An update from the install page downloads in full and then silently does nothing while
the tunnel is running. No error, no progress, the app stays at the old version — which
cost several hours yesterday, chasing the manifest, the short version string, the
signing and the server headers in turn.
Established across seven attempts on 2026-08-15: every upgrade with the tunnel down
succeeded, every upgrade with it up failed identically. The server log is the only place
the two are distinguishable, and both look the same up to the point where the download
completes.
The likely cause is that iOS will not replace a bundle whose network extension is live,
the packet tunnel being inside the very bundle being replaced. The same .ipa installs
fine while connected via devicectl, which goes through developer services rather than
the ordinary installer.
The workaround is one tap in the app — toggle the VPN off, install, toggle it back on —
and needs no trip to iOS Settings. A first install is unaffected, since there is no
tunnel yet, which is the case that matters for anyone new.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Extracted from the officer-suite monorepo into its own public repo. The app is
open source and free; the rest of the suite is not, so it could not stay in a
tree that ships an account layer.
What moved:
- apps/offscale/* -> repo root (App shell, app.json, assets)
- packages/officer-net/ -> modules/officer-net/, a `file:` dependency
- packages/core VPN closure -> src/vpn/ (screen, hook, native bridge, invite)
- packages/core shared primitives -> src/ui/ (theme, cards, tabs, backdrop, splash)
- scripts/build-{ios,android}.sh -> scripts/, cut down to this one app
What deliberately did NOT move: the platform account layer. VpnScreen used to
render core's AppSettingsScreen, which drags in ServersSection -> servers.ts,
useAuth, api.ts, shared-session, install-guard, api-keys. None of that exists
here. src/settings/SettingsScreen.tsx is a fresh replacement rendering exactly
what VpnScreen passed it — the app's own sections plus About — with no Servers
tab, no Appearance control (the app is pinned to dark) and no sign-out.
The one platform reference left in the closure was a dead `import { request }
from './api'` in officer-net.ts, unused since enrollVpn() was removed. Gone. The
app now contacts nothing but the control server you point it at, its peers, and
the enrolment sidecar named inside an invite link you tapped.
Dependencies are pinned to the exact versions the monorepo has installed, not to
ranges: this repo starts from versions already proven to build, and an unpinned
install is a supply-chain decision nobody made. react-query, react-dom,
react-native-screens, expo-secure-store, track-player, expo-audio and
expo-file-system were all declared by the old app and imported by none of this
code, so they are not here.
NOTICE carries Tailscale's BSD-3 text, names the built artifacts that contain
their compiled code, and treats the trademark question separately — including
that src/ui/TailscaleMark.tsx reproduces their logo in the attribution strip.
pastilhasandClaude Opus 5