.docs/remote-architecture.md | 302 ++++++ .github/workflows/ci.yml | 2 +- .oxfmtrc.json | 3 +- .plans/18-server-auth-model.md | 823 +++++++++++++++++ apps/desktop/scripts/dev-electron.mjs | 19 +- apps/desktop/src/backendReadiness.test.ts | 83 ++ apps/desktop/src/backendReadiness.ts | 103 +++ apps/desktop/src/desktopSettings.test.ts | 64 ++ apps/desktop/src/desktopSettings.ts | 51 ++ apps/desktop/src/main.ts | 322 ++++++- apps/desktop/src/preload.ts | 9 +- apps/desktop/src/serverExposure.test.ts | 139 +++ apps/desktop/src/serverExposure.ts | 80 ++ apps/server/src/auth/Layers/AuthControlPlane.test.ts | 111 +++ apps/server/src/auth/Layers/AuthControlPlane.ts | 176 ++++ apps/server/src/auth/Layers/BootstrapCredentialService.test.ts | 151 +++ apps/server/src/auth/Layers/BootstrapCredentialService.ts | 296 ++++++ apps/server/src/auth/Layers/ServerAuth.test.ts | 182 ++++ apps/server/src/auth/Layers/ServerAuth.ts | 385 ++++++++ apps/server/src/auth/Layers/ServerAuthPolicy.test.ts | 111 +++ apps/server/src/auth/Layers/ServerAuthPolicy.ts | 57 ++ apps/server/src/auth/Layers/ServerSecretStore.test.ts | 263 ++++++ apps/server/src/auth/Layers/ServerSecretStore.ts | 151 +++ apps/server/src/auth/Layers/SessionCredentialService.test.ts | 191 ++++ apps/server/src/auth/Layers/SessionCredentialService.ts | 493 ++++++++++ apps/server/src/auth/Services/AuthControlPlane.ts | 69 ++ apps/server/src/auth/Services/BootstrapCredentialService.ts | 57 ++ apps/server/src/auth/Services/ServerAuth.ts | 84 ++ apps/server/src/auth/Services/ServerAuthPolicy.ts | 11 + apps/server/src/auth/Services/ServerSecretStore.ts | 22 + apps/server/src/auth/Services/SessionCredentialService.ts | 87 ++ apps/server/src/auth/http.ts | 254 ++++++ apps/server/src/auth/utils.test.ts | 26 + apps/server/src/auth/utils.ts | 121 +++ apps/server/src/cli-config.test.ts | 20 +- apps/server/src/cli.test.ts | 110 ++- apps/server/src/cli.ts | 376 +++++++- apps/server/src/cliAuthFormat.test.ts | 88 ++ apps/server/src/cliAuthFormat.ts | 190 ++++ apps/server/src/config.ts | 6 +- apps/server/src/environment/Layers/ServerEnvironment.test.ts | 2 +- apps/server/src/environment/Layers/ServerEnvironment.ts | 10 +- apps/server/src/environment/Layers/ServerEnvironmentLabel.test.ts | 150 +++ apps/server/src/environment/Layers/ServerEnvironmentLabel.ts | 104 +++ apps/server/src/http.test.ts | 27 + apps/server/src/http.ts | 75 +- apps/server/src/keybindings.test.ts | 19 +- apps/server/src/keybindings.ts | 4 +- apps/server/src/persistence/Errors.ts | 2 + apps/server/src/persistence/Layers/AuthPairingLinks.ts | 209 +++++ apps/server/src/persistence/Layers/AuthSessions.ts | 279 ++++++ apps/server/src/persistence/Migrations.ts | 6 + apps/server/src/persistence/Migrations/020_AuthAccessManagement.ts | 42 + apps/server/src/persistence/Migrations/021_AuthSessionClientMetadata.ts | 62 ++ apps/server/src/persistence/Migrations/022_AuthSessionLastConnectedAt.ts | 17 + apps/server/src/persistence/Services/AuthPairingLinks.ts | 76 ++ apps/server/src/persistence/Services/AuthSessions.ts | 93 ++ apps/server/src/server.test.ts | 868 ++++++++++++++++-- apps/server/src/server.ts | 35 +- apps/server/src/serverRuntimeStartup.test.ts | 9 + apps/server/src/serverRuntimeStartup.ts | 61 +- apps/server/src/ws.ts | 1561 +++++++++++++++++--------------- apps/web/index.html | 86 +- apps/web/src/authBootstrap.test.ts | 460 ++++++++++ apps/web/src/components/BranchToolbar.logic.ts | 9 +- apps/web/src/components/BranchToolbar.tsx | 164 +--- apps/web/src/components/BranchToolbarBranchSelector.tsx | 160 +++- apps/web/src/components/BranchToolbarEnvModeSelector.tsx | 73 ++ apps/web/src/components/BranchToolbarEnvironmentSelector.tsx | 65 ++ apps/web/src/components/ChatView.browser.tsx | 26 +- apps/web/src/components/ChatView.tsx | 277 ++++-- apps/web/src/components/GitActionsControl.browser.tsx | 19 +- apps/web/src/components/KeybindingsToast.browser.tsx | 44 + apps/web/src/components/NoActiveThreadState.tsx | 41 + apps/web/src/components/ProjectFavicon.tsx | 21 +- apps/web/src/components/Sidebar.tsx | 366 ++++++-- apps/web/src/components/SplashScreen.tsx | 9 + apps/web/src/components/ThreadTerminalDrawer.browser.tsx | 48 +- apps/web/src/components/ThreadTerminalDrawer.tsx | 42 +- apps/web/src/components/WebSocketConnectionSurface.tsx | 176 +--- apps/web/src/components/auth/PairingRouteSurface.tsx | 195 ++++ apps/web/src/components/settings/ConnectionsSettings.tsx | 1441 +++++++++++++++++++++++++++++ apps/web/src/components/settings/SettingsPanels.browser.tsx | 592 +++++++++++- apps/web/src/components/settings/SettingsPanels.tsx | 127 +-- apps/web/src/components/settings/SettingsSidebarNav.tsx | 14 +- apps/web/src/components/settings/settingsLayout.tsx | 122 +++ apps/web/src/components/ui/qr-code.test.tsx | 27 + apps/web/src/components/ui/qr-code.tsx | 81 ++ apps/web/src/composerDraftStore.test.ts | 44 + apps/web/src/composerDraftStore.ts | 46 +- apps/web/src/environmentApi.ts | 7 +- apps/web/src/environmentBootstrap.ts | 65 -- apps/web/src/environmentGrouping.test.ts | 453 +++++++++ apps/web/src/environments/primary/auth.ts | 361 ++++++++ apps/web/src/environments/primary/bootstrap.test.ts | 121 +++ apps/web/src/environments/primary/context.ts | 120 +++ apps/web/src/environments/primary/index.ts | 35 + apps/web/src/environments/primary/target.ts | 103 +++ apps/web/src/environments/remote/api.test.ts | 235 +++++ apps/web/src/environments/remote/api.ts | 143 +++ apps/web/src/environments/remote/target.ts | 86 ++ apps/web/src/environments/runtime/catalog.test.ts | 51 ++ apps/web/src/environments/runtime/catalog.ts | 251 +++++ apps/web/src/environments/runtime/connection.test.ts | 216 +++++ apps/web/src/environments/runtime/connection.ts | 296 ++++++ apps/web/src/environments/runtime/index.ts | 29 + apps/web/src/environments/runtime/service.ts | 659 ++++++++++++++ apps/web/src/hooks/useTheme.ts | 53 ++ apps/web/src/index.css | 12 +- apps/web/src/lib/gitReactQuery.ts | 4 +- apps/web/src/lib/gitStatusState.test.ts | 178 +++- apps/web/src/lib/gitStatusState.ts | 104 ++- apps/web/src/lib/utils.test.ts | 43 +- apps/web/src/lib/utils.ts | 29 - apps/web/src/lib/vendor/qrcodegen.ts | 996 ++++++++++++++++++++ apps/web/src/localApi.test.ts | 66 +- apps/web/src/localApi.ts | 23 +- apps/web/src/observability/clientTracing.ts | 7 +- apps/web/src/pairingUrl.ts | 33 + apps/web/src/routeTree.gen.ts | 42 + apps/web/src/routes/__root.tsx | 556 ++---------- apps/web/src/routes/_chat.index.tsx | 28 +- apps/web/src/routes/_chat.tsx | 15 +- apps/web/src/routes/pair.tsx | 47 + apps/web/src/routes/settings.connections.tsx | 7 + apps/web/src/routes/settings.tsx | 14 +- apps/web/src/rpc/client.test.ts | 279 ------ apps/web/src/rpc/client.ts | 42 - apps/web/src/rpc/protocol.ts | 79 +- apps/web/src/rpc/serverState.test.ts | 6 + apps/web/src/rpc/serverState.ts | 2 +- apps/web/src/rpc/wsRpcClient.test.ts | 104 +++ apps/web/src/rpc/wsRpcClient.ts | 242 +++++ apps/web/src/rpc/wsTransport.test.ts | 863 ++++++++++++++++++ apps/web/src/rpc/wsTransport.ts | 276 ++++++ apps/web/src/store.ts | 93 +- apps/web/src/timestampFormat.test.ts | 88 +- apps/web/src/timestampFormat.ts | 87 ++ apps/web/src/uiStateStore.ts | 2 +- apps/web/src/wsRpcClient.test.ts | 130 --- apps/web/src/wsRpcClient.ts | 391 -------- apps/web/src/wsTransport.test.ts | 775 ---------------- apps/web/src/wsTransport.ts | 265 ------ apps/web/test/authHttpHandlers.ts | 41 + apps/web/test/wsRpcHarness.ts | 9 +- apps/web/vite.config.ts | 44 +- packages/client-runtime/src/knownEnvironment.test.ts | 41 +- packages/client-runtime/src/knownEnvironment.ts | 36 +- packages/contracts/src/auth.ts | 266 ++++++ packages/contracts/src/baseSchemas.ts | 2 + packages/contracts/src/index.ts | 1 + packages/contracts/src/ipc.ts | 15 +- packages/contracts/src/model.ts | 1 + packages/contracts/src/rpc.ts | 9 + packages/contracts/src/server.ts | 2 + packages/shared/src/model.test.ts | 1 + scripts/dev-runner.test.ts | 18 +- scripts/dev-runner.ts | 27 +- turbo.json | 2 +- 159 files changed, 20030 insertions(+), 4271 deletions(-)