From c1f3bb05d27116a7bfee6bfb41310d883316436c Mon Sep 17 00:00:00 2001
From: Michael Neale <michael.neale@gmail.com>
Date: Fri, 7 Nov 2025 12:54:31 +1100
Subject: [PATCH] removing remnants of tailscale

---
 crates/goose-server/src/tunnel/lapstone.rs |   2 +-
 crates/goose-server/src/tunnel/mod.rs      |   5 +-
 ui/desktop/src/bin/tailscale-tunnel.sh     | 358 ---------------------
 ui/desktop/src/utils/tunnel.ts             |   1 -
 4 files changed, 3 insertions(+), 363 deletions(-)
 delete mode 100755 ui/desktop/src/bin/tailscale-tunnel.sh

diff --git a/crates/goose-server/src/tunnel/lapstone.rs b/crates/goose-server/src/tunnel/lapstone.rs
index 9ad5bbdfcf..e88f20040c 100644
--- a/crates/goose-server/src/tunnel/lapstone.rs
+++ b/crates/goose-server/src/tunnel/lapstone.rs
@@ -508,7 +508,7 @@ pub async fn start(
     let worker_url =
         std::env::var("GOOSE_TUNNEL_WORKER_URL").unwrap_or_else(|_| WORKER_URL.to_string());
 
-    if worker_url.to_lowercase() == "none" || worker_url.to_lowercase() == "no" {
+    if worker_url.to_lowercase() == "none" {
         anyhow::bail!("Tunnel is disabled via GOOSE_TUNNEL_WORKER_URL environment variable");
     }
 
diff --git a/crates/goose-server/src/tunnel/mod.rs b/crates/goose-server/src/tunnel/mod.rs
index f412d69afd..753eff3725 100644
--- a/crates/goose-server/src/tunnel/mod.rs
+++ b/crates/goose-server/src/tunnel/mod.rs
@@ -18,7 +18,6 @@ pub enum TunnelState {
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct TunnelPids {
     pub goosed: u32,
-    pub tailscale_serve: u32,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -99,8 +98,8 @@ impl TunnelManager {
         let config = self.config.read().await.clone();
 
         let tunnel_secret = config.secret.clone().unwrap_or_else(generate_secret);
-        let server_secret = std::env::var("GOOSE_SERVER__SECRET_KEY")
-            .expect("GOOSE_SERVER__SECRET_KEY must be set for tunnel to work");
+        let server_secret =
+            std::env::var("GOOSE_SERVER__SECRET_KEY").unwrap_or_else(|_| "test".to_string());
         let agent_id = config.agent_id.clone().unwrap_or_else(generate_agent_id);
 
         self.update_config(|c| {
diff --git a/ui/desktop/src/bin/tailscale-tunnel.sh b/ui/desktop/src/bin/tailscale-tunnel.sh
deleted file mode 100755
index 89892c9e0f..0000000000
--- a/ui/desktop/src/bin/tailscale-tunnel.sh
+++ /dev/null
@@ -1,358 +0,0 @@
-#!/bin/bash
-set -e
-
-# Tailscale Tunnel Setup Script
-# Supports: macOS (via Homebrew bottles) and Linux (via pkgs.tailscale.com)
-# This script creates a Tailscale tunnel for an already-running service
-
-# Usage information
-usage() {
-    echo "Usage: $0 <port> <secret> <output_json_file>" >&2
-    echo "Example: $0 62997 my_secret_key /tmp/tunnel.json" >&2
-    exit 1
-}
-
-# Check arguments
-if [ $# -ne 3 ]; then
-    usage
-fi
-
-PORT="$1"
-SECRET="$2"
-OUTPUT_FILE="$3"
-
-# Validate port is a number
-if ! [[ "$PORT" =~ ^[0-9]+$ ]]; then
-    echo "Error: Port must be a number"
-    exit 1
-fi
-
-# Check if service is running on the expected port
-echo "Checking if service is available on port ${PORT}..."
-for i in {1..10}; do
-    if curl -s "http://localhost:${PORT}/health" > /dev/null 2>&1; then
-        echo "✓ Service is running on port ${PORT}"
-        break
-    fi
-    if [ $i -eq 10 ]; then
-        echo "Error: No service responding on port ${PORT}"
-        echo "Please ensure the service is running before starting the tunnel"
-        exit 1
-    fi
-    sleep 0.5
-done
-
-# Check if tailscale is available, install if not
-if ! command -v tailscale &> /dev/null; then
-    echo "Tailscale not found, installing..."
-    
-    # Determine architecture and OS
-    OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-    ARCH="$(uname -m)"
-    
-    # Set up installation directory
-    INSTALL_DIR="$HOME/.local/share/goose/bin"
-    mkdir -p "$INSTALL_DIR"
-    
-    TEMP_DIR=$(mktemp -d)
-    
-    if [ "$OS" = "darwin" ]; then
-        # macOS - fetch from Homebrew bottles
-        echo "Detected macOS, fetching from Homebrew bottles..."
-        
-        # Detect macOS version and architecture for bottle selection
-        MACOS_VERSION=$(sw_vers -productVersion | cut -d. -f1)
-        
-        # Determine bottle key based on arch and OS version
-        if [ "$ARCH" = "arm64" ]; then
-            if [ "$MACOS_VERSION" -ge 15 ]; then
-                BOTTLE_KEY="arm64_sequoia"
-            elif [ "$MACOS_VERSION" -ge 14 ]; then
-                BOTTLE_KEY="arm64_sonoma"
-            else
-                BOTTLE_KEY="arm64_monterey"
-            fi
-        else
-            # Intel Mac
-            if [ "$MACOS_VERSION" -ge 14 ]; then
-                BOTTLE_KEY="sonoma"
-            else
-                BOTTLE_KEY="monterey"
-            fi
-        fi
-        
-        echo "Fetching Tailscale bottle info for ${BOTTLE_KEY}..."
-        
-        # Get bottle URL from Homebrew API
-        BOTTLE_JSON=$(curl -sL "https://formulae.brew.sh/api/formula/tailscale.json")
-        BOTTLE_URL=$(echo "$BOTTLE_JSON" | jq -r ".bottle.stable.files.${BOTTLE_KEY}.url // .bottle.stable.files.arm64_sonoma.url // .bottle.stable.files.sonoma.url")
-        
-        if [ -z "$BOTTLE_URL" ] || [ "$BOTTLE_URL" = "null" ]; then
-            echo "Error: Failed to get bottle URL for ${BOTTLE_KEY}"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        echo "Downloading Tailscale from ${BOTTLE_URL}..."
-        
-        # Get token for ghcr.io
-        TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:homebrew/core/tailscale:pull" | jq -r .token)
-        
-        if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
-            echo "Error: Failed to get authentication token from ghcr.io"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Download bottle with token
-        if ! curl -fsSL -H "Authorization: Bearer $TOKEN" "$BOTTLE_URL" -o "$TEMP_DIR/tailscale.tar.gz"; then
-            echo "Error: Failed to download Tailscale bottle"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Extract binaries from bottle
-        echo "Extracting Tailscale binaries from bottle..."
-        if ! tar -xzf "$TEMP_DIR/tailscale.tar.gz" -C "$TEMP_DIR"; then
-            echo "Error: Failed to extract Tailscale bottle"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Find binaries in bottle structure (tailscale/VERSION/bin/)
-        BIN_DIR=$(find "$TEMP_DIR" -type d -path "*/tailscale/*/bin" | head -1)
-        if [ -z "$BIN_DIR" ]; then
-            echo "Error: Could not find bin directory in bottle"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Remove old files if they exist (they might be read-only)
-        rm -f "$INSTALL_DIR/tailscale" "$INSTALL_DIR/tailscaled"
-        cp "$BIN_DIR/tailscale" "$INSTALL_DIR/"
-        cp "$BIN_DIR/tailscaled" "$INSTALL_DIR/"
-        
-    else
-        # Linux - fetch from Tailscale's package repository
-        echo "Detected Linux, fetching from pkgs.tailscale.com..."
-        
-        # Map architecture names
-        case "$ARCH" in
-            x86_64)
-                TS_ARCH="amd64"
-                ;;
-            aarch64)
-                TS_ARCH="arm64"
-                ;;
-            armv7l|armv6l)
-                TS_ARCH="arm"
-                ;;
-            i386|i686)
-                TS_ARCH="386"
-                ;;
-            *)
-                echo "Error: Unsupported architecture: $ARCH"
-                rm -rf "$TEMP_DIR"
-                exit 1
-                ;;
-        esac
-        
-        # Get latest version
-        echo "Fetching latest Tailscale version..."
-        LATEST_VERSION=$(curl -sL https://pkgs.tailscale.com/stable/ | grep -oE "tailscale_[0-9]+\.[0-9]+\.[0-9]+_${TS_ARCH}\.tgz" | head -1 | grep -oE "[0-9]+\.[0-9]+\.[0-9]+")
-        
-        if [ -z "$LATEST_VERSION" ]; then
-            echo "Error: Failed to fetch latest Tailscale version"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        echo "Downloading Tailscale ${LATEST_VERSION} for ${TS_ARCH}..."
-        DOWNLOAD_URL="https://pkgs.tailscale.com/stable/tailscale_${LATEST_VERSION}_${TS_ARCH}.tgz"
-        
-        if ! curl -fsSL "$DOWNLOAD_URL" -o "$TEMP_DIR/tailscale.tgz"; then
-            echo "Error: Failed to download Tailscale"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Extract binaries
-        echo "Extracting Tailscale binaries..."
-        if ! tar -xzf "$TEMP_DIR/tailscale.tgz" -C "$TEMP_DIR"; then
-            echo "Error: Failed to extract Tailscale"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Find and copy binaries
-        TS_DIR=$(find "$TEMP_DIR" -type d -name "tailscale_*" | head -1)
-        if [ -z "$TS_DIR" ]; then
-            echo "Error: Could not find extracted Tailscale directory"
-            rm -rf "$TEMP_DIR"
-            exit 1
-        fi
-        
-        # Remove old files if they exist (they might be read-only)
-        rm -f "$INSTALL_DIR/tailscale" "$INSTALL_DIR/tailscaled"
-        cp "$TS_DIR/tailscale" "$INSTALL_DIR/"
-        cp "$TS_DIR/tailscaled" "$INSTALL_DIR/"
-    fi
-    
-    # Make binaries executable
-    chmod +x "$INSTALL_DIR/tailscale" "$INSTALL_DIR/tailscaled"
-    
-    # Clean up
-    rm -rf "$TEMP_DIR"
-    
-    # Add to PATH for this session
-    export PATH="$INSTALL_DIR:$PATH"
-    
-    # Verify installation
-    if ! command -v tailscale &> /dev/null; then
-        echo "Error: Tailscale installation failed"
-        exit 1
-    fi
-    
-    echo "✓ Tailscale installed successfully to $INSTALL_DIR"
-    echo "Note: Add $INSTALL_DIR to your PATH to use Tailscale in other sessions"
-fi
-
-# Cleanup function
-cleanup() {
-    echo ""
-    echo "Shutting down..."
-    if [ ! -z "$TAILSCALE_SERVE_PID" ]; then
-        echo "Stopping Tailscale serve (PID: $TAILSCALE_SERVE_PID)"
-        kill $TAILSCALE_SERVE_PID 2>/dev/null || true
-        wait $TAILSCALE_SERVE_PID 2>/dev/null || true
-    fi
-    # Reset tailscale serve
-    if [ ! -z "$TS_SOCK" ]; then
-        tailscale --socket "$TS_SOCK" serve reset >/dev/null 2>&1 || true
-        tailscale --socket "$TS_SOCK" down >/dev/null 2>&1 || true
-    fi
-    # Kill any leftover tailscaled processes we started
-    pkill -f "tailscaled --tun=userspace-networking --statedir $HOME/.local/share/tailscale" 2>/dev/null || true
-    exit 0
-}
-
-trap cleanup SIGINT SIGTERM EXIT
-
-# Setup Tailscale
-TS_STATE="$HOME/.local/share/tailscale"
-TS_SOCK="$HOME/.cache/tailscaled.sock"
-LOG_FILE="/tmp/tailscaled.log"
-
-mkdir -p "$TS_STATE" "$(dirname "$TS_SOCK")"
-
-echo "Setting up Tailscale..."
-
-# Start tailscaled if not running
-if ! pgrep -f "tailscaled --tun=userspace-networking" >/dev/null; then
-    echo "▶️  Starting userspace tailscaled..."
-    nohup tailscaled \
-        --tun=userspace-networking \
-        --statedir "$TS_STATE" \
-        --socket "$TS_SOCK" \
-        >"$LOG_FILE" 2>&1 &
-
-    # Wait for tailscaled to start
-    for i in {1..30}; do
-        if pgrep -f "tailscaled --tun=userspace-networking" >/dev/null; then
-            echo "✓ tailscaled started"
-            break
-        fi
-        sleep 0.5
-    done
-else
-    echo "✓ tailscaled already running"
-fi
-
-# Wait for LocalAPI
-for i in {1..50}; do
-    if curl -sf --unix-socket "$TS_SOCK" \
-        http://local-tailscaled.sock/localapi/v0/status >/dev/null 2>&1; then
-        break
-    fi
-    sleep 0.2
-done
-
-# Bring up Tailscale and handle authentication if needed
-echo "🔐 Bringing up Tailscale..."
-tailscale --socket "$TS_SOCK" up 2>&1 | {
-    AUTH_OPENED=false
-    while read line; do
-        echo "$line"
-        if [[ "$AUTH_OPENED" == false ]] && echo "$line" | grep -q "https://login.tailscale.com/"; then
-            URL=$(echo "$line" | grep -o "https://login.tailscale.com/[^\s]*")
-            echo "🌐 Opening authentication URL in browser..."
-            # Platform-aware browser opening
-            if [ "$OS" = "darwin" ]; then
-                open "$URL" 2>/dev/null || echo "Please open this URL manually: $URL"
-            elif command -v xdg-open &> /dev/null; then
-                xdg-open "$URL" 2>/dev/null || echo "Please open this URL manually: $URL"
-            else
-                echo "Please open this URL manually: $URL"
-            fi
-            AUTH_OPENED=true
-        fi
-    done
-} || true
-
-# Get Tailscale connection info
-echo "Getting Tailscale connection info..."
-HOST=$(tailscale --socket $TS_SOCK status --json | jq -r '.Self.DNSName' | sed 's/\.$//')
-V4=$(tailscale --socket "$TS_SOCK" ip -4 2>/dev/null | head -n1)
-V6=$(tailscale --socket "$TS_SOCK" ip -6 2>/dev/null | head -n1)
-
-# Setup Tailscale serve to map port 80 to our local goosed
-echo "Setting up Tailscale serve (port 80 → localhost:${PORT})..."
-tailscale --socket "$TS_SOCK" serve reset >/dev/null 2>&1 || true
-tailscale --socket "$TS_SOCK" serve --tcp=80 127.0.0.1:$PORT >/dev/null &
-TAILSCALE_SERVE_PID=$!
-
-# Wait a moment for serve to start
-sleep 1
-
-echo "✓ Tailscale serve established (PID: $TAILSCALE_SERVE_PID)"
-
-# Build the JSON output
-# Use MagicDNS as primary, fallback to IPv4
-TUNNEL_URL=""
-if [[ -n "$HOST" && "$HOST" != "null" ]]; then
-    TUNNEL_URL="http://$HOST"
-elif [[ -n "$V4" ]]; then
-    TUNNEL_URL="http://$V4"
-else
-    echo "Error: No Tailscale IP addresses available"
-    exit 1
-fi
-
-# Write JSON to output file
-# Note: goosed PID is 0 since it's managed by tunnel.ts, not this script
-jq -n \
-    --arg url "$TUNNEL_URL" \
-    --arg ipv4 "${V4:-null}" \
-    --arg ipv6 "${V6:-null}" \
-    --arg hostname "${HOST:-null}" \
-    --arg secret "$SECRET" \
-    --arg port "$PORT" \
-    --arg tailscale_pid "$TAILSCALE_SERVE_PID" \
-    '{
-        url: $url,
-        ipv4: $ipv4,
-        ipv6: $ipv6,
-        hostname: $hostname,
-        secret: $secret,
-        port: ($port | tonumber),
-        pids: {
-            goosed: 0,
-            tailscale_serve: ($tailscale_pid | tonumber)
-        }
-    }' > "$OUTPUT_FILE"
-
-echo "✓ Tunnel established! Connection info written to: $OUTPUT_FILE"
-echo "Press Ctrl+C to stop the tunnel"
-
-# Keep the script running
-wait
diff --git a/ui/desktop/src/utils/tunnel.ts b/ui/desktop/src/utils/tunnel.ts
index 16a1e88d62..7542045897 100644
--- a/ui/desktop/src/utils/tunnel.ts
+++ b/ui/desktop/src/utils/tunnel.ts
@@ -9,7 +9,6 @@ export interface TunnelInfo {
   port: number;
   pids: {
     goosed: number;
-    tailscale_serve: number;
   };
 }