tailscalelisted

# tailscale — driving the tailnet Operate remote hosts over Tailscale from a sandboxed shell: read tailnet status, run commands on tailnet hosts. Opt-in + link-only — the operator brings a host that is already `tailscale up`; you drive a scoped loop against it. Grant is explicit, per-fork (`common=0`); the **devops** flavor's signature skill. ## Drive through the host broker — never `tailscale` directly The sandbox can't join the tailnet (no route, no TUN, no `NET_ADMIN`) and must not hold a tailnet credential. NEVER run `tailscale` or bring up `tailscaled` — call the host-side **ts-broker** over its unix socket in the bind-mounted repo; the broker owns the host's `tailscale up` node, and the tailnet identity never enters the fork. (Detail: `.super-coder/docs/tailscale-broker.md` — sibling of the Windows VM broker; `windows_devkit` works the same way.) ```bash SOCK="$(sc ts-broker-sock)" curl -s --unix-socket "$SOCK" http://ts/health # liveness check first ``` curl fails "not reachable" → broker down → ask the operator to run `sc ts-broker-up` on the host. You cannot start it yourself (host process, not sandbox). ## Precondition — the link is configured Tailnet config = `ts` key in `.super-coder/instance.json`. Carries no secret material — the host node's identity is the credential and it stays host-side: ```json "ts": { "ssh_user": "tester", "allowed_hosts": ["build-box","deploy-target"], "tailscale_bin": "tailscale" } ``` No `ts` block → no tailnet lin