First-class Tailscale support (status, serve/funnel, doctor, docs) - #2451
sethkarten wants to merge 1 commit into
Conversation
Prime Agent performance — completedPR Overall: 0 regressed · 0 improved · 41 no clear change.
Python runtime
Session transport
UI interactions
Sandbox cost: ~$0.1492 — no inference calls. Methodology and samplesMain resolved at 2026-09-18T09:44:30.733940+00:00. Harness
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
sethkarten
changed the title
9d87c71 to
99b8beb
Compare
99b8beb to
75cac35
Compare
75cac35 to
147f6ad
Compare
147f6ad to
5170bc3
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5170bc3. Configure here.
…funnel, doctor, docs) prime-agent tailscale: tailnet and MagicDNS detection with teaching errors, serve --port [--funnel] wrapping tailscale serve/funnel for any local bridge, a Tailscale section in doctor, and docs for the three patterns (Tailscale SSH remote control, tailnet exposure, MagicDNS reach from cloud containers + the official Tailscale MCP connector). No new dependencies: shells out to the tailscale CLI detected at runtime.
5170bc3 to
295255b
Compare
|
CORRECTION (process incident, transparency): replies at 147f6ad and 5170bc3 claimed some fixes that were lost from the tree before those commits were pushed. Audit of the pushed commits shows these claims were NOT in those commits but ARE now verifiably in 295255b (grep-verified in the pushed head):
Root cause: a multi-step edit round where one edit step mutated the file in memory but was not persisted before an inspection step, and a later step re-read the file and wrote a tree missing the unpersisted change. Fixes that WERE correctly present at those commits: funnel AllowFunnel check, docs (userspace networking, Tailscale SSH prerequisites), changeset wording, host-suffix comment. All four of today's new findings trace exactly to the lost edits and are fixed at 295255b with tests green and the full check chain green. My process now greps the COMMIT content before posting any "fixed at " reply. |
2 participants
Motivation
Every AI harness needs to support Tailscale: agents run in containers, on laptops, and in CI; Tailscale is the standard zero-config way to reach them (user directive). This gives prime-agent first-class Tailscale awareness instead of leaving users to hand-wire it.
What it adds
prime-agent tailscale- tailnet state, MagicDNS name, and served endpoints (listen/path -> targetfromtailscale serve status --json)prime-agent tailscale serve --port <n> [--funnel]- wrapstailscale serve --bg localhost:<n>/tailscale funnel --bg localhost:<n>; requires an explicit--port(never guesses a default), validates 1-65535 BEFORE any side effect, exits 1 on every failuretailscalecan exit 0 after only printing an interactive enable URL without configuring anything (enableFeatureInteractive); the wrapper re-readsserve status --jsonand refuses success when the target is absent--jsonmachine-readable statusdoctor --jsonstays pure JSON)Backend-state diagnosis
BackendStatedrives the diagnosis, not justSelf.Online: a node whose daemon is Running but currently unreachable is reported "up on a tailnet (currently offline)", not wrongly told to runtailscale up. Top-levelMagicDNSSuffixis deprecated upstream;CurrentTailnet.MagicDNSSuffixis preferred when present.Verification
serve|funnel --bg localhost:<n>pinned exactly), post-serve verification (pending-enable detection), parser forms (--port n,--port=n, bare serve refusal, unknown subcommand errors), status failure diagnostics (empty-stderr case)whichdependency; Windows-safe)Note
Medium Risk
The new commands shell out to Tailscale and can expose local ports on the tailnet or publicly via funnel; mistakes in parsing or verification could misreport success, though serve requires an explicit port and post-serve checks mitigate false positives.
Overview
Adds
prime-agent tailscaleso the CLI can probe the local Tailscale install, report tailnet/MagicDNS/served endpoints, and wraptailscale serve --bg/funnel --bgwith an explicit--port(optional--funnel). Status supports--json;servevalidates the port up front, re-readsserve status --jsonafter a zero exit (so pending interactive enable flows do not count as success), and checks funnel ACL state when--funnelis set.prime-agent doctor(human output only) appends one-line Tailscale facts from the same probe logic. Help/registry wiring,docs/tailscale.md, a changelog note, and vitest coverage (argv parsing, backend offline vs stopped, post-serve verification) ship with the feature.Reviewed by Cursor Bugbot for commit 295255b. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Add
tailscalecommand for status, serve/funnel, and doctor integrationtailscalecommand group to theprime-agentCLI. The defaultstatusmode reports tailnet state, MagicDNS identity, and served endpoints, with machine-readable output via--json.tailscale serverequires a numeric port, validates the port range, and exposes the local port via Tailscale serve or funnel. It verifies the exact port is configured post-command.prime-agent doctornow includes Tailscale detection, reporting whether the CLI is missing, unusable, disconnected, offline, or on a tailnet.runTailscalein tailscale.ts uses synchronous hidden execution with a 15-second timeout and SIGKILL termination; ensure this blocking call does not stall the CLI on hung processes.Macroscope summarized 295255b.