fix(server): open in editor works over Tailscale SSH without a local sshd

[t3dotgg]

On a host that serves SSH only through Tailscale SSH, "Open in editor" said "No SSH route", even though ssh <tailnet-name> works. The server advertised no SSH targets unless sshd listened on loopback :22, and it checked that before it looked at Tailscale.

This follows the split gate from the triage on #11052:

• A loopback sshd still advertises the tailnet name and the mDNS name, as before.
• With no loopback sshd, the server advertises only the tailnet name, and only when Tailscale SSH is on. It reads RunSSH from tailscale debug prefs, because tailscale status --json does not report SSH for the local node. tailscale down keeps RunSSH stored, so WantRunning: false counts as off.
• A running tailscaled alone (for example --tailscale-serve) still advertises nothing.

@t3tools/tailscale gets readTailscaleSshEnabled. It uses the same command runner as readTailscaleStatus, which is now shared, so readTailscaleStatus behaves the same. No client or contract change: kind: "tailscale" targets already exist.

Proof

• New test advertises only the tailnet name when Tailscale SSH serves without sshd failed on main (got []) and passes with the fix. Tests also cover Tailscale SSH off and a stored RunSSH after tailscale down.
• RemoteOpenTargets.test.ts 7/7 and packages/tailscale 15/15 pass. Typecheck passes for packages/tailscale, apps/server, and apps/desktop. Lint is clean on the changed files.
• Tested with fixtures only. It was not run against a real Tailscale SSH host.

Fixes #11052

Reviewed with sol-loop: 1 round with GPT-6.1-Sol.

Model and harness: Claude Opus 5.5 in Claude Code via T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 62d6c16

Macroscope's review found this PR approvable — This is a localized bug fix that detects enabled Tailscale SSH and exposes an existing tailnet editor target only for hosts without local sshd. Existing sshd behavior is preserved, failure cases fall back safely, and the new paths are covered by tests.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: c3ce0ac8-c44c-43bf-8acc-b05f0c9f4933

📥 Commits

Reviewing files that changed from the base of the PR and between 2cde3f7 and 62d6c16.

📒 Files selected for processing: 4

• apps/server/src/environment/RemoteOpenTargets.test.ts
• apps/server/src/environment/RemoteOpenTargets.ts
• packages/tailscale/src/tailscale.test.ts
• packages/tailscale/src/tailscale.ts

Limit details: You’ve used all 10 included reviews currently available.

📝 Walkthrough

Remote target discovery now checks Tailscale SSH preferences. When no local SSH listener exists, it advertises the MagicDNS target only when the name is available and Tailscale SSH is enabled.

Changes: Tailscale SSH Target Discovery

Layer / File(s)	Summary
Read Tailscale SSH preferences packages/tailscale/src/tailscale.ts, packages/tailscale/src/tailscale.test.ts	A shared read-only command runner handles Tailscale commands. New helpers read and parse SSH preferences, with tests for enabled, disabled, missing, and malformed preferences.
Advertise Tailscale SSH targets apps/server/src/environment/RemoteOpenTargets.ts, apps/server/src/environment/RemoteOpenTargets.test.ts	Target discovery can advertise a MagicDNS name when no loopback SSH listener exists and Tailscale SSH is enabled. Tests cover the status and preferences command results and target outcomes.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 62d6c

The change is mergeable after normal checks. Discovery is designed to avoid advertising a target when the tested Tailscale SSH-off state is present.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary fix: enabling editor access over Tailscale SSH when no local sshd is present.
Description check		The description clearly explains the problem, implementation, scope, test coverage, observed results, limitations, issue reference, and agent attribution. It uses "Proof" instead of "Verification" and…
Linked Issues check		Issue #11052 requires remote target discovery for Tailscale SSH without a loopback SSH listener. RemoteOpenTargets.ts now reads the MagicDNS name and readTailscaleSshEnabled, then advertises a `ki…
Out of Scope Changes check		The changes remain within issue #11052. The shared Tailscale command runner, readTailscaleSshEnabled, parser tests, and remote-target tests directly support the required discovery behavior. No unrel…

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 4
• Charged: $1.00
• View usage details

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	4.9 KiB	−23 B (−0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−23 B (−1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.8 KiB	−41 B (−0.2%)	29.3 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−24 B (−0.5%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−24 B (−2.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	−41 B (−0.2%)	29.3 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: 2cde3f7 · PR result: 62d6c16 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.