@dev.sail.money/sailor 1.3.0-210 → 1.3.0-211

package/README.md

@@ -170,6 +170,7 @@ sailor trigger github      # fire the agent's GitHub Actions workflow on demand
 
 # Dashboard
 sailor ui start            # prints the per-project dashboard URL
+sailor ui start --expose tailscale   # also expose it on your tailnet over HTTPS (see Dashboard section)
 
 # Maintenance
 sailor update              # re-sync skills, AGENTS.md, and tooling files after a CLI upgrade
@@ -263,6 +264,37 @@ sailor ui status
 sailor ui stop
 ```
 
+### Remote access over your tailnet (HTTPS) — optional
+
+The dashboard is local-only by default. To reach it from another device (e.g. a
+remote operator box), expose it over your [Tailscale](https://tailscale.com)
+tailnet on HTTPS:
+
+```bash
+sailor ui start --expose tailscale
+# → Sailor UI started at http://localhost:<port>
+# → Exposed on your tailnet at https://<node>.<tailnet>.ts.net/
+```
+
+It uses `tailscale serve` (tailnet-private), **never `funnel`** — only devices on
+your tailnet can reach it, not the public internet. `sailor ui stop` tears the
+tailnet proxy down along with the local server.
+
+Requirements:
+
+- `tailscale` installed and logged in (`tailscale up`).
+- Tailscale **Serve** enabled for your tailnet, plus **HTTPS certificates**
+  (admin console → DNS → Enable HTTPS). If Serve is disabled, the command prints
+  the enable link instead of reporting success.
+
+When exposed, the tailnet origin is added to the dashboard's CORS allowlist
+automatically. To allow additional origins (e.g. a custom HTTPS host in front of
+the station), set a comma-separated list — the local origin is always allowed:
+
+```bash
+SAILOR_CORS_ORIGINS=https://hermes.example.ts.net,https://another.host
+```
+
 ---
 
 ## Agent-driven onboarding & custom mandates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev.sail.money/sailor",
-  "version": "1.3.0-210",
+  "version": "1.3.0-211",
   "description": "Operator toolkit for Sail Protocol",
   "bin": {
     "sailor": "packages/cli/dist/index.cjs"

package/packages/sdk/dist/intelligence.d.ts

@@ -5,7 +5,7 @@
  * Do not edit manually — run `pnpm build` to regenerate.
  *
  * Spec version : 1.2.0
- * Generated at : 2026-06-25T14:29:20.609Z
+ * Generated at : 2026-06-25T14:31:14.298Z
  */
 export declare const SAIL_INTELLIGENCE_BASE_URL = "https://api.sail.money";
 export declare const SAIL_INTELLIGENCE_DOCS_URL = "https://api.sail.money/docs";

package/packages/sdk/dist/intelligence.js

@@ -5,7 +5,7 @@
  * Do not edit manually — run `pnpm build` to regenerate.
  *
  * Spec version : 1.2.0
- * Generated at : 2026-06-25T14:29:20.609Z
+ * Generated at : 2026-06-25T14:31:14.298Z
  */
 export const SAIL_INTELLIGENCE_BASE_URL = "https://api.sail.money";
 export const SAIL_INTELLIGENCE_DOCS_URL = "https://api.sail.money/docs";

package/templates/default/.agents/skills/sail-servers/SKILL.md

@@ -13,11 +13,13 @@ Two distinct local servers. Both are per-project, both write state under `.sail/
 sailor ui start    # spawns a detached Express server, prints the URL, returns immediately
 sailor ui status   # ● running  http://localhost:<port>  (pid N)
 sailor ui stop     # SIGTERM via the pid file
+sailor ui start --expose tailscale   # also serve it on the tailnet over HTTPS (opt-in)
 ```
 
-- Port: deterministic per project — `3333 + (hash(projectPath) % 667)`, i.e. somewhere in 3333–3999, bumped to the next free port if taken. **Do not assume 3333** — always use the URL the command prints or read `.sail/runtime/ui.json` (`{ pid, port, startedAt }`).
+- Port: deterministic per project — `3333 + (hash(projectPath) % 667)`, i.e. somewhere in 3333–3999, bumped to the next free port if taken. **Do not assume 3333** — always use the URL the command prints or read `.sail/runtime/ui.json` (`{ pid, port, startedAt, exposed }`).
 - The server serves the pre-built React app (`SERVE_DIST=1`) and a local `/api` that reads `.sail/` state (`SAIL_DIR` env).
 - `ui start` does not block — no `&` needed.
+- `--expose tailscale` (optional): proxies the dashboard onto the operator's tailnet over HTTPS via `tailscale serve` (tailnet-private, never `funnel`). Requires `tailscale` installed + logged in, and Serve + HTTPS enabled for the tailnet (else the command prints the enable link). `ui stop` tears the proxy down. To allow extra browser origins, set `SAILOR_CORS_ORIGINS` (comma-separated; the local origin is always allowed).
 
 ## Signing station — `sailor station`