[shivamhwp]

With Local environment off, the desktop app showed "No environment selected" in Sharing & access even while connected to a background service. The page now selects a connected service and offers a picker when several are available. Pairing and T3 Connect actions use that service's credentials and permissions. Desktop network controls remain restricted to the backend the app manages, and switching services clears the displayed pairing credential.

Closes #26420

Evidence

Verified head d86991209bf586bf1d152e6f1ae3590198f5750c, built from base a185dd924889cd7f925760431a9f29b973a35e2f. The rebase preserves main's new collapsed pairing-link preview. An independent Codex review found no findings.

Before

Historical Linux desktop reproduction at 48a292364ab37574c67fb377b5227e5d281d9203: a connected saved service has no access target with Local environment off.

linux-before.mp4

After at this head

Physical corex, Linux Electron 44.10.1, two real bundled servers on loopback ports 27731 and 27732 with separate test homes. Both services were enrolled through Add environment. Electron used the production gnome_libsecret backend with a task-isolated GNOME secret-service session collection. The saved connection catalog was encrypted; Electron's basic store was not used.

The recording follows Labs to Sharing & access, creates A's pairing link while Authorized clients is collapsed, switches to B, creates and revokes B's link, then returns to A. A's link survives B's revocation and its copyable credential is cleared on switching. It then revokes A's link, links A and B for publishing, unlinks A while B remains linked, and finally unlinks B. The last view shows Local environment off and both services connected. Idle pauses are shortened and the fixture boundary is captioned.

linux-final-short.mp4

Only unavailable external boundaries were fixtures: Clerk FAPI/session responses and its account widget, plus a local HTTPS relay. The real Clerk SDK, production renderer/hooks/controllers, selected-service HTTP authentication, and real /api/connect handlers ran unchanged. The relay fixture verified real Ed25519 proofs before returning invented per-environment credentials. The fixture certificate required Electron's --ignore-certificate-errors.

Cloud linking in the recording is publish-only. The managed T3 Connect switch is visible and stays off. After each action, authenticated reads of both real servers and hashes of their secret files confirmed the selected service changed and the other service did not. All five checkpoints passed.

The Browser panel also exercised primary-environment pairing creation and revocation at this head. The collapsed list displayed its new preview, then removed it on revocation.

Web and macOS/Windows desktop run the same ConnectionsSettings, AuthorizedClientsSettings, useCloudLinkController and executeConnectedEnvironmentHttpRequest paths exercised here. Native mobile has separate UI; no mobile call sites use the new pairing commands, and no native mobile UI changed.

Real server proof and checks

Against the two current-head servers, commands verified manual and managed link-proof signatures and claims, exact loopback ports, unauthorized/wrong-port rejection, account-mismatch rejection without mutation, and relay-config persistence. After restarting both servers, exact secret bytes, 0600 modes, preferences and signing keys survived. A's bearer failed on B; unlinking A left B's state and files unchanged.

Boat job j_kz4jyhrkvej3ewyhzgfy exited 0. vp run check:changed passed format, lint, both knip passes, affected-package typechecks, all 67 focused tests in 8 files, and 15 selected React compiler cases. vp run build:desktop passed. The focused run includes environment HTTP authentication, auth commands, saved-service credentials, cloud controller behavior, selection, pairing rows and scheduled-task compatibility.

Commands and successful output as text

PR #26464 current-head verification
Head: d86991209bf586bf1d152e6f1ae3590198f5750c
Build/test base: a185dd924889cd7f925760431a9f29b973a35e2f
Machine: physical corex, Linux, Electron 44.10.1
Build: Boat j_kz4jyhrkvej3ewyhzgfy, worker bx_3grjdm9s, large, attempt 1, exit 0
Build command: vp i --frozen-lockfile; vp run check:changed "$FLEET_SOURCE_BASE"; export T3CODE_CLERK_PUBLISHABLE_KEY=pk_test_Y2xlcmsuZml4dHVyZS50ZXN0JA; export T3CODE_CLERK_JWT_TEMPLATE=fixture-relay; export T3CODE_RELAY_URL=https://127.0.0.1:27740; vp run build:desktop
Runtime archive SHA256: 64c03516bf48ab18f9c91d5e9a0932f175d6de1069ea59b4e21f463542756ff7

The exact built desktop/server/web outputs were extracted without source edits.
Two real bundled server processes, separate test homes and ports 27731/27732:
node runtime/apps/server/dist/bin.mjs serve --base-dir /tmp/t3code-26464-rebase/service-a --port 27731 --host 127.0.0.1 --no-browser
node runtime/apps/server/dist/bin.mjs serve --base-dir /tmp/t3code-26464-rebase/service-b --port 27732 --host 127.0.0.1 --no-browser

Electron used --password-store=gnome-libsecret with a task-isolated D-Bus GNOME secret-service session collection.
Actual startup output: backend: gnome_libsecret
Persisted connection-catalog.json has only version and encryptedCatalog fields, 3584 bytes.
Both services enrolled through normal Add environment host/code UI. Local environment was off.

Native recording: Labs -> Sharing & access, selected A Create link with collapsed list -> new preview + Copy code; switch B -> A preview clears; create/revoke B; return A -> A link remains, credential cleared; revoke A; publish-only link A; link B; unlink A; return B still publishing; unlink B; Environments shows Local off and both connected.
Production client hooks/controllers/auth and real /api/connect handlers were unchanged.
Only external Clerk FAPI/session/account-widget and HTTPS relay responses were fixtures.
Real Clerk SDK, real server Ed25519 proofs verified at the relay fixture, invented per-service credentials.
Managed Connect switch stayed off. Publish-only linking/unlinking was exercised.
Video contains actual Electron viewport only, pauses shortened while retaining the setup and dialog and a fixture caption added.

Real-server proof commands:
node real-server-proof.mjs prepare proof-input-final.private.json
Stop/restart each captured server PID with the same base directory and port.
node real-server-proof.mjs verify-after-restart proof-input-final.private.json
Private input has only isolated loopback server credentials and is not attached.

A: GET /api/connect/link-state -> 200
A: POST /api/connect/link-proof -> 200
A: verified manual link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
A: POST /api/connect/link-proof -> 200
A: verified cloudflare_tunnel link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
A: POST /api/connect/link-proof -> 400
A: POST /api/connect/link-proof -> 401
A: POST /api/connect/relay-config -> 200
A: POST /api/connect/preferences -> 200
A: GET /api/connect/link-state -> 200
A: POST /api/connect/relay-config -> 409
A: real relay-config and preference handlers persisted six private secret files; exact values and 0600 modes verified; account mismatch rejected without mutation
B: GET /api/connect/link-state -> 200
B: POST /api/connect/link-proof -> 200
B: verified manual link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
B: POST /api/connect/link-proof -> 200
B: verified cloudflare_tunnel link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
B: POST /api/connect/link-proof -> 400
B: POST /api/connect/link-proof -> 401
B: POST /api/connect/relay-config -> 200
B: POST /api/connect/preferences -> 200
B: GET /api/connect/link-state -> 200
B: POST /api/connect/relay-config -> 409
B: real relay-config and preference handlers persisted six private secret files; exact values and 0600 modes verified; account mismatch rejected without mutation
A: GET /api/connect/link-state -> 401
B: GET /api/connect/link-state -> 401
PREPARE PASS. Stop/restart both isolated servers using their original base directories and ports, then run verify-after-restart with this same input file. No server, relay or process was mocked by this script.

A: GET /api/connect/link-state -> 200
A: POST /api/connect/link-proof -> 200
A: verified manual link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
A: restart retained linked state, publishing preference, exact relay-config secret bytes and signing key
B: GET /api/connect/link-state -> 200
B: POST /api/connect/link-proof -> 200
B: verified manual link-proof signature against persisted public key; challenge, environment, endpoint, loopback port, audience, TTL and scopes match
B: restart retained linked state, publishing preference, exact relay-config secret bytes and signing key
B: GET /api/connect/link-state -> 200
A: POST /api/connect/unlink -> 200
A: GET /api/connect/link-state -> 200
B: GET /api/connect/link-state -> 200
A: unlink removed only A's relay secrets; B's real link state and persisted bytes are unchanged
B: POST /api/connect/unlink -> 200
B: GET /api/connect/link-state -> 200
B: unlink removed B's relay secrets
VERIFY-AFTER-RESTART PASS. Real production HTTP auth, link-proof signing, configuration persistence, restart reads and selected-server unlink isolation verified. External Clerk/relay/tunnel/guest-link behavior remains unverified.

Cloud UI checkpoints:
baseline PASS: http://127.0.0.1:27731 linked=false publishing=false; http://127.0.0.1:27732 linked=false publishing=false; other service state and persisted file hashes unchanged.
link-a PASS: http://127.0.0.1:27731 linked=true publishing=true; http://127.0.0.1:27732 linked=false publishing=false; other service state and persisted file hashes unchanged.
link-b PASS: http://127.0.0.1:27731 linked=true publishing=true; http://127.0.0.1:27732 linked=true publishing=true; other service state and persisted file hashes unchanged.
unlink-a PASS: http://127.0.0.1:27731 linked=false publishing=false; http://127.0.0.1:27732 linked=true publishing=true; other service state and persisted file hashes unchanged.
unlink-b PASS: http://127.0.0.1:27731 linked=false publishing=false; http://127.0.0.1:27732 linked=false publishing=false; other service state and persisted file hashes unchanged.

Browser panel: same head primary pairing creation/revocation and collapsed preview passed.

Unverified: production Clerk login, live relay provisioning/revocation, managed connector startup, tunnel reachability and guest links through a live tunnel. No test account is available.

PR #26464 | head d86991209bf586bf1d152e6f1ae3590198f5750c
Base a185dd924889cd7f925760431a9f29b973a35e2f
Boat j_kz4jyhrkvej3ewyhzgfy | large bx_3grjdm9s | attempt 1 | exit 0
Command: vp i --frozen-lockfile; vp run check:changed "$FLEET_SOURCE_BASE"; vp run build:desktop

> vp test (8 files)  pass  21.4s

 RUN  v5.0.5 /tmp/fleet-job/j_kz4jyhrkvej3ewyhzgfy/src

 ✓  @t3tools/web (unit)  src/components/settings/ConnectionsSettings.logic.test.ts (17 tests) 5ms
 ✓  @t3tools/web (browser) (chromium)  src/components/settings/AuthorizedClientsSettings.browser.test.tsx (2 tests) 111ms
 ✓  @t3tools/client-runtime  src/state/auth.test.ts (2 tests) 3ms
 ✓  @t3tools/web (browser) (chromium)  src/cloud/useCloudLinkController.browser.test.tsx (8 tests) 196ms
stdout | unknown test
[02:00:03.182] WARN (#38): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
stdout | src/components/settings/ScheduledTasksSettings.browser.test.tsx > ScheduledTasksSettings > creates on a permitted secondary and reacts to permission changes
[02:00:03.286] WARN (#87): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
 ✓  @t3tools/client-runtime  src/state/environmentHttpAuth.test.ts (31 tests) 103ms
 ✓  @t3tools/web (unit)  src/cloud/linkEnvironment.test.ts (1 test) 41ms
stdout | src/components/settings/ScheduledTasksSettings.browser.test.tsx > ScheduledTasksSettings > keeps the permitted representative as the creation target
[02:00:03.534] WARN (#173): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
 ✓  @t3tools/web (browser) (chromium)  src/components/settings/ScheduledTasksSettings.browser.test.tsx (5 tests) 717ms
   ✓ ScheduledTasksSettings (5)
     ✓ creates on a permitted secondary and reacts to permission changes 319ms
stdout | unknown test
[02:00:06.200] WARN (#38): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
stdout | unknown test
[02:00:06.565] WARN (#173): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
stdout | unknown test
[02:00:09.232] WARN (#38): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
stdout | unknown test
[02:00:09.587] WARN (#173): Could not discover the primary environment. {
  error: [ConnectionTransientError: Remote environment endpoint returned an invalid response from http://localhost:62601/.well-known/t3/environment.],
}
 ✓  t3  src/provider/AgentContextBudget.test.ts (1 test) 75ms

 Test Files  8 passed (8)
      Tests  67 passed (67)
   Start at  01:59:52
   Duration  17.86s (transform 57%, import 20%, worker 16%, setup 5%, tests 2%)

> vp react compiler (15 files)  pass  7.5s

 RUN  v5.0.5 /tmp/fleet-job/j_kz4jyhrkvej3ewyhzgfy/src

 ✓  @t3tools/web (unit)  src/reactCompilerCoverage.test.ts (1305 tests | 1290 skipped) 137ms

 Test Files  1 passed (1)
      Tests  15 passed | 1290 skipped (1305)
   Start at  02:00:12
   Duration  5.94s (transform 66%, setup 25%, import 6%, tests 3%)

check:changed summary
  pass  unused patches  17.8s
  pass  format  0.2s
  pass  lint  0.7s
  pass  knip 1/2  5.8s
  pass  knip 2/2  12.5s
  pass  typecheck (40 packages)  27.6s
  pass  test (8 files)  21.4s
  pass  react compiler (15 files)  7.5s
  CI also runs: full test suites, build, rust, release smoke
  pass not cached: files changed during the run

Desktop build output:
✔ Build complete in 965ms

---
vp run: 5/5 successful. (Run `vp run --last-details` for full details)

Compatibility with the updated base

Live main advanced to a07be97ab0753b2b5b0caecebba69d7f872594fa. Its only overlapping PR file changes the client-runtime typecheck command to effect-tsgo tsrs --noEmit. It also refactors server signing and shares DPoP creation. Access UI, pairing commands and selected-service HTTP functions are unchanged from the head recorded above.

A clean test-only merge of PR head d86991209bf586bf1d152e6f1ae3590198f5750c and that base passed on Boat job j_72mvirsqdv22342oypju, exit 0. The new typechecker passed for 40 packages; changed-file checks passed 68 tests in 8 files and 15 selected compiler cases. The focused server auth, cloud-link and HTTP suites passed 44 tests; shared DPoP passed 2 tests. The merge was not pushed and the PR head is unchanged.

Updated-base verification commands and output

PR #26464 base compatibility, 2026-11-04
PR head: d86991209bf586bf1d152e6f1ae3590198f5750c
Live base: a07be97ab0753b2b5b0caecebba69d7f872594fa
Test-only merge: f492e863febd862a1a6caf94eddd3abac9125823
Merged tree: 88df5d56091dbf56258b4d662583246de463a293
Boat job: j_72mvirsqdv22342oypju, large bx_7hdhu7jj, attempt 1, succeeded, exit 0
No branch changes or push. The temporary merge contains the exact PR head and live base.
Only overlapping PR file: packages/client-runtime/package.json changes typecheck to effect-tsgo tsrs --noEmit.
Access UI, pairing commands and selected-service HTTP functions are unchanged from the recorded PR head.

Commands:
vp i --frozen-lockfile
vp run check:changed a07be97ab0753b2b5b0caecebba69d7f872594fa
(cd apps/server && vp test run src/cloud/http.test.ts src/cloud/CloudLink.test.ts src/auth/PairingGrantStore.test.ts src/auth/SessionStore.test.ts)
(cd packages/client-runtime && vp test run src/relay/dpopProof.test.ts)

Actual output, install and migration chatter omitted:
✓ Lockfile passes supply-chain policies (2031 entries in 14s)
 ✓  @t3tools/web (unit)  src/components/settings/ConnectionsSettings.logic.test.ts (17 tests) 9ms
 ✓  @t3tools/client-runtime  src/state/auth.test.ts (2 tests) 4ms
 ✓  @t3tools/web (browser) (chromium)  src/components/settings/AuthorizedClientsSettings.browser.test.tsx (2 tests) 117ms
 ✓  @t3tools/client-runtime  src/state/environmentHttpAuth.test.ts (31 tests) 146ms
 ✓  @t3tools/web (browser) (chromium)  src/cloud/useCloudLinkController.browser.test.tsx (8 tests) 169ms
 ✓  @t3tools/web (unit)  src/cloud/linkEnvironment.test.ts (1 test) 33ms
 ✓  @t3tools/web (browser) (chromium)  src/components/settings/ScheduledTasksSettings.browser.test.tsx (5 tests) 621ms
 ✓  t3  src/provider/AgentContextBudget.test.ts (2 tests) 92ms
 Test Files  8 passed (8)
      Tests  68 passed (68)
 ✓  @t3tools/web (unit)  src/reactCompilerCoverage.test.ts (1305 tests | 1290 skipped) 124ms
 Test Files  1 passed (1)
      Tests  15 passed | 1290 skipped (1305)
check:changed summary
  pass  unused patches  20.4s
  pass  format  0.4s
  pass  lint  1.1s
  pass  knip 1/2  10.3s
  pass  knip 2/2  19.7s
  pass  typecheck (40 packages)  23.9s
  pass  test (8 files)  22.7s
  pass  react compiler (15 files)  7.3s
  CI also runs: full test suites, build, rust, release smoke
  pass not cached: files changed during the run

 ✓ src/auth/SessionStore.test.ts (22 tests) 1291ms
 ✓ src/cloud/CloudLink.test.ts (7 tests) 58ms
 ✓ src/cloud/http.test.ts (8 tests) 434ms
 ✓ src/auth/PairingGrantStore.test.ts (7 tests) 354ms
 Test Files  4 passed (4)
      Tests  44 passed (44)
 ✓ src/relay/dpopProof.test.ts (2 tests) 44ms
 Test Files  1 passed (1)
      Tests  2 passed (2)
COMPATIBILITY PASS

Ready check compared this head with live main a07be97ab0753b2b5b0caecebba69d7f872594fa. The merge is clean. Current-head runtime evidence remains applicable to the unchanged access and cloud-link UI; the compatibility checks above cover the new base. Required checks pass and no review threads remain unresolved. Auto-merge is off and there is no merge queue entry.

Unverified live path: production Clerk login, live relay provisioning/revocation, managed connector startup, tunnel reachability, and guest links through a live tunnel. No dedicated test account is available. These external paths are not claimed by the fixture proof. Initial linking retains the server's existing loopback-origin restriction.

Implemented and rebased by Claude Opus 5.5 in Claude Code. Investigated, tested and independently reviewed by GPT-6.1 Sol in Codex through T3 Code.

[macroscopeapp]

Approvability

Verdict: Approved at 44dba53

Macroscope's review found this PR approvable — Access settings can now manage saved environments with Local environment off, using each environment's own authenticated connection. Access changes remain explicit and permission-scoped, while desktop backend controls stay restricted to the primary environment.

No code changes detected at d869912. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: a185dd9 · PR result: d869912 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: d2bc956
• Latest commit, not reviewed: d869912

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

Access settings can select an environment and use its session, permissions, and authentication commands. Cloud-link state and operations use the selected environment’s connected HTTP services. The changes also add tests and remote-access documentation.

Changes: Environment-scoped access and cloud links

Layer / File(s)	Summary
Connected-environment authentication commands packages/client-runtime/src/state/environmentHttpAuth.ts, packages/client-runtime/src/state/auth.ts, packages/client-runtime/package.json, apps/web/src/environments/primary/auth.ts, apps/web/src/environments/primary/index.ts, apps/web/src/environments/primary/sessionState.ts, apps/web/src/state/session.ts	The client runtime adds authenticated HTTP requests and pairing or client-management commands for connected environments. The primary-environment pairing, revocation, and session-state helpers are removed. Session state accepts a nullable environment ID.
Environment-scoped cloud-link state and operations apps/web/src/cloud/cloudLinkState.ts, apps/web/src/cloud/linkEnvironment.ts, apps/web/src/cloud/linkEnvironmentAtoms.ts, apps/web/src/cloud/primaryCloudLinkState.ts, apps/web/src/cloud/linkEnvironment.test.ts	Cloud-link reads and mutations use a target environment’s prepared connection. State, refresh, and cached reads are scoped to an environment. Tests check target-specific origins and bearer tokens.
Environment selection and access management apps/web/src/components/settings/ConnectionsSettings.logic.ts, apps/web/src/components/settings/ConnectionsSettings.logic.test.ts, apps/web/src/components/settings/ConnectionsSettings.tsx, apps/web/src/components/settings/AuthorizedClientsSettings.tsx, apps/web/src/components/settings/AuthorizedClientsSettings.browser.test.tsx, apps/web/src/components/settings/SettingsScopeSentence.tsx, docs/user/remote-access.md	Access settings resolve a selected environment and use its session state, permissions, and authentication commands. Pairing and client revocation target that environment. The documentation describes selecting an environment and managing a same-machine background service.
Cloud-link controls and settings integration apps/web/src/cloud/useCloudLinkController.ts, apps/web/src/cloud/useCloudLinkController.browser.test.tsx, apps/web/src/components/cloud/ConnectOnboardingDialog.tsx, apps/web/src/components/settings/SavedEnvironmentRows.tsx, apps/web/src/components/settings/ScheduledTasksSettings.tsx, apps/web/src/components/settings/useAvailableSettingsSearchItems.ts	The cloud-link controller and settings rows receive an environment ID. The onboarding dialog passes the primary environment ID.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  actor User
  participant ConnectionsSettings
  participant useEnvironmentSessionState
  participant authEnvironmentCommand
  participant ConnectedEnvironment
  User->>ConnectionsSettings: Select an environment
  ConnectionsSettings->>useEnvironmentSessionState: Read session for selected environment
  ConnectionsSettings->>authEnvironmentCommand: Create pairing credential or revoke client
  authEnvironmentCommand->>ConnectedEnvironment: Send authenticated request
  ConnectedEnvironment-->>authEnvironmentCommand: Return command result

Loading

Suggested reviewers: maria-rcks

Merge Risk: Minimal · up to d2bc9

The change lets Sharing & access work for a connected service when Local environment is off. No blocking risk was found in the reviewed changes. Signed-in T3 Connect and multi-environment selection were not exercised by the author. The T3 Connect onboarding dialog still acts on the primary environment; it behaved that way before this change.

Pre-merge checks: 3 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Description check		The description follows the repository template's sections (Problem, Change, Scope and approval, Verification) only partly. It opens with a clear problem statement and links issue #26420, so the probl…	1. Add a clear Change section. Explain how the fix works. Describe the selection of the connected environment, the picker, and the move of cloud-link and pairing commands to environment-scoped APIs. State why the changes in the web, client-…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title is concise, conventional, and accurately describes the main change: showing saved-service access when Local environment is off.
Linked Issues check		Issue #26420 is the only active directly linked target. Its coding requirement: Settings → Sharing & access must show a connected non-primary service when Local environment is off. The page must offer…
Out of Scope Changes check		The whole-PR summary (merge base d897d3f to head d2bc956) shows changes that serve #26420: - Environment selection and picker in ConnectionsSettings and resolveAccessEnvironmentId. - Environment-s…

Full details: Linked Issues check

Explanation

Issue #26420 is the only active directly linked target. Its coding requirement: Settings → Sharing & access must show a connected non-primary service when Local environment is off. The page must offer that service's settings and T3 Connect link/unlink controls, not 'No environment selected'.

Evidence at head d2bc956 (whole PR, merge base d897d3f):

• resolveAccessEnvironmentId in ConnectionsSettings.logic.ts keeps a listed explicit selection. Otherwise it uses the listed primary environment, then a connected listed environment, then the first listed environment. It returns null only when no environments exist. ConnectionsSettings.tsx offers a picker when several are listed.
• Access queries, session state, scopes, pairing, client revocation and cloud-link rows target the selected environment. SavedEnvironmentRows.tsx gives CloudLinkRow an environmentId, so the T3 Connect row renders for the selected service.
• Cloud-link requests in linkEnvironment.ts and environment-scoped commands in packages/client-runtime/src/state/auth.ts run through the selected environment's prepared connection (executeConnectedEnvironmentHttpRequest).
• The rebase adds managed-policy checks that follow the selected service. AuthorizedClientsSettings.browser.test.tsx (read at head) covers the selected service denying remote clients (pairing disabled) and an unmanaged selected service with a managed primary (pairing enabled). This matches the PR description.
• Unproven at head: signed-in T3 Connect link/unlink and guest-link creation through a live tunnel. The issue requires the UI path and environment-scoped requests, and the code provides both. Live tunnel behavior does not change this verdict. Maria's run covers saved-service access and pairing on head 286d53a. It does not cover the later rebase at d2bc956.

Full details: Out of Scope Changes check

Explanation

The whole-PR summary (merge base d897d3f to head d2bc956) shows changes that serve #26420:

• Environment selection and picker in ConnectionsSettings and resolveAccessEnvironmentId.
• Environment-scoped cloud-link state, controller and commands (cloudLinkState.ts, linkEnvironment.ts, linkEnvironmentAtoms.ts, useCloudLinkController.ts, SavedEnvironmentRows.tsx, ConnectOnboardingDialog.tsx passing the primary ID).
• Environment-scoped pairing and revocation in packages/client-runtime/src/state/auth.ts and environmentHttpAuth.ts. These replace primary-only helpers removed from apps/web/src/environments/primary/auth.ts, index.ts and sessionState.ts.
• AuthorizedClientsSettings.tsx changes: selected-environment pairing and managed-policy checks for that environment. The rebase moved policy checks from the primary to the selected service, which is part of making pairing for the selected service correct.
• Primary-only desktop network, Tailscale, WSL and onboarding controls keep the primary target. The PR description and summary state this, and it matches the issue's scope.
• Comment, import and docs updates (SettingsScopeSentence.tsx, useAvailableSettingsSearchItems.ts, ScheduledTasksSettings.tsx, docs/user/remote-access.md, the environmentHttpAuth package export) and tests for the changed behavior.
  The summary shows no server, server-authorization or native mobile changes. The rebase over PR #27197 did not add a file that the summary lists as unrelated. The server typecheck issue in AgentSessionScanner.ts, if present, is a main-branch condition and not a change of this PR.

Full details: Description check

Explanation

The description follows the repository template's sections (Problem, Change, Scope and approval, Verification) only partly. It opens with a clear problem statement and links issue #26420, so the problem is clear. The Change section is short and does not explain how the fix works across components. The Scope and approval section links only the issue. It does not show a maintainer approval comment or explain why the change qualifies without one. The Verification section is very detailed and reports the head commit, base commit, focused tests, desktop build, real-server proof, and screenshots. It also states what was not verified, including production Clerk login and live tunnel behavior. The description also says it was implemented by Claude Opus 5.5 and reviewed by GPT-6.1 Sol, which satisfies the template's agent attribution requirement.

Resolution

1. Add a clear Change section. Explain how the fix works. Describe the selection of the connected environment, the picker, and the move of cloud-link and pairing commands to environment-scoped APIs. State why the changes in the web, client-runtime, and docs files belong to the same fix. 2. Complete the Scope and approval section. Add the maintainer-approved issue or discussion link, or quote the approval comment. If no approval exists, explain why this fix qualifies as a very small, focused fix of an obvious bug. Consider that the change removes server-auth helpers and renames several public cloud-link APIs, so broader scope may need approval. 3. Trim the Verification section to the focused checks that cover the changed behavior. Keep the observed results and the unverified items. The template asks for focused checks, not a long log. 4. Keep the before and after screenshots for the UI change.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: issue-watch/26420
• File: .coderabbit.config.ts
• Commit: d2bc956
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 23a1a455-bb29-4040-8fc2-29aea7bcb8b5

Commits

Reviewing files that changed from the base of the PR and between 286d53a and d2bc956.

Files selected for processing: 5

• apps/web/src/components/cloud/ConnectOnboardingDialog.tsx
• apps/web/src/components/settings/AuthorizedClientsSettings.browser.test.tsx
• apps/web/src/components/settings/AuthorizedClientsSettings.tsx
• apps/web/src/components/settings/ConnectionsSettings.tsx
• apps/web/src/components/settings/SavedEnvironmentRows.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

Verified head 286d53a8f18ce56c9a431d0ed7bec0f79c4ec711 on a Linux Boat VM. Reproduced on github/main (8b74a69019): real Electron with Local environment off and a connected saved service showed "No environment selected" in Sharing & access. On this PR, the same saved connection shows Permissions, Authorized clients, and Create link.

Used the real dev server, Electron renderer, and repository Playwright with system Chrome. Added a real git project through the app and ran Codex gpt-6.1-sol turns on both revisions. Both read README.md through a terminal; the PR returned PR_RUNTIME_OK. No mocks or injected desktop bridge.

Created a pairing code from saved-service access, paired a fresh Chrome client, then revoked it. The client lost its connection and returned to pairing on reload. Also created/revoked an unused link and verified primary web pairing creation/revocation. Desktop-only network controls remain absent for the saved service.

Actual saved-service requests, credentials omitted:

POST http://127.0.0.1:16733/api/auth/pairing-token -> 200 bearer=true
POST http://127.0.0.1:16733/api/auth/pairing-links/revoke -> 200 bearer=true

vp run check:changed 85bd3f2a2a0ad4a8ddf2950e01db80765e9a1bf4 passed through blacksmith-check: 39 package typechecks, 65 tests across 7 files, 15 selected React compiler checks, format, lint, both knip passes, and unused patches. No code changes.

Not verified

Signed-in T3 Connect linking/unlinking, managed tunnels, and guest links require an external test account that was unavailable. Multi-environment selection was not exercised because this pass used one server. macOS, Windows, native iOS and Android were not exercised on this Linux VM.

Merge verification, 2026-11-04

Merged current main (a185dd924889) without conflicts and pushed merge commit d86991209bf586bf1d152e6f1ae3590198f5750c to this head. No feature code changed. The PR diff remains 25 files, +852/-509.

All 33 GitCafe check contexts passed; GitHub reports CLEAN and MERGEABLE. Two independent scoped code reviews found no blocker or should-fix findings. No actionable bot threads were present.

Ran vp run check:changed a185dd924889cd7f925760431a9f29b973a35e2f through blacksmith-check: format, lint, both knip passes, unused patches, 40 package typechecks, 67 tests in 8 files, and 15 selected React compiler checks passed. Worker setup needed parent history and Playwright Chromium, then the complete check passed.

Fresh real Chrome pairing and the primary Sharing & access page worked on the merged head. Real Electron launched with Local environment off. Repeating saved-service pairing was blocked by unavailable desktop secure storage; using the configured protected backend opened a keyring prompt, so verification stopped without interacting with that prompt. The earlier saved-service evidence above is from the stated earlier head and is not a fresh runtime verification of this merge commit. Signed-in T3 Connect and the other platforms remain unverified.

Harness: Codex; model: gpt-6.1-sol.

Dismissing prior approval to re-evaluate 44dba53