[kwsantiago]

Bumps the wrapped upstream client from Tailscale 1.104.1 to 1.104.2 (the current stable release), per UPDATING.md.

Changes

• Dockerfile: ghcr.io/tailscale/tailscale:v1.104.1 -> v1.104.2
• startos/versions/current.ts: 1.104.1:0 -> 1.104.2:0, with release notes in all five supported locales
• package.json / package-lock.json: @start9labs/start-sdk 3.0.6 -> 3.1.0, the current published release. Nothing the package uses changed: the one touched API is gracePeriod, whose new behavior applies only to 0, and this package sets 30_000. The lockfile is stable across repeat installs and holds a single SDK copy.

No migration is needed: nothing in the package's on-disk state changes shape across the bump, so migrations.up stays a no-op.

What 1.104.2 brings

The public changelog has no 1.104.2 entry yet, so this is from the upstream tag diff. It is three commits:

• The Go toolchain moves to 1.27.3, a security update (the upstream commit tracks CVE-2026-111943), along with the matching dependency bumps in go.mod/go.sum.
• A Windows-only DNS fix: quad-100 is no longer installed as the OS's primary resolver when hosts are unrouted. It does not affect this package, which runs tailscaled --tun=userspace-networking and never manages the OS resolver (dns: OScfg: {} in the daemon log).
• The version file.

No CLI, serve, or ipn code changed between the tags.

Verification

• ghcr.io/tailscale/tailscale:v1.104.2 publishes both linux/amd64 and linux/arm64, and is what latest now resolves to. The binary reports 1.104.2 built with go1.27.3.
• Every CLI surface the package drives still exists, checked against --help in the image: tailscaled --state/--socket/--tun, tailscale status --json, tailscale web --listen, tailscale serve --bg --http/--https/--tcp, tailscale serve status --json, tailscale serve reset, tailscale funnel --bg --https, tailscale funnel reset.
• Ran tailscaled --tun=userspace-networking in the image: tailscale status --json still emits BackendState and Self.DNSName, and tailscale serve status --json exits 0 with {} on an unconfigured node.
• tsc --noEmit and prettier (with the SDK's config, as CI runs it) pass on SDK 3.1.0, and npm ls @start9labs/start-sdk shows one copy at 3.1.0.
• make builds clean for both arches with SDK 3.1.0 and start-cli 2.4.2, the release CI installs, both reporting v1.104.2:0. The SDK's new format-on-build step left startos/ unchanged.

Not verified: a live install on StartOS with a real tailnet sign-in.

[helix-a]

Please update the exact @start9labs/start-sdk pin from 3.0.6 to the currently published 3.1.0 before merging, as required by the package-review policy. The proposal updates package.json and regenerates package-lock.json to a stable fixed point, retaining one SDK copy. I read the published guide's SDK changelog for this range; no package API changes are needed.

The Tailscale patch bump itself looks correct: it merges cleanly into master, the image tag resolves for both supported architectures, the package version matches, and editing the existing no-op migration version in place is appropriate. README and user instructions remain accurate for this change.

Verification: all three existing CI checks passed, including x86 and ARM package builds. For the proposal I ran repeated npm installs (lockfile stable), npm ls @start9labs/start-sdk, tsc --noEmit, Prettier, and make tailscale.s9pk through helix-build; all passed. I inspected the returned package's manifest: tailscale 1.104.2:0, StartOS requirement 0.4.0.2, both aarch64 and x86_64 images. No live StartOS/tailnet sign-in test was performed.

Proposed changes: 8d685bf...proposal/20

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol