@@ -654,6 +654,34 @@ it.layer(NodeServices.layer)("dev-runner", (it) => {
       }),
     );
 
+    // Sharing dev:desktop would publish a URL whose renderer dials the
+    // visitor's own loopback, and would clobber the VITE_DEV_SERVER_URL that
+    // Electron loads from. It must decline, not half-work.
+    it.effect("declines to share for dev:desktop and still starts the stack", () => {
+      let spawnCount = 0;
+      const spawnerLayer = Layer.succeed(
+        ChildProcessSpawner.ChildProcessSpawner,
+        ChildProcessSpawner.make(() => {
+          spawnCount += 1;
+          return Effect.succeed(mockProcess(0));
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* runDevRunnerWithInput({
+          ...devServerInput,
+          mode: "dev:desktop",
+          port: undefined,
+          share: true,
+        }).pipe(
+          Effect.provide(Layer.mergeAll(emptyConfigLayer, netServiceLayer, spawnerLayer)),
+          Effect.provideService(HostProcessPlatform, "linux"),
+        );
+
+        assert.equal(spawnCount, 1);
+      });
+    });
+
     it.effect("spawns nothing when --dry-run is combined with --share", () => {
       let spawnCount = 0;
       const spawnerLayer = Layer.succeed(
 
@@ -591,6 +591,16 @@ export function runDevRunnerWithInput(input: DevRunnerCliInput) {
     if (input.share) {
       if (input.mode === "dev:server") {
         yield* Effect.logInfo("[dev-runner] --share has no effect for dev:server (no web server).");
+      } else if (input.mode === "dev:desktop") {
+        // Desktop is not single-origin: the renderer gets VITE_HTTP_URL and
+        // VITE_WS_URL baked to loopback, so a tailnet visitor would load the UI
+        // and then watch it dial its own 127.0.0.1 for the backend. Worse,
+        // sharing would overwrite VITE_DEV_SERVER_URL, which is the origin
+        // Electron itself loads the renderer from. Refuse rather than hand out
+        // a URL that is broken in a way the user cannot see.
+        yield* Effect.logWarning(
+          "[dev-runner] --share is not supported for dev:desktop (the renderer is pinned to loopback). Use `dev` or `dev:web`.",
+        );
       } else {
         // acquireRelease, not share-then-addFinalizer: the mapping outlives this
         // process (and reboots), so the cleanup has to be registered atomically