[Sidreyas]

Problem

One-time pairing codes typed with ASCII hyphens or spaces are rejected by the server with 401 auth_invalid, while the same code without separators works. This addresses the separator-rejection part of #4889. The case-only fix in #22089 is already merged; the separate Android false-timeout symptom is outside this change.

Change

Before the one-time pairing-link lookup, remove whitespace and ASCII hyphens only when the remaining value matches the existing generated-code alphabet and length, then use the existing uppercase canonical form. Exact desktop bootstrap matching happens first. The existing atomic consume, expiry, scope, and proof-key checks continue to apply to the canonical pairing code.

Extend the existing PairingGrantStore tests for formatted codes, invalid lengths/alphabet/separators, mixed raw/formatted concurrent consumption, proof-key and scope rejection, and exact desktop credentials.

Scope and approval

This is a small focused fix for an obvious input-formatting bug in the existing pairing capability. It changes the shared server credential boundary used by OAuth and browser-session pairing, so web, desktop, and mobile clients benefit without client or wire-contract changes. It also applies to remote connections because normalization happens on the destination server.

It does not change Android request timing or claim to close the entire issue. No competing open separator fix was found; #22089 explicitly covered case only.

Verification

Windows x64, Node 26.12.1, locked Effect 4.1.2, base 6577c6b6185167c0e502fa01f9e8e8f2dee6ff25.

• Regression added before the source change: from apps/server, vp test run src/auth/PairingGrantStore.test.ts --maxWorkers 1 failed in the four formatted-code cases, with seven controls passing. Failure: UnknownBootstrapCredentialError for an issued valid code.
• Fixed selected tests: from apps/server, vp test run src/auth/PairingGrantStore.test.ts src/provider/AgentContextBudget.test.ts --maxWorkers 1 passed all 13 tests in two files.
• vp fmt --check apps/server/src/auth/PairingGrantStore.ts apps/server/src/auth/PairingGrantStore.test.ts and vp lint with the same two paths passed.
• vp run knip:check:files and vp run knip:check:exports both passed.
• vp run --filter ./apps/server generate --check passed.
• vp run --cache --parallel --concurrency-limit 1 --filter @t3tools/evals --filter @t3tools/scripts --filter t3 typecheck passed all three affected packages.

vp run check:changed --concurrency 1 was attempted on this branch but blocked before its check stages: the ignored-input Git scan follows Windows pnpm junctions and hits the known traversal problem covered by #32023. The wrapper was stopped and is not claimed passed; its cache was not written. Every selected check was run individually with the same scope. Server tests used their owning package configuration because the root browser-project initialization selects port 62126, in this machine's Windows-excluded range; that separate problem is covered by #24007. No repository configuration or check was weakened.

Real network E2E

Ran the actual server CLI twice, before and after the fix, each with a fresh temporary data directory, isolated home and environment, and a reserved loopback port:

node apps/server/src/bin.ts serve --base-dir <fresh-directory> --host 127.0.0.1 --port <port> --no-browser --log-level debug
node apps/server/src/bin.ts auth pairing create --base-dir <same-directory> --json

The CLI-issued raw code authenticated an administrator through /oauth/token. The fixture then issued disposable read-only codes through /api/auth/pairing-token and exercised the actual HTTP handlers, persistence, authentication, and WebSocket upgrade. No provider prompt or live T3 state was used. Credentials were kept out of the transcript. Both owned server processes were stopped afterward.

Flow	Before	After
Lowercase code grouped with hyphens, OAuth	401	200 Bearer
Code grouped with spaces, OAuth	401	200 Bearer
Mixed whitespace/hyphens, OAuth	401	200 Bearer
Hyphenated code with real ES256 DPoP proofs	401	200 DPoP
Hyphenated code, browser-session cookie	401	200

Before, retrying each same issued code without separators succeeded, proving the credentials and transport were valid. After, all five formatted exchanges established authenticated sessions and returned 200 from /api/orchestration/shell; all three Bearer flows also minted WebSocket tickets and opened /ws. Reusing the original raw code returned 401 in every flow. Slash separators and an invalid alphabet remained rejected without spending a valid code.

This verifies the actual server pairing workflow over loopback HTTP. Native Android/iOS entry, Tailscale HTTPS transport, and the reported Android false timeout were not exercised; there is no changed visual surface.

Implemented with OpenAI GPT-6 via the Codex harness.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[macroscopeapp]

Approvability

Verdict: Approved at 74b1089

Macroscope's review found this PR approvable — Pairing codes now accept hyphens and whitespace without changing the underlying secret. Expiration, single-use consumption, proof-key binding and scope checks remain unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The pairing grant store now normalizes hyphens and whitespace before checking issued pairing codes. Tests cover formatted credentials, concurrent consumption, proof-key checks, and rejection of formatted desktop tokens.

Changes: Pairing code format

Layer / File(s)	Summary
Normalize pairing codes and verify consumption apps/server/src/auth/PairingGrantStore.ts, apps/server/src/auth/PairingGrantStore.test.ts	consume removes hyphens and whitespace before validating issued pairing codes. Tests check formatted credentials, concurrent consumption, proof-key handling, and desktop-token rejection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• Issue 4889 reports rejection of manually entered pairing codes with hyphens. This change accepts valid issued codes with hyphens or whitespace; the reported Android false-timeout behavior remains outside this change.

Suggested reviewers: only21mil, maria-rcks

Merge Risk: Minimal · up to 40620

Formatted pairing codes are normalized before lookup. No merge-blocking issue was established.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: accepting formatted one-time pairing codes.
Description check		The description includes all required sections. It explains the problem and change, justifies the focused scope, and reports specific tests, results, and checks that could not be run.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 934c7f8
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9d8cd1be-b5ea-4af0-ad39-8f8841fb0a12

Commits

Reviewing files that changed from the base of the PR and between 74b1089 and 40620ca.

Files selected for processing: 1

• apps/server/src/auth/PairingGrantStore.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Merged current main (merge commit, no rebase). main added MCP approval codes (AUTO-XXXXXXXXXXXX etc.) on the same line in PairingGrantStore.consume. The resolution keeps both: separators are stripped first for plain 12-character pairing codes, and anything else falls through to parseMcpApprovalCode on the raw credential, so prefixed MCP codes keep their hyphen. vp run check:changed passes, including PairingGrantStore.test.ts (11 tests).