Summary

Follow-up to #466 (and referencing #406): fixes remaining macOS Tailscale detection edge cases where Detect Tailscale can select a non-usable candidate and then fail parsing status --json output.

This change hardens candidate selection and validation so CLI wrapper paths are preferred, and unexpected tailscale version output is rejected before status parsing.

Key Changes

• macOS candidate resolution
  • Keep canonical app path support:
    • /Applications/Tailscale.app/Contents/MacOS/Tailscale
  • Keep compatibility fallback:
    • /Applications/Tailscale.app/Contents/MacOS/tailscale
  • Prefer CLI/wrapper locations first:
    • tailscale (PATH)
    • /opt/homebrew/bin/tailscale
    • /usr/local/bin/tailscale
    • /usr/local/bin/Tailscale
• Added looks_like_tailscale_version(...) guard
  • Candidate is accepted only when tailscale version succeeds and stdout contains a plausible version token.
  • Success exit codes with unexpected stdout (for example GUI error text) are rejected and resolution continues.
• Updated macOS missing-CLI hint to canonical app path casing.
• Added focused tests for:
  • macOS candidate presence/order
  • valid version output acceptance
  • GUI error output rejection
  • empty output rejection

Behavior Notes

• Prevents false-positive candidate selection from leading to JSON parse failures in Detect Tailscale.
• Keeps existing Tailscale status/degraded-status contracts intact.
• No frontend API or schema changes.

Before Fix (macOS)

Observed on click Detect Tailscale:

Invalid tailscale status JSON: expected value at line 1 column 1 (stdout: The Tailscale GUI failed to start: The operation couldn’t be completed. (Tailscale.CLIError error 3.))
Version: The Tailscale GUI failed to start: The operation couldn’t be completed. (Tailscale.CLIError error 3.)

Validation Run

• pnpm run lint (passes; 1 pre-existing warning in src/features/app/hooks/useRemoteThreadLiveConnection.ts)
• cd src-tauri && cargo test tailscale::
• cd src-tauri && cargo check