[Bug]: Android: T3 Connect environment stays "Off" with a locked toggle while a phone VPN is active; the connect step fails silently

[xob0t]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/mobile

Steps to reproduce

1. On a desktop, turn on T3 Connect (Settings → T3 Connect on). The tunnel registers and relay health checks succeed.
2. On Android, turn on a VPN.
3. Install the T3 Code app and sign in with the same account.
4. Open the Environments tab. The desktop appears in the list.
5. PC connection is visible but toggle is inactive

Expected behavior

The app connects the environment through T3 Connect. If the connect step can't reach the environment or the relay, it shows an error and a way to retry.

Actual behavior

The environment shows "Off". Its toggle is disabled and doesn't respond to taps. The card says "Managed by T3 Connect. Tunnel details update automatically.", and below it the screen says "Connect this environment to manage it." No control on that screen can connect it, and no error appears. Tapping refresh doesn't change anything.

Turning the phone VPN off lets the connect step finish. After that I can turn the VPN back on and the connection keeps working over it. So the VPN only breaks the first connect/link step, not the tunnel traffic itself.

The desktop's server traces show only T3 Connect health checks (POST /api/t3-connect/health → 200) through the tunnel during this time. No request from the phone ever reached the desktop while the VPN was on.

Impact

Major degradation or frequent failure

Version or commit

Android app 2.0; desktop/server 0.0.46-nightly.20261005.2702

Environment

Android 16. Desktop: Windows 11 Pro

Logs or stack traces

Screenshots, recordings, or supporting files

No response

Workaround

Turn off the phone VPN, open the environment so the connect step finishes, then turn the VPN back on.

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Triage

Thanks @xob0t for the clear repro and for checking the desktop traces, that narrowed this down a lot. Reading current main (ac8e945), this looks like a failed first link on Android rather than a dead tunnel. It's separate from #14958 and from the older "VPN looks offline" bug fixed in #3949.

What I found

• The phone's connect never reached the desktop. POST /api/t3-connect/health is the relay probing the desktop. A phone connect is a different call: the app asks the relay to connectEnvironment, and the relay then POSTs /api/t3-connect/mint-credential on the desktop before the phone opens the tunnel. Seeing only health checks means that mint never ran, so the first connect stopped before it got that far. An already-open socket staying up after the VPN comes back on doesn't necessarily mean a fresh connect would work over the VPN.
• fix(mobile): don't mark Android VPN/Tailscale as offline when connected #3949 is already on main. apps/mobile/src/connection/platform.ts treats the device as offline only when isConnected === false, not when isInternetReachable is false, so this isn't that regression.
• The "Off" screen has no way forward. The literal "Off" label shows only when a saved environment has isEnabled === false and isn't unsupported (ConnectionEnvironmentRow, CloudEnvironmentRows). In that state the UI drops the connection error, the reconnect control is disabled={!enabled}, and the detail screen only says "Connect this environment to manage it." Pull-to-refresh reloads the T3 Connect list but doesn't retry the link.
• The Android switch tap. On Android the switch sits inside the row Pressable, so a tap opens or expands the row instead of turning the environment on ([Bug]: Android connection switch taps expand the row instead of enabling the environment #14958, still open). An unsaved cloud row isn't wrapped that way, so the very first toggle may still fire. After that, once the row is saved and off, nothing on the screen can start or retry the connect.

Likely fix area

apps/mobile connection screens and the T3 Connect connect path. Some options:

• Show the relay or tunnel connect failure, with a retry that works while the environment is off.
• Make the Android switch toggle reliably inside the row ([Bug]: Android connection switch taps expand the row instead of enabling the environment #14958).
• Look at why the first connectEnvironment from the phone doesn't reach mint while a VPN is up, or at least have it fail visibly instead of waiting until the VPN is turned off.

If you hit it again, the VPN app's name and whether the line under the environment said "Off", "Connecting…", or "Offline" while the VPN was on would help pin down which state you were in. The missing error and retry are enough to track either way.

A maintainer will decide on the fix direction.