First-class Tailscale support (status, serve/funnel, doctor, docs) - #2451
sethkarten wants to merge 6 commits into
Conversation
Prime Agent performance — completedPR Overall: 1 regressed · 1 improved · 39 no clear change.
Python runtime
Session transport
UI interactions
Sandbox cost: ~$0.1023 — no inference calls. Methodology and samplesMain resolved at 2026-09-21T12:46:04.266085+00:00. Harness
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
sethkarten
changed the title
9d87c71 to
99b8beb
Compare
99b8beb to
75cac35
Compare
75cac35 to
147f6ad
Compare
147f6ad to
5170bc3
Compare
…funnel, doctor, docs) prime-agent tailscale: tailnet and MagicDNS detection with teaching errors, serve --port [--funnel] wrapping tailscale serve/funnel for any local bridge, a Tailscale section in doctor, and docs for the three patterns (Tailscale SSH remote control, tailnet exposure, MagicDNS reach from cloud containers + the official Tailscale MCP connector). No new dependencies: shells out to the tailscale CLI detected at runtime.
5170bc3 to
295255b
Compare
|
CORRECTION (process incident, transparency): replies at 147f6ad and 5170bc3 claimed some fixes that were lost from the tree before those commits were pushed. Audit of the pushed commits shows these claims were NOT in those commits but ARE now verifiably in 295255b (grep-verified in the pushed head):
Root cause: a multi-step edit round where one edit step mutated the file in memory but was not persisted before an inspection step, and a later step re-read the file and wrote a tree missing the unpersisted change. Fixes that WERE correctly present at those commits: funnel AllowFunnel check, docs (userspace networking, Tailscale SSH prerequisites), changeset wording, host-suffix comment. All four of today's new findings trace exactly to the lost edits and are fixed at 295255b with tests green and the full check chain green. My process now greps the COMMIT content before posting any "fixed at " reply. |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 70fb80c. Configure here.
2 participants
Motivation
Every AI harness needs to support Tailscale: agents run in containers, on laptops, and in CI; Tailscale is the standard zero-config way to reach them (user directive). This gives prime-agent first-class Tailscale awareness instead of leaving users to hand-wire it.
What it adds
prime-agent tailscale- tailnet state, MagicDNS name, and served endpoints (listen/path -> targetfromtailscale serve status --json)prime-agent tailscale serve --port <n> [--funnel]- wrapstailscale serve --bg localhost:<n>/tailscale funnel --bg localhost:<n>; requires an explicit--port(never guesses a default), validates 1-65535 BEFORE any side effect, exits 1 on every failuretailscalecan exit 0 after only printing an interactive enable URL without configuring anything (enableFeatureInteractive); the wrapper re-readsserve status --jsonand refuses success when the target is absent--jsonmachine-readable statusdoctor --jsonstays pure JSON)Backend-state diagnosis
BackendStatedrives the diagnosis, not justSelf.Online: a node whose daemon is Running but currently unreachable is reported "up on a tailnet (currently offline)", not wrongly told to runtailscale up. Top-levelMagicDNSSuffixis deprecated upstream;CurrentTailnet.MagicDNSSuffixis preferred when present.Verification
serve|funnel --bg localhost:<n>pinned exactly), post-serve verification (pending-enable detection), parser forms (--port n,--port=n, bare serve refusal, unknown subcommand errors), status failure diagnostics (empty-stderr case)whichdependency; Windows-safe)Note
Medium Risk
New CLI paths invoke Tailscale serve/funnel and can expose local services on the tailnet or publicly when
--funnelis used; behavior is delegated to the externaltailscalebinary with validation rather than changes to core agent auth or data handling.Overview
Adds first-class Tailscale to
prime-agentvia a new top-leveltailscalecommand, wired through the command registry and public CLI dispatcher.prime-agent tailscale(default status) probes thetailscaleCLI, reports tailnet/MagicDNS/node state (including Running-but-offline vs stopped), lists active serve/funnel mappings fromserve status --json, and supports--json.tailscale serve --port <n> [--funnel]wrapstailscale serve|funnel --bg localhost:<n>with required explicit ports (1–65535), pre-flight checks, and post-serve verification so exit 0 alone cannot claim success when the port is not actually served or funnel is not enabled.prime-agent doctor(human output only, not--json) appends one-line Tailscale facts from the same probe. Newdocs/tailscale.mdand a changelog entry document SSH remote control, serve/funnel, MagicDNS/containers, and Tailscale MCP. Vitest coverage uses a shimmedtailscalebinary for probe, parser edge cases, and exact port matching.Reviewed by Cursor Bugbot for commit 3c79aa9. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Add
tailscaleCLI command forstatus,serve/funnel, anddoctortailscalecommand group in command-registry.ts and dispatches it via public-command.tsrunTailscaleStatusprobes the Tailscale CLI, reports tailnet and MagicDNS identity, lists locally served endpoints, and supports JSON outputrunTailscaleServevalidates ports, runsserveorfunnelin background mode, and verifies the exact local target is configured before reporting successrunDoctorappends Tailscale installation and tailnet facts to human-readable reports; JSON and fix-mode output are unchangedrunTailscaleServeexits non-zero iftailscaleStatusJsonverification does not match the exact requested port or if funnel enablement is unconfirmedMacroscope summarized 3c79aa9.