v1.2.2

Three fixes to what the extension tells you about itself, and one to what it does before it is ready.

No re-registration is needed this time — the native messaging host name has not changed since v1.2.1. Upgrading still means replacing the backend binary, since it is copied into your browser's configuration directory at install time:

go run github.com/iazat/ts-browser-ext@latest --install=C<your-extension-id>   # Chrome
go run github.com/iazat/ts-browser-ext@latest --install=F                      # Firefox

Traffic could leave through your own address for the first seconds

The proxy starts listening and reports its port to the extension before tsnet has finished starting, and the browser is pointed at it straight away. Until the tailnet reached Running there was a window — seconds, on a cold start — in which a request went out through this machine's own connection instead of the exit node.

Nothing about it was visible afterwards. By the time you looked, the backend was running and the popup named the exit node correctly, so a page that went out from the real address looked no different from one that did not. A site that decides what to serve by address would answer that first request from the wrong country and keep the result.

The proxy now refuses to dial until the tailnet is actually carrying traffic. Two cases stay open deliberately: with no exit node configured, leaving through this machine is what you asked for, and the login page has to stay reachable because it is fetched through this same proxy.

If you load a page in the first moment after the backend restarts, you may now see not routing yet: an exit node is configured but the tailnet is Starting instead of the page. That is the fix working. It clears in a second or two.

The popup said "Connected as Not connected"

Whenever the backend came up already logged in, the popup reported an empty tailnet name — sometimes for a long time, because the name only arrived when something about the tailnet happened to change. The management page at 100.100.100.100 was unaffected and named the tailnet correctly, which is what made the two disagree on screen.

The backend was subscribing to the IPN bus without asking for the initial network map. It does now, and falls back to the status it already fetches for the exit node list. Where the name genuinely is not known, the popup says plain Connected rather than filling the gap with a phrase that contradicts itself.

The exit node picker claimed None before it knew

None is a claim: it says no exit node is configured. Two states at startup looked identical to the code building the picker and meant nothing of the kind — the preferences had not been read yet, or they had been read and named a node that was not in the peer list yet because the network map was still arriving.

Both settle within seconds, and both were announced as None at the moment you are most likely to be looking: right after switching on. The picker now shows a disabled Connecting… while the answer is still unknown.

Disabling it matters as much as the label. The picker sends your selection on every change, and an empty value means "stop using an exit node" — so touching a list that was wrongly showing None would have cleared a selection you could not see.

The preferences read also has its own deadline now instead of inheriting whatever was left of the one the status call ahead of it had already spent, and a failure to read them is logged rather than passed off as an answer.

Known limitations

• Firefox has still not been run live. Its test suite passes and it is exercised against a mocked browser API on every commit, but nobody has loaded it through about:debugging.
• Losing the backend still hands the browser a direct connection. When the native messaging host goes away, the extension resets the browser proxy to direct rather than to a dead port — about a second per reconnect, with the same exposure as the startup window fixed above. Making that fail closed would mean pages stop loading entirely whenever the backend dies, and has not been done.
• Windows cannot register the native host. The binary builds, but there is no registry install path yet.

v1.2.1

A fix for Firefox, which v1.2.0 broke, and the last of the rename.

Everyone upgrading has to re-run the install command, on Chrome as well as Firefox — see below.

go run github.com/iazat/ts-browser-ext@latest --install=C<your-extension-id>   # Chrome
go run github.com/iazat/ts-browser-ext@latest --install=F                      # Firefox

Chrome's id is printed by the popup. Installing clears the old registration for you; nothing is left behind.

Firefox could not reach its backend in v1.2.0

Renaming the extension changed its Firefox add-on id, but the installer went on writing the old id into the native messaging host manifest. Firefox checks that list before it will let an extension talk to a host, so the two being out of step meant the connection was refused — and it failed silently: the extension installed, the popup opened, the backend simply never answered.

If you installed v1.2.0 on Firefox, re-run the install command after upgrading. The registration written by v1.2.0 names the wrong id and has to be replaced:

go run github.com/iazat/ts-browser-ext@latest --install=F

The two ids are now checked against each other by a test, so they cannot drift again.

The backend no longer registers itself under Tailscale's name

The native messaging host was called com.tailscale.browserext.chrome, and installing wrote a file by that name into your browser's configuration directory. An extension nobody at Tailscale publishes had no business leaving a file bearing their name on your disk.

It is now io.github.iazat.tailext.chrome (and .firefox). This is why the re-install is needed: the browser looks for a registration matching the name the extension asks for, and the old one no longer matches. Installing removes the stale file, and --uninstall clears both the old and new names.

The names on the two sides — the string the extension passes to connectNative, and the file the installer writes — are now checked against each other by a test, along with the Firefox add-on id. All three were free to drift before, and two of them had.

Also

• The management page at http://100.100.100.100/ still called itself "Tailscale Extension" and carried Tailscale's mark. It is served from inside the Go backend, so it was missed when the extension's own files were renamed.
• Running the backend with no arguments printed usage suggesting --install=chrome, which has never been a valid argument — it takes a browser letter followed by the extension id.
• The packaged zips are now byte-for-byte reproducible: rebuilding the same commit produces the same checksums, so a release asset can be checked against a build you made yourself.

Install

Download the zip for your browser — ts-browser-ext-chrome-v1.2.1.zip or ts-browser-ext-firefox-v1.2.1.zip — and unzip it. Each contains only what the browser needs; the source archives below carry the whole repository and are not what you want here.

Then load it unpacked, open the popup, and run the command it prints. Requires Go, and macOS or Linux. Full steps in the README.

Known limitations

• Firefox has still not been run live. This release fixes a bug that only a live Firefox would have caught, found by reading the code after the fact. Its test suite passes; nobody has loaded it through about:debugging.
• Windows cannot register the native host. The binary builds, but there is no registry install path yet.

ver 1.2.0

A rename, and the groundwork for a Chrome Web Store listing. No behaviour changes — if v1.1.0 works for you, this one works the same way.

Renamed to TailExt

The extension used to ship as "Tailscale Extension", carrying Tailscale's wordmark and icon. That was never appropriate for anything published: the BSD-3 licence this code is under says the copyright holder's name may not be used to promote derived products without permission, and it invites people to mistake this for an official client.

It is now TailExt, with its own artwork. Tailscale is still named as the service this works with, and the popup keeps its attribution link to the upstream project. This remains unofficial and unaffiliated.

Firefox users: the add-on id changed from browser-ext@tailscale.com to tailext@iazat.github.io, so Firefox treats this as a new add-on rather than an update. Remove the old one first.

Changes

• New icon, with a full set of sizes. The toolbar icon was previously a single 128px image the browser squashed down to 16, which turned it to mush; each connection state now ships artwork drawn for the size it is displayed at.
• The manifest declares an icon set at all, which it never did.
• The README says plainly what is tested and what is not, and documents how releases are built.
• Notes for a store submission live in docs/chrome-web-store.md, and there is now a PRIVACY.md.

Install

Download the zip for your browser — ts-browser-ext-chrome-v1.2.0.zip or ts-browser-ext-firefox-v1.2.0.zip — and unzip it. Each contains only what the browser needs; the source archives below carry the whole repository and are not what you want here.

Then load it unpacked (chrome://extensions → Developer mode → Load unpacked, or about:debugging → Load Temporary Add-on in Firefox), open the popup, and run the command it prints. It builds and registers the companion backend, which the extension does nothing without.

Requires Go, and macOS or Linux.

Upgrading from v1.1.0? Remove the old extension first rather than loading both — on Firefox the changed add-on id makes it a separate add-on, and on Chrome two copies will each try to register their own backend.

Known limitations

Unchanged from v1.1.0:

• Firefox has not been run live. Its test suite passes and its code is diffed against the working Chrome copy, but no build has been loaded through about:debugging.
• Windows cannot register the native host. The binary builds, but there is no registry install path yet.

ver 1.1.0

Fixes

• The connect toggle only worked once. Turning the extension off left the
  browser on a direct connection, and turning it back on never restored the
  proxy — you had to reload the extension. A regression from the previous
  release's fix for ERR_PROXY_CONNECTION_FAILED.
• Firefox leaked a dead proxy handler. Every disconnect left a handler
  pointing at a port that was no longer listening, and every reconnect added
  another.
• The exit node picker never hid itself, leaving an empty dropdown on
  screen whenever there was nothing to pick.
• The install command pointed at upstream, so following it produced a
  backend with no exit node support.
• The native host did not compile for Windows at all. It builds now;
  registering it there is still unimplemented.

Changes

• The Firefox extension has caught up with the Chrome one: exit node picker,
  working login link, honest connection states.
• Inter is bundled instead of fetched from Google Fonts — opening the popup
  no longer reports to a third party, and the UI survives being offline.
• tailscale.com updated to v1.102.2.
• Test suites for both extensions and CI across six build targets.

Install

Load the unpacked extension from the zip below, open the popup, and run the
command it prints. Requires Go and macOS or Linux.

Firefox note: this build's Firefox copy passes its test suite but has not
been run in a real Firefox.