From 6e2677b4ad8c79dd3112e5136aae7a352e2f4414 Mon Sep 17 00:00:00 2001
From: Andrew Lytvynov <awly@tailscale.com>
Date: Wed, 25 Feb 2026 16:00:32 -0800
Subject: [PATCH] client/systray: open BrowseToURL from WatchIPN in a browser
 (#18816)

This works for Tailscale SSH, but not for account logins (due to another
process potentially starting that login, or `--operator` limitations).

RELNOTE=The systray app now opens login links for SSH check mode in a
browser.

Updates #8551

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
---
 client/systray/systray.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/client/systray/systray.go b/client/systray/systray.go
index 7018f0f3b..65c1bec20 100644
--- a/client/systray/systray.go
+++ b/client/systray/systray.go
@@ -531,6 +531,15 @@ func (menu *Menu) watchIPNBusInner() error {
 			if err != nil {
 				return fmt.Errorf("ipnbus error: %w", err)
 			}
+			if url := n.BrowseToURL; url != nil {
+				// Avoid opening the browser when running as root, just in case.
+				runningAsRoot := os.Getuid() == 0
+				if !runningAsRoot {
+					if err := webbrowser.Open(*url); err != nil {
+						log.Printf("failed to open BrowseToURL: %v", err)
+					}
+				}
+			}
 			var rebuild bool
 			if n.State != nil {
 				log.Printf("new state: %v", n.State)