feat(tailscale): your own devices find and connect to your boxes with no pairing code

apps/desktop/src/app/DesktopConnectionCatalogStore.ts

@@ -372,6 +372,7 @@ const migrateSavedEnvironmentRecords = Effect.fn(
     credentials,
     remoteDpopTokens: [],
     disabledEnvironmentIds: [],
+    dismissedEnvironmentIds: [],
   };
 });
 

apps/desktop/src/backend/DesktopBackendConfiguration.test.ts

@@ -35,10 +35,13 @@ const layerServerExposure = Layer.succeed(DesktopServerExposure.DesktopServerExp
     httpBaseUrl: new URL("http://127.0.0.1:4888"),
     tailscaleServeEnabled: true,
     tailscaleServePort: 8443,
+    tailscaleSignInEnabled: false,
+    tailscaleOnly: false,
   }),
   configureFromSettings: () => Effect.die("unexpected configureFromSettings"),
   setMode: () => Effect.die("unexpected setMode"),
   setTailscaleServeEnabled: () => Effect.die("unexpected setTailscaleServeEnabled"),
+  setTailscaleSignInEnabled: () => Effect.die("unexpected setTailscaleSignInEnabled"),
   getAdvertisedEndpoints: Effect.succeed([]),
 } satisfies DesktopServerExposure.DesktopServerExposure["Service"]);
 
@@ -240,6 +243,9 @@ describe("DesktopBackendConfiguration", () => {
         assert.isUndefined(first.env.T3CODE_PORT);
         assert.isUndefined(first.env.T3CODE_MODE);
         assert.isUndefined(first.env.T3CODE_DESKTOP_LAN_HOST);
+        // Removed from what the backend inherits, so the desktop's own switch decides.
+        assert.property(first.env, "T3CODE_TAILSCALE_SIGN_IN");
+        assert.isUndefined(first.env.T3CODE_TAILSCALE_SIGN_IN);
 
         assert.equal(first.bootstrap.mode, "desktop");
         assert.equal(first.bootstrap.noBrowser, true);

apps/desktop/src/backend/DesktopBackendConfiguration.ts

@@ -78,6 +78,8 @@ const DESKTOP_BACKEND_ENV_NAMES = [
   "T3CODE_DESKTOP_HTTPS_ENDPOINTS",
   "T3CODE_TAILSCALE_SERVE",
   "T3CODE_TAILSCALE_SERVE_PORT",
+  "T3CODE_TAILSCALE_SIGN_IN",
+  "T3CODE_TAILSCALE_OWNER",
 ] as const;
 
 // Windows forwards these variables into WSL only through WSLENV.
@@ -507,6 +509,8 @@ const resolvePrimaryStartConfig = Effect.fn("desktop.backendConfiguration.resolv
       shellEnvironmentPrepared: input.shellEnvironmentPrepared,
       tailscaleServeEnabled: backendExposure.tailscaleServeEnabled,
       tailscaleServePort: backendExposure.tailscaleServePort,
+      ...(backendExposure.tailscaleSignInEnabled ? { tailscaleSignInEnabled: true } : {}),
+      ...(backendExposure.tailscaleOnly ? { tailscaleOnly: true } : {}),
       desktopTelemetryFd: 4,
       desktopTelemetryControlFd: 5,
       desktopBrowserFd: 6,

apps/desktop/src/backend/DesktopServerExposure.test.ts

@@ -9,12 +9,14 @@ import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
+import { HttpClient, HttpClientResponse } from "effect/http";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import * as DesktopEnvironment from "../app/DesktopEnvironment.ts";
 import * as DesktopConfig from "../app/DesktopConfig.ts";
 import * as DesktopNetworkInterfaces from "./DesktopNetworkInterfaces.ts";
 import * as DesktopServerExposure from "./DesktopServerExposure.ts";
+import * as DesktopTailscaleStatus from "./DesktopTailscaleStatus.ts";
 import * as DesktopAppSettings from "../settings/DesktopAppSettings.ts";
 
 const encoder = new TextEncoder();
@@ -90,6 +92,7 @@ function layer(input: {
   readonly env?: Record<string, string | undefined>;
   readonly spawnerLayer?: Layer.Layer<ChildProcessSpawner.ChildProcessSpawner>;
   readonly desktopSettingsLayer?: Layer.Layer<DesktopAppSettings.DesktopAppSettings>;
+  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
 }) {
   const env = { T3CODE_HOME: input.baseDir, ...input.env };
   const layerEnvironment = layerEnvironmentFor(input.baseDir, env);
@@ -98,9 +101,10 @@ function layer(input: {
   });
 
   return DesktopServerExposure.layer.pipe(
+    Layer.provideMerge(DesktopTailscaleStatus.layer),
     Layer.provideMerge(input.desktopSettingsLayer ?? DesktopAppSettings.layer),
     Layer.provideMerge(NodeFileSystem.layer),
-    Layer.provideMerge(NodeHttpClient.layerUndici),
+    Layer.provideMerge(input.httpClientLayer ?? NodeHttpClient.layerUndici),
     Layer.provideMerge(input.spawnerLayer ?? layerMockSpawner()),
     Layer.provideMerge(layerNetwork),
     Layer.provideMerge(DesktopConfig.layerTest(env)),
@@ -122,6 +126,7 @@ const withHarness = <A, E, R>(
   env: Record<string, string | undefined> = {},
   spawnerLayer?: Layer.Layer<ChildProcessSpawner.ChildProcessSpawner>,
   desktopSettingsLayer?: Layer.Layer<DesktopAppSettings.DesktopAppSettings>,
+  httpClientLayer?: Layer.Layer<HttpClient.HttpClient>,
 ) =>
   Effect.gen(function* () {
     const fileSystem = yield* FileSystem.FileSystem;
@@ -136,6 +141,7 @@ const withHarness = <A, E, R>(
           env,
           ...(spawnerLayer ? { spawnerLayer } : {}),
           ...(desktopSettingsLayer ? { desktopSettingsLayer } : {}),
+          ...(httpClientLayer ? { httpClientLayer } : {}),
         }),
       ),
     );
@@ -209,6 +215,8 @@ describe("DesktopServerExposure", () => {
           advertisedHost: "192.168.1.20",
           tailscaleServeEnabled: false,
           tailscaleServePort: 443,
+          tailscaleSignInEnabled: false,
+          port: 4173,
         });
 
         const backendConfig = yield* serverExposure.backendConfig;
@@ -297,6 +305,47 @@ describe("DesktopServerExposure", () => {
     ),
   );
 
+  it.effect(
+    "listens on the tailnet only while Tailscale sign-in is on and Network access is off",
+    () =>
+      withHarness(
+        { ...tailnetNetworkInterfaces, ...lanNetworkInterfaces },
+        Effect.gen(function* () {
+          const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+          yield* (yield* DesktopAppSettings.DesktopAppSettings).load;
+          yield* serverExposure.configureFromSettings({ port: 3773 });
+
+          const signIn = yield* serverExposure.setTailscaleSignInEnabled(true);
+          assert.equal(signIn.requiresRelaunch, true);
+          assert.equal(signIn.state.tailscaleSignInEnabled, true);
+          assert.equal(signIn.state.port, 3773);
+          assert.deepInclude(yield* serverExposure.backendConfig, {
+            bindHost: "0.0.0.0",
+            tailscaleSignInEnabled: true,
+            tailscaleOnly: true,
+          });
+          assert.deepEqual(
+            (yield* serverExposure.getAdvertisedEndpoints).map((endpoint) => endpoint.httpBaseUrl),
+            ["http://127.0.0.1:3773/", "http://100.90.1.2:3773/"],
+          );
+
+          yield* serverExposure.setMode("network-accessible");
+          assert.deepInclude(yield* serverExposure.backendConfig, {
+            bindHost: "0.0.0.0",
+            tailscaleOnly: false,
+          });
+
+          yield* serverExposure.setMode("local-only");
+          yield* serverExposure.setTailscaleSignInEnabled(false);
+          assert.deepInclude(yield* serverExposure.backendConfig, {
+            bindHost: "127.0.0.1",
+            tailscaleSignInEnabled: false,
+            tailscaleOnly: false,
+          });
+        }),
+      ),
+  );
+
   it.effect("keeps a Tailscale Serve change made while a mode change is saving", () =>
     Effect.gen(function* () {
       const modeWriteStarted = yield* Deferred.make<void>();
@@ -448,6 +497,53 @@ describe("DesktopServerExposure", () => {
     },
   );
 
+  it.effect("reads this backend's environment ID once it answers, then keeps it", () => {
+    let localReads = 0;
+    const httpClientLayer = Layer.succeed(
+      HttpClient.HttpClient,
+      HttpClient.make((request) =>
+        Effect.sync(() => {
+          const local = request.url.startsWith("http://127.0.0.1:4173/");
+          if (local) localReads += 1;
+          // The backend is still starting on the first read.
+          const body =
+            local && localReads === 1
+              ? new Response("starting", { status: 503 })
+              : Response.json({ environmentId: "this-desktop" });
+          return HttpClientResponse.fromWeb(request, body);
+        }),
+      ),
+    );
+    const serveStatus = () =>
+      withHarness(
+        tailnetNetworkInterfaces,
+        Effect.gen(function* () {
+          const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+          yield* serverExposure.configureFromSettings({ port: 4173 });
+          yield* serverExposure.setTailscaleServeEnabled({ enabled: true });
+          const statuses: Array<string> = [];
+          for (let call = 0; call < 3; call += 1) {
+            const endpoints = yield* serverExposure.getAdvertisedEndpoints;
+            statuses.push(
+              endpoints.find((endpoint) => endpoint.httpBaseUrl.startsWith("https://"))?.status ??
+                "missing",
+            );
+          }
+          return statuses;
+        }),
+        {},
+        layerMockSpawner(
+          `{"Self":{"DNSName":"desktop.tail.ts.net.","TailscaleIPs":["100.90.1.2"]}}`,
+        ),
+        undefined,
+        httpClientLayer,
+      );
+    return Effect.gen(function* () {
+      assert.deepEqual(yield* serveStatus(), ["unavailable", "available", "available"]);
+      assert.equal(localReads, 2);
+    });
+  });
+
   it.effect("preserves explicit Tailscale exposure overrides", () =>
     withHarness(
       lanNetworkInterfaces,