Skip to content

Tie Mac organizations to local Tailscale profiles - #348

Open
jfrolich wants to merge 1 commit into
mainfrom
feat/mac-org-tailnet
Open

Tie Mac organizations to local Tailscale profiles#348
jfrolich wants to merge 1 commit into
mainfrom
feat/mac-org-tailnet

Conversation

@jfrolich

@jfrolich jfrolich commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add OS → Organizations → Network on this Mac… to associate each local organization with a saved Tailscale profile.
  • Default to asking before switching, with an explicit automatic mode and an option to leave Tailscale unchanged. Store only the profile ID and mode locally.
  • Serialize explicit organization switches across windows, verify Tailscale and server readiness before navigation, and retain organization routes. Background windows, notifications, startup, and focus changes do not switch networks.
  • Restrict network-settings IPC to dedicated bundled pages. Use fixed CLI paths and validated saved profile IDs without shell execution or elevated privileges.

Verification

  • Passed OPENSESSION_TEST_JOBS=2 bun run check.
  • Passed all 33 Mac unit tests.
  • Passed the Electron integration harness with disposable servers and a fake Tailscale client, including settings persistence, IPC rejection, ask/automatic modes, route retention, failure handling, and background-window isolation.
  • Passed read-only profile discovery and readiness against the installed Tailscale app.
  • Captured settings and progress screenshots in the linked session. A Portal could not start because the running macOS Portal launcher requires unavailable setsid.

The actual device-wide network switch was not exercised on the live Mac. Cancelling or failing leaves the old organization selected but does not automatically restore the previous Tailscale profile. This ships with a Mac app release; no server deploy is required.

Started by Jaap Frolich in this Assistant session

@jfrolich
Tie Mac organizations to local Tailscale profiles
fc18fbc 
Add local network settings with ask and automatic modes, serialize explicit
organization switches, and wait for network/server readiness before navigating.
Keep network configuration inaccessible to remotely served renderer pages.

Co-authored-by: Jaap Frolich <jfrolich@gmail.com>
@jfrolich jfrolich self-assigned this Sep 10, 2026
@open-session-os-tella-dev

open-session-os-tella-dev Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 OS review · approve · quality 5/5 · risk medium

Safe to merge. No correctness, security, packaging, or contract issues found.

🟠 Risk medium · recovery in hours · new external service, DNS or infra, secrets or config, auth or billing, wide blast radius, large diff
The app persists network bindings and changes the device-wide Tailscale profile; rollback cannot restore each Mac’s prior profile. Gate rollout and automatically restore each prior Tailscale profile.

Reviewed fc18fbc · GPT-5.6 Sol · open session · labels: os-auto-fix fix and push · os-adversarial deeper pass · os-simplify cleanup

@vercel

vercel Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
opensession Ready Ready Preview Sep 10, 2026 7:41pm UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@jfrolich jfrolich

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jfrolich