Loopback-first Web Service with private Serve and public Funnel

.gitignore

@@ -53,5 +53,9 @@ docs/superpowers
 # release.yml, not git.
 src-tauri/binaries/
 
+# Built userspace Tailscale sidecar (go build in codeg-tsnet/)
+codeg-tsnet/codeg-tsnet
+codeg-tsnet/codeg-tsnet.exe
+
 # pnpm local store (pnpm 11+)
 .pnpm-store/

codeg-tsnet/go.mod

@@ -0,0 +1,51 @@
+module github.com/xintaofei/codeg/codeg-tsnet
+
+go 1.26.5
+
+require tailscale.com v1.102.2
+
+require (
+	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/akutz/memconn v0.1.0 // indirect
+	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
+	github.com/coder/websocket v1.8.14 // indirect
+	github.com/creachadair/msync v0.8.1 // indirect
+	github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/gaissmai/bart v0.26.1 // indirect
+	github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
+	github.com/huin/goupnp v1.3.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.1 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
+	github.com/mdlayher/socket v0.5.0 // indirect
+	github.com/mitchellh/go-ps v1.0.0 // indirect
+	github.com/pires/go-proxyproto v0.8.1 // indirect
+	github.com/safchain/ethtool v0.3.0 // indirect
+	github.com/tailscale/certstore v0.1.1-0.20260409135935-3638fb84b77d // indirect
+	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
+	github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd // indirect
+	github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc // indirect
+	github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 // indirect
+	github.com/tailscale/wireguard-go v0.0.0-20260715223240-2e01ba5b00f0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
+	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
+	gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8 // indirect
+)

codeg-tsnet/main.go

@@ -0,0 +1,149 @@
+// Userspace Tailscale node bundled with Codeg.
+// Joins the tailnet inside this process. No Tailscale app on the PC.
+// Proxies HTTPS on the tailnet (or Funnel if --public) to a loopback target.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tsnet"
+)
+
+type event struct {
+	Event   string `json:"event"`
+	URL     string `json:"url,omitempty"`
+	Mode    string `json:"mode,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+
+func emit(e event) {
+	b, err := json.Marshal(e)
+	if err != nil {
+		return
+	}
+	fmt.Println(string(b))
+}
+
+func main() {
+	target := flag.String("target", "http://127.0.0.1:3080", "loopback Codeg Web Service")
+	hostname := flag.String("hostname", "codeg", "tailnet hostname")
+	stateDir := flag.String("state-dir", "", "persistent tsnet state directory")
+	public := flag.Bool("public", false, "Funnel (public HTTPS). Default is private tailnet only")
+	flag.Parse()
+
+	parsed, err := url.Parse(*target)
+	if err != nil || parsed.Scheme != "http" {
+		emit(event{Event: "error", Message: "target must be http://127.0.0.1:<port>"})
+		os.Exit(2)
+	}
+	host := parsed.Hostname()
+	if host != "127.0.0.1" && host != "localhost" {
+		emit(event{Event: "error", Message: "target must be loopback"})
+		os.Exit(2)
+	}
+
+	dir := strings.TrimSpace(*stateDir)
+	if dir == "" {
+		cfg, err := os.UserConfigDir()
+		if err != nil {
+			emit(event{Event: "error", Message: "cannot resolve config dir"})
+			os.Exit(2)
+		}
+		dir = filepath.Join(cfg, "app.codeg", "tsnet")
+	}
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		emit(event{Event: "error", Message: "cannot create state dir"})
+		os.Exit(2)
+	}
+
+	mode := "private"
+	if *public {
+		mode = "public"
+	}
+
+	srv := &tsnet.Server{
+		Hostname: strings.TrimSpace(*hostname),
+		Dir:      dir,
+		UserLogf: func(format string, args ...any) {
+			msg := fmt.Sprintf(format, args...)
+			if u := authURLFromLog(msg); u != "" {
+				emit(event{Event: "auth_url", URL: u})
+			}
+		},
+		Logf: func(string, ...any) {},
+	}
+	defer srv.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	st, err := srv.Up(ctx)
+	cancel()
+	if err != nil {
+		emit(event{Event: "error", Message: "tailnet login failed"})
+		os.Exit(1)
+	}
+
+	if *public {
+		funnelLn, err := srv.ListenFunnel("tcp", ":443")
+		if err != nil {
+			emit(event{Event: "error", Message: "could not start public Funnel listener"})
+			os.Exit(1)
+		}
+		go http.Serve(funnelLn, reverseProxy(parsed))
+	} else {
+		tlsLn, err := srv.ListenTLS("tcp", ":443")
+		if err != nil {
+			emit(event{Event: "error", Message: "could not start private TLS listener"})
+			os.Exit(1)
+		}
+		go http.Serve(tlsLn, reverseProxy(parsed))
+	}
+
+	emit(event{Event: "ready", URL: httpsURL(st), Mode: mode})
+
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
+	<-stop
+}
+
+func reverseProxy(target *url.URL) http.Handler {
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.Host = target.Host
+		proxy.ServeHTTP(w, r)
+	})
+}
+
+func httpsURL(st *ipnstate.Status) string {
+	if st == nil {
+		return ""
+	}
+	if len(st.CertDomains) > 0 {
+		return "https://" + strings.TrimSuffix(st.CertDomains[0], ".")
+	}
+	if st.Self != nil && st.Self.DNSName != "" {
+		return "https://" + strings.TrimSuffix(st.Self.DNSName, ".")
+	}
+	return ""
+}
+
+func authURLFromLog(msg string) string {
+	for _, part := range strings.Fields(msg) {
+		if strings.HasPrefix(part, "https://login.tailscale.com/") {
+			return strings.TrimRight(part, ".,)")
+		}
+	}
+	return ""
+}

src-tauri/build.rs

@@ -39,34 +39,33 @@ fn ensure_sidecar_placeholder() {
         ""
     };
     let dir = PathBuf::from("binaries");
-    let path = dir.join(format!("codeg-mcp-{triple}{ext}"));
-
-    println!("cargo:rerun-if-changed={}", path.display());
-
-    let needs_placeholder = match fs::metadata(&path) {
-        Ok(meta) => meta.len() == 0,
-        Err(_) => true,
-    };
-
-    if needs_placeholder {
-        if let Err(e) = fs::create_dir_all(&dir) {
-            panic!("failed to create {}: {e}", dir.display());
-        }
-        if let Err(e) = fs::write(&path, b"") {
-            panic!(
-                "failed to write sidecar placeholder {}: {e}",
+    for name in ["codeg-mcp", "codeg-tsnet"] {
+        let path = dir.join(format!("{name}-{triple}{ext}"));
+        println!("cargo:rerun-if-changed={}", path.display());
+        let needs_placeholder = match fs::metadata(&path) {
+            Ok(meta) => meta.len() == 0,
+            Err(_) => true,
+        };
+        if needs_placeholder {
+            if let Err(e) = fs::create_dir_all(&dir) {
+                panic!("failed to create {}: {e}", dir.display());
+            }
+            if let Err(e) = fs::write(&path, b"") {
+                panic!(
+                    "failed to write sidecar placeholder {}: {e}",
+                    path.display()
+                );
+            }
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o755));
+            }
+            println!(
+                "cargo:warning={name} sidecar missing at {}; wrote 0-byte placeholder. \
+                 Run `pnpm tauri:prepare-sidecars` before `tauri build` to ship a working binary.",
                 path.display()
             );
         }
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o755));
-        }
-        println!(
-            "cargo:warning=codeg-mcp sidecar missing at {}; wrote 0-byte placeholder. \
-             Run `pnpm tauri:prepare-sidecars` before `tauri build` to ship a working binary.",
-            path.display()
-        );
     }
 }

src-tauri/scripts/prepare-sidecars.mjs

@@ -120,6 +120,38 @@ function main() {
     chmodSync(dest, 0o755)
   }
   log(`sidecar staged at ${dest}`)
+  stageTsnet(target, ext, isWindows)
+}
+
+function stageTsnet(target, ext, isWindows) {
+  const goDir = resolve(SRC_TAURI, "..", "codeg-tsnet")
+  if (!existsSync(join(goDir, "main.go"))) {
+    log("codeg-tsnet source missing — skip")
+    return
+  }
+  try {
+    execFileSync("go", ["version"], { encoding: "utf8" })
+  } catch {
+    log("go not on PATH — skip codeg-tsnet sidecar")
+    return
+  }
+  log("building codeg-tsnet (latest pinned tailscale.com)")
+  execFileSync("go", ["mod", "tidy"], { stdio: "inherit", cwd: goDir })
+  const outName = `codeg-tsnet${ext}`
+  execFileSync("go", ["build", "-o", outName, "."], {
+    stdio: "inherit",
+    cwd: goDir,
+    env: { ...process.env, CGO_ENABLED: "0" },
+  })
+  const built = join(goDir, outName)
+  if (!existsSync(built)) {
+    die(`expected ${built} after go build`)
+  }
+  mkdirSync(BINARIES_DIR, { recursive: true })
+  const dest = join(BINARIES_DIR, `codeg-tsnet-${target}${ext}`)
+  copyFileSync(built, dest)
+  if (!isWindows) chmodSync(dest, 0o755)
+  log(`sidecar staged at ${dest}`)
 }
 
 main()

src-tauri/src/lib.rs

@@ -1394,6 +1394,12 @@ mod tauri_app {
                 model_provider_commands::update_model_provider,
                 model_provider_commands::delete_model_provider,
                 web::start_web_server,
+                web::funnel::tailscale_serve_status,
+                web::funnel::tailscale_serve_enable,
+                web::funnel::tailscale_serve_disable,
+                web::funnel::tailscale_funnel_status,
+                web::funnel::tailscale_funnel_enable,
+                web::funnel::tailscale_funnel_disable,
                 web::stop_web_server,
                 web::get_web_server_status,
                 web::get_web_service_config,

src-tauri/src/web/auth.rs

@@ -9,6 +9,20 @@ use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 pub const WS_EVENT_PROTOCOL: &str = "codeg-events";
 const WS_TOKEN_PROTOCOL_PREFIX: &str = "codeg-token.";
 
+/// Length-aware compare so a wrong token cannot be probed by timing.
+fn token_eq(provided: &str, expected: &str) -> bool {
+    let a = provided.as_bytes();
+    let b = expected.as_bytes();
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
 fn token_from_ws_protocols(value: &str) -> Option<String> {
     value
         .split(',')
@@ -27,15 +41,18 @@ pub async fn require_token(request: Request, next: Next, token: String) -> Respo
 
     if let Some(auth_header) = request.headers().get("authorization") {
         if let Ok(auth_str) = auth_header.to_str() {
-            if auth_str.strip_prefix("Bearer ").is_some_and(|t| t == token) {
+            if auth_str
+                .strip_prefix("Bearer ")
+                .is_some_and(|t| token_eq(t, &token))
+            {
                 return next.run(request).await;
             }
         }
     }
 
     if let Some(protocol_header) = request.headers().get("sec-websocket-protocol") {
         if let Ok(protocols) = protocol_header.to_str() {
-            if token_from_ws_protocols(protocols).is_some_and(|t| t == token) {
+            if token_from_ws_protocols(protocols).is_some_and(|t| token_eq(&t, &token)) {
                 return next.run(request).await;
             }
         }
@@ -63,4 +80,13 @@ mod tests {
     fn ignores_invalid_ws_protocol_token() {
         assert!(token_from_ws_protocols("codeg-events, codeg-token.not-valid-@@@@").is_none());
     }
+
+    #[test]
+    fn token_eq_is_length_and_value_sensitive() {
+        assert!(token_eq("secret", "secret"));
+        assert!(!token_eq("secret", "Secret"));
+        assert!(!token_eq("secret", "secre"));
+        assert!(!token_eq("secret", "secrets"));
+        assert!(!token_eq("", "x"));
+    }
 }