[root-daemon]

Problem

Settings → Connections → Tailscale HTTPS asks users to start Tailscale when the desktop already advertises its adapter IP but cannot read its MagicDNS name. This commonly happens when the Tailscale CLI is unavailable to a macOS app launched from the Dock.

Change

Use the existing advertised Tailscale IP to show the original implementation's MagicDNS/CLI guidance. Keep the network-access-off message and existing MagicDNS controls unchanged. No additional CLI probes, wire fields, or provider changes.

Preserves @root-daemon's original commit, merges main, and removes the single-use IP helper and an overly specific comment about the failure cause. Fixes https://git.cafe/pingdotgg/t3code/issues/15919.

Scope and approval

Maintainer-directed takeover for https://git.cafe/pingdotgg/t3code/issues/15919. This only corrects misleading diagnostic copy using data the desktop already advertises; no CLI lookup or networking behavior changes.

Verification

• Blacksmith: vp run check:changed 278588a61a3a passes format, lint, both knip passes, affected typechecks, and the focused test suite (10 tests).
• Restoring main's logic produces one failure and nine passes; the fixed logic passes all ten. Covers adapter-only, no address, and network access off with a cached IP.
• Real dev app in system Chrome, simulated desktop IPC: checked adapter-only, no-address, network-off, and MagicDNS-present states. Inspected light 1440×1000 and dark 900×900 layouts. Existing MagicDNS switch remains present.
• Unverified here: native Electron IPC, a real Tailscale daemon, and macOS Dock/PATH behavior. The captures prove the real settings renderer with matching IPC data, not a live tailnet integration.

Before, with main's message logic and an advertised adapter IP:

After, with the same adapter IP:

Built with GPT-6.1-Sol in the Codex harness on T3 Code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 278588a
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1bc39fbe-9f6b-40e4-bba9-4de8124cab5c

Commits

Reviewing files that changed from the base of the PR and between 278588a and 2ba046f.

Files selected for processing: 3

• apps/web/src/components/settings/ConnectionsSettings.logic.test.ts
• apps/web/src/components/settings/ConnectionsSettings.logic.ts
• apps/web/src/components/settings/ConnectionsSettings.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

The Tailscale HTTPS settings row now uses advertised endpoints to distinguish an unavailable MagicDNS endpoint from a Tailscale instance that is not running. Tests cover the related guidance messages.

Changes: Tailscale endpoint guidance

Layer / File(s)	Summary
Select and display missing-endpoint guidance apps/web/src/components/settings/ConnectionsSettings.logic.ts, apps/web/src/components/settings/ConnectionsSettings.tsx, apps/web/src/components/settings/ConnectionsSettings.logic.test.ts	The helper accepts advertised endpoints and reports MagicDNS-read guidance when a Tailscale IP endpoint exists. The settings row passes the endpoints to the helper. Tests cover enabled network access, disabled network access with a cached IP, and no Tailscale address.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related issues

• pingdotgg/t3code#17362 — The issue concerns Tailscale HTTPS remaining in setup after Tailscale connects late. This change adjusts the message for a related state where a Tailscale IP exists but MagicDNS is unavailable.

Possibly related PRs

• pingdotgg/t3code#24943 — This PR changes Tailscale endpoint resolution and MagicDNS probing used by this change to select the settings message.

Suggested reviewers: mnigos

Merge Risk: Low · up to 2ba04

The guidance can briefly be inaccurate after Tailscale stops, but the change remains mergeable with awareness of that limitation.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title follows conventional commit format and names the specific user-facing change: the Tailscale HTTPS row no longer says "Start Tailscale" while Tailscale is running. The changeset matches this:…
Linked Issues check		Issue [#15919] requires the Tailscale HTTPS row to stop claiming that Tailscale is stopped when a Tailscale IP is advertised. missingTailscaleEndpointDescription now detects tailscale-ip: endpoint…
Out of Scope Changes check		The diff changes only the Tailscale HTTPS message selection, passes the existing advertised endpoints into that selection, and adds focused tests. The changes support issue [#15919] and preserve the e…
Description check		The pull request description includes all required sections: Problem, Change, Scope and approval, and Verification. It explains the issue, implementation, linked issue and approval basis, focused test…

Full details: Title check

Explanation

The title follows conventional commit format and names the specific user-facing change: the Tailscale HTTPS row no longer says "Start Tailscale" while Tailscale is running. The changeset matches this: missingTailscaleEndpointDescription now takes the endpoint list and reports MagicDNS-read failure when a tailscale-ip endpoint exists. The title is concise and specific, and a teammate scanning history would understand the primary change.

Full details: Linked Issues check

Explanation

Issue [#15919] requires the Tailscale HTTPS row to stop claiming that Tailscale is stopped when a Tailscale IP is advertised. missingTailscaleEndpointDescription now detects tailscale-ip: endpoints and shows MagicDNS and CLI guidance. It preserves the Network access message when access is off and the start message when no Tailscale address exists. Tests cover all three cases. The issue suggests bundle-path lookup and/or a diagnostic message; this change implements the diagnostic path without adding a CLI probe.

Full details: Out of Scope Changes check

Explanation

The diff changes only the Tailscale HTTPS message selection, passes the existing advertised endpoints into that selection, and adds focused tests. The changes support issue [#15919] and preserve the existing Network access and no-address behavior. No unrelated provider, wire, or CLI changes are present.

Full details: Description check

Explanation

The pull request description includes all required sections: Problem, Change, Scope and approval, and Verification. It explains the issue, implementation, linked issue and approval basis, focused test results, manual checks, limitations, screenshots, and the agent and harness used.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

thanks @root-daemon. your adapter-IP fallback correctly addresses the misleading message without extra CLI probes. i kept your commit, merged main, removed the single-use predicate helper and the overly specific failure-cause comment, and added coverage for network access being off with a cached IP. the original MagicDNS controls and actions stay intact.

verification on 2ba046fe104e13088816767facdcc65beef39e6c:

• blacksmith vp run check:changed 278588a61a3a: format, lint, knip, affected typechecks, and all 10 focused tests pass. main's logic fails the adapter-only case.
• GitHub CI passes, including build/typecheck, web tests, unit tests, and all eight server shards. the automatic bot review generated no actionable findings. two independent GPT-6.1-Sol reviews found no issues on this head.
• checked the real settings renderer with simulated desktop IPC for adapter-only, no IP, network off, and MagicDNS present. inspected light 1440×1000 and dark 900×900 layouts. both screenshots use matching data.
• unverified: real Electron IPC, a live Tailscale daemon, and macOS Dock/PATH behavior. preview deployment workflows were not run.

marked ready for Maria's review. no labels changed, no rebase, no force-push.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

partial verification on head 2ba046fe104e13088816767facdcc65beef39e6c. the changed tailscale message remains unverified.

• inspected the diff, description, discussion, and all three pr commits. the pr is open; none is authored by juliusmarminge or t3dotgg.
• installed and ran github/main (49a9e80e0b) in /home/user/main, then stopped its captured process group before installing and running the exact pr head. only one dev server ran at a time, with isolated state.
• used the repo playwright with /usr/bin/google-chrome, real pairing authentication, and the running web/server stack. created a project pointing at the real main git worktree through the app.
• completed a real codex gpt-6.1-sol follow-up turn through the composer. it ran git commands and returned 49a9e80e0b, with tracked files clean. persisted run: codex, gpt-6.1-sol, completed, with a ready checkpoint. an initial turn used the default astra model; the follow-up explicitly used sol.
• nearby behavior: created a pairing code in settings, consumed it in an independent chrome context, and saw authorized clients increase from one to two. also exercised read-only/standard permission presets and cancelled the pairing dialog.
• inspected the screenshots and recording. uploaded video playback and seeking passed in the t3 preview player.

short runtime transcript (credentials omitted):

main: vp i; background vp run dev
[dev-runner] serverPort=16733 webPort=8693 baseDir=/home/user/main/.t3
chrome: window.desktopBridge -> undefined; tailscale https row absent
stop main by captured process group 17778
pr: git rev-parse HEAD -> 2ba046fe104e13088816767facdcc65beef39e6c
pr: vp i; background vp run dev (isolated T3CODE_HOME)
[dev-runner] serverPort=13773 webPort=5733 baseDir=/home/user/t3code/.t3
persisted run: codex / gpt-6.1-sol / completed
provider tool result: 49a9e80e0b; tracked files clean
independent chrome context: paired successfully
authorized clients: 1 -> 2

main web settings, showing the desktop tailscale row is unavailable here:

Not verified

the adapter-present / magicdns-unreadable tailscale state could not be reproduced on main or exercised on this pr. this linux vm has no tailscale cli, authenticated tailnet, or tailscale adapter address. the changed row is gated behind the real electron desktop bridge, which chrome does not have. no simulated ipc, injected endpoints, fake adapter, mocks, or fixtures were used.

these captures prove the real web, provider, and pairing paths, not the tailscale copy fix. native electron ipc, tailscale https/serve setup and disable, macos dock/path behavior, windows, native ios/android, and remote/relay/tunnel connections remain unverified. completing the requested proof needs the desktop app connected to a real tailnet with an adapter address while cli/magicdns lookup is unavailable, followed by no-address and network-access-off checks.

no source changes, commits, pushes, labels, or pr metadata changes. observed existing ci: 25 successful checks, zero pending/failing; checks were not rerun because no source changed. both task dev servers are stopped after evidence capture.

[t3dotgg]

Note

🤖 Claude Opus 5.5 responding on behalf of Theo

Superseded by #26757, which folds in the "Start Tailscale" copy fix. You are credited with a Co-authored-by trailer. Closing this so the two don't conflict.