Update

vendor/tailscale.com/paths/paths.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package paths returns platform and user-specific default paths to
@@ -8,8 +8,10 @@ package paths
 import (
 	"log"
 	"os"
+	"os/user"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"tailscale.com/syncs"
 	"tailscale.com/version/distro"
@@ -19,11 +21,40 @@ import (
 // containing a directory we can read/write in.
 var AppSharedDir syncs.AtomicValue[string]
 
+// WindowsProtectedPipePrefix is the prefix of the Windows named pipe names
+// that only administrators may create. tailscaled's default socket is under
+// it, which is what lets clients trust that whatever answers there is the
+// Tailscale service (or an administrator's tailscaled) and not another user's.
+const WindowsProtectedPipePrefix = `\\.\pipe\ProtectedPrefix\Administrators\`
+
+// IsWindowsProtectedPipe reports whether path is a named pipe name under
+// [WindowsProtectedPipePrefix]. Pipe names are case-insensitive.
+func IsWindowsProtectedPipe(path string) bool {
+	return len(path) > len(WindowsProtectedPipePrefix) &&
+		strings.EqualFold(path[:len(WindowsProtectedPipePrefix)], WindowsProtectedPipePrefix)
+}
+
+// WindowsDevTailscaledSocket returns the named pipe that a tailscaled started
+// by the current user with --windows-mode=dev listens on by default:
+// \\.\pipe\tailscale-<SID>, with the user's SID rather than their name, which
+// need not be unique once local and domain accounts are in play. It returns
+// "" on other platforms or if the current user is unknown.
+func WindowsDevTailscaledSocket() string {
+	if runtime.GOOS != "windows" {
+		return ""
+	}
+	u, err := user.Current()
+	if err != nil {
+		return ""
+	}
+	return `\\.\pipe\tailscale-` + u.Uid
+}
+
 // DefaultTailscaledSocket returns the path to the tailscaled Unix socket
 // or the empty string if there's no reasonable default.
 func DefaultTailscaledSocket() string {
 	if runtime.GOOS == "windows" {
-		return `\\.\pipe\ProtectedPrefix\Administrators\Tailscale\tailscaled`
+		return WindowsProtectedPipePrefix + `Tailscale\tailscaled`
 	}
 	if runtime.GOOS == "darwin" {
 		return "/var/run/tailscaled.socket"
@@ -31,6 +62,14 @@ func DefaultTailscaledSocket() string {
 	if runtime.GOOS == "plan9" {
 		return "/srv/tailscaled.sock"
 	}
+	if runtime.GOOS == "android" {
+		// Android (e.g. a userspace tailscaled under Termux) has no /var,
+		// and the cwd-relative fallback below only works when the daemon
+		// and the CLI happen to be started from the same directory
+		// (see #21161). Use the shared per-app temp directory so both
+		// agree on an absolute path.
+		return filepath.Join(os.TempDir(), "tailscaled.sock")
+	}
 	switch distro.Get() {
 	case distro.Synology:
 		if distro.DSMVersion() == 6 {