apps/desktop/package.json | 1 + apps/desktop/src/ipc/DesktopIpcHandlers.ts | 4 +- apps/desktop/src/ipc/methods/sshEnvironment.test.ts | 115 ++++++ apps/desktop/src/ipc/methods/sshEnvironment.ts | 78 +++- apps/desktop/src/main.ts | 3 +- apps/desktop/src/preload.ts | 2 +- apps/desktop/src/ssh/DesktopSshRemoteApi.test.ts | 79 ---- apps/desktop/src/ssh/DesktopSshRemoteApi.ts | 124 ------ apps/mobile/src/lib/connection.test.ts | 16 +- apps/mobile/src/lib/connection.ts | 14 +- apps/server/src/auth/EnvironmentAuth.test.ts | 261 +++++++++++++ apps/server/src/auth/EnvironmentAuth.ts | 662 ++++++++++++++++++++++++++++++++ apps/server/src/auth/EnvironmentAuthAdmin.test.ts | 125 ++++++ apps/server/src/auth/EnvironmentAuthPolicy.test.ts | 114 ++++++ apps/server/src/auth/EnvironmentAuthPolicy.ts | 55 +++ apps/server/src/auth/Layers/AuthControlPlane.test.ts | 112 ------ apps/server/src/auth/Layers/AuthControlPlane.ts | 186 --------- apps/server/src/auth/Layers/BootstrapCredentialService.test.ts | 153 -------- apps/server/src/auth/Layers/BootstrapCredentialService.ts | 304 --------------- apps/server/src/auth/Layers/ServerAuth.test.ts | 183 --------- apps/server/src/auth/Layers/ServerAuth.ts | 398 ------------------- apps/server/src/auth/Layers/ServerAuthPolicy.test.ts | 115 ------ apps/server/src/auth/Layers/ServerAuthPolicy.ts | 45 --- apps/server/src/auth/Layers/ServerSecretStore.test.ts | 268 ------------- apps/server/src/auth/Layers/ServerSecretStore.ts | 152 -------- apps/server/src/auth/Layers/SessionCredentialService.test.ts | 193 ---------- apps/server/src/auth/Layers/SessionCredentialService.ts | 530 ------------------------- apps/server/src/auth/PairingGrantStore.test.ts | 167 ++++++++ apps/server/src/auth/PairingGrantStore.ts | 386 +++++++++++++++++++ apps/server/src/auth/ServerSecretStore.test.ts | 267 +++++++++++++ apps/server/src/auth/ServerSecretStore.ts | 193 ++++++++++ apps/server/src/auth/Services/AuthControlPlane.ts | 73 ---- apps/server/src/auth/Services/BootstrapCredentialService.ts | 61 --- apps/server/src/auth/Services/ServerAuth.ts | 86 ----- apps/server/src/auth/Services/ServerAuthPolicy.ts | 11 - apps/server/src/auth/Services/ServerSecretStore.ts | 22 -- apps/server/src/auth/Services/SessionCredentialService.ts | 91 ----- apps/server/src/auth/SessionStore.test.ts | 243 ++++++++++++ apps/server/src/auth/SessionStore.ts | 637 ++++++++++++++++++++++++++++++ apps/server/src/auth/http.ts | 574 ++++++++++++++++----------- apps/server/src/auth/utils.test.ts | 28 ++ apps/server/src/auth/utils.ts | 14 +- apps/server/src/bin.test.ts | 50 ++- apps/server/src/cli/auth.ts | 67 ++-- apps/server/src/cli/project.ts | 138 +++---- apps/server/src/cliAuthFormat.test.ts | 12 +- apps/server/src/cliAuthFormat.ts | 18 +- apps/server/src/http.ts | 98 +++-- apps/server/src/orchestration/http.ts | 132 +++---- apps/server/src/persistence/Layers/AuthPairingLinks.ts | 10 +- apps/server/src/persistence/Layers/AuthSessions.ts | 16 +- apps/server/src/persistence/Migrations.ts | 2 + apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.test.ts | 80 ++++ apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.ts | 57 +++ apps/server/src/persistence/Services/AuthPairingLinks.ts | 5 +- apps/server/src/persistence/Services/AuthSessions.ts | 15 +- apps/server/src/server.test.ts | 488 ++++++++++++++++++----- apps/server/src/server.ts | 49 +-- apps/server/src/serverRuntimeStartup.ts | 4 +- apps/server/src/serverSettings.ts | 7 +- apps/server/src/startupAccess.ts | 6 +- apps/server/src/ws.ts | 191 +++++++-- apps/web/package.json | 3 +- apps/web/src/authBootstrap.test.ts | 490 +++++++++-------------- apps/web/src/components/ChatView.browser.tsx | 2 +- apps/web/src/components/KeybindingsToast.browser.tsx | 2 +- apps/web/src/components/settings/ConnectionsSettings.tsx | 261 ++++++++++--- apps/web/src/components/settings/SettingsPanels.browser.tsx | 53 ++- apps/web/src/environments/primary/auth.ts | 341 +++++++++------- apps/web/src/environments/primary/bootstrap.test.ts | 74 ++-- apps/web/src/environments/primary/context.ts | 27 +- apps/web/src/environments/primary/httpClient.ts | 20 + apps/web/src/environments/primary/index.ts | 2 + apps/web/src/environments/primary/sessionState.ts | 37 ++ apps/web/src/environments/runtime/catalog.ts | 6 +- apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts | 61 ++- apps/web/src/environments/runtime/service.savedEnvironments.test.ts | 2 +- apps/web/src/environments/runtime/service.threadSubscriptions.test.ts | 3 +- apps/web/src/environments/runtime/service.ts | 53 +-- apps/web/src/lib/runtime.ts | 34 ++ apps/web/src/localApi.test.ts | 6 +- apps/web/src/rpc/serverState.test.ts | 2 +- apps/web/test/authHttpHandlers.ts | 92 ++++- apps/web/test/environmentHttpTest.ts | 136 +++++++ bun.lock | 7 +- docs/environment-auth.md | 113 ++++++ package.json | 3 +- packages/client-runtime/src/remote.test.ts | 199 ++++++++-- packages/client-runtime/src/remote.ts | 287 +++++++------- packages/client-runtime/src/wsTransport.test.ts | 4 +- packages/contracts/src/auth.ts | 137 +++++-- packages/contracts/src/environmentHttp.ts | 325 ++++++++++++++++ packages/contracts/src/index.ts | 1 + packages/contracts/src/ipc.ts | 8 +- packages/contracts/src/rpc.ts | 98 +++-- packages/shared/package.json | 4 + packages/shared/src/oauthScope.test.ts | 35 ++ packages/shared/src/oauthScope.ts | 40 ++ packages/shared/src/observability.test.ts | 16 + packages/shared/src/observability.ts | 16 + packages/ssh/src/tunnel.test.ts | 4 +- packages/ssh/src/tunnel.ts | 104 +---- 102 files changed, 6822 insertions(+), 4876 deletions(-)