[Bug]: Tailscale HTTPS row says "Start Tailscale" and hides its toggle while Network access is off, even though Tailscale is running#18753

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/desktop

Steps to reproduce

[human] I tried out the Mac app for the first time and the Tailscale section in the settings doesn't seem right. There is no toggle button or explanation. Probably better messaging or a toggle button that's disabled and explains why would make the UX better.

[AI slop follows]

1. On macOS, run the standalone Tailscale app, signed in to a tailnet with MagicDNS and HTTPS certificates enabled. tailscale status --json reports BackendState: "Running", a Self.DNSName, and a non-empty CertDomains.
2. In T3 Code, leave Network access off and don't turn on Tailscale HTTPS. Open Settings → Connections and look at the local environment.
3. Look at the Tailscale HTTPS row.

Expected behavior

I can't tell from the code whether Tailscale HTTPS is meant to need Network access, so either answer should lead to a fix:

• If Tailscale HTTPS is meant to work with Network access off, the row should detect Tailscale and show the toggle. Tailscale Serve forwards to http://127.0.0.1:<port>, which a local-only backend already listens on. getAdvertisedEndpoints also keeps resolving Tailscale endpoints in local-only mode once tailscaleServeEnabled is true. That suggests this combination is supported, but it can only be reached after Network access has been turned on at least once.
• If it's meant to need Network access, or detection is skipped on purpose (see Notes), the row shouldn't say "Start Tailscale" when Tailscale was never checked. It should explain why it's unavailable and what to do, for example "Turn on Network access to set up Tailscale HTTPS", or offer a way to check for Tailscale on demand.

Actual behavior

The row says "Start Tailscale to set up HTTPS access through MagicDNS." and has no toggle, even though Tailscale is running and ready to serve HTTPS. Nothing on the page suggests that Network access affects this row.

The cause is in apps/desktop/src/backend/DesktopServerExposure.ts, getAdvertisedEndpoints (main @ 9e55228):

With Network access off and Tailscale Serve never enabled, the Tailscale CLI isn't called, so no Tailscale endpoint is returned. renderTailscaleRow in apps/web/src/components/settings/ConnectionsSettings.tsx then treats "no endpoint" as "Tailscale isn't running". It shows the "Start Tailscale" text and hides the switch. The fallback text is the same whether Tailscale is stopped or was never checked.

Notes

• The check was added on purpose in #2745 (fixing #2254 and #2737). It stops the Tailscale CLI from being called while there's no network exposure, because calling it triggers a macOS "Other apps" permission prompt with the Mac App Store Tailscale build. This report isn't asking to undo that. It's about the effect on this settings row.
• This is a different problem from #15919. That report had Network access on and blames the tailscale command not being on the app's PATH. Here the CLI resolves fine, as /usr/local/bin is on the backend's PATH; it just never runs.

Impact

Minor bug or occasional failure

Version or commit

Desktop Alpha 0.0.45. The same code is on main @ 9e55228.

Environment

macOS 26.6.2 (arm64), standalone Tailscale 1.104.1 (not the Mac App Store build)

Logs or stack traces

Screenshots, recordings, or supporting files

2026-10-12_14-51.png

Workaround

Turn on Network access. The Tailscale HTTPS switch then appears. Turning on Network access also makes the backend listen on every network interface, so if you only want tailnet access, turn Network access back off after enabling Tailscale HTTPS.