fix(tsconnect): keep racing the runtime while the IPN is built

Two lifecycle gaps in startIPN, both found in review.

The runtime was only raced until the readiness callback fired. Building
the backend happens after that, in a Go goroutine, and if the runtime
dies partway through, that goroutine dies with it and the promise it
would have settled never settles. startIPN hung forever instead of
rejecting. Race the factory too.

createIPN also handed callers the bridge's own shutdown, whose promise
races the runtime tearing itself down and may never settle, and which
the public type did not declare at all. Replace it in place with one that
resolves when the runtime has actually exited, and declare it. Replacing
rather than wrapping keeps the object the bridge built, instead of a copy
that only looks like it.

That also gives the exit handler the distinction it was missing: only an
exit the caller did not ask for is a panic now, so a deliberate shutdown
is no longer reported as one.

Co-Authored-By: claude-opus-5 <noreply@anthropic.com>

cmd/tsconnect/src/app/index.ts

@@ -5,6 +5,7 @@ import "../wasm_exec"
 import wasmUrl from "./main.wasm"
 import { sessionStateStorage } from "../lib/js-state-store"
 import { renderApp } from "./app"
+import { startIPN } from "../lib/start-ipn"
 
 async function main() {
   const app = await renderApp()
@@ -13,23 +14,25 @@ async function main() {
     fetch(`./dist/${wasmUrl}`),
     go.importObject
   )
-  // The Go process should never exit, if it does then it's an unhandled panic.
-  go.run(wasmInstance.instance).then(() =>
-    app.handleGoPanic("Unexpected shutdown")
-  )
 
   const params = new URLSearchParams(window.location.search)
   const authKey = params.get("authkey") ?? undefined
 
-  const ipn = newIPN({
+  // The Go process should never exit, if it does then it's an unhandled panic.
-    // Persist IPN state in sessionStorage in development, so that we don't need
+  const ipn = await startIPN(
-    // to re-authorize every time we reload the page.
+    go,
-    stateStorage: DEBUG ? sessionStateStorage : undefined,
+    wasmInstance.instance,
-    // authKey allows for an auth key to be
+    {
-    // specified as a url param which automatically
+      // Persist IPN state in sessionStorage in development, so that we don't
-    // authorizes the client for use.
+      // need to re-authorize every time we reload the page.
-    authKey: DEBUG ? authKey : undefined,
+      stateStorage: DEBUG ? sessionStateStorage : undefined,
-  })
+      // authKey allows for an auth key to be
+      // specified as a url param which automatically
+      // authorizes the client for use.
+      authKey: DEBUG ? authKey : undefined,
+    },
+    (reason) => app.handleGoPanic(reason)
+  )
   app.runWithIPN(ipn)
 }
 

cmd/tsconnect/src/lib/start-ipn.ts

@@ -0,0 +1,87 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+/**
+ * Starts a Go runtime and returns the single IPN it owns.
+ *
+ * The runtime does not publish its bridge on a global. It reads the name of a
+ * callback from its environment and invokes it once the bridge is ready, so
+ * this resolves on an explicit signal rather than on the Go scheduler having
+ * run far enough. The name is generated per runtime, so several runtimes can
+ * start in one page without racing each other.
+ *
+ * The returned IPN replaces the bridge's shutdown() with one that resolves when
+ * the runtime has actually exited. The raw promise cannot be awaited: it races
+ * with the runtime tearing itself down, so it may never settle.
+ */
+export async function startIPN(
+  go: Go,
+  instance: WebAssembly.Instance,
+  config: IPNConfig,
+  onExit: (reason: string) => void
+): Promise<IPN> {
+  const name = `__tsconnectInit_${Math.random().toString(36).slice(2)}`
+  const globals = globalThis as Record<string, unknown>
+
+  const ready = new Promise<[NewIPN, Terminate]>((resolve) => {
+    globals[name] = (newIPN: NewIPN, terminate: Terminate) => {
+      delete globals[name]
+      resolve([newIPN, terminate])
+    }
+  })
+
+  go.env[INIT_CALLBACK_ENV] = name
+
+  // Only an exit the caller did not ask for is worth reporting. Before the
+  // handover every exit is a startup failure and rejecting hands it back as an
+  // error; afterwards, only an exit that shutdown() did not cause is a panic.
+  let stopping = false
+  const exited: Promise<void> = go.run(instance).then(() => {
+    delete globals[name]
+    if (!stopping) onExit("Unexpected shutdown")
+  })
+  // Reject alongside it, so an exit during startup fails the awaits below
+  // instead of leaving them pending forever.
+  const failed: Promise<never> = exited.then(() => {
+    throw new Error("Go runtime exited before the IPN was ready")
+  })
+
+  const [newIPN, terminate] = await Promise.race([ready, failed])
+  let ipn: IPN
+  try {
+    // Keep racing the runtime: building the backend runs in a Go goroutine, and
+    // if the runtime dies partway that goroutine dies with it and its promise
+    // never settles.
+    ipn = await Promise.race([newIPN(config), failed])
+  } catch (err) {
+    // Nothing was built, so nothing can shut the runtime down. Exit it here and
+    // wait for it, or the page keeps a blocked runtime for a failed startup.
+    // Calling terminate on an already-exited runtime does nothing.
+    stopping = true
+    terminate()
+    await exited
+    throw err
+  }
+
+  // Replace shutdown in place rather than wrapping the object: the bridge hands
+  // back a plain map of Go-backed functions, and copying it would leave the
+  // caller with something that only looks like the IPN.
+  const rawShutdown = ipn.shutdown.bind(ipn)
+  ipn.shutdown = async () => {
+    stopping = true
+    try {
+      void rawShutdown()
+    } catch {
+      // The runtime may already be gone, in which case there is nothing to ask
+      // and the await below returns immediately.
+    }
+    await exited
+  }
+  return ipn
+}
+
+type NewIPN = (config: IPNConfig) => Promise<IPN>
+type Terminate = () => void
+
+/** Must match initCallbackEnv in wasm_js.go. */
+const INIT_CALLBACK_ENV = "TSCONNECT_INIT_CALLBACK"

cmd/tsconnect/src/pkg/pkg.ts

@@ -7,6 +7,7 @@
 /// <reference path="../types/wasm_js.d.ts" />
 
 import "../wasm_exec"
+import { startIPN } from "../lib/start-ipn"
 import wasmURL from "./main.wasm"
 
 /**
@@ -30,11 +31,7 @@ export async function createIPN(config: IPNPackageConfig): Promise<IPN> {
     go.importObject
   )
   // The Go process should never exit, if it does then it's an unhandled panic.
-  go.run(wasmInstance.instance).then(() =>
+  return startIPN(go, wasmInstance.instance, config, config.panicHandler)
-    config.panicHandler("Unexpected shutdown")
-  )
-
-  return newIPN(config)
 }
 
 export { runSSHSession } from "../lib/ssh"

cmd/tsconnect/src/types/wasm_js.d.ts

@@ -7,12 +7,18 @@
  */
 
 declare global {
-  function newIPN(config: IPNConfig): IPN
-
   interface IPN {
     run(callbacks: IPNCallbacks): void
     login(): void
     logout(): void
+    /**
+     * Tears down the backend and exits the Go runtime that owns this IPN.
+     *
+     * The promise the bridge returns races with the runtime exiting and may
+     * never settle; startIPN replaces it with one that resolves when the
+     * runtime has actually gone.
+     */
+    shutdown(): Promise<void>
     ssh(
       host: string,
       username: string,

cmd/tsconnect/wasm/drive.go

@@ -240,10 +240,14 @@ type jsDrivePeer struct {
 	Online       *bool  `json:"online,omitempty"`
 }
 
-// listDrivePeers returns a JSON array of peers that carry
+// listDrivePeers returns a JSON array of peers that are online, have a
-// PeerCapabilityTaildriveSharer. Returns an empty array if the local node
+// reachable peerAPI and carry PeerCapabilityTaildriveSharer. Returns an empty
-// does not have drive:access in its ACL (DriveAccessEnabled). This mirrors
+// array if the local node does not have drive:access in its ACL
-// the filtering in LocalBackend.driveRemotesFromPeers.
+// (DriveAccessEnabled). This mirrors the filtering in
+// LocalBackend.driveRemotesFromPeers.
+//
+// The cap means a peer is allowed to share with us, not that it currently
+// exposes any share, so the result is a superset of the peers with shares.
 func (i *jsIPN) listDrivePeers() js.Value {
 	return makePromise(func() (any, error) {
 		if !i.lb.DriveAccessEnabled() {
@@ -269,6 +273,13 @@ func (i *jsIPN) listDrivePeers() js.Value {
 
 		peers := make([]jsDrivePeer, 0)
 		for _, p := range nm.Peers {
+			if !p.Online().Get() {
+				continue
+			}
+			peerURL := buildPeerAPIURL(p, selfHave4, selfHave6)
+			if peerURL == "" {
+				continue
+			}
 			// Check PeerCapabilityTaildriveSharer via the live PeerCaps map
 			// (derived from ACL rules), mirroring driveRemotesFromPeers.
 			hasCap := false
@@ -281,7 +292,6 @@ func (i *jsIPN) listDrivePeers() js.Value {
 			if !hasCap {
 				continue
 			}
-			peerURL := buildPeerAPIURL(p, selfHave4, selfHave6)
 			online := p.Online().Clone()
 			peers = append(peers, jsDrivePeer{
 				Name:         p.DisplayName(false),

cmd/tsconnect/wasm/wasm_js.go

@@ -6,11 +6,10 @@
 //
 // When run in the browser, a newIPN(config) function is added to the global JS
 // namespace. When called it returns an ipn object with the methods
-// run(callbacks), login(), logout(), and ssh(...).
+// run(callbacks), login(), and logout().
 package main
 
 import (
-	"bytes"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -25,13 +24,14 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"os"
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"syscall/js"
 	"time"
 
-	"golang.org/x/crypto/ssh"
 	"golang.org/x/net/dns/dnsmessage"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
@@ -40,10 +40,10 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
 	"gvisor.dev/gvisor/pkg/waiter"
 	"tailscale.com/control/controlclient"
+	_ "tailscale.com/feature/condregister"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnauth"
 	"tailscale.com/ipn/ipnlocal"
-	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/ipn/localapi"
 	"tailscale.com/ipn/store/mem"
 	"tailscale.com/logpolicy"
@@ -52,7 +52,6 @@ import (
 	"tailscale.com/net/netns"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tsdial"
-	"tailscale.com/safesocket"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tsd"
 	"tailscale.com/types/logid"
@@ -65,21 +64,62 @@ import (
 // ControlURL defines the URL to be used for connection to Control.
 var ControlURL = ipn.DefaultControlURL
 
+// initCallbackEnv names the JS global holding the callback that this runtime
+// hands its bridge to. The loader generates a name, installs the callback under
+// it, and passes the name in through go.env before starting the runtime.
+//
+// Publishing the bridge through a caller-supplied callback rather than a fixed
+// global means the loader never has to guess when the Go scheduler has run far
+// enough to expose it, and two runtimes in one JS realm cannot collide on the
+// name.
+const initCallbackEnv = "TSCONNECT_INIT_CALLBACK"
+
 func main() {
+	name := os.Getenv(initCallbackEnv)
+	if name == "" {
+		log.Fatalf("%s is not set; this module must be loaded by @webnet/tsconnect", initCallbackEnv)
+	}
+	callback := js.Global().Get(name)
+	if callback.Type() != js.TypeFunction {
+		log.Fatalf("globalThis[%q] is not a function", name)
+	}
+
 	shutdownCh := make(chan struct{})
-	js.Global().Set("newIPN", js.FuncOf(func(this js.Value, args []js.Value) any {
+	var terminateOnce sync.Once
-		if len(args) != 1 {
+	terminate := func() { terminateOnce.Do(func() { close(shutdownCh) }) }
-			log.Fatal("Usage: newIPN(config)")
+
-			return nil
+	var claimed atomic.Bool
-		}
+	newIPNFn := js.FuncOf(func(this js.Value, args []js.Value) any {
-		return newIPN(args[0], shutdownCh)
+		return makePromise(func() (any, error) {
-	}))
+			if len(args) != 1 {
+				return nil, errors.New("newIPN takes exactly one argument")
+			}
+			// One IPN per runtime: shutdown exits the shared Go runtime, so a
+			// second IPN here would be torn down by the first one's shutdown.
+			if !claimed.CompareAndSwap(false, true) {
+				return nil, errors.New("this WASM runtime already has an IPN; start another runtime instead")
+			}
+			return newIPN(args[0], terminate)
+		})
+	})
+
+	// A failed newIPN leaves the runtime blocked below with nothing to shut it
+	// down, so the loader gets a way to exit it. Leaving that to the loader
+	// keeps the ordering right: closing shutdownCh here would let main return
+	// before makePromise had delivered the rejection.
+	terminateFn := js.FuncOf(func(this js.Value, args []js.Value) any {
+		terminate()
+		return nil
+	})
+
+	callback.Invoke(newIPNFn, terminateFn)
+
 	// Block until shutdown() is called on the IPN, then let main return so the
 	// Go runtime (and all its goroutines) can be collected by the JS engine.
 	<-shutdownCh
 }
 
-func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
+func newIPN(jsConfig js.Value, terminate func()) (map[string]any, error) {
 	netns.SetEnabled(false)
 
 	var store ipn.StateStore
@@ -134,13 +174,13 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 		EventBus:      sys.Bus.Get(),
 	})
 	if err != nil {
-		log.Fatal(err)
+		return nil, fmt.Errorf("wgengine.NewUserspaceEngine: %w", err)
 	}
 	sys.Set(eng)
 
 	ns, err := netstack.Create(logf, sys.Tun.Get(), eng, sys.MagicSock.Get(), dialer, sys.DNSManager.Get(), sys.ProxyMapper())
 	if err != nil {
-		log.Fatalf("netstack.Create: %v", err)
+		return nil, fmt.Errorf("netstack.Create: %w", err)
 	}
 	sys.Set(ns)
 	ns.ProcessLocalIPs = true
@@ -177,20 +217,17 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 	// initDriveForRemote must be called before NewLocalBackend (SubSystem is set-once).
 	driveFS := initDriveForRemote(sys)
 
-	srv := ipnserver.New(logf, logid, sys.Bus.Get(), sys.NetMon.Get())
 	lb, err := ipnlocal.NewLocalBackend(logf, logid, sys, controlclient.LoginEphemeral)
 	if err != nil {
-		log.Fatalf("ipnlocal.NewLocalBackend: %v", err)
+		return nil, fmt.Errorf("ipnlocal.NewLocalBackend: %w", err)
 	}
 	if err := ns.Start(lb); err != nil {
-		log.Fatalf("failed to start netstack: %v", err)
+		return nil, fmt.Errorf("starting netstack: %w", err)
 	}
 	wireTaildropFileOps(lb, jsConfig.Get("fileOps"))
-	srv.SetLocalBackend(lb)
 
 	jsIPN := &jsIPN{
 		dialer:      dialer,
-		srv:         srv,
 		lb:          lb,
 		ns:          ns,
 		controlURL:  controlURL,
@@ -198,7 +235,7 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 		hostname:    hostname,
 		logID:       logid,
 		funnelPorts: make(map[uint16]*funnelListenerEntry),
-		shutdownCh:  shutdownCh,
+		terminate:   terminate,
 	}
 	lb.SetTCPHandlerForFunnelFlow(jsIPN.handleFunnelTCP)
 
@@ -232,25 +269,6 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 			jsIPN.logout()
 			return nil
 		}),
-		"ssh": js.FuncOf(func(this js.Value, args []js.Value) any {
-			if len(args) != 3 {
-				log.Printf("Usage: ssh(hostname, userName, termConfig)")
-				return nil
-			}
-			return jsIPN.ssh(
-				args[0].String(),
-				args[1].String(),
-				args[2])
-		}),
-		"fetch": js.FuncOf(func(this js.Value, args []js.Value) any {
-			if len(args) != 1 {
-				log.Printf("Usage: fetch(url)")
-				return nil
-			}
-
-			url := args[0].String()
-			return jsIPN.fetch(url)
-		}),
 		"dial": js.FuncOf(func(this js.Value, args []js.Value) any {
 			if len(args) != 2 {
 				log.Printf("Usage: dial(network, addr)")
@@ -290,13 +308,6 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 			}
 			return jsIPN.setExitNode(args[0].String())
 		}),
-		"setExitNodeEnabled": js.FuncOf(func(this js.Value, args []js.Value) any {
-			if len(args) != 1 {
-				log.Printf("Usage: setExitNodeEnabled(enabled)")
-				return nil
-			}
-			return jsIPN.setExitNodeEnabled(args[0].Bool())
-		}),
 		"listFileTargets": js.FuncOf(func(this js.Value, args []js.Value) any {
 			return jsIPN.listFileTargets()
 		}),
@@ -404,12 +415,11 @@ func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 		}),
 	}
 	wireDriveJS(jsIPN, driveFS, m)
-	return m
+	return m, nil
 }
 
 type jsIPN struct {
 	dialer     *tsdial.Dialer
-	srv        *ipnserver.Server
 	lb         *ipnlocal.LocalBackend
 	ns         *netstack.Impl
 	controlURL string
@@ -420,10 +430,7 @@ type jsIPN struct {
 	funnelMu    sync.Mutex
 	funnelPorts map[uint16]*funnelListenerEntry
 
-	// ln is the safesocket listener created by run(); stored here so shutdown
+	terminate    func() // unblocks main() so the Go runtime can exit
-	// can close it and unblock srv.Run.
-	ln           net.Listener
-	shutdownCh   chan struct{} // closed by shutdown() to unblock main()
 	shutdownOnce sync.Once
 }
 
@@ -615,18 +622,6 @@ func (i *jsIPN) run(jsCallbacks js.Value) {
 		}
 	}()
 
-	ln, err := safesocket.Listen("")
-	if err != nil {
-		log.Fatalf("safesocket.Listen: %v", err)
-	}
-	i.ln = ln
-
-	go func() {
-		err := i.srv.Run(context.Background(), ln)
-		if err != nil && !errors.Is(err, net.ErrClosed) {
-			log.Fatalf("ipnserver.Run exited: %v", err)
-		}
-	}()
 }
 
 func (i *jsIPN) login() {
@@ -644,208 +639,22 @@ func (i *jsIPN) logout() {
 	}()
 }
 
+// shutdown tears down the backend and lets main return, which exits the whole
+// Go runtime. Callers should await the runtime's exit rather than the promise
+// returned here: terminating races with makePromise resolving, so the promise
+// may never settle.
 func (i *jsIPN) shutdown() js.Value {
 	return makePromise(func() (any, error) {
 		i.shutdownOnce.Do(func() {
 			if i.lb != nil {
 				i.lb.Shutdown()
 			}
-			if i.ln != nil {
+			i.terminate()
-				i.ln.Close()
-			}
-			close(i.shutdownCh)
 		})
 		return nil, nil
 	})
 }
 
-func (i *jsIPN) ssh(host, username string, termConfig js.Value) map[string]any {
-	jsSSHSession := &jsSSHSession{
-		jsIPN:      i,
-		host:       host,
-		username:   username,
-		termConfig: termConfig,
-	}
-
-	go jsSSHSession.Run()
-
-	return map[string]any{
-		"close": js.FuncOf(func(this js.Value, args []js.Value) any {
-			return jsSSHSession.Close() != nil
-		}),
-		"resize": js.FuncOf(func(this js.Value, args []js.Value) any {
-			rows := args[0].Int()
-			cols := args[1].Int()
-			return jsSSHSession.Resize(rows, cols) != nil
-		}),
-	}
-}
-
-type jsSSHSession struct {
-	jsIPN      *jsIPN
-	host       string
-	username   string
-	termConfig js.Value
-	session    *ssh.Session
-
-	pendingResizeRows int
-	pendingResizeCols int
-}
-
-func (s *jsSSHSession) Run() {
-	writeFn := s.termConfig.Get("writeFn")
-	writeErrorFn := s.termConfig.Get("writeErrorFn")
-	setReadFn := s.termConfig.Get("setReadFn")
-	rows := s.termConfig.Get("rows").Int()
-	cols := s.termConfig.Get("cols").Int()
-	timeoutSeconds := 5.0
-	if jsTimeoutSeconds := s.termConfig.Get("timeoutSeconds"); jsTimeoutSeconds.Type() == js.TypeNumber {
-		timeoutSeconds = jsTimeoutSeconds.Float()
-	}
-	onConnectionProgress := s.termConfig.Get("onConnectionProgress")
-	onConnected := s.termConfig.Get("onConnected")
-	onDone := s.termConfig.Get("onDone")
-	defer onDone.Invoke()
-
-	writeError := func(label string, err error) {
-		writeErrorFn.Invoke(fmt.Sprintf("%s Error: %v\r\n", label, err))
-	}
-	reportProgress := func(message string) {
-		onConnectionProgress.Invoke(message)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeoutSeconds*float64(time.Second)))
-	defer cancel()
-	reportProgress(fmt.Sprintf("Connecting to %s…", strings.Split(s.host, ".")[0]))
-	c, err := s.jsIPN.dialer.UserDial(ctx, "tcp", net.JoinHostPort(s.host, "22"))
-	if err != nil {
-		writeError("Dial", err)
-		return
-	}
-	defer c.Close()
-
-	config := &ssh.ClientConfig{
-		HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
-			// Host keys are not used with Tailscale SSH, but we can use this
-			// callback to know that the connection has been established.
-			reportProgress("SSH connection established…")
-			return nil
-		},
-		User: s.username,
-	}
-
-	reportProgress("Starting SSH client…")
-	sshConn, _, _, err := ssh.NewClientConn(c, s.host, config)
-	if err != nil {
-		writeError("SSH Connection", err)
-		return
-	}
-	defer sshConn.Close()
-
-	sshClient := ssh.NewClient(sshConn, nil, nil)
-	defer sshClient.Close()
-
-	session, err := sshClient.NewSession()
-	if err != nil {
-		writeError("SSH Session", err)
-		return
-	}
-	s.session = session
-	defer session.Close()
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		writeError("SSH Stdin", err)
-		return
-	}
-
-	session.Stdout = termWriter{writeFn}
-	session.Stderr = termWriter{writeFn}
-
-	setReadFn.Invoke(js.FuncOf(func(this js.Value, args []js.Value) any {
-		input := args[0].String()
-		_, err := stdin.Write([]byte(input))
-		if err != nil {
-			writeError("Write Input", err)
-		}
-		return nil
-	}))
-
-	// We might have gotten a resize notification since we started opening the
-	// session, pick up the latest size.
-	if s.pendingResizeRows != 0 {
-		rows = s.pendingResizeRows
-	}
-	if s.pendingResizeCols != 0 {
-		cols = s.pendingResizeCols
-	}
-	err = session.RequestPty("xterm", rows, cols, ssh.TerminalModes{})
-	if err != nil {
-		writeError("Pseudo Terminal", err)
-		return
-	}
-
-	err = session.Shell()
-	if err != nil {
-		writeError("Shell", err)
-		return
-	}
-
-	onConnected.Invoke()
-	err = session.Wait()
-	if err != nil {
-		writeError("Wait", err)
-		return
-	}
-}
-
-func (s *jsSSHSession) Close() error {
-	if s.session == nil {
-		// We never had a chance to open the session, ignore the close request.
-		return nil
-	}
-	return s.session.Close()
-}
-
-func (s *jsSSHSession) Resize(rows, cols int) error {
-	if s.session == nil {
-		s.pendingResizeRows = rows
-		s.pendingResizeCols = cols
-		return nil
-	}
-	return s.session.WindowChange(rows, cols)
-}
-
-func (i *jsIPN) fetch(url string) js.Value {
-	return makePromise(func() (any, error) {
-		c := &http.Client{
-			Transport: &http.Transport{
-				DialContext: i.dialer.UserDial,
-			},
-		}
-		res, err := c.Get(url)
-		if err != nil {
-			return nil, err
-		}
-
-		return map[string]any{
-			"status":     res.StatusCode,
-			"statusText": res.Status,
-			"text": js.FuncOf(func(this js.Value, args []js.Value) any {
-				return makePromise(func() (any, error) {
-					defer res.Body.Close()
-					buf := new(bytes.Buffer)
-					if _, err := buf.ReadFrom(res.Body); err != nil {
-						return nil, err
-					}
-					return buf.String(), nil
-				})
-			}),
-			// TODO: populate a more complete JS Response object
-		}, nil
-	})
-}
-
 func (i *jsIPN) setExitNode(stableNodeID string) js.Value {
 	return makePromise(func() (any, error) {
 		mp := &ipn.MaskedPrefs{
@@ -857,13 +666,6 @@ func (i *jsIPN) setExitNode(stableNodeID string) js.Value {
 	})
 }
 
-func (i *jsIPN) setExitNodeEnabled(enabled bool) js.Value {
-	return makePromise(func() (any, error) {
-		_, err := i.lb.SetUseExitNodeEnabled(ipnauth.Self, enabled)
-		return nil, err
-	})
-}
-
 func (i *jsIPN) dial(network, addr string) js.Value {
 	return makePromise(func() (any, error) {
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -1335,10 +1137,10 @@ func (i *jsIPN) ping(ip string, pingType string, size int) js.Value {
 			return nil, fmt.Errorf("ping: invalid IP %q: %w", ip, err)
 		}
 		switch tailcfg.PingType(pingType) {
-		case tailcfg.PingDisco, tailcfg.PingTSMP, tailcfg.PingICMP, tailcfg.PingPeerAPI:
+		case tailcfg.PingTSMP, tailcfg.PingICMP, tailcfg.PingPeerAPI:
 			// valid
 		default:
-			return nil, fmt.Errorf("ping: unknown type %q, must be one of: disco, TSMP, ICMP, peerapi", pingType)
+			return nil, fmt.Errorf("ping: unknown type %q, must be one of: TSMP, ICMP, peerapi", pingType)
 		}
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
@@ -1663,16 +1465,6 @@ func resolveUDPAddr(s string) (*net.UDPAddr, error) {
 	return &net.UDPAddr{IP: ip, Port: port}, nil
 }
 
-type termWriter struct {
-	f js.Value
-}
-
-func (w termWriter) Write(p []byte) (n int, err error) {
-	r := bytes.Replace(p, []byte("\n"), []byte("\n\r"), -1)
-	w.f.Invoke(string(r))
-	return len(p), nil
-}
-
 // jsIncomingFile is the JSON representation of an in-progress inbound file
 // transfer sent to the notifyIncomingFiles callback.
 type jsIncomingFile struct {

cmd/tsconnect/wasmbuild/wasmbuild.go

@@ -36,59 +36,36 @@ var baseTags = []string{
 	"omitpemdecrypt",
 }
 
-// Keep is the set of feature/featuretags tags the cmd/tsconnect/wasm
+// Omit is the set of feature/featuretags tags excluded from the
-// build needs LINKED. Every other feature in [featuretags.Features] is
+// cmd/tsconnect/wasm build via their ts_omit_ build tag (computed by
-// excluded via its ts_omit_ build tag (computed by [Tags]).
+// [Tags]). Everything else in [featuretags.Features] stays linked.
-// Transitive dependencies of entries in Keep are pulled in
+//
-// automatically via [featuretags.Requires].
+// Upstream uses the opposite polarity here — a small allow-list — because
+// its wasm client is only an SSH/fetch-in-browser tool. This fork's JS
+// bridge exposes Taildrop, Taildrive, Funnel/serve, ACME certs, exit node
+// selection, service advertisement and the peerAPI, so an allow-list is
+// the wrong default: a missing entry is not a compile error, it is a
+// feature that silently stops working at runtime (an omitted extension
+// simply never registers its hooks). Linking everything also matches how
+// this build behaved before upstream introduced featuretags.
 //
-// Adding an entry here grows the wasm bundle. Removing one strips it.
 // The init() below panics if any entry is unknown to feature/featuretags,
 // so a rename / removal in that registry fails loudly here.
 //
-// Notably absent (server-only or otherwise meaningless in a browser):
+// Trimming the bundle by omitting more features is worthwhile but should
-//   - "ssh": controls the SSH *server* (feature/ssh registers
+// be done with measurements and per-feature runtime verification, not by
-//     ssh/tailssh). The wasm acts as an SSH *client* using
+// assuming a feature is unreachable from the browser.
-//     golang.org/x/crypto/ssh directly; no featuretag gates that.
+var Omit = []featuretags.FeatureTag{
-//   - "portmapper", "debugportmapper": js/wasm has no UDP sockets,
+	// feature/ace does not compile for GOOS=js: control/controlhttp only
-//     can't speak NAT-PMP / PCP / UPnP.
+	// installs HookMakeACEDialer on non-js platforms, so feature/ace's
-//   - "captiveportal": the browser handles captive portal detection
+	// reference to it is undefined here.
-//     in front of us.
+	"ace",
-//   - "syspolicy": no MDM in a browser.
-//   - "clientupdate": no binary self-update.
-//   - "dbus", "resolved", "networkmanager", "iptables", "linkspeed",
-//     "linuxdnsfight", "listenrawdisco", "osrouter", "synology",
-//     "systray", "tundevstats", "wakeonlan": OS integrations not
-//     applicable to a browser-hosted client.
-//   - "aws", "cloud", "kube", "bird", "appconnectors", "conn25",
-//     "relayserver", "tap", "tpm", "doctor", "advertiseroutes",
-//     "useroutes": server-side or otherwise out of scope.
-//
-// This fork keeps considerably more than upstream's SSH-in-browser
-// build: the JS bridge exposes Taildrop, Taildrive, Funnel/serve, ACME
-// certs and exit node selection, all of which need their feature linked
-// in. The taildrop/drive FileOps are backed by JS callbacks rather than
-// a real filesystem, so the usual "no local filesystem" objection to
-// linking them into wasm doesn't apply here.
-var Keep = []featuretags.FeatureTag{
-	"acme",              // getCert / listenTLS need ACME cert issuance
-	"advertiseexitnode", // exit node advertisement via the JS bridge
-	"c2n",               // control-to-node mechanism the control client invokes
-	"dns",               // MagicDNS resolution in-process
-	"drive",             // Taildrive WebDAV server exposed to JS
-	"health",            // ipnstate/ipnlocal reference health warnables pervasively
-	"ipnbus",            // notification bus for state/netmap callbacks
-	"logtail",           // log upload (browser console + remote)
-	"netstack",          // userspace networking; wasm has no kernel TUN
-	"serve",             // setFunnel / listenTLS serve config
-	"taildrop",          // file send/receive over a JS-backed FileOps
-	"useexitnode",       // exit node selection exposed to JS
 }
 
 func init() {
-	for _, ft := range Keep {
+	for _, ft := range Omit {
 		if _, ok := featuretags.Features[ft]; !ok {
-			panic(fmt.Sprintf("wasmbuild.Keep references unknown feature tag %q; "+
+			panic(fmt.Sprintf("wasmbuild.Omit references unknown feature tag %q; "+
 				"did feature/featuretags rename or remove it?", ft))
 		}
 	}
@@ -113,25 +90,22 @@ type BuildInfo struct {
 }
 
 // Tags returns the joined -tags value for the wasm build: [baseTags]
-// plus a ts_omit_<feature> for every entry in [featuretags.Features]
+// plus a ts_omit_<feature> for every entry in [Omit].
-// that is not transitively required by [Keep].
 //
 // The result is sorted so that the same source tree always produces
 // the same string (and therefore the same wasm bytes, given identical
 // inputs to `go build`).
 func Tags() string {
-	keep := map[featuretags.FeatureTag]bool{}
+	omit := map[featuretags.FeatureTag]bool{}
-	for _, ft := range Keep {
+	for _, ft := range Omit {
-		for dep := range featuretags.Requires(ft) {
+		omit[ft] = true
-			keep[dep] = true
-		}
 	}
 	tags := slices.Clone(baseTags)
 	for ft := range featuretags.Features {
 		if ft == "" || !ft.IsOmittable() {
 			continue
 		}
-		if !keep[ft] {
+		if omit[ft] {
 			tags = append(tags, ft.OmitTag())
 		}
 	}

ipn/ipnlocal/local.go

@@ -1763,6 +1763,13 @@ func (b *LocalBackend) PeerCaps(src netip.Addr) tailcfg.PeerCapMap {
 	return b.currentNode().PeerCaps(src)
 }
 
+// PeerCapsIncludingUnsigned is like [LocalBackend.PeerCaps] but does not deny
+// capabilities to peers with UnsignedPeerAPIOnly set. It exists only for the
+// Funnel ingress path; see [nodeBackend.PeerCapsIncludingUnsigned].
+func (b *LocalBackend) PeerCapsIncludingUnsigned(src netip.Addr) tailcfg.PeerCapMap {
+	return b.currentNode().PeerCapsIncludingUnsigned(src)
+}
+
 // PeerCapsForIP returns the capabilities that remote src IP has when
 // talking to the given destination IP on this node.
 func (b *LocalBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {

ipn/ipnlocal/node_backend.go

@@ -432,10 +432,32 @@ func (nb *nodeBackend) srcIsUnsignedPeerLocked(src netip.Addr) bool {
 	return ok && n.UnsignedPeerAPIOnly()
 }
 
+// PeerCapsIncludingUnsigned is like [nodeBackend.PeerCaps] but does not deny
+// capabilities to peers with UnsignedPeerAPIOnly set.
+//
+// Funnel ingress relays are delivered as UnsignedPeerAPIOnly nodes: per the
+// docs on [tailcfg.Node.UnsignedPeerAPIOnly] they get no network access at all
+// and exist solely to reach this node's peerapi. The ingress endpoint they need
+// is gated on [tailcfg.PeerCapabilityIngress], so denying them capabilities
+// wholesale — as peerCapsLocked does upstream as of 0eb38dc2e — makes Funnel
+// impossible. Callers must therefore be limited to the ingress path.
+//
+// This is a fork-local patch; drop it once upstream restores Funnel.
+// See webnet/tailscale#16.
+func (nb *nodeBackend) PeerCapsIncludingUnsigned(src netip.Addr) tailcfg.PeerCapMap {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	return nb.peerCapsIgnoringSignatureLocked(src)
+}
+
 func (nb *nodeBackend) peerCapsLocked(src netip.Addr) tailcfg.PeerCapMap {
 	if nb.srcIsUnsignedPeerLocked(src) {
 		return nil
 	}
+	return nb.peerCapsIgnoringSignatureLocked(src)
+}
+
+func (nb *nodeBackend) peerCapsIgnoringSignatureLocked(src netip.Addr) tailcfg.PeerCapMap {
 	if nb.netMap == nil {
 		return nil
 	}

ipn/ipnlocal/peerapi.go

@@ -592,8 +592,14 @@ func (h *peerAPIHandler) canDebug() bool {
 var allowSelfIngress = envknob.RegisterBool("TS_ALLOW_SELF_INGRESS")
 
 // canIngress reports whether h can send ingress requests to this node.
+//
+// The ingress cap is resolved without the unsigned-peer denial that
+// [nodeBackend.PeerCaps] applies, because Funnel ingress relays are by design
+// UnsignedPeerAPIOnly nodes whose only permitted action is this endpoint.
+// See [nodeBackend.PeerCapsIncludingUnsigned].
 func (h *peerAPIHandler) canIngress() bool {
-	return h.peerHasCap(tailcfg.PeerCapabilityIngress) || (allowSelfIngress() && h.isSelf)
+	caps := h.ps.b.PeerCapsIncludingUnsigned(h.remoteAddr.Addr())
+	return caps.HasCapability(tailcfg.PeerCapabilityIngress) || (allowSelfIngress() && h.isSelf)
 }
 
 func (h *peerAPIHandler) peerHasCap(wantCap tailcfg.PeerCapability) bool {

safesocket/safesocket_js.go

@@ -5,22 +5,15 @@ package safesocket
 
 import (
 	"context"
-	"fmt"
 	"net"
-	"sync/atomic"
 
 	"github.com/akutz/memconn"
 )
 
 const memName = "Tailscale-IPN"
 
-// memSeq ensures each IPN instance in the same WASM process gets a distinct
-// memconn address, so concurrent instances do not conflict on the registry.
-var memSeq atomic.Int64
-
 func listen(path string) (net.Listener, error) {
-	name := fmt.Sprintf("%s-%d", memName, memSeq.Add(1))
+	return memconn.Listen("memu", memName)
-	return memconn.Listen("memu", name)
 }
 
 func connect(ctx context.Context, _ string) (net.Conn, error) {