Commit 60e1b73948debac845c3dc72aac35c9adbd4cd64 | the-knife

author	maria <maria@kuuro.net> 2026-09-05 14:41:25-04:00
committer	GitHub <noreply@github.com> 2026-09-05 14:41:25-04:00
log	60e1b73948debac845c3dc72aac35c9adbd4cd64
tree	ebbc026be22b9da9b3170a0caa49ba2352a10dc8
parent	2c301fd0c4fc58c1612be47c3856fa4ad547429d
signature	Signed by PGP key B5690EEEBB952194

fix(desktop): separate LAN and Tailscale pairing endpoints (#9882)

3 files changed, 49 insertions(+), 11 deletions(-)

apps
- desktop
  - src
    app
    DesktopApp.ts
    backend
    DesktopServerExposure.test.ts
    DesktopServerExposure.ts

apps/desktop/src/app/DesktopApp.ts+4-1

 @@ -194,7 +194,10 @@ const bootstrap = Effect.gen(function* () {
     yield* logBootstrapInfo("bootstrap enabled network access", {
       endpointUrl: serverExposureState.endpointUrl,
     });
-  } else if (settings.serverExposureMode === "network-accessible") {
+  } else if (
+    settings.serverExposureMode === "network-accessible" &&
+    serverExposureState.mode === "local-only"
+  ) {
     yield* logBootstrapWarning(
       "bootstrap fell back to local-only because no advertised network host was available",
     );

apps/desktop/src/backend/DesktopServerExposure.test.ts+33-7

 @@ -304,9 +304,9 @@ describe("DesktopServerExposure", () => {
     );
   });
-  it.effect("resolves advertised endpoints from the scoped runtime state", () =>
+  it.effect("keeps LAN and Tailscale endpoints distinct when Tailscale is enumerated first", () =>
     withHarness(
-      { ...lanNetworkInterfaces, ...tailnetNetworkInterfaces },
+      { ...tailnetNetworkInterfaces, ...lanNetworkInterfaces },
       Effect.gen(function* () {
         const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
         yield* serverExposure.configureFromSettings({ port: 4173 });
 @@ -321,6 +321,32 @@ describe("DesktopServerExposure", () => {
     ),
   );
+  it.effect("keeps Tailscale-only hosts network-accessible", () =>
+    withHarness(
+      tailnetNetworkInterfaces,
+      Effect.gen(function* () {
+        const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+        const settings = yield* DesktopAppSettings.DesktopAppSettings;
+        yield* settings.setServerExposureMode("network-accessible");
+        const state = yield* serverExposure.configureFromSettings({ port: 4173 });
+        assert.equal(state.mode, "network-accessible");
+        assert.equal(state.advertisedHost, null);
+        assert.equal(state.endpointUrl, null);
+        assert.equal((yield* serverExposure.backendConfig).bindHost, "0.0.0.0");
+        const endpoints = yield* serverExposure.getAdvertisedEndpoints;
+        assert.deepEqual(
+          endpoints.map((endpoint) => [endpoint.reachability, endpoint.httpBaseUrl]),
+          [
+            ["loopback", "http://127.0.0.1:4173/"],
+            ["private-network", "http://100.90.1.2:4173/"],
+          ],
+        );
+      }),
+    ),
+  );
   it.effect("does not spawn the tailscale CLI while server exposure is local-only", () =>
     withHarness(
       lanNetworkInterfaces,
 @@ -342,7 +368,7 @@ describe("DesktopServerExposure", () => {
     ),
   );
-  it.effect("uses ConfigProvider desktop exposure overrides", () =>
+  it.effect("preserves explicit Tailscale exposure overrides", () =>
     withHarness(
       lanNetworkInterfaces,
       Effect.gen(function* () {
 @@ -350,17 +376,17 @@ describe("DesktopServerExposure", () => {
         yield* serverExposure.configureFromSettings({ port: 4173 });
         const change = yield* serverExposure.setMode("network-accessible");
-        assert.equal(change.state.advertisedHost, "10.0.0.7");
+        assert.equal(change.state.advertisedHost, "100.90.1.2");
-        assert.equal(change.state.endpointUrl, "http://10.0.0.7:4173");
+        assert.equal(change.state.endpointUrl, "http://100.90.1.2:4173");
         const endpoints = yield* serverExposure.getAdvertisedEndpoints;
         assert.deepEqual(
           endpoints.map((endpoint) => endpoint.httpBaseUrl),
-          ["http://127.0.0.1:4173/", "http://10.0.0.7:4173/", "https://public.example.test/"],
+          ["http://127.0.0.1:4173/", "http://100.90.1.2:4173/", "https://public.example.test/"],
         );
       }),
       {
-        T3CODE_DESKTOP_LAN_HOST: "10.0.0.7",
+        T3CODE_DESKTOP_LAN_HOST: "100.90.1.2",
         T3CODE_DESKTOP_HTTPS_ENDPOINTS: "https://public.example.test",
       },
     ),

apps/desktop/src/backend/DesktopServerExposure.ts+12-3

 @@ -9,7 +9,7 @@ import {
   type DesktopServerExposureMode,
   type DesktopServerExposureState,
 } from "@t3tools/contracts";
-import { readTailscaleStatus } from "@t3tools/tailscale";
+import { isTailscaleIpv4Address, readTailscaleStatus } from "@t3tools/tailscale";
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 @@ -65,7 +65,9 @@ const normalizeOptionalHost = (value: string | undefined): string | undefined =>
 };
 const isUsableLanIpv4Address = (address: string): boolean =>
-  !address.startsWith("127.") && !address.startsWith("169.254.");
+  !address.startsWith("127.") &&
+  !address.startsWith("169.254.") &&
+  !isTailscaleIpv4Address(address);
 const isHttpsEndpointUrl = (value: string): boolean => {
   try {
 @@ -376,7 +378,14 @@ function resolveRuntimeState(input: {
     ...(advertisedHostOverride ? { advertisedHostOverride } : {}),
   });
   const unavailable =
-    input.requestedMode === "network-accessible" && requestedExposure.endpointUrl === null;
+    input.requestedMode === "network-accessible" &&
+    requestedExposure.endpointUrl === null &&
+    !Object.values(input.networkInterfaces).some((addresses) =>
+      addresses?.some(
+        (address) =>
+          !address.internal && address.family === "IPv4" && isTailscaleIpv4Address(address.address),
+      ),
+    );
   const exposure = unavailable
     ? resolveDesktopServerExposure({
         mode: "local-only",