Make the phone a mirror, and publishing to the tailnet a button

Both from beta.1 feedback.

**One button instead of a terminal command.** Publishing the portal to the tailnet
was a `tailscale serve --bg <port>` line the user had to run themselves. The
reasoning was that the step deserved to be *visible* — it's what makes the journal
reachable from another device. But visible and manual aren't the same thing, so
`portal_serve` / `portal_unserve` now run it, the button still says exactly what it
runs, it shows the resulting *.ts.net URL, and it's reversible. Tailscale's own
refusals ("not logged in", "HTTPS must be enabled in the admin console") are shown
verbatim rather than flattened into a generic failure, because that message is the
fix.

**The phone mirrors the desktop.** /m was a four-button subset — dose, note, combo,
Companion — and you couldn't even start a session without walking to the desk. It's
now Now / Journal / Combo / Look up / Talk: start and end sessions, log doses, edit
and delete them, notes with the crisis scan, browse history, the substance log, the
DoseWiki dose tables, corpus search, and your catalogue.

This changed **no permissions**: every command the mirror needs was already in
`EXPOSED`. The allowlist still excludes wiping the journal, the passphrase, backups,
Obsidian sync, the Ollama installers, and the filesystem commands — a phone is the
device you lose. The new `portal_serve`/`portal_unserve` are excluded too: a phone
may not publish or unpublish its own access.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sparkly-quasar

ROADMAP.md

@@ -197,8 +197,11 @@ non-negotiables, each with a test:
    - **Transport swap** — `src/lib/api.ts` picks Tauri `invoke` on the desktop and
      `fetch` on the phone (`src/lib/portal.ts`). One function; the 1,900-line UI never
      learned about it. **`api.ts` remains the only file allowed to import `invoke`.**
-   - **Mobile route** — `/m`: dose, note, combo, Companion. A phone-shaped *subset*, not
-     the desktop page made responsive.
+   - **Mobile route** — `/m`: Now (start/end a session, log a dose, edit or delete one,
+     notes with the crisis scan), Journal (history + substance log), Combo, Look up (dose
+     table + corpus prose + your catalogue), Talk. A phone-shaped **mirror** of the
+     desktop, re-laid out for one hand — not the desktop page made responsive. It started
+     as a four-button subset; beta feedback was that the subset was the wrong call.
    - **PWA shell** — `static/manifest.webmanifest` + Apple meta tags: home-screen icon
      and standalone chrome. The **service worker is Phase 3b**, deliberately absent.
    - **Auth** — a 256-bit bearer token, compared in constant time, paired by scanning a
@@ -215,11 +218,18 @@ non-negotiables, each with a test:
    commands, the filesystem commands, and the `portal_*` commands themselves stay
    unreachable.
 
-   **Still to do for 3a:** the user runs `tailscale serve --bg <port>` themselves — the
-   app detects Tailscale, shows the exact command, and shows the resulting `*.ts.net`
-   URL, but does not run it for them. That's deliberate for now (it's the step that makes
-   the journal reachable from another device, and it should be visible), but a one-click
-   version behind a confirmation is a reasonable follow-up.
+   **Publishing to the tailnet is one button** (`portal_serve` / `portal_unserve`, wired to
+   Settings → Phone access). It was originally a command for the user to run by hand, on the
+   theory that the step deserved to be visible; beta feedback was that this is too much to
+   ask of an end user, and the honest fix is to keep it *visible* — the button says what it
+   runs, shows the resulting `*.ts.net` URL, and is reversible — rather than to keep it
+   *manual*. Tailscale's own refusals ("not logged in", "HTTPS must be enabled in the admin
+   console") are surfaced verbatim, because that message is the fix.
+
+   **Note the asymmetry:** the phone mirrors the journal, but it cannot mirror the *portal's
+   own controls*. `portal_serve`, `portal_unserve`, `portal_enable`, and `portal_disable` are
+   not in `EXPOSED` — a phone may not publish, unpublish, or reconfigure its own access. That
+   decision is made at the desk.
 
    ### Phase 3b — offline capture. Lets you log while the Mac is asleep or off-tailnet.
    The journal is **append-only** in practice (a dose/note is a new row), so an outbox

package.json

@@ -1,6 +1,6 @@
 {
   "name": "field-notes",
-  "version": "0.4.0-beta.1",
+  "version": "0.4.0-beta.2",
   "description": "Offline harm-reduction journal & trip-sitting workstation.",
   "type": "module",
   "private": true,

src-tauri/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "field_notes"
-version = "0.4.0-beta.1"
+version = "0.4.0-beta.2"
 description = "Offline harm-reduction journal & trip-sitting workstation"
 authors = ["sparkly-quasar"]
 # Licensed under the PolyForm Noncommercial License 1.0.0 — see ../LICENSE.

src-tauri/Cargo.toml

@@ -969,9 +969,12 @@ pub struct TailscaleStatus {
     pub installed: bool,
     /// The tailnet hostname to reach this machine on, if we could read one.
     pub host: Option<String>,
-    /// The exact command that publishes the portal to the tailnet. We show it
-    /// rather than silently running it — it is the step that makes the journal
-    /// reachable from another device, and the user should see it happen.
+    /// Tailscale is already proxying the tailnet to the portal's port.
+    pub serving: bool,
+    /// The tailnet URL the phone reaches, once we're serving.
+    pub url: Option<String>,
+    /// The equivalent command, for anyone who would rather run it themselves or
+    /// wants to see what the button does. `portal_serve` runs exactly this.
     pub serve_command: Option<String>,
 }
 
@@ -987,10 +990,31 @@ fn tailscale_bin() -> Option<String> {
     PATHS.iter().find(|p| Path::new(p).exists()).map(|p| p.to_string())
 }
 
+/// Run a `tailscale` subcommand, returning its stderr as the error. Tailscale's own
+/// messages are the useful ones here ("HTTPS must be enabled in the admin console",
+/// "not logged in"), and a generic "failed to publish" would throw them away.
+fn tailscale_run(bin: &str, args: &[&str]) -> Result<String, String> {
+    let out = std::process::Command::new(bin)
+        .args(args)
+        .output()
+        .map_err(|e| format!("Couldn't run Tailscale: {e}"))?;
+    if out.status.success() {
+        return Ok(String::from_utf8_lossy(&out.stdout).trim().to_string());
+    }
+    let msg = String::from_utf8_lossy(&out.stderr).trim().to_string();
+    Err(if msg.is_empty() { "Tailscale refused, without saying why.".into() } else { msg })
+}
+
 #[tauri::command]
 pub fn portal_tailscale(portal: State<'_, Portal>) -> TailscaleStatus {
     let Some(bin) = tailscale_bin() else {
-        return TailscaleStatus { installed: false, host: None, serve_command: None };
+        return TailscaleStatus {
+            installed: false,
+            host: None,
+            serving: false,
+            url: None,
+            serve_command: None,
+        };
     };
 
     let host = std::process::Command::new(&bin)
@@ -1003,12 +1027,44 @@ pub fn portal_tailscale(portal: State<'_, Portal>) -> TailscaleStatus {
             (!dns.is_empty()).then_some(dns)
         });
 
-    let serve_command = portal
-        .status()
-        .port
-        .map(|p| format!("{bin} serve --bg {p}"));
+    let port = portal.status().port;
+
+    // Are we already proxying to *our* port? Tailscale may well be serving something
+    // else entirely; that isn't us, and turning it off isn't ours to do.
+    let serving = port.is_some_and(|p| {
+        tailscale_run(&bin, &["serve", "status", "--json"])
+            .map(|s| s.contains(&format!("127.0.0.1:{p}")))
+            .unwrap_or(false)
+    });
+
+    TailscaleStatus {
+        installed: true,
+        host: host.clone(),
+        serving,
+        url: (serving && host.is_some()).then(|| format!("https://{}/m", host.unwrap())),
+        serve_command: port.map(|p| format!("{bin} serve --bg {p}")),
+    }
+}
+
+/// Publish the portal to the tailnet: Tailscale terminates HTTPS on the tailnet and
+/// proxies to our loopback port. This is the one button that makes the journal
+/// reachable from another device, so it stays an explicit, reversible act — and it
+/// refuses if the portal isn't actually running, rather than serving a dead port.
+#[tauri::command]
+pub fn portal_serve(portal: State<'_, Portal>) -> Result<TailscaleStatus, String> {
+    let bin = tailscale_bin().ok_or("Tailscale isn't installed on this Mac.")?;
+    let port = portal.status().port.ok_or("Turn on phone access first.")?;
+    tailscale_run(&bin, &["serve", "--bg", &port.to_string()])?;
+    Ok(portal_tailscale(portal))
+}
 
-    TailscaleStatus { installed: true, host, serve_command }
+/// Stop publishing. The portal itself keeps running on loopback — this only removes
+/// the tailnet's route to it.
+#[tauri::command]
+pub fn portal_unserve(portal: State<'_, Portal>) -> Result<TailscaleStatus, String> {
+    let bin = tailscale_bin().ok_or("Tailscale isn't installed on this Mac.")?;
+    tailscale_run(&bin, &["serve", "--https=443", "off"])?;
+    Ok(portal_tailscale(portal))
 }
 
 // ---------- upstream contribution drafts ----------

src-tauri/src/commands.rs

@@ -157,6 +157,8 @@ pub fn run() {
             commands::portal_disable,
             commands::portal_qr,
             commands::portal_tailscale,
+            commands::portal_serve,
+            commands::portal_unserve,
             commands::crisis_scan,
             commands::knowledge_search,
             commands::knowledge_status,

src-tauri/src/lib.rs

@@ -446,10 +446,15 @@ mod tests {
             "ai_pull",
             "ai_start",
             "pw_update",
-            // The portal may not reconfigure or disable itself.
+            // The portal may not reconfigure or disable itself — including publishing
+            // itself to the tailnet, which is a decision made at the desk.
             "portal_status",
             "portal_enable",
             "portal_disable",
+            "portal_qr",
+            "portal_tailscale",
+            "portal_serve",
+            "portal_unserve",
         ];
         for c in forbidden {
             assert!(!EXPOSED.contains(&c), "`{c}` must not be reachable from the phone");

src-tauri/src/portal.rs

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Field Notes",
-  "version": "0.4.0-beta.1",
+  "version": "0.4.0-beta.2",
   "identifier": "com.fieldnotes.journal",
   "build": {
     "beforeDevCommand": "npm run dev",

src-tauri/tauri.conf.json

@@ -372,13 +372,17 @@ export interface PortalStatus {
 export interface TailscaleStatus {
   installed: boolean;
   host: string | null;
+  serving: boolean;
+  url: string | null;
   serve_command: string | null;
 }
 export const portalStatus = () => invoke<PortalStatus>("portal_status");
 export const portalEnable = () => invoke<PortalStatus>("portal_enable");
 export const portalDisable = () => invoke<PortalStatus>("portal_disable");
 export const portalQr = (url?: string) => invoke<string>("portal_qr", { url });
 export const portalTailscale = () => invoke<TailscaleStatus>("portal_tailscale");
+export const portalServe = () => invoke<TailscaleStatus>("portal_serve");
+export const portalUnserve = () => invoke<TailscaleStatus>("portal_unserve");
 
 // ---- erase all data / uninstall ----
 export const dataDir = () => invoke<string>("data_dir");

src/lib/api.ts

@@ -47,6 +47,8 @@
     portalDisable,
     portalQr,
     portalTailscale,
+    portalServe,
+    portalUnserve,
     type PortalStatus,
     type TailscaleStatus,
     dbStatus,
@@ -168,6 +170,7 @@
   // The pairing QR carries the bearer token, so it is hidden until asked for —
   // it should not be sitting on screen behind you while you're screen-sharing.
   let showQr = $state(false);
+  let serving = $state(false);
   let tailscaleUrl = $derived(
     ts?.host && portal.port ? `https://${ts.host}/m` : null,
   );
@@ -975,6 +978,25 @@
     showQr = true;
   }
 
+  /** Publish (or stop publishing) the portal to the tailnet. This is the step that
+   *  makes the journal reachable from another device, so it's one button and it's
+   *  reversible — and Tailscale's own refusal (not logged in, HTTPS not enabled in
+   *  the admin console) is shown verbatim, because that message is the fix. */
+  async function toggleServe() {
+    portalErr = null;
+    serving = true;
+    try {
+      ts = ts?.serving ? await portalUnserve() : await portalServe();
+      // The pairing URL changes with it, so any QR on screen is now stale.
+      portalQrSvg = null;
+      showQr = false;
+    } catch (e) {
+      portalErr = e instanceof Error ? e.message : String(e);
+    } finally {
+      serving = false;
+    }
+  }
+
   // ---- Upstream contribution ----
   async function loadContrib() {
     contribCands = await contributionCandidates();
@@ -1689,13 +1711,27 @@
               </p>
             {:else if !tailscaleUrl}
               <p class="muted small">⚠️ Tailscale is installed but isn't logged in — sign in, then reopen this tab.</p>
+            {:else if ts.serving}
+              <p class="muted small">
+                Published to your tailnet. Your phone can reach <strong>{ts.url ?? tailscaleUrl}</strong> —
+                and nothing else can: it's your tailnet, encrypted end to end, and every request still
+                needs the paired token.
+              </p>
+              <button class="small-btn" disabled={serving} onclick={toggleServe}>
+                {serving ? "Working…" : "Stop publishing to my tailnet"}
+              </button>
             {:else}
               <p class="muted small">
-                One more step, and you run it yourself so you can see exactly what it does — it's the
-                command that publishes the portal to your tailnet:
+                One more step: publish the portal to your tailnet, so your phone can reach it.
+                Tailscale carries it, encrypted — this does not open anything to the internet or to
+                your local network. You can undo it here at any time.
+              </p>
+              <button class="primary small-btn" disabled={serving} onclick={toggleServe}>
+                {serving ? "Publishing…" : "Publish to my tailnet"}
+              </button>
+              <p class="muted small">
+                That runs <code>{ts.serve_command}</code>, if you'd rather do it yourself.
               </p>
-              <pre class="draft">{ts.serve_command}</pre>
-              <p class="muted small">Then your phone opens <strong>{tailscaleUrl}</strong>.</p>
             {/if}
 
             {#if showQr && portalQrSvg}