fix(ssh): Tailscale SSH check links open in the browser instead of a stuck reconnect#22146

@@ -959,6 +962,7 @@ export const issueRemotePairingToken = Effect.fn("ssh/tunnel.issueRemotePairingT
     ...(input?.authSecret === undefined ? {} : { authSecret: input.authSecret }),
     ...(input?.batchMode === undefined ? {} : { batchMode: input.batchMode }),
     ...(input?.interactiveAuth === undefined ? {} : { interactiveAuth: input.interactiveAuth }),
+    ...(input?.onTailscaleCheck === undefined ? {} : { onTailscaleCheck: input.onTailscaleCheck }),

@@ -1708,6 +1727,17 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
       ...sshTargetLogFields(resolvedTarget),
       key,
     });
+    // The held session outlasts a client's setup timeout, so a retry gets the
+    // approval link now instead of queuing behind that session.
+    const tailscaleCheck = tailscaleChecks.get(key);
+    if (tailscaleCheck !== undefined) {
+      return yield* new SshCommandError({
+        command: ["ssh"],
+        exitCode: null,
+        stderr: "",
+        message: `Tailscale SSH needs you to approve the connection to ${resolvedTarget.alias}: ${tailscaleCheck}`,