Repository navigation
Surface the Tailscale SSH check login link on a remote host (DEV-2106) - #9
Merged
ZmeiGorynych merged 7 commits intoOct 18, 2026
Conversation
OpenSpec change for a needs-login host status carrying the Tailscale check URL, live stderr scanning on remote links, sibling-session redial, and the page banner with the login link. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… link Unit, process and e2e tests for the needs-login host status: the login line parser and line scanner, live stderr scanning on a remote link, host transitions, stale login callbacks, the login field's wire rules (browser protocol 9), the web banner and tab status, and sibling-session redial. The fake SSH gains a per-invocation Tailscale login gate. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A remote link scans SSH's standard error live until the daemon's first frame and reports a login.tailscale.com check URL; the host becomes needs-login with the URL in the new host-entry field `login` (browser protocol 9). When one session's link to a host greets, other sessions' needs-login links to it redial at once. The page shows a banner with an "Open login link" button and "needs login" on the host's repo tabs. Also keeps the protocol 8 hosts sample in the wire corpus, updates the version strings tests expect, and makes the WebGL LRU property test's per-step check one assertion so it no longer times out under load. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the
Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the primary change: exposing the Tailscale SSH check login link for remote hosts. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 31 files. (10 skipped: 10 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… runs rmSync empties a directory once and then retries only removing it, so a call recorded by an SSH run that started before the hub was killed made cleanup fail with ENOTEMPTY after 5.5 s. Cleanup now also kills runs that have not recorded their call yet and retries the whole removal. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
ZmeiGorynych
added a commit
that referenced
this pull request
Oct 18, 2026
…ce-the-tailscale-ssh-check-login-link-on Surface the Tailscale SSH check login link on a remote host (DEV-2106)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes DEV-2106.
Why
When a remote host is reached over Tailscale SSH and the tailnet rule uses
"action": "check", an expired check makes sshd print a login link on standard error and hold the connection until someone approves it in a browser.BatchMode=yesdoesn't stop this. The hub only read SSH's standard error after the process ended, so the host sat inconnectingforever with no reason and no way to find the link. The only workaround was runningssh <alias> truein a terminal.What changes
To authenticate, visit: https://login.tailscale.com/…line makes the hostneeds-login, with the URL in a new host-entry fieldlogin. The link stays open and no failure is counted. Once the check is approved, the same SSH process continues and the host connects with no retry.needs-loginlink to that host is redialed at once. The redial reuses the now-authenticated control master. Sessions in any other status are left alone.needs-loginhost gets a banner, "box: needs Tailscale login", with an Open login link button (target="_blank",rel="noopener noreferrer"). Its repo tabs showneeds login.reconnecting/downpath with SSH's reason. The failure count carries over from before the check.Before: the host stays
connectingwith no reason. After:Safety of the link
The URL ends up in an
href, so it is checked at both ends. The parser and the wire decoder accept only strings starting withhttps://login.tailscale.com/, at most 1024 characters, and present exactly when the status isneeds-login. Lookalikes such ashttps://login.tailscale.com.evil/…,http:andjavascript:are rejected.Compatibility
BROWSER_PROTOCOL_VERSIONgoes from 8 to 9. The daemon protocol is unchanged, so no daemon restart is needed. An open page reloads once under the existing stale-bundle rule.Tests
logincallbacks from replaced linksloginhost-unavailablefor requests to aneeds-loginhostAlso: the WebGL LRU property test made one assertion per addon at every step. It now makes a single check (921 ms → 41 ms), so it no longer times out under full-suite load.
The spec change is in
openspec/changes/dev-2106-worktree-term-surface-the-tailscale-ssh-check-login-link-on/.🤖 Generated with Claude Code
Summary by CodeRabbit