Emit the minimal v2 grammar for the pairing window's Tailscale QR

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxPairingQRBitmap.swift

@@ -25,11 +25,13 @@ public struct CmxPairingQRBitmap: Sendable {
     /// zone included, or `nil` when Core Image produces no code (empty or
     /// over-capacity payload).
     ///
-    /// ECC M rather than L: the routes-only payload is small enough that M
-    /// still keeps the code at QR version 6 or lower (asserted by tests), and
-    /// the extra redundancy tolerates the glare, moire, and off-angle blur of
-    /// photographing a glossy Mac screen. L would maximize module size, but
-    /// module size is not the binding constraint at these payload sizes.
+    /// ECC M rather than L: the minimal payloads are small enough that M
+    /// still keeps the code at QR version 6 or lower for routes-only and
+    /// Iroh codes, and version 8 or lower for the account-bound Tailscale
+    /// compatibility code (both asserted by tests), and the extra redundancy
+    /// tolerates the glare, moire, and off-angle blur of photographing a
+    /// glossy Mac screen. L would maximize module size, but module size is
+    /// not the binding constraint at these payload sizes.
     public func makeImage(payload: String) -> CGImage? {
         let filter = CIFilter.qrCodeGenerator()
         filter.message = Data(payload.utf8)

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxPairingQRCode.swift

@@ -14,17 +14,27 @@ import Foundation
 ///
 /// Tailscale compatibility codes keep the v2 grammar so already-released
 /// clients can still scan them:
-/// `cmux-ios://attach?v=2&ub=<stack-user-id>&pc=<compat>&av=<version>&ab=<build>&r=<host>:<port>[&r=<host>:<port>...]`.
+/// `cmux-ios://attach?v=2&ub=<stack-user-id>&pc=<compat>&r=<host>:<port>[&r=<host>:<port>...]`.
+///
+/// The only metadata a Tailscale code carries is what the phone consults
+/// before dialing: `ub`, the opaque Stack user id the account preflight
+/// matches against the signed-in phone so a wrong-account scan fails fast
+/// (#6028), and `pc`, the pairing compatibility level, which fielded
+/// decoders default to 0 when absent — omitting it would spuriously fire the
+/// cross-version pairing warning on every current phone. App version and
+/// build (`av`/`ab`) only ever decorated that warning's message, so they are
+/// no longer written; the decoder still reads them from older Macs' codes.
 ///
 /// Both grammars share these properties:
 /// - **No auth token.** The owner's Stack access token is the host's sole
 ///   authorization gate; a token in the QR authorized nothing and made the
 ///   code look like a leaked credential.
 /// - **No expiry.** Ticket age authorizes nothing, so a code that sat on
 ///   screen for an hour still pairs.
-/// - **No display name, no device id.** Both arrive post-handshake from
-///   `mobile.host.status`; the decoder leaves `macDeviceID` empty and the
-///   shell adopts the host-reported identity once connected.
+/// - **No display name, no device id, no build metadata.** All arrive
+///   post-handshake from `mobile.host.status`; the decoder leaves
+///   `macDeviceID` empty and the shell adopts the host-reported identity
+///   once connected.
 /// - **No loopback, ever.** v2 routes are Tailscale `host:port` only: the
 ///   encoder drops a DEBUG Mac's dev loopback route instead of encoding it,
 ///   the Mac refuses to mint a QR without a Tailscale route (it shows the
@@ -105,12 +115,6 @@ public struct CmxPairingQRCode: Sendable {
             if let compatibilityVersion = ticket.macPairingCompatibilityVersion {
                 compatibilityItems.append("pc=\(compatibilityVersion)")
             }
-            if let version = normalizedNonEmpty(ticket.macAppVersion) {
-                compatibilityItems.append("av=\(percentEncodeQueryValue(version))")
-            }
-            if let build = normalizedNonEmpty(ticket.macAppBuild) {
-                compatibilityItems.append("ab=\(percentEncodeQueryValue(build))")
-            }
             compatibilityItems.append(contentsOf: routes.map { route -> String in
                 guard case let .hostPort(host, port) = route.endpoint else {
                     // Unreachable: the selector admits host/port endpoints only.

Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxPairingQRBitmapTests.swift

@@ -1,4 +1,5 @@
 import CoreGraphics
+import Foundation
 import Testing
 
 @testable import CMUXMobileCore
@@ -65,6 +66,58 @@ import Testing
         }
     }
 
+    /// The pairing window's real Tailscale compatibility payload also carries
+    /// the `ub` account binding (an opaque user id, in practice a UUID) and
+    /// the `pc` compatibility level. Built through the real encoder with the
+    /// longest realistic inputs (tagged dev scheme, IPv4 + IPv6 routes) so
+    /// this tracks whatever the encoder actually emits: it may exceed
+    /// version 6, but stays at or below version 8 (49 modules), where
+    /// modules still render large on screen. The full-key JSON payload this
+    /// replaced rendered version 23 (109 modules).
+    @Test func realCompatibilityPayloadStaysAtOrBelowVersionEight() throws {
+        let ticket = try CmxAttachTicket(
+            workspaceID: "",
+            terminalID: nil,
+            macDeviceID: "mac-device-uuid",
+            macDisplayName: "Lawrence's Mac",
+            macUserEmail: nil,
+            macUserID: "8b7e6a2f-1234-4c5d-9e8f-0a1b2c3d4e5f",
+            macPairingCompatibilityVersion: CmxMobileDefaults.pairingCompatibilityVersion,
+            macAppVersion: "0.65.0",
+            macAppBuild: "42",
+            routes: [
+                try CmxAttachRoute(
+                    id: "tailscale",
+                    kind: .tailscale,
+                    endpoint: .hostPort(host: "100.101.102.103", port: 52341),
+                    priority: 10
+                ),
+                try CmxAttachRoute(
+                    id: "tailscale_2",
+                    kind: .tailscale,
+                    endpoint: .hostPort(host: "fd7a:115c:a1e0::1234:5678", port: 52341),
+                    priority: 20
+                ),
+            ],
+            expiresAt: Date().addingTimeInterval(600),
+            authToken: "minted-but-never-in-the-qr"
+        )
+        let payload = try #require(CmxPairingQRCode().encode(
+            ticket,
+            routeDisclosureMode: .legacyPrivateNetworkCompatibility,
+            pairingURLScheme: try #require(
+                CmxPairingURLScheme(rawValue: "cmux-ios-dev.cmux.ios.longtag")
+            )
+        ))
+        let image = try #require(CmxPairingQRBitmap().makeImage(payload: payload))
+        let modules = image.width - CmxPairingQRBitmap.quietZoneModules * 2
+        #expect((modules - 17) % 4 == 0, "\(modules) modules is not a QR version")
+        #expect(
+            modules <= 49,
+            "account-bound compat payload should stay at version <= 8, got \(modules) modules"
+        )
+    }
+
     /// Renders `image` into an sRGB bitmap and reduces each pixel to its red
     /// channel; the QR is grayscale, so one channel carries the module value.
     private func grayLevels(of image: CGImage) throws -> [UInt8] {

Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxPairingQRCodeTests.swift

@@ -91,7 +91,7 @@ import Testing
         #expect(decoded.routes.map(\.priority) == [10, 20])
     }
 
-    @Test func roundTripsUserIDAndBuildMetadataWithoutExposingEmail() throws {
+    @Test func encodesOnlyAccountBindingAndCompatibilityLevelFromMetadata() throws {
         let ticket = try CmxAttachTicket(
             workspaceID: "",
             terminalID: nil,
@@ -110,20 +110,37 @@ import Testing
         )
 
         let url = try #require(encodeLegacy(ticket))
+        // `ub` survives (the account preflight's wrong-account fast-fail) and
+        // `pc` survives (fielded decoders default a missing `pc` to 0, which
+        // would spuriously fire the cross-version pairing warning). Email is
+        // never written, and app version/build only ever decorated that
+        // warning's message, so they are no longer written either.
         #expect(url.contains("ub=user_mac_123"))
+        #expect(url.contains("pc=1"))
         #expect(!url.contains("Lawrence@Example.com"))
         #expect(!url.lowercased().contains("lawrence@example.com"))
-        #expect(url.contains("pc=1"))
-        #expect(url.contains("av=0.64.15"))
-        #expect(url.contains("ab=42"))
+        #expect(!url.contains("av="))
+        #expect(!url.contains("ab="))
 
         let decoded = try CmxPairingQRCode().decode(try components(url))
         #expect(decoded.macUserEmail == nil)
         #expect(decoded.macUserID == "user_mac_123")
         #expect(decoded.macPairingCompatibilityVersion == 1)
+        #expect(decoded.macAppVersion == nil)
+        #expect(decoded.macAppBuild == nil)
+        #expect(decoded.routes == ticket.routes)
+    }
+
+    @Test func decodeStillReadsBuildMetadataFromOlderMacsCodes() throws {
+        // Macs that predate the av/ab removal still stamp both fields; the
+        // decoder keeps reading them so the cross-version warning can name
+        // the older Mac's version.
+        let url = "cmux-ios://attach?v=2&ub=user_mac_123&pc=1&av=0.64.15&ab=42&r=100.64.0.5:58465"
+        let decoded = try CmxPairingQRCode().decode(try components(url))
+        #expect(decoded.macUserID == "user_mac_123")
+        #expect(decoded.macPairingCompatibilityVersion == 1)
         #expect(decoded.macAppVersion == "0.64.15")
         #expect(decoded.macAppBuild == "42")
-        #expect(decoded.routes == ticket.routes)
     }
 
     @Test func roundTripsIPv6LiteralThroughRealURLParsing() throws {

Sources/Mobile/MobileAttachTarget.swift

@@ -32,26 +32,38 @@ enum MobileAttachTarget: String, Sendable {
                 selected = irohRoutes
                 break
             }
-            let physicalRoutes = routes.filter {
-                $0.kind == .tailscale && !CmxLoopbackHost().matches($0)
-            }
-            // A route-id filter can leave `tailscale_2` as the only route.
-            // Reindex the selected endpoints to the canonical sequence the v2
-            // QR decoder reconstructs, keeping the destination lossless while
-            // avoiding a token-bearing v1 fallback on physical devices.
-            selected = try physicalRoutes.enumerated().map { index, route in
+            selected = try Self.canonicalTailscaleRoutes(from: routes)
+        }
+        guard !selected.isEmpty else {
+            throw MobileAttachTicketStoreError.routeUnavailable
+        }
+        return selected
+    }
+
+    /// The non-loopback Tailscale routes of `routes`, reindexed to the
+    /// canonical id/priority sequence the v2 pairing decoder resynthesizes.
+    ///
+    /// A route-id filter can leave `tailscale_2` as the only route, and mixed
+    /// snapshots interleave Iroh and loopback entries. Reindexing keeps the
+    /// disclosed subsequence expressible in the bare `host:port` grammar
+    /// (which encodes neither ids nor priorities) without a token-bearing v1
+    /// fallback. Shared by the physical-device destination and the pairing
+    /// window's Tailscale compatibility code.
+    static func canonicalTailscaleRoutes(
+        from routes: [CmxAttachRoute]
+    ) throws -> [CmxAttachRoute] {
+        try routes
+            .filter { $0.kind == .tailscale && !CmxLoopbackHost().matches($0) }
+            .enumerated().map { index, route in
                 try CmxAttachRoute(
-                    id: index == 0 ? "tailscale" : "tailscale_\(index + 1)",
+                    id: index == 0
+                        ? CmxAttachTransportKind.tailscale.rawValue
+                        : "\(CmxAttachTransportKind.tailscale.rawValue)_\(index + 1)",
                     kind: .tailscale,
                     endpoint: route.endpoint,
                     priority: 10 + index * 10
                 )
             }
-        }
-        guard !selected.isEmpty else {
-            throw MobileAttachTicketStoreError.routeUnavailable
-        }
-        return selected
     }
 
     private static func identityOnlyIrohRoutes(