pinokiod 8.2.9 → 8.2.11

package/kernel/anywhere/index.js

@@ -1,6 +1,6 @@
 /*
   Pinokio Anywhere: owns the bundled `tailscaled` daemon (installed from
-  conda-forge by kernel/bin/tailscaled.js) and drives it over its LocalAPI so
+  conda-forge by kernel/bin/tailscaled.js) and controls it with the bundled CLI so
   the user can reach this Pinokio and every app it launches from their phone
   or another computer on their private tailnet, over HTTPS.
 
@@ -19,14 +19,14 @@ const os = require('os')
 const fs = require('fs')
 const path = require('path')
 const crypto = require('crypto')
-const { spawn } = require('child_process')
-const { LocalAPI } = require('./localapi')
-const { buildServeConfig, describeServeConfig, sameServeConfig, DEFAULT_HTTPS_PORT } = require('./serve')
+const { spawn, execFile, execFileSync } = require('child_process')
+const TailscaleCLI = require('./cli')
+const writeJson = require('./state')
+const { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS } = require('./serve')
 const { loadPortMap, savePortMap, assignPorts } = require('./ports')
 const Util = require('../util')
 
 const DEFAULT_HOSTNAME = 'pinokio'
-const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '[::1]'])
 const DEFAULT_CONNECT_URL_TEMPLATE = 'https://pinokio.co/anywhere/connect#u={address}&a={email}'
 const MAX_UNIX_SOCKET_PATH = 100   // sun_path is 104 bytes on macOS, 108 on Linux
 const DAEMON_READY_TIMEOUT_MS = 20000
@@ -41,7 +41,6 @@ class Anywhere {
     this.kernel = kernel
     this.platform = kernel && kernel.platform ? kernel.platform : os.platform()
     this.child = null
-    this.pid = null
     this.api = null
     this.config = null
     this.starting = null
@@ -54,7 +53,8 @@ class Anywhere {
     this.feature = null            // cached query-feature result
     this.featureAt = 0
     this.error = null
-    this.loginRequestedAt = 0
+    this.login = null
+    this.stopping = null
   }
 
   // ---------- paths ----------
@@ -120,6 +120,7 @@ class Anywhere {
       config = JSON.parse(raw) || {}
       this.configExists = true
     } catch (e) {
+      if (e.code !== 'ENOENT') throw e
       config = {}
     }
     this.config = Object.assign({
@@ -129,10 +130,8 @@ class Anywhere {
     return this.config
   }
   async saveConfig(patch) {
-    const config = await this.loadConfig()
-    Object.assign(config, patch || {})
-    await fs.promises.mkdir(this.dir(), { recursive: true })
-    await fs.promises.writeFile(this.configPath(), JSON.stringify(config, null, 2))
+    const config = Object.assign({}, await this.loadConfig(), patch || {})
+    await writeJson(this.configPath(), config)
     this.config = config
     this.configExists = true
     return config
@@ -176,7 +175,9 @@ class Anywhere {
   // ---------- daemon lifecycle ----------
   client() {
     if (!this.api) {
-      this.api = new LocalAPI({ socketPath: this.socketPath() })
+      this.api = new TailscaleCLI({
+        binPath: this.kernel.bin.mod.tailscaled.cliPath(), socketPath: this.socketPath(),
+      })
     }
     return this.api
   }
@@ -185,32 +186,53 @@ class Anywhere {
   }
   // Called from kernel/bin/tailscaled.js start() during bin init.
   async autostart() {
-    // a pid file left behind by a crash or reboot must never point at an unrelated process
-    if (!(await this.daemonAlive())) fs.rmSync(this.pidPath(), { force: true })
-    if (!(await this.enabled())) return false
-    if (!(await this.installed())) return false
-    await this.start()
-    return true
+    return this.start(true)
   }
-  async start() {
+  async start(automatic = false) {
+    if (this.stopping) await this.stopping
     if (this.starting) return this.starting
-    this.starting = this._start().finally(() => { this.starting = null })
+    this.starting = this._start(automatic).catch((e) => {
+      if (!this.stopping) this.error = e.message
+      throw e
+    }).finally(() => { this.starting = null })
     return this.starting
   }
-  async _start() {
-    this.error = null
+  async assertOwnership() {
+    const api = this.api
+    const config = this.config
+    const owned = (this.child && this.child.pid && this.child.exitCode === null) || await this.readPid()
+    if (this.stopping || this.api !== api || this.config !== config) return false
+    if (!owned) {
+      throw new Error('Cannot verify ownership of tailscaled; its process and PID record were preserved.')
+    }
+    return true
+  }
+  async _start(automatic) {
     await this.loadConfig()
+    if (!this.config.enabled) return false
+    if (!(await this.installed())) {
+      if (automatic) return false
+      throw new Error('Install the matching Tailscale daemon and CLI through Anywhere setup.')
+    }
+    if (this.stopping) return false
+    this.error = null
+    if (this.api) this.api.cancel()
+    if (this.syncing) await this.syncing.catch(() => {})
+    const forceLogin = !!(this.login && this.login.error)
+    this.login = null
     await fs.promises.mkdir(this.stateDir(), { recursive: true })
     const bin = this.binPath()
     if (!bin) {
       throw new Error('tailscaled module is not available')
     }
-    if (!(await this.daemonAlive())) {
-      if (this.platform !== 'win32') {
-        // a stale socket file makes bind() fail
-        await fs.promises.rm(this.socketPath(), { force: true }).catch(() => {})
-      }
-      const logFd = fs.openSync(this.logPath(), 'w')
+    const alive = await this.daemonAlive()
+    if (this.stopping) return false
+    if (alive && (!(await this.assertOwnership()) || this.stopping)) return false
+    if (!alive) {
+      const pid = await this.readPid()
+      if (this.stopping) return false
+      if (pid) throw new Error('tailscaled is still running but its private endpoint is unavailable; no second daemon was started.')
+      const logFd = fs.openSync(this.logPath(), 'a')
       const env = Object.assign({}, process.env, {
         TS_LOGS_DIR: this.stateDir(),
       })
@@ -222,22 +244,26 @@ class Anywhere {
       })
       fs.closeSync(logFd)
       this.child = child
-      this.pid = child.pid
-      if (child.pid) fs.writeFileSync(this.pidPath(), String(child.pid))
       child.on('exit', (code, signal) => {
         console.log(`[anywhere] tailscaled exited (code=${code} signal=${signal})`)
         if (this.child === child) {
           // not a stop() of ours: surface it, the page offers "Try again"
           this.child = null
-          this.pid = null
-          this.error = `tailscaled exited (code=${code} signal=${signal})`
-          fs.rmSync(this.pidPath(), { force: true })
+          if (!this.stopping && !this.error) this.error = `tailscaled exited (code=${code} signal=${signal})`
+          try { fs.rmSync(this.pidPath(), { force: true }) }
+          catch (error) { this.error = `Could not remove tailscaled PID record: ${error.message}` }
         }
       })
       child.on('error', (err) => {
         console.log('[anywhere] tailscaled spawn error', err && err.message ? err.message : err)
         this.error = `tailscaled failed to start: ${err && err.message ? err.message : err}`
       })
+      try {
+        if (child.pid) fs.writeFileSync(this.pidPath(), String(child.pid))
+      } catch (error) {
+        child.kill()
+        throw error
+      }
       const ready = await this.waitForDaemon(DAEMON_READY_TIMEOUT_MS)
       if (!ready) {
         let tail = ''
@@ -249,20 +275,21 @@ class Anywhere {
         }
         throw new Error(this.error)
       }
-    } else if (!this.pid) {
-      // adopted from a previous pinokiod run: recover its pid so shutdown can still kill it
-      this.pid = this.readPid()
     }
-    await this.applyPrefs()
+    if (this.stopping) return false
+    await this.client().setPrefs(await this.hostname())
     this.lastServe = undefined
+    this.lastServeError = null
     this.lastStatusAt = 0
-    await this.refreshStatus(true)
+    const status = await this.refreshStatus(true)
+    if (!status) throw new Error(this.error)
+    if (status.BackendState !== 'Running') this.requestLogin(forceLogin)
     return true
   }
   async waitForDaemon(timeout) {
     const started = Date.now()
     while (Date.now() - started < timeout) {
-      if (this.error || (this.child && this.child.exitCode !== null)) {
+      if (this.stopping || this.error || (this.child && this.child.exitCode !== null)) {
         return false
       }
       if (await this.daemonAlive()) {
@@ -272,41 +299,70 @@ class Anywhere {
     }
     return false
   }
-  async applyPrefs() {
-    const hostname = await this.hostname()
-    await this.client().patchPrefs({
-      HostnameSet: true,
-      Hostname: hostname,
-      WantRunningSet: true,
-      WantRunning: true,
-      LoggedOutSet: true,
-      LoggedOut: false,
-      // this node is a server; never route the machine's traffic elsewhere
-      RouteAllSet: true,
-      RouteAll: false,
-      ExitNodeIDSet: true,
-      ExitNodeID: '',
-      CorpDNSSet: true,
-      CorpDNS: false,
+  async stop() {
+    if (this.stopping) return this.stopping
+    this.stopping = this._stop().catch((e) => { this.error = e.message; throw e }).finally(() => { this.stopping = null })
+    return this.stopping
+  }
+  pidInspection() {
+    let pid
+    try { pid = Number(fs.readFileSync(this.pidPath(), 'utf8').trim()) }
+    catch (e) { if (e.code === 'ENOENT') return null; throw e }
+    if (!Number.isInteger(pid) || pid <= 0) return null
+    try { process.kill(pid, 0) }
+    catch (e) { if (e.code === 'ESRCH') return null; throw e }
+    return { pid, file: this.platform === 'win32' ? 'powershell.exe' : '/bin/ps',
+      args: this.platform === 'win32' ? ['-NoProfile', '-NonInteractive', '-Command',
+        `[Console]::OutputEncoding=[Text.Encoding]::UTF8; (Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine`]
+        : ['-ww', '-p', String(pid), '-o', 'args='],
+      options: { encoding: 'utf8', shell: false, windowsHide: true, timeout: 2000 } }
+  }
+  ownedPid(inspection, command) {
+    command = command.trim()
+    let expected = [this.binPath(), ...this.daemonArgs()].join(' ')
+    if (this.platform === 'win32') {
+      command = command.replace(/"/g, '').toLowerCase()
+      expected = expected.toLowerCase()
+    }
+    return command === expected ? inspection.pid : null
+  }
+  async readPid() {
+    const inspection = this.pidInspection()
+    if (!inspection) return null
+    const command = await new Promise((resolve, reject) => {
+      execFile(inspection.file, inspection.args, inspection.options, (error, stdout) => error ? reject(error) : resolve(stdout))
+    }).catch(error => {
+      // The daemon can exit between the liveness probe and process inspection.
+      try { process.kill(inspection.pid, 0) }
+      catch (cause) { if (cause.code === 'ESRCH') return null }
+      throw error
     })
-  }
-  readPid() {
-    try {
-      const pid = Number(fs.readFileSync(this.pidPath(), 'utf8').trim())
-      if (!Number.isInteger(pid) || pid <= 0) return null
-      process.kill(pid, 0)   // throws when there is no such process
-      return pid
-    } catch (e) {
-      return null
+    if (command === null) return null
+    return this.ownedPid(inspection, command)
+  }
+  readPidSync() {
+    const inspection = this.pidInspection()
+    return inspection ? this.ownedPid(inspection, execFileSync(inspection.file, inspection.args, inspection.options)) : null
+  }
+  async _stop() {
+    if (this.api) this.api.cancel()
+    if (this.starting) await this.starting.catch(() => {})
+    if (this.syncing) await this.syncing.catch(() => {})
+    if (this.login) await this.login.promise
+    if (this.featureQuery) await this.featureQuery.catch(() => {})
+    const pid = this.child && this.child.exitCode === null ? this.child.pid : await this.readPid()
+    if (pid) process.kill(pid, 'SIGTERM')
+    else if (await this.daemonAlive()) throw Object.assign(new Error('Cannot verify ownership of tailscaled; its process and PID record were preserved.'), { code: 'ERR_ANYWHERE_UNOWNED' })
+    const deadline = Date.now() + 5000
+    while ((this.child && this.child.exitCode === null) || (pid && await this.readPid()) || await this.daemonAlive()) {
+      if (Date.now() >= deadline) throw new Error('tailscaled did not stop; its state and PID record were preserved.')
+      await sleep(100)
     }
-  }
-  async stop() {
-    const pid = this.pid || this.readPid()
+    this.error = null
+    this.lastServeError = null
     this.child = null
-    this.pid = null
-    if (pid) {
-      try { process.kill(pid, 'SIGTERM') } catch (e) { }
-    }
+    this.login = null
+    this.api = null
     fs.rmSync(this.pidPath(), { force: true })
     this.lastStatus = null
     this.lastStatusAt = 0
@@ -315,11 +371,12 @@ class Anywhere {
   }
   // synchronous: used from the process shutdown path
   killSync() {
-    const pid = this.pid || this.readPid()
+    if (this.api) this.api.cancel()
+    const pid = this.child && this.child.exitCode === null ? this.child.pid : this.readPidSync()
     if (pid) {
-      try { process.kill(pid, 'SIGKILL') } catch (e) { }
+      process.kill(pid, 'SIGKILL')
+      fs.rmSync(this.pidPath(), { force: true })
     }
-    fs.rmSync(this.pidPath(), { force: true })
   }
   async enable() {
     await this.saveConfig({ enabled: true })
@@ -331,20 +388,42 @@ class Anywhere {
     await this.stop()
     return true
   }
-  async requestLogin() {
-    this.loginRequestedAt = Date.now()
-    await this.client().loginInteractive()
-    this.lastStatusAt = 0
-    return true
+  requestLogin(force = false) {
+    if (!this.config || !this.config.enabled || this.login || this.stopping || this.error) return
+    const login = { url: null, error: null, done: false }
+    this.login = login
+    login.promise = this.assertOwnership().then((owned) => {
+      if (!owned || this.stopping || this.login !== login || !this.config.enabled) return
+      return this.client().up((update) => {
+        if (this.login !== login) return
+        if (update.AuthURL) login.url = update.AuthURL
+        if (update.Error) { login.url = null; login.error = update.Error; this.error = update.Error }
+        this.lastStatusAt = 0
+      }, force, this.config.hostname)
+    }).then(() => {
+      login.done = true
+      if (this.login === login) this.login = null
+      this.lastStatusAt = 0
+    }).catch((e) => {
+      login.done = true
+      if (this.login === login && !e.cancelled) {
+        login.url = null
+        login.error = this.error = e.message
+      }
+    })
   }
   async logout() {
+    if (!(await this.assertOwnership()) || this.stopping) return false
+    if (this.api) this.api.cancel()
+    this.login = null
     await this.client().logout()
-    await this.applyPrefs()
-    await this.client().start()
+    this.error = null
     this.lastStatus = null
     this.lastStatusAt = 0
     this.lastServe = undefined
     this.feature = null
+    this.featureAt = 0
+    this.requestLogin()
     return true
   }
 
@@ -354,12 +433,16 @@ class Anywhere {
     if (!force && this.lastStatus && now - this.lastStatusAt < STATUS_CACHE_MS) {
       return this.lastStatus
     }
+    const api = this.client()
     try {
-      const status = await this.client().status()
+      const status = await api.status()
+      if (this.api !== api) return null
       this.lastStatus = status
       this.lastStatusAt = Date.now()
       return status
     } catch (e) {
+      if (this.api !== api) return null
+      if (!e.cancelled) this.error = e.message
       this.lastStatus = null
       this.lastStatusAt = Date.now()
       return null
@@ -369,30 +452,8 @@ class Anywhere {
     if (!status || !status.Self || !status.Self.DNSName) return null
     return String(status.Self.DNSName).replace(/\.$/, '')
   }
-  async ensureRunningPrefs(status) {
-    // the daemon persisted WantRunning=false (e.g. after `logout`): nudge it
-    if (status && status.BackendState === 'Stopped') {
-      try {
-        await this.client().patchPrefs({ WantRunningSet: true, WantRunning: true })
-        this.lastStatusAt = 0
-      } catch (e) { }
-    }
-  }
-  async ensureLoginUrl(status) {
-    if (!status || status.BackendState !== 'NeedsLogin') return null
-    // the daemon keeps offering a link even after the control server rejected it
-    // ("register request: http 410: auth path not found"); reset and ask again
-    const dead = Array.isArray(status.Health) && status.Health.some((h) => /auth path not found/i.test(String(h)))
-    if (status.AuthURL && !dead) return status.AuthURL
-    if (Date.now() - this.loginRequestedAt > 5000) {
-      try {
-        if (dead) await this.client().start()
-        await this.requestLogin()
-      } catch (e) { }
-    }
-    return null
-  }
   async httpsFeature(status) {
+    if (!this.config || !this.config.enabled || this.stopping) return null
     if (!status || status.BackendState !== 'Running') return null
     if (Array.isArray(status.CertDomains) && status.CertDomains.length > 0) {
       this.feature = { Complete: true }
@@ -402,12 +463,20 @@ class Anywhere {
       return this.feature
     }
     try {
-      this.feature = await this.client().queryFeature('serve')
+      if (!this.featureQuery) {
+        this.featureQuery = this.assertOwnership().then((owned) => {
+          if (!owned || this.stopping || !this.config.enabled) return null
+          return this.client().queryFeature()
+        })
+      }
+      this.feature = await this.featureQuery
       this.featureAt = Date.now()
     } catch (e) {
-      // e.g. 503 "no netmap" right after login: not an answer yet, ask again next time
+      if (!e.cancelled) this.error = e.message
       this.feature = null
       this.featureAt = 0
+    } finally {
+      this.featureQuery = null
     }
     return this.feature
   }
@@ -486,25 +555,22 @@ class Anywhere {
         const port = Number(url.port)
         if (seen.has(port)) continue
         seen.add(port)
-        targets.push({ key: domain === '@' ? name : `${domain}.${name}`, name, local: port })
+        targets.push({ key: domain === '@' ? name : `${domain}.${name}`, name, local: port, origin: url.origin.replace('://0.0.0.0:', '://127.0.0.1:') })
       }
     }
     return targets
   }
   // Recomputes this.targets from the running apps, giving a new app its stable
-  // port (kept in ports.json). Returns true when the targets changed.
+  // port (kept in ports.json).
   async refreshTargets() {
     if (!this.portMap) this.portMap = await loadPortMap(this.portMapPath())
     const apps = this.appTargets()
     const { map, changed } = assignPorts(this.portMap, apps.map((app) => app.key))
     if (changed) {
+      await savePortMap(this.portMapPath(), map)
       this.portMap = map
-      await savePortMap(this.portMapPath(), map).catch((e) => console.log('[anywhere] could not save ports.json', e.message))
     }
-    const targets = apps.map((app) => Object.assign({}, app, { listen: map[app.key] }))
-    const differs = JSON.stringify(targets) !== JSON.stringify(this.targets)
-    this.targets = targets
-    return differs
+    this.targets = apps.map((app) => Object.assign({}, app, { listen: map[app.key] }))
   }
   async desiredServeConfig(status) {
     const dnsName = this.dnsNameFrom(status)
@@ -513,14 +579,9 @@ class Anywhere {
     return buildServeConfig({
       dnsName,
       serverPort: this.serverPort(),
-      targets: this.targets.map((t) => ({ listen: t.listen, target: t.local })),
+      targets: this.targets.map((t) => ({ listen: t.listen, target: t.local, origin: t.origin })),
     })
   }
-  targetNames() {
-    const names = {}
-    for (const t of this.targets) names[t.listen] = t.name
-    return names
-  }
   // true when `host` (a Host header) is this node's own Tailscale name
   isNodeHost(host) {
     const dnsName = this.lastStatus ? this.dnsNameFrom(this.lastStatus) : null
@@ -533,28 +594,16 @@ class Anywhere {
   // href back unchanged.
   rewriteHref(host, href) {
     if (!this.isNodeHost(host)) return href
-    const dnsName = this.dnsNameFrom(this.lastStatus)
-    let url
-    try { url = new URL(String(href)) } catch (_) { return href }
-    if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
-    const local = Number(url.port)
-    let listen
-    if (local === this.serverPort()) {
-      listen = DEFAULT_HTTPS_PORT
-    } else {
-      const target = this.targets.find((t) => t.local === local)
-      if (!target) return href
-      listen = target.listen
-    }
-    const origin = listen === DEFAULT_HTTPS_PORT ? `https://${dnsName}` : `https://${dnsName}:${listen}`
-    return origin + url.pathname + url.search + url.hash
+    return rewriteHref(href, describeServeConfig(this.lastServe, this.dnsNameFrom(this.lastStatus)))
   }
   async rewriteMenu(host, menu) {
     if (!Array.isArray(menu) || !this.isNodeHost(host)) return menu
-    // An app that just published its URL is not in the serve config until the
-    // next kernel.refresh() tick. Give it its stable port now, so the menu is
-    // right on first render, and push the route without waiting for the tick.
-    if (await this.refreshTargets()) this.sync().catch(() => {})
+    // Confirm new or changed routes on first render; refresh checks unchanged ones.
+    const apps = this.appTargets()
+    if (this.syncing || this.lastServe === undefined || this.lastServeError || apps.length !== this.targets.length ||
+        apps.some((app, i) => app.key !== this.targets[i].key || app.local !== this.targets[i].local || app.origin !== this.targets[i].origin)) {
+      await this.sync()
+    }
     const rewrite = (items) => {
       for (const item of items) {
         if (!item || typeof item !== 'object') continue
@@ -575,29 +624,42 @@ class Anywhere {
   // Regenerates the Serve config from the apps' published URLs. Called from
   // kernel.refresh() (same trigger as router.update()) and after start.
   async sync() {
-    // one push at a time; a call made during a push runs its own afterwards
-    if (this.syncing) return this.syncing.then(() => this.sync())
-    this.syncing = this.pushServeConfig().finally(() => { this.syncing = null })
+    // Concurrent callers share one operation, with a further pass for new work.
+    if (this.syncing) {
+      this.syncAgain = true
+      return this.syncing
+    }
+    this.syncing = (async () => {
+      let changed = false
+      do {
+        this.syncAgain = false
+        changed = await this.pushServeConfig() || changed
+      } while (this.syncAgain)
+      return changed
+    })().finally(() => { this.syncing = null })
     return this.syncing
   }
   async pushServeConfig() {
-    if (!this.config || !this.config.enabled) return false
-    if (!this.pid && !this.api) return false
+    if (this.stopping || !this.config || !this.config.enabled) return false
+    if (!this.api || this.starting) return false
+    if (!(await this.assertOwnership()) || this.stopping) return false
     const status = await this.refreshStatus(false)
     if (!status || status.BackendState !== 'Running') return false
-    const desired = await this.desiredServeConfig(status)
-    if (!desired) return false
-    if (this.lastServe !== undefined && sameServeConfig(desired, this.lastServe)) {
-      return false
-    }
+    const feature = await this.httpsFeature(status)
+    if (!feature || !feature.Complete) return false
     try {
+      const desired = await this.desiredServeConfig(status)
+      if (this.stopping || !this.config.enabled) return false
+      if (!desired) throw new Error('Tailscale did not report this node\'s DNS name.')
       const current = await this.client().serveConfig()
-      await this.client().setServeConfig(desired, current.etag)
-      this.lastServe = desired
+      const changed = !sameServeConfig(desired, current)
+      const applied = changed ? await this.client().setServeConfig(desired, current) : current
+      if (!sameServeConfig(desired, applied)) throw new Error('Tailscale Serve configuration does not match the required routes. Try again.')
+      this.lastServe = applied
       this.lastServeError = null
-      console.log(`[anywhere] serve config updated: ${Object.keys(desired.TCP).join(', ')}`)
-      return true
+      return changed
     } catch (e) {
+      this.lastServe = undefined
       this.lastServeError = e && e.message ? e.message : String(e)
       console.log('[anywhere] serve config update failed', this.lastServeError)
       return false
@@ -615,19 +677,26 @@ class Anywhere {
       error: this.error,
       serveError: this.lastServeError,
     }
+    const inactive = () => Object.assign(base, { enabled: !!this.config.enabled, running: false,
+      phase: this.error ? 'error' : this.config.enabled ? 'starting' : 'off', error: this.error })
     if (!installed) {
       return Object.assign(base, { phase: 'setup', running: false })
     }
+    if (this.error) return Object.assign(base, { phase: 'error', running: false })
     if (!enabled) {
       return Object.assign(base, { phase: 'off', running: false })
     }
     if (this.starting) {
       return Object.assign(base, { phase: 'starting', running: false })
     }
+    const owned = await this.assertOwnership()
+    if (!owned || this.stopping || !this.config.enabled) return inactive()
     const status = await this.refreshStatus(false)
+    if (this.stopping || !this.config.enabled) return inactive()
     if (!status) {
       return Object.assign(base, {
         phase: this.error ? 'error' : 'starting',
+        error: this.error,
         running: false,
       })
     }
@@ -655,7 +724,8 @@ class Anywhere {
     })
     if (backendState === 'NeedsLogin') {
       out.phase = 'login'
-      out.loginUrl = await this.ensureLoginUrl(status)
+      this.requestLogin()
+      out.loginUrl = this.login ? this.login.url : null
       if (!out.loginUrl) {
         out.phase = 'starting'
       }
@@ -666,17 +736,20 @@ class Anywhere {
       return out
     }
     if (backendState === 'Stopped') {
-      await this.ensureRunningPrefs(status)
+      this.requestLogin()
       out.phase = 'starting'
       return out
     }
     if (backendState !== 'Running') {
-      out.phase = 'starting'
+      out.phase = this.login && !this.login.done ? 'starting' : 'error'
+      if (out.phase === 'error') out.error = `Unexpected Tailscale state: ${backendState}`
       return out
     }
     const feature = await this.httpsFeature(status)
+    if (this.stopping || !this.config.enabled) return inactive()
     if (!feature) {
-      out.phase = 'starting'
+      out.phase = 'error'
+      out.error = this.error || 'Could not query HTTPS approval.'
       return out
     }
     if (!feature.Complete) {
@@ -687,9 +760,12 @@ class Anywhere {
       }
       return out
     }
-    out.phase = 'ready'
-    const serve = this.lastServe !== undefined ? this.lastServe : await this.desiredServeConfig(status)
-    out.serve = describeServeConfig(serve, dnsName, this.targetNames())
+    await this.sync()
+    if (this.stopping || !this.config.enabled) return inactive()
+    out.phase = this.error || this.lastServeError || this.lastServe === undefined || !this.lastStatus || this.lastStatus.BackendState !== 'Running' ? 'error' : 'ready'
+    if (out.phase === 'error') out.error = this.error || this.lastServeError || 'Routes are not confirmed'
+    out.serveError = this.lastServeError
+    out.serve = describeServeConfig(this.lastServe, dnsName, Object.fromEntries(this.targets.map(target => [target.listen, target.name])))
     return out
   }
 }