[Bug]: Open in editor reports no SSH route when using Tailscale SSH without a localhost listener

[jahands]

(this issue is brought to you by gpt-6-astra-medium)

Area

apps/server (remote editor discovery), apps/web (editor menu)

Steps to reproduce

1. Run a T3 server on a Linux host with Tailscale SSH enabled and no conventional SSH listener on localhost port 22.
2. Connect to that environment from another machine through a URL connection, without a desktop SSH connection profile supplying an explicit SSH alias.
3. Confirm that ssh <tailnet-host> works from the viewing machine.
4. Open the project's “Open in editor” menu.

Expected behavior

Offer remote editor links using the working Tailscale SSH destination. A localhost SSH listener should not be required when Tailscale handles SSH connections.

Actual behavior

The menu displays “No SSH route to ” and disables opening the project in an editor, despite successful SSH access from the viewing machine.

Verified diagnostics

Read-only checks from a macOS viewing machine against the affected Linux environment confirmed:

• A noninteractive SSH login succeeds.
• tailscale status --json reports BackendState: Running and a valid MagicDNS name.
• tailscale debug prefs reports RunSSH: true.
• TCP connections to both 127.0.0.1:22 and [::1]:22 on the remote host fail with connection refused.
• ss -ltn 'sport = :22' reports no listener.

Cause

RemoteOpenTargets.ts probes localhost port 22 and immediately returns an empty target list if neither loopback family accepts a connection. This happens before Tailscale discovery. The assumption that no local sshd means no SSH destination can work is invalid for Tailscale SSH.

remoteOpen.ts then maps an empty advertised target list, without an explicit SSH profile alias, to remote-unavailable.

Discovery should recognize enabled Tailscale SSH independently of a localhost SSH listener. Tailscale connectivity alone should not be assumed to imply SSH availability.

Impact

Remote opening in an editor is blocked for this valid Tailscale SSH configuration.

Version or commit

Investigated source: d29c56a. The affected installed server version was not captured.

Related issues

Related discovery/gating symptoms: #7530 and #8278. This report specifically concerns Tailscale SSH with no localhost SSH listener.

[juliusmarminge]

Triage

Confirmed on current main (d29c56a). This is a real bug in remote editor discovery, not a misconfiguration. Keeping this issue open.

What happens

RemoteOpenTargets.resolveTargets() probes loopback :22 and returns an empty list immediately if neither family accepts:

t3code/apps/server/src/environment/RemoteOpenTargets.ts

Lines 35 to 45 in d29c56a

	// No local sshd means no name can work; advertise nothing so clients
	// render a clear "no SSH route" state instead of links that hang.
	// Check both loopback families: sshd can be bound IPv6-only.
	const sshdListening = yield* Effect.zipWith(
	net.hasListenerOnHost(SSH_PORT, "127.0.0.1"),
	net.hasListenerOnHost(SSH_PORT, "::1"),
	(ipv4, ipv6) => ipv4 || ipv6,
	);
	if (!sshdListening) {
	return [];
	}

Tailscale MagicDNS discovery runs only after that gate. A URL connection has no desktop SSH alias, so resolveRemoteOpenState maps the empty list to remote-unavailable, and the picker shows “No SSH route to <environment>”:

t3code/apps/web/src/remoteOpen.ts

Lines 89 to 96 in d29c56a

	if (input.sshAlias !== null && input.sshAlias.length > 0) {
	return { mode: "remote-links", host: { kind: "ssh-alias", host: input.sshAlias } };
	}
	const advertised = input.remoteOpenTargets?.[0];
	if (advertised !== undefined) {
	return { mode: "remote-links", host: advertised };
	}
	return REMOTE_UNAVAILABLE;

That matches the report: ssh <tailnet-host> works, RunSSH: true, and nothing listens on 127.0.0.1:22 / [::1]:22.

The assumption (“no local sshd ⇒ no SSH destination can work”) was introduced with remote open in #6572 and is still encoded by the test that expects [] when Tailscale is up but loopback :22 is closed. Tailscale SSH does not need a conventional localhost listener.

Not a duplicate

Related menu/gating symptoms only:

• [Bug]: Open in editor dead-ends at "No SSH route" for a same-machine browser reaching the server by LAN IP #7530 — same-machine browser on a LAN IP is classified as remote; no sshd and no Tailscale.
• Open in editor hangs forever when the server runs inside a Docker container reached over SSH #8278 — server inside Docker behind SSH; ssh-remote+host cannot cross docker exec.

This issue is specifically Tailscale SSH with no localhost :22.

Fix direction

Do not advertise a tailnet name just because Tailscale is running (--tailscale-serve ≠ Tailscale SSH). Split the gate:

1. Localhost :22 still authorizes mDNS (and conventional SSH via MagicDNS).
2. Enabled Tailscale SSH (RunSSH / prefs) independently authorizes a kind: "tailscale" target, even with no loopback listener.
3. @t3tools/tailscale currently parses MagicDNS / IPs only — it needs an explicit SSH-enablement check.

#8305 (open) adds usernames to advertised targets and does not lift this gate. No existing PR fixes this.

Workaround

Use a desktop SSH connection profile with an explicit alias, or run a conventional sshd on localhost :22.