cmd/tailscale: improve file cp error message in macOS GUI version

Fixes tailscale/corp#1684

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/tailscale/cli/file.go

@@ -29,6 +29,7 @@ import (
 	"tailscale.com/client/tailscale"
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/ipn"
+	"tailscale.com/version"
 )
 
 var fileCmd = &ffcli.Command{
@@ -131,6 +132,9 @@ func runCp(ctx context.Context, args []string) error {
 		} else {
 			f, err := os.Open(fileArg)
 			if err != nil {
+				if version.IsSandboxedMacOS() {
+					return errors.New("the GUI version of Tailscale on macOS runs in a macOS sandbox that can't read files")
+				}
 				return err
 			}
 			defer f.Close()