fix(desktop): separate LAN and Tailscale pairing endpoints

[leoisadev1]

Problem

When Tailscale is enumerated before Wi-Fi, desktop pairing advertises the tailnet address as both Local network and Tailscale IP.

Fix

Automatic LAN discovery now skips tailnet addresses. Tailscale-only machines stay network-accessible, and explicit host overrides still win. The bootstrap warning for a missing LAN host only fires when exposure actually fell back to local-only.

Adaptation

Reviewed port of pingdotgg/t3code#9882. Hosted relay was not added.

Scope

This PR is pairing endpoint advertisement only. Cookie isolation is #208. SSH runner ownership is #215. Zed remote open is a separate PR.

Verification

• vp test run apps/desktop/src/backend/DesktopServerExposure.test.ts: 10 passed, including Tailscale-first enumeration and Tailscale-only network-accessible hosts.
• vp run --filter @t3tools/desktop typecheck exited 0.
• Targeted lint reported no errors.

No live bot/group UI changed. Native two-device pairing over LAN and Tailscale was not exercised on this Linux host.

Implemented with Grok 4.6 High in Grok Build via Orca.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
akeru-bot-landing	Building	Preview	Sep 10, 2026 5:44pm UTC

[greptile-apps]

Greptile Summary

This PR separates automatically discovered LAN and Tailscale pairing endpoints while retaining network-accessible binding on Tailscale-only machines.

• Excludes Tailscale IPv4 addresses from automatic LAN-host selection.
• Preserves network-accessible mode when a tailnet interface is the only network interface.
• Limits the bootstrap fallback warning to genuine local-only fallback.
• Adds regression coverage for Tailscale-first enumeration, Tailscale-only hosts, and explicit overrides.
• Documents the revised pairing endpoint behavior.

Confidence Score: 5/5

The PR appears safe to merge; the changed endpoint classification and fallback behavior are internally consistent and covered by targeted tests.

No actionable failure was established. Tailscale addresses are excluded only from LAN selection, remain independently advertised, and correctly prevent local-only fallback when tailnet access is available.

Important Files Changed

Filename	Overview
apps/desktop/src/backend/DesktopServerExposure.ts	Separates LAN selection from tailnet detection and preserves network-accessible binding for Tailscale-only hosts.
apps/desktop/src/backend/DesktopServerExposure.test.ts	Adds focused regression coverage for endpoint ordering, Tailscale-only exposure, and explicit host overrides.
apps/desktop/src/app/DesktopApp.ts	Restricts the missing-network-host warning to cases that actually resolve to local-only mode.
docs/internals/remote.md	Documents distinct LAN and Tailscale endpoint advertisement behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Request network-accessible mode] --> B{Explicit host override?}
    B -->|Yes| C[Use explicit advertised host]
    B -->|No| D{Non-Tailscale LAN IPv4?}
    D -->|Yes| E[Advertise LAN endpoint]
    D -->|No| F{Tailscale IPv4 present?}
    F -->|Yes| G[Remain network-accessible]
    G --> H[Advertise Tailscale endpoint separately]
    F -->|No| I[Fall back to local-only]
    I --> J[Emit bootstrap warning]

Loading

_{Reviews (1): Last reviewed commit: "fix(desktop): separate LAN and Tailscale..." | Re-trigger Greptile}