Repository navigation
Phone pairing UX: QR code, one-time tokens, revocable device sessions #151
Description
What T3 Code does
npx t3 pair prints a QR code; one-time pairing tokens are exchanged for per-device sessions; t3 auth inspects and revokes sessions; optional Tailscale HTTPS publishing (remote-access). Plus native iOS/Android apps and a hosted web app.
Solenta today
--serve-web prints one long-lived static token persisted at <userData>/web-token (electron/webServer.js:86-103, README:131-137). No QR, no per-device sessions, no revocation short of deleting the file.
Why it matters
Typing a 43-char base64url token on a phone is the single biggest friction in the remote story Solenta already advertises. A QR shown in the app plus revocable per-device sessions is a small main-process change with outsized payoff, and revocation is a real security gap today.
Scope suggestion
Pairing endpoint that issues one-time codes (shown as QR in Settings), exchanged for named device sessions listed in Settings with a revoke button.
Activity
currentbits commentedon Aug 17, 2026
Research note (Northflank auto-DNS per port): phone pairing becomes much more useful with an auto-tunneled HTTPS preview URL per dev-server port, so the paired phone can open the running app, not just the orchestrator UI.
currentbits commentedon Oct 2, 2026
T3 source follow-up for this existing pairing issue (2026-10-02, commit 54084ae): direct pairing uses a short-lived, one-use grant (five-minute default) exchanged for a device session; ordinary paired sessions cannot issue access-management grants. Sessions are revocable and default to 30 days. The client obtains a short-lived WebSocket ticket through authenticated HTTP, keeping its longer-lived token out of the socket URL. Sources: pairing grants, scope contract, WebSocket upgrade.
For Solenta, this should replace the single long-lived
web-tokenas part of #245, while the first remote-host proof can stay loopback-only behind SSH. Acceptance should cover one-use/expiry, per-device revoke, wrong-host rejection, and reconnect with a valid session. A paired device can still run host-side agents/terminals under the host OS account, so the QR code grants substantial authority.currentbits commentedon Oct 9, 2026
Gap pass #1532 checked this against main @24d3c36b (v0.24.0). #1512 shipped named per-device tokens, stored only as hashes. Revoking a device drops its live sockets (
electron/webDevices.js:131-166,webAccess.js:266), and Settings shows a pairing QR code.Still missing, so keeping this open:
webServer.js:342).This overlaps with #1530 (scoped remote access).
currentbits commentedon Oct 9, 2026
Shipped in 0.24.0: QR pairing plus named per-device tokens with instant revoke (
electron/webDevices.js). Scoped device permissions continue in #1530. Closing in the 2026-10-09 board cleanup (#1532).