First-class Tailscale support (status, serve/funnel, doctor, docs) - #2451
sethkarten wants to merge 10 commits into
Conversation
Prime Agent performance — completedPR Overall: 0 regressed · 0 improved · 41 no clear change.
Python runtime
Session transport
UI interactions
Sandbox cost: ~$0.1017 — no inference calls. Methodology and samplesMain resolved at 2026-09-21T20:19:10.817327+00:00. Harness
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
sethkarten
changed the title
9d87c71 to
99b8beb
Compare
99b8beb to
75cac35
Compare
75cac35 to
147f6ad
Compare
147f6ad to
5170bc3
Compare
…funnel, doctor, docs) prime-agent tailscale: tailnet and MagicDNS detection with teaching errors, serve --port [--funnel] wrapping tailscale serve/funnel for any local bridge, a Tailscale section in doctor, and docs for the three patterns (Tailscale SSH remote control, tailnet exposure, MagicDNS reach from cloud containers + the official Tailscale MCP connector). No new dependencies: shells out to the tailscale CLI detected at runtime.
5170bc3 to
295255b
Compare
|
CORRECTION (process incident, transparency): replies at 147f6ad and 5170bc3 claimed some fixes that were lost from the tree before those commits were pushed. Audit of the pushed commits shows these claims were NOT in those commits but ARE now verifiably in 295255b (grep-verified in the pushed head):
Root cause: a multi-step edit round where one edit step mutated the file in memory but was not persisted before an inspection step, and a later step re-read the file and wrote a tree missing the unpersisted change. Fixes that WERE correctly present at those commits: funnel AllowFunnel check, docs (userspace networking, Tailscale SSH prerequisites), changeset wording, host-suffix comment. All four of today's new findings trace exactly to the lost edits and are fixed at 295255b with tests green and the full check chain green. My process now greps the COMMIT content before posting any "fixed at " reply. |
…lure; drop dead offline branch Post-serve verification with unparseable serve status output now prints the parse-failure line (matching the status command) and exits 1, instead of the pending-enable warning for an enable flow that never happened. The status command's !onTailnet branch dropped its offlineButUp sub-branch: offlineButUp implies onTailnet, so an offline node reaches the success path, which already prints its state.
…lect-ai/prime-agent into rsi/tailscale-support
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6275e7c. Configure here.
| const host = | ||
| probe.hostname.endsWith(`.${suffix}`) || probe.hostname === suffix | ||
| ? probe.hostname | ||
| : `${probe.hostname}.${suffix}`; |
There was a problem hiding this comment.
Invented MagicDNS suffix
Low Severity
After a successful serve, a missing magicDnsSuffix is replaced with ts.net and appended to the short node name. That prints a fabricated reachability host instead of omitting the URL the way a missing hostname already does.
Reviewed by Cursor Bugbot for commit 6275e7c. Configure here.
2 participants
Motivation
Every AI harness needs to support Tailscale: agents run in containers, on laptops, and in CI; Tailscale is the standard zero-config way to reach them (user directive). This gives prime-agent first-class Tailscale awareness instead of leaving users to hand-wire it.
What it adds
prime-agent tailscale- tailnet state, MagicDNS name, and served endpoints (listen/path -> targetfromtailscale serve status --json)prime-agent tailscale serve --port <n> [--funnel]- wrapstailscale serve --bg localhost:<n>/tailscale funnel --bg localhost:<n>; requires an explicit--port(never guesses a default), validates 1-65535 BEFORE any side effect, exits 1 on every failuretailscalecan exit 0 after only printing an interactive enable URL without configuring anything (enableFeatureInteractive); the wrapper re-readsserve status --jsonand refuses success when the target is absent--jsonmachine-readable statusdoctor --jsonstays pure JSON)Backend-state diagnosis
BackendStatedrives the diagnosis, not justSelf.Online: a node whose daemon is Running but currently unreachable is reported "up on a tailnet (currently offline)", not wrongly told to runtailscale up. Top-levelMagicDNSSuffixis deprecated upstream;CurrentTailnet.MagicDNSSuffixis preferred when present.Verification
serve|funnel --bg localhost:<n>pinned exactly), post-serve verification (pending-enable detection), parser forms (--port n,--port=n, bare serve refusal, unknown subcommand errors), status failure diagnostics (empty-stderr case)whichdependency; Windows-safe)Note
Medium Risk
New serve/funnel wrappers change network exposure for local ports, though use is explicit and verified; otherwise CLI probing and doctor output only.
Overview
Adds
prime-agent tailscaleas a tailnet-aware CLI: default status reports MagicDNS, node hostname, and localservemappings (human or--json), andserve --port <n> [--funnel]wrapstailscale serve|funnel --bg localhost:<n>with pre-flight checks (CLI present, node on tailnet, port 1–65535, no default port) and post-serve verification viaserve status --jsonso exit 0 alone cannot claim success when the port is not actually served or funnel is not enabled.probeTailscaledistinguishes missing CLI, failing status, stopped backend vs running-but-offline, and prefersCurrentTailnet.MagicDNSSuffix. Non-JSONdoctorappends one-line Tailscale facts;doctor --jsonis unchanged.Docs in
docs/tailscale.mdand a changelog entry cover Tailscale SSH, serve/funnel, container MagicDNS, and Tailscale MCP. Vitest shims cover parsing edge cases (including refusing accidental public--funnel), serve argv, and exact port matching in verification.Reviewed by Cursor Bugbot for commit 6275e7c. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Add
tailscaleCLI command for status, serve/funnel, and doctor detectiontailscaleCLI command withstatus(human and--jsonoutput) andserve --port/--funnelsubcommands, wired through the public command dispatcher in public-command.tsprobeTailscaledetection distinguishing missing CLI, failing CLI, stopped backend, online node, and offline-but-configured state, exposing MagicDNS suffix and hostnamedoctoroutput viatailscaleDoctorFactstailscale serveruns a background Tailscale process and post-verifies the endpoint viaserve-statusJSON, failing with exit code 1 if the requested local port is not confirmed;doctornow appends a Tailscale facts line to normal outputMacroscope summarized 6275e7c.