fix(desktop): separate LAN and Tailscale pairing endpoints

[maria-rcks]

When Tailscale is enumerated before Wi-Fi, desktop pairing advertises the tailnet address as both Local network and Tailscale IP. Automatic LAN discovery now skips tailnet addresses while preserving Tailscale-only connectivity and explicit host overrides.

Verified with 14 focused desktop exposure and Tailscale endpoint tests, targeted lint, and desktop typecheck. The updated tests fail against the original source for the two changed behaviors.

Fixes #7519.

Model: gpt-6-astra via Codex.

---

Note

Medium Risk
Changes desktop network binding and advertised pairing endpoints; Tailscale-only machines that previously fell back to local-only now remain network-accessible.

Overview
Desktop pairing no longer treats Tailscale IPv4 addresses as the LAN host, so advertised endpoints stay distinct when interface enumeration puts tailnet before Wi‑Fi.

isUsableLanIpv4Address excludes addresses recognized by isTailscaleIpv4Address, and network-accessible mode no longer falls back to local-only when there is no classic LAN host but a non-internal Tailscale IPv4 interface exists (bind stays on 0.0.0.0 with tailnet advertised separately). Bootstrap logging only warns about a local-only fallback when the user requested network access and runtime exposure actually resolved to local-only.

Tests cover Tailscale-before-LAN ordering, Tailscale-only hosts, and explicit T3CODE_DESKTOP_LAN_HOST overrides using tailnet addresses.

^{Reviewed by Cursor Bugbot for commit 30a4991. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Separate LAN and Tailscale pairing endpoints in DesktopServerExposure

• isUsableLanIPv4Address now excludes Tailscale IPv4 addresses, so LAN host resolution no longer picks a Tailscale address as the LAN endpoint.
• resolveRuntimeState keeps network-accessible exposure when a Tailscale non-internal IPv4 address is present, even without a resolved endpoint URL. Previously it fell back to local-only in that case.
• Desktop startup no longer emits the local-only fallback warning when the server remains network-accessible via Tailscale but has no single endpoint URL.
• Tests in DesktopServerExposure.test.ts are renamed and expanded to cover Tailscale-only exposure and explicit Tailscale overrides.
• Behavioral Change: configurations that previously fell back to local-only now stay network-accessible when a qualifying Tailscale address exists; the fallback path is unchanged for configs lacking both an endpoint URL and a Tailscale address.

^{Macroscope summarized 30a4991.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1f69771. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved at 30a4991

Macroscope's review found this PR approvable — This is a contained desktop pairing fix that keeps LAN and Tailscale endpoints distinct and preserves network access for Tailscale-only hosts. The production changes are narrow, directly test-covered, and do not modify defaults, schemas, deployment behavior, or static-analysis configuration.

^{You can add or adjust custom eligibility rules. Learn more.}