fix(dev): share dev servers on the loopback Vite actually binds

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Problem

vp run dev --share registers a tailscale serve rule that proxies https://<node>.ts.net:<webPort> to http://127.0.0.1:<webPort>. But Vite is configured with server.host: "localhost", and on Node 17+ localhost resolves to ::1 first (verbatim DNS order), so Vite binds only [::1]:<webPort>. Nothing listens on the IPv4 loopback, and the tailnet URL returns a 502 from Tailscale.

Reproduced on macOS with Node 24: lsof -iTCP:6561 -sTCP:LISTEN showed only [::1]:6561; curl http://127.0.0.1:6561/ was refused while curl http://[::1]:6561/ returned 200.

A secondary symptom you may notice while sharing: the dev runner logs "Port 6561 is in use on a wildcard address, but localhost:6561 is available". That wildcard holder is Tailscale's own serve listener on the tailnet IP, so the warning is misleading but harmless. Not addressed here.

Fix

scripts/lib/dev-share.ts now passes localHost: "localhost" to ensureTailscaleServe, so the Tailscale proxy resolves the same name Vite bound. A literal [::1] target is not an option: Tailscale rejects that form with a 500.

The @t3tools/tailscale default of 127.0.0.1 is unchanged. The server's own --tailscale-serve path passes 127.0.0.1 explicitly and binds it explicitly, and t3 pair --tailscale resolves its target from the recorded dev URL, so neither is affected.

Verification

• Manual repro before the change: 502 on the tailnet URL; re-running tailscale serve --bg --https=6561 http://localhost:6561 by hand fixed it immediately, which is exactly what this change makes the runner do.
• vp test run scripts/lib/dev-share.test.ts: 8 passed, including a new test asserting the serve call targets http://localhost:<port>.
• npx tsgo -p scripts/tsconfig.json --noEmit: clean.
• vp lint --report-unused-disable-directives scripts/lib/dev-share.ts scripts/lib/dev-share.test.ts: clean.

Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrow change to dev-share Tailscale proxy targeting; server --tailscale-serve and other explicit 127.0.0.1 paths are unchanged.

Overview
vp run dev --share was registering Tailscale to forward to http://127.0.0.1:<port> while Vite listens on localhost, which on Node 17+ often resolves to IPv6 (::1) only—so the tailnet URL returned 502.

shareDevServer now passes localHost: "localhost" into ensureTailscaleServe so the proxy target matches how Vite binds. Tests record spawned tailscale argv and assert the serve invocation uses http://localhost:<webPort> instead of 127.0.0.1.

^{Reviewed by Cursor Bugbot for commit 9a68fea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix shareDevServer to proxy through localhost instead of 127.0.0.1

Updates the Tailscale serve command in dev-share.ts to pass localhost as the local host while keeping the requested web port. The returned tailnet HTTPS URL and all status/cleanup logic remain unchanged.

• Extends the spawner test helper in dev-share.test.ts to record spawned command arguments, and adds a test asserting the serve command targets localhost on the requested port.

^{Macroscope summarized 9a68fea.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.4 KiB	+156 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+152 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.4 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: b9b1b8f · PR result: 9a68fea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 9a68fea

Macroscope's review found this PR approvable — This is a narrowly scoped, dev-only fix that makes the existing opt-in sharing command target the hostname Vite already binds, with unchanged ports, cleanup, and URL behavior. The added test directly verifies the generated Tailscale command, and no production or product defaults are changed.

^{You can add or adjust custom eligibility rules. Learn more.}