| Files | Last commit | Last update |
|---|---|---|
Phones hear a routes change inside their session before the relay acts (#4695) A phone restricted to Wi-Fi and Tailscale was never told: on the relay it was dropped at once (4404) and said "asleep or offline"; on Wi-Fi its sheet kept "Anywhere"; away from home it could never learn it was allowed again. - companion.endpoints: the device's endpoint list, pushed as an id-less event on every /api/events stream it holds when its routes change. - Narrowing holds the relay admission 300 ms (in the set itself) so the event lands, then shrinks it and closes relay sessions; direct ones stay. Widening admits first, then tells. - A "local" descriptor keeps h/r (vectors: routes_local_with_relay is valid; new SHA-256 5471a007…bf4e), so a restricted phone can probe the relay. - A paired device whose token is never used within 5 min is dropped. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> | 5 hours ago | |
Phones hear a routes change inside their session before the relay acts (#4695) A phone restricted to Wi-Fi and Tailscale was never told: on the relay it was dropped at once (4404) and said "asleep or offline"; on Wi-Fi its sheet kept "Anywhere"; away from home it could never learn it was allowed again. - companion.endpoints: the device's endpoint list, pushed as an id-less event on every /api/events stream it holds when its routes change. - Narrowing holds the relay admission 300 ms (in the set itself) so the event lands, then shrinks it and closes relay sessions; direct ones stay. Widening admits first, then tells. - A "local" descriptor keeps h/r (vectors: routes_local_with_relay is valid; new SHA-256 5471a007…bf4e), so a restricted phone can probe the relay. - A paired device whose token is never used within 5 min is dropped. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> | 5 hours ago | |
companion: serve the end-to-end connection (direct and relay), WIP Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 1 day ago | |
companion: union the three lines of review hardening The sidecar was reviewed three times in parallel — on its own PR, under the toggle PR, and under the iOS PR — and each line fixed what its review found. This folds all three into one, keeping the strongest version wherever two lines fixed the same thing differently: From the iOS line: CRLF/bare-CR-tolerant SSE framing; the mDNS on-link check derived from interface netmasks rather than an RFC 1918 prefix guess, plus byte-budget clamping for TXT names; device-record normalization that rejects zero and negative timestamps; named state-file modes; the byte-pipe branch destroying the response when the harness dies mid-image; a 16 MiB ceiling on `tailscale status` output. From the toggle line: fail-closed scrubbing — a response that parses but cannot be scrubbed is a 502, never forwarded raw; pairing that rolls back and reports when the write fails, and a lastSeenAt write failure that no longer signs a phone out; `originIsLoopback` on the control plane; a runnable bin (shebang, exec bit, restored bin entry); the self-scheduling control-page poll. Kept from this line where others regressed it: `+json` structured-suffix scrubbing; the fail-closed SSE ceiling (the toggle line's cap silently dropped a frame); the goodbye-datagram flush; the headers-phase deadline with its 504/502 distinction; the pairing code checked before the device cap, so a wrong guess cannot probe fleet state. One bearer parser everywhere, case-insensitive per RFC 7235. | 2 months ago |