Commit 365aa87982a4d81cc8e0c085e8d1a40ca7daecdc | the-knife

apps/mobile/src/App.tsx+2

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { PermissionUpdateNotice } from "./components/PermissionUpdateNotice";
1	import * as Linking from "expo-linking";	2	import * as Linking from "expo-linking";
2	import * as SplashScreen from "expo-splash-screen";	3	import * as SplashScreen from "expo-splash-screen";
3	import { useEffect } from "react";	4	import { useEffect } from "react";
...	@@ -75,6 +76,7 @@ function AppContent() {	...	@@ -75,6 +76,7 @@ function AppContent() {
75	<>	76	<>
76	<SplashScreenCoordinator />	77	<SplashScreenCoordinator />
77	<SubscriptionUsageCoordinator />	78	<SubscriptionUsageCoordinator />
		79	<PermissionUpdateNotice />
78	<GestureHandlerRootView className="flex-1">	80	<GestureHandlerRootView className="flex-1">
79	<KeyboardProvider statusBarTranslucent>	81	<KeyboardProvider statusBarTranslucent>
80	<SafeAreaProvider>	82	<SafeAreaProvider>

apps/mobile/src/components/PermissionUpdateNotice.tsx created+84

...	@@ -0,0 +1,84 @@
1	import { useAtomValue } from "@effect/atom-react";
2	import { sessionHasLegacyPermissions } from "@t3tools/contracts";
3	import { Atom } from "effect/reactivity";
4	import * as SecureStore from "expo-secure-store";
5	import { useEffect, useMemo, useRef, useState } from "react";
6	import { Alert } from "react-native";
7
8	import { useEnvironments } from "../state/environments";
9	import { environmentSession } from "../state/session";
10
11	const storageKey = "t3code.permission-update.v1";
12	const dismissedThisLaunch = new Set<string>();
13	const shownThisLaunch = new Set<string>();
14
15	export function PermissionUpdateNotice() {
16	const { environments } = useEnvironments();
17	const [dismissed, setDismissed] = useState<ReadonlySet<string> \| null>(null);
18	const showing = useRef(false);
19	const affected = useAtomValue(
20	useMemo(
21	() =>
22	Atom.make((get) =>
23	environments.filter(({ environmentId }) => {
24	const session = get(environmentSession.sessionStateAtom(environmentId));
25	return (
26	session._tag === "Success" &&
27	!session.waiting &&
28	sessionHasLegacyPermissions(session.value)
29	);
30	}),
31	),
32	[environments],
33	),
34	);
35
36	useEffect(() => {
37	let active = true;
38	void SecureStore.getItemAsync(storageKey)
39	.then((raw) => {
40	const value: unknown = raw === null ? [] : JSON.parse(raw);
41	if (active)
42	setDismissed(
43	new Set(
44	Array.isArray(value)
45	? value.filter((id): id is string => typeof id === "string")
46	: [],
47	),
48	);
49	})
50	.catch(() => {
51	if (active) setDismissed(new Set());
52	});
53	return () => {
54	active = false;
55	};
56	}, []);
57
58	useEffect(() => {
59	if (dismissed === null \|\| showing.current) return;
60	const environment = affected.find(
61	({ environmentId }) => !dismissed.has(environmentId) && !shownThisLaunch.has(environmentId),
62	);
63	if (!environment) return;
64	showing.current = true;
65	shownThisLaunch.add(environment.environmentId);
66	const dismiss = () => {
67	dismissedThisLaunch.add(environment.environmentId);
68	const next = new Set([...dismissed, ...dismissedThisLaunch]);
69	// Keep notices serial when several environments have old grants.
70	showing.current = false;
71	setDismissed(next);
72	void SecureStore.setItemAsync(storageKey, JSON.stringify([...next])).catch(() => {
73	// Remember for this launch even if persistent storage is unavailable.
74	});
75	};
76	Alert.alert(
77	`Permissions have changed for ${environment.label}`,
78	"This connection still uses the old permissions, so some actions may no longer be available. Pair again using a new link with the permissions you need.",
79	[{ text: "Got it", onPress: dismiss }],
80	{ cancelable: false },
81	);
82	}, [affected, dismissed]);
83	return null;
84	}

apps/mobile/src/features/settings/environment-maintenance.test.ts+27

...	@@ -76,6 +76,33 @@ describe("environment maintenance access", () => {	...	@@ -76,6 +76,33 @@ describe("environment maintenance access", () => {
76	).toBe(expected);	76	).toBe(expected);
77	});	77	});
78		78
		79	it.each([
		80	{ permissions: ["environment:maintain"], expected: true },
		81	{ permissions: ["providers:manage"], expected: false },
		82	{ permissions: [], expected: false },
		83	] as const)(
		84	"honors exact permissions over legacy scopes: $permissions",
		85	({ permissions, expected }) => {
		86	expect(
		87	canMaintainEnvironment(
		88	{
		89	authenticated: true,
		90	auth: {
		91	policy: "remote-reachable",
		92	bootstrapMethods: [],
		93	sessionMethods: [],
		94	sessionCookieName: "session",
		95	serverUpdateScope: "environment:maintain",
		96	},
		97	scopes: ["orchestration:operate"],
		98	permissions,
		99	},
		100	true,
		101	),
		102	).toBe(expected);
		103	},
		104	);
		105
79	it("requires remote desktop update support for desktop hosts", () => {	106	it("requires remote desktop update support for desktop hosts", () => {
80	expect(supportsEnvironmentUpdate({})).toBe(false);	107	expect(supportsEnvironmentUpdate({})).toBe(false);
81	expect(supportsEnvironmentUpdate({ serverSelfUpdate: "respawn" })).toBe(true);	108	expect(supportsEnvironmentUpdate({ serverSelfUpdate: "respawn" })).toBe(true);

apps/mobile/src/features/settings/environment-maintenance.ts+3-3

...	@@ -1,5 +1,6 @@	...	@@ -1,5 +1,6 @@
1	import {	1	import {
2	AuthOrchestrationOperateScope,	2	AuthEnvironmentMaintainScope,
		3	sessionGrantsScope,
3	type AuthSessionState,	4	type AuthSessionState,
4	type ExecutionEnvironmentCapabilities,	5	type ExecutionEnvironmentCapabilities,
5	type ServerProvider,	6	type ServerProvider,
...	@@ -16,8 +17,7 @@ export function canMaintainEnvironment(session: AuthSessionState \| null, connect	...	@@ -16,8 +17,7 @@ export function canMaintainEnvironment(session: AuthSessionState \| null, connect
16	return (	17	return (
17	connected &&	18	connected &&
18	session?.authenticated === true &&	19	session?.authenticated === true &&
19	session.scopes?.includes(session.auth.serverUpdateScope ?? AuthOrchestrationOperateScope) ===	20	sessionGrantsScope(session, AuthEnvironmentMaintainScope)
20	true
21	);	21	);
22	}	22	}
23		23

apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx+7-2

 @@ -4,6 +4,7 @@ import {
   DEFAULT_TERMINAL_ID,
   EnvironmentId,
   ThreadId,
+  sessionGrantsScope,
 } from "@t3tools/contracts";
 import { type KnownTerminalSession } from "@t3tools/client-runtime/state/terminal";
 import { SymbolView } from "../../components/AppSymbol";
 @@ -279,9 +280,13 @@ export function ThreadTerminalRouteScreen(props: ThreadTerminalRouteScreenProps)
   const isAuthenticated =
     terminalSession.error === null && terminalSession.data?.authenticated === true;
   const canOperateTerminal =
-    isAuthenticated && terminalSession.data?.scopes?.includes(AuthTerminalOperateScope) === true;
+    isAuthenticated &&
+    terminalSession.data !== null &&
+    sessionGrantsScope(terminalSession.data, AuthTerminalOperateScope);
   const canReadTerminal =
-    isAuthenticated && terminalSession.data?.scopes?.includes(AuthTerminalReadScope) === true;
+    isAuthenticated &&
+    terminalSession.data !== null &&
+    sessionGrantsScope(terminalSession.data, AuthTerminalReadScope);
   const environment = useEnvironmentPresentation(routeEnvironmentId);
   const isEnvironmentReady = environment.presentation?.connection.phase === "connected";
   const requestedTerminalId = firstRouteParam(params.terminalId);

apps/mobile/src/state/mediaActions.ts+4-6

 @@ -3,8 +3,9 @@ import { useNavigation } from "@react-navigation/native";
 import type { MediaActionId } from "@t3tools/client-runtime/media-actions";
 import {
   AuthFilesystemReadScope,
-  type AuthSessionState,
   type EnvironmentId,
+  sessionGrantsScope,
+  type SessionGrantInput,
 } from "@t3tools/contracts";
 import { normalizeNativeMarkdownUrl } from "@t3tools/mobile-markdown-text/links";
 import * as Option from "effect/Option";
 @@ -21,11 +22,8 @@ import { copyTextWithHaptic } from "../lib/copyTextWithHaptic";
 import { loadLocalAttachmentPreview } from "../lib/localAttachmentPreview";
 /** An explicit action may ask the server while its grant is still unresolved. */
-function allowsHostMedia(session: Pick<AuthSessionState, "authenticated" | "scopes"> | null) {
+function allowsHostMedia(session: SessionGrantInput | null) {
-  return (
+  return session === null || sessionGrantsScope(session, AuthFilesystemReadScope);
-    session === null ||
-    (session.authenticated && session.scopes?.includes(AuthFilesystemReadScope) === true)
-  );
 }
 function canReadHostMedia(environmentId: EnvironmentId | null): boolean {

apps/mobile/src/state/session.test.ts+15

...	@@ -98,3 +98,18 @@ it("reacts to grant revocation, failure, and regrant without a connection list c	...	@@ -98,3 +98,18 @@ it("reacts to grant revocation, failure, and regrant without a connection list c
98	expect(appAtomRegistry.get(observed)).toEqual(new Set([secondary]));	98	expect(appAtomRegistry.get(observed)).toEqual(new Set([secondary]));
99	expect(changes).not.toHaveLength(0);	99	expect(changes).not.toHaveLength(0);
100	});	100	});
		101
		102	it("uses exact new-server permissions and keeps old-server grants usable", () => {
		103	// A legacy representation must never override an explicitly narrowed grant.
		104	appAtomRegistry.set(source(primary), AsyncResult.success({ ...session(true), permissions: [] }));
		105	expect(useEnvironmentScope(primary, AuthOrchestrationOperateScope)).toBe(false);
		106	expect(readEnvironmentScope(primary, AuthOrchestrationOperateScope)).toBe(false);
		107	appAtomRegistry.set(
		108	source(primary),
		109	AsyncResult.success({ ...session(false), permissions: [AuthOrchestrationOperateScope] }),
		110	);
		111	expect(useEnvironmentScope(primary, AuthOrchestrationOperateScope)).toBe(true);
		112	expect(readEnvironmentScope(primary, AuthOrchestrationOperateScope)).toBe(true);
		113	appAtomRegistry.set(source(primary), AsyncResult.success(session(true)));
		114	expect(useEnvironmentScope(primary, AuthOrchestrationOperateScope)).toBe(true);
		115	});

apps/mobile/src/state/session.ts+7-6

 @@ -1,6 +1,11 @@
 import { useAtomValue } from "@effect/atom-react";
 import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";
-import type { AuthEnvironmentScope, AuthSessionState, EnvironmentId } from "@t3tools/contracts";
+import {
+  type AuthEnvironmentScope,
+  type AuthSessionState,
+  type EnvironmentId,
+  sessionGrantsScope,
+} from "@t3tools/contracts";
 import * as Option from "effect/Option";
 import { AsyncResult, Atom } from "effect/reactivity";
 import { useMemo } from "react";
 @@ -17,11 +22,7 @@ function sessionHasScope(
   scope: AuthEnvironmentScope,
 ): boolean {
   const session = Option.getOrNull(AsyncResult.value(result));
-  return (
+  return result._tag !== "Failure" && session !== null && sessionGrantsScope(session, scope);
-    result._tag !== "Failure" &&
-    session?.authenticated === true &&
-    session.scopes?.includes(scope) === true
-  );
 }
 /** Uses the selected environment's grant, including cached scopes during a refresh. */

apps/server/src/auth/EnvironmentAuth.test.ts+22-4

 @@ -1,5 +1,9 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { AuthAdministrativeScopes, AuthStandardClientScopes } from "@t3tools/contracts";
+import {
+  authScopeResponse,
+  AuthAdministrativeScopes,
+  AuthStandardClientScopes,
+} from "@t3tools/contracts";
 import { expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 @@ -102,6 +106,7 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
       const authenticated = yield* serverAuth.authenticateHttpRequest(request);
       expect(devExchange.cookieName).toMatch(/^t3_dev_session_/);
       expect(devExchange.expireNormalCookie).toBe(true);
+      expect(devExchange.response).toMatchObject(authScopeResponse(AuthAdministrativeScopes));
       expect(authenticated.scopes).toEqual(["orchestration:read"]);
     }).pipe(
       Effect.provide(
 @@ -214,6 +219,16 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
       expect(firstSession.subject).toBe("reusable-dev-token-child");
       expect(secondSession.subject).toBe("reusable-dev-token-child");
       expect((yield* sessions.verify(token)).subject).toBe("reusable-dev-token");
+      const before = yield* serverAuth.listClientSessions(firstSession.sessionId);
+      const denied = yield* serverAuth
+        .exchangeBootstrapCredentialForAccessToken(token, ["review:write"], requestMetadata)
+        .pipe(Effect.flip);
+      expect(denied._tag).toBe("ServerAuthScopeNotGrantedError");
+      const empty = yield* serverAuth
+        .exchangeBootstrapCredentialForAccessToken(token, [], requestMetadata)
+        .pipe(Effect.flip);
+      expect(empty._tag).toBe("ServerAuthScopeNotGrantedError");
+      expect(yield* serverAuth.listClientSessions(firstSession.sessionId)).toEqual(before);
     }).pipe(
       Effect.provide(
         layerEnvironmentAuth({
 @@ -241,7 +256,7 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
       expect((yield* Effect.flip(sessions.verify(token)))._tag).toBe("SessionTokenRevokedError");
       expect(
         (yield* serverAuth.createBrowserSession(recovery.credential, requestMetadata)).response,
-      ).toMatchObject({ authenticated: true, scopes: AuthAdministrativeScopes });
+      ).toMatchObject({ authenticated: true, ...authScopeResponse(AuthAdministrativeScopes) });
     }).pipe(
       Effect.provide(
         layerEnvironmentAuth({
 @@ -355,7 +370,7 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
       const error = yield* serverAuth
         .exchangeBootstrapCredentialForAccessToken(
           pairingCredential.credential,
-          ["orchestration:read", "access:write"],
+          ["access:write"],
           requestMetadata,
         )
         .pipe(Effect.flip);
 @@ -393,7 +408,10 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
   it.effect.each([
     { label: "omits scope", requestedScopes: undefined },
-    { label: "requests no scopes", requestedScopes: [] },
+    {
+      label: "requests unsupported permissions alongside a granted one",
+      requestedScopes: ["orchestration:read", "access:write"] as const,
+    },
   ])("inherits a constrained pairing grant when token exchange $label", ({ requestedScopes }) =>
     Effect.gen(function* () {
       const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;

apps/server/src/auth/EnvironmentAuth.ts+14-6

 @@ -16,6 +16,7 @@ import {
   type AuthPairingCredentialResult,
   type AuthSessionId,
   type AuthSessionState,
+  authScopeResponse,
   type ServerAuthDescriptor,
   type ServerAuthSessionMethod,
   type AuthWebSocketTicketResult,
 @@ -773,7 +774,7 @@ export const make = Effect.gen(function* () {
           ({
             authenticated: true,
             auth: descriptor,
-            scopes: session.scopes,
+            ...authScopeResponse(session.scopes),
             sessionMethod: session.method,
             ...(session.expiresAt ? { expiresAt: DateTime.toUtc(session.expiresAt) } : {}),
           }) satisfies AuthSessionState,
 @@ -800,7 +801,7 @@ export const make = Effect.gen(function* () {
                 ({
                   response: {
                     authenticated: true,
-                    scopes: session.scopes,
+                    ...authScopeResponse(session.scopes),
                     sessionMethod: session.method,
                     expiresAt: DateTime.toUtc(DateTime.add(now, { days: 30 })),
                   } satisfies AuthBrowserSessionResult,
 @@ -841,7 +842,7 @@ export const make = Effect.gen(function* () {
     return {
       response: {
         authenticated: true,
-        scopes: session.scopes,
+        ...authScopeResponse(session.scopes),
         sessionMethod: session.method,
         expiresAt: DateTime.toUtc(session.expiresAt),
       } satisfies AuthBrowserSessionResult,
 @@ -890,15 +891,20 @@ export const make = Effect.gen(function* () {
   };
   const exchangeBootstrapCredentialForAccessToken: EnvironmentAuth["Service"]["exchangeBootstrapCredentialForAccessToken"] =
-    (credential, requestedScopesInput, requestMetadata, input) => {
+    (credential, requestedScopes, requestMetadata, input) => {
-      const requestedScopes = requestedScopesInput?.length ? requestedScopesInput : undefined;
       return resolveBootstrapGrant(credential, {
         ...input,
         ...(requestedScopes !== undefined ? { requestedScopes } : {}),
       }).pipe(
         Effect.flatMap((grant) =>
           Effect.gen(function* () {
-            const grantedScopes = requestedScopes ?? grant.scopes;
+            const grantedScopes =
+              requestedScopes === undefined
+                ? grant.scopes
+                : [...new Set(requestedScopes)].filter((scope) => grant.scopes.includes(scope));
+            if (grantedScopes.length === 0) {
+              return yield* new ServerAuthScopeNotGrantedError({});
+            }
             return yield* sessions
               .issue({
                 method: input?.proofKeyThumbprint ? "dpop-access-token" : "bearer-access-token",
 @@ -1005,6 +1011,7 @@ export const make = Effect.gen(function* () {
         ];
         return pairingLinks
           .filter((pairingLink) => !excludedSubjects.includes(pairingLink.subject))
+          .map((link) => ({ ...link, ...authScopeResponse(link.scopes) }))
           .toSorted(
             (left, right) => right.createdAt.epochMilliseconds - left.createdAt.epochMilliseconds,
           );
 @@ -1110,6 +1117,7 @@ export const make = Effect.gen(function* () {
       Effect.map((clientSessions) =>
         clientSessions.map((clientSession): AuthClientSession => ({
           ...clientSession,
+          ...authScopeResponse(clientSession.scopes),
           current: clientSession.sessionId === currentSessionId,
         })),
       ),

apps/server/src/auth/PairingGrantStore.ts+8-2

 @@ -504,7 +504,10 @@ export const make = Effect.gen(function* () {
             ];
           }
-          if (input?.requestedScopes?.some((scope) => !grant.scopes.includes(scope))) {
+          if (
+            input?.requestedScopes !== undefined &&
+            !input.requestedScopes.some((scope) => grant.scopes.includes(scope))
+          ) {
             return [
               {
                 _tag: "error",
 @@ -608,7 +611,10 @@ export const make = Effect.gen(function* () {
         return yield* new BootstrapCredentialProofKeyMismatchError({});
       }
-      if (input?.requestedScopes?.some((scope) => !matching.value.scopes.includes(scope))) {
+      if (
+        input?.requestedScopes !== undefined &&
+        !input.requestedScopes.some((scope) => matching.value.scopes.includes(scope))
+      ) {
         return yield* new BootstrapCredentialScopeNotGrantedError({});
       }

apps/server/src/auth/RpcAuthorization.test.ts+8-5

...	@@ -247,7 +247,7 @@ describe("RPC scope middleware", () => {	...	@@ -247,7 +247,7 @@ describe("RPC scope middleware", () => {
247	yield* client[WS_METHODS.serverRetryResourceTelemetry]({}).pipe(Effect.flip),	247	yield* client[WS_METHODS.serverRetryResourceTelemetry]({}).pipe(Effect.flip),
248	).toMatchObject({	248	).toMatchObject({
249	_tag: "EnvironmentAuthorizationError",	249	_tag: "EnvironmentAuthorizationError",
250	requiredScope: missing,	250	requiredPermission: missing,
251	});	251	});
252	expect(handled).toEqual([]);	252	expect(handled).toEqual([]);
253	}).pipe(Effect.scoped),	253	}).pipe(Effect.scoped),
...	@@ -291,7 +291,7 @@ describe("settings mutation authorization", () => {	...	@@ -291,7 +291,7 @@ describe("settings mutation authorization", () => {
291	patch: { defaultRuntimeMode: "full-access" },	291	patch: { defaultRuntimeMode: "full-access" },
292	providerInstanceMutation,	292	providerInstanceMutation,
293	}).pipe(Effect.flip),	293	}).pipe(Effect.flip),
294	).toMatchObject({ requiredScope: AuthSettingsWriteScope });	294	).toMatchObject({ requiredPermission: AuthSettingsWriteScope });
295	expect(handled).toBe(1);	295	expect(handled).toBe(1);
296	}).pipe(Effect.scoped),	296	}).pipe(Effect.scoped),
297	);	297	);
...	@@ -317,7 +317,7 @@ describe("settings mutation authorization", () => {	...	@@ -317,7 +317,7 @@ describe("settings mutation authorization", () => {
317	patch: {},	317	patch: {},
318	providerInstanceMutation,	318	providerInstanceMutation,
319	}).pipe(Effect.flip),	319	}).pipe(Effect.flip),
320	).toMatchObject({ requiredScope: AuthProvidersManageScope });	320	).toMatchObject({ requiredPermission: AuthProvidersManageScope });
321	expect(handled).toBe(false);	321	expect(handled).toBe(false);
322	}).pipe(Effect.scoped),	322	}).pipe(Effect.scoped),
323	);	323	);
...	@@ -355,7 +355,7 @@ it.effect("requires task permission before attaching a prepared worktree to a th	...	@@ -355,7 +355,7 @@ it.effect("requires task permission before attaching a prepared worktree to a th
355	mode: "worktree",	355	mode: "worktree",
356	threadId: ThreadId.make("thread"),	356	threadId: ThreadId.make("thread"),
357	}).pipe(Effect.flip),	357	}).pipe(Effect.flip),
358	).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });	358	).toMatchObject({ requiredPermission: AuthOrchestrationOperateScope });
359	expect(handled).toBe(false);	359	expect(handled).toBe(false);
360	}).pipe(Effect.scoped),	360	}).pipe(Effect.scoped),
361	);	361	);
...	@@ -394,7 +394,10 @@ it.effect("separates host file URLs from readable attachment URLs", () =>	...	@@ -394,7 +394,10 @@ it.effect("separates host file URLs from readable attachment URLs", () =>
394	] as const) {	394	] as const) {
395	expect(	395	expect(
396	yield* client[WS_METHODS.assetsCreateUrl]({ resource }).pipe(Effect.flip),	396	yield* client[WS_METHODS.assetsCreateUrl]({ resource }).pipe(Effect.flip),
397	).toMatchObject({ requiredScope: AuthFilesystemReadScope });	397	).toMatchObject({
		398	requiredScope: AuthOrchestrationReadScope,
		399	requiredPermission: AuthFilesystemReadScope,
		400	});
398	}	401	}
399	expect(handled).toBe(1);	402	expect(handled).toBe(1);
400	}).pipe(Effect.scoped),	403	}).pipe(Effect.scoped),

apps/server/src/auth/RpcAuthorization.ts+2-1

...	@@ -2,6 +2,7 @@ import {	...	@@ -2,6 +2,7 @@ import {
2	CLIENT_GUARDED_RPC_SCOPES,	2	CLIENT_GUARDED_RPC_SCOPES,
3	type DeviceListInput,	3	type DeviceListInput,
4	clientRpcRequiredScopes,	4	clientRpcRequiredScopes,
		5	authScopeRequiredResponse,
5	AssetCreateUrlInput,	6	AssetCreateUrlInput,
6	AuthAccessReadScope,	7	AuthAccessReadScope,
7	ServerSettingsPatch,	8	ServerSettingsPatch,
...	@@ -213,7 +214,7 @@ export function requiredScopeForRpcMethod(method: string): AuthEnvironmentScope	...	@@ -213,7 +214,7 @@ export function requiredScopeForRpcMethod(method: string): AuthEnvironmentScope
213	export const rpcAuthorizationError = (requiredScope: AuthEnvironmentScope) =>	214	export const rpcAuthorizationError = (requiredScope: AuthEnvironmentScope) =>
214	new EnvironmentAuthorizationError({	215	new EnvironmentAuthorizationError({
215	message: `The authenticated token is missing required scope: ${requiredScope}.`,	216	message: `The authenticated token is missing required scope: ${requiredScope}.`,
216	requiredScope,	217	...authScopeRequiredResponse(requiredScope),
217	});	218	});
218		219
219	const SettingsUpdate = Schema.Struct({	220	const SettingsUpdate = Schema.Struct({

apps/server/src/auth/SessionStore.test.ts+29

...	@@ -20,6 +20,7 @@ import * as SqlitePersistence from "../persistence/Sqlite.ts";	...	@@ -20,6 +20,7 @@ import * as SqlitePersistence from "../persistence/Sqlite.ts";
20	import * as AuthSessions from "../persistence/AuthSessions.ts";	20	import * as AuthSessions from "../persistence/AuthSessions.ts";
21	import * as SessionStore from "./SessionStore.ts";	21	import * as SessionStore from "./SessionStore.ts";
22	import * as ServerSecretStore from "./ServerSecretStore.ts";	22	import * as ServerSecretStore from "./ServerSecretStore.ts";
		23	import { base64UrlDecodeUtf8, base64UrlEncode, signPayload } from "./utils.ts";
23		24
24	const layerServerConfig = (overrides?: Partial<ServerConfig.ServerConfig["Service"]>) =>	25	const layerServerConfig = (overrides?: Partial<ServerConfig.ServerConfig["Service"]>) =>
25	Layer.effect(	26	Layer.effect(
...	@@ -290,6 +291,34 @@ it.layer(NodeServices.layer)("SessionStore.layer", (it) => {	...	@@ -290,6 +291,34 @@ it.layer(NodeServices.layer)("SessionStore.layer", (it) => {
290	expect((yield* sessions.verify(uncapped.token)).runtimeModeCeiling).toBeUndefined();	291	expect((yield* sessions.verify(uncapped.token)).runtimeModeCeiling).toBeUndefined();
291	}).pipe(Effect.provide(layerSessionStore())),	292	}).pipe(Effect.provide(layerSessionStore())),
292	);	293	);
		294	it.effect("keeps recorded scopes unchanged for both token versions", () =>
		295	Effect.gen(function* () {
		296	const sessions = yield* SessionStore.SessionStore;
		297	const secrets = yield* ServerSecretStore.ServerSecretStore;
		298	const legacyScopes = ["orchestration:read", "terminal:operate", "review:write"] as const;
		299	const issued = yield* sessions.issue({ subject: "one-time-token", scopes: legacyScopes });
		300	// Accept prerelease v2 credentials without widening their recorded grant.
		301	const [encodedPayload] = issued.token.split(".");
		302	const currentClaims = base64UrlDecodeUtf8(encodedPayload!);
		303	expect(currentClaims).toContain('"v":1');
		304	const legacyPayload = base64UrlEncode(currentClaims.replace('"v":1', '"v":2'));
		305	const secret = yield* secrets.getOrCreateRandom("server-signing-key", 32);
		306	const legacyToken = `${legacyPayload}.${signPayload(legacyPayload, secret)}`;
		307
		308	expect((yield* sessions.verify(issued.token)).scopes).toEqual(legacyScopes);
		309	expect((yield* sessions.verify(legacyToken)).scopes).toEqual(legacyScopes);
		310	}).pipe(
		311	Effect.provide(
		312	SessionStore.layer.pipe(
		313	Layer.provideMerge(ServerSecretStore.layer),
		314	Layer.provide(SqlitePersistence.layerMemory),
		315	Layer.provide(layerServerEnvironment(EnvironmentId.make("test-environment"))),
		316	Layer.provide(layerServerConfig()),
		317	),
		318	),
		319	),
		320	);
		321
293	it.effect("rejects malformed session tokens", () =>	322	it.effect("rejects malformed session tokens", () =>
294	Effect.gen(function* () {	323	Effect.gen(function* () {
295	const sessions = yield* SessionStore.SessionStore;	324	const sessions = yield* SessionStore.SessionStore;

apps/server/src/auth/SessionStore.ts+2-1

...	@@ -428,8 +428,9 @@ export class SessionStore extends Context.Service<	...	@@ -428,8 +428,9 @@ export class SessionStore extends Context.Service<
428	const SIGNING_SECRET_NAME = "server-signing-key";	428	const SIGNING_SECRET_NAME = "server-signing-key";
429	const DEFAULT_SESSION_TTL = Duration.days(30);	429	const DEFAULT_SESSION_TTL = Duration.days(30);
430	const DEFAULT_WEBSOCKET_TOKEN_TTL = Duration.minutes(5);	430	const DEFAULT_WEBSOCKET_TOKEN_TTL = Duration.minutes(5);
		431
431	const SessionClaims = Schema.Struct({	432	const SessionClaims = Schema.Struct({
432	v: Schema.Literal(1),	433	v: Schema.Literals([1, 2]),
433	kind: Schema.Literal("session"),	434	kind: Schema.Literal("session"),
434	sid: AuthSessionId,	435	sid: AuthSessionId,
435	sub: Schema.String,	436	sub: Schema.String,

apps/server/src/auth/http.test.ts+19

...	@@ -1,6 +1,9 @@	...	@@ -1,6 +1,9 @@
1	import * as NodeServices from "@effect/platform-node/NodeServices";	1	import * as NodeServices from "@effect/platform-node/NodeServices";
2	import {	2	import {
3	AuthSessionId,	3	AuthSessionId,
		4	AuthTokenExchangeGrantType,
		5	AuthEnvironmentBootstrapTokenType,
		6	AuthAccessTokenType,
4	EnvironmentAuthenticatedAuth,	7	EnvironmentAuthenticatedAuth,
5	EnvironmentHttpApi,	8	EnvironmentHttpApi,
6	} from "@t3tools/contracts";	9	} from "@t3tools/contracts";
...	@@ -100,6 +103,22 @@ it.effect("sets the selected browser session cookies through the HTTP route", ()	...	@@ -100,6 +103,22 @@ it.effect("sets the selected browser session cookies through the HTTP route", ()
100	requestContext,	103	requestContext,
101	);	104	);
102	expect(devResponse.status).toBe(200);	105	expect(devResponse.status).toBe(200);
		106	const retiredScopeResponse = await environmentA.handler(
		107	new Request("http://127.0.0.1/oauth/token", {
		108	method: "POST",
		109	body: new URLSearchParams({
		110	grant_type: AuthTokenExchangeGrantType,
		111	subject_token: DEV_TOKEN,
		112	subject_token_type: AuthEnvironmentBootstrapTokenType,
		113	requested_token_type: AuthAccessTokenType,
		114	scope: "review:write",
		115	}),
		116	}),
		117	requestContext,
		118	);
		119	expect(retiredScopeResponse.status).toBe(400);
		120	expect(await retiredScopeResponse.json()).toMatchObject({ reason: "invalid_scope" });
		121
103	const devCookies = devResponse.headers.getSetCookie();	122	const devCookies = devResponse.headers.getSetCookie();
104	const devCookie = devCookies.find((cookie) => cookie.startsWith("t3_dev_session_"));	123	const devCookie = devCookies.find((cookie) => cookie.startsWith("t3_dev_session_"));
105	expect(devCookie).toContain("HttpOnly");	124	expect(devCookie).toContain("HttpOnly");

apps/server/src/auth/http.ts+7-7

 @@ -1,4 +1,5 @@
 import {
+  authScopeRequiredResponse,
   AuthAccessReadScope,
   AuthAccessWriteScope,
   AuthStandardClientScopes,
 @@ -18,11 +19,13 @@ import {
   EnvironmentAuthenticatedPrincipal,
 } from "@t3tools/contracts";
 import type { AuthEnvironmentScope, DpopFailureReason } from "@t3tools/contracts";
-import { parseAllowedOAuthScope } from "@t3tools/shared/oauthScope";
+import { parseOAuthScope } from "@t3tools/shared/oauthScope";
 import { causeErrorTag } from "@t3tools/shared/observability";
 import * as Clock from "effect/Clock";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { identity } from "effect/Function";
 import * as Layer from "effect/Layer";
 import * as Cookies from "effect/http/Cookies";
 import * as HttpEffect from "effect/http/HttpEffect";
 @@ -122,7 +125,7 @@ export function failEnvironmentScopeRequired(requiredScope: AuthEnvironmentScope
       Effect.fail(
         new EnvironmentScopeRequiredError({
           code: "insufficient_scope",
-          requiredScope,
+          ...authScopeRequiredResponse(requiredScope),
           traceId,
         }),
       ),
 @@ -356,11 +359,8 @@ export const layer = HttpApiBuilder.group(
             const requestedScopes =
               args.payload.scope === undefined
                 ? undefined
-                : parseAllowedOAuthScope({
+                : (parseOAuthScope(args.payload.scope)?.filter(Schema.is(AuthGrantScope)) ?? null);
-                    value: args.payload.scope,
+            if (requestedScopes === null || requestedScopes?.length === 0) {
-                    allowedScopes: new Set(AuthGrantScope.literals),
-                  });
-            if (requestedScopes === null) {
               return yield* failEnvironmentInvalidRequest("invalid_scope");
             }
             const proofKeyThumbprint = args.headers.dpop

apps/server/src/cliAuthFormat.ts+2-2

...	@@ -77,7 +77,7 @@ export function formatPairingCredentialList(	...	@@ -77,7 +77,7 @@ export function formatPairingCredentialList(
77	credentials.map((credential) => ({	77	credentials.map((credential) => ({
78	id: credential.id,	78	id: credential.id,
79	...(credential.label ? { label: credential.label } : {}),	79	...(credential.label ? { label: credential.label } : {}),
80	scopes: credential.scopes,	80	scopes: credential.permissions ?? credential.scopes,
81	createdAt: toIsoString(credential.createdAt),	81	createdAt: toIsoString(credential.createdAt),
82	expiresAt: toIsoString(credential.expiresAt),	82	expiresAt: toIsoString(credential.expiresAt),
83	})),	83	})),
...	@@ -95,7 +95,7 @@ export function formatPairingCredentialList(	...	@@ -95,7 +95,7 @@ export function formatPairingCredentialList(
95	.map((credential) =>	95	.map((credential) =>
96	[	96	[
97	`${credential.id}${credential.label ? ` (${credential.label})` : ""}`,	97	`${credential.id}${credential.label ? ` (${credential.label})` : ""}`,
98	` scopes: ${credential.scopes.join(" ")}`,	98	` scopes: ${(credential.permissions ?? credential.scopes).join(" ")}`,
99	` created: ${toIsoString(credential.createdAt)}`,	99	` created: ${toIsoString(credential.createdAt)}`,
100	` expires: ${toIsoString(credential.expiresAt)}`,	100	` expires: ${toIsoString(credential.expiresAt)}`,
101	].join(newline),	101	].join(newline),

apps/server/src/persistence/AuthPairingLinks.ts+3-3

...	@@ -172,13 +172,13 @@ export const make = Effect.gen(function* () {	...	@@ -172,13 +172,13 @@ export const make = Effect.gen(function* () {
172	proof_key_thumbprint IS NULL	172	proof_key_thumbprint IS NULL
173	OR proof_key_thumbprint = ${proofKeyThumbprint}	173	OR proof_key_thumbprint = ${proofKeyThumbprint}
174	)	174	)
175	AND NOT EXISTS (	175	AND (${requestedScopes === undefined} OR EXISTS (
176	SELECT 1	176	SELECT 1
177	FROM json_each(${JSON.stringify(requestedScopes ?? [])}) AS requested	177	FROM json_each(${JSON.stringify(requestedScopes ?? [])}) AS requested
178	WHERE requested.value NOT IN (	178	WHERE requested.value IN (
179	SELECT value FROM json_each(auth_pairing_links.scopes)	179	SELECT value FROM json_each(auth_pairing_links.scopes)
180	)	180	)
181	)	181	))
182	RETURNING	182	RETURNING
183	id AS "id",	183	id AS "id",
184	credential AS "credential",	184	credential AS "credential",

apps/server/src/ws.ts+3-1

...	@@ -24,6 +24,7 @@ import {	...	@@ -24,6 +24,7 @@ import {
24	DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL,	24	DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL,
25	AcpRegistryOperationError,	25	AcpRegistryOperationError,
26	CommandId,	26	CommandId,
		27	authScopeResponse,
27	AuthAccessStreamError,	28	AuthAccessStreamError,
28	type AuthAccessStreamEvent,	29	type AuthAccessStreamEvent,
29	AuthOrchestrationOperateScope,	30	AuthOrchestrationOperateScope,
...	@@ -561,7 +562,7 @@ function toAuthAccessStreamEvent(	...	@@ -561,7 +562,7 @@ function toAuthAccessStreamEvent(
561	version: 1,	562	version: 1,
562	revision,	563	revision,
563	type: "pairingLinkUpserted",	564	type: "pairingLinkUpserted",
564	payload: change.pairingLink,	565	payload: { ...change.pairingLink, ...authScopeResponse(change.pairingLink.scopes) },
565	};	566	};
566	case "pairingLinkRemoved":	567	case "pairingLinkRemoved":
567	return {	568	return {
...	@@ -577,6 +578,7 @@ function toAuthAccessStreamEvent(	...	@@ -577,6 +578,7 @@ function toAuthAccessStreamEvent(
577	type: "clientUpserted",	578	type: "clientUpserted",
578	payload: {	579	payload: {
579	...change.clientSession,	580	...change.clientSession,
		581	...authScopeResponse(change.clientSession.scopes),
580	current: change.clientSession.sessionId === currentSessionId,	582	current: change.clientSession.sessionId === currentSessionId,
581	},	583	},
582	};	584	};

apps/web/src/components/PermissionUpdateNotice.test.tsx created+111

...	@@ -0,0 +1,111 @@
1	import { act, create, type ReactTestRenderer } from "react-test-renderer";
2	import { beforeEach, afterEach, expect, it, vi } from "vite-plus/test";
3
4	const state = vi.hoisted(() => ({
5	id: 0,
6	saved: false,
7	session: {
8	_tag: "Success",
9	waiting: false,
10	value: { authenticated: true, permissions: ["orchestration:operate"] },
11	},
12	add: vi.fn((_notice: unknown) => "notice"),
13	close: vi.fn(),
14	save: vi.fn(),
15	navigate: vi.fn(),
16	}));
17	vi.mock("@effect/atom-react", () => ({ useAtomValue: () => state.session }));
18	vi.mock("@tanstack/react-router", () => ({ useNavigate: () => state.navigate }));
19	vi.mock("../state/environments", () => ({
20	useEnvironments: () => ({
21	environments: [{ environmentId: `env-${state.id}`, label: "Work laptop" }],
22	}),
23	}));
24	vi.mock("../state/session", () => ({ environmentSession: { sessionStateAtom: () => null } }));
25	vi.mock("../hooks/useLocalStorage", () => ({
26	getLocalStorageItem: () => state.saved,
27	setLocalStorageItem: (...args: unknown[]) => state.save(...args),
28	}));
29	vi.mock("./ui/toast", () => ({ toastManager: { add: state.add, close: state.close } }));
30	import { PermissionUpdateNotice } from "./PermissionUpdateNotice";
31
32	let renderer: ReactTestRenderer;
33	beforeEach(() => {
34	state.id++;
35	state.saved = false;
36	state.session = {
37	_tag: "Success",
38	waiting: false,
39	value: { authenticated: true, permissions: ["orchestration:operate"] },
40	};
41	vi.clearAllMocks();
42	});
43	afterEach(async () => {
44	if (renderer) await act(async () => renderer.unmount());
45	});
46	async function render() {
47	await act(async () => {
48	renderer = create(<PermissionUpdateNotice />);
49	});
50	}
51
52	it("keeps the notice visible and persists dismissal, with a route to pairing settings", async () => {
53	await render();
54	const notice = state.add.mock.calls[0]![0] as unknown as {
55	timeout: number;
56	onClose: () => void;
57	actionProps: { onClick: () => void };
58	};
59	expect(notice.timeout).toBe(0);
60	expect(state.save).not.toHaveBeenCalled();
61	notice.actionProps.onClick();
62	expect(state.navigate).toHaveBeenCalledWith({ to: "/settings/connections" });
63	expect(state.close).toHaveBeenCalledWith("notice");
64	expect(state.save).toHaveBeenCalledWith(
65	`t3code:permission-update:v1:env-${state.id}`,
66	true,
67	expect.anything(),
68	);
69	});
70	it("does not repeat on session refresh or remount", async () => {
71	await render();
72	await act(async () => renderer.unmount());
73	state.session = { ...state.session };
74	await render();
75	expect(state.add).toHaveBeenCalledTimes(1);
76	});
77	it("skips a notice dismissed on an earlier launch", async () => {
78	state.saved = true;
79	await render();
80	expect(state.add).not.toHaveBeenCalled();
81	});
82	it("waits for a successful, settled session check", async () => {
83	state.session._tag = "Failure";
84	await render();
85	expect(state.add).not.toHaveBeenCalled();
86	state.session = { ...state.session, _tag: "Success", waiting: true };
87	await act(async () => renderer.update(<PermissionUpdateNotice />));
88	expect(state.add).not.toHaveBeenCalled();
89	state.session = { ...state.session, waiting: false };
90	await act(async () => renderer.update(<PermissionUpdateNotice />));
91	expect(state.add).toHaveBeenCalledTimes(1);
92	});
93	it("does not warn for a granular grant", async () => {
94	state.session.value.permissions.push("filesystem:read");
95	await render();
96	expect(state.add).not.toHaveBeenCalled();
97	});
98
99	it("persists the secondary dismissal without relying on the toast close callback", async () => {
100	await render();
101	const notice = state.add.mock.calls[0]![0] as {
102	data: { secondaryActionProps: { onClick: () => void } };
103	};
104	notice.data.secondaryActionProps.onClick();
105	expect(state.save).toHaveBeenCalledWith(
106	`t3code:permission-update:v1:env-${state.id}`,
107	true,
108	expect.anything(),
109	);
110	expect(state.close).toHaveBeenCalledWith("notice");
111	});

apps/web/src/components/PermissionUpdateNotice.tsx created+78

...	@@ -0,0 +1,78 @@
1	import { useAtomValue } from "@effect/atom-react";
2	import { sessionHasLegacyPermissions, type EnvironmentId } from "@t3tools/contracts";
3	import { useNavigate } from "@tanstack/react-router";
4	import * as Schema from "effect/Schema";
5	import { useEffect } from "react";
6
7	import { getLocalStorageItem, setLocalStorageItem } from "../hooks/useLocalStorage";
8	import { useEnvironments } from "../state/environments";
9	import { environmentSession } from "../state/session";
10	import { toastManager } from "./ui/toast";
11
12	// Keep an active toast across remounts, including Strict Mode effect replay.
13	const shown = new Set<EnvironmentId>();
14
15	function EnvironmentPermissionNotice({
16	environmentId,
17	label,
18	}: {
19	environmentId: EnvironmentId;
20	label: string;
21	}) {
22	const session = useAtomValue(environmentSession.sessionStateAtom(environmentId));
23	const navigate = useNavigate();
24	useEffect(() => {
25	if (
26	session._tag !== "Success" \|\|
27	session.waiting \|\|
28	!sessionHasLegacyPermissions(session.value)
29	)
30	return;
31	if (shown.has(environmentId)) return;
32	const key = `t3code:permission-update:v1:${environmentId}`;
33	try {
34	if (getLocalStorageItem(key, Schema.Boolean)) return;
35	} catch {
36	// An unavailable store must not prevent the notice.
37	}
38	shown.add(environmentId);
39	const persistDismissal = () => {
40	try {
41	setLocalStorageItem(key, true, Schema.Boolean);
42	} catch {
43	// The in-memory marker still prevents repeats during this launch.
44	}
45	};
46	const dismiss = () => {
47	persistDismissal();
48	toastManager.close(id);
49	};
50	const id = toastManager.add({
51	title: `Permissions have changed for ${label}`,
52	description:
53	"This connection still uses the old permissions, so some actions may no longer be available. Pair again using a new link with the permissions you need.",
54	timeout: 0,
55	onClose: persistDismissal,
56	actionProps: {
57	children: "Open Connections",
58	onClick: () => {
59	dismiss();
60	void navigate({ to: "/settings/connections" });
61	},
62	},
63	data: {
64	actionLayout: "stacked-end",
65	secondaryActionProps: { children: "Dismiss", onClick: dismiss },
66	secondaryActionVariant: "ghost",
67	},
68	});
69	}, [environmentId, label, navigate, session]);
70	return null;
71	}
72
73	export function PermissionUpdateNotice() {
74	const { environments } = useEnvironments();
75	return environments.map(({ environmentId, label }) => (
76	<EnvironmentPermissionNotice key={environmentId} environmentId={environmentId} label={label} />
77	));
78	}

apps/web/src/components/ServerUpdateAction.tsx+6-8

 @@ -1,5 +1,9 @@
 import { useAtomValue } from "@effect/atom-react";
-import { AuthOrchestrationOperateScope, type AuthSessionState } from "@t3tools/contracts";
+import {
+  AuthEnvironmentMaintainScope,
+  type AuthSessionState,
+  sessionGrantsScope,
+} from "@t3tools/contracts";
 import type { AsyncResult } from "effect/reactivity";
 import { environmentSession } from "~/state/session";
 import type {
 @@ -162,13 +166,7 @@ export function ServerUpdatesAction({
 function canUpdateServer(result: AsyncResult.AsyncResult<AuthSessionState, unknown>): boolean {
   if (result._tag !== "Success" || !result.value.authenticated) return false;
-  const session = result.value;
+  return sessionGrantsScope(result.value, AuthEnvironmentMaintainScope);
-  // Only self-update bridges the old authorization protocol. Upgraded servers
-  // advertise the new scope even when this client's grant predates it.
-  return (
-    session.scopes?.includes(session.auth.serverUpdateScope ?? AuthOrchestrationOperateScope) ===
-    true
-  );
 }
 /**

apps/web/src/components/media/MediaActions.tsx+4-5

 @@ -11,6 +11,8 @@ import {
   type AuthSessionState,
   type ContextMenuItem,
   type EnvironmentId,
+  sessionGrantsScope,
+  type SessionGrantInput,
 } from "@t3tools/contracts";
 import * as Option from "effect/Option";
 import { AsyncResult } from "effect/reactivity";
 @@ -43,11 +45,8 @@ function mediaFileName(source: MediaActionSource): string {
 }
 /** An explicit action may ask the server while its grant is still unresolved. */
-function allowsHostMedia(session: Pick<AuthSessionState, "authenticated" | "scopes"> | null) {
+function allowsHostMedia(session: SessionGrantInput | null) {
-  return (
+  return session === null || sessionGrantsScope(session, AuthFilesystemReadScope);
-    session === null ||
-    (session.authenticated && session.scopes?.includes(AuthFilesystemReadScope) === true)
-  );
 }
 function canReadHostMedia(environmentId: EnvironmentId | null): boolean {

apps/web/src/components/settings/ConnectionsSettings.tsx+3-1

apps/web/src/components/settings/ProviderSettingsPanel.logic.test.ts+15-1

...	@@ -231,12 +231,26 @@ describe("remote operate access", () => {	...	@@ -231,12 +231,26 @@ describe("remote operate access", () => {
231	it("does not treat the old orchestration grant as provider management", () => {	231	it("does not treat the old orchestration grant as provider management", () => {
232	expect(	232	expect(
233	resolveRemoteOperateAccess({	233	resolveRemoteOperateAccess({
234	session: { authenticated: true, scopes: ["orchestration:operate"] },	234	session: {
		235	authenticated: true,
		236	scopes: ["orchestration:operate"],
		237	auth: { serverUpdateScope: "environment:maintain" },
		238	},
235	isPending: false,	239	isPending: false,
236	hasError: false,	240	hasError: false,
237	}),	241	}),
238	).toBe("denied");	242	).toBe("denied");
239	});	243	});
		244
		245	it("accepts the orchestration grant from a server that predates providers:manage", () => {
		246	expect(
		247	resolveRemoteOperateAccess({
		248	session: { authenticated: true, scopes: ["orchestration:operate"], auth: {} },
		249	isPending: false,
		250	hasError: false,
		251	}),
		252	).toBe("granted");
		253	});
240	it("derives access from the environment session's granted scopes", () => {	254	it("derives access from the environment session's granted scopes", () => {
241	expect(	255	expect(
242	resolveRemoteOperateAccess({	256	resolveRemoteOperateAccess({

apps/web/src/components/settings/ProviderSettingsPanel.logic.ts+6-6

 @@ -3,6 +3,8 @@ import {
   AuthProvidersManageScope,
   type AuthSessionState,
   type EnvironmentId,
+  sessionGrantsScope,
+  type SessionGrantInput,
 } from "@t3tools/contracts";
 export interface ProviderEnvironmentOptionLike {
 @@ -76,21 +78,19 @@ export type ProviderOperateAccess = "granted" | "denied" | "pending";
 /** Cached grants remain usable during revalidation; unknown or failed lookups grant nothing. */
 function resolveSessionOperateAccess(input: {
-  readonly session: Pick<AuthSessionState, "authenticated" | "scopes"> | null;
+  readonly session: SessionGrantInput | null;
   readonly isPending: boolean;
   readonly hasError: boolean;
 }): ProviderOperateAccess {
   if (input.hasError) return "denied";
   if (input.session === null) return input.isPending ? "pending" : "denied";
-  return input.session.authenticated && input.session.scopes?.includes(AuthProvidersManageScope)
+  return sessionGrantsScope(input.session, AuthProvidersManageScope) ? "granted" : "denied";
-    ? "granted"
-    : "denied";
 }
 export function resolvePrimaryOperateAccess(input: {
   readonly isPrimary: boolean;
   readonly hasDesktopBridge: boolean;
-  readonly session: Pick<AuthSessionState, "authenticated" | "scopes"> | null;
+  readonly session: SessionGrantInput | null;
   readonly isPending: boolean;
   readonly hasError: boolean;
 }): ProviderOperateAccess {
 @@ -98,7 +98,7 @@ export function resolvePrimaryOperateAccess(input: {
 }
 export function resolveRemoteOperateAccess(input: {
-  readonly session: Pick<AuthSessionState, "authenticated" | "scopes"> | null;
+  readonly session: SessionGrantInput | null;
   readonly isPending: boolean;
   readonly hasError: boolean;
 }): ProviderOperateAccess {

apps/web/src/components/usage/UsagePriceOverrides.tsx+2-2

...	@@ -1,5 +1,5 @@	...	@@ -1,5 +1,5 @@
1	import { useAtomValue } from "@effect/atom-react";	1	import { useAtomValue } from "@effect/atom-react";
2	import { AuthSettingsWriteScope, type EnvironmentId } from "@t3tools/contracts";	2	import { AuthSettingsWriteScope, type EnvironmentId, sessionGrantsScope } from "@t3tools/contracts";
3	import { ChevronDownIcon, PlusIcon, RotateCcwIcon, XIcon } from "lucide-react";	3	import { ChevronDownIcon, PlusIcon, RotateCcwIcon, XIcon } from "lucide-react";
4	import * as Option from "effect/Option";	4	import * as Option from "effect/Option";
5	import { AsyncResult, Atom } from "effect/reactivity";	5	import { AsyncResult, Atom } from "effect/reactivity";
...	@@ -54,7 +54,7 @@ const priceTargetsAtom = Atom.make((get): readonly UsagePriceTarget[] =>	...	@@ -54,7 +54,7 @@ const priceTargetsAtom = Atom.make((get): readonly UsagePriceTarget[] =>
54	? session.waiting	54	? session.waiting
55	? "pending"	55	? "pending"
56	: "denied"	56	: "denied"
57	: sessionData.authenticated && sessionData.scopes?.includes(AuthSettingsWriteScope)	57	: sessionGrantsScope(sessionData, AuthSettingsWriteScope)
58	? "granted"	58	? "granted"
59	: "denied";	59	: "denied";
60	return {	60	return {

apps/web/src/hooks/useSettings.ts+2-1

...	@@ -19,6 +19,7 @@ import {	...	@@ -19,6 +19,7 @@ import {
19	type ProviderInstanceMutation,	19	type ProviderInstanceMutation,
20	ServerSettings,	20	ServerSettings,
21	type ServerSettingsPatch,	21	type ServerSettingsPatch,
		22	sessionGrantsScope,
22	} from "@t3tools/contracts";	23	} from "@t3tools/contracts";
23	import {	24	import {
24	type ClientSettingsPatch,	25	type ClientSettingsPatch,
...	@@ -446,7 +447,7 @@ function useSharedSettingsSyncTargetIds(includePending = false): ReadonlyArray<E	...	@@ -446,7 +447,7 @@ function useSharedSettingsSyncTargetIds(includePending = false): ReadonlyArray<E
446	}	447	}
447	const session =	448	const session =
448	result._tag === "Failure" ? null : Option.getOrNull(AsyncResult.value(result));	449	result._tag === "Failure" ? null : Option.getOrNull(AsyncResult.value(result));
449	return session?.authenticated && session.scopes?.includes(AuthSettingsWriteScope)	450	return session !== null && sessionGrantsScope(session, AuthSettingsWriteScope)
450	? [environment.environmentId]	451	? [environment.environmentId]
451	: [];	452	: [];
452	}),	453	}),

apps/web/src/hooks/useThreadActions.permissions.test.ts+1

...	@@ -72,6 +72,7 @@ vi.mock("../state/use-atom-query-runner", () => ({	...	@@ -72,6 +72,7 @@ vi.mock("../state/use-atom-query-runner", () => ({
72	: AsyncResult.success({	72	: AsyncResult.success({
73	authenticated: true,	73	authenticated: true,
74	scopes: [...(state.scopes.get(environmentId) ?? [])],	74	scopes: [...(state.scopes.get(environmentId) ?? [])],
		75	auth: { serverUpdateScope: "environment:maintain" },
75	}),	76	}),
76	}));	77	}));
77	vi.mock("../state/threads", () => ({	78	vi.mock("../state/threads", () => ({

apps/web/src/hooks/useThreadActions.ts+2-2

...	@@ -14,6 +14,7 @@ import {	...	@@ -14,6 +14,7 @@ import {
14	EnvironmentId,	14	EnvironmentId,
15	type ScopedThreadRef,	15	type ScopedThreadRef,
16	ThreadId,	16	ThreadId,
		17	sessionGrantsScope,
17	} from "@t3tools/contracts";	18	} from "@t3tools/contracts";
18	import { resolveWorktreeCleanup } from "@t3tools/shared/projectSettings";	19	import { resolveWorktreeCleanup } from "@t3tools/shared/projectSettings";
19	import * as Cause from "effect/Cause";	20	import * as Cause from "effect/Cause";
...	@@ -496,8 +497,7 @@ export function useThreadActions() {	...	@@ -496,8 +497,7 @@ export function useThreadActions() {
496	if (permissionFailure) return permissionFailure;	497	if (permissionFailure) return permissionFailure;
497	canDeleteWorktree =	498	canDeleteWorktree =
498	sessionResult._tag === "Success" &&	499	sessionResult._tag === "Success" &&
499	sessionResult.value.authenticated &&	500	sessionGrantsScope(sessionResult.value, AuthSourceControlWriteScope);
500	sessionResult.value.scopes?.includes(AuthSourceControlWriteScope) === true;
501	}	501	}
502	let shouldDeleteWorktree = false;	502	let shouldDeleteWorktree = false;
503	const environmentSettings = environmentConfig?.settings;	503	const environmentSettings = environmentConfig?.settings;

apps/web/src/routes/__root.tsx+2

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { PermissionUpdateNotice } from "../components/PermissionUpdateNotice";
1	import { type ServerLifecycleWelcomePayload } from "@t3tools/contracts";	2	import { type ServerLifecycleWelcomePayload } from "@t3tools/contracts";
2	import { scopedProjectKey, scopeProjectRef } from "@t3tools/client-runtime/environment";	3	import { scopedProjectKey, scopeProjectRef } from "@t3tools/client-runtime/environment";
3	import {	4	import {
...	@@ -237,6 +238,7 @@ function RootRouteView() {	...	@@ -237,6 +238,7 @@ function RootRouteView() {
237	<ConfirmDialogHost />	238	<ConfirmDialogHost />
238	<CustomSnoozeDialogHost />	239	<CustomSnoozeDialogHost />
239	<SlowRpcRequestToastCoordinator />	240	<SlowRpcRequestToastCoordinator />
		241	<PermissionUpdateNotice />
240	{primaryEnvironmentAuthenticated ? <LegacyThreadMigrationToast /> : null}	242	{primaryEnvironmentAuthenticated ? <LegacyThreadMigrationToast /> : null}
241	<ProjectCloneToastCoordinator />	243	<ProjectCloneToastCoordinator />
242	<HostedStaticEnvironmentBootstrap />	244	<HostedStaticEnvironmentBootstrap />

apps/web/src/state/session.ts+18-18

 @@ -1,6 +1,11 @@
 import { useAtomValue } from "@effect/atom-react";
 import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";
-import type { AuthEnvironmentScope, AuthSessionState, EnvironmentId } from "@t3tools/contracts";
+import {
+  type AuthEnvironmentScope,
+  type AuthSessionState,
+  type EnvironmentId,
+  sessionGrantsScope,
+} from "@t3tools/contracts";
 import { useMemo } from "react";
 import * as Option from "effect/Option";
 import { AsyncResult, Atom } from "effect/reactivity";
 @@ -22,12 +27,15 @@ export function useEnvironmentScope(
       ? EMPTY_SESSION_STATE_ATOM
       : environmentSession.sessionStateAtom(environmentId),
   );
+  return sessionHasScope(result, scope);
+}
+function sessionHasScope(
+  result: AsyncResult.AsyncResult<AuthSessionState, unknown>,
+  scope: AuthEnvironmentScope,
+): boolean {
   const session = Option.getOrNull(AsyncResult.value(result));
-  return (
+  return result._tag !== "Failure" && session !== null && sessionGrantsScope(session, scope);
-    result._tag !== "Failure" &&
-    session?.authenticated === true &&
-    session.scopes?.includes(scope) === true
-  );
 }
 /** Subscribe to the grants of every selected environment. */
 @@ -41,12 +49,7 @@ export function useEnvironmentsWithScope(
         const ids = new Set<EnvironmentId>();
         for (const { environmentId } of environments) {
           const result = get(environmentSession.sessionStateAtom(environmentId));
-          const session = Option.getOrNull(AsyncResult.value(result));
+          if (sessionHasScope(result, scope)) {
-          if (
-            result._tag !== "Failure" &&
-            session?.authenticated === true &&
-            session.scopes?.includes(scope)
-          ) {
             ids.add(environmentId);
           }
         }
 @@ -61,12 +64,9 @@ export function readEnvironmentScope(
   environmentId: EnvironmentId,
   scope: AuthEnvironmentScope,
 ): boolean {
-  const result = appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId));
+  return sessionHasScope(
-  const session = Option.getOrNull(AsyncResult.value(result));
+    appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId)),
-  return (
+    scope,
-    result._tag !== "Failure" &&
-    session?.authenticated === true &&
-    session.scopes?.includes(scope) === true
   );
 }

docs/internals/environment-auth.md+12-4

...	@@ -58,10 +58,18 @@ extra authority: [every RPC declares a required	...	@@ -58,10 +58,18 @@ extra authority: [every RPC declares a required
58	scope](../../apps/server/src/auth/RpcAuthorization.ts), and the WebSocket RPC	58	scope](../../apps/server/src/auth/RpcAuthorization.ts), and the WebSocket RPC
59	group's `RpcScopeAuthorization` middleware checks it before any handler runs.	59	group's `RpcScopeAuthorization` middleware checks it before any handler runs.
60		60
61	Self-update must work across authorization protocol changes. New servers advertise	61	Scope changes must not prevent older clients from connecting. Token exchange
62	`auth.serverUpdateScope`; only an older server that omits it uses	62	intersects recognized requests with the pairing grant; retired and unknown names
63	`orchestration:operate` for updates. An unchanged grant on an upgraded server must	63	are dropped. A request with no granted scopes fails before consuming the link.
64	still include `environment:maintain`.	64	Stored credentials are never expanded when scopes split.
		65
		66	Auth responses keep `scopes` within the original wire vocabulary and include
		67	`permissions` for the exact grant. New clients use `permissions` when present,
		68	even if empty. Older servers omit it, so clients use legacy parent checks for
		69	features those servers already support. These client checks never change server
		70	authorization. Permission errors likewise retain a legacy `requiredScope` and
		71	add the exact `requiredPermission`, so a denied RPC stays decodable by old clients.
		72	Unknown response permissions are ignored; grant inputs stay strict.
65		73
66	Desktop restarts forget the previous local bearer token, so its reusable	74	Desktop restarts forget the previous local bearer token, so its reusable
67	bootstrap grant replaces earlier sessions for the same subject and method.	75	bootstrap grant replaces earlier sessions for the same subject and method.

docs/user/remote-access.md+4-3

...	@@ -289,9 +289,10 @@ and the agent it runs can use Git however the environment allows.	...	@@ -289,9 +289,10 @@ and the agent it runs can use Git however the environment allows.
289		289
290	Settings changes, provider management, and environment maintenance can be granted	290	Settings changes, provider management, and environment maintenance can be granted
291	separately from access administration. New standard pairings include these	291	separately from access administration. New standard pairings include these
292	permissions. Existing clients keep their original grants after an update; to	292	permissions. Existing clients can stay connected after an update, but newly separated
293	receive newly separated permissions, pair the client again with the scopes it	293	features may require pairing again with the permissions they need. Older clients
294	needs. Reconnecting or refreshing a session does not expand its grant.	294	may show controls that the server denies. Create a fresh pairing link to change
		295	a client's permissions.
295		296
296	`filesystem:read` allows browsing host files, opening workspace files, and viewing	297	`filesystem:read` allows browsing host files, opening workspace files, and viewing
297	local changes. Add `filesystem:write` to allow editing files or saving plans to	298	local changes. Add `filesystem:write` to allow editing files or saving plans to

packages/client-runtime/src/rpc/client.ts+2-1

...	@@ -1,6 +1,7 @@	...	@@ -1,6 +1,7 @@
1	import {	1	import {
2	EnvironmentAuthorizationError,	2	EnvironmentAuthorizationError,
3	clientRpcRequiredScopes,	3	clientRpcRequiredScopes,
		4	authScopeRequiredResponse,
4	type EnvironmentId,	5	type EnvironmentId,
5	type ClientGuardedRpcTag,	6	type ClientGuardedRpcTag,
6	ORCHESTRATION_V2_WS_METHODS,	7	ORCHESTRATION_V2_WS_METHODS,
...	@@ -165,7 +166,7 @@ export class RpcPermissionGuard extends Context.Reference<{	...	@@ -165,7 +166,7 @@ export class RpcPermissionGuard extends Context.Reference<{
165	? Effect.void	166	? Effect.void
166	: Effect.fail(	167	: Effect.fail(
167	new EnvironmentAuthorizationError({	168	new EnvironmentAuthorizationError({
168	requiredScope: scope,	169	...authScopeRequiredResponse(scope),
169	message: `This connection requires ${scope}.`,	170	message: `This connection requires ${scope}.`,
170	}),	171	}),
171	);	172	);

packages/client-runtime/src/state/commandPermissions.test.ts+70-2

...	@@ -1,3 +1,9 @@	...	@@ -1,3 +1,9 @@
		1	import { requestGuarded, runStreamGuarded } from "../rpc/client.ts";
		2	import { EnvironmentSupervisor } from "../connection/supervisor.ts";
		3	import * as SubscriptionRef from "effect/SubscriptionRef";
		4	import * as Option from "effect/Option";
		5	import * as Stream from "effect/Stream";
		6	import type { RpcSession } from "../rpc/session.ts";
1	import { describe, expect, it } from "@effect/vitest";	7	import { describe, expect, it } from "@effect/vitest";
2	import { vi } from "vite-plus/test";	8	import { vi } from "vite-plus/test";
3	import {	9	import {
...	@@ -36,6 +42,7 @@ const grant = (allowed: boolean): AuthSessionState => ({	...	@@ -36,6 +42,7 @@ const grant = (allowed: boolean): AuthSessionState => ({
36	sessionCookieName: "test",	42	sessionCookieName: "test",
37	},	43	},
38	scopes: allowed ? [AuthOrchestrationOperateScope] : [],	44	scopes: allowed ? [AuthOrchestrationOperateScope] : [],
		45	permissions: allowed ? [AuthOrchestrationOperateScope] : [],
39	});	46	});
40	const runtime = Atom.runtime(	47	const runtime = Atom.runtime(
41	Layer.succeed(EnvironmentRegistry, {	48	Layer.succeed(EnvironmentRegistry, {
...	@@ -161,12 +168,16 @@ it.effect(	...	@@ -161,12 +168,16 @@ it.effect(
161	const registry = yield* setup;	168	const registry = yield* setup;
162	registry.set(sessions(env), AsyncResult.success(grant(true)));	169	registry.set(sessions(env), AsyncResult.success(grant(true)));
163	const git = createCommandPermissions(runtime, WS_METHODS.vcsInit);	170	const git = createCommandPermissions(runtime, WS_METHODS.vcsInit);
164	expect((yield* git.authorize(registry, env).pipe(Effect.flip)).requiredScope).toBe(	171	expect((yield* git.authorize(registry, env).pipe(Effect.flip)).requiredPermission).toBe(
165	AuthSourceControlWriteScope,	172	AuthSourceControlWriteScope,
166	);	173	);
167	registry.set(	174	registry.set(
168	sessions(env),	175	sessions(env),
169	AsyncResult.success({ ...grant(false), scopes: [AuthSourceControlWriteScope] }),	176	AsyncResult.success({
		177	...grant(false),
		178	scopes: [AuthSourceControlWriteScope],
		179	permissions: [AuthSourceControlWriteScope],
		180	}),
170	);	181	);
171	yield* git.authorize(registry, env);	182	yield* git.authorize(registry, env);
172	const prepare = createCommandPermissions(runtime, WS_METHODS.gitPreparePullRequestThread);	183	const prepare = createCommandPermissions(runtime, WS_METHODS.gitPreparePullRequestThread);
...	@@ -186,6 +197,7 @@ it.effect(	...	@@ -186,6 +197,7 @@ it.effect(
186	AsyncResult.success({	197	AsyncResult.success({
187	...grant(true),	198	...grant(true),
188	scopes: [AuthSourceControlWriteScope, AuthOrchestrationOperateScope],	199	scopes: [AuthSourceControlWriteScope, AuthOrchestrationOperateScope],
		200	permissions: [AuthSourceControlWriteScope, AuthOrchestrationOperateScope],
189	}),	201	}),
190	);	202	);
191	expect(registry.get(prepare.permissionAtom(env, input))).toBe(true);	203	expect(registry.get(prepare.permissionAtom(env, input))).toBe(true);
...	@@ -193,3 +205,59 @@ it.effect(	...	@@ -193,3 +205,59 @@ it.effect(
193	}),	205	}),
194	),	206	),
195	);	207	);
		208
		209	it.effect("honors exact empty permissions and preserves legacy parent grants", () =>
		210	Effect.scoped(
		211	Effect.gen(function* () {
		212	const registry = yield* setup;
		213	const git = createCommandPermissions(runtime, WS_METHODS.vcsInit);
		214	registry.set(sessions(env), AsyncResult.success({ ...grant(true), permissions: [] }));
		215	expect(registry.get(git.permissionAtom(env))).toBe(false);
		216	const denied = yield* git.authorize(registry, env).pipe(Effect.flip);
		217	expect(denied).toMatchObject({
		218	requiredPermission: AuthSourceControlWriteScope,
		219	requiredScope: AuthOrchestrationOperateScope,
		220	});
		221	const { permissions: _exact, ...legacy } = grant(true);
		222	registry.set(sessions(env), AsyncResult.success(legacy));
		223	expect(registry.get(git.permissionAtom(env))).toBe(true);
		224	yield* git.authorize(registry, env);
		225	}),
		226	),
		227	);
		228
		229	it.effect("rejects protected unary and streamed RPCs outside a guarded command", () =>
		230	Effect.gen(function* () {
		231	let writes = 0;
		232	const session = {
		233	client: {
		234	[WS_METHODS.scheduledTasksDelete]: () =>
		235	Effect.sync(() => {
		236	writes++;
		237	return { id: ScheduledTaskId.make("task") };
		238	}),
		239	[WS_METHODS.gitRunStackedAction]: () =>
		240	Stream.fromEffect(
		241	Effect.sync(() => {
		242	writes++;
		243	}),
		244	),
		245	},
		246	} as unknown as RpcSession;
		247	const supervisor = {
		248	target: { environmentId: env, label: "target" },
		249	session: yield* SubscriptionRef.make(Option.some(session)),
		250	} as unknown as EnvironmentSupervisor["Service"];
		251	const unary = yield* requestGuarded(WS_METHODS.scheduledTasksDelete, {
		252	id: ScheduledTaskId.make("task"),
		253	}).pipe(Effect.provideService(EnvironmentSupervisor, supervisor), Effect.flip);
		254	expect(unary._tag).toBe("EnvironmentAuthorizationError");
		255	const streamed = yield* runStreamGuarded(WS_METHODS.gitRunStackedAction, {
		256	actionId: "test-action",
		257	cwd: "/repo",
		258	action: "commit",
		259	}).pipe(Stream.runDrain, Effect.provideService(EnvironmentSupervisor, supervisor), Effect.flip);
		260	expect(streamed._tag).toBe("EnvironmentAuthorizationError");
		261	expect(writes).toBe(0);
		262	}),
		263	);

packages/client-runtime/src/state/commandPermissions.ts+5-7

 @@ -1,5 +1,7 @@
 import {
   clientRpcRequiredScopes,
+  sessionGrantsScope,
+  authScopeRequiredResponse,
   EnvironmentAuthorizationError,
   type EnvironmentId,
   type AuthSessionState,
 @@ -11,10 +13,6 @@ import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
 import type { EnvironmentRegistry } from "../connection/registry.ts";
 import { createEnvironmentSessionAtoms } from "./session.ts";
-function grants(session: AuthSessionState, scope: AuthEnvironmentScope) {
-  return session.authenticated && session.scopes?.includes(scope) === true;
-}
 /** UI availability and dispatch use the same target session and method policy. */
 function makeCommandPermissions<R, E>(
   runtime: Atom.AtomRuntime<EnvironmentRegistry | R, E>,
 @@ -33,7 +31,7 @@ function makeCommandPermissions<R, E>(
         return (
           result._tag !== "Failure" &&
           session !== null &&
-          scopes.every((scope) => grants(session, scope))
+          scopes.every((scope) => sessionGrantsScope(session, scope))
         );
       }),
     ),
 @@ -59,12 +57,12 @@ function makeCommandPermissions<R, E>(
             Effect.catch(() => Effect.succeed(Option.none<AuthSessionState>())),
           );
           const missing = scopes.find(
-            (scope) => Option.isNone(session) || !grants(session.value, scope),
+            (scope) => Option.isNone(session) || !sessionGrantsScope(session.value, scope),
           );
           if (missing !== undefined)
             return yield* Effect.fail(
               new EnvironmentAuthorizationError({
-                requiredScope: missing,
+                ...authScopeRequiredResponse(missing),
                 message: `This connection requires ${missing}.`,
               }),
             );

packages/client-runtime/src/state/filesystem.test.ts+16-2

 @@ -9,6 +9,9 @@ import {
   resolveFilesystemReadAccess,
 } from "./filesystem.ts";
+/** A server that already splits scopes; it never falls back to a parent grant. */
+const SPLIT_SCOPES_SERVER = { serverUpdateScope: "environment:maintain" } as const;
 describe("filesystem read access", () => {
   it("waits for the initial catalog before declaring a missing environment disconnected", () => {
     expect(
 @@ -100,8 +103,8 @@ describe("filesystem read access", () => {
   );
   it.each([
-    { authenticated: true, scopes: [AuthOrchestrationReadScope] },
+    { authenticated: true, scopes: [AuthOrchestrationReadScope], auth: SPLIT_SCOPES_SERVER },
-    { authenticated: false, scopes: [AuthFilesystemReadScope] },
+    { authenticated: false, scopes: [AuthFilesystemReadScope], auth: SPLIT_SCOPES_SERVER },
   ] as const)("does not infer file access from an ungranted session", (session) => {
     expect(
       resolveFilesystemReadAccess({
 @@ -112,6 +115,17 @@ describe("filesystem read access", () => {
       }),
     ).toEqual({ canReadFiles: false, isPending: false, error: null });
   });
+  it("falls back to the orchestration grant on a server that predates filesystem:read", () => {
+    expect(
+      resolveFilesystemReadAccess({
+        isCatalogReady: true,
+        connection: { phase: "connected", error: null },
+        session: { authenticated: true, scopes: [AuthOrchestrationReadScope], auth: {} },
+        sessionError: null,
+      }),
+    ).toEqual({ canReadFiles: true, isPending: false, error: null });
+  });
 });
 describe("filesystem browse model", () => {

packages/client-runtime/src/state/filesystem.ts+4-4

...	@@ -3,6 +3,8 @@ import {	...	@@ -3,6 +3,8 @@ import {
3	type AuthSessionState,	3	type AuthSessionState,
4	type FilesystemBrowseEntry,	4	type FilesystemBrowseEntry,
5	WS_METHODS,	5	WS_METHODS,
		6	sessionGrantsScope,
		7	type SessionGrantInput,
6	} from "@t3tools/contracts";	8	} from "@t3tools/contracts";
7	import { Atom } from "effect/reactivity";	9	import { Atom } from "effect/reactivity";
8		10
...	@@ -24,7 +26,7 @@ import { createEnvironmentRpcQueryAtomFamily } from "./runtime.ts";	...	@@ -24,7 +26,7 @@ import { createEnvironmentRpcQueryAtomFamily } from "./runtime.ts";
24	export function resolveFilesystemReadAccess(input: {	26	export function resolveFilesystemReadAccess(input: {
25	readonly isCatalogReady: boolean;	27	readonly isCatalogReady: boolean;
26	readonly connection: Pick<EnvironmentConnectionPresentation, "phase" \| "error"> \| null;	28	readonly connection: Pick<EnvironmentConnectionPresentation, "phase" \| "error"> \| null;
27	readonly session: Pick<AuthSessionState, "authenticated" \| "scopes"> \| null;	29	readonly session: SessionGrantInput \| null;
28	readonly sessionError: string \| null;	30	readonly sessionError: string \| null;
29	}) {	31	}) {
30	if (input.sessionError !== null) {	32	if (input.sessionError !== null) {
...	@@ -45,9 +47,7 @@ export function resolveFilesystemReadAccess(input: {	...	@@ -45,9 +47,7 @@ export function resolveFilesystemReadAccess(input: {
45	};	47	};
46	}	48	}
47	return {	49	return {
48	canReadFiles:	50	canReadFiles: sessionGrantsScope(input.session, AuthFilesystemReadScope),
49	input.session.authenticated &&
50	input.session.scopes?.includes(AuthFilesystemReadScope) === true,
51	isPending: false,	51	isPending: false,
52	error: null,	52	error: null,
53	};	53	};

packages/client-runtime/src/state/usageAccess.test.ts+5-1

 @@ -39,7 +39,11 @@ describe("resolveUsageAccess", () => {
   it("distinguishes a failed check from a resolved grant without diagnostics access", () => {
     const denied = resolveUsageAccess({
       connectionPhase: "connected",
-      session: { authenticated: true, scopes: [AuthOrchestrationReadScope] },
+      session: {
+        authenticated: true,
+        scopes: [AuthOrchestrationReadScope],
+        auth: { serverUpdateScope: "environment:maintain" },
+      },
       hasSessionError: false,
     });
     const failed = resolveUsageAccess({

packages/client-runtime/src/state/usageAccess.ts+8-5

 @@ -1,10 +1,15 @@
-import { AuthDiagnosticsReadScope, type AuthSessionState } from "@t3tools/contracts";
+import {
+  AuthDiagnosticsReadScope,
+  type AuthSessionState,
+  sessionGrantsScope,
+  type SessionGrantInput,
+} from "@t3tools/contracts";
 import type { EnvironmentConnectionPhase } from "../connection/presentation.ts";
 export function resolveUsageAccess(input: {
   readonly connectionPhase: EnvironmentConnectionPhase;
-  readonly session: Pick<AuthSessionState, "authenticated" | "scopes"> | null;
+  readonly session: SessionGrantInput | null;
   readonly hasSessionError: boolean;
 }) {
   if (input.hasSessionError) {
 @@ -27,9 +32,7 @@ export function resolveUsageAccess(input: {
       error: isPending ? null : "This environment is not connected.",
     };
   }
-  const canReadDiagnostics =
+  const canReadDiagnostics = sessionGrantsScope(input.session, AuthDiagnosticsReadScope);
-    input.session.authenticated &&
-    input.session.scopes?.includes(AuthDiagnosticsReadScope) === true;
   return {
     canReadDiagnostics,
     isPending: false,

packages/contracts/src/auth.test.ts+143-1

...	@@ -1,7 +1,17 @@	...	@@ -1,7 +1,17 @@
1	import { describe, expect, it } from "vite-plus/test";	1	import { describe, expect, it } from "vite-plus/test";
2	import * as Schema from "effect/Schema";	2	import * as Schema from "effect/Schema";
3		3
4	import { AuthEnvironmentScopes, AuthGrantScopes, AuthStandardClientScopes } from "./auth.ts";	4	import {
		5	AuthEnvironmentScopes,
		6	AuthEnvironmentScope,
		7	authScopeRequiredResponse,
		8	AuthGrantScopes,
		9	AuthStandardClientScopes,
		10	authScopeResponse,
		11	AuthSessionState,
		12	sessionGrantsScope,
		13	sessionHasLegacyPermissions,
		14	} from "./auth.ts";
5		15
6	describe("authorization grants", () => {	16	describe("authorization grants", () => {
7	it("decodes legacy review credentials without offering them in new grants", () => {	17	it("decodes legacy review credentials without offering them in new grants", () => {
...	@@ -11,4 +21,136 @@ describe("authorization grants", () => {	...	@@ -11,4 +21,136 @@ describe("authorization grants", () => {
11	expect(() => Schema.decodeUnknownSync(AuthGrantScopes)(["review:write"])).toThrow();	21	expect(() => Schema.decodeUnknownSync(AuthGrantScopes)(["review:write"])).toThrow();
12	expect(AuthStandardClientScopes).not.toContain("review:write");	22	expect(AuthStandardClientScopes).not.toContain("review:write");
13	});	23	});
		24
		25	// Frozen vocabulary from the client before granular scopes shipped. Do not
		26	// derive it from the current enum: that would hide compatibility regressions.
		27	const oldScopes = Schema.Array(
		28	Schema.Literals([
		29	"orchestration:read",
		30	"orchestration:operate",
		31	"terminal:operate",
		32	"review:write",
		33	"access:read",
		34	"access:write",
		35	"relay:read",
		36	"relay:write",
		37	]),
		38	);
		39
		40	const decodeOldScopes = Schema.decodeUnknownSync(oldScopes);
		41
		42	it.each(AuthEnvironmentScope.literals)(
		43	"keeps %s permission errors decodable by old clients",
		44	(scope) => {
		45	const response = authScopeRequiredResponse(scope);
		46	expect(decodeOldScopes([response.requiredScope])).toEqual([response.requiredScope]);
		47	expect(response.requiredPermission).toBe(scope);
		48	},
		49	);
		50
		51	it("keeps old clients able to decode grants with new permissions", () => {
		52	const response = authScopeResponse(AuthStandardClientScopes);
		53	expect(decodeOldScopes(response.scopes)).toEqual(response.scopes);
		54	expect(response.permissions).toEqual(AuthStandardClientScopes);
		55	expect(response.scopes).not.toContain("filesystem:read");
		56	});
		57
		58	it("ignores unknown response permissions without falling back to broader scopes", () => {
		59	const session = Schema.decodeUnknownSync(AuthSessionState)({
		60	authenticated: true,
		61	auth: {
		62	policy: "loopback-browser",
		63	bootstrapMethods: [],
		64	sessionMethods: [],
		65	sessionCookieName: "session",
		66	},
		67	scopes: ["orchestration:operate"],
		68	permissions: ["future:permission"],
		69	});
		70	expect(session.permissions).toEqual([]);
		71	expect(sessionGrantsScope(session, "orchestration:operate")).toBe(false);
		72	expect(sessionGrantsScope(session, "settings:write")).toBe(false);
		73	});
		74
		75	it.each([
		76	{
		77	label: "exact permissions over the legacy presentation",
		78	session: {
		79	authenticated: true,
		80	scopes: ["orchestration:operate"],
		81	permissions: ["filesystem:read"],
		82	},
		83	scope: "settings:write",
		84	expected: false,
		85	},
		86	{
		87	label: "a permission absent from the legacy presentation",
		88	session: { authenticated: true, scopes: [], permissions: ["filesystem:read"] },
		89	scope: "filesystem:read",
		90	expected: true,
		91	},
		92
		93	{
		94	label: "the parent on a server that predates the split",
		95	session: { authenticated: true, scopes: ["orchestration:operate"], auth: {} },
		96	scope: "settings:write",
		97	expected: true,
		98	},
		99	{
		100	label: "only the exact scope on a server that knows the split",
		101	session: {
		102	authenticated: true,
		103	scopes: ["orchestration:operate"],
		104	auth: { serverUpdateScope: "environment:maintain" },
		105	},
		106	scope: "settings:write",
		107	expected: false,
		108	},
		109	{
		110	label: "the exact scope regardless of server version",
		111	session: { authenticated: true, scopes: ["settings:write"], auth: {} },
		112	scope: "settings:write",
		113	expected: true,
		114	},
		115	{
		116	label: "nothing for an unauthenticated session",
		117	session: { authenticated: false, scopes: ["orchestration:operate"], auth: {} },
		118	scope: "settings:write",
		119	expected: false,
		120	},
		121	{
		122	label: "no parent for scopes that were never split",
		123	session: { authenticated: true, scopes: ["orchestration:operate"], auth: {} },
		124	scope: "access:write",
		125	expected: false,
		126	},
		127	] as const)("sessionGrantsScope accepts $label", ({ session, scope, expected }) => {
		128	expect(sessionGrantsScope(session, scope)).toBe(expected);
		129	});
		130	});
		131
		132	describe("legacy permission notice", () => {
		133	it.each(["orchestration:read", "orchestration:operate", "terminal:operate"] as const)(
		134	"recognizes an old %s grant on an upgraded server",
		135	(scope) =>
		136	expect(sessionHasLegacyPermissions({ authenticated: true, permissions: [scope] })).toBe(true),
		137	);
		138	it("waits for a new server and an authenticated session", () => {
		139	expect(
		140	sessionHasLegacyPermissions({ authenticated: true, scopes: ["orchestration:operate"] }),
		141	).toBe(false);
		142	expect(
		143	sessionHasLegacyPermissions({ authenticated: false, permissions: ["orchestration:operate"] }),
		144	).toBe(false);
		145	});
		146	it("skips new grants and old grants that lost no implied permissions", () => {
		147	for (const permissions of [
		148	AuthStandardClientScopes,
		149	["orchestration:read", "filesystem:read"] as const,
		150	["access:read"] as const,
		151	[],
		152	]) {
		153	expect(sessionHasLegacyPermissions({ authenticated: true, permissions })).toBe(false);
		154	}
		155	});
14	});	156	});

packages/contracts/src/auth.ts+81-3

...	@@ -3,6 +3,7 @@ import * as HttpApiSchema from "effect/http-api/HttpApiSchema";	...	@@ -3,6 +3,7 @@ import * as HttpApiSchema from "effect/http-api/HttpApiSchema";
3		3
4	import {	4	import {
5	AuthSessionId,	5	AuthSessionId,
		6	ForwardCompatibleArray,
6	ClientSurface,	7	ClientSurface,
7	ClientWebDeployment,	8	ClientWebDeployment,
8	TrimmedNonEmptyString,	9	TrimmedNonEmptyString,
...	@@ -126,6 +127,81 @@ export type AuthGrantScope = typeof AuthGrantScope.Type;	...	@@ -126,6 +127,81 @@ export type AuthGrantScope = typeof AuthGrantScope.Type;
126	export const AuthGrantScopes = Schema.Array(AuthGrantScope);	127	export const AuthGrantScopes = Schema.Array(AuthGrantScope);
127	export type AuthGrantScopes = typeof AuthGrantScopes.Type;	128	export type AuthGrantScopes = typeof AuthGrantScopes.Type;
128		129
		130	// Frozen wire vocabulary for clients released before granular permissions.
		131	const legacyScopes = new Set<AuthEnvironmentScope>([
		132	AuthOrchestrationReadScope,
		133	AuthOrchestrationOperateScope,
		134	AuthTerminalOperateScope,
		135	AuthReviewWriteScope,
		136	AuthAccessReadScope,
		137	AuthAccessWriteScope,
		138	AuthRelayReadScope,
		139	AuthRelayWriteScope,
		140	]);
		141
		142	/** Format public auth metadata without changing the server's authorization grant. */
		143	export function authScopeResponse(scopes: ReadonlyArray<AuthEnvironmentScope>) {
		144	return { scopes: scopes.filter((scope) => legacyScopes.has(scope)), permissions: scopes };
		145	}
		146
		147	const authScopeResponseFields = {
		148	scopes: AuthEnvironmentScopes,
		149	permissions: Schema.optionalKey(ForwardCompatibleArray(AuthEnvironmentScope)),
		150	};
		151
		152	// Only clients talking to an old server use these parent checks. Servers never
		153	// expand stored grants, and an explicitly empty permissions array grants nothing.
		154	const legacyParents: Partial<Record<AuthEnvironmentScope, AuthEnvironmentScope>> = {
		155	[AuthFilesystemReadScope]: AuthOrchestrationReadScope,
		156	[AuthDiagnosticsReadScope]: AuthOrchestrationReadScope,
		157	[AuthSettingsWriteScope]: AuthOrchestrationOperateScope,
		158	[AuthProvidersManageScope]: AuthOrchestrationOperateScope,
		159	[AuthEnvironmentMaintainScope]: AuthOrchestrationOperateScope,
		160	[AuthPreviewOperateScope]: AuthOrchestrationOperateScope,
		161	[AuthSourceControlWriteScope]: AuthOrchestrationOperateScope,
		162	[AuthFilesystemWriteScope]: AuthOrchestrationOperateScope,
		163	[AuthTerminalReadScope]: AuthTerminalOperateScope,
		164	};
		165
		166	/** Keep permission denials decodable by clients with the original scope enum. */
		167	export function authScopeRequiredResponse(requiredPermission: AuthEnvironmentScope) {
		168	return {
		169	requiredScope: legacyParents[requiredPermission] ?? requiredPermission,
		170	requiredPermission,
		171	};
		172	}
		173
		174	export interface SessionGrantInput {
		175	readonly authenticated: boolean;
		176	readonly scopes?: ReadonlyArray<AuthEnvironmentScope> \| undefined;
		177	readonly permissions?: ReadonlyArray<AuthEnvironmentScope> \| undefined;
		178	readonly auth?: { readonly serverUpdateScope?: string \| undefined } \| undefined;
		179	}
		180
		181	export function sessionGrantsScope(
		182	session: SessionGrantInput,
		183	scope: AuthEnvironmentScope,
		184	): boolean {
		185	if (!session.authenticated) return false;
		186	if (session.permissions !== undefined) return session.permissions.includes(scope);
		187	if (session.scopes?.includes(scope)) return true;
		188	// Also recognize servers from the first granular-scope release.
		189	if (session.auth?.serverUpdateScope !== undefined) return false;
		190	const parent = legacyParents[scope];
		191	return parent !== undefined && session.scopes?.includes(parent) === true;
		192	}
		193
		194	/** Old-only grants lost the child permissions formerly implied by their broad scopes. */
		195	export function sessionHasLegacyPermissions(session: SessionGrantInput): boolean {
		196	const permissions = session.permissions;
		197	return (
		198	session.authenticated &&
		199	permissions !== undefined &&
		200	permissions.every((scope) => legacyScopes.has(scope)) &&
		201	Object.values(legacyParents).some((parent) => permissions.includes(parent))
		202	);
		203	}
		204
129	export const AuthStandardClientScopes = [	205	export const AuthStandardClientScopes = [
130	AuthOrchestrationReadScope,	206	AuthOrchestrationReadScope,
131	AuthOrchestrationOperateScope,	207	AuthOrchestrationOperateScope,
...	@@ -191,7 +267,7 @@ export type AuthBrowserSessionRequest = typeof AuthBrowserSessionRequest.Type;	...	@@ -191,7 +267,7 @@ export type AuthBrowserSessionRequest = typeof AuthBrowserSessionRequest.Type;
191		267
192	export const AuthBrowserSessionResult = Schema.Struct({	268	export const AuthBrowserSessionResult = Schema.Struct({
193	authenticated: Schema.Literal(true),	269	authenticated: Schema.Literal(true),
194	scopes: AuthEnvironmentScopes,	270	...authScopeResponseFields,
195	sessionMethod: ServerAuthSessionMethod,	271	sessionMethod: ServerAuthSessionMethod,
196	expiresAt: Schema.DateTimeUtc,	272	expiresAt: Schema.DateTimeUtc,
197	});	273	});
...	@@ -257,7 +333,7 @@ export type AuthPairingCredentialResult = typeof AuthPairingCredentialResult.Typ	...	@@ -257,7 +333,7 @@ export type AuthPairingCredentialResult = typeof AuthPairingCredentialResult.Typ
257	// Read models contain metadata only. Credentials are returned by creation alone.	333	// Read models contain metadata only. Credentials are returned by creation alone.
258	export const AuthPairingLink = Schema.Struct({	334	export const AuthPairingLink = Schema.Struct({
259	id: TrimmedNonEmptyString,	335	id: TrimmedNonEmptyString,
260	scopes: AuthEnvironmentScopes,	336	...authScopeResponseFields,
261	subject: TrimmedNonEmptyString,	337	subject: TrimmedNonEmptyString,
262	label: Schema.optionalKey(TrimmedNonEmptyString),	338	label: Schema.optionalKey(TrimmedNonEmptyString),
263	createdAt: Schema.DateTimeUtc,	339	createdAt: Schema.DateTimeUtc,
...	@@ -278,7 +354,7 @@ export type AuthClientMetadata = typeof AuthClientMetadata.Type;	...	@@ -278,7 +354,7 @@ export type AuthClientMetadata = typeof AuthClientMetadata.Type;
278	export const AuthClientSession = Schema.Struct({	354	export const AuthClientSession = Schema.Struct({
279	sessionId: AuthSessionId,	355	sessionId: AuthSessionId,
280	subject: TrimmedNonEmptyString,	356	subject: TrimmedNonEmptyString,
281	scopes: AuthEnvironmentScopes,	357	...authScopeResponseFields,
282	method: ServerAuthSessionMethod,	358	method: ServerAuthSessionMethod,
283	client: AuthClientMetadata,	359	client: AuthClientMetadata,
284	issuedAt: Schema.DateTimeUtc,	360	issuedAt: Schema.DateTimeUtc,
...	@@ -335,6 +411,7 @@ export class EnvironmentAuthorizationError extends Schema.TaggedError<Environmen	...	@@ -335,6 +411,7 @@ export class EnvironmentAuthorizationError extends Schema.TaggedError<Environmen
335	{	411	{
336	message: Schema.String,	412	message: Schema.String,
337	requiredScope: AuthEnvironmentScope,	413	requiredScope: AuthEnvironmentScope,
		414	requiredPermission: Schema.optionalKey(Schema.String),
338	},	415	},
339	) {}	416	) {}
340		417
...	@@ -385,6 +462,7 @@ export const AuthSessionState = Schema.Struct({	...	@@ -385,6 +462,7 @@ export const AuthSessionState = Schema.Struct({
385	authenticated: Schema.Boolean,	462	authenticated: Schema.Boolean,
386	auth: ServerAuthDescriptor,	463	auth: ServerAuthDescriptor,
387	scopes: Schema.optionalKey(AuthEnvironmentScopes),	464	scopes: Schema.optionalKey(AuthEnvironmentScopes),
		465	permissions: authScopeResponseFields.permissions,
388	sessionMethod: Schema.optionalKey(ServerAuthSessionMethod),	466	sessionMethod: Schema.optionalKey(ServerAuthSessionMethod),
389	expiresAt: Schema.optionalKey(Schema.DateTimeUtc),	467	expiresAt: Schema.optionalKey(Schema.DateTimeUtc),
390	});	468	});

packages/contracts/src/environmentHttp.ts+2-1

...	@@ -170,6 +170,7 @@ export class EnvironmentScopeRequiredError extends Schema.TaggedError<Environmen	...	@@ -170,6 +170,7 @@ export class EnvironmentScopeRequiredError extends Schema.TaggedError<Environmen
170	{	170	{
171	code: Schema.Literal("insufficient_scope"),	171	code: Schema.Literal("insufficient_scope"),
172	requiredScope: AuthEnvironmentScope,	172	requiredScope: AuthEnvironmentScope,
		173	requiredPermission: Schema.optionalKey(Schema.String),
173	traceId: TrimmedNonEmptyString,	174	traceId: TrimmedNonEmptyString,
174	},	175	},
175	{ httpApiStatus: 403 },	176	{ httpApiStatus: 403 },
...	@@ -179,7 +180,7 @@ export class EnvironmentScopeRequiredError extends Schema.TaggedError<Environmen	...	@@ -179,7 +180,7 @@ export class EnvironmentScopeRequiredError extends Schema.TaggedError<Environmen
179	}	180	}
180		181
181	override get message(): string {	182	override get message(): string {
182	return `This request needs the ${this.requiredScope} scope, which this client does not have.`;	183	return `This request needs the ${this.requiredPermission ?? this.requiredScope} scope, which this client does not have.`;
183	}	184	}
184	}	185	}
185		186

author	Julius Marminge <julius0216@outlook.com> 2026-10-06 20:30:14-07:00
committer	GitHub <noreply@github.com> 2026-10-06 20:30:14-07:00
log	365aa87982a4d81cc8e0c085e8d1a40ca7daecdc
tree	08055d86149cd701686ab12cf845bb156c7a2ae1
parent	cc41482df0232454af0cc5ac2f1afd984e342134
signature	Signed by PGP key B5690EEEBB952194

...	@@ -534,6 +534,7 @@ function sortDesktopClientSessions(sessions: ReadonlyArray<ServerClientSessionRe	...	@@ -534,6 +534,7 @@ function sortDesktopClientSessions(sessions: ReadonlyArray<ServerClientSessionRe
534	function toDesktopPairingLinkRecord(pairingLink: AuthPairingLink): ServerPairingLinkRecord {	534	function toDesktopPairingLinkRecord(pairingLink: AuthPairingLink): ServerPairingLinkRecord {
535	return {	535	return {
536	...pairingLink,	536	...pairingLink,
		537	scopes: pairingLink.permissions ?? pairingLink.scopes,
537	createdAt: DateTime.formatIso(pairingLink.createdAt),	538	createdAt: DateTime.formatIso(pairingLink.createdAt),
538	expiresAt: DateTime.formatIso(pairingLink.expiresAt),	539	expiresAt: DateTime.formatIso(pairingLink.expiresAt),
539	};	540	};
...	@@ -542,6 +543,7 @@ function toDesktopPairingLinkRecord(pairingLink: AuthPairingLink): ServerPairing	...	@@ -542,6 +543,7 @@ function toDesktopPairingLinkRecord(pairingLink: AuthPairingLink): ServerPairing
542	function toDesktopClientSessionRecord(clientSession: AuthClientSession): ServerClientSessionRecord {	543	function toDesktopClientSessionRecord(clientSession: AuthClientSession): ServerClientSessionRecord {
543	return {	544	return {
544	...clientSession,	545	...clientSession,
		546	scopes: clientSession.permissions ?? clientSession.scopes,
545	issuedAt: DateTime.formatIso(clientSession.issuedAt),	547	issuedAt: DateTime.formatIso(clientSession.issuedAt),
546	expiresAt: DateTime.formatIso(clientSession.expiresAt),	548	expiresAt: DateTime.formatIso(clientSession.expiresAt),
547	lastConnectedAt:	549	lastConnectedAt:
...	@@ -2108,7 +2110,7 @@ export function ConnectionsSettings() {	...	@@ -2108,7 +2110,7 @@ export function ConnectionsSettings() {
2108	const primaryEnvironmentId = primaryEnvironment?.environmentId ?? null;	2110	const primaryEnvironmentId = primaryEnvironment?.environmentId ?? null;
2109	const primarySessionState = usePrimarySessionState();	2111	const primarySessionState = usePrimarySessionState();
2110	const currentSessionScopes = primarySessionState.data?.authenticated	2112	const currentSessionScopes = primarySessionState.data?.authenticated
2111	? (primarySessionState.data.scopes ?? null)	2113	? (primarySessionState.data.permissions ?? primarySessionState.data.scopes ?? null)
2112	: null;	2114	: null;
2113	const currentAuthPolicy = desktopBridge ? null : (primarySessionState.data?.auth.policy ?? null);	2115	const currentAuthPolicy = desktopBridge ? null : (primarySessionState.data?.auth.policy ?? null);
2114	// Catalog order is the order the machines were added; rows never jump when	2116	// Catalog order is the order the machines were added; rows never jump when

fix(auth): keep old clients connected across scope changes (#10298)