Fix packaged Tailscale CLI detection

[sambitcreate]

Summary

• force the documented TAILSCALE_BE_CLI=1 mode for the shared macOS Tailscale app/CLI executable so Finder and Dock production launches behave like terminal-launched development
• classify status inspection failures with privacy-safe categorical diagnostics and retain no command output
• distinguish a ready local listener from verified Tailscale Serve readiness in Remote Access settings
• preserve the existing executable resolution, port pair, Serve target, Funnel protections, and exact route ownership
• set the desktop release version to 0.35.76

This is a focused follow-up to merged PR #64.

Root cause

The macOS Tailscale app and CLI share one executable. Development inherited terminal environment variables, but a packaged Aiden launch did not, so the executable selected GUI mode and returned a zero-exit non-JSON error. Aiden then failed closed while reading status and could not safely configure Serve.

Validation

• npm run test:aiden-remote — 338 passed, 1 host-dependent skip; 7 transport proofs passed
• focused Tailscale suite — 32 passed, including ETIMEDOUT and killed: true timeout shapes
• npm run test:diagnostics — 65 TypeScript tests and 7 policy tests passed
• npm run type-check
• npm run lint
• npm run build
• npm run test:branding — 32 TypeScript and 18 Node tests passed under aiden-agent@0.35.76
• npm run release:check-consumers
• React Doctor on the origin/main diff — 91/100, no issues
• package and lockfile versions are 0.35.76

[pullfrog]

ℹ️ No critical issues — one minor test-coverage suggestion inline.

Reviewed changes

• Forced Tailscale CLI mode in packaged launches — createSystemTailscaleCommandRunner now injects TAILSCALE_BE_CLI=1 into every invocation (with environment/execute/resolveBinary seams for testing). I verified the env var is honored by the macOS app and is documented in Tailscale's KB 1080, and that setting it on non-macOS CLI builds is inert.
• Categorical status-read diagnostics — failures classify as command-failed/invalid-response/timed-out with no command output retained, and production emits tailscale-status-read-unavailable with closed enum fields through writeDiagnosticEvent.
• Local-ready vs Tailscale-verified distinction — the settings UI shows Local ready · <badge> / Local service ready when the listener runs but Tailscale Serve readiness isn't verified, instead of a blanket Ready.
• Tests for the runner environment, failure categories, diagnostic field filtering, and the new UI copy; docs and plan index updated.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

Important

The declared version 0.35.76 was already published before these commits, so merging this will skip the release entirely — the production fix will not ship under this version.

Reviewed changes

• Version bump 0.35.0 → 0.35.76 — two chore(release) commits (first 0.35.1, corrected to 0.35.76) touching package.json and both package-lock.json version entries, kept in sync.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

0.35.76 is already published: a non-draft release "Aiden Agent 0.35.76" tagged v0.35.76 targets 8c0e411 (a main commit ~19h before these commits) and does not contain this PR's fix. On merge, release.yml's version resolution sees the tag exists and skips publishing entirely (publish=false, "skipping release without changing its version"), so the Tailscale fix never reaches auto-update users until another version bump. Declare an untagged version (e.g. 0.35.77) so the main-push release publishes a build containing the fix.

Technical details

# Declared release version already published

## Affected sites
- package.json:3 — `"version": "0.35.76"` (same on package-lock.json:3 and :9)
- .github/workflows/release.yml:44-58 — `base_tag_exists` probe against `refs/tags/v${base_version}`; `publish = !baseTagExists` in scripts/prepare-ci-release.mjs

## Required outcome
- Merged `package.json` version must correspond to a tag that does not exist yet, so the main-push release builds and publishes a distribution containing 7cf174b0's fix.

## Open questions for the human
- Was the `0.35.76` release intentionally cut early from `8c0e411` (without the fix)? If so, the shipped artifacts should be verified against what updaters currently serve.

[pullfrog]

ℹ️ No new issues in this delta — the timeout-shape test addresses the prior suggestion. The version finding from the prior review still stands.

Reviewed changes

• Timeout-category test coverage — a new combined route inspection categorizes both Node CLI timeout shapes test drives both code: "ETIMEDOUT" and killed: true errors through statusReadFailureCategory, pinning the timed-out classification (and that error text is never retained). This closes the coverage gap flagged in the initial review; the assertions would fail if categorization regressed to command-failed.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}