fix: refresh routes when Tailscale account changes on same utun#16
Merged
GeiserX merged 1 commit intoGeiserX:mainfrom Mar 5, 2026
Merged
Conversation
GeiserX
approved these changes
Mar 5, 2026
Owner
GeiserX
left a comment
There was a problem hiding this comment.
Thorough review completed across 8 dimensions (security, concurrency, logic, performance, edge cases, Tailscale CLI compatibility, style, behavioral regression).
No blocking issues found. Key observations:
- Security: Net improvement —
--peers=falsereduces unnecessary data exposure. No injection vectors, fingerprint stays in memory only. - Concurrency:
@MainActorserialization +isLoading/isApplyingRoutesguards are sufficient. - Tailscale CLI: Verified against Tailscale source —
--self --peers=falsepreservesExitNodeStatus,Self, andTailscaleIPsfields. - Edge cases: All tested (Tailscale not installed, no exit node, rapid switching, VPN disconnect mid-refresh, non-Tailscale VPNs) — all handled correctly.
- Performance: 3 CLI spawns per cycle vs 2 (no per-cycle cache), but negligible at 30s intervals with the lighter
--peers=falsepayload.
Minor non-blocking observations for future consideration:
String(describing:)onNSNumberforUserID— works today but could use explicitNSNumber.stringValuefor stability- Per-cycle caching of
readTailscaleStatusJSON()result would eliminate redundant subprocess spawns
LGTM ✅
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This patch fixes a practical Tailscale edge case: switching between Tailscale accounts/profiles while staying on the same
utuninterface.In the current behavior, routes may stay tied to the previous profile because the app only reacts to connect/disconnect or interface changes. That means users can switch account, keep
utun6, and still have stale bypass routes.What this patch changes:
removeAllRoutes+applyAllRoutes).tailscale status --json --self --peers=false) to avoid large JSON/timeouts on big tailnets.readTailscaleStatusJSON) so detection paths stay consistent.Scope and impact:
Sources/RouteManager.swiftonly.Why this is needed:
Without this, users can end up in a confusing state where Tailscale is connected, but the app reports no usable VPN route transition after account switch or keeps stale bypass behavior until a manual refresh.