsName}`,
-        apps: apps.map((app) => {
-          const { remote, ...rest } = app
-          return Object.assign(rest, { open: this.anywherePeerOpenPath(label, remote) })
-        }),
-      }
-    }))
-    return { status: 200, body: { peers: probes.map((probe) => probe.status === "fulfilled" ? probe.value : null).filter(Boolean) } }
-  }
-  // this node's open route for a peer's published address, or null for no address
-  anywherePeerOpenPath(label, remote) {
-    if (typeof remote !== "string") return null
-    let url
-    try { url = new URL(remote) } catch (_) { return null }
-    return anywhereOpenPath(label, url.port ? Number(url.port) : 443, url.pathname + url.search + url.hash)
-  }
-  // GET /anywhere/peers/<name>/open?port=<n>&to=<path>: { status, headers } or { status, body }
-  async anywherePeerOpen(name, query = {}) {
-    const anywhere = this.kernel.anywhere
-    const peer = anywhere.peerFor(name)
-    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
-    const port = Number(query.port)
-    if (!(port === 443 || (Number.isInteger(port) && port >= ANYWHERE_FIRST_PORT && port <= ANYWHERE_LAST_PORT))) {
-      return { status: 400, body: { error: `Not a Remote port: ${query.port}` } }
-    }
-    const unavailable = this.anywherePeerUnavailable()
-    if (unavailable) return { status: 502, body: { error: unavailable } }
-    let local
-    try {
-      local = await anywhere.forwarders.open(peer.dnsName, port)
-    } catch (error) {
-      return { status: 500, body: { error: error && error.message ? error.message : String(error) } }
-    }
-    // `to` resolved against the forwarder: encoded for the header, and never another origin
-    const base = `http://127.0.0.1:${local}/`
-    let location
-    try { location = new URL(typeof query.to === "string" ? query.to : "/", base) } catch (_) { location = new URL(base) }
-    if (location.origin !== new URL(base).origin) location = new URL(base)
-    return { status: 302, headers: { Location: location.href, "Cache-Control": "no-store" } }
-  }
-  // /anywhere/peers/<name>/<path>: the peer's own API through the daemon's proxy (API spec, Relays).
-  // JSON routes get the peer's published addresses turned into this node's open routes, absolute,
-  // since the client may be pinokio.co on another origin; an asset is passed through as it is.
-  async relayAnywherePeer(name, method, relayPath, body = {}) {
-    const anywhere = this.kernel.anywhere
-    const peer = anywhere.peerFor(name)
-    if (!peer) return { status: 400, body: { error: `Not a computer on your network: ${name}` } }
-    const unavailable = this.anywherePeerUnavailable()
-    if (unavailable) return { status: 502, body: { error: unavailable } }
-    const json = relayPath.startsWith("anywhere/")
-    let answer
-    try {
-      answer = await anywhere.forwarders.request(`https://${peer.dnsName}/${relayPath}`, method === "POST"
-        ? { method, headers: { "Content-Type": "application/json" }, body: JSON.stringify(body || {}), timeoutMs: 30000 }
-        : { method, timeoutMs: 8000 })
-    } catch (error) {
-      return { status: 502, body: { error: `Could not reach ${peer.name}: ${error && error.message ? error.message : error}` } }
-    }
-    if (!json) return { status: answer.status, raw: answer.raw, contentType: answer.headers["content-type"] || "application/octet-stream" }
-    let parsed
-    try { parsed = JSON.parse(answer.body) } catch (_) {
-      return { status: 502, body: { error: `${peer.name} did not answer with JSON (HTTP ${answer.status})` } }
-    }
-    const own = (url) => { try { return new URL(url).hostname.toLowerCase() === peer.dnsName.toLowerCase() } catch (_) { return false } }
-    const route = (url) => `http://127.0.0.1:${anywhere.serverPort()}${this.anywherePeerOpenPath(peer.dnsName.split(".")[0], url)}`
-    if (parsed && Array.isArray(parsed.apps)) {
-      for (const app of parsed.apps) if (app && typeof app.remote === "string" && own(app.remote)) app.remote = route(app.remote)
-    }
-    if (parsed && parsed.action === "open" && typeof parsed.url === "string" && own(parsed.url)) parsed.url = route(parsed.url)
-    return { status: answer.status, body: parsed }
-  }
   // the app's menu as launch targets: scripts and web addresses, never interface links;
   // text is plain: a launcher may write HTML, which the desktop renders and the phone does not
   async anywhereMenu(api, repoPath) {
@@ -5194,8 +5076,7 @@ class Server {
       // published app's fixed https address; any other host is left for the
       // Home Server rewrite below, exactly as before.
       if (this.kernel.anywhere) {
-        // a visitor forwarded by another Pinokio gets links its forwarder answers (API spec, Peers)
-        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu, req.get(ANYWHERE_FORWARDED_HEADER) === "1")
+        await this.kernel.anywhere.rewriteMenu(req.$source && req.$source.host, config.menu)
       }
       config = Util.rewrite_localhost(this.kernel, config, req.$source)
       return config
@@ -7007,12 +6888,6 @@ class Server {
         this.kernel.vault.automaticScans.supported)
       next()
     })
-    // pinokio.co's Remote tab reaches the peer routes from a browser on this computer; Chrome's
-    // local network access wants this on the preflight, which the cors middleware below answers
-    this.app.use("/anywhere/peers", (req, res, next) => {
-      if (req.get("Access-Control-Request-Private-Network")) res.set("Access-Control-Allow-Private-Network", "true")
-      next()
-    })
     this.app.use(cors({
       origin: '*'
     }));
@@ -14485,8 +14360,6 @@ class Server {
         status,
         theme: this.theme,
         agent: req.agent,
-        // Your other Pinokios links end on 127.0.0.1, which mean nothing to a phone reading this page
-        loopback: this.isLocalRequest(req),
       })
     }))
     this.app.get("/anywhere/status", ex(async (req, res) => {
@@ -14513,32 +14386,6 @@ class Server {
     })
     this.app.post("/anywhere/apps/launch", anywhereAppAction((body) => this.composeAnywhereLaunch(body)))
     this.app.post("/anywhere/apps/stop", anywhereAppAction((body) => this.composeAnywhereStop(body)))
-    // the other Pinokios on the tailnet, for this computer's own Remote page (API spec, Peers)
-    const anywherePeerRoute = (fn) => ex(async (req, res) => {
-      res.set("Cache-Control", "no-store")
-      if (!this.anywherePeerAllowed(req)) {
-        res.status(403).json({ error: "Allowed only on this computer" })
-        return
-      }
-      try {
-        const answer = await fn(req)
-        if (answer.headers) res.set(answer.headers)
-        if (answer.raw) res.status(answer.status).type(answer.contentType).send(answer.raw)
-        else if (answer.body === undefined) res.status(answer.status).end()
-        else res.status(answer.status).json(answer.body)
-      } catch (error) {
-        res.status(500).json({ error: error && error.message ? error.message : String(error) })
-      }
-    })
-    this.app.get("/anywhere/peers", anywherePeerRoute(() => this.composeAnywherePeers()))
-    this.app.get("/anywhere/peers/:name/open", anywherePeerRoute((req) => this.anywherePeerOpen(req.params.name, req.query)))
-    // the peer's own API under its prefix: a client swaps the peer's address for this prefix and changes nothing else
-    const anywhereRelay = (method, relayPath) => anywherePeerRoute((req) => this.relayAnywherePeer(req.params.name, method, relayPath(req), req.body))
-    this.app.get("/anywhere/peers/:name/anywhere/status", anywhereRelay("GET", () => "anywhere/status"))
-    this.app.get("/anywhere/peers/:name/anywhere/apps", anywhereRelay("GET", () => "anywhere/apps"))
-    this.app.post("/anywhere/peers/:name/anywhere/apps/launch", anywhereRelay("POST", () => "anywhere/apps/launch"))
-    this.app.post("/anywhere/peers/:name/anywhere/apps/stop", anywhereRelay("POST", () => "anywhere/apps/stop"))
-    this.app.get("/anywhere/peers/:name/asset/*", anywhereRelay("GET", (req) => "asset/" + encodeURI(req.params[0])))
     const anywhereAction = (label, fn) => ex(async (req, res) => {
       const anywhere = this.kernel.anywhere
       if (!anywhere) {

package/server/views/anywhere.ejs

@@ -40,7 +40,7 @@ body.dark .anywhere-card { border-color: rgba(255,255,255,0.1); background: rgba
 .anywhere-muted { opacity: 0.7; font-size: 13px; }
 .anywhere-grid { display: grid; grid-template-columns: minmax(280px, 380px) 1fr; gap: 16px; align-items: start; }
 @media (max-width: 900px) { .anywhere-grid { grid-template-columns: 1fr; } }
-.anywhere-signout, .anywhere-linkbtn { background: none; border: none; padding: 0; font: inherit; color: inherit; text-decoration: underline; cursor: pointer; }
+.anywhere-signout { background: none; border: none; padding: 0; font: inherit; color: inherit; text-decoration: underline; cursor: pointer; }
 /* which device is connecting: a segmented control, the phone panel by default */
 .anywhere-segments { display: grid; grid-template-columns: 1fr 1fr; width: 100%; padding: 4px; border-radius: 12px; background: rgba(0,0,0,0.05); }
 body.dark .anywhere-segments { background: rgba(255,255,255,0.08); }
@@ -258,13 +258,6 @@ document.addEventListener('DOMContentLoaded', function() {
                 <h3>Published addresses</h3>
                 <div id='anywhere-ports' class='anywhere-muted'></div>
               </div>
-              <% if (locals.loopback) { %>
-              <div class='anywhere-card'>
-                <h2>Your other Pinokios</h2>
-                <p class='anywhere-muted'>Computers on your network with Remote on. They open through this Pinokio; nothing else to install.</p>
-                <div id='anywhere-others'><p class='anywhere-muted'>Looking…</p></div>
-              </div>
-              <% } %>
               <div class='anywhere-card'>
                 <h2>Devices on your network</h2>
                 <div id='anywhere-peers'></div>
@@ -477,56 +470,6 @@ document.addEventListener('DOMContentLoaded', function() {
     }
   }
 
-  // Your other Pinokios: only on a loopback host, refreshed with each status poll while ready
-  const others = document.getElementById('anywhere-others')
-  let othersBusy = false
-  let othersNote = ''   // the last failed action, shown until the next one
-  const renderOthers = (peers) => {
-    if (!others) return
-    others.innerHTML = (othersNote ? `<p class='anywhere-error'>${esc(othersNote)}</p>` : '') + (peers.length === 0
-      ? `<p class='anywhere-muted'>No other Pinokio with Remote on is online.</p>`
-      : peers.map((peer) => `
-        <div class='anywhere-row anywhere-other' data-peer='${esc(peer.name)}'>
-          <i class='fa-solid fa-desktop'></i>
-          <div class='grow'>
-            <div class='title'>${esc(peer.name)} <a class='remote' href='/anywhere/peers/${encodeURIComponent(peer.name)}/open?port=443&to=%2F' target='_blank' rel='noopener'>Open Pinokio</a></div>
-            ${(peer.apps || []).length === 0 ? `<div class='sub'>no app running</div>` : peer.apps.map((app) => `
-              <div class='sub'>${esc(app.name)} ${app.open ? `<a class='remote' href='${esc(app.open)}' target='_blank' rel='noopener'>Open</a>` : `<span class='anywhere-badge'>${esc(app.state || 'starting')}</span>`} · <button type='button' class='anywhere-linkbtn' data-stop='${esc(app.id)}'>Stop</button></div>`).join('')}
-          </div>
-        </div>`).join(''))
-  }
-  const refreshOthers = async () => {
-    if (!others || othersBusy || current.phase !== 'ready') return
-    othersBusy = true
-    try {
-      const response = await fetch('/anywhere/peers', { cache: 'no-store' })
-      const answer = await response.json().catch(() => ({}))
-      if (!response.ok) throw new Error(answer.error || `HTTP ${response.status}`)
-      renderOthers(answer.peers || [])
-    } catch (e) {
-      others.innerHTML = `<p class='anywhere-muted'>Could not look for other Pinokios: ${esc(e.message)}</p>`
-    } finally {
-      othersBusy = false
-    }
-  }
-  if (others) {
-    others.addEventListener('click', async (event) => {
-      const button = event.target.closest('button[data-stop]')
-      if (!button) return
-      const peer = button.closest('[data-peer]').dataset.peer
-      button.disabled = true
-      othersNote = ''
-      try {
-        const response = await fetch(`/anywhere/peers/${encodeURIComponent(peer)}/anywhere/apps/stop`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ id: button.dataset.stop }) })
-        const answer = await response.json().catch(() => ({}))
-        if (!response.ok) othersNote = `Could not stop it on ${peer}: ${answer.error || `HTTP ${response.status}`}`
-      } catch (e) {
-        othersNote = `Could not stop it on ${peer}: ${e.message}`
-      }
-      await refreshOthers()
-    })
-  }
-
   const poll = async () => {
     try {
       const response = await fetch('/anywhere/status', { cache: 'no-store' })
@@ -535,7 +478,6 @@ document.addEventListener('DOMContentLoaded', function() {
     } catch (e) {
       render(Object.assign({}, current, { phase: 'error', error: e.message }))
     }
-    refreshOthers()
     const phase = current.phase || ''
     const delay = (phase === 'ready' || phase === 'off') ? 5000 : 2000
     setTimeout(poll, delay)
@@ -595,7 +537,6 @@ document.addEventListener('DOMContentLoaded', function() {
   })
 
   render(current)
-  refreshOthers()
   setTimeout(poll, 1500)
 })()
 </script>

package/kernel/anywhere/forward.js

@@ -1,171 +0,0 @@
-/*
-  Forwarders for Remote from computer to computer
-  (spec/requirements/pinokio-anywhere.md, Other Pinokios; the routes in
-  spec/requirements/pinokio-anywhere-api.md, Peers).
-
-  The bundled tailscaled runs in userspace networking mode, so the browser on
-  this computer has no route to tailnet addresses. The daemon does, and
-  exposes it as a plain HTTP proxy on loopback (--outbound-http-proxy-listen).
-  A forwarder is one loopback port that relays HTTP requests and upgrades
-  through that proxy, with TLS to one peer's .ts.net name on one remote port.
-  The peer sees an ordinary tailnet client; the browser talks plain HTTP to
-  127.0.0.1, as it does to Pinokio itself.
-
-  Every forwarder answers /.pinokio/open itself, never relaying it: a peer on
-  this revision rewrites the links inside its interface to that path, and the
-  redirect lands on this node's `open` route, which maps the port on demand.
-*/
-const http = require('http')
-const https = require('https')
-const httpProxy = require('http-proxy')
-const { ProxyAgent } = require('proxy-agent')
-const { OPEN_PATH } = require('./serve')
-
-const FORWARDED_HEADER = 'x-pinokio-forwarded'
-// honoured by the peer middleware's trust; a forwarder never sends them
-const STRIPPED_HEADERS = ['x-pinokio-peer', 'x-pinokio-source-host', 'x-pinokio-source-proto']
-
-// This node's `open` route for a peer and port, relative for the page's links.
-function openPath(label, port, to) {
-  return `/anywhere/peers/${encodeURIComponent(label)}/open?port=${Number(port)}&to=${encodeURIComponent(to || '/')}`
-}
-
-// The headers go out as the incoming request's headers. Setting them in http-proxy's proxyReq
-// hook instead would throw: with the proxy agent the hook fires once the CONNECT completes, and
-// by then the outgoing headers are already written.
-function mark(req) {
-  for (const name of STRIPPED_HEADERS) delete req.headers[name]
-  req.headers[FORWARDED_HEADER] = '1'
-}
-
-class Forwarders {
-  // proxyUrl: () => 'http://127.0.0.1:<port>' or null while the daemon is down
-  // serverPort: () => pinokiod's own port
-  // scheme exists for the tests, which forward to a plain local server instead of
-  // TLS through the proxy; the product never passes it.
-  constructor({ proxyUrl, serverPort, scheme = 'https' } = {}) {
-    this.proxyUrl = proxyUrl
-    this.serverPort = serverPort
-    this.scheme = scheme
-    this.agents = new Map()          // proxy URL -> agent, one per daemon start
-    this.servers = new Map()         // "<dnsName>:<port>" -> { port, server, proxy, sockets } or { pending }
-  }
-  agent() {
-    const url = this.proxyUrl()
-    if (this.scheme === 'https' && !url) throw new Error('Remote is not running on this computer')
-    if (!url) return undefined
-    // proxy-agent picks CONNECT-then-TLS for an http:// proxy and an https target
-    if (!this.agents.has(url)) this.agents.set(url, new ProxyAgent({ keepAlive: true, getProxyForUrl: () => url }))
-    return this.agents.get(url)
-  }
-  // One request to a peer through the proxy, for the status probe and the launch/stop relay.
-  async request(url, options) {
-    return requestThroughProxy(this.agent(), url, options)
-  }
-  // Finds or starts the forwarder for (dnsName, port); resolves to its loopback port.
-  async open(dnsName, port) {
-    const key = `${String(dnsName).toLowerCase()}:${Number(port)}`
-    const existing = this.servers.get(key)
-    if (existing) return existing.port || (await existing.pending).port
-    const pending = this.start(dnsName, Number(port))
-    this.servers.set(key, { pending })
-    try {
-      const entry = await pending
-      this.servers.set(key, entry)
-      return entry.port
-    } catch (error) {
-      this.servers.delete(key)
-      throw error
-    }
-  }
-  async start(dnsName, port) {
-    const label = String(dnsName).split('.')[0]
-    const target = `${this.scheme}://${dnsName}:${port}`
-    const proxy = httpProxy.createProxyServer({ target, agent: this.agent(), changeOrigin: true, secure: true, ws: true })
-    proxy.on('error', (error, req, res) => {
-      const message = `Could not reach ${dnsName}: ${error && error.message ? error.message : error}`
-      if (res && typeof res.writeHead === 'function' && !res.headersSent) {
-        res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' })
-        res.end(message)
-      } else if (res && typeof res.destroy === 'function') {
-        res.destroy()
-      }
-    })
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url, 'http://127.0.0.1')
-      if (url.pathname === OPEN_PATH) {
-        const port = Number(url.searchParams.get('port'))
-        if (!Number.isInteger(port) || port <= 0) {
-          res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
-          res.end('Not a Remote port')
-          return
-        }
-        const route = openPath(label, port, url.searchParams.get('to') || '/')
-        res.writeHead(302, { Location: `http://127.0.0.1:${this.serverPort()}${route}`, 'Cache-Control': 'no-store' })
-        res.end()
-        return
-      }
-      mark(req)
-      proxy.web(req, res)
-    })
-    server.on('upgrade', (req, socket, head) => {
-      mark(req)
-      proxy.ws(req, socket, head)
-    })
-    // every connection on both sides, upgraded ones included, so stopAll can end a stream a
-    // tab still holds; destroying only the browser's side would leave the peer's side piped open
-    const sockets = new Set()
-    const track = (socket) => {
-      sockets.add(socket)
-      socket.once('close', () => sockets.delete(socket))
-    }
-    server.on('connection', track)
-    proxy.on('open', track)
-    await new Promise((resolve, reject) => {
-      server.once('error', reject)
-      server.listen(0, '127.0.0.1', () => { server.off('error', reject); resolve() })
-    })
-    return { port: server.address().port, server, proxy, sockets }
-  }
-  // Ends every forwarder, open streams included: they belong to the daemon that is going away.
-  async stopAll() {
-    const entries = [...this.servers.values()]
-    this.servers.clear()
-    for (const agent of this.agents.values()) if (typeof agent.destroy === 'function') agent.destroy()
-    this.agents.clear()
-    await Promise.all(entries.map(async (entry) => {
-      const live = entry.server ? entry : await entry.pending.catch(() => null)
-      if (!live) return
-      live.proxy.close()
-      for (const socket of live.sockets) socket.destroy()
-      await new Promise((resolve) => live.server.close(resolve))
-    }))
-  }
-}
-
-// Resolves { status, headers, raw, body }; rejects on a transport failure or when the whole
-// request, the proxy's CONNECT included, exceeds the deadline.
-function requestThroughProxy(agent, url, { method = 'GET', headers = {}, body = null, timeoutMs = 4000 } = {}) {
-  return new Promise((resolve, reject) => {
-    const target = new URL(url)
-    const lib = target.protocol === 'https:' ? https : http
-    // the deadline is kept here, not as the request's signal: while the agent's CONNECT is still
-    // pending the request has no socket, and Node reports an abort only once it gets one
-    const deadline = setTimeout(() => { reject(new Error(`no answer in ${Math.round(timeoutMs / 1000)} s`)); req.destroy() }, timeoutMs)
-    const req = lib.request(target, { method, headers, agent }, (res) => {
-      const chunks = []
-      res.on('data', (chunk) => chunks.push(chunk))
-      res.on('end', () => {
-        clearTimeout(deadline)
-        const raw = Buffer.concat(chunks)
-        resolve({ status: res.statusCode, headers: res.headers, raw, body: raw.toString('utf8') })
-      })
-      res.on('error', (error) => { clearTimeout(deadline); reject(error) })
-    })
-    req.on('error', (error) => { clearTimeout(deadline); reject(error) })
-    if (body != null) req.write(body)
-    req.end()
-  })
-}
-
-module.exports = { Forwarders, openPath, FORWARDED_HEADER }

package/test/anywhere-forward.test.js

@@ -1,168 +0,0 @@
-const assert = require('node:assert/strict')
-const http = require('node:http')
-const test = require('node:test')
-const { once } = require('node:events')
-const WebSocket = require('ws')
-const { Forwarders } = require('../kernel/anywhere/forward')
-
-// Forwarders (spec/requirements/pinokio-anywhere.md, Other Pinokios; the
-// API spec, Peers): one loopback port relaying to one peer and port. The
-// peer here is a plain local server, so the TLS-through-proxy layer is
-// replaced by the http scheme and no agent; what is checked is the relay.
-
-async function peer(t) {
-  const seen = []
-  const server = http.createServer((req, res) => {
-    seen.push({ url: req.url, headers: req.headers, method: req.method })
-    let body = ''
-    req.on('data', (chunk) => { body += chunk })
-    req.on('end', () => {
-      res.writeHead(200, { 'Content-Type': 'application/json' })
-      res.end(JSON.stringify({ url: req.url, host: req.headers.host, forwarded: req.headers['x-pinokio-forwarded'] || null, peer: req.headers['x-pinokio-peer'] || null, body }))
-    })
-  })
-  const wss = new WebSocket.Server({ server })
-  wss.on('connection', (socket, req) => {
-    socket.on('message', (message) => socket.send(`echo:${message} forwarded=${req.headers['x-pinokio-forwarded'] || 'none'} peer=${req.headers['x-pinokio-peer'] || 'none'}`))
-  })
-  server.listen(0, '127.0.0.1')
-  await once(server, 'listening')
-  t.after(() => new Promise((resolve) => { wss.close(); server.close(resolve); server.closeAllConnections() }))
-  return { port: server.address().port, seen }
-}
-
-const get = (port, path, headers = {}) => new Promise((resolve, reject) => {
-  http.get({ host: '127.0.0.1', port, path, headers }, (res) => {
-    let body = ''
-    res.on('data', (chunk) => { body += chunk })
-    res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }))
-  }).on('error', reject)
-})
-
-test('a forwarder relays requests with the forwarded header, the peer as Host, and no trusted peer headers', async (t) => {
-  const target = await peer(t)
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  t.after(() => forwarders.stopAll())
-  const local = await forwarders.open('127.0.0.1', target.port)
-  assert.equal(await forwarders.open('127.0.0.1', target.port), local, 'the same peer and port reuse the forwarder')
-  const answer = await get(local, '/ui/?a=1', { 'X-Pinokio-Peer': '1', 'X-Pinokio-Source-Host': 'evil', 'X-Pinokio-Source-Proto': 'https' })
-  assert.equal(answer.status, 200)
-  const body = JSON.parse(answer.body)
-  assert.equal(body.url, '/ui/?a=1')
-  assert.equal(body.host, `127.0.0.1:${target.port}`, 'Host names the peer, not the loopback port')
-  assert.equal(body.forwarded, '1')
-  assert.equal(body.peer, null, 'the existing peer-trust headers never pass through')
-  assert.equal(target.seen[0].headers['x-pinokio-source-host'], undefined)
-})
-
-// A forward proxy for plain http targets: the real ProxyAgent sends it absolute URLs, and
-// connects asynchronously, which is what broke the proxyReq-hook version in production.
-async function forwardProxy(t) {
-  const server = http.createServer((req, res) => {
-    const target = new URL(req.url)
-    const upstream = http.request({ host: target.hostname, port: target.port, path: target.pathname + target.search, method: req.method, headers: req.headers }, (answer) => {
-      res.writeHead(answer.statusCode, answer.headers)
-      answer.pipe(res)
-    })
-    upstream.on('error', (error) => { res.writeHead(502); res.end(error.message) })
-    req.pipe(upstream)
-  })
-  server.listen(0, '127.0.0.1')
-  await once(server, 'listening')
-  t.after(() => { server.closeAllConnections(); server.close() })
-  return `http://127.0.0.1:${server.address().port}`
-}
-
-test('through the real proxy agent, whose connection completes later, the forwarded header still goes out and nothing throws', async (t) => {
-  const target = await peer(t)
-  const proxyUrl = await forwardProxy(t)
-  const forwarders = new Forwarders({ proxyUrl: () => proxyUrl, serverPort: () => 42000, scheme: 'http' })
-  t.after(() => forwarders.stopAll())
-  const local = await forwarders.open('127.0.0.1', target.port)
-  const answer = await get(local, '/ui/?a=1', { 'X-Pinokio-Peer': '1' })
-  assert.equal(answer.status, 200)
-  const body = JSON.parse(answer.body)
-  assert.equal(body.forwarded, '1')
-  assert.equal(body.peer, null)
-  assert.equal(body.host, `127.0.0.1:${target.port}`)
-  assert.equal(target.seen.length, 1)
-})
-
-test('two opens of the same peer and port at once share one forwarder', async (t) => {
-  const target = await peer(t)
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  t.after(() => forwarders.stopAll())
-  const [a, b] = await Promise.all([forwarders.open('127.0.0.1', target.port), forwarders.open('127.0.0.1', target.port)])
-  assert.ok(Number.isInteger(a) && a > 0)
-  assert.equal(a, b)
-})
-
-test('a forwarder answers /.pinokio/open itself with a redirect to this node\'s open route', async (t) => {
-  const target = await peer(t)
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  t.after(() => forwarders.stopAll())
-  const local = await forwarders.open('pinokio-1.tail1.ts.net', target.port)
-  const answer = await get(local, '/.pinokio/open?port=43001&to=%2Fui%2F%3Fa%3D1%23view')
-  assert.equal(answer.status, 302)
-  assert.equal(answer.headers.location, 'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43001&to=%2Fui%2F%3Fa%3D1%23view')
-  assert.equal((await get(local, '/.pinokio/open?to=%2F')).status, 400, 'a link without a port does not bounce through pinokiod')
-  assert.equal(target.seen.length, 0, 'never relayed')
-})
-
-test('a forwarder relays a WebSocket upgrade', async (t) => {
-  const target = await peer(t)
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  t.after(() => forwarders.stopAll())
-  const local = await forwarders.open('127.0.0.1', target.port)
-  const socket = new WebSocket(`ws://127.0.0.1:${local}/socket`, { headers: { 'X-Pinokio-Peer': '1' } })
-  await once(socket, 'open')
-  socket.send('hi')
-  const [message] = await once(socket, 'message')
-  assert.equal(String(message), 'echo:hi forwarded=1 peer=none', 'the forwarded header is added and the trust header dropped on the upgrade path too')
-  socket.close()
-})
-
-test('a peer that cannot be reached answers 502, and stopAll closes every forwarder, an open WebSocket included', async (t) => {
-  const target = await peer(t)
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  const dead = await forwarders.open('127.0.0.1', 1)
-  const answer = await get(dead, '/')
-  assert.equal(answer.status, 502)
-  assert.match(answer.body, /Could not reach 127\.0\.0\.1/)
-  const live = await forwarders.open('127.0.0.1', target.port)
-  const socket = new WebSocket(`ws://127.0.0.1:${live}/socket`)
-  await once(socket, 'open')
-  const closed = once(socket, 'close')
-  const stopped = forwarders.stopAll()
-  await Promise.race([stopped, new Promise((_, reject) => setTimeout(() => reject(new Error('stopAll hung on the open WebSocket')), 2000))])
-  await closed
-  await assert.rejects(get(live, '/'), /ECONNREFUSED/)
-})
-
-test('the https scheme refuses to forward while the daemon is down', () => {
-  const forwarders = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000 })
-  assert.throws(() => forwarders.agent(), /Remote is not running/)
-})
-
-test('a request to a peer returns status and body, and the deadline covers the connection itself', async (t) => {
-  const target = await peer(t)
-  const plain = new Forwarders({ proxyUrl: () => null, serverPort: () => 42000, scheme: 'http' })
-  const answer = await plain.request(`http://127.0.0.1:${target.port}/anywhere/status`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{"id":"x"}' })
-  assert.equal(answer.status, 200)
-  assert.equal(JSON.parse(answer.body).body, '{"id":"x"}')
-  const silent = http.createServer(() => { /* never answers */ })
-  silent.listen(0, '127.0.0.1')
-  await once(silent, 'listening')
-  t.after(() => { silent.closeAllConnections(); silent.close() })
-  await assert.rejects(plain.request(`http://127.0.0.1:${silent.address().port}/`, { timeoutMs: 200 }), /no answer in 0 s/)
-  // a proxy that accepts and never answers the CONNECT, through the real agent: the deadline
-  // still fires there, where a socket timeout would not have started yet
-  const held = []
-  const stuckProxy = require('node:net').createServer((socket) => { held.push(socket) /* never answers */ })
-  stuckProxy.listen(0, '127.0.0.1')
-  await once(stuckProxy, 'listening')
-  t.after(() => { for (const socket of held) socket.destroy(); stuckProxy.close() })
-  const forwarders = new Forwarders({ proxyUrl: () => `http://127.0.0.1:${stuckProxy.address().port}`, serverPort: () => 42000 })
-  t.after(() => forwarders.stopAll())
-  await assert.rejects(forwarders.request('https://peer.tail1.ts.net/anywhere/status', { timeoutMs: 300 }), /no answer in 0 s/)
-})

package/test/anywhere-others.test.js

@@ -1,96 +0,0 @@
-const assert = require('node:assert/strict')
-const fs = require('node:fs')
-const path = require('node:path')
-const test = require('node:test')
-const ejs = require('ejs')
-const { JSDOM, VirtualConsole } = require('jsdom')
-
-// The Remote page's "Your other Pinokios" section (spec/requirements/
-// pinokio-anywhere.md, Other Pinokios): on a loopback host only, filled from
-// /anywhere/peers at each status poll while ready, stop relayed per app.
-const filename = path.resolve(__dirname, '../server/views/anywhere.ejs')
-const template = fs.readFileSync(filename, 'utf8')
-const address = 'https://pinokio.tail123.ts.net'
-const ready = { phase: 'ready', enabled: true, address, connectUrl: 'https://pinokio.co/anywhere/connect#u=x', dnsName: 'pinokio.tail123.ts.net', account: { email: 'me@example.com' }, peers: [{ name: 'STUDIO', os: 'windows', online: true }], apps: [], serve: [] }
-
-function render(t, { loopback, peers }) {
-  const state = { calls: [], timers: [], peers }
-  const html = ejs.render(template, { theme: 'light', agent: 'electron', status: ready, loopback }, { filename, includer: () => ({ template: ' ' }) })
-  const virtualConsole = new VirtualConsole()
-  virtualConsole.on('jsdomError', (error) => { throw error })
-  const dom = new JSDOM(html, {
-    url: 'http://127.0.0.1:42000/anywhere', runScripts: 'dangerously', pretendToBeVisual: true, virtualConsole,
-    beforeParse(window) {
-      window.setTimeout = (callback, delay) => state.timers.push({ callback, delay })
-      window.fetch = async (url, options = {}) => {
-        state.calls.push({ url, method: options.method || 'GET', body: options.body })
-        if (url === '/anywhere/status') return { ok: true, json: async () => ({ ...ready }) }
-        if (url === '/anywhere/peers') return state.peersError ? { ok: false, status: 502, json: async () => ({ error: state.peersError }) } : { ok: true, json: async () => ({ peers: state.peers }) }
-        if (state.stopFails) return { ok: false, status: 502, json: async () => ({ error: 'no answer in 30 s' }) }
-        return { ok: true, json: async () => ({ action: 'stopped' }) }
-      }
-      window.open = () => {}
-    },
-  })
-  t.after(() => dom.window.close())
-  const document = dom.window.document
-  // the poll: status, then the peers refresh it starts; let both settle
-  const poll = async () => { state.timers.shift().callback(); await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve)) }
-  return { state, document, poll, section: () => document.getElementById('anywhere-others') }
-}
-
-test('on a loopback host the section lists each other Pinokio with Open Pinokio and its apps through the open route', async (t) => {
-  const h = render(t, { loopback: true, peers: [
-    { name: 'pinokio-1', apps: [
-      { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2F' },
-      { id: 'forge', name: 'Forge', state: 'starting', exposed: false, open: null },
-    ] },
-    { name: 'other', apps: [] },
-  ] })
-  assert.ok(h.section(), 'the card exists before the first answer')
-  await h.poll()
-  assert.deepEqual(h.state.calls.map((call) => call.url), ['/anywhere/peers', '/anywhere/status', '/anywhere/peers'], 'once on load, then with each status poll')
-  const rows = [...h.section().querySelectorAll('[data-peer]')]
-  assert.deepEqual(rows.map((row) => row.dataset.peer), ['pinokio-1', 'other'])
-  const links = [...rows[0].querySelectorAll('a')].map((a) => [a.textContent, a.getAttribute('href')])
-  assert.deepEqual(links, [['Open Pinokio', '/anywhere/peers/pinokio-1/open?port=443&to=%2F'], ['Open', '/anywhere/peers/pinokio-1/open?port=43000&to=%2F']])
-  assert.match(rows[0].textContent, /Forge/)
-  assert.ok(rows[0].querySelector('.anywhere-badge'), 'an app without an address shows its state instead of a link')
-  assert.match(rows[1].textContent, /no app running/)
-  assert.doesNotMatch(h.section().textContent, /Looking…/)
-})
-
-test('with none found the section says so, and a stop is relayed to the peer then refreshed', async (t) => {
-  const h = render(t, { loopback: true, peers: [] })
-  await h.poll()
-  assert.match(h.section().textContent, /No other Pinokio with Remote on is online/)
-  h.state.peers = [{ name: 'pinokio-1', apps: [{ id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2F' }] }]
-  await h.poll()
-  const stop = h.section().querySelector('button[data-stop="comfy"]')
-  assert.ok(stop)
-  stop.click()
-  await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve))
-  const posted = h.state.calls.find((call) => call.method === 'POST')
-  assert.deepEqual([posted.url, posted.body], ['/anywhere/peers/pinokio-1/anywhere/apps/stop', '{"id":"comfy"}'])
-  assert.equal(h.state.calls.filter((call) => call.url === '/anywhere/peers').length, 4, 'load, two polls, and once more after the stop')
-  assert.equal(h.section().querySelector('.anywhere-error'), null)
-  h.state.stopFails = true
-  h.section().querySelector('button[data-stop="comfy"]').click()
-  await new Promise((resolve) => setImmediate(resolve)); await new Promise((resolve) => setImmediate(resolve))
-  assert.match(h.section().querySelector('.anywhere-error').textContent, /Could not stop it on pinokio-1: no answer in 30 s/)
-  assert.ok(h.section().querySelector('[data-peer="pinokio-1"]'), 'the list is still there under the note')
-})
-
-test('while the daemon runs without the proxy, the section shows the reason the server gives', async (t) => {
-  const h = render(t, { loopback: true, peers: [] })
-  h.state.peersError = 'Turn Remote off and on to reach your other Pinokios'
-  await h.poll()
-  assert.match(h.section().textContent, /Could not look for other Pinokios: Turn Remote off and on to reach your other Pinokios/)
-})
-
-test('through the node\'s own Tailscale name there is no section and no peers request', async (t) => {
-  const h = render(t, { loopback: false, peers: [{ name: 'pinokio-1', apps: [] }] })
-  assert.equal(h.section(), null)
-  await h.poll()
-  assert.deepEqual(h.state.calls.map((call) => call.url), ['/anywhere/status'], 'no peers request at load or at the poll')
-})

package/test/anywhere-peers.test.js

@@ -1,223 +0,0 @@
-const assert = require('node:assert/strict')
-const test = require('node:test')
-const Server = require('../server/index.js')
-const Anywhere = require('../kernel/anywhere')
-const { buildServeConfig } = require('../kernel/anywhere/serve')
-
-// The peer routes (spec/requirements/pinokio-anywhere-api.md, Peers) and the
-// forwarded link rewrite, with the proxy request and the forwarders stubbed.
-
-const status = {
-  Self: { DNSName: 'pinokio.tail1.ts.net.' },
-  Peer: {
-    a: { HostName: 'STUDIO', DNSName: 'pinokio-1.tail1.ts.net.', OS: 'windows', Online: true, TailscaleIPs: ['100.1.1.1'] },
-    b: { HostName: 'iphone', DNSName: 'iphone-14-pro.tail1.ts.net.', OS: 'iOS', Online: true },
-    c: { HostName: 'asleep', DNSName: 'asleep.tail1.ts.net.', OS: 'macOS', Online: false },
-    d: { HostName: 'other', DNSName: 'other.tail1.ts.net.', OS: 'linux', Online: true },
-  },
-}
-
-function anywhereWith(requests = {}, { proxy = true } = {}) {
-  const anywhere = new Anywhere({})
-  anywhere.config = { enabled: true }
-  anywhere.lastStatus = status
-  anywhere.proxyPort = proxy ? 1055 : null
-  anywhere.forwarders.request = async (url, options) => {
-    const handler = requests[url]
-    if (!handler) throw new Error(`no route to ${url}`)
-    return handler(options)
-  }
-  anywhere.forwarders.open = async (dnsName, port) => 51000 + (port % 1000)
-  return anywhere
-}
-const json = (body, code = 200) => async () => ({ status: code, headers: {}, body: JSON.stringify(body) })
-const fake = (anywhere) => ({ kernel: { anywhere }, anywherePeerOpenPath: Server.prototype.anywherePeerOpenPath, anywherePeerUnavailable: Server.prototype.anywherePeerUnavailable })
-
-test('peers lists the online computers that answered a status, with apps linked through the open route', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': json({ phase: 'ready', apps: [
-      { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, remote: 'https://pinokio-1.tail1.ts.net:43000/ui/?a=1#v' },
-      { id: 'forge', name: 'Forge', state: 'starting', exposed: false, remote: null },
-    ] }),
-    'https://other.tail1.ts.net/anywhere/status': async () => ({ status: 404, headers: {}, body: 'not pinokio' }),
-  })
-  const out = await Server.prototype.composeAnywherePeers.call(fake(anywhere))
-  assert.equal(out.status, 200)
-  assert.deepEqual(out.body, { peers: [{ name: 'pinokio-1', address: 'https://pinokio-1.tail1.ts.net', apps: [
-    { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v' },
-    { id: 'forge', name: 'Forge', state: 'starting', exposed: false, open: null },
-  ] }] })
-})
-
-test('peers skips phones and offline peers, tolerates a peer that fails, and says why while the proxy is missing', async () => {
-  const asked = []
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': async () => { asked.push('pinokio-1'); throw new Error('no answer in 4 s') },
-    'https://other.tail1.ts.net/anywhere/status': async () => { asked.push('other'); return { status: 200, headers: {}, body: 'not json' } },
-  })
-  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(anywhere))).body, { peers: [] })
-  assert.deepEqual(asked.sort(), ['other', 'pinokio-1'], 'the phone and the offline computer are never asked')
-  const adopted = anywhereWith({}, { proxy: false })
-  assert.deepEqual(await Server.prototype.composeAnywherePeers.call(fake(adopted)), { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
-  adopted.error = 'tailscaled exited (code=1 signal=null)'
-  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(adopted))).body, { error: 'Remote is not running on this computer' }, 'a daemon that died')
-})
-
-test('open validates the peer, the port and the path, then redirects to the forwarder', async () => {
-  const server = fake(anywhereWith())
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'nobody', { port: '443' })).status, 400)
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '8080' })).status, 400)
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443.5' })).status, 400)
-  const root = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443' })
-  assert.equal(root.status, 302)
-  assert.equal(root.headers.Location, 'http://127.0.0.1:51443/')
-  const deep = await Server.prototype.anywherePeerOpen.call(server, 'PINOKIO-1', { port: '43000', to: '/ui/?a=1#v' })
-  assert.equal(deep.headers.Location, 'http://127.0.0.1:51000/ui/?a=1#v', 'the path, query and fragment survive; the name is case-insensitive')
-  for (const bad of ['//evil.example', 'https://evil.example/', '\\\\evil.example', 'http://127.0.0.1:51443@evil.example/']) {
-    const answer = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: bad })
-    assert.equal(new URL(answer.headers.Location).origin, 'http://127.0.0.1:51443', `a path that could leave the forwarder (${bad}) stays on it`)
-  }
-  const odd = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: '/ui/?q=caf\u00e9 x#\u00fc' })
-  assert.equal(odd.headers.Location, 'http://127.0.0.1:51443/ui/?q=caf%C3%A9%20x#%C3%BC', 'a path with characters a header cannot carry is encoded, fragment kept')
-  const unavailable = await Server.prototype.anywherePeerOpen.call(fake(anywhereWith({}, { proxy: false })), 'pinokio-1', { port: '443' })
-  assert.deepEqual(unavailable, { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
-})
-
-test('the relays carry the peer\'s API under its prefix, with its own addresses made absolute open routes', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': json({ phase: 'ready', apps: [
-      { id: 'comfy', name: 'ComfyUI', remote: 'https://pinokio-1.tail1.ts.net:43000/ui/?a=1#v' },
-      { id: 'ext', name: 'Ext', remote: 'https://example.com/' },
-      { id: 'forge', name: 'Forge', remote: null },
-    ] }),
-    'https://pinokio-1.tail1.ts.net/anywhere/apps': json({ apps: [{ id: 'comfy', name: 'ComfyUI', icon: '/asset/api/comfy/icon.png' }] }),
-    'https://pinokio-1.tail1.ts.net/asset/api/comfy/icon.png': async () => ({ status: 200, headers: { 'content-type': 'image/png' }, raw: Buffer.from([0x89, 0x50]), body: '' }),
-  })
-  const server = fake(anywhere)
-  const status = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'anywhere/status')
-  assert.equal(status.status, 200)
-  assert.deepEqual(status.body.apps.map((app) => app.remote), [
-    'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v', 'https://example.com/', null,
-  ], 'the peer\'s own address becomes an absolute open route; anything else passes through')
-  const catalog = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'anywhere/apps')
-  assert.deepEqual(catalog.body, { apps: [{ id: 'comfy', name: 'ComfyUI', icon: '/asset/api/comfy/icon.png' }] })
-  const icon = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'asset/api/comfy/icon.png')
-  assert.deepEqual([icon.status, icon.contentType, [...icon.raw]], [200, 'image/png', [0x89, 0x50]], 'an asset is passed through as bytes')
-})
-
-test('launch and stop relay the peer\'s status and body, turning an open URL into the open route', async () => {
-  const sent = []
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': async (options) => { sent.push(options); return { status: 200, headers: {}, body: JSON.stringify({ action: 'open', url: 'https://pinokio-1.tail1.ts.net:43000/' }) } },
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': json({ error: 'Unknown app: x' }, 400),
-  })
-  const server = fake(anywhere)
-  const launch = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/launch', { id: 'comfy' })
-  assert.deepEqual(launch, { status: 200, body: { action: 'open', url: 'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43000&to=%2F' } })
-  assert.equal(sent[0].method, 'POST')
-  assert.equal(sent[0].body, '{"id":"comfy"}')
-  assert.equal(sent[0].headers['Content-Type'], 'application/json')
-  assert.deepEqual(await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/stop', { id: 'x' }), { status: 400, body: { error: 'Unknown app: x' } })
-  assert.equal((await Server.prototype.relayAnywherePeer.call(server, 'nobody', 'POST', 'anywhere/apps/stop', {})).status, 400)
-})
-
-test('a launch whose default is an outside address passes through unchanged', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': json({ action: 'open', url: 'https://github.com/x/y' }),
-  })
-  const launch = await Server.prototype.relayAnywherePeer.call(fake(anywhere), 'pinokio-1', 'POST', 'anywhere/apps/launch', { id: 'docs' })
-  assert.deepEqual(launch.body, { action: 'open', url: 'https://github.com/x/y' })
-})
-
-test('a peer that cannot be reached or answers without JSON relays as 502', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': async () => { throw new Error('no answer in 30 s') },
-    'https://other.tail1.ts.net/anywhere/apps/stop': async () => ({ status: 404, headers: {}, body: '<html>' }),
-  })
-  const server = fake(anywhere)
-  const down = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/stop', { id: 'x' })
-  assert.equal(down.status, 502)
-  assert.match(down.body.error, /Could not reach STUDIO: no answer/)
-  const old = await Server.prototype.relayAnywherePeer.call(server, 'other', 'POST', 'anywhere/apps/stop', { id: 'x' })
-  assert.deepEqual(old, { status: 502, body: { error: 'other did not answer with JSON (HTTP 404)' } })
-  const stopped = await Server.prototype.relayAnywherePeer.call(fake(anywhereWith({}, { proxy: false })), 'other', 'POST', 'anywhere/apps/stop', {})
-  assert.equal(stopped.status, 502)
-})
-
-test('the peer routes answer a browser on this computer only, never a tailnet client through Serve, whatever Host it sends', () => {
-  const server = { kernel: { anywhere: anywhereWith() }, isLoopbackHost: Server.prototype.isLoopbackHost, isLocalRequest: Server.prototype.isLocalRequest }
-  const request = ({ remote = '127.0.0.1', host = 'localhost:42000', origin, headers = {} } = {}) => ({
-    socket: { remoteAddress: remote },
-    get: (name) => ({ host, origin, ...Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])) })[name.toLowerCase()],
-  })
-  const allowed = (req) => Server.prototype.anywherePeerAllowed.call(server, req)
-  assert.equal(allowed(request()), true, 'a top-level navigation on this computer')
-  assert.equal(allowed(request({ remote: '::1', host: '[::1]:42000', origin: 'http://[::1]:42000' })), true)
-  assert.equal(allowed(request({ remote: '::ffff:127.0.0.1', host: '127.0.0.1:42000', origin: 'http://127.0.0.1:42000' })), true)
-  assert.equal(allowed(request({ origin: 'http://localhost:3000' })), false, 'another local site is not this page')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co' })), true, 'the Remote tab in a browser on this computer')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co', headers: { 'X-Forwarded-For': '100.1.1.1' } })), false, 'but not through Serve')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co.evil' })), false)
-  assert.equal(allowed(request({ origin: 'not a url' })), false)
-  assert.equal(allowed(request({ host: 'pinokio.tail1.ts.net' })), false, 'the node\'s own name')
-  assert.equal(allowed(request({ headers: { 'X-Forwarded-For': '100.1.1.1' } })), false, 'through Serve with a forged loopback Host')
-  assert.equal(allowed(request({ headers: { 'X-Pinokio-Peer': '1', 'X-Pinokio-Source-Host': 'localhost' } })), false, 'through another Pinokio')
-  assert.equal(allowed(request({ remote: '192.168.1.5' })), false, 'Home Server on the LAN')
-  assert.equal(allowed(request({ remote: null })), false, 'no socket address at all')
-  assert.equal(Server.prototype.isLoopbackHost('LOCALHOST'), true)
-  assert.equal(Server.prototype.isLoopbackHost('localhost.evil'), false)
-})
-
-test('a live daemon is still ours across a pinokiod restart, its proxy port read from its command line', () => {
-  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/'), bin: { mod: { tailscaled: { binPath: () => '/opt/tailscaled' } } } })
-  const line = (port) => ['/opt/tailscaled', ...anywhere.daemonArgs(port)].join(' ')
-  assert.equal(anywhere.proxyPort, null, 'a fresh pinokiod process knows no port yet')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055)), 7)
-  assert.equal(anywhere.ownedProxyPort, 1055, 'the port the daemon was given, for adoption')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(null)), 7, 'a daemon started before the proxy existed')
-  assert.equal(anywhere.ownedProxyPort, null, 'and it has no proxy to use')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055) + ' --extra'), null, 'anything else is not ours')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, '/usr/bin/tailscaled --tun=userspace-networking'), null)
-  anywhere.platform = 'win32'
-  assert.equal(anywhere.ownedPid({ pid: 9 }, `"${line(1055).toUpperCase()}"`), 9, 'Windows compares without quotes, case-insensitively')
-})
-
-test('peerFor finds a peer by the first label of its DNS name, which may differ from its displayed name', () => {
-  const anywhere = anywhereWith()
-  assert.equal(anywhere.peerFor('pinokio-1').name, 'STUDIO')
-  assert.equal(anywhere.peerFor('iphone-14-pro').mobile, true)
-  assert.equal(anywhere.peerFor('STUDIO'), null, 'the hostname is not the key')
-  assert.equal(anywhere.peerFor(''), null)
-  assert.equal(anywhere.peerFor(null), null)
-})
-
-test('a forwarded visitor gets menu links on the forwarder\'s open path; every other visitor gets today\'s links', async () => {
-  const anywhere = new Anywhere({})
-  anywhere.config = { enabled: true }
-  anywhere.lastStatus = status
-  anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
-  const href = 'http://127.0.0.1:7860/ui/?a=1#v'
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, true), '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, false), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
-  assert.equal(anywhere.rewriteHref('localhost:42000', href, true), href, 'the Host gate still applies with the header')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', 'http://127.0.0.1:9999/', true), 'http://127.0.0.1:9999/', 'a port without a route is left alone, as today')
-  const menu = [{ href, src: href, menu: [{ href: 'https://example.com/' }] }]
-  await anywhere.rewriteMenu('pinokio.tail1.ts.net', menu, true)
-  assert.equal(menu[0].href, '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
-  assert.equal(menu[0].src, menu[0].href)
-  assert.equal(menu[0].menu[0].href, 'https://example.com/')
-})
-
-test('the daemon is started with the proxy on the port pinokiod picked, and peers carry their DNS name', () => {
-  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/') })
-  anywhere.proxyPort = 1055
-  assert.ok(anywhere.daemonArgs().includes('--outbound-http-proxy-listen=127.0.0.1:1055'))
-  assert.equal(anywhere.proxyUrl(), 'http://127.0.0.1:1055')
-  anywhere.proxyPort = null
-  assert.equal(anywhere.proxyUrl(), null)
-  assert.ok(!anywhere.daemonArgs().some((arg) => arg.includes('proxy')), 'no port, no flag')
-  assert.deepEqual(anywhere.peersFrom(status).map((p) => [p.name, p.dnsName]), [
-    ['iphone-14-pro', 'iphone-14-pro.tail1.ts.net'], ['other', 'other.tail1.ts.net'], ['STUDIO', 'pinokio-1.tail1.ts.net'], ['asleep', 'asleep.tail1.ts.net'],
-  ])
-})