[incognitojam]

Note

Reusing an exact private Tailscale Serve mapping now skips the host's redundant HTTPS self-probes. In the controlled failed-self-probe case, the packaged CLI went from 6.601s to 1.483s and made zero HTTPS requests instead of six. Healthy-path timing is inconclusive on this shared host.

A running server and its private Serve mapping can be correct while the host cannot reach its own MagicDNS HTTPS address. pair --tailscale currently probes that address before inspecting the mapping and can spend five seconds retrying an endpoint it does not need to rediscover.

Read the live mapping first only when its complete proxy URL equals the local origin already verified during server discovery. Reuse an exact private mapping immediately. The six-line package helper delegates to the existing strict classifier; it does not duplicate mapping policy. Funnel, foreground overrides, extra routes, different targets, and different local origins cannot take this shortcut. Dev web repointing and all fallback identity checks remain intact. The pairing implementation adds a small early-return block; existing test fixtures cover it without another test harness.

The shortcut establishes the local server and configured mapping, not public HTTPS health. It deliberately does not verify certificate readiness, DNS, or remote client reachability for an existing exact mapping. First-time configuration retains its existing checks. A nonexact same-origin fallback reads Serve configuration twice, preserving the final live ownership check rather than adding a cached snapshot.

Measured self-contained executable results against fork main 26608d8b687eab0a4c2c16e23eaec228b00161e7:

Scenario	Pairs	Before median	After median	HTTPS probes per invocation
Direct pairing control	5	1.098s	0.946s	0 → 0
Healthy local HTTPS	5	1.438s	1.313s	1 → 0
HTTPS response delayed 300ms	3	1.961s	1.270s	1 → 0
HTTPS self-probe returns 502	3	6.601s	1.483s	6 → 0

Both executables used the production packing configuration, Node 26.12.0, and disabled SEA code caching. Each sample starts a fresh process and measures through exit with warm filesystem caches, after one untimed warm-up per build. Healthy/control measurements used five counterbalanced before/after pairs; delayed/failing-probe measurements used three alternating pairs. All runs used the same isolated backend and database. A synthetic Tailscale executable reported an exact private mapping; a trusted local TLS proxy provided healthy, delayed, or failed HTTPS responses. No Serve mutation occurred.

Healthy and control timing ranges overlap, so the medians do not establish a normal-case speedup. Request counts establish removal of one HTTPS round trip in the healthy case. The failed-probe case removes all six probes and five configured one-second sleeps. These measurements exclude npm resolution, SSH, real tailnet routing, and certificate provisioning. Real tailnet reachability was not verified.

Validation:

• 49 focused tests passed: vp test run apps/server/src/cli/pair.test.ts packages/tailscale/src/tailscale.test.ts. They cover successful token/URL output without HTTPS, canonical exact-handler reuse, Funnel/foreground/extra-route protection, foreign environment rejection, dev repointing, and IPv4/IPv6 origin mismatch.
• Before/after production Node bundles and self-contained executables were exercised against an isolated running server. All 20 credential redemptions produced authenticated sessions and rejected a second redemption; no server runtime errors were observed. The fixture server was stopped afterward.
• Both affected package typechecks, targeted lint, formatting, and fork ledger validation passed. Server typecheck emitted existing Effect suggestions.
• GPT-6.1 Sol at high implemented the change; GPT-6 Astra at high independently reviewed the source and tests with no actionable findings. Its review did not independently verify real tailnet reachability.

Current upstream 42da166d131017335a1158d0b379dd68b8985796 still probes HTTPS first and has no equivalent merged shortcut waiting in intake. The related bounded-body work is open; discovery/retry work closed unmerged. Neither has an intake position or merge date. No upstream patch or intake state was changed here.

Executable timing samples (milliseconds)

Scenario	Before	After
Direct pairing control	1091.32, 1186.12, 1014.36, 1097.55, 1271.11	895.67, 909.77, 1142.05, 973.39, 946.36
Healthy local HTTPS	1367.82, 1437.89, 1499.38, 1357.35, 1684.88	1289.48, 1312.59, 1614.82, 1849.67, 1308.11
HTTPS response delayed 300ms	1960.58, 1762.13, 2410.86	1300.27, 1270.32, 1190.85
HTTPS self-probe returns 502	6601.12, 6623.72, 6494.1	1510.62, 1483.01, 1282.82

---

Written by an agent (Codex, gpt-6.1-sol).

[github-actions]

Upstream divergence

Both sides are compared with upstream at the in-order tip 06e627448b. Excludes .repos/ and pnpm-lock.yaml.

Measure	Base	This PR	Change
Upstream files the fork changes	1,390	1,390	0
Lines changed in them	65,747	65,855	+108
Upstream files the fork removes	41	41	0
Fork-only files	459	459	0
Fork-only lines	81,318	81,323	+5

Upstream files whose difference changes (4)

File	Change	Now differs by
apps/server/src/cli/pair.test.ts	+69	274 lines
apps/server/src/cli/pair.ts	+23	74 lines
packages/tailscale/src/tailscale.test.ts	+10	320 lines
packages/tailscale/src/tailscale.ts	+6	192 lines

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 26608d8 · PR result: 3352da3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.