Browser SSH times out when target uses SSH ACL action "check"

[BlueCase]

Description

Problem

Browser SSH fails to connect to a host whose SSH access rule uses action: "check".
The session hangs and ends with:

ssh: handshake failed: read tcp ...:22: i/o timeout

Native tailscale ssh to the same host works, and browser SSH works with
action: "accept" — only check is affected.

Cause

In check mode, tailscaled on the target sends the re-authentication URL
(# To authenticate, visit: https://...) as a pre-auth SSH banner
(tailssh SendAuthBanner). The WASM client in internal/hp_ipn/ssh.go builds
its ssh.ClientConfig without a BannerCallback, so the banner — and with it
the URL — is silently dropped. The user never sees the URL, the check is never
completed, and the connection runs into the read deadline.

Suggested fix

Set a BannerCallback that forwards the banner to the terminal, and extend the
read deadline once a banner arrives (completing SSO takes longer than 30s):

BannerCallback: func(msg string) error {
    s.Config.OnData(strings.ReplaceAll(msg, "\n", "\r\n"))
    conn.SetReadDeadline(time.Now().Add(60 * time.Second))
    return nil
},

Since the terminal has copy/selection disabled, the printed URL is not clickable;
ideally it is opened directly (e.g. window.open from the WASM side) or rendered
as a clickable link.

Workaround

Use action: "accept" instead of "check" for the SSH rule (loses periodic
re-authentication).

Info

I know more a upstream topic but the client ist part of your release and you already implement patches for the client.

Headplane Version

v0.7

Headscale Version

v0.29.2

[pullfrog]

Analysis

Confirmed. In internal/hp_ipn/ssh.go the ssh.ClientConfig is built without a BannerCallback, so when Tailscale's SSH server sends the pre-auth banner for action: "check" the URL is swallowed. The user cannot complete the check, the 30-second read deadline expires, and the handshake fails with an I/O timeout. The issue description and proposed root cause are accurate.

Proposed plan

1. Forward SSH banners to the terminal
   Add BannerCallback to the ssh.ClientConfig in internal/hp_ipn/ssh.go that writes the banner to s.Config.OnData (normalizing \n to \r\n).

2. Extend the read deadline while a banner is pending
   In the same callback, extend conn.SetReadDeadline to give the user time to complete the SSO step. Use the configured Timeout value instead of hardcoding 60s, so self-hosted deployments with stricter timeouts stay predictable.

3. Make the re-authentication URL usable
   The terminal currently has selection disabled, so a printed URL cannot be copied. Add an onAuthURL callback to TunnelConfig/HeadplaneSSH and invoke it from the WASM side when the banner looks like a Tailscale auth URL (https://...). On the React side, render a clickable overlay above the terminal so the user can open the link directly and continue authentication.

4. Verification

   • Build the WASM target (pnpm run build:wasm or the Nix build).
   • Test Browser SSH against a node whose ACL uses action: "accept" — existing behavior must remain unchanged.
   • Test against a node whose ACL uses action: "check" — the auth URL should appear, open in a new tab, and the session should proceed after authentication.

This is a small, focused change that fixes the regression without breaking existing accept behavior. I can implement it if you'd like to proceed.

Task list (3/3 completed)

• Read relevant code
• Analyze issue and feasibility
• Post analysis/plan comment

  ^{｜ Implement plan ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}

[linear-code]

HP-564

[tale]

Let me think on this one, but I agree, this should be addressable via a patch that I don't mind shipping for now.