Linked environments: a lazy person's "Link all" button

[kevintwg]

Hey! I run T3 Code on five machines and I want agents on any of them to be able to work on any other. Links only go one way, so that's 20 links. Right now each one is its own Link dialog, and I have to open it from the right machine's section in Settings → Connections.

I did four of them and then decided there had to be a better way. Then I found out links expire after 30 days, which means the same 20 dialogs come back every month. I am way too lazy for that.

To be clear, I get why links are one-way, with their own access level and revocable on the other machine. I'm not asking to change any of that. I just want fewer clicks.

The idea

• One "Linked environments" section with a grid instead of a list per machine. Rows are where the agent runs, columns are what it can work on. Click an empty square to link that pair.
• A Link all button. Pick your machines and an access level once, and it creates every missing link while you watch.
• Once everything is linked, the button turns into Renew all, so month two is one click too.

Here's a quick mockup (just a mockup with made-up machine names, not real code yet):

link-all-demo.mp4

Why I think it's small

The web client already does this for a single link. If it's connected to the other machine with access:write, it mints the pairing code there (mintPairingCodeOn) and then calls peerLinkEnvironment.link on the source. Link all just does that for each missing pair. As far as I can tell, no server, contract or permission changes. If the client can't mint a code on some machine, that pair gets skipped and listed instead of failing quietly.

What about mesh (#24863)?

Mesh looks like the bigger and better version of this, but it's for T3 Connect accounts on the allowlist. Most of my machines talk over Tailscale, so I'm not sure mesh will cover setups like mine. If mesh is meant to replace manual links entirely, no worries, I'll happily drop this.

So...

Would you take a PR for this? I'm happy to build it and keep it to the web client's Connections settings. If you'd rather keep it smaller (say, just Renew all, or just the dialog without the grid), let me know and I'll stick to that.

[rendrag-git]

Same boat here, would love this. I've got T3 on a Linux box and two Macs (laptop and a mini), all on one tailnet. What I really want is to add a new machine once, pick the access level, and have it linked to everything else I've already got.

I also hit something today that a Link all button would probably sidestep. Linking my laptop from the Linux box kept failing with "could not reach ", even though the laptop was up and answering. It took some digging to figure out it wasn't a reachability problem at all. T3 had offered the LAN address, the 100.x Tailscale IP, and 127.0.0.1. It refuses the first two because they're plain http without a .ts.net name, and 127.0.0.1 is just the Linux box itself. Once I linked using the MagicDNS name (http://<machine>.<tailnet>.ts.net:3773) it went through first try. Looks like the same thing as #26450.

So if Link all picked the .ts.net name for each pair, that whole problem goes away. And separately, it'd be great if the error said "refused: plain http" instead of "could not reach". That would have saved me a good half hour.

Possibly related: #26840, #28531 (that one will get worse as people link more machines), and #29184.

Running 0.1.6 stable on Linux and 0.1.7-nightly on the Mac, for what it's worth.