Fix hosted pairing token retry, SSH prompt double-click, and redundant settings call

- Track token submission in HostedPairingRouteSurface so retry after a
  consumed one-time token shows a clear message instead of a confusing
  auth error.
- Add isResponding guard to SshPasswordPromptDialog to prevent rapid
  double-click from corrupting the prompt queue and silently dropping
  queued prompts.
- Refactor applyDesktopTailscaleServeEnabled to accept already-resolved
  DesktopSettings instead of re-deriving them from the same inputs.

Author: cursoragent

apps/desktop/src/main.ts

@@ -402,13 +402,14 @@ async function applyDesktopServerExposureMode(
   return getDesktopServerExposureState();
 }
 
-async function applyDesktopTailscaleServeEnabled(input: {
-  readonly enabled: boolean;
-  readonly port?: number;
-}): Promise<DesktopServerExposureState> {
-  desktopSettings = setDesktopTailscaleServePreference(desktopSettings, input);
+async function applyDesktopTailscaleServeEnabled(
+  resolvedSettings: typeof desktopSettings,
+): Promise<DesktopServerExposureState> {
+  desktopSettings = resolvedSettings;
   writeDesktopSettings(DESKTOP_SETTINGS_PATH, desktopSettings);
-  relaunchDesktopApp(input.enabled ? "tailscale-serve-enabled" : "tailscale-serve-disabled");
+  relaunchDesktopApp(
+    desktopSettings.tailscaleServeEnabled ? "tailscale-serve-enabled" : "tailscale-serve-disabled",
+  );
   return getDesktopServerExposureState();
 }
 
@@ -1751,10 +1752,7 @@ function registerIpcHandlers(): void {
     if (nextSettings === desktopSettings) {
       return getDesktopServerExposureState();
     }
-    return applyDesktopTailscaleServeEnabled({
-      enabled: input.enabled,
-      port: nextSettings.tailscaleServePort,
-    });
+    return applyDesktopTailscaleServeEnabled(nextSettings);
   });
 
   ipcMain.removeHandler(GET_ADVERTISED_ENDPOINTS_CHANNEL);

apps/web/src/components/auth/PairingRouteSurface.tsx

@@ -166,6 +166,7 @@ export function HostedPairingRouteSurface() {
   const [status, setStatus] = useState<"pairing" | "paired" | "error">("pairing");
   const [message, setMessage] = useState("Connecting to this backend.");
   const submitAttemptedRef = useRef(false);
+  const tokenSubmittedRef = useRef(false);
 
   const submitHostedPairingRequest = useCallback(async () => {
     const request = hostedPairingRequestRef.current;
@@ -176,9 +177,18 @@ export function HostedPairingRouteSurface() {
       return;
     }
 
+    if (tokenSubmittedRef.current) {
+      setStatus("error");
+      setMessage(
+        "The pairing token may have already been used. Please request a new pairing link.",
+      );
+      return;
+    }
+
     setStatus("pairing");
     setMessage("Connecting to this backend.");
 
+    tokenSubmittedRef.current = true;
     try {
       const record = await addSavedEnvironment({
         label: request.label,

apps/web/src/components/desktop/SshPasswordPromptDialog.tsx

@@ -20,6 +20,7 @@ function describeSshTarget(request: DesktopSshPasswordPromptRequest): string {
 export function SshPasswordPromptDialog() {
   const [queue, setQueue] = useState<readonly DesktopSshPasswordPromptRequest[]>([]);
   const [password, setPassword] = useState("");
+  const [isResponding, setIsResponding] = useState(false);
   const currentRequest = queue[0] ?? null;
   const inputRef = useRef<HTMLInputElement | null>(null);
 
@@ -50,17 +51,20 @@ export function SshPasswordPromptDialog() {
   }, [currentRequest]);
 
   const respond = async (nextPassword: string | null) => {
-    if (!currentRequest) {
+    if (!currentRequest || isResponding) {
       return;
     }
 
     const requestId = currentRequest.requestId;
+    setIsResponding(true);
     setQueue((currentQueue) => currentQueue.slice(1));
     setPassword("");
     try {
       await window.desktopBridge?.resolveSshPasswordPrompt(requestId, nextPassword);
     } catch (error) {
       console.error("Failed to resolve SSH password prompt.", error);
+    } finally {
+      setIsResponding(false);
     }
   };
 
@@ -101,10 +105,10 @@ export function SshPasswordPromptDialog() {
           </p>
         </DialogPanel>
         <DialogFooter>
-          <Button variant="outline" onClick={() => void respond(null)}>
+          <Button disabled={isResponding} variant="outline" onClick={() => void respond(null)}>
             Cancel
           </Button>
-          <Button onClick={() => void respond(password)} type="button">
+          <Button disabled={isResponding} onClick={() => void respond(password)} type="button">
             Continue
           </Button>
         </DialogFooter>