wherdr 1.3.1 → 1.3.3

package/bin/install-docker-skill.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Run on the HOST after pulling an image; no container is started, no home mounted.
+# Usage: sh bin/install-docker-skill.sh <image> [refresh|install]
+extract_skill() (
+  set -eu
+  [ -n "${1:-}" ] || { echo 'usage: install-docker-skill.sh <image> [refresh|install]' >&2; exit 1; }
+  [ "${WHERDR_SKILL:-}" != off ] || { echo 'wherdr skill: disabled by WHERDR_SKILL=off'; exit 0; }
+  if [ "${2:-install}" != install ] && [ -e "${HOME:-}/.local/state/wherdr/skill-disabled" ]; then exit 0; fi
+  helper=$(CDPATH= cd -- "$(dirname "$0")" && pwd -P)/lib/install-skill.sh
+  tmp=$(mktemp -d)
+  container=
+  trap '[ -z "$container" ] || docker rm "$container" >/dev/null 2>&1; rm -rf "$tmp"' EXIT HUP INT TERM
+  container=$(docker create -- "$1")
+  mkdir -p "$tmp/skills/wherdr"
+  # Only data crosses the image boundary. The executed helper is local.
+  docker cp "$container:/app/skills/wherdr/SKILL.md" "$tmp/skills/wherdr/SKILL.md"
+  sh "$helper" "${2:-install}" "$tmp"
+)
+# Unlike startup, manual and plugin callers see failures and useful diagnostics.
+extract_skill "$@"

package/bin/lib/commands.mjs

@@ -11,7 +11,8 @@ import { BIN, CliError, SERVER, VERSION, bad, c, homebrewInstall, localUrl, ok,
 import { RUNTIME_HELP, findRuntime, isBun, runtimeOk, runtimeVersion, temporaryInstall } from './runtime.mjs'
 import { brewDoctor, brewRedirect, brewService, brewStatusRows } from './brew.mjs'
 import { controlService, installService, serviceFile, servicePlatform, serviceState, uninstallService } from './service.mjs'
-import { LINKS, inspect, reachable } from './tailnet.mjs'
+import { refreshSkill } from './skill.mjs'
+import { LINKS, inspect, publishCommand, reachable } from './tailnet.mjs'
 
 export const HELP = `${'wherdr'}: your Herdr agents from your phone and browser.
 
@@ -115,6 +116,7 @@ function needServer() {
 
 // ------------------------------------------------------------------- run
 export async function run(opts) {
+  refreshSkill(context(opts).env)
   needServer()
   const ctx = context(opts)
   if (!process.versions.bun && Number(process.versions.node.split('.')[0]) < 22) throw new CliError(`Node.js 22 or newer is required (found ${process.version}).`)
@@ -138,6 +140,7 @@ export async function run(opts) {
 
 // ----------------------------------------------------------------- start
 export async function start(opts) {
+  refreshSkill(context(opts).env)
   needServer()
   const ctx = context(opts)
   const brew = brewService()
@@ -289,16 +292,39 @@ export function openUrl(url) {
   return r.status === 0
 }
 
+// Does the published address answer? 'host' means wherdr answers but does not
+// know that name yet (`tailscale serve` run a moment ago): a local request to
+// /api/phone makes it read Tailscale again and adopt the address
+// (server/utils/phone.ts), then it is asked again. `reach` / `allow` are
+// injectable for the tests.
+export async function phoneReach(localUrl, phoneUrl, { reach = reachable, allow = url => fetch(`${url}/api/phone`).catch(() => {}), timeoutMs = 8000 } = {}) {
+  let r = await reach(phoneUrl, timeoutMs)
+  if (r === 'host') { await allow(localUrl); r = await reach(phoneUrl, timeoutMs) }
+  return r
+}
+
+// The address to open: the tailnet one when wherdr is already published there
+// and it answers (passkeys are tied to the address they were created on),
+// else the local one.
+export async function openAddress(localUrl, port, { net = inspect, ...probes } = {}) {
+  const phone = (await net(port)).phone
+  if (!phone?.served) return localUrl
+  return await phoneReach(localUrl, phone.url, { timeoutMs: 5000, ...probes }) === 'ok' ? phone.url.replace(/\/$/, '') : localUrl
+}
+
 export async function open(opts) {
   const ctx = context(opts)
   if (await probe(ctx.port, ctx.host) !== 'wherdr') warn(`wherdr does not answer on port ${ctx.port}: run \`wherdr start\` first.`)
-  if (openUrl(ctx.url)) ok(`opened ${c.cyan(ctx.url)}`)
-  else say(ctx.url)
+  const url = await openAddress(ctx.url, ctx.port)
+  if (openUrl(url)) ok(`opened ${c.cyan(url)}`)
+  else say(url)
 }
 
 // ----------------------------------------------------------------- phone
 // The phone setup lives in the app (Settings › Phone: publish on the tailnet,
-// live check, APP_URL, QR code). Here: the real state, the link to that page,
+// live check, APP_URL, QR code). Here: the real state, the command that
+// publishes wherdr when it is not (a server without a screen has no browser
+// for that page; wherdr adopts the address by itself), the link to the page,
 // and the QR code only when the address answers.
 export const phoneSetupUrl = url => `${url}/#/settings?section=phone`
 
@@ -311,6 +337,13 @@ async function qr(text) {
   } catch { return null }
 }
 
+// Why a published address is not usable yet, for `wherdr phone`.
+export function phoneRefusal(reach, phone, running) {
+  if (reach !== 'host') return running ? 'does not answer yet (the HTTPS certificate can take a minute)' : 'wherdr is not running'
+  if (phone.funnel) return 'also open to the Internet by `tailscale funnel`, which wherdr never enables: turn the funnel off'
+  return 'wherdr refuses it: it could not read `tailscale serve status` itself (is `tailscale` on the PATH of the wherdr server?)'
+}
+
 export async function phone(opts) {
   const ctx = context(opts)
   const setup = phoneSetupUrl(ctx.url)
@@ -323,17 +356,21 @@ export async function phone(opts) {
   let reach = null
   if (!net.installed) warn(`Tailscale is not installed: ${c.cyan(LINKS.download)}`)
   else if (!net.connected || !net.phone) warn('Tailscale is not connected on this machine.')
-  else if (!net.phone.served) warn(`${c.bold('Not reachable from your phone yet')}: wherdr is not published on your tailnet.`)
-  else {
-    reach = await reachable(net.phone.url)
+  else if (!net.phone.served) {
+    warn(`${c.bold('Not reachable from your phone yet')}: wherdr is not published on your tailnet.`)
+    say(`    Publish it (private, only your Tailscale devices): ${c.cyan(publishCommand(ctx.port))}`)
+    say('    wherdr enables that address by itself; run `wherdr phone` again for its QR code.')
+  } else {
+    reach = await phoneReach(ctx.url, net.phone.url)
     if (reach === 'ok') ok(`${c.cyan(net.phone.url)} answers`)
-    else warn(`${c.bold('Not reachable from your phone yet')}: ${net.phone.url} is published but ${reach === 'host' ? 'refused (APP_URL)' : 'does not answer'}.`)
+    else warn(`${c.bold('Not reachable from your phone yet')}: ${net.phone.url} is published but ${phoneRefusal(reach, net.phone, local === 'wherdr')}.`)
   }
   if (reach === 'ok') {
     const code = await qr(net.phone.url)
     if (code) { say(); say(code.split('\n').map(l => `  ${l}`).join('\n')) }
     say(`  ${code ? 'Scan it with the iPhone camera' : `Open ${c.cyan(net.phone.url)} on the iPhone`}, then Share → Add to Home Screen.`)
     say('  In the app: Settings → Enable notifications, then Security → Enable passkey lock.')
+    say(`  Enable the lock on ${c.cyan(net.phone.url)}, not on localhost: a passkey is tied to its address.`)
   }
   say()
   say(`  Set up your phone in the app, on this computer: ${c.cyan(setup)}`)
@@ -341,6 +378,7 @@ export async function phone(opts) {
 
 // --------------------------------------------------------------- service
 export async function service(opts) {
+  if (opts.sub === 'install') refreshSkill(context(opts).env)
   const ctx = context(opts)
   if (opts.sub === 'uninstall') {
     const file = uninstallService()
@@ -372,7 +410,7 @@ export async function service(opts) {
   if (ctx.env.HERDR_WEB_SESSION) args.push('--session', ctx.env.HERDR_WEB_SESSION)
   const PATH = [...new Set([path.dirname(runtime), path.join(os.homedir(), '.local/bin'), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin'])].join(':')
   const env = { PATH, WHERDR_DIR: ctx.dir, WHERDR_RUNTIME: runtime }
-  for (const k of ['APP_URL', 'HERDR_BIN', 'HOST_LABEL']) if (process.env[k]) env[k] = process.env[k]
+  for (const k of ['APP_URL', 'HERDR_BIN', 'HOST_LABEL', 'CLAUDE_CONFIG_DIR', 'WHERDR_SKILL']) if (ctx.env[k]) env[k] = ctx.env[k]
   const file = installService({ runtime, args, env, log: ctx.files.log })
   ok(`login service installed: ${file}`)
   say(c.dim(`    ${runtime} ${args.join(' ')}`))

package/bin/lib/core.mjs

@@ -17,6 +17,18 @@ export function homebrewInstall(file) {
   return /[\\/]Cellar[\\/]wherdr[\\/]/.test(file)
 }
 
+// How this copy of wherdr was installed (shared/updates.ts InstallMode), from
+// the path of its bin/wherdr.mjs: the Homebrew Cellar; the copy the Herdr
+// plugin keeps in <wherdr dir>/app; `npm i -g` (<prefix>/lib/node_modules/wherdr,
+// never a temporary npx folder); otherwise a temporary package (npx, bunx, pnpm dlx).
+export function installKind(bin, dir) {
+  if (homebrewInstall(bin)) return 'brew'
+  const root = path.resolve(bin, '..', '..')
+  if (root === path.join(dir, 'app')) return 'plugin'
+  if (/[\\/]lib[\\/]node_modules[\\/]wherdr$/.test(root) && !/[\\/]_npx[\\/]/.test(root)) return 'npm-global'
+  return 'npm'
+}
+
 export const COMMANDS = ['run', 'start', 'stop', 'restart', 'status', 'logs', 'open', 'phone', 'panel', 'service', 'doctor', 'help', 'version']
 const VALUE_OPTIONS = { '--port': 'port', '--host': 'host', '--data-dir': 'dataDir', '--session': 'session', '--lines': 'lines', '-n': 'lines' }
 const FLAGS = { '-h': 'help', '--help': 'help', '-v': 'version', '--version': 'version', '-f': 'follow', '--follow': 'follow' }
@@ -98,8 +110,12 @@ export function serverEnv(opts, env, home = os.homedir(), bin = BIN) {
   out.NODE_ENV = 'production'
   // Open WebSockets do not hold Ctrl+C for 30 s; clients reconnect on their own.
   out.NITRO_SHUTDOWN_TIMEOUT ??= '1500'
-  // Update command offered in the app (shared/updates.ts).
-  out.WHERDR_INSTALL = homebrewInstall(bin) ? 'brew' : 'npm'
+  // Update command, or one-tap update, offered in the app (shared/updates.ts):
+  // the package to replace and the folder of its state and log (server/utils/selfupdate.ts).
+  out.WHERDR_INSTALL = installKind(bin, dir)
+  out.WHERDR_ROOT = path.resolve(bin, '..', '..')
+  out.WHERDR_DIR = dir
+  if (out.CLAUDE_CONFIG_DIR) out.CLAUDE_CONFIG_DIR = path.resolve(home, expandHome(out.CLAUDE_CONFIG_DIR, home))
   // Nitro reads NITRO_PORT / NITRO_HOST before PORT / HOST.
   delete out.NITRO_PORT
   delete out.NITRO_HOST

package/bin/lib/install-skill.sh

@@ -0,0 +1,100 @@
+#!/bin/sh
+# Automatic startup is silent and best effort; explicit operations report errors.
+# Usage: sh bin/lib/install-skill.sh [auto|refresh|install|uninstall] [package root]
+install_skill() (
+  set -eu
+  [ -n "${HOME:-}" ] && [ -d "$HOME" ] || exit 0
+  root=${2:-$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd -P)}
+  mode=${1:-auto}
+  base=${WHERDR_DIR:-$HOME/wherdr}
+  case "$base" in /*) ;; *) base="$PWD/$base" ;; esac
+  dest="$base/skills/wherdr"
+  state="$HOME/.local/state/wherdr"
+  disabled="$state/skill-disabled"
+  claude=${CLAUDE_CONFIG_DIR:-$HOME/.claude}
+  case "$claude" in /*) ;; *) claude="$HOME/$claude" ;; esac
+  dirs() {
+    [ ! -d "$claude" ] || printf '%s\n' "$claude/skills"
+    if [ -d "$HOME/.agents" ] || [ -d "$HOME/.codex" ] || [ -d "$HOME/.omp" ]; then
+      printf '%s\n' "$HOME/.agents/skills"
+    fi
+  }
+  # Opt-out applies even to an explicit install; uninstall is always available.
+  if [ "$mode" != uninstall ]; then
+    [ "${WHERDR_SKILL:-}" != off ] || { echo 'wherdr skill: disabled by WHERDR_SKILL=off'; exit 0; }
+    [ "$mode" = install ] || [ ! -e "$disabled" ] || exit 0
+    [ -n "$(dirs)" ] || { echo 'wherdr skill: no installed agent found'; exit 0; }
+  fi
+  if [ "$mode" = uninstall ]; then
+    mkdir -p "$state"
+    [ ! -L "$disabled" ] || { echo 'wherdr skill: opt-out marker is a symlink' >&2; exit 1; }
+    [ -f "$disabled" ] || : > "$disabled"
+  fi
+  # Never follow a foreign symlink at the managed copy or its metadata.
+  [ ! -L "$dest" ] && [ ! -L "$dest/SKILL.md" ] && [ ! -L "$dest/.wherdr-managed" ] || {
+    echo 'wherdr skill: foreign symlink left alone' >&2; exit 0;
+  }
+  owned=false
+  [ ! -f "$dest/.wherdr-managed" ] || owned=true
+  if [ -e "$dest" ] && [ "$owned" = false ]; then
+    # Adopt an older plugin copy only when an agent links to this exact path.
+    legacy=$(dirs | while IFS= read -r d; do
+      if [ -L "$d/wherdr" ] && [ "$(readlink "$d/wherdr")" = "$dest" ]; then echo 1; fi
+    done)
+    [ -z "$legacy" ] || owned=true
+    [ "$owned" = true ] || { echo 'wherdr skill: existing foreign copy left alone'; exit 0; }
+  fi
+  case "$mode" in
+    auto|refresh|install)
+      [ -f "$root/skills/wherdr/SKILL.md" ] || { echo 'wherdr skill: bundled SKILL.md is missing' >&2; exit 1; }
+      mkdir -p "$dest"
+      if ! cmp -s "$root/skills/wherdr/SKILL.md" "$dest/SKILL.md"; then
+        tmp=$(mktemp "$dest/.SKILL.XXXXXX")
+        trap 'rm -f "$tmp"' EXIT HUP INT TERM
+        cp "$root/skills/wherdr/SKILL.md" "$tmp"
+        chmod 644 "$tmp"
+        mv -f "$tmp" "$dest/SKILL.md"
+      fi
+      [ -f "$dest/.wherdr-managed" ] || : > "$dest/.wherdr-managed"
+      dirs | while IFS= read -r d; do
+        link="$d/wherdr"
+        record="$d/.wherdr-managed-target"
+        # The record survives removal of an old WHERDR_DIR. A path's shape
+        # alone never proves ownership of a dangling link.
+        if [ -L "$link" ] && [ ! -e "$link" ] && [ -f "$record" ] && [ ! -L "$record" ] \
+          && [ "$(cat "$record")" = "$(readlink "$link")" ]; then
+          rm "$link"
+        fi
+        if [ ! -e "$link" ] && [ ! -L "$link" ]; then
+          mkdir -p "$d"
+          ln -s "$dest" "$link"
+        fi
+        if [ -L "$link" ] && [ "$(readlink "$link")" = "$dest" ] && [ ! -L "$record" ]; then
+          if [ ! -f "$record" ] || [ "$(cat "$record")" != "$dest" ]; then printf '%s\n' "$dest" > "$record"; fi
+        fi
+      done
+      [ "$mode" != install ] || rm -f "$disabled"
+      echo 'wherdr skill: installed or already up to date'
+      ;;
+    uninstall)
+      dirs | while IFS= read -r d; do
+        if [ -L "$d/wherdr" ] && [ "$(readlink "$d/wherdr")" = "$dest" ]; then
+          rm "$d/wherdr"
+          [ -L "$d/.wherdr-managed-target" ] || rm -f "$d/.wherdr-managed-target"
+        fi
+      done
+      if [ "$owned" = true ]; then
+        rm -f "$dest/SKILL.md" "$dest/.wherdr-managed"
+        rmdir "$dest" "$(dirname "$dest")" 2>/dev/null || true
+      fi
+      echo 'wherdr skill: uninstalled; automatic installation disabled'
+      ;;
+    *) echo 'usage: install-skill.sh [auto|refresh|install|uninstall] [package root]' >&2; exit 1 ;;
+  esac
+)
+if [ "${1:-auto}" = auto ]; then
+  ( install_skill "$@" ) >/dev/null 2>&1
+  exit 0
+else
+  install_skill "$@"
+fi

package/bin/lib/skill.mjs

@@ -0,0 +1,16 @@
+// The shell helper is also used without Node by the Docker / Herdr installer.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+export function refreshSkill(env = process.env) {
+  // One-shot handoff from the detached updater; never pass it to the server.
+  const refreshed = env.WHERDR_SKILL_REFRESHED === '1'
+  delete env.WHERDR_SKILL_REFRESHED
+  delete process.env.WHERDR_SKILL_REFRESHED
+  if (refreshed || env.WHERDR_SKILL === 'off') return
+  try {
+    spawnSync('sh', [fileURLToPath(new URL('./install-skill.sh', import.meta.url))], {
+      env, stdio: 'ignore', timeout: 5000,
+    })
+  } catch {} // Optional: a read-only home or missing shell must not prevent startup.
+}

package/bin/lib/tailnet.d.mts

@@ -1,13 +1,18 @@
 // Types of tailnet.mjs, for the server (server/utils/phone.ts).
-export interface PhoneAddress { url: string, served: boolean, httpsPort: string }
+// funnel: also published on the Internet by `tailscale funnel` (never adopted).
+export interface PhoneAddress { url: string, served: boolean, httpsPort: string, funnel?: boolean }
 export interface Tailnet {
   installed: boolean
-  bin?: string
+  bin?: string | null
+  // Tailscale's socket, when the state was read there (no CLI: Docker).
+  socket?: string | null
   name?: string | null
   connected?: boolean
   https?: boolean
   phone?: PhoneAddress | null
   taken?: boolean
+  // Addresses published for wherdr's port; null when they could not be read.
+  served?: string[] | null
 }
 export type Reach = 'ok' | 'host' | 'other' | 'unreachable'
 export type ReachCause = 'dns' | 'refused' | 'timeout' | 'cert' | 'tls' | 'network'
@@ -15,18 +20,22 @@ export interface Probe { reach: Reach, cause?: ReachCause, status?: number }
 export type ServeErrorCode = 'operator' | 'https' | 'offline'
 
 export const LINKS: { download: string, https: string, operator: string }
+export const TAILSCALED_SOCKET: string
+export function tailscaledSocket(env?: Record<string, string | undefined>, exists?: (p: string) => boolean): string | null
 export function tailscaleBin(env?: Record<string, string | undefined>, exists?: (p: string) => boolean): string | null
 export function tailnetStatus(statusJson: string): { name: string | null, connected: boolean, https: boolean }
 export function phoneAddress(name: string | null, port: string | number, serveJson: string): PhoneAddress | null
+export function servedAddresses(name: string | null, port: string | number, serveJson: string): string[] | null
 export function servedPorts(serveJson: string): string[]
 export function publishCommand(port: string | number, httpsPort?: string | number): string
 export function publishArgs(port: string | number): string[]
 export function unpublishArgs(httpsPort: string): string[]
 export function tailnetUrl(text: unknown): string | null
 export function serveError(output: string): { code: ServeErrorCode, link: string } | null
-export function inspect(port: string | number, bin?: string | null): Promise<Tailnet>
+export function inspect(port: string | number, bin?: string | null, socket?: string | null): Promise<Tailnet>
 export function tailnetDomain(resolvConf: string): string | null
 export function reachable(url: string, timeoutMs?: number): Promise<Reach>
+export function healthReach(status: number, text: string): 'ok' | 'host' | null
 export function probe(url: string, timeoutMs?: number): Promise<Probe>
 export function failureCause(err: unknown): ReachCause
 export function runTailscale(bin: string, args: string[], timeoutMs?: number): Promise<{ code: number, output: string }>

package/bin/lib/tailnet.mjs

@@ -7,6 +7,7 @@
 import { execFile } from 'node:child_process'
 import dns from 'node:dns'
 import { existsSync } from 'node:fs'
+import http from 'node:http'
 import https from 'node:https'
 import path from 'node:path'
 import { promisify } from 'node:util'
@@ -26,6 +27,32 @@ export function tailscaleBin(env = process.env, exists = existsSync) {
   return dirs.find(p => exists(p)) || null
 }
 
+// Tailscale's own socket on Linux. Its local API answers the same JSON as the
+// CLI: a Docker container has no `tailscale` command, but docker-compose.yml
+// mounts this folder, so wherdr reads the state there. Anyone may read; the
+// API also accepts changes from Tailscale's operator, but wherdr only ever
+// sends GET requests to it (localApi below).
+export const TAILSCALED_SOCKET = '/var/run/tailscale/tailscaled.sock'
+export function tailscaledSocket(env = process.env, exists = existsSync) {
+  const file = env.WHERDR_TAILSCALED_SOCKET || TAILSCALED_SOCKET
+  return exists(file) ? file : null
+}
+
+// GET on Tailscale's local API → the body, '' on any failure.
+function localApi(socketPath, route, timeoutMs = 4000) {
+  const { promise, resolve } = Promise.withResolvers()
+  const req = http.get({ socketPath, path: `/localapi/v0/${route}`, headers: { host: 'local-tailscaled.sock' }, timeout: timeoutMs }, (res) => {
+    let text = ''
+    res.setEncoding('utf8')
+    res.on('data', (c) => { if (text.length < 1 << 20) text += c })
+    res.on('end', () => resolve(res.statusCode === 200 ? text : ''))
+    res.on('error', () => resolve(''))
+  })
+  req.on('timeout', () => req.destroy())
+  req.on('error', () => resolve(''))
+  return promise
+}
+
 // `tailscale status --json` → { name, connected, https }: this machine's
 // tailnet name (machine.tailnet.ts.net) or null, whether Tailscale is up,
 // and whether the tailnet issues HTTPS certificates.
@@ -40,22 +67,51 @@ export function tailnetStatus(statusJson) {
   }
 }
 
+// The HTTPS entries of a serve configuration that proxy to wherdr's local
+// port on this machine's own name: [{ hostPort, httpsPort, funnel }], or null
+// when the configuration could not be read (Tailscale stopped, not JSON).
+// Background entries (`--bg`) and those of a `tailscale serve` still running
+// in a terminal (Foreground) both count. `funnel`: also open to the Internet.
+function wherdrEntries(name, port, serveJson) {
+  let config = null
+  try { config = JSON.parse(serveJson) } catch {}
+  if (!name || !config || typeof config !== 'object' || Array.isArray(config)) return null
+  const target = new RegExp(`^(https?://)?(127\\.0\\.0\\.1|localhost):${port}/?$`)
+  const out = []
+  for (const part of [config, ...Object.values(config.Foreground || {})]) {
+    for (const [hostPort, entry] of Object.entries(part?.Web || {})) {
+      const colon = hostPort.lastIndexOf(':')
+      if (hostPort.slice(0, colon).toLowerCase() !== name.toLowerCase()) continue
+      if (!Object.values(entry?.Handlers || {}).some(h => target.test(h?.Proxy || ''))) continue
+      out.push({ hostPort, httpsPort: hostPort.slice(colon + 1), funnel: Boolean(part.AllowFunnel?.[hostPort]) })
+    }
+  }
+  return out
+}
+
+const addressOf = (name, httpsPort) => `https://${name}${httpsPort === '443' ? '' : `:${httpsPort}`}/`
+
 // Phone address: the `tailscale serve` entry whose proxy targets wherdr's
 // local port (served on any HTTPS port), else the address publishing would
 // give (same port) with served: false. Null without a tailnet name.
 export function phoneAddress(name, port, serveJson) {
   if (!name) return null
-  let web = {}
-  try { web = JSON.parse(serveJson || '{}')?.Web || {} } catch {}
-  const target = new RegExp(`^(https?://)?(127\\.0\\.0\\.1|localhost):${port}/?$`)
-  for (const [hostPort, entry] of Object.entries(web)) {
-    if (!Object.values(entry?.Handlers || {}).some(h => target.test(h?.Proxy || ''))) continue
-    const servedPort = hostPort.slice(hostPort.lastIndexOf(':') + 1)
-    return { url: `https://${name}${servedPort === '443' ? '' : `:${servedPort}`}/`, served: true, httpsPort: servedPort }
-  }
+  const entries = wherdrEntries(name, port, serveJson) || []
+  const hit = entries.find(e => !e.funnel) || entries[0]
+  if (hit) return { url: addressOf(name, hit.httpsPort), served: true, httpsPort: hit.httpsPort, ...(hit.funnel ? { funnel: true } : {}) }
   return { url: `https://${name}:${port}/`, served: false, httpsPort: String(port) }
 }
 
+// The addresses wherdr adopts by itself (server/utils/phone.ts): what
+// `tailscale serve` publishes for its port on this machine's name, read from
+// Tailscale, which only the owner of the machine configures. null: unknown
+// (nothing is changed then); []: nothing is published. An address that
+// `tailscale funnel` also opens to the Internet is never adopted.
+export function servedAddresses(name, port, serveJson) {
+  const entries = wherdrEntries(name, port, serveJson)
+  return entries && entries.filter(e => !e.funnel).map(e => addressOf(name, e.httpsPort))
+}
+
 // HTTPS ports already published by `tailscale serve` (for anything).
 export function servedPorts(serveJson) {
   try {
@@ -92,16 +148,18 @@ export function serveError(output) {
   return null
 }
 
-// Tailscale's state for wherdr's port: { installed, bin, connected, https, name, phone, taken }.
-export async function inspect(port, bin = tailscaleBin()) {
-  if (!bin) return { installed: false }
+// Tailscale's state for wherdr's port: { installed, bin, socket, connected,
+// https, name, phone, taken, served }. Read with the CLI, or without one
+// (Docker) from Tailscale's socket.
+export async function inspect(port, bin = tailscaleBin(), socket = bin ? null : tailscaledSocket()) {
+  if (!bin && !socket) return { installed: false }
   const run = args => exec(bin, args, { encoding: 'utf8', timeout: 8000 }).then(r => r.stdout, () => '')
-  const status = tailnetStatus(await run(['status', '--json']))
-  const serve = status.name ? await run(['serve', 'status', '--json']) : ''
+  const status = tailnetStatus(bin ? await run(['status', '--json']) : await localApi(socket, 'status?peers=false'))
+  const serve = !status.name ? '' : bin ? await run(['serve', 'status', '--json']) : await localApi(socket, 'serve-config')
   const phone = phoneAddress(status.name, port, serve)
   // Publishing on wherdr's port would replace whatever else is served there.
   const taken = Boolean(phone && !phone.served && servedPorts(serve).includes(String(port)))
-  return { installed: true, bin, ...status, phone, taken }
+  return { installed: true, bin, socket, ...status, phone, taken, served: servedAddresses(status.name, port, serve) }
 }
 
 // The tailnet's DNS suffix (tailnet.ts.net) from /etc/resolv.conf's search
@@ -152,29 +210,49 @@ export function failureCause(err) {
   return 'network'
 }
 
-// reachable() with the details: { reach, cause?, status? }: `cause` when
-// unreachable (failureCause), `status` the HTTP code when something answered.
-export function probe(url, timeoutMs = 8000) {
+// GET of `route` on the address → { status, text }, or { cause } when it failed.
+function fetchText(url, route, timeoutMs) {
   const { promise, resolve } = Promise.withResolvers()
   let u
-  try { u = new URL('manifest.webmanifest', url) } catch { return Promise.resolve({ reach: 'unreachable', cause: 'network' }) }
+  try { u = new URL(route, url) } catch { return Promise.resolve({ cause: 'network' }) }
   // Accept JSON: a refused host then answers { code: 'host' }, not the HTML page.
   const req = https.get(u, { lookup, timeout: timeoutMs, headers: { accept: 'application/json' } }, (res) => {
     let text = ''
     res.setEncoding('utf8')
     res.on('data', (c) => { if (text.length < 65536) text += c })
-    res.on('end', () => {
-      const status = res.statusCode || 0
-      if (status >= 200 && status < 300) resolve({ reach: text.includes('wherdr') ? 'ok' : 'other', status })
-      else resolve({ reach: status === 403 && /"code"\s*:\s*"host"/.test(text) ? 'host' : 'other', status })
-    })
-    res.on('error', e => resolve({ reach: 'unreachable', cause: failureCause(e) }))
+    res.on('end', () => resolve({ status: res.statusCode || 0, text }))
+    res.on('error', e => resolve({ cause: failureCause(e) }))
   })
   req.on('timeout', () => req.destroy(new Error('timeout')))
-  req.on('error', e => resolve({ reach: 'unreachable', cause: failureCause(e) }))
+  req.on('error', e => resolve({ cause: failureCause(e) }))
   return promise
 }
 
+// What an answer of /api/health means: 'ok' (wherdr, and it accepts this
+// address), 'host' (wherdr's host check refused it), or null: not a wherdr
+// that has this route (versions up to 1.3.1, or another program).
+export function healthReach(status, text) {
+  if (status >= 200 && status < 300 && /"name"\s*:\s*"wherdr"/.test(text)) return 'ok'
+  if (status === 403 && /"code"\s*:\s*"host"/.test(text)) return 'host'
+  return null
+}
+
+// reachable() with the details: { reach, cause?, status? }: `cause` when
+// unreachable (failureCause), `status` the HTTP code when something answered.
+// /api/health is asked first: it goes through wherdr's host check, which the
+// static manifest does not (it answers for any host name). The manifest only
+// recognizes an older wherdr without that route.
+export async function probe(url, timeoutMs = 8000) {
+  const health = await fetchText(url, 'api/health', timeoutMs)
+  if (health.cause) return { reach: 'unreachable', cause: health.cause }
+  const reach = healthReach(health.status, health.text)
+  if (reach) return { reach, status: health.status }
+  const manifest = await fetchText(url, 'manifest.webmanifest', timeoutMs)
+  if (manifest.cause) return { reach: 'unreachable', cause: manifest.cause }
+  const ok = manifest.status >= 200 && manifest.status < 300 && manifest.text.includes('wherdr')
+  return { reach: ok ? 'ok' : 'other', status: ok ? manifest.status : health.status }
+}
+
 // Runs `tailscale <args>` without a terminal → { code, output }. On a tailnet
 // without HTTPS, `tailscale serve` prints a link and waits: the timeout ends it.
 export function runTailscale(bin, args, timeoutMs = 30_000) {