[WesleySmits]

Problem

The Tailscale HTTPS section in docs/user/remote-access.md says how to turn the route on, but not what the tailnet needs for it to work. Without MagicDNS and HTTPS certificates, or on Linux without permission to manage Tailscale, T3 Code still starts but no HTTPS route appears. Nothing in the guide points users to the cause (see #16238).

Change

Six lines in ### Tailscale HTTPS, before the CLI examples:

Your tailnet needs MagicDNS and HTTPS certificates enabled; see
[Tailscale's HTTPS setup](https://tailscale.com/docs/how-to/set-up-https-certificates).
On Linux, T3 Code also needs permission to manage Tailscale; see
[operator permission](https://tailscale.com/docs/reference/troubleshooting/linux/linux-operator-permission)
for non-root users. If any of these is missing, T3 Code still starts but can't
add the HTTPS route.

Both links go to Tailscale's own docs, so the setup steps and the public-ledger note stay there.

Scope and approval

Docs only, one problem: the existing workflow is hard to get working because its prerequisites aren't documented (CONTRIBUTING, existing workflow hard to find or understand). It doesn't change runtime behavior.

Refs #16238. Related: #23605 makes the server retry Serve after a failed start. That PR touches no docs, and these prerequisites still apply after it lands, since a retry can't succeed while one of them is missing. For the same reason this text gives no recovery or retry advice.

Verification

• Claims checked against Tailscale's docs: the HTTPS page ("Enable MagicDNS…", "Under HTTPS Certificates, select Enable HTTPS") and the Linux operator page ("To allow a different user to manage Tailscale, set the user as the operator"). Both URLs return 200 with no redirect.
• Claims checked against the source: t3 pair --tailscale fails explicitly when there is no MagicDNS name or Serve/HTTPS is not enabled (apps/server/src/cli/pair.ts), and the server logs a warning and keeps running when tailscale serve fails (apps/server/src/server.ts). The maintainer repro in [Bug]: Tailscale Serve failures are only logged as a warning; the server silently stays loopback-only #16238 shows the non-operator case: permission-denied, server ready, serve status {}.
• vp run check:changed: format pass; knip skipped (no code changed). git diff --check is clean.
• Not checked: I did not reproduce this on a real tailnet. There is no live run with MagicDNS, HTTPS certificates or operator permission missing, and no root or rootless-daemon run. No UI change, so no screenshots.

🤖 Written by Claude Opus 5.5 via Claude Code in T3 Code.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-22T18:21:39.828830Z We couldn’t complete this review. Comment @codex review to try again.	1e03b48	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[macroscopeapp]

Approvability

Verdict: Approved at 1e03b48

Macroscope's review found this PR approvable — This PR only adds prerequisite guidance and links to the existing Tailscale HTTPS documentation. It changes no executable code, product defaults, schemas, or deployment behavior.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 4eae8ae
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3b1c4d57-3952-443b-b757-d1cb34f6fbe5

📥 Commits

Reviewing files that changed from the base of the PR and between 4eae8ae and 1e03b48.

📒 Files selected for processing: 1

• docs/user/remote-access.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The Tailscale HTTPS documentation now lists required settings and Linux permissions. It states that missing prerequisites prevent adding the HTTPS route but do not prevent T3 Code from starting.

Changes: Tailscale HTTPS documentation

Layer / File(s)	Summary
Document HTTPS prerequisites and behavior docs/user/remote-access.md	The guidance lists MagicDNS, HTTPS certificates, and Linux operator permissions as requirements. It states that T3 Code starts without adding the HTTPS route when any requirement is missing.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related issues

• [Bug]: Desktop does not recover network access when Tailscale connects after launch #17362: The documentation describes a related Tailscale HTTPS setup failure when prerequisites are missing, but does not add retry behavior.

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 1e03b

The PR only clarifies Tailscale HTTPS prerequisites and does not alter runtime behavior.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title is concise, specific, and accurately describes the documentation change to the Tailscale HTTPS prerequisites.
Description check		The description covers the problem, documentation change, scope, issue reference, verification steps, observed results, and limitations. It clearly states that the change is documentation-only and ide…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the problem, documentation change, scope, issue reference, verification steps, observed results, and limitations. It clearly states that the change is documentation-only and identifies the checks that were not performed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified the documentation change at 1e03b48a95a6215200f2e11f07459bd278e4d318, with limited runtime coverage. this is a seven-line docs-only change, not a runtime fix. no source changes or pushes were needed.

• installed dependencies and ran github/main (fa4e4677c0) in a separate worktree first, then the exact pr head. ran one background dev server at a time with isolated empty state and T3CODE_TAILSCALE_SERVE=true.
• used repo playwright and /usr/bin/google-chrome to pair locally, add the real repository through the app, create a thread, select codex gpt-6.1-sol, and submit a real read-only turn. no mocks, fixtures, demo data or replay provider.
• main's completed turn confirmed the section omitted all three prerequisites. the pr's completed turn read the updated file and displayed magicdns, https certificates, linux permissions, and both working links. the screenshots show documentation content through the real client/provider path; they do not prove tailnet configuration.
• both servers logged Failed to configure Tailscale Serve with TailscaleCommandSpawnError because tailscale is not installed. local pairing and real codex turns still worked afterward. pair --tailscale explicitly failed with TailscaleUnavailableError. unauthenticated access to the protected shell endpoint returned 401.
• both linked tailscale pages returned 200. their current text requires magicdns and enabling https certificates, and explains linux operator permission.
• vp run check:changed passed on blacksmith: format passed for the one changed docs file; knip skipped because no code changed. the worker's initial missing merge base was repaired by fetching the fork head history and restoring the exact pr base ref before rerunning.

short runtime transcript

Not verified

this vm has neither a tailscale installation nor an authenticated tailnet. i could not reproduce missing magicdns, disabled https certificates, or missing linux operator permission individually, nor successful https publication, prerequisite recovery, or cross-device access. the missing-executable case above is separate and does not prove those three cases. those claims remain supported by the linked upstream docs and source inspection, not a live tailnet run.

native desktop, ios/android, macos/windows behavior was not exercised. no product ui changed. this pass verifies the documentation and local fallback/provider path, not end-to-end tailscale https.