Commit 28ce9d1c1751d70c869e3de3287b96d5e28fc845 | the-knife

AGENTS.md+1

...	@@ -150,6 +150,7 @@ Architecture and its constraints: `docs/internals/overview.md`. Glossary: `docs/	...	@@ -150,6 +150,7 @@ Architecture and its constraints: `docs/internals/overview.md`. Glossary: `docs/
150	## Taste	150	## Taste
151		151
152	- Complexity belongs at the adapter boundary. Orchestration stays pure, UI stays dumb.	152	- Complexity belongs at the adapter boundary. Orchestration stays pure, UI stays dumb.
		153	- Client mutations use `createEnvironmentRpcCommand`. Add protected methods to `CLIENT_GUARDED_RPC_SCOPES` in contracts and use the command's `permissionAtom` for UI availability. Grants are checked at execution against the destination environment; the server remains authoritative. Keep raw RPC clients inside `rpc/`, and extend the permission behavior tests when adding a protected method.
153	- Server features are services; transports stay thin. A `ws.ts` RPC handler, HTTP route, or MCP tool decodes input, calls one service method, and maps errors. See [Effect services](docs/internals/effect-services.md).	154	- Server features are services; transports stay thin. A `ws.ts` RPC handler, HTTP route, or MCP tool decodes input, calls one service method, and maps errors. See [Effect services](docs/internals/effect-services.md).
154	- `apps/web/src/components/ui` exports own their look. Pick a `variant` or `size`; do not restyle one with `className`. If none fits and the look is a generic concept, add a variant to the component; a look that belongs to one feature stays in that feature's own component, not in `components/ui`. Layout classes (width, flex, margin, position) belong on the parent. `shadcn/no-restyle` fails lint on violations. See [Web UI](docs/internals/web-ui.md).	155	- `apps/web/src/components/ui` exports own their look. Pick a `variant` or `size`; do not restyle one with `className`. If none fits and the look is a generic concept, add a variant to the component; a look that belongs to one feature stays in that feature's own component, not in `components/ui`. Layout classes (width, flex, margin, position) belong on the parent. `shadcn/no-restyle` fails lint on violations. See [Web UI](docs/internals/web-ui.md).
155	- Inferred types over annotations. `any` is the enemy.	156	- Inferred types over annotations. `any` is the enemy.

apps/mobile/src/features/agent-awareness/liveActivityPreferences.test.ts+114-1

...	@@ -25,7 +25,14 @@ vi.mock("react-native", () => ({	...	@@ -25,7 +25,14 @@ vi.mock("react-native", () => ({
25	Platform: { OS: "ios" },	25	Platform: { OS: "ios" },
26	}));	26	}));
27		27
28	vi.mock("../cloud/linkEnvironment", () => ({	28	vi.mock("expo-constants", () => ({
		29	default: { expoConfig: {} },
		30	}));
		31
		32	vi.mock("expo-device", () => ({}));
		33
		34	vi.mock("../cloud/linkEnvironment", async (importOriginal) => ({
		35	...(await importOriginal<typeof import("../cloud/linkEnvironment")>()),
29	linkEnvironmentToCloudWithPreference: vi.fn(() => Effect.void),	36	linkEnvironmentToCloudWithPreference: vi.fn(() => Effect.void),
30	}));	37	}));
31		38
...	@@ -78,6 +85,7 @@ describe("liveActivityPreferences", () => {	...	@@ -78,6 +85,7 @@ describe("liveActivityPreferences", () => {
78	previousEnabled: true,	85	previousEnabled: true,
79	clerkToken: "clerk-token",	86	clerkToken: "clerk-token",
80	connections: [connection],	87	connections: [connection],
		88	canConfigureEnvironment: () => true,
81	});	89	});
82		90
83	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({	91	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
...	@@ -98,6 +106,7 @@ describe("liveActivityPreferences", () => {	...	@@ -98,6 +106,7 @@ describe("liveActivityPreferences", () => {
98	previousEnabled: false,	106	previousEnabled: false,
99	clerkToken: "clerk-token",	107	clerkToken: "clerk-token",
100	connections: [connection],	108	connections: [connection],
		109	canConfigureEnvironment: () => true,
101	});	110	});
102		111
103	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({	112	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
...	@@ -118,6 +127,7 @@ describe("liveActivityPreferences", () => {	...	@@ -118,6 +127,7 @@ describe("liveActivityPreferences", () => {
118	previousEnabled: true,	127	previousEnabled: true,
119	clerkToken: null,	128	clerkToken: null,
120	connections: [connection],	129	connections: [connection],
		130	canConfigureEnvironment: () => true,
121	});	131	});
122		132
123	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({	133	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
...	@@ -139,6 +149,7 @@ describe("liveActivityPreferences", () => {	...	@@ -139,6 +149,7 @@ describe("liveActivityPreferences", () => {
139	previousEnabled: false,	149	previousEnabled: false,
140	clerkToken: "clerk-token",	150	clerkToken: "clerk-token",
141	connections: [connection, managedConnection],	151	connections: [connection, managedConnection],
		152	canConfigureEnvironment: () => true,
142	});	153	});
143		154
144	expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledTimes(1);	155	expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledTimes(1);
...	@@ -162,6 +173,7 @@ describe("liveActivityPreferences", () => {	...	@@ -162,6 +173,7 @@ describe("liveActivityPreferences", () => {
162	previousEnabled: true,	173	previousEnabled: true,
163	clerkToken: "clerk-token",	174	clerkToken: "clerk-token",
164	connections: [connection],	175	connections: [connection],
		176	canConfigureEnvironment: () => true,
165	}),	177	}),
166	);	178	);
167		179
...	@@ -184,4 +196,105 @@ describe("liveActivityPreferences", () => {	...	@@ -184,4 +196,105 @@ describe("liveActivityPreferences", () => {
184	});	196	});
185	}).pipe(Effect.provide(layerTest));	197	}).pipe(Effect.provide(layerTest));
186	});	198	});
		199
		200	it.effect("only re-links environments with relay access when enabling updates", () => {
		201	const readOnlyConnection: SavedRemoteConnection = {
		202	...connection,
		203	environmentId: "read-only" as EnvironmentId,
		204	};
		205
		206	return Effect.gen(function* () {
		207	yield* setLiveActivityUpdatesEnabled({
		208	enabled: true,
		209	previousEnabled: false,
		210	clerkToken: "clerk-token",
		211	connections: [readOnlyConnection, connection],
		212	canConfigureEnvironment: (environmentId) => environmentId === connection.environmentId,
		213	});
		214
		215	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
		216	liveActivitiesEnabled: true,
		217	});
		218	expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledExactlyOnceWith({
		219	clerkToken: "clerk-token",
		220	connection,
		221	liveActivitiesEnabled: true,
		222	});
		223	}).pipe(Effect.provide(layerTest));
		224	});
		225
		226	it.effect("keeps device updates independently switchable without relay access", () =>
		227	Effect.gen(function* () {
		228	for (const enabled of [false, true]) {
		229	yield* setLiveActivityUpdatesEnabled({
		230	enabled,
		231	previousEnabled: !enabled,
		232	clerkToken: "clerk-token",
		233	connections: [connection],
		234	canConfigureEnvironment: () => false,
		235	});
		236	}
		237
		238	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(1, {
		239	liveActivitiesEnabled: false,
		240	});
		241	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(2, {
		242	liveActivitiesEnabled: true,
		243	});
		244	expect(linkEnvironmentToCloudWithPreference).not.toHaveBeenCalled();
		245	}).pipe(Effect.provide(layerTest)),
		246	);
		247
		248	it.effect("checks current relay access after updating the device registration", () => {
		249	let canConfigureEnvironment = true;
		250	vi.mocked(updateAgentAwarenessRegistrationPreferences).mockImplementationOnce(() =>
		251	Effect.sync(() => {
		252	canConfigureEnvironment = false;
		253	}),
		254	);
		255
		256	return Effect.gen(function* () {
		257	yield* setLiveActivityUpdatesEnabled({
		258	enabled: false,
		259	previousEnabled: true,
		260	clerkToken: "clerk-token",
		261	connections: [connection],
		262	canConfigureEnvironment: () => canConfigureEnvironment,
		263	});
		264
		265	expect(linkEnvironmentToCloudWithPreference).not.toHaveBeenCalled();
		266	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledTimes(1);
		267	}).pipe(Effect.provide(layerTest));
		268	});
		269
		270	it.effect("does not retry environment changes after relay access is revoked", () => {
		271	let canConfigureEnvironment = true;
		272	vi.mocked(linkEnvironmentToCloudWithPreference).mockImplementationOnce(() =>
		273	Effect.sync(() => {
		274	canConfigureEnvironment = false;
		275	}).pipe(
		276	Effect.andThen(
		277	Effect.fail(new CloudEnvironmentLinkError({ message: "relay access revoked" })),
		278	),
		279	),
		280	);
		281
		282	return Effect.gen(function* () {
		283	const exit = yield* Effect.exit(
		284	setLiveActivityUpdatesEnabled({
		285	enabled: false,
		286	previousEnabled: true,
		287	clerkToken: "clerk-token",
		288	connections: [connection],
		289	canConfigureEnvironment: () => canConfigureEnvironment,
		290	}),
		291	);
		292
		293	expect(exit._tag).toBe("Failure");
		294	expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledTimes(1);
		295	expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(2, {
		296	liveActivitiesEnabled: true,
		297	});
		298	}).pipe(Effect.provide(layerTest));
		299	});
187	});	300	});

apps/mobile/src/features/agent-awareness/liveActivityPreferences.ts+18-11

 @@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import type { EnvironmentId } from "@t3tools/contracts";
 import type { SavedRemoteConnection } from "../../lib/connection";
 import { linkEnvironmentToCloudWithPreference } from "../cloud/linkEnvironment";
 @@ -10,11 +11,26 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
     readonly previousEnabled: boolean;
     readonly clerkToken: string | null;
     readonly connections: ReadonlyArray<SavedRemoteConnection>;
+    readonly canConfigureEnvironment: (environmentId: EnvironmentId) => boolean;
   }) {
     const linkedConnections = input.connections.filter(
       (connection) => connection.bearerToken !== null,
     );
+    const updateEnvironmentPreference = Effect.fn("updateEnvironmentPreference")(function* (
+      connection: SavedRemoteConnection,
+      enabled: boolean,
+      clerkToken: string,
+    ) {
+      if (!input.canConfigureEnvironment(connection.environmentId)) return;
+      yield* linkEnvironmentToCloudWithPreference({
+        clerkToken,
+        connection,
+        liveActivitiesEnabled: enabled,
+      });
+    });
     const updateRelayPreference = Effect.fn("updateRelayPreference")(function* (enabled: boolean) {
       yield* updateAgentAwarenessRegistrationPreferences({
         liveActivitiesEnabled: enabled,
 @@ -25,12 +41,7 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
       yield* Effect.forEach(
         linkedConnections,
-        (connection) =>
+        (connection) => updateEnvironmentPreference(connection, enabled, clerkToken),
-          linkEnvironmentToCloudWithPreference({
-            clerkToken,
-            connection,
-            liveActivitiesEnabled: enabled,
-          }),
         { concurrency: "unbounded" },
       );
     });
 @@ -50,11 +61,7 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
       yield* Effect.forEach(
         linkedConnections,
         (connection) =>
-          linkEnvironmentToCloudWithPreference({
+          updateEnvironmentPreference(connection, input.previousEnabled, clerkToken).pipe(
-            clerkToken,
-            connection,
-            liveActivitiesEnabled: input.previousEnabled,
-          }).pipe(
             Effect.catchCause((cause) =>
               Effect.logWarning(
                 `Could not restore Live Activity preference for environment ${connection.environmentId}.`,

apps/mobile/src/features/archive/ArchivedThreadsScreen.tsx+62-53

 @@ -4,6 +4,7 @@ import type {
 } from "@t3tools/client-runtime/state/shell";
 import { LegendList } from "@legendapp/list/react-native";
 import {
+  AuthOrchestrationOperateScope,
   type EnvironmentId,
   type EnvironmentMachineKind,
   resolveEnvironmentMachineKind,
 @@ -30,6 +31,7 @@ import { ProjectFavicon } from "../../components/ProjectFavicon";
 import { relativeTime } from "../../lib/time";
 import { useUniwindTheme } from "../../lib/useUniwindTheme";
 import { useServerConfigs } from "../../state/entities";
+import { useEnvironmentScope } from "../../state/session";
 import { ThreadSwipeable } from "../home/thread-swipe-actions";
 import type { ArchivedThreadGroup, ArchivedThreadSortOrder } from "./archivedThreadList";
 import { SettingsScreenContent } from "../settings/components/SettingsScreen";
 @@ -191,24 +193,74 @@ function ArchivedThreadRow(props: {
 }) {
   const { width: windowWidth } = useWindowDimensions();
   const cardColor = useUniwindTheme()["--color-grouped-card"];
+  const canOperateThread = useEnvironmentScope(
+    props.thread.environmentId,
+    AuthOrchestrationOperateScope,
+  );
   const timestamp = relativeTime(props.thread.archivedAt ?? props.thread.updatedAt);
   const subtitle = [props.environmentLabel, props.thread.branch].filter((part): part is string =>
     Boolean(part),
   );
+  const rowContent = (
+    <View
+      className={`flex-row items-center gap-3 bg-grouped-card px-4 py-3 ${props.isLast ? "" : "border-b border-separator"}`}
+    >
+      <View className="h-[34px] w-[34px] items-center justify-center rounded-[11px] bg-subtle">
+        <SymbolView
+          name="archivebox.fill"
+          size={15}
+          tintColorClassName="accent-icon-subtle"
+          type="monochrome"
+        />
+      </View>
+      <View className="min-w-0 flex-1 gap-1">
+        <View className="flex-row items-center gap-2">
+          <Text
+            className="min-w-0 flex-1 text-base font-t3-bold leading-snug text-foreground"
+            numberOfLines={1}
+          >
+            {props.thread.title}
+          </Text>
+          <Text className="min-w-[30px] text-right text-xs tabular-nums text-foreground-tertiary">
+            {timestamp}
+          </Text>
+        </View>
+        {subtitle.length > 0 ? (
+          <View className="flex-row items-center gap-1.5">
+            <SymbolView
+              name="arrow.triangle.branch"
+              size={10}
+              tintColorClassName="accent-icon-subtle"
+              type="monochrome"
+            />
+            <Text
+              className="min-w-0 flex-1 font-mono text-2xs text-foreground-tertiary"
+              numberOfLines={1}
+            >
+              {subtitle.join(" · ")}
+            </Text>
+          </View>
+        ) : null}
+      </View>
+    </View>
+  );
+  // Keep the group's rounded corners on both interactive and read-only rows.
+  const containerStyle = {
+    borderTopLeftRadius: props.isFirst ? 20 : 0,
+    borderTopRightRadius: props.isFirst ? 20 : 0,
+    borderBottomLeftRadius: props.isLast ? 20 : 0,
+    borderBottomRightRadius: props.isLast ? 20 : 0,
+    overflow: "hidden" as const,
+  };
+  if (!canOperateThread) return <View style={containerStyle}>{rowContent}</View>;
   return (
     <ThreadSwipeable
       resetKey={`${props.thread.environmentId}:${props.thread.id}`}
       threadKey={`${props.thread.environmentId}:${props.thread.id}`}
       backgroundColor={cardColor}
-      // Round + clip the swipeable container so the group's corners stay
+      containerStyle={containerStyle}
-      // rounded while rows swipe; the row itself stays square inside.
-      containerStyle={{
-        borderTopLeftRadius: props.isFirst ? 20 : 0,
-        borderTopRightRadius: props.isFirst ? 20 : 0,
-        borderBottomLeftRadius: props.isLast ? 20 : 0,
-        borderBottomRightRadius: props.isLast ? 20 : 0,
-        overflow: "hidden",
-      }}
       fullSwipeWidth={windowWidth - 32}
       onDelete={props.onDelete}
       onSwipeableClose={props.onSwipeableClose}
 @@ -222,50 +274,7 @@ function ArchivedThreadRow(props: {
       simultaneousWith={props.simultaneousSwipeGesture}
       threadTitle={props.thread.title}
     >
-      {() => (
+      {() => rowContent}
-        <View
-          className={`flex-row items-center gap-3 bg-grouped-card px-4 py-3 ${props.isLast ? "" : "border-b border-separator"}`}
-        >
-          <View className="h-[34px] w-[34px] items-center justify-center rounded-[11px] bg-subtle">
-            <SymbolView
-              name="archivebox.fill"
-              size={15}
-              tintColorClassName="accent-icon-subtle"
-              type="monochrome"
-            />
-          </View>
-          <View className="min-w-0 flex-1 gap-1">
-            <View className="flex-row items-center gap-2">
-              <Text
-                className="min-w-0 flex-1 text-base font-t3-bold leading-snug text-foreground"
-                numberOfLines={1}
-              >
-                {props.thread.title}
-              </Text>
-              <Text className="min-w-[30px] text-right text-xs tabular-nums text-foreground-tertiary">
-                {timestamp}
-              </Text>
-            </View>
-            {subtitle.length > 0 ? (
-              <View className="flex-row items-center gap-1.5">
-                <SymbolView
-                  name="arrow.triangle.branch"
-                  size={10}
-                  tintColorClassName="accent-icon-subtle"
-                  type="monochrome"
-                />
-                <Text
-                  className="min-w-0 flex-1 font-mono text-2xs text-foreground-tertiary"
-                  numberOfLines={1}
-                >
-                  {subtitle.join(" · ")}
-                </Text>
-              </View>
-            ) : null}
-          </View>
-        </View>
-      )}
     </ThreadSwipeable>
   );
 }

apps/mobile/src/features/home/useThreadListActions.test.ts created+326

...	@@ -0,0 +1,326 @@
1	import { makeThreadShellFixture } from "../../test-fixtures";
2	import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";
3	import {
4	AuthOrchestrationOperateScope,
5	EnvironmentId,
6	ProjectId,
7	ProviderInstanceId,
8	ThreadId,
9	} from "@t3tools/contracts";
10	import * as Cause from "effect/Cause";
11	import { AsyncResult } from "effect/reactivity";
12	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
13
14	const state = vi.hoisted(() => ({
15	pendingOrder: null as object \| null,
16	dropBusy: false,
17	scopes: new Map<string, Set<string>>(),
18	shells: [] as EnvironmentThreadShell[],
19	requests: [] as {
20	action: string;
21	environmentId: string;
22	input: { threadId: string; orderKey?: string };
23	}[],
24	dialogs: [] as { onConfirm: () => void }[],
25	alerts: [] as {
26	title: string;
27	buttons?: { text: string; onPress?: () => void }[];
28	}[],
29	afterRequest: undefined as (() => void) \| undefined,
30	}));
31
32	vi.mock("react", () => ({
33	useCallback: (callback: unknown) => callback,
34	useRef: (current: unknown) => ({ current }),
35	}));
36	vi.mock("react-native", () => ({
37	Alert: {
38	alert: (title: string, _message: string, buttons?: { text: string; onPress?: () => void }[]) =>
39	state.alerts.push({ title, buttons }),
40	},
41	}));
42	vi.mock("expo-haptics", () => ({
43	impactAsync: async () => {},
44	ImpactFeedbackStyle: { Light: "light" },
45	}));
46	vi.mock("../../components/ConfirmDialogHost", () => ({
47	showConfirmDialog: (dialog: { onConfirm: () => void }) => state.dialogs.push(dialog),
48	}));
49	vi.mock("../archive/useArchivedThreadSnapshots", () => ({
50	refreshArchivedThreadsForEnvironment: () => {},
51	}));
52	vi.mock("../../state/session", () => ({
53	readEnvironmentScope: (environmentId: string, scope: string) =>
54	state.scopes.get(environmentId)?.has(scope) === true,
55	}));
56	vi.mock("../../state/server", () => ({
57	environmentServerConfigsAtom: "server-configs",
58	}));
59	vi.mock("../../state/atom-registry", () => ({
60	appAtomRegistry: {
61	set: (_atom: string, value: boolean) => {
62	state.dropBusy = value;
63	},
64	get: (atom: string) =>
65	atom === "thread-drop-busy"
66	? state.dropBusy
67	: atom === "thread-shells"
68	? state.shells
69	: atom === "queued-thread-keys"
70	? new Set<string>()
71	: new Map(
72	[...state.scopes.keys()].map((environmentId) => [
73	environmentId,
74	{
75	environment: {
76	capabilities: {
77	threadSettlement: true,
78	threadSnooze: true,
79	threadPinning: true,
80	threadPinReorder: true,
81	threadTitleRegeneration: true,
82	},
83	},
84	},
85	]),
86	),
87	},
88	}));
89	vi.mock("../../state/use-atom-command", () => ({
90	useAtomCommand: (command: unknown) => command,
91	}));
92	// Stubbed at the direct dependency: the real outbox pulls the Expo file-system
93	// storage into a test that only reads which threads are queued.
94	vi.mock("../../state/use-thread-outbox", () => ({ queuedThreadKeysAtom: "queued-thread-keys" }));
95	// The real hold lives in a module-level atom that would leak between cases.
96	vi.mock("../../state/thread-order", () => ({
97	threadDropBusyAtom: "thread-drop-busy",
98	getPendingThreadOrder: () => state.pendingOrder,
99	beginPendingThreadOrder: () => {
100	state.pendingOrder = {};
101	return {
102	isPending: () => state.pendingOrder !== null,
103	complete: () => {
104	state.pendingOrder = null;
105	},
106	cancel: () => {
107	state.pendingOrder = null;
108	},
109	};
110	},
111	}));
112	vi.mock("../../state/threads", () => ({
113	environmentThreadShells: { threadShellsAtom: "thread-shells" },
114	threadEnvironment: Object.fromEntries(
115	[
116	"archive",
117	"unarchive",
118	"delete",
119	"settle",
120	"unsettle",
121	"snooze",
122	"unsnooze",
123	"pin",
124	"unpin",
125	"reorderPin",
126	"updateMetadata",
127	].map((action) => [
128	action,
129	async (request: {
130	environmentId: string;
131	input: { threadId: string; orderKey?: string };
132	}) => {
133	state.requests.push({ action, ...request });
134	if (!state.scopes.get(request.environmentId)?.has(AuthOrchestrationOperateScope)) {
135	return AsyncResult.failure(Cause.fail(new Error("Thread operation denied")));
136	}
137	state.afterRequest?.();
138	return AsyncResult.success(undefined);
139	},
140	]),
141	),
142	}));
143
144	import { useArchivedThreadListActions, useThreadListActions } from "./useThreadListActions";
145
146	const primaryEnvironmentId = EnvironmentId.make("primary");
147	const otherEnvironmentId = EnvironmentId.make("other");
148
149	function makeThread(input: Partial<EnvironmentThreadShell> = {}): EnvironmentThreadShell {
150	return makeThreadShellFixture({
151	id: ThreadId.make("thread"),
152	title: "Thread",
153	environmentId: primaryEnvironmentId,
154	projectId: ProjectId.make("project"),
155	modelSelection: { instanceId: ProviderInstanceId.make("codex"), model: "model" },
156	...input,
157	});
158	}
159
160	const mutationCases = [
161	["archiveThread", "archive"],
162	["settleThread", "settle"],
163	["unsettleThread", "unsettle"],
164	["snoozeThread", "snooze"],
165	["unsnoozeThread", "unsnooze"],
166	["pinThread", "pin"],
167	["unpinThread", "unpin"],
168	["regenerateThreadTitle", "updateMetadata"],
169	] as const;
170
171	beforeEach(() => {
172	state.pendingOrder = null;
173	state.dropBusy = false;
174	state.scopes = new Map([
175	[primaryEnvironmentId, new Set([AuthOrchestrationOperateScope])],
176	[otherEnvironmentId, new Set<string>()],
177	]);
178	state.requests = [];
179	state.shells = [];
180	state.dialogs = [];
181	state.alerts = [];
182	state.afterRequest = undefined;
183	});
184
185	afterEach(() => vi.unstubAllEnvs());
186
187	describe("thread list operation permissions", () => {
188	it.each(mutationCases)(
189	"%s rejects a retained callback after its environment loses permission",
190	async (handler) => {
191	const actions = useThreadListActions();
192	state.scopes.get(primaryEnvironmentId)!.clear();
193
194	await actions[handler](makeThread(), "2099-01-01T00:00:00.000Z");
195
196	expect(state.requests).toEqual([]);
197	},
198	);
199
200	it.each(mutationCases)("%s requires the target environment's permission", async (handler) => {
201	await useThreadListActions()[handler](
202	makeThread({ environmentId: otherEnvironmentId }),
203	"2099-01-01T00:00:00.000Z",
204	);
205
206	expect(state.requests).toEqual([]);
207	});
208
209	it.each(mutationCases)(
210	"%s works when the target environment gains only task permission",
211	async (handler, action) => {
212	state.scopes.get(primaryEnvironmentId)!.clear();
213	const actions = useThreadListActions();
214	state.scopes.get(otherEnvironmentId)!.add(AuthOrchestrationOperateScope);
215
216	await actions[handler](
217	makeThread({ environmentId: otherEnvironmentId }),
218	"2099-01-01T00:00:00.000Z",
219	);
220
221	expect(state.requests).toEqual([
222	expect.objectContaining({ action, environmentId: otherEnvironmentId }),
223	]);
224	},
225	);
226
227	it.each(["ios", "android"])("does not show a forbidden %s delete confirmation", (os) => {
228	vi.stubEnv("EXPO_OS", os);
229	useThreadListActions().confirmDeleteThread(makeThread({ environmentId: otherEnvironmentId }));
230
231	expect(state.dialogs).toEqual([]);
232	expect(state.alerts.some((alert) => alert.title === "Delete thread?")).toBe(false);
233	expect(state.requests).toEqual([]);
234	});
235
236	it.each(["ios", "android"])(
237	"rechecks permission after a retained %s delete confirmation",
238	async (os) => {
239	vi.stubEnv("EXPO_OS", os);
240	useThreadListActions().confirmDeleteThread(makeThread());
241	const confirm =
242	os === "ios"
243	? state.alerts[0]?.buttons?.find((button) => button.text === "Delete")?.onPress
244	: state.dialogs[0]?.onConfirm;
245	expect(confirm).toBeTypeOf("function");
246	state.scopes.get(primaryEnvironmentId)!.clear();
247
248	await confirm!();
249
250	expect(state.requests).toEqual([]);
251	},
252	);
253
254	it("unarchives with only task permission and blocks a later revoked callback", async () => {
255	const actions = useArchivedThreadListActions(() => {});
256	const thread = makeThread({ archivedAt: "2026-09-02T00:00:00.000Z" });
257	await actions.unarchiveThread(thread);
258	expect(state.requests).toEqual([expect.objectContaining({ action: "unarchive" })]);
259	state.requests = [];
260	state.scopes.get(primaryEnvironmentId)!.clear();
261
262	await actions.unarchiveThread(thread);
263
264	expect(state.requests).toEqual([]);
265	});
266
267	it("keeps delete independent of terminal and source-control permissions", async () => {
268	vi.stubEnv("EXPO_OS", "android");
269	useArchivedThreadListActions(() => {}).confirmDeleteThread(makeThread());
270	await state.dialogs[0]!.onConfirm();
271
272	expect(state.requests).toEqual([expect.objectContaining({ action: "delete" })]);
273	});
274	});
275
276	describe("pinned thread operation permissions", () => {
277	it("checks every materialization target before writing any keys", async () => {
278	const moved = makeThread({ pinnedAt: "2026-09-02T00:00:00.000Z" });
279	state.shells = [
280	moved,
281	makeThread({
282	id: ThreadId.make("other-thread"),
283	environmentId: otherEnvironmentId,
284	pinnedAt: "2026-09-02T00:00:00.000Z",
285	createdAt: "2026-09-02T00:00:00.000Z",
286	}),
287	];
288
289	expect(await useThreadListActions().moveThread(moved, "up")).toBe(false);
290	expect(state.requests).toEqual([]);
291	});
292
293	it("moves a keyed thread past a read-only neighbor without writing that neighbor", async () => {
294	const moved = makeThread({ pinnedAt: "2026-09-02T00:00:00.000Z", pinOrderKey: "m" });
295	state.shells = [
296	moved,
297	makeThread({
298	id: ThreadId.make("other-thread"),
299	environmentId: otherEnvironmentId,
300	pinnedAt: "2026-09-02T00:00:00.000Z",
301	pinOrderKey: "g",
302	}),
303	];
304
305	expect(await useThreadListActions().moveThread(moved, "up")).toBe(true);
306	expect(state.requests).toEqual([
307	expect.objectContaining({ action: "reorderPin", environmentId: primaryEnvironmentId }),
308	]);
309	});
310
311	it("rechecks permission between materialization writes", async () => {
312	const moved = makeThread({ pinnedAt: "2026-09-02T00:00:00.000Z" });
313	state.shells = [
314	moved,
315	makeThread({
316	id: ThreadId.make("other-thread"),
317	pinnedAt: "2026-09-02T00:00:00.000Z",
318	createdAt: "2026-09-02T00:00:00.000Z",
319	}),
320	];
321	state.afterRequest = () => state.scopes.get(primaryEnvironmentId)!.clear();
322
323	expect(await useThreadListActions().moveThread(moved, "up")).toBe(false);
324	expect(state.requests).toHaveLength(1);
325	});
326	});

apps/mobile/src/features/home/useThreadListActions.ts+22

apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx+33-7

 @@ -1,6 +1,11 @@
 import { useAtomValue } from "@effect/atom-react";
 import { useNavigation, type StaticScreenProps } from "@react-navigation/native";
-import type { EnvironmentId, ServerProvider } from "@t3tools/contracts";
+import {
+  AuthProvidersManageScope,
+  AuthOrchestrationReadScope,
+  type EnvironmentId,
+  type ServerProvider,
+} from "@t3tools/contracts";
 import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { AsyncResult } from "effect/reactivity";
 import { useEffect, useRef, useState } from "react";
 @@ -10,8 +15,9 @@ import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { AppText as Text } from "../../components/AppText";
 import { ProviderIcon } from "../../components/ProviderIcon";
 import { ScreenScrollView } from "../../components/ScreenScrollView";
+import { appAtomRegistry } from "../../state/atom-registry";
 import { serverEnvironment } from "../../state/server";
-import { environmentSession } from "../../state/session";
+import { environmentSession, useEnvironmentScope, readEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { useRemoteConnections } from "../../state/use-remote-environment-registry";
 import { ConnectionEnvironmentRow } from "../connection/ConnectionEnvironmentRow";
 @@ -75,7 +81,10 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
       (provider) =>
         provider.updateState?.status === "running" || provider.updateState?.status === "queued",
     ) ?? false;
-  const disabled = !allowed || pending !== null || running || providerBusy;
+  const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
+  const canRead = useEnvironmentScope(environmentId, AuthOrchestrationReadScope);
+  const busy = !connected || pending !== null || running || providerBusy;
+  const disabled = !allowed || busy;
   const version = config?.environment.serverVersion;
   const checkedRelease = release?.fromVersion === version ? release : null;
   const capabilities = config?.environment.capabilities;
 @@ -111,6 +120,16 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
           text: "Update",
           onPress: () =>
             void run("server", async () => {
+              if (
+                AsyncResult.isFailure(
+                  appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId)),
+                ) ||
+                !canMaintainEnvironment(
+                  appAtomRegistry.get(environmentSession.sessionStateValueAtom(environmentId)),
+                  connected,
+                )
+              )
+                return;
               const result = await updateServer({
                 environmentId,
                 input: {
 @@ -131,7 +150,12 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
   }
   function requestProviderUpdate(provider: ServerProvider) {
-    if (disabled || !canUpdateEnvironmentProvider(provider)) return;
+    if (
+      busy ||
+      !readEnvironmentScope(environmentId, AuthProvidersManageScope) ||
+      !canUpdateEnvironmentProvider(provider)
+    )
+      return;
     void run(provider.instanceId, async () => {
       const result = await updateProvider({
         environmentId,
 @@ -274,11 +298,13 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
                   <SettingsActionRow
                     icon="arrow.clockwise"
                     label="Refresh providers"
-                    disabled={disabled}
+                    disabled={busy || !canRead}
                     loading={pending === "refresh"}
                     onPress={() => {
-                      if (disabled) return;
+                      if (busy || !canRead) return;
                       void run("refresh", async () => {
+                        if (!readEnvironmentScope(environmentId, AuthOrchestrationReadScope))
+                          return;
                         const result = await refreshProviders({ environmentId, input: {} });
                         if (AsyncResult.isFailure(result)) throw squashAtomCommandFailure(result);
                         setNotice("Provider status refreshed.");
 @@ -338,7 +364,7 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
                           <SettingsActionRow
                             icon="arrow.up.circle"
                             label={`Update ${provider.displayName ?? provider.driver}`}
-                            disabled={disabled}
+                            disabled={busy || !canManageProviders}
                             loading={pending === provider.instanceId}
                             onPress={() => requestProviderUpdate(provider)}
                           />

apps/mobile/src/features/settings/SettingsNotificationsRouteScreen.tsx+7-1

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthRelayWriteScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope } from "../../state/session";
1	import { ScreenScrollView as ScrollView } from "../../components/ScreenScrollView";	3	import { ScreenScrollView as ScrollView } from "../../components/ScreenScrollView";
2	import { useAuth } from "@clerk/expo";	4	import { useAuth } from "@clerk/expo";
3	import { useAtomSet, useAtomValue } from "@effect/atom-react";	5	import { useAtomSet, useAtomValue } from "@effect/atom-react";
...	@@ -271,6 +273,8 @@ function ConfiguredSettingsNotificationsRouteScreen() {	...	@@ -271,6 +273,8 @@ function ConfiguredSettingsNotificationsRouteScreen() {
271	const updateResult = await settleAsyncResult(() =>	273	const updateResult = await settleAsyncResult(() =>
272	runtime.runPromiseExit(	274	runtime.runPromiseExit(
273	setLiveActivityUpdatesEnabled({	275	setLiveActivityUpdatesEnabled({
		276	canConfigureEnvironment: (environmentId) =>
		277	readEnvironmentScope(environmentId, AuthRelayWriteScope),
274	enabled: true,	278	enabled: true,
275	previousEnabled: liveActivitiesPreferenceEnabled,	279	previousEnabled: liveActivitiesPreferenceEnabled,
276	clerkToken: tokenResult.value,	280	clerkToken: tokenResult.value,
...	@@ -302,7 +306,7 @@ function ConfiguredSettingsNotificationsRouteScreen() {	...	@@ -302,7 +306,7 @@ function ConfiguredSettingsNotificationsRouteScreen() {
302	Alert.alert(	306	Alert.alert(
303	Platform.OS === "android" ? "Ongoing activity enabled" : "Live Activities enabled",	307	Platform.OS === "android" ? "Ongoing activity enabled" : "Live Activities enabled",
304	environmentCount > 0	308	environmentCount > 0
305	? `${environmentCount} environment${environmentCount === 1 ? "" : "s"} linked for agent activity updates.`	309	? "Agent activity updates are enabled for environments this connection can configure."
306	: "Agent activity updates are enabled. Add an environment to start receiving updates.",	310	: "Agent activity updates are enabled. Add an environment to start receiving updates.",
307	);	311	);
308	} else {	312	} else {
...	@@ -370,6 +374,8 @@ function ConfiguredSettingsNotificationsRouteScreen() {	...	@@ -370,6 +374,8 @@ function ConfiguredSettingsNotificationsRouteScreen() {
370	const updateResult = await settleAsyncResult(() =>	374	const updateResult = await settleAsyncResult(() =>
371	runtime.runPromiseExit(	375	runtime.runPromiseExit(
372	setLiveActivityUpdatesEnabled({	376	setLiveActivityUpdatesEnabled({
		377	canConfigureEnvironment: (environmentId) =>
		378	readEnvironmentScope(environmentId, AuthRelayWriteScope),
373	enabled: false,	379	enabled: false,
374	previousEnabled: liveActivitiesPreferenceEnabled,	380	previousEnabled: liveActivitiesPreferenceEnabled,
375	clerkToken: token,	381	clerkToken: token,

apps/mobile/src/features/settings/SettingsRouteScreen.logic.test.ts+60-1

...	@@ -1,6 +1,65 @@	...	@@ -1,6 +1,65 @@
		1	import { EnvironmentId } from "@t3tools/contracts";
1	import { describe, expect, it } from "vite-plus/test";	2	import { describe, expect, it } from "vite-plus/test";
2		3
3	import { resolveAgentAwarenessPlatformPresentation } from "./SettingsRouteScreen.logic";	4	import {
		5	resolveAgentAwarenessPlatformPresentation,
		6	resolveAutoSettleReferenceEnvironmentId,
		7	} from "./SettingsRouteScreen.logic";
		8
		9	describe("resolveAutoSettleReferenceEnvironmentId", () => {
		10	const firstId = EnvironmentId.make("first");
		11	const secondId = EnvironmentId.make("second");
		12
		13	it("waits for an earlier grant before exposing a later writable reference", () => {
		14	const second = { environmentId: secondId, canWriteSettings: true };
		15	expect(
		16	resolveAutoSettleReferenceEnvironmentId([
		17	{ environmentId: firstId, canWriteSettings: null },
		18	second,
		19	]),
		20	).toBeNull();
		21	expect(
		22	resolveAutoSettleReferenceEnvironmentId([
		23	{ environmentId: firstId, canWriteSettings: false },
		24	second,
		25	]),
		26	).toBe(secondId);
		27	expect(
		28	resolveAutoSettleReferenceEnvironmentId([
		29	{ environmentId: firstId, canWriteSettings: true },
		30	second,
		31	]),
		32	).toBe(firstId);
		33	});
		34
		35	it("does not wait for later grants after finding the first writable reference", () => {
		36	expect(
		37	resolveAutoSettleReferenceEnvironmentId([
		38	{ environmentId: firstId, canWriteSettings: true },
		39	{ environmentId: secondId, canWriteSettings: null },
		40	]),
		41	).toBe(firstId);
		42	});
		43
		44	it("waits before showing a read-only fallback until all grants are resolved", () => {
		45	expect(
		46	resolveAutoSettleReferenceEnvironmentId([
		47	{ environmentId: firstId, canWriteSettings: false },
		48	{ environmentId: secondId, canWriteSettings: null },
		49	]),
		50	).toBeNull();
		51	expect(
		52	resolveAutoSettleReferenceEnvironmentId([
		53	{ environmentId: firstId, canWriteSettings: false },
		54	{ environmentId: secondId, canWriteSettings: false },
		55	]),
		56	).toBe(firstId);
		57	});
		58
		59	it("has no reference when no environment supports synchronization", () => {
		60	expect(resolveAutoSettleReferenceEnvironmentId([])).toBeNull();
		61	});
		62	});
4		63
5	describe("resolveAgentAwarenessPlatformPresentation", () => {	64	describe("resolveAgentAwarenessPlatformPresentation", () => {
6	it("supports agent awareness settings on Android", () => {	65	it("supports agent awareness settings on Android", () => {

apps/mobile/src/features/settings/SettingsRouteScreen.logic.ts+16

...	@@ -1,3 +1,19 @@	...	@@ -1,3 +1,19 @@
		1	import type { EnvironmentId } from "@t3tools/contracts";
		2
		3	/** Wait for earlier grants before choosing the settings that edits and synchronization use. */
		4	export function resolveAutoSettleReferenceEnvironmentId(
		5	environments: ReadonlyArray<{
		6	readonly environmentId: EnvironmentId;
		7	readonly canWriteSettings: boolean \| null;
		8	}>,
		9	): EnvironmentId \| null {
		10	for (const environment of environments) {
		11	if (environment.canWriteSettings === null) return null;
		12	if (environment.canWriteSettings) return environment.environmentId;
		13	}
		14	return environments[0]?.environmentId ?? null;
		15	}
		16
1	export function resolveAgentAwarenessPlatformPresentation(platform: string): {	17	export function resolveAgentAwarenessPlatformPresentation(platform: string): {
2	readonly supported: boolean;	18	readonly supported: boolean;
3	readonly subtitle: string \| undefined;	19	readonly subtitle: string \| undefined;

apps/mobile/src/features/settings/SettingsScheduledTasksRouteScreen.tsx+28-6

 @@ -1,3 +1,6 @@
+import { useAtomValue } from "@effect/atom-react";
+import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
+import { readEnvironmentScope } from "../../state/session";
 import type {
   EnvironmentId,
   ProjectId,
 @@ -580,6 +583,9 @@ function TaskForm({
   const projects = useProjects().filter((project) => project.environmentId === environmentId);
   const config = useEnvironmentServerConfig(environmentId);
   const modelOptions = useMemo(() => buildModelOptions(config, null), [config]);
+  const canOperate = useAtomValue(
+    serverEnvironment.upsertScheduledTask.permissionAtom(environmentId),
+  );
   const upsert = useAtomCommand(serverEnvironment.upsertScheduledTask, {
     label: "scheduled task upsert",
     reportFailure: false,
 @@ -602,6 +608,7 @@ function TaskForm({
   const save = async () => {
     if (
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) ||
       submissionPending.current ||
       saving ||
       dictationPending ||
 @@ -937,7 +944,7 @@ function TaskForm({
                   : draft.task
               }
               signatureConfigured={draft.schedule.signature !== null}
-              disabled={saving || environmentUnavailable}
+              disabled={!canOperate || saving || environmentUnavailable}
             />
             <FormField
               label="Skip requests older than (minutes)"
 @@ -994,7 +1001,9 @@ function TaskForm({
         accessibilityState={{
           disabled: saving || dictationPending || taskMissing || environmentUnavailable,
         }}
-        disabled={saving || dictationPending || taskMissing || environmentUnavailable}
+        disabled={
+          !canOperate || saving || dictationPending || taskMissing || environmentUnavailable
+        }
         onPress={() => void save()}
         className="min-h-12 items-center justify-center rounded-[14px] bg-primary px-4 disabled:opacity-50"
       >
 @@ -1118,6 +1127,9 @@ function EnvironmentTasks({
   const visibleTasks = tasks.data?.tasks.filter(
     (task) => projectIds === null || projectIds.includes(task.projectId),
   );
+  const canOperate = useAtomValue(
+    serverEnvironment.upsertScheduledTask.permissionAtom(environmentId),
+  );
   const setEnabled = useAtomCommand(serverEnvironment.setScheduledTaskEnabled, {
     label: "scheduled task enabled",
     reportFailure: false,
 @@ -1137,6 +1149,7 @@ function EnvironmentTasks({
   };
   const act = async (task: ScheduledTask, action: "run" | "toggle" | "delete") => {
+    if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
     const result =
       action === "run"
         ? await runNow({ environmentId, input: { id: task.id } })
 @@ -1205,10 +1218,19 @@ function EnvironmentTasks({
             <ControlPillMenu
               actions={[
                 { id: "edit", title: "Edit" },
-                { id: "toggle", title: task.enabled ? "Pause" : "Resume" },
+                {
-                // A webhook task has no request to run without.
+                  id: "toggle",
-                ...(task.schedule.type === "webhook" ? [] : [{ id: "run", title: "Run now" }]),
+                  title: task.enabled ? "Pause" : "Resume",
-                { id: "delete", title: "Delete", attributes: { destructive: true } },
+                  attributes: { disabled: !canOperate },
+                },
+                ...(task.schedule.type === "webhook"
+                  ? []
+                  : [{ id: "run", title: "Run now", attributes: { disabled: !canOperate } }]),
+                {
+                  id: "delete",
+                  title: "Delete",
+                  attributes: { destructive: true, disabled: !canOperate },
+                },
               ]}
               onPressAction={({ nativeEvent }) => {
                 const action = nativeEvent.event;

apps/mobile/src/features/settings/SettingsServerControlsRouteScreen.tsx+26-3

 @@ -1,5 +1,7 @@
 import { useNavigation } from "@react-navigation/native";
 import { SettingsRow } from "./components/SettingsRow";
+import { AuthSettingsWriteScope } from "@t3tools/contracts";
+import { readEnvironmentScope, useEnvironmentsWithScope } from "../../state/session";
 import { ScreenScrollView as ScrollView } from "../../components/ScreenScrollView";
 import { AppText as Text } from "../../components/AppText";
 import {
 @@ -141,6 +143,7 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
   const navigation = useNavigation();
   const { selectedTargets, projectGroups, selectedProjectKey } = useSettingsEnvironmentFilter();
   const selectedProject = projectGroups.find((group) => group.key === selectedProjectKey);
+  const writableEnvironments = useEnvironmentsWithScope(selectedTargets, AuthSettingsWriteScope);
   const projectSelected = selectedProjectKey !== null;
   const targets = resolveMobileSettingsTargets(
     selectedTargets,
 @@ -151,6 +154,9 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
   const [pendingTargets, setPendingTargets] = useState<
     readonly ScopedMobileSettingsTarget[] | null
   >(null);
+  const canWriteSettings =
+    targets.length > 0 &&
+    targets.every((target) => writableEnvironments.has(target.environment.environmentId));
   const displayTargets = pendingWrites > 0 && pendingTargets !== null ? pendingTargets : targets;
   const hasConnectedSelection = targets.length > 0;
   const reference = displayTargets[0] ?? null;
 @@ -165,7 +171,14 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
     reportFailure: true,
   });
   const write = (patch: ServerSettingsPatch) => {
-    if (writeInFlight.current || !hasConnectedSelection) return;
+    if (
+      writeInFlight.current ||
+      !hasConnectedSelection ||
+      !targets.every((target) =>
+        readEnvironmentScope(target.environment.environmentId, AuthSettingsWriteScope),
+      )
+    )
+      return;
     const writes = planMobileScopedSettingsPatch(targets, projectSelected, patch);
     if (writes.length === 0) return;
     writeInFlight.current = true;
 @@ -182,7 +195,13 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
     });
   };
   const clearProjectOverrides = () => {
-    if (writeInFlight.current) return;
+    if (
+      writeInFlight.current ||
+      !targets.every((target) =>
+        readEnvironmentScope(target.environment.environmentId, AuthSettingsWriteScope),
+      )
+    )
+      return;
     const writes = planMobileScopedSettingsClear(targets, PAGE_PROJECT_KEYS[props.page]);
     if (writes.length === 0) return;
     writeInFlight.current = true;
 @@ -203,7 +222,10 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
       target.environment.serverConfig.environment.capabilities.projectSettingsOverrides === true,
   );
   const disabled =
-    pendingWrites > 0 || !hasConnectedSelection || (projectSelected && !supportsProjectOverrides);
+    !canWriteSettings ||
+    pendingWrites > 0 ||
+    !hasConnectedSelection ||
+    (projectSelected && !supportsProjectOverrides);
   const supportsContinuation = targets.every(
     (target) =>
       target.environment.serverConfig.environment.capabilities.threadRestartContinuation === true,
 @@ -245,6 +267,7 @@ function ServerSettingsDetail(props: { readonly page: SettingsPage }) {
                   )}
                   supportsOverrides={supportsProjectOverrides}
                   pending={pendingWrites > 0}
+                  disabled={!canWriteSettings}
                   onClear={clearProjectOverrides}
                 />
               ) : null}

apps/mobile/src/features/settings/SettingsThreadsRouteScreen.tsx+23-3

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthSettingsWriteScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope, useEnvironmentsWithScope } from "../../state/session";
1	import { AutoSettleDaysField } from "./components/AutoSettleDaysField";	3	import { AutoSettleDaysField } from "./components/AutoSettleDaysField";
2	import { ScreenScrollView as ScrollView } from "../../components/ScreenScrollView";	4	import { ScreenScrollView as ScrollView } from "../../components/ScreenScrollView";
3	import { useAtomSet, useAtomValue } from "@effect/atom-react";	5	import { useAtomSet, useAtomValue } from "@effect/atom-react";
...	@@ -61,6 +63,7 @@ const AUTO_SETTLE_DEFAULT_DAYS = DEFAULT_SERVER_SETTINGS.sidebarAutoSettleAfterD	...	@@ -61,6 +63,7 @@ const AUTO_SETTLE_DEFAULT_DAYS = DEFAULT_SERVER_SETTINGS.sidebarAutoSettleAfterD
61	function AutoSettleSettingsRows() {	63	function AutoSettleSettingsRows() {
62	const { selectedTargets, projectGroups, selectedProjectKey } = useSettingsEnvironmentFilter();	64	const { selectedTargets, projectGroups, selectedProjectKey } = useSettingsEnvironmentFilter();
63	const selectedProject = projectGroups.find((group) => group.key === selectedProjectKey);	65	const selectedProject = projectGroups.find((group) => group.key === selectedProjectKey);
		66	const writableEnvironments = useEnvironmentsWithScope(selectedTargets, AuthSettingsWriteScope);
64	const projectSelected = selectedProjectKey !== null;	67	const projectSelected = selectedProjectKey !== null;
65	const [pendingWrites, setPendingWrites] = useState(0);	68	const [pendingWrites, setPendingWrites] = useState(0);
66	const writeInFlight = useRef(false);	69	const writeInFlight = useRef(false);
...	@@ -77,6 +80,9 @@ function AutoSettleSettingsRows() {	...	@@ -77,6 +80,9 @@ function AutoSettleSettingsRows() {
77	syncEnvironments,	80	syncEnvironments,
78	projectSelected ? (selectedProject?.members.map((member) => member.project) ?? []) : null,	81	projectSelected ? (selectedProject?.members.map((member) => member.project) ?? []) : null,
79	);	82	);
		83	const canWriteSettings =
		84	syncTargets.length > 0 &&
		85	syncTargets.every((target) => writableEnvironments.has(target.environment.environmentId));
80	const displayTargets =	86	const displayTargets =
81	pendingWrites > 0 && pendingTargets !== null ? pendingTargets : syncTargets;	87	pendingWrites > 0 && pendingTargets !== null ? pendingTargets : syncTargets;
82	const reference = displayTargets[0] ?? null;	88	const reference = displayTargets[0] ?? null;
...	@@ -92,7 +98,13 @@ function AutoSettleSettingsRows() {	...	@@ -92,7 +98,13 @@ function AutoSettleSettingsRows() {
92	snoozeLimitedThreads?: boolean;	98	snoozeLimitedThreads?: boolean;
93	},	99	},
94	) => {	100	) => {
95	if (writeInFlight.current) return;	101	if (
		102	writeInFlight.current \|\|
		103	!syncTargets.every((target) =>
		104	readEnvironmentScope(target.environment.environmentId, AuthSettingsWriteScope),
		105	)
		106	)
		107	return;
96	const writes = planMobileScopedSettingsPatch(syncTargets, projectSelected, patch);	108	const writes = planMobileScopedSettingsPatch(syncTargets, projectSelected, patch);
97	if (writes.length === 0) return;	109	if (writes.length === 0) return;
98	writeInFlight.current = true;	110	writeInFlight.current = true;
...	@@ -127,7 +139,8 @@ function AutoSettleSettingsRows() {	...	@@ -127,7 +139,8 @@ function AutoSettleSettingsRows() {
127	(target) =>	139	(target) =>
128	target.environment.serverConfig.environment.capabilities.projectSettingsOverrides === true,	140	target.environment.serverConfig.environment.capabilities.projectSettingsOverrides === true,
129	);	141	);
130	const disabled = pendingWrites > 0 \|\| (projectSelected && !supportsProjectOverrides);	142	const disabled =
		143	!canWriteSettings \|\| pendingWrites > 0 \|\| (projectSelected && !supportsProjectOverrides);
131	const hasProjectOverrides =	144	const hasProjectOverrides =
132	projectSelected &&	145	projectSelected &&
133	syncTargets.some(	146	syncTargets.some(
...	@@ -136,7 +149,13 @@ function AutoSettleSettingsRows() {	...	@@ -136,7 +149,13 @@ function AutoSettleSettingsRows() {
136	target.sources.sidebarAutoSettleAfterDays === "project",	149	target.sources.sidebarAutoSettleAfterDays === "project",
137	);	150	);
138	const clearProjectOverrides = () => {	151	const clearProjectOverrides = () => {
139	if (writeInFlight.current) return;	152	if (
		153	writeInFlight.current \|\|
		154	!syncTargets.every((target) =>
		155	readEnvironmentScope(target.environment.environmentId, AuthSettingsWriteScope),
		156	)
		157	)
		158	return;
140	const writes = planMobileScopedSettingsClear(syncTargets, [	159	const writes = planMobileScopedSettingsClear(syncTargets, [
141	"sidebarAutoSettleOnMerge",	160	"sidebarAutoSettleOnMerge",
142	"sidebarAutoSettleAfterDays",	161	"sidebarAutoSettleAfterDays",
...	@@ -166,6 +185,7 @@ function AutoSettleSettingsRows() {	...	@@ -166,6 +185,7 @@ function AutoSettleSettingsRows() {
166	hasOverrides={hasProjectOverrides}	185	hasOverrides={hasProjectOverrides}
167	supportsOverrides={supportsProjectOverrides}	186	supportsOverrides={supportsProjectOverrides}
168	pending={pendingWrites > 0}	187	pending={pendingWrites > 0}
		188	disabled={!canWriteSettings}
169	onClear={clearProjectOverrides}	189	onClear={clearProjectOverrides}
170	/>	190	/>
171	) : null}	191	) : null}

apps/mobile/src/features/settings/components/SettingsProjectOverridesSection.tsx+2

...	@@ -8,6 +8,7 @@ export function SettingsProjectOverridesSection(props: {	...	@@ -8,6 +8,7 @@ export function SettingsProjectOverridesSection(props: {
8	readonly hasOverrides: boolean;	8	readonly hasOverrides: boolean;
9	readonly supportsOverrides: boolean;	9	readonly supportsOverrides: boolean;
10	readonly pending: boolean;	10	readonly pending: boolean;
		11	readonly disabled?: boolean;
11	readonly onClear: () => void;	12	readonly onClear: () => void;
12	}) {	13	}) {
13	return (	14	return (
...	@@ -20,6 +21,7 @@ export function SettingsProjectOverridesSection(props: {	...	@@ -20,6 +21,7 @@ export function SettingsProjectOverridesSection(props: {
20	<Pressable	21	<Pressable
21	accessibilityRole="button"	22	accessibilityRole="button"
22	accessibilityLabel="Use environment defaults"	23	accessibilityLabel="Use environment defaults"
		24	disabled={props.disabled}
23	onPress={props.onClear}	25	onPress={props.onClear}
24	className="px-2 py-2 active:opacity-70"	26	className="px-2 py-2 active:opacity-70"
25	>	27	>

apps/mobile/src/features/settings/environment-maintenance.test.ts+23

...	@@ -53,6 +53,29 @@ describe("environment maintenance access", () => {	...	@@ -53,6 +53,29 @@ describe("environment maintenance access", () => {
53	expect(canMaintainEnvironment(null, true)).toBe(false);	53	expect(canMaintainEnvironment(null, true)).toBe(false);
54	});	54	});
55		55
		56	it.each([
		57	{ scopes: ["environment:maintain"], expected: true },
		58	{ scopes: ["orchestration:operate"], expected: false },
		59	{ scopes: ["providers:manage"], expected: false },
		60	] as const)("uses the advertised update permission for $scopes", ({ scopes, expected }) => {
		61	expect(
		62	canMaintainEnvironment(
		63	{
		64	authenticated: true,
		65	auth: {
		66	policy: "remote-reachable",
		67	bootstrapMethods: [],
		68	sessionMethods: [],
		69	sessionCookieName: "session",
		70	serverUpdateScope: "environment:maintain",
		71	},
		72	scopes,
		73	},
		74	true,
		75	),
		76	).toBe(expected);
		77	});
		78
56	it("requires remote desktop update support for desktop hosts", () => {	79	it("requires remote desktop update support for desktop hosts", () => {
57	expect(supportsEnvironmentUpdate({})).toBe(false);	80	expect(supportsEnvironmentUpdate({})).toBe(false);
58	expect(supportsEnvironmentUpdate({ serverSelfUpdate: "respawn" })).toBe(true);	81	expect(supportsEnvironmentUpdate({ serverSelfUpdate: "respawn" })).toBe(true);

apps/mobile/src/features/settings/environment-maintenance.ts+2-1

...	@@ -16,7 +16,8 @@ export function canMaintainEnvironment(session: AuthSessionState \| null, connect	...	@@ -16,7 +16,8 @@ export function canMaintainEnvironment(session: AuthSessionState \| null, connect
16	return (	16	return (
17	connected &&	17	connected &&
18	session?.authenticated === true &&	18	session?.authenticated === true &&
19	session.scopes?.includes(AuthOrchestrationOperateScope) === true	19	session.scopes?.includes(session.auth.serverUpdateScope ?? AuthOrchestrationOperateScope) ===
		20	true
20	);	21	);
21	}	22	}
22		23

apps/mobile/src/features/threads/NewTaskDraftScreen.tsx+20

...	@@ -28,6 +28,7 @@ import { useSafeAreaInsets } from "react-native-safe-area-context";	...	@@ -28,6 +28,7 @@ import { useSafeAreaInsets } from "react-native-safe-area-context";
28	import { useUniwindTheme } from "../../lib/useUniwindTheme";	28	import { useUniwindTheme } from "../../lib/useUniwindTheme";
29	import { useFontFamily } from "../../lib/useFontFamily";	29	import { useFontFamily } from "../../lib/useFontFamily";
30	import {	30	import {
		31	AuthOrchestrationOperateScope,
31	PROVIDER_SEND_TURN_MAX_ATTACHMENTS,	32	PROVIDER_SEND_TURN_MAX_ATTACHMENTS,
32	PROVIDER_SEND_TURN_MAX_INPUT_CHARS,	33	PROVIDER_SEND_TURN_MAX_INPUT_CHARS,
33	resolveEnvironmentMachineKind,	34	resolveEnvironmentMachineKind,
...	@@ -133,6 +134,7 @@ import { selectIncomingShareAttachmentsForServer } from "../sharing/incoming-sha	...	@@ -133,6 +134,7 @@ import { selectIncomingShareAttachmentsForServer } from "../sharing/incoming-sha
133	import { appAtomRegistry } from "../../state/atom-registry";	134	import { appAtomRegistry } from "../../state/atom-registry";
134	import { serverEnvironment } from "../../state/server";	135	import { serverEnvironment } from "../../state/server";
135	import { fileRoutePathSegments } from "../files/filePath";	136	import { fileRoutePathSegments } from "../files/filePath";
		137	import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
136		138
137	function NewTaskWorkspaceIcon(props: {	139	function NewTaskWorkspaceIcon(props: {
138	readonly workspaceMode: "local" \| "worktree";	140	readonly workspaceMode: "local" \| "worktree";
...	@@ -219,6 +221,12 @@ export function NewTaskDraftScreen(props: {	...	@@ -219,6 +221,12 @@ export function NewTaskDraftScreen(props: {
219	connectedEnvironments.find(	221	connectedEnvironments.find(
220	(environment) => environment.environmentId === selectedProject.environmentId,	222	(environment) => environment.environmentId === selectedProject.environmentId,
221	)?.connectionState === "connected";	223	)?.connectionState === "connected";
		224	const canOperate = useEnvironmentScope(
		225	selectedProject?.environmentId ?? null,
		226	AuthOrchestrationOperateScope,
		227	);
		228	const taskPermissionReason =
		229	environmentConnected && !canOperate ? "This connection cannot start tasks." : null;
222	const modelUnavailable = environmentConnected && flow.selectedModelOption?.isUnavailable === true;	230	const modelUnavailable = environmentConnected && flow.selectedModelOption?.isUnavailable === true;
223	// A project added by cloning exists before its files do: the prompt can be	231	// A project added by cloning exists before its files do: the prompt can be
224	// written meanwhile, but Start waits for the clone.	232	// written meanwhile, but Start waits for the clone.
...	@@ -1214,6 +1222,12 @@ export function NewTaskDraftScreen(props: {	...	@@ -1214,6 +1222,12 @@ export function NewTaskDraftScreen(props: {
1214	if (!selectedProject \|\| !draftKey) {	1222	if (!selectedProject \|\| !draftKey) {
1215	return;	1223	return;
1216	}	1224	}
		1225	if (
		1226	environmentConnected &&
		1227	!readEnvironmentScope(selectedProject.environmentId, AuthOrchestrationOperateScope)
		1228	) {
		1229	return;
		1230	}
1217	const draft = getComposerDraftSnapshot(draftKey);	1231	const draft = getComposerDraftSnapshot(draftKey);
1218	if (appAtomRegistry.get(composerContextImportsAtom)[draftKey]) return;	1232	if (appAtomRegistry.get(composerContextImportsAtom)[draftKey]) return;
1219	// Read the latest explicit pick. Antigravity selections stay unchanged	1233	// Read the latest explicit pick. Antigravity selections stay unchanged
...	@@ -1378,6 +1392,7 @@ export function NewTaskDraftScreen(props: {	...	@@ -1378,6 +1392,7 @@ export function NewTaskDraftScreen(props: {
1378	const canStart =	1392	const canStart =
1379	!isImportingContext &&	1393	!isImportingContext &&
1380	!cloneBlocksStart &&	1394	!cloneBlocksStart &&
		1395	taskPermissionReason === null &&
1381	attachmentBlockReason === null &&	1396	attachmentBlockReason === null &&
1382	!modelUnavailable &&	1397	!modelUnavailable &&
1383	Boolean(flow.selectedProject) &&	1398	Boolean(flow.selectedProject) &&
...	@@ -1655,6 +1670,10 @@ export function NewTaskDraftScreen(props: {	...	@@ -1655,6 +1670,10 @@ export function NewTaskDraftScreen(props: {
1655	) : null}	1670	) : null}
1656	{flow.canChooseWorkspace ? <View className="pb-1">{workspaceControls}</View> : null}	1671	{flow.canChooseWorkspace ? <View className="pb-1">{workspaceControls}</View> : null}
1657		1672
		1673	{taskPermissionReason ? (
		1674	<Text className="px-3 py-2 text-xs text-muted-foreground">{taskPermissionReason}</Text>
		1675	) : null}
		1676
1658	{modelUnavailable ? (	1677	{modelUnavailable ? (
1659	<Pressable	1678	<Pressable
1660	accessibilityRole="button"	1679	accessibilityRole="button"
...	@@ -1794,6 +1813,7 @@ export function NewTaskDraftScreen(props: {	...	@@ -1794,6 +1813,7 @@ export function NewTaskDraftScreen(props: {
1794	{voicePresentation.showsSend ? (	1813	{voicePresentation.showsSend ? (
1795	<ComposerActionButton	1814	<ComposerActionButton
1796	accessibilityLabel={	1815	accessibilityLabel={
		1816	taskPermissionReason ??
1797	attachmentBlockReason ??	1817	attachmentBlockReason ??
1798	(cloneBlocksStart	1818	(cloneBlocksStart
1799	? projectClone === null \|\| projectClone.phase === "running"	1819	? projectClone === null \|\| projectClone.phase === "running"

apps/mobile/src/features/threads/PendingApprovalCard.tsx+7-1

 @@ -10,6 +10,7 @@ import { AppText as Text } from "../../components/AppText";
 import type { PendingApproval } from "../../lib/threadActivity";
 export interface PendingApprovalCardProps {
+  readonly canOperateThread: boolean;
   readonly approval: PendingApproval;
   readonly respondingApprovalId: RuntimeRequestId | null;
   readonly onRespond: (
 @@ -66,11 +67,16 @@ export function PendingApprovalCard(props: PendingApprovalCardProps) {
                   ? "danger"
                   : "secondary"
             }
-            disabled={disabled}
+            disabled={disabled || !props.canOperateThread}
             onPress={() => void props.onRespond(props.approval.requestId, option.decision)}
           />
         ))}
       </View>
+      {!props.canOperateThread ? (
+        <Text className="font-sans text-xs text-adaptive-neutral-500-400">
+          This connection cannot respond to approvals.
+        </Text>
+      ) : null}
     </View>
   );
 }

apps/mobile/src/features/threads/PendingUserInputCard.tsx+8-1

...	@@ -28,6 +28,7 @@ import {	...	@@ -28,6 +28,7 @@ import {
28	} from "../../lib/threadActivity";	28	} from "../../lib/threadActivity";
29		29
30	export interface PendingUserInputCardProps {	30	export interface PendingUserInputCardProps {
		31	readonly canOperateThread: boolean;
31	readonly pendingUserInput: PendingUserInput;	32	readonly pendingUserInput: PendingUserInput;
32	/**	33	/**
33	* Constant while a request is pending (it reserves keyboard space), so the	34	* Constant while a request is pending (it reserves keyboard space), so the
...	@@ -200,6 +201,7 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {	...	@@ -200,6 +201,7 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {
200	icon="stop.fill"	201	icon="stop.fill"
201	variant="danger"	202	variant="danger"
202	className="h-9 w-9"	203	className="h-9 w-9"
		204	disabled={!props.canOperateThread}
203	onPress={props.onStopThread}	205	onPress={props.onStopThread}
204	/>	206	/>
205	) : null}	207	) : null}
...	@@ -342,7 +344,7 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {	...	@@ -342,7 +344,7 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {
342	label="Submit answers"	344	label="Submit answers"
343	size="large"	345	size="large"
344	tone={props.answers ? "primary" : "secondary"}	346	tone={props.answers ? "primary" : "secondary"}
345	disabled={responseDisabled \|\| props.answers === null}	347	disabled={!props.canOperateThread \|\| responseDisabled \|\| props.answers === null}
346	onPress={() => void props.onSubmit()}	348	onPress={() => void props.onSubmit()}
347	/>	349	/>
348	{props.pendingUserInput.dismissible ? (	350	{props.pendingUserInput.dismissible ? (
...	@@ -357,6 +359,11 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {	...	@@ -357,6 +359,11 @@ export function PendingUserInputCard(props: PendingUserInputCardProps) {
357	</Text>	359	</Text>
358	</Pressable>	360	</Pressable>
359	) : null}	361	) : null}
		362	{!props.canOperateThread ? (
		363	<Text className="font-sans text-xs text-foreground-tertiary">
		364	This connection cannot submit answers.
		365	</Text>
		366	) : null}
360	</Animated.View>	367	</Animated.View>
361	) : null;	368	) : null;
362	return (	369	return (

apps/mobile/src/features/threads/ThreadComposer.tsx+10

...	@@ -140,6 +140,7 @@ export const COMPOSER_COLLAPSED_CHROME = 60;	...	@@ -140,6 +140,7 @@ export const COMPOSER_COLLAPSED_CHROME = 60;
140	export const COMPOSER_EXPANDED_CHROME = 156;	140	export const COMPOSER_EXPANDED_CHROME = 156;
141		141
142	export interface ThreadComposerProps {	142	export interface ThreadComposerProps {
		143	readonly canOperateThread: boolean;
143	readonly draftMessage: string;	144	readonly draftMessage: string;
144	readonly draftAttachments: ReadonlyArray<DraftComposerAttachment>;	145	readonly draftAttachments: ReadonlyArray<DraftComposerAttachment>;
145	readonly placeholder: string;	146	readonly placeholder: string;
...	@@ -539,6 +540,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer	...	@@ -539,6 +540,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer
539	(pendingPastedTextAttachmentCount > 0 ? "Attaching pasted text" : null) ??	540	(pendingPastedTextAttachmentCount > 0 ? "Attaching pasted text" : null) ??
540	attachmentBlockReason;	541	attachmentBlockReason;
541	const canSend =	542	const canSend =
		543	(props.canOperateThread \|\| props.connectionState !== "connected") &&
542	hasContent &&	544	hasContent &&
543	!contextImports[composerDraftKey] &&	545	!contextImports[composerDraftKey] &&
544	!voiceInput.blocksSubmission &&	546	!voiceInput.blocksSubmission &&
...	@@ -1056,6 +1058,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer	...	@@ -1056,6 +1058,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer
1056	accessibilityLabel="Stop agent"	1058	accessibilityLabel="Stop agent"
1057	icon="stop.fill"	1059	icon="stop.fill"
1058	variant="danger"	1060	variant="danger"
		1061	disabled={!props.canOperateThread}
1059	onPress={props.onStopThread}	1062	onPress={props.onStopThread}
1060	/>	1063	/>
1061	) : (	1064	) : (
...	@@ -1150,6 +1153,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer	...	@@ -1150,6 +1153,7 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer
1150	accessibilityLabel="Stop agent"	1153	accessibilityLabel="Stop agent"
1151	icon="stop.fill"	1154	icon="stop.fill"
1152	variant="danger"	1155	variant="danger"
		1156	disabled={!props.canOperateThread}
1153	onPress={props.onStopThread}	1157	onPress={props.onStopThread}
1154	/>	1158	/>
1155	) : voicePresentation.showsSend ? (	1159	) : voicePresentation.showsSend ? (
...	@@ -1165,6 +1169,12 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer	...	@@ -1165,6 +1169,12 @@ export const ThreadComposer = memo(function ThreadComposer(props: ThreadComposer
1165	</ComposerDictationToolbar>	1169	</ComposerDictationToolbar>
1166	</Animated.View>	1170	</Animated.View>
1167	</ComposerSurface>	1171	</ComposerSurface>
		1172
		1173	{props.connectionState === "connected" && !props.canOperateThread ? (
		1174	<Text className="pt-2 text-xs text-foreground-muted">
		1175	This connection cannot control this task. You can still edit your draft.
		1176	</Text>
		1177	) : null}
1168	</Animated.View>	1178	</Animated.View>
1169		1179
1170	<VideoPreviewModal source={previewVideo} onRequestClose={closePreview} />	1180	<VideoPreviewModal source={previewVideo} onRequestClose={closePreview} />

apps/mobile/src/features/threads/ThreadDetailScreen.tsx+4

apps/mobile/src/features/threads/ThreadRouteScreen.tsx+12-1

 @@ -15,11 +15,13 @@ import {
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import * as Option from "effect/Option";
 import {
+  AuthOrchestrationOperateScope,
   DEFAULT_SERVER_SETTINGS,
   EnvironmentId,
   ThreadId,
   type ProjectScript,
 } from "@t3tools/contracts";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
 import {
   projectScriptCwd,
   projectScriptRuntimeEnv,
 @@ -333,6 +335,10 @@ function ThreadRouteContent(
     selectedThreadProject,
     selectedEnvironmentConnection,
   } = useThreadSelection();
+  const canOperateThread = useEnvironmentScope(
+    selectedThread?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
   const selectedThreadDetailState = props.selectedThreadDetailState;
   const selectedThreadDetail = Option.getOrNull(selectedThreadDetailState.data);
   const { selectedThreadCwd } = useSelectedThreadWorktree();
 @@ -673,7 +679,11 @@ function ThreadRouteContent(
     void navigation.navigate("Connections");
   }, [navigation]);
   const handleStopThread = useCallback(() => {
-    if (!selectedThread || composer.interruptibleRunId === null) {
+    if (
+      !selectedThread ||
+      !readEnvironmentScope(selectedThread.environmentId, AuthOrchestrationOperateScope) ||
+      composer.interruptibleRunId === null
+    ) {
       return;
     }
     return interruptThreadTurn({
 @@ -988,6 +998,7 @@ function ThreadRouteContent(
       <View className="flex-1 bg-screen android:overflow-hidden android:rounded-t-[28px] android:bg-thread-canvas">
         <ThreadDetailScreen
+          canOperateThread={canOperateThread}
           selectedThread={selectedThreadWithDraftSettings ?? selectedThread}
           contentPresentation={contentPresentation}
           screenTone={connectionTone(routeConnectionState)}

apps/mobile/src/features/threads/thread-list-v2-items.tsx+8-3

apps/mobile/src/features/usage/UsageLimitsSection.test.ts+4

 @@ -9,6 +9,10 @@ const state = vi.hoisted(() => ({
   autoRefresh: async () => {},
   refreshingRef: { current: false },
 }));
+vi.mock("../../state/session", () => ({
+  useEnvironmentScope: () => true,
+  readEnvironmentScope: () => true,
+}));
 vi.mock("react", () => ({
   useState: (initial: unknown) => {
     const index = state.cursor++;

apps/mobile/src/features/usage/UsageLimitsSection.tsx+22-12

 @@ -1,12 +1,13 @@
 import { useAtomValue } from "@effect/atom-react";
-import type {
+import {
-  EnvironmentId,
+  AuthProvidersManageScope,
-  ProviderConsumeResetCreditOutcome,
+  type EnvironmentId,
-  ProviderConsumeResetCreditInput,
+  type ProviderConsumeResetCreditOutcome,
-  ServerProvider,
+  type ProviderConsumeResetCreditInput,
-  ServerProviderResetCredits,
+  type ServerProvider,
-  ServerProviderUsageWindow,
+  type ServerProviderResetCredits,
-  UsageProviderKind,
+  type ServerProviderUsageWindow,
+  type UsageProviderKind,
 } from "@t3tools/contracts";
 import {
   elapsedShare,
 @@ -24,6 +25,7 @@ import { AppText as Text } from "../../components/AppText";
 import { ProviderIcon } from "../../components/ProviderIcon";
 import { environmentPresentations } from "../../state/presentation";
 import { serverEnvironment } from "../../state/server";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { useProviderColors } from "./usageProviders";
 @@ -207,6 +209,7 @@ export function ResetCredits(props: {
   readonly dense?: boolean;
 }) {
   const { environmentId, input, credits, now, dense = false } = props;
+  const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
   const consume = useAtomCommand(serverEnvironment.consumeResetCredit, {
     reportFailure: false,
   });
 @@ -225,6 +228,7 @@ export function ResetCredits(props: {
         }`;
   const redeem = async () => {
+    if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
     setBusy(true);
     setStatus(null);
     const result = await consume({ environmentId, input });
 @@ -241,6 +245,7 @@ export function ResetCredits(props: {
   };
   const confirm = () => {
+    if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
     Alert.alert(
       "Use a reset credit?",
       "This redeems one credit on your account and clears the current rate-limit windows. It cannot be undone.",
 @@ -257,13 +262,13 @@ export function ResetCredits(props: {
       {credits.availableCount > 0 ? (
         <Pressable
           accessibilityRole="button"
-          accessibilityState={{ disabled: busy }}
+          accessibilityState={{ disabled: busy || !canManageProviders }}
-          disabled={busy}
+          disabled={busy || !canManageProviders}
           onPress={confirm}
           className={
             dense
-              ? "rounded-full bg-subtle-strong px-2.5 py-1"
+              ? "rounded-full bg-subtle-strong px-2.5 py-1 disabled:opacity-[0.45]"
-              : "min-h-[44px] justify-center rounded-full bg-subtle-strong px-3 py-1.5"
+              : "min-h-[44px] justify-center rounded-full bg-subtle-strong px-3 py-1.5 disabled:opacity-[0.45]"
           }
         >
           <Text
 @@ -277,6 +282,11 @@ export function ResetCredits(props: {
           </Text>
         </Pressable>
       ) : null}
+      {!canManageProviders ? (
+        <Text className="text-xs text-foreground-tertiary">
+          This connection cannot manage provider accounts.
+        </Text>
+      ) : null}
       {status ? <Text className="text-sm text-foreground">{status}</Text> : null}
     </View>
   );

apps/mobile/src/lib/attachmentUpload.test.ts+77

...	@@ -3,6 +3,7 @@ import * as Option from "effect/Option";	...	@@ -3,6 +3,7 @@ import * as Option from "effect/Option";
3	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";	3	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
4		4
5	const mocks = vi.hoisted(() => ({	5	const mocks = vi.hoisted(() => ({
		6	canOperate: true,
6	documentUri: "file:///documents",	7	documentUri: "file:///documents",
7	createAssetUrl: vi.fn(),	8	createAssetUrl: vi.fn(),
8	createUploadUrl: Symbol("create-upload-url"),	9	createUploadUrl: Symbol("create-upload-url"),
...	@@ -48,6 +49,7 @@ vi.mock("../state/attachments", () => ({	...	@@ -48,6 +49,7 @@ vi.mock("../state/attachments", () => ({
48	}));	49	}));
49		50
50	vi.mock("../state/session", () => ({	51	vi.mock("../state/session", () => ({
		52	readEnvironmentScope: () => mocks.canOperate,
51	environmentSession: {	53	environmentSession: {
52	preparedConnectionValueAtom: () => mocks.preparedConnection,	54	preparedConnectionValueAtom: () => mocks.preparedConnection,
53	},	55	},
...	@@ -194,6 +196,7 @@ function removeCallsFor(attachmentId: string): number {	...	@@ -194,6 +196,7 @@ function removeCallsFor(attachmentId: string): number {
194		196
195	describe("prepareTurnAttachments", () => {	197	describe("prepareTurnAttachments", () => {
196	beforeEach(() => {	198	beforeEach(() => {
		199	mocks.canOperate = true;
197	mocks.documentUri = "file:///documents";	200	mocks.documentUri = "file:///documents";
198	mocks.createAssetUrl.mockReset();	201	mocks.createAssetUrl.mockReset();
199	mocks.createAssetUrl.mockImplementation((target: unknown) => target);	202	mocks.createAssetUrl.mockImplementation((target: unknown) => target);
...	@@ -222,6 +225,80 @@ describe("prepareTurnAttachments", () => {	...	@@ -222,6 +225,80 @@ describe("prepareTurnAttachments", () => {
222	mocks.upload.mockResolvedValue({ status: 204, body: "", headers: {} });	225	mocks.upload.mockResolvedValue({ status: 204, body: "", headers: {} });
223	});	226	});
224		227
		228	it("does not mint or transfer attachments without task operation access", async () => {
		229	mocks.canOperate = false;
		230	await expect(
		231	prepareTurnAttachments({
		232	environmentId,
		233	attachments: [fileBackedImage],
		234	supportsImageUploads: true,
		235	}),
		236	).rejects.toThrow("cannot upload attachments");
		237	expect(mocks.runAtomCommand).not.toHaveBeenCalled();
		238	expect(mocks.upload).not.toHaveBeenCalled();
		239	});
		240
		241	it("rechecks access after a signed URL is minted before sending any bytes", async () => {
		242	mocks.runAtomCommand.mockImplementationOnce(async () => {
		243	mocks.canOperate = false;
		244	return {
		245	_tag: "Success",
		246	value: {
		247	attachmentId: MINTED_ID,
		248	relativeUrl: "/api/attachments/upload/signed",
		249	expiresAt: 1,
		250	},
		251	};
		252	});
		253	const warning = vi.spyOn(console, "warn").mockImplementation(() => {});
		254	try {
		255	await expect(
		256	prepareTurnAttachments({
		257	environmentId,
		258	attachments: [fileBackedImage],
		259	supportsImageUploads: true,
		260	}),
		261	).rejects.toThrow("cannot upload attachments");
		262	expect(mocks.upload).not.toHaveBeenCalled();
		263	expect(mocks.runAtomCommand).toHaveBeenCalledTimes(1);
		264	} finally {
		265	warning.mockRestore();
		266	}
		267	});
		268
		269	it("does not replace an expired upload when access was revoked during verification", async () => {
		270	mocks.executeAtomQuery.mockImplementationOnce(async () => {
		271	mocks.canOperate = false;
		272	return { _tag: "Failure", error: { _tag: "AssetAttachmentNotFoundError" } };
		273	});
		274	await expect(
		275	prepareTurnAttachments({
		276	environmentId,
		277	attachments: [
		278	{
		279	...fileBackedImage,
		280	uploadedAttachmentId: MINTED_ID,
		281	uploadEnvironmentId: environmentId,
		282	},
		283	],
		284	supportsImageUploads: true,
		285	}),
		286	).rejects.toThrow("cannot upload attachments");
		287	expect(mocks.runAtomCommand).not.toHaveBeenCalled();
		288	expect(mocks.upload).not.toHaveBeenCalled();
		289	});
		290
		291	it("rechecks deletion permission before retrying a failed cleanup", async () => {
		292	mocks.runAtomCommand.mockImplementationOnce(async () => {
		293	mocks.canOperate = false;
		294	return { _tag: "Failure", error: new Error("Retry cleanup") };
		295	});
		296	await expect(releasePendingAttachmentUploads(environmentId, [MINTED_ID])).rejects.toThrow(
		297	"cannot delete pending attachments",
		298	);
		299	expect(mocks.runAtomCommand).toHaveBeenCalledTimes(1);
		300	});
		301
225	it("keeps existing image attachments on the legacy wire path", async () => {	302	it("keeps existing image attachments on the legacy wire path", async () => {
226	const prepared = await prepareTurnAttachments({ environmentId, attachments: [image] });	303	const prepared = await prepareTurnAttachments({ environmentId, attachments: [image] });
227		304

apps/mobile/src/lib/attachmentUpload.ts+23-2

 @@ -13,13 +13,16 @@ import type {
   EnvironmentId,
   UploadChatImageAttachment,
 } from "@t3tools/contracts";
-import { PROVIDER_SEND_TURN_SUPPORTED_IMAGE_MIME_TYPES } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  PROVIDER_SEND_TURN_SUPPORTED_IMAGE_MIME_TYPES,
+} from "@t3tools/contracts";
 import * as Option from "effect/Option";
 import { appAtomRegistry } from "../state/atom-registry";
 import { assetEnvironment } from "../state/assets";
 import { attachmentEnvironment } from "../state/attachments";
-import { environmentSession } from "../state/session";
+import { environmentSession, readEnvironmentScope } from "../state/session";
 import { resolveOwnedComposerAttachmentFileUri } from "./composerAttachmentFiles";
 import { retainComposerAttachmentFileForPreview } from "./composerAttachmentPreviewRetention";
 import {
 @@ -109,6 +112,9 @@ export async function releasePendingAttachmentUploads(
   attachmentIds: ReadonlyArray<string>,
 ): Promise<void> {
   const deleteOnce = async (attachmentId: string): Promise<boolean> => {
+    if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) {
+      throw new Error("This connection cannot delete pending attachments.");
+    }
     const result = await runAtomCommand(
       appAtomRegistry,
       attachmentEnvironment.remove,
 @@ -255,6 +261,7 @@ async function composerImageAttachmentDataUrl(
 }
 async function uploadFileBytes(
+  environmentId: EnvironmentId,
   attachment: DraftComposerAttachment,
   url: string,
   signal: AbortSignal,
 @@ -262,6 +269,9 @@ async function uploadFileBytes(
 ): Promise<void> {
   const { File, Paths, UploadType } = await import("expo-file-system");
   if (signal.aborted) throw new Error("Upload cancelled.");
+  if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) {
+    throw new Error("This connection cannot upload attachments.");
+  }
   // Legacy image drafts persisted inline bytes and stage them in a temp cache
   // file for the native uploader. Everything else uploads its owned copy.
   const fileUri = attachment.fileUri;
 @@ -349,6 +359,13 @@ export async function prepareTurnAttachments(input: {
     }
   }
+  const requireUploadAccess = () => {
+    if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) {
+      throw new Error("This connection cannot upload attachments.");
+    }
+  };
+  requireUploadAccess();
   const connection = appAtomRegistry.get(
     environmentSession.preparedConnectionValueAtom(environmentId),
   );
 @@ -365,6 +382,7 @@ export async function prepareTurnAttachments(input: {
   try {
     for (const attachment of input.attachments) {
       if (controller.signal.aborted) throw new Error("Upload cancelled.");
+      requireUploadAccess();
       if (attachment.type === "image" && !input.supportsImageUploads) {
         uploadedAttachments.push(...(await toUploadChatImageAttachments([attachment])));
         continue;
 @@ -393,6 +411,7 @@ export async function prepareTurnAttachments(input: {
         // "missing": the pending upload expired, upload the bytes again.
       }
+      requireUploadAccess();
       const result = await runAttachmentUploadCycle({
         registry: appAtomRegistry,
         createUploadUrl: attachmentEnvironment.createUploadUrl,
 @@ -402,6 +421,7 @@ export async function prepareTurnAttachments(input: {
         // Read the connection at transfer time: the environment may have
         // reconnected on a new base URL since this cycle started.
         resolveUploadUrl: (relativeUrl) => {
+          requireUploadAccess();
           const currentConnection = appAtomRegistry.get(
             environmentSession.preparedConnectionValueAtom(environmentId),
           );
 @@ -411,6 +431,7 @@ export async function prepareTurnAttachments(input: {
         },
         transport: (url) => ({
           done: uploadFileBytes(
+            environmentId,
             attachment,
             url,
             controller.signal,

apps/mobile/src/state/attachments.test.ts created+99

...	@@ -0,0 +1,99 @@
1	import {
2	AuthOrchestrationOperateScope,
3	EnvironmentAuthorizationError,
4	EnvironmentId,
5	} from "@t3tools/contracts";
6	import { runAttachmentUploadCycle } from "@t3tools/client-runtime/state/attachments";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult, AtomRegistry } from "effect/reactivity";
9	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
10
11	const state = vi.hoisted(() => ({
12	grantedEnvironments: new Set<string>(),
13	create: vi.fn(),
14	remove: vi.fn(),
15	}));
16	vi.mock("../connection/runtime", () => ({ connectionAtomRuntime: {} }));
17	vi.mock("./session", () => ({
18	readEnvironmentScope: (environmentId: string, scope: string) =>
19	scope === AuthOrchestrationOperateScope && state.grantedEnvironments.has(environmentId),
20	}));
21	vi.mock("@t3tools/client-runtime/state/attachments", async (importOriginal) => ({
22	...(await importOriginal<typeof import("@t3tools/client-runtime/state/attachments")>()),
23	createAttachmentEnvironmentAtoms: () => ({
24	createUploadUrl: { label: "create", run: state.create },
25	remove: { label: "remove", run: state.remove },
26	}),
27	}));
28
29	import { attachmentEnvironment } from "./attachments";
30
31	const environmentId = EnvironmentId.make("secondary");
32	const registry = AtomRegistry.make();
33	beforeEach(() => {
34	state.grantedEnvironments = new Set(["primary"]);
35	state.create.mockReset().mockResolvedValue(
36	AsyncResult.success({
37	attachmentId: "pending",
38	relativeUrl: "/upload",
39	expiresAt: 1,
40	}),
41	);
42	state.remove.mockReset().mockResolvedValue(AsyncResult.success(undefined));
43	});
44	afterEach(() => {
45	vi.restoreAllMocks();
46	});
47
48	describe("attachment mutation grants", () => {
49	it("uses the attachment environment for both mint and deletion", async () => {
50	const mintResult = await attachmentEnvironment.createUploadUrl.run(registry, {
51	environmentId,
52	input: { name: "image.png", mimeType: "image/png", sizeBytes: 1 },
53	});
54	const removeResult = await attachmentEnvironment.remove.run(registry, {
55	environmentId,
56	input: { attachmentId: "pending" },
57	});
58	for (const result of [mintResult, removeResult]) {
59	expect(result._tag).toBe("Failure");
60	if (result._tag !== "Failure") throw new Error("Expected permission denial");
61	const error = Cause.squash<unknown>(result.cause);
62	expect(error).toBeInstanceOf(EnvironmentAuthorizationError);
63	expect(error).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });
64	}
65	expect(state.create).not.toHaveBeenCalled();
66	expect(state.remove).not.toHaveBeenCalled();
67	state.grantedEnvironments.add("secondary");
68	expect(
69	(
70	await attachmentEnvironment.remove.run(registry, {
71	environmentId,
72	input: { attachmentId: "pending" },
73	})
74	)._tag,
75	).toBe("Success");
76	expect(state.remove).toHaveBeenCalledOnce();
77	});
78
79	it("blocks the upload cycle's asynchronous cleanup after grant revocation", async () => {
80	state.grantedEnvironments.add("secondary");
81	const transport = vi.fn();
82	const result = await runAttachmentUploadCycle({
83	registry,
84	...attachmentEnvironment,
85	environmentId,
86	upload: { name: "image.png", mimeType: "image/png", sizeBytes: 1 },
87	resolveUploadUrl: () => "https://example.test/upload",
88	transport,
89	onMinted: () => {
90	state.grantedEnvironments.delete("secondary");
91	return "cancel";
92	},
93	});
94	expect(result.status).toBe("cancelled");
95	expect(state.create).toHaveBeenCalledOnce();
96	expect(state.remove).not.toHaveBeenCalled();
97	expect(transport).not.toHaveBeenCalled();
98	});
99	});

apps/mobile/src/state/attachments.ts+35-1

...	@@ -1,5 +1,39 @@	...	@@ -1,5 +1,39 @@
1	import { createAttachmentEnvironmentAtoms } from "@t3tools/client-runtime/state/attachments";	1	import { createAttachmentEnvironmentAtoms } from "@t3tools/client-runtime/state/attachments";
		2	import type { AtomCommand } from "@t3tools/client-runtime/state/runtime";
		3	import {
		4	AuthOrchestrationOperateScope,
		5	EnvironmentAuthorizationError,
		6	type EnvironmentId,
		7	} from "@t3tools/contracts";
		8	import * as Cause from "effect/Cause";
		9	import { AsyncResult } from "effect/reactivity";
2		10
3	import { connectionAtomRuntime } from "../connection/runtime";	11	import { connectionAtomRuntime } from "../connection/runtime";
		12	import { readEnvironmentScope } from "./session";
4		13
5	export const attachmentEnvironment = createAttachmentEnvironmentAtoms(connectionAtomRuntime);	14	function requireAttachmentWriteAccess<W extends { readonly environmentId: EnvironmentId }, A, E>(
		15	command: AtomCommand<W, A, E>,
		16	): AtomCommand<W, A, E \| EnvironmentAuthorizationError> {
		17	return {
		18	...command,
		19	run: async (registry, input) => {
		20	if (!readEnvironmentScope(input.environmentId, AuthOrchestrationOperateScope)) {
		21	return AsyncResult.failure(
		22	Cause.fail(
		23	new EnvironmentAuthorizationError({
		24	message: "This connection cannot change attachments.",
		25	requiredScope: AuthOrchestrationOperateScope,
		26	}),
		27	),
		28	);
		29	}
		30	return command.run(registry, input);
		31	},
		32	};
		33	}
		34
		35	const commands = createAttachmentEnvironmentAtoms(connectionAtomRuntime);
		36	export const attachmentEnvironment = {
		37	createUploadUrl: requireAttachmentWriteAccess(commands.createUploadUrl),
		38	remove: requireAttachmentWriteAccess(commands.remove),
		39	};

apps/mobile/src/state/composer-attachment-uploads.ts+14-3

...	@@ -1,5 +1,5 @@	...	@@ -1,5 +1,5 @@
1	import { useAtomValue } from "@effect/atom-react";	1	import { useAtomValue } from "@effect/atom-react";
2	import type { EnvironmentId } from "@t3tools/contracts";	2	import { AuthOrchestrationOperateScope, type EnvironmentId } from "@t3tools/contracts";
3	import { Atom } from "effect/reactivity";	3	import { Atom } from "effect/reactivity";
4	import { useEffect, useRef } from "react";	4	import { useEffect, useRef } from "react";
5		5
...	@@ -24,6 +24,7 @@ import {	...	@@ -24,6 +24,7 @@ import {
24	setComposerDraftAttachmentUpload,	24	setComposerDraftAttachmentUpload,
25	} from "./use-composer-drafts";	25	} from "./use-composer-drafts";
26	import { useRemoteConnectionStatus } from "./use-remote-environment-registry";	26	import { useRemoteConnectionStatus } from "./use-remote-environment-registry";
		27	import { readEnvironmentScope, useEnvironmentsWithScope } from "./session";
27		28
28	export {	29	export {
29	composerAttachmentUploadBlockReason,	30	composerAttachmentUploadBlockReason,
...	@@ -48,6 +49,7 @@ export function useComposerAttachmentUploadState(	...	@@ -48,6 +49,7 @@ export function useComposerAttachmentUploadState(
48	}	49	}
49		50
50	export function retryComposerAttachmentUpload(environmentId: EnvironmentId, attachmentId: string) {	51	export function retryComposerAttachmentUpload(environmentId: EnvironmentId, attachmentId: string) {
		52	if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
51	uploadQueue?.retry(environmentId, attachmentId);	53	uploadQueue?.retry(environmentId, attachmentId);
52	}	54	}
53		55
...	@@ -57,6 +59,10 @@ export function useComposerAttachmentUploadWorker() {	...	@@ -57,6 +59,10 @@ export function useComposerAttachmentUploadWorker() {
57	const queuedMessages = useThreadOutboxMessages();	59	const queuedMessages = useThreadOutboxMessages();
58	const serverConfigs = useServerConfigs();	60	const serverConfigs = useServerConfigs();
59	const { connectedEnvironments } = useRemoteConnectionStatus();	61	const { connectedEnvironments } = useRemoteConnectionStatus();
		62	const operableEnvironments = useEnvironmentsWithScope(
		63	connectedEnvironments,
		64	AuthOrchestrationOperateScope,
		65	);
60	const queueRef = useRef<ReturnType<typeof createComposerAttachmentUploadQueue> \| null>(null);	66	const queueRef = useRef<ReturnType<typeof createComposerAttachmentUploadQueue> \| null>(null);
61		67
62	useEffect(() => {	68	useEffect(() => {
...	@@ -117,7 +123,12 @@ export function useComposerAttachmentUploadWorker() {	...	@@ -117,7 +123,12 @@ export function useComposerAttachmentUploadWorker() {
117	);	123	);
118	const requests = Object.entries(drafts).flatMap(([key, draft]) => {	124	const requests = Object.entries(drafts).flatMap(([key, draft]) => {
119	const environmentId = composerDraftEnvironmentId(key, queued, draft);	125	const environmentId = composerDraftEnvironmentId(key, queued, draft);
120	if (environmentId === null \|\| !connected.has(environmentId)) return [];	126	if (
		127	environmentId === null \|\|
		128	!connected.has(environmentId) \|\|
		129	!operableEnvironments.has(environmentId)
		130	)
		131	return [];
121	return draft.attachments	132	return draft.attachments
122	.filter((attachment) =>	133	.filter((attachment) =>
123	canUploadComposerAttachment(attachment, serverConfigs.get(environmentId)),	134	canUploadComposerAttachment(attachment, serverConfigs.get(environmentId)),
...	@@ -125,5 +136,5 @@ export function useComposerAttachmentUploadWorker() {	...	@@ -125,5 +136,5 @@ export function useComposerAttachmentUploadWorker() {
125	.map((attachment) => ({ environmentId, attachment }));	136	.map((attachment) => ({ environmentId, attachment }));
126	});	137	});
127	queueRef.current?.sync(requests);	138	queueRef.current?.sync(requests);
128	}, [connectedEnvironments, drafts, queuedMessages, serverConfigs]);	139	}, [connectedEnvironments, drafts, operableEnvironments, queuedMessages, serverConfigs]);
129	}	140	}

apps/mobile/src/state/session.test.ts created+100

...	@@ -0,0 +1,100 @@
1	import {
2	AuthOrchestrationOperateScope,
3	EnvironmentId,
4	type AuthSessionState,
5	} from "@t3tools/contracts";
6	import * as Cause from "effect/Cause";
7	import { AsyncResult, Atom } from "effect/reactivity";
8	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
9
10	const harness = vi.hoisted(() => ({ lastAtom: null as Atom.Atom<unknown> \| null }));
11	vi.mock("react", () => ({ useMemo: <A>(factory: () => A) => factory() }));
12	vi.mock("@effect/atom-react", async () => {
13	const { appAtomRegistry } = await import("./atom-registry");
14	return {
15	useAtomValue: <A>(atom: Atom.Atom<A>) => {
16	harness.lastAtom = atom;
17	return appAtomRegistry.get(atom);
18	},
19	};
20	});
21	vi.mock("../connection/runtime", () => ({ connectionAtomRuntime: {} }));
22	vi.mock("@t3tools/client-runtime/state/session", () => ({
23	createEnvironmentSessionAtoms: () => ({
24	sessionStateAtom: Atom.family((_id: EnvironmentId) =>
25	Atom.make(AsyncResult.initial<AuthSessionState, Error>()).pipe(Atom.keepAlive),
26	),
27	}),
28	}));
29
30	import { appAtomRegistry } from "./atom-registry";
31	import {
32	environmentSession,
33	readEnvironmentScope,
34	useEnvironmentScope,
35	useEnvironmentsWithScope,
36	} from "./session";
37
38	const primary = EnvironmentId.make("primary");
39	const secondary = EnvironmentId.make("secondary");
40	const session = (canOperate: boolean): AuthSessionState => ({
41	authenticated: true,
42	scopes: canOperate ? [AuthOrchestrationOperateScope] : [],
43	auth: {
44	policy: "remote-reachable",
45	bootstrapMethods: [],
46	sessionMethods: [],
47	sessionCookieName: "session",
48	},
49	});
50	// The production atom is read-only; the fake session source is writable.
51	const source = (id: EnvironmentId) =>
52	environmentSession.sessionStateAtom(id) as unknown as Atom.Writable<
53	AsyncResult.AsyncResult<AuthSessionState, Error>
54	>;
55	const releases: Array<() => void> = [];
56	beforeEach(() => {
57	harness.lastAtom = null;
58	appAtomRegistry.set(source(primary), AsyncResult.success(session(true)));
59	appAtomRegistry.set(source(secondary), AsyncResult.initial());
60	});
61	afterEach(() => {
62	releases.splice(0).forEach((release) => release());
63	});
64
65	it("keeps pending and denied environments out of worker grants while retaining valid cached access", () => {
66	expect(useEnvironmentScope(secondary, AuthOrchestrationOperateScope)).toBe(false);
67	expect(readEnvironmentScope(secondary, AuthOrchestrationOperateScope)).toBe(false);
68	const environments = [{ environmentId: primary }, { environmentId: secondary }];
69	expect(useEnvironmentsWithScope(environments, AuthOrchestrationOperateScope)).toEqual(
70	new Set([primary]),
71	);
72	appAtomRegistry.set(source(secondary), AsyncResult.waiting(AsyncResult.success(session(true))));
73	expect(readEnvironmentScope(secondary, AuthOrchestrationOperateScope)).toBe(true);
74	expect(useEnvironmentsWithScope(environments, AuthOrchestrationOperateScope)).toEqual(
75	new Set([primary, secondary]),
76	);
77	appAtomRegistry.set(source(secondary), AsyncResult.success(session(false)));
78	expect(useEnvironmentScope(secondary, AuthOrchestrationOperateScope)).toBe(false);
79	});
80
81	it("reacts to grant revocation, failure, and regrant without a connection list change", () => {
82	const environments = [{ environmentId: primary }, { environmentId: secondary }];
83	useEnvironmentsWithScope(environments, AuthOrchestrationOperateScope);
84	const observed = harness.lastAtom;
85	if (!observed) throw new Error("Missing worker grant atom");
86	const changes: unknown[] = [];
87	releases.push(appAtomRegistry.subscribe(observed, (value) => changes.push(value)));
88	appAtomRegistry.set(source(secondary), AsyncResult.success(session(true)));
89	expect(appAtomRegistry.get(observed)).toEqual(new Set([primary, secondary]));
90	appAtomRegistry.set(source(secondary), AsyncResult.success(session(false)));
91	expect(appAtomRegistry.get(observed)).toEqual(new Set([primary]));
92	appAtomRegistry.set(
93	source(primary),
94	AsyncResult.failure(Cause.fail(new Error("Session lookup failed"))),
95	);
96	expect(appAtomRegistry.get(observed)).toEqual(new Set());
97	appAtomRegistry.set(source(secondary), AsyncResult.success(session(true)));
98	expect(appAtomRegistry.get(observed)).toEqual(new Set([secondary]));
99	expect(changes).not.toHaveLength(0);
100	});

apps/mobile/src/state/session.ts+60-2

...	@@ -1,13 +1,71 @@	...	@@ -1,13 +1,71 @@
1	import { useAtomValue } from "@effect/atom-react";	1	import { useAtomValue } from "@effect/atom-react";
2	import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";	2	import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";
3	import type { EnvironmentId } from "@t3tools/contracts";	3	import type { AuthEnvironmentScope, AuthSessionState, EnvironmentId } from "@t3tools/contracts";
4	import * as Option from "effect/Option";	4	import * as Option from "effect/Option";
5	import { Atom } from "effect/reactivity";	5	import { AsyncResult, Atom } from "effect/reactivity";
		6	import { useMemo } from "react";
6		7
7	import { connectionAtomRuntime } from "../connection/runtime";	8	import { connectionAtomRuntime } from "../connection/runtime";
		9	import { appAtomRegistry } from "./atom-registry";
8		10
9	export const environmentSession = createEnvironmentSessionAtoms(connectionAtomRuntime);	11	export const environmentSession = createEnvironmentSessionAtoms(connectionAtomRuntime);
10		12
		13	const EMPTY_SESSION_STATE_ATOM = Atom.make(AsyncResult.initial<AuthSessionState>());
		14
		15	function sessionHasScope(
		16	result: AsyncResult.AsyncResult<AuthSessionState, unknown>,
		17	scope: AuthEnvironmentScope,
		18	): boolean {
		19	const session = Option.getOrNull(AsyncResult.value(result));
		20	return (
		21	result._tag !== "Failure" &&
		22	session?.authenticated === true &&
		23	session.scopes?.includes(scope) === true
		24	);
		25	}
		26
		27	/** Uses the selected environment's grant, including cached scopes during a refresh. */
		28	export function useEnvironmentScope(
		29	environmentId: EnvironmentId \| null,
		30	scope: AuthEnvironmentScope,
		31	): boolean {
		32	const result = useAtomValue(
		33	environmentId === null
		34	? EMPTY_SESSION_STATE_ATOM
		35	: environmentSession.sessionStateAtom(environmentId),
		36	);
		37	return sessionHasScope(result, scope);
		38	}
		39
		40	/** Keeps background workers subscribed to each target's grant. */
		41	export function useEnvironmentsWithScope(
		42	environments: ReadonlyArray<{ readonly environmentId: EnvironmentId }>,
		43	scope: AuthEnvironmentScope,
		44	): ReadonlySet<EnvironmentId> {
		45	const permittedEnvironments = useMemo(
		46	() =>
		47	Atom.make((get) => {
		48	const permitted = new Set<EnvironmentId>();
		49	for (const { environmentId } of environments) {
		50	if (sessionHasScope(get(environmentSession.sessionStateAtom(environmentId)), scope)) {
		51	permitted.add(environmentId);
		52	}
		53	}
		54	return permitted;
		55	}),
		56	[environments, scope],
		57	);
		58	return useAtomValue(permittedEnvironments);
		59	}
		60
		61	export function readEnvironmentScope(
		62	environmentId: EnvironmentId,
		63	scope: AuthEnvironmentScope,
		64	): boolean {
		65	const result = appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId));
		66	return sessionHasScope(result, scope);
		67	}
		68
11	const EMPTY_PREPARED_CONNECTION_ATOM = Atom.make(Option.none()).pipe(	69	const EMPTY_PREPARED_CONNECTION_ATOM = Atom.make(Option.none()).pipe(
12	Atom.withLabel("mobile-prepared-connection:empty"),	70	Atom.withLabel("mobile-prepared-connection:empty"),
13	);	71	);

apps/mobile/src/state/thread-task-permissions.test.ts created+260

...	@@ -0,0 +1,260 @@
1	import { AuthOrchestrationOperateScope, RuntimeRequestId } from "@t3tools/contracts";
2	import type { DraftComposerImageAttachment } from "../lib/composerImages";
3	import type { PendingThreadRequests } from "@t3tools/client-runtime/state/thread-requests";
4	import { AsyncResult, type Atom } from "effect/reactivity";
5	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
6
7	const state = vi.hoisted(() => ({
8	grantedEnvironments: new Set<string>(),
9	connectionState: "connected",
10	draft: { text: "Keep my draft", attachments: [] as DraftComposerImageAttachment[] },
11	pendingRequests: { approvals: [], userInputs: [] } as PendingThreadRequests,
12	enqueue: vi.fn(async () => undefined),
13	clearDraft: vi.fn(),
14	approve: vi.fn(),
15	answer: vi.fn(),
16	feedback: vi.fn(),
17	updateSettings: vi.fn(),
18	question: {
19	id: "language",
20	header: "Language",
21	question: "Which language?",
22	options: [{ label: "TypeScript", description: "Use the existing code" }],
23	multiSelect: false,
24	},
25	thread: {
26	id: "thread",
27	environmentId: "secondary",
28	modelSelection: { instanceId: "codex", model: "gpt-5.4" },
29	runtimeMode: "full-access",
30	interactionMode: "default",
31	runtime: null,
32	latestRun: null,
33	},
34	}));
35
36	vi.mock("react", () => ({
37	useCallback: <A>(callback: A) => callback,
38	useEffect: () => {},
39	useRef: <A>(current: A) => ({ current }),
40	useMemo: <A>(factory: () => A) => factory(),
41	useState: <A>(initial: A \| (() => A)) => [
42	typeof initial === "function" ? (initial as () => A)() : initial,
43	vi.fn(),
44	],
45	}));
46	vi.mock("expo-crypto", () => ({ randomUUID: () => "uuid" }));
47	vi.mock("../lib/attachmentUpload", () => ({ prepareTurnAttachments: vi.fn() }));
48	vi.mock("../lib/uuid", () => ({ uuidv4: () => "uuid" }));
49	vi.mock("./queued-run-edit", () => ({
50	useQueuedRunEdit: () => null,
51	getQueuedRunEdit: () => null,
52	}));
53	vi.mock("./preferences", async () => {
54	const { Atom, AsyncResult } = await import("effect/reactivity");
55	return { mobilePreferencesAtom: Atom.make(AsyncResult.success({})) };
56	});
57	vi.mock("react-native", () => ({ Alert: { alert: vi.fn() } }));
58	vi.mock("@effect/atom-react", async () => {
59	const { appAtomRegistry } = await import("./atom-registry");
60	return { useAtomValue: <A>(atom: Atom.Atom<A>) => appAtomRegistry.get(atom) };
61	});
62	vi.mock("./entities", () => ({ useServerConfigs: () => new Map() }));
63	vi.mock("./session", () => ({
64	readEnvironmentScope: (environmentId: string, scope: string) =>
65	scope === AuthOrchestrationOperateScope && state.grantedEnvironments.has(environmentId),
66	}));
67	vi.mock("./use-thread-selection", () => ({
68	useThreadSelection: () => ({
69	selectedThread: state.thread,
70	selectedThreadCreation: null,
71	selectedEnvironmentRuntime: {
72	connectionState: state.connectionState,
73	serverConfig: {
74	providers: [{ instanceId: "codex", driver: "codex" }],
75	environment: { capabilities: {} },
76	},
77	},
78	}),
79	}));
80	vi.mock("./use-thread-detail", () => ({
81	useSelectedThreadProjection: () => null,
82	useSelectedThreadVisibleTurnItems: () => [],
83	useSelectedThreadPendingRequests: () => state.pendingRequests,
84	}));
85	vi.mock("./use-atom-command", () => ({ useAtomCommand: <A>(command: A) => command }));
86	vi.mock("./threads", async () => {
87	const { Atom } = await import("effect/reactivity");
88	return {
89	environmentThreadDetails: { queueWorkflowAtom: () => Atom.make(null) },
90	threadEnvironment: {
91	respondToApproval: state.approve,
92	respondToUserInput: state.answer,
93	uploadFeedback: state.feedback,
94	},
95	};
96	});
97	vi.mock("./use-thread-outbox", async () => {
98	const { Atom } = await import("effect/reactivity");
99	return { dispatchingQueuedMessageIdAtom: Atom.make(null), useThreadOutboxMessages: () => ({}) };
100	});
101	vi.mock("./thread-outbox", () => ({ enqueueThreadOutboxMessage: state.enqueue }));
102	vi.mock("./composer-attachment-uploads", async () => {
103	const { Atom } = await import("effect/reactivity");
104	return {
105	composerAttachmentUploadsAtom: Atom.make({}),
106	composerAttachmentUploadBlockReason: () => null,
107	composerAttachmentsStillUploading: () => false,
108	};
109	});
110	vi.mock("./use-composer-drafts", async () => {
111	const { Atom } = await import("effect/reactivity");
112	return {
113	composerDraftsAtom: Atom.make({}),
114	composerContextImportsAtom: Atom.make({}),
115	getComposerDraftSnapshot: () => state.draft,
116	clearComposerDraftContent: state.clearDraft,
117	clearComposerDraft: state.clearDraft,
118	setComposerDraftText: (_key: string, text: string) => {
119	state.draft.text = text;
120	},
121	updateComposerDraftSettings: state.updateSettings,
122	ensureComposerDraftsLoaded: () => {},
123	scheduleUnusedComposerAttachmentCleanup: () => {},
124	appendComposerDraftAttachments: vi.fn(),
125	appendComposerDraftText: vi.fn(),
126	mergeComposerDraftContent: vi.fn(),
127	removeComposerDraftAttachment: vi.fn(),
128	useComposerDraft: () => state.draft,
129	};
130	});
131	vi.mock("../lib/composerImages", () => ({
132	convertPastedImagesToAttachments: vi.fn(),
133	pasteComposerClipboard: vi.fn(),
134	pickComposerFiles: vi.fn(),
135	pickComposerMedia: vi.fn(),
136	}));
137	vi.mock("../lib/commandMetadata", () => ({
138	makeQueuedMessageMetadata: () => ({
139	messageId: "message",
140	commandId: "command",
141	createdAt: "2026-09-05T00:00:00.000Z",
142	}),
143	}));
144	vi.mock("../lib/copyTextWithHaptic", () => ({ copyTextWithHaptic: vi.fn() }));
145	vi.mock("../lib/modelOptions", () => ({ isModelSelectionUnavailable: () => false }));
146	vi.mock("./use-remote-environment-registry", () => ({ setPendingConnectionError: vi.fn() }));
147
148	import { useThreadComposerState } from "./use-thread-composer-state";
149	import { useSelectedThreadRequests } from "./use-selected-thread-requests";
150
151	beforeEach(() => {
152	state.grantedEnvironments = new Set(["primary"]);
153	state.connectionState = "connected";
154	state.draft = { text: "Keep my draft", attachments: [] };
155	state.pendingRequests = {
156	approvals: [
157	{
158	requestId: RuntimeRequestId.make("approval"),
159	requestKind: "command",
160	createdAt: "2026-09-05T00:00:00.000Z",
161	responseCapability: "live",
162	},
163	],
164	userInputs: [],
165	};
166	vi.clearAllMocks();
167	state.approve.mockResolvedValue(AsyncResult.success(undefined));
168	state.answer.mockResolvedValue(AsyncResult.success(undefined));
169	state.feedback.mockResolvedValue(AsyncResult.success({ feedbackId: "feedback" }));
170	});
171
172	describe("mobile task permissions", () => {
173	it("keeps a connected read-only task's draft instead of queueing it with another environment's grant", async () => {
174	const composer = useThreadComposerState();
175	expect(await composer.onSendMessage()).toBeNull();
176	expect(state.enqueue).not.toHaveBeenCalled();
177	expect(state.clearDraft).not.toHaveBeenCalled();
178	composer.onChangeDraftMessage("Edited locally");
179	composer.onUpdateInteractionMode("plan");
180	expect(state.draft.text).toBe("Edited locally");
181	expect(state.updateSettings).toHaveBeenCalledWith("secondary:thread", {
182	interactionMode: "plan",
183	});
184	});
185
186	it("rechecks a retained send callback before clearing or queueing the draft", async () => {
187	state.grantedEnvironments.add("secondary");
188	const composer = useThreadComposerState();
189	state.grantedEnvironments.delete("secondary");
190	expect(await composer.onSendMessage()).toBeNull();
191	expect(state.clearDraft).not.toHaveBeenCalled();
192	expect(state.enqueue).not.toHaveBeenCalled();
193	state.grantedEnvironments.add("secondary");
194	expect(await composer.onSendMessage()).toBe("message");
195	expect(state.enqueue).toHaveBeenCalledWith(
196	expect.objectContaining({
197	environmentId: "secondary",
198	threadId: "thread",
199	text: "Keep my draft",
200	}),
201	);
202	});
203
204	it("preserves offline queueing without dispatching feedback through the queue action", async () => {
205	state.connectionState = "disconnected";
206	expect(await useThreadComposerState().onSendMessage()).toBe("message");
207	expect(state.enqueue).toHaveBeenCalledTimes(1);
208	state.draft.text = "/feedback The agent stopped early.";
209	expect(await useThreadComposerState().onSendMessage()).toBeNull();
210	expect(state.feedback).not.toHaveBeenCalled();
211	expect(state.enqueue).toHaveBeenCalledTimes(1);
212	expect(state.clearDraft).toHaveBeenCalledTimes(1);
213	});
214
215	it("rechecks the target environment before an approval response", async () => {
216	state.grantedEnvironments.add("secondary");
217	const requests = useSelectedThreadRequests();
218	state.grantedEnvironments.delete("secondary");
219	await requests.onRespondToApproval(RuntimeRequestId.make("approval"), "accept");
220	expect(state.approve).not.toHaveBeenCalled();
221	state.grantedEnvironments.add("secondary");
222	await requests.onRespondToApproval(RuntimeRequestId.make("approval"), "accept");
223	expect(state.approve).toHaveBeenCalledWith({
224	environmentId: "secondary",
225	input: { threadId: "thread", requestId: "approval", decision: "accept" },
226	});
227	});
228
229	it("keeps answer drafts editable after revocation while blocking their submission", async () => {
230	state.pendingRequests = {
231	approvals: [],
232	userInputs: [
233	{
234	requestId: RuntimeRequestId.make("input"),
235	createdAt: "2026-09-05T00:00:00.000Z",
236	responseCapability: "live",
237	dismissible: false,
238	questions: [state.question],
239	},
240	],
241	};
242	const requestId = RuntimeRequestId.make("input");
243	useSelectedThreadRequests().onSelectUserInputOption(requestId, state.question, "TypeScript");
244	state.grantedEnvironments.add("secondary");
245	const requests = useSelectedThreadRequests();
246	expect(requests.activePendingUserInputAnswers).toEqual({ language: "TypeScript" });
247	state.grantedEnvironments.delete("secondary");
248	await requests.onSubmitUserInput();
249	expect(state.answer).not.toHaveBeenCalled();
250	expect(useSelectedThreadRequests().activePendingUserInputAnswers).toEqual({
251	language: "TypeScript",
252	});
253	state.grantedEnvironments.add("secondary");
254	await requests.onSubmitUserInput();
255	expect(state.answer).toHaveBeenCalledWith({
256	environmentId: "secondary",
257	input: { threadId: "thread", requestId: "input", answers: { language: "TypeScript" } },
258	});
259	});
260	});

apps/mobile/src/state/use-selected-thread-requests.test.tsx+1

...	@@ -47,6 +47,7 @@ vi.mock("./entities", () => ({	...	@@ -47,6 +47,7 @@ vi.mock("./entities", () => ({
47	],	47	],
48	]),	48	]),
49	}));	49	}));
		50	vi.mock("./session", () => ({ readEnvironmentScope: () => true }));
50	vi.mock("./threads", () => ({ threadEnvironment: {} }));	51	vi.mock("./threads", () => ({ threadEnvironment: {} }));
51	vi.mock("./use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));	52	vi.mock("./use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));
52	vi.mock("./use-thread-selection", () => ({	53	vi.mock("./use-thread-selection", () => ({

apps/mobile/src/state/use-selected-thread-requests.ts+13-3

...	@@ -19,6 +19,7 @@ import {	...	@@ -19,6 +19,7 @@ import {
19	type PendingThreadRequests,	19	type PendingThreadRequests,
20	type ThreadUserInputQuestion,	20	type ThreadUserInputQuestion,
21	} from "@t3tools/client-runtime/state/thread-requests";	21	} from "@t3tools/client-runtime/state/thread-requests";
		22	import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
22	import { Atom } from "effect/reactivity";	23	import { Atom } from "effect/reactivity";
23		24
24	import { threadEnvironment } from "../state/threads";	25	import { threadEnvironment } from "../state/threads";
...	@@ -33,6 +34,7 @@ import { appAtomRegistry } from "./atom-registry";	...	@@ -33,6 +34,7 @@ import { appAtomRegistry } from "./atom-registry";
33	import { useSelectedThreadPendingRequests } from "./use-thread-detail";	34	import { useSelectedThreadPendingRequests } from "./use-thread-detail";
34	import { useThreadSelection } from "./use-thread-selection";	35	import { useThreadSelection } from "./use-thread-selection";
35	import { useAtomCommand } from "./use-atom-command";	36	import { useAtomCommand } from "./use-atom-command";
		37	import { readEnvironmentScope } from "./session";
36		38
37	const EMPTY_PENDING_REQUESTS: PendingThreadRequests = { approvals: [], userInputs: [] };	39	const EMPTY_PENDING_REQUESTS: PendingThreadRequests = { approvals: [], userInputs: [] };
38		40
...	@@ -211,7 +213,10 @@ export function useSelectedThreadRequests() {	...	@@ -211,7 +213,10 @@ export function useSelectedThreadRequests() {
211		213
212	const onRespondToApproval = useCallback(	214	const onRespondToApproval = useCallback(
213	async (requestId: RuntimeRequestId, decision: ProviderApprovalDecision) => {	215	async (requestId: RuntimeRequestId, decision: ProviderApprovalDecision) => {
214	if (!selectedThreadShell) {	216	if (
		217	!selectedThreadShell \|\|
		218	!readEnvironmentScope(selectedThreadShell.environmentId, AuthOrchestrationOperateScope)
		219	) {
215	return;	220	return;
216	}	221	}
217	if (	222	if (
...	@@ -241,7 +246,8 @@ export function useSelectedThreadRequests() {	...	@@ -241,7 +246,8 @@ export function useSelectedThreadRequests() {
241	!selectedThreadShell \|\|	246	!selectedThreadShell \|\|
242	!activePendingUserInput \|\|	247	!activePendingUserInput \|\|
243	activePendingUserInput.responseCapability === "not_resumable" \|\|	248	activePendingUserInput.responseCapability === "not_resumable" \|\|
244	!activePendingUserInputAnswers	249	!activePendingUserInputAnswers \|\|
		250	!readEnvironmentScope(selectedThreadShell.environmentId, AuthOrchestrationOperateScope)
245	) {	251	) {
246	return;	252	return;
247	}	253	}
...	@@ -318,7 +324,11 @@ export function useSelectedThreadRequests() {	...	@@ -318,7 +324,11 @@ export function useSelectedThreadRequests() {
318		324
319	// Closes an async question without messaging the agent.	325	// Closes an async question without messaging the agent.
320	const onDismissUserInput = useCallback(async () => {	326	const onDismissUserInput = useCallback(async () => {
321	if (!selectedThreadShell \|\| !activePendingUserInput) {	327	if (
		328	!selectedThreadShell \|\|
		329	!activePendingUserInput \|\|
		330	!readEnvironmentScope(selectedThreadShell.environmentId, AuthOrchestrationOperateScope)
		331	) {
322	return;	332	return;
323	}	333	}
324		334

apps/mobile/src/state/use-thread-composer-state.ts+10

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope } from "./session";
1	import type { ComposerTextPaste } from "../native/T3ComposerEditor.types";	3	import type { ComposerTextPaste } from "../native/T3ComposerEditor.types";
2	import { useAtomValue } from "@effect/atom-react";	4	import { useAtomValue } from "@effect/atom-react";
3	import { threadRuntimeIsActive } from "@t3tools/client-runtime/state/shell";	5	import { threadRuntimeIsActive } from "@t3tools/client-runtime/state/shell";
...	@@ -548,6 +550,12 @@ export function useThreadComposerState() {	...	@@ -548,6 +550,12 @@ export function useThreadComposerState() {
548		550
549	const onSendMessage = useCallback(	551	const onSendMessage = useCallback(
550	async (followUpOverride?: ActiveTurnComposerAction) => {	552	async (followUpOverride?: ActiveTurnComposerAction) => {
		553	if (
		554	selectedThreadShell &&
		555	selectedEnvironmentRuntime?.connectionState === "connected" &&
		556	!readEnvironmentScope(selectedThreadShell.environmentId, AuthOrchestrationOperateScope)
		557	)
		558	return null;
551	if (!selectedThreadShell) {	559	if (!selectedThreadShell) {
552	return null;	560	return null;
553	}	561	}
...	@@ -624,6 +632,8 @@ export function useThreadComposerState() {	...	@@ -624,6 +632,8 @@ export function useThreadComposerState() {
624	? parseCodexFeedbackCommand(text)	632	? parseCodexFeedbackCommand(text)
625	: null;	633	: null;
626	if (feedbackCommand) {	634	if (feedbackCommand) {
		635	if (!readEnvironmentScope(selectedThreadShell.environmentId, AuthOrchestrationOperateScope))
		636	return null;
627	if (thread.activeProviderThreadId === null) {	637	if (thread.activeProviderThreadId === null) {
628	Alert.alert("Start a Codex thread first", "Send a message before you submit feedback.");	638	Alert.alert("Start a Codex thread first", "Send a message before you submit feedback.");
629	return null;	639	return null;

apps/mobile/src/state/use-thread-outbox-drain.permissions.test.ts created+318

...	@@ -0,0 +1,318 @@
1	import {
2	AuthOrchestrationOperateScope,
3	CommandId,
4	EnvironmentId,
5	MessageId,
6	ProjectId,
7	ProviderInstanceId,
8	ThreadId,
9	} from "@t3tools/contracts";
10	import * as Cause from "effect/Cause";
11	import { AsyncResult, type Atom } from "effect/reactivity";
12	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
13	import type { QueuedThreadMessage } from "./thread-outbox-model";
14
15	const state = vi.hoisted(() => ({
16	grantedEnvironments: new Set<string>(),
17	draftText: "Keep this draft separate",
18	cleanups: [] as Array<() => void>,
19	start: vi.fn(),
20	metadata: vi.fn(),
21	runtime: vi.fn(),
22	interaction: vi.fn(),
23	prepare: vi.fn(),
24	manager: null as unknown as ReturnType<
25	typeof import("./thread-outbox-manager").createThreadOutboxManager
26	>,
27	thread: {
28	environmentId: "secondary",
29	id: "thread",
30	modelSelection: { instanceId: "codex", model: "gpt-5.4" },
31	runtimeMode: "full-access",
32	interactionMode: "default",
33	session: null,
34	},
35	config: {
36	providers: [{ instanceId: "codex", driver: "codex" }],
37	environment: { capabilities: {} },
38	},
39	}));
40	vi.mock("react", () => ({
41	useCallback: <A>(callback: A) => callback,
42	useEffect: (effect: () => void \| (() => void)) => {
43	const cleanup = effect();
44	if (cleanup) state.cleanups.push(cleanup);
45	},
46	useRef: <A>(value: A) => ({ current: value }),
47	useState: <A>(initial: A) => [initial, vi.fn()],
48	}));
49	vi.mock("react-native", () => ({ Alert: { alert: vi.fn() } }));
50	vi.mock("@effect/atom-react", async () => {
51	const { appAtomRegistry } = await import("./atom-registry");
52	return { useAtomValue: <A>(atom: Atom.Atom<A>) => appAtomRegistry.get(atom) };
53	});
54	vi.mock("./session", () => ({
55	readEnvironmentScope: (environmentId: string, scope: string) =>
56	scope === AuthOrchestrationOperateScope && state.grantedEnvironments.has(environmentId),
57	useEnvironmentsWithScope: () => state.grantedEnvironments,
58	}));
59	vi.mock("./entities", () => ({
60	useProjects: () => [],
61	useThreadShells: () => [state.thread],
62	useServerConfigs: () => new Map([["secondary", state.config]]),
63	}));
64	vi.mock("./server", async () => {
65	const { Atom } = await import("effect/reactivity");
66	return {
67	serverEnvironment: { configValueAtom: Atom.family((_id: string) => Atom.make(state.config)) },
68	};
69	});
70	vi.mock("./threads", async () => {
71	const { Atom } = await import("effect/reactivity");
72	return {
73	threadEnvironment: {
74	startTurn: state.start,
75	updateMetadata: state.metadata,
76	setRuntimeMode: state.runtime,
77	setInteractionMode: state.interaction,
78	},
79	environmentThreadShells: { threadShellsAtom: Atom.make([state.thread]) },
80	};
81	});
82	vi.mock("./use-atom-command", () => ({ useAtomCommand: <A>(command: A) => command }));
83	vi.mock("../lib/modelOptions", () => ({ isModelSelectionUnavailable: () => false }));
84	vi.mock("../lib/uuid", () => ({ uuidv4: () => "uuid", randomHex: () => "abcd" }));
85	vi.mock("../lib/attachmentUpload", () => ({ prepareTurnAttachments: state.prepare }));
86	vi.mock("./use-remote-environment-registry", () => ({
87	setPendingConnectionError: vi.fn(),
88	useRemoteConnectionStatus: () => ({
89	connectedEnvironments: [{ environmentId: "secondary", connectionState: "connected" }],
90	}),
91	}));
92	vi.mock("./thread-outbox", async () => {
93	const { createThreadOutboxManager } = await import("./thread-outbox-manager");
94	const { appAtomRegistry } = await import("./atom-registry");
95	state.manager = createThreadOutboxManager({
96	registry: appAtomRegistry,
97	storage: {
98	load: async () => ({ messages: [], errors: [] }),
99	write: async () => {},
100	remove: async () => {},
101	},
102	});
103	return {
104	threadOutboxManager: state.manager,
105	threadOutboxRevision: (id: MessageId) => state.manager.revisionOf(id),
106	confirmThreadOutboxMessageQueued: (message: QueuedThreadMessage) =>
107	state.manager.confirmQueued(message),
108	updateThreadOutboxMessage: (message: QueuedThreadMessage, revision?: number) =>
109	state.manager.update(message, revision),
110	};
111	});
112	vi.mock("./thread-outbox-removal", () => ({
113	removeThreadOutboxMessage: (message: QueuedThreadMessage, revision?: number) =>
114	state.manager.remove(message, revision),
115	}));
116	vi.mock("./use-thread-outbox", async () => {
117	const { Atom } = await import("effect/reactivity");
118	const { appAtomRegistry } = await import("./atom-registry");
119	await import("./thread-outbox");
120	return {
121	editingQueuedMessageIdsAtom: Atom.make({}).pipe(Atom.keepAlive),
122	dispatchingQueuedMessageIdAtom: Atom.make<MessageId \| null>(null).pipe(Atom.keepAlive),
123	useThreadOutboxMessages: () => appAtomRegistry.get(state.manager.queuedMessagesByThreadKeyAtom),
124	useThreadOutboxShellStatuses: () => new Map([["secondary", "live"]]),
125	};
126	});
127	vi.mock("./use-composer-drafts", async () => {
128	const { Atom } = await import("effect/reactivity");
129	return {
130	composerDraftsAtom: Atom.make({}),
131	removeDeliveredCloudQueuedMessage: async () => {},
132	appendComposerDraftAttachments: vi.fn(),
133	flushComposerDrafts: vi.fn(),
134	getComposerDraftSnapshot: vi.fn(() => ({ text: state.draftText, attachments: [] })),
135	mergeComposerDraftContent: vi.fn(async (_key: string, input: { text: string }) => {
136	state.draftText += `\n${input.text}`;
137	}),
138	replaceComposerDraftAttachments: vi.fn(),
139	undoComposerDraftMerge: vi.fn(),
140	updateComposerDraftSettings: vi.fn(),
141	waitForComposerDraftsLoaded: vi.fn(),
142	};
143	});
144
145	import { appAtomRegistry } from "./atom-registry";
146	import { dispatchingQueuedMessageIdAtom } from "./use-thread-outbox";
147	import { useThreadOutboxDrain } from "./use-thread-outbox-drain";
148
149	const message = (overrides: Partial<QueuedThreadMessage> = {}): QueuedThreadMessage => ({
150	environmentId: EnvironmentId.make("secondary"),
151	threadId: ThreadId.make("thread"),
152	commandId: CommandId.make("command"),
153	messageId: MessageId.make("message"),
154	text: "Keep this queued",
155	attachments: [],
156	createdAt: "2026-09-05T00:00:00.000Z",
157	...overrides,
158	});
159	const remaining = () =>
160	Object.values(appAtomRegistry.get(state.manager.queuedMessagesByThreadKeyAtom)).flat();
161
162	function runDrain() {
163	const settled = Promise.withResolvers<void>();
164	const release = appAtomRegistry.subscribe(dispatchingQueuedMessageIdAtom, (id) => {
165	if (id === null) settled.resolve();
166	});
167	useThreadOutboxDrain();
168	return settled.promise.finally(release);
169	}
170
171	beforeEach(() => {
172	state.grantedEnvironments = new Set(["primary"]);
173	state.draftText = "Keep this draft separate";
174	appAtomRegistry.set(state.manager.queuedMessagesByThreadKeyAtom, {});
175	appAtomRegistry.set(dispatchingQueuedMessageIdAtom, null);
176	for (const command of [state.start, state.metadata, state.runtime, state.interaction]) {
177	command.mockReset().mockResolvedValue(AsyncResult.success(undefined));
178	}
179	state.prepare.mockReset().mockImplementation(async ({ attachments }) => ({
180	status: "ready",
181	attachments: [],
182	draftAttachments: attachments,
183	pendingAttachmentIds: [],
184	}));
185	});
186	afterEach(() => {
187	state.cleanups.splice(0).forEach((cleanup) => cleanup());
188	});
189
190	describe("queued task operation access", () => {
191	it("parks a connected read-only target, then delivers its unchanged queue after a grant", async () => {
192	const queued = message();
193	await state.manager.enqueue(queued);
194	useThreadOutboxDrain();
195	expect(state.start).not.toHaveBeenCalled();
196	expect(state.prepare).not.toHaveBeenCalled();
197	expect(remaining()).toEqual([queued]);
198	state.grantedEnvironments.add("secondary");
199	await runDrain();
200	expect(state.start).toHaveBeenCalledOnce();
201	expect(remaining()).toEqual([]);
202	});
203
204	it("stops the remaining settings and turn commands when an earlier update loses access", async () => {
205	state.grantedEnvironments.add("secondary");
206	const queued = message({
207	modelSelection: { instanceId: ProviderInstanceId.make("codex"), model: "different-model" },
208	runtimeMode: "approval-required",
209	interactionMode: "plan",
210	});
211	await state.manager.enqueue(queued);
212	state.runtime.mockImplementationOnce(async () => {
213	state.grantedEnvironments.delete("secondary");
214	return AsyncResult.success(undefined);
215	});
216	await runDrain();
217	expect(state.runtime).toHaveBeenCalledOnce();
218	expect(state.interaction).not.toHaveBeenCalled();
219	expect(state.prepare).not.toHaveBeenCalled();
220	expect(state.start).not.toHaveBeenCalled();
221	expect(remaining()).toEqual([queued]);
222	});
223
224	it.each([
225	{ isCreation: false, accepted: false },
226	{ isCreation: true, accepted: false },
227	{ isCreation: false, accepted: true },
228	{ isCreation: true, accepted: true },
229	])(
230	"preserves a rejected queue but removes an accepted turn after access loss (new task: $isCreation, accepted: $accepted)",
231	async ({ isCreation, accepted }) => {
232	state.grantedEnvironments.add("secondary");
233	const queued = message(
234	isCreation
235	? {
236	threadId: ThreadId.make("new-thread"),
237	modelSelection: { instanceId: ProviderInstanceId.make("codex"), model: "gpt-5.4" },
238	creation: {
239	projectId: ProjectId.make("project"),
240	projectCwd: "/repo",
241	workspaceMode: "local",
242	branch: null,
243	worktreePath: null,
244	},
245	}
246	: {},
247	);
248	await state.manager.enqueue(queued);
249	const started = Promise.withResolvers<void>();
250	const delivery = Promise.withResolvers<AsyncResult.AsyncResult<void, Error>>();
251	state.start.mockImplementationOnce(() => {
252	started.resolve();
253	return delivery.promise;
254	});
255	const drained = runDrain();
256	await started.promise;
257	state.grantedEnvironments.delete("secondary");
258	delivery.resolve(
259	accepted
260	? AsyncResult.success(undefined)
261	: AsyncResult.failure(Cause.fail(new Error("This connection cannot control this task."))),
262	);
263	await drained;
264
265	expect(remaining()).toEqual(accepted ? [] : [queued]);
266	expect(state.draftText).toBe("Keep this draft separate");
267	if (!accepted) {
268	state.grantedEnvironments.add("secondary");
269	await runDrain();
270	expect(state.start).toHaveBeenCalledTimes(2);
271	expect(remaining()).toEqual([]);
272	expect(state.draftText).toBe("Keep this draft separate");
273	}
274	},
275	);
276
277	it.each([
278	{ isCreation: false, uploadFails: false },
279	{ isCreation: true, uploadFails: false },
280	{ isCreation: false, uploadFails: true },
281	{ isCreation: true, uploadFails: true },
282	])(
283	"keeps the message queued after upload revocation (new task: $isCreation, upload fails: $uploadFails)",
284	async ({ isCreation, uploadFails }) => {
285	state.grantedEnvironments.add("secondary");
286	const queued = message(
287	isCreation
288	? {
289	threadId: ThreadId.make("new-thread"),
290	modelSelection: { instanceId: ProviderInstanceId.make("codex"), model: "gpt-5.4" },
291	creation: {
292	projectId: ProjectId.make("project"),
293	projectCwd: "/repo",
294	workspaceMode: "local",
295	branch: null,
296	worktreePath: null,
297	},
298	}
299	: {},
300	);
301	await state.manager.enqueue(queued);
302	state.prepare.mockImplementationOnce(async ({ attachments }) => {
303	state.grantedEnvironments.delete("secondary");
304	if (uploadFails) throw new Error("This connection cannot upload attachments.");
305	return {
306	status: "ready",
307	attachments: [],
308	draftAttachments: attachments,
309	pendingAttachmentIds: [],
310	};
311	});
312	await runDrain();
313	expect(state.prepare).toHaveBeenCalledOnce();
314	expect(state.start).not.toHaveBeenCalled();
315	expect(remaining()).toEqual([queued]);
316	},
317	);
318	});

apps/mobile/src/state/use-thread-outbox-drain.test.ts+28

...	@@ -13,6 +13,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test"	...	@@ -13,6 +13,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test"
13	import type { PreparedTurnAttachments } from "../lib/attachmentUpload";	13	import type { PreparedTurnAttachments } from "../lib/attachmentUpload";
14		14
15	const harness = vi.hoisted(() => ({	15	const harness = vi.hoisted(() => ({
		16	canOperate: true,
16	manager: null as unknown as ReturnType<	17	manager: null as unknown as ReturnType<
17	typeof import("./thread-outbox-manager").createThreadOutboxManager	18	typeof import("./thread-outbox-manager").createThreadOutboxManager
18	>,	19	>,
...	@@ -95,6 +96,11 @@ vi.mock("./use-atom-command", () => ({	...	@@ -95,6 +96,11 @@ vi.mock("./use-atom-command", () => ({
95	useAtomCommand: () => async () => undefined,	96	useAtomCommand: () => async () => undefined,
96	}));	97	}));
97		98
		99	vi.mock("./session", () => ({
		100	readEnvironmentScope: () => harness.canOperate,
		101	useEnvironmentsWithScope: () => new Set(),
		102	}));
		103
98	vi.mock("./use-thread-outbox", async () => {	104	vi.mock("./use-thread-outbox", async () => {
99	const { Atom } = await import("effect/reactivity");	105	const { Atom } = await import("effect/reactivity");
100	return {	106	return {
...	@@ -203,6 +209,7 @@ function remainingMessages(): ReadonlyArray<QueuedThreadMessage> {	...	@@ -203,6 +209,7 @@ function remainingMessages(): ReadonlyArray<QueuedThreadMessage> {
203		209
204	beforeEach(() => {	210	beforeEach(() => {
205	appAtomRegistry.set(acknowledgedThreadMessagesAtom, []);	211	appAtomRegistry.set(acknowledgedThreadMessagesAtom, []);
		212	harness.canOperate = true;
206	harness.draftFile.setDocument({ schemaVersion: 1, drafts: {} });	213	harness.draftFile.setDocument({ schemaVersion: 1, drafts: {} });
207	});	214	});
208		215
...	@@ -220,6 +227,27 @@ afterEach(() => {	...	@@ -220,6 +227,27 @@ afterEach(() => {
220	});	227	});
221		228
222	describe("thread outbox attachment preparation", () => {	229	describe("thread outbox attachment preparation", () => {
		230	it("keeps a denied message queued without starting its attachment upload", async () => {
		231	const message = queuedMessage({
		232	messageId: "denied-queued-message",
		233	text: "Keep this queued",
		234	fileUri: "file:///documents/keep.pdf",
		235	});
		236	await harness.manager.enqueue(message);
		237	harness.prepareTurnAttachments.mockResolvedValueOnce({
		238	status: "ready",
		239	attachments: [],
		240	draftAttachments: message.attachments,
		241	pendingAttachmentIds: [],
		242	});
		243	harness.canOperate = false;
		244	await expect(prepareQueuedMessageAttachments(message)).resolves.toEqual({
		245	status: "abandoned",
		246	});
		247	expect(harness.prepareTurnAttachments).not.toHaveBeenCalled();
		248	expect(remainingMessages()).toEqual([message]);
		249	});
		250
223	it("abandons reused uploads when an editor saves changed text during verification", async () => {	251	it("abandons reused uploads when an editor saves changed text during verification", async () => {
224	const message = withReusedFileUpload(	252	const message = withReusedFileUpload(
225	queuedMessage({	253	queuedMessage({

apps/mobile/src/state/use-thread-outbox-drain.ts+28

...	@@ -7,6 +7,7 @@ import {	...	@@ -7,6 +7,7 @@ import {
7	import type { AtomCommandResult } from "@t3tools/client-runtime/state/runtime";	7	import type { AtomCommandResult } from "@t3tools/client-runtime/state/runtime";
8	import { deriveThreadTitleSeed } from "@t3tools/client-runtime/operations";	8	import { deriveThreadTitleSeed } from "@t3tools/client-runtime/operations";
9	import {	9	import {
		10	AuthOrchestrationOperateScope,
10	CommandId,	11	CommandId,
11	DEFAULT_PROVIDER_INTERACTION_MODE,	12	DEFAULT_PROVIDER_INTERACTION_MODE,
12	DEFAULT_RUNTIME_MODE,	13	DEFAULT_RUNTIME_MODE,
...	@@ -39,6 +40,7 @@ import {	...	@@ -39,6 +40,7 @@ import {
39	recordPendingThreadCreationOutcome,	40	recordPendingThreadCreationOutcome,
40	} from "./pending-thread-creation";	41	} from "./pending-thread-creation";
41	import { serverEnvironment } from "./server";	42	import { serverEnvironment } from "./server";
		43	import { readEnvironmentScope, useEnvironmentsWithScope } from "./session";
42	import {	44	import {
43	confirmThreadOutboxMessageQueued,	45	confirmThreadOutboxMessageQueued,
44	threadOutboxManager,	46	threadOutboxManager,
...	@@ -226,6 +228,9 @@ export async function prepareQueuedMessageAttachments(	...	@@ -226,6 +228,9 @@ export async function prepareQueuedMessageAttachments(
226	if (!(await confirmThreadOutboxMessageQueued(queuedMessage))) {	228	if (!(await confirmThreadOutboxMessageQueued(queuedMessage))) {
227	return { status: "abandoned" };	229	return { status: "abandoned" };
228	}	230	}
		231	if (!readEnvironmentScope(queuedMessage.environmentId, AuthOrchestrationOperateScope)) {
		232	return { status: "abandoned" };
		233	}
229	const revision = threadOutboxRevision(queuedMessage.messageId);	234	const revision = threadOutboxRevision(queuedMessage.messageId);
230	if (!isQueuedMessagePayloadCurrent(queuedMessage, revision)) {	235	if (!isQueuedMessagePayloadCurrent(queuedMessage, revision)) {
231	return { status: "abandoned" };	236	return { status: "abandoned" };
...	@@ -668,6 +673,10 @@ export function useThreadOutboxDrain(): void {	...	@@ -668,6 +673,10 @@ export function useThreadOutboxDrain(): void {
668	const projects = useProjects();	673	const projects = useProjects();
669	const serverConfigs = useServerConfigs();	674	const serverConfigs = useServerConfigs();
670	const { connectedEnvironments } = useRemoteConnectionStatus();	675	const { connectedEnvironments } = useRemoteConnectionStatus();
		676	const operableEnvironments = useEnvironmentsWithScope(
		677	connectedEnvironments,
		678	AuthOrchestrationOperateScope,
		679	);
671	const [retryTick, setRetryTick] = useState(0);	680	const [retryTick, setRetryTick] = useState(0);
672	const retryAttemptRef = useRef(new Map<MessageId, number>());	681	const retryAttemptRef = useRef(new Map<MessageId, number>());
673	const retryNotBeforeRef = useRef(new Map<MessageId, number>());	682	const retryNotBeforeRef = useRef(new Map<MessageId, number>());
...	@@ -794,6 +803,9 @@ export function useThreadOutboxDrain(): void {	...	@@ -794,6 +803,9 @@ export function useThreadOutboxDrain(): void {
794		803
795	const sendQueuedMessage = useCallback(	804	const sendQueuedMessage = useCallback(
796	async (queuedMessage: QueuedThreadMessage, thread: EnvironmentThreadShell) => {	805	async (queuedMessage: QueuedThreadMessage, thread: EnvironmentThreadShell) => {
		806	const hasAccess = () =>
		807	readEnvironmentScope(queuedMessage.environmentId, AuthOrchestrationOperateScope);
		808	if (!hasAccess()) return true;
797	const serverConfig = appAtomRegistry.get(	809	const serverConfig = appAtomRegistry.get(
798	serverEnvironment.configValueAtom(queuedMessage.environmentId),	810	serverEnvironment.configValueAtom(queuedMessage.environmentId),
799	);	811	);
...	@@ -808,6 +820,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -808,6 +820,7 @@ export function useThreadOutboxDrain(): void {
808	const { reportFailure } = makeDeliveryHelpers(queuedMessage);	820	const { reportFailure } = makeDeliveryHelpers(queuedMessage);
809		821
810	if (settings.runtimeMode !== thread.runtimeMode) {	822	if (settings.runtimeMode !== thread.runtimeMode) {
		823	if (!hasAccess()) return true;
811	const runtimeResult = await setThreadRuntimeMode({	824	const runtimeResult = await setThreadRuntimeMode({
812	environmentId: queuedMessage.environmentId,	825	environmentId: queuedMessage.environmentId,
813	input: {	826	input: {
...	@@ -824,6 +837,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -824,6 +837,7 @@ export function useThreadOutboxDrain(): void {
824	}	837	}
825		838
826	if (settings.interactionMode !== thread.interactionMode) {	839	if (settings.interactionMode !== thread.interactionMode) {
		840	if (!hasAccess()) return true;
827	const interactionResult = await setThreadInteractionMode({	841	const interactionResult = await setThreadInteractionMode({
828	environmentId: queuedMessage.environmentId,	842	environmentId: queuedMessage.environmentId,
829	input: {	843	input: {
...	@@ -842,6 +856,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -842,6 +856,7 @@ export function useThreadOutboxDrain(): void {
842	let prepared: PreparedTurnAttachments;	856	let prepared: PreparedTurnAttachments;
843	let persistedMessage: QueuedThreadMessage;	857	let persistedMessage: QueuedThreadMessage;
844	let deliveryRevision: number;	858	let deliveryRevision: number;
		859	if (!hasAccess()) return true;
845	try {	860	try {
846	const preparedResult = await prepareQueuedMessageAttachments(	861	const preparedResult = await prepareQueuedMessageAttachments(
847	queuedMessage,	862	queuedMessage,
...	@@ -861,6 +876,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -861,6 +876,7 @@ export function useThreadOutboxDrain(): void {
861	return true;	876	return true;
862	}	877	}
863	} catch (error) {	878	} catch (error) {
		879	if (!hasAccess()) return true;
864	logThreadOutboxUploadFailure(queuedMessage, error);	880	logThreadOutboxUploadFailure(queuedMessage, error);
865	if (!shouldRetryThreadOutboxDelivery(error)) {	881	if (!shouldRetryThreadOutboxDelivery(error)) {
866	return restoreQueuedMessage(	882	return restoreQueuedMessage(
...	@@ -888,6 +904,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -888,6 +904,7 @@ export function useThreadOutboxDrain(): void {
888	settings,	904	settings,
889	currentConfig.providers,	905	currentConfig.providers,
890	);	906	);
		907	if (!hasAccess()) return true;
891	const deliveryResult = await startTurn({	908	const deliveryResult = await startTurn({
892	environmentId: queuedMessage.environmentId,	909	environmentId: queuedMessage.environmentId,
893	input: {	910	input: {
...	@@ -922,6 +939,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -922,6 +939,7 @@ export function useThreadOutboxDrain(): void {
922	dispatchMode: queuedMessage.dispatchMode ?? "start",	939	dispatchMode: queuedMessage.dispatchMode ?? "start",
923	},	940	},
924	});	941	});
		942	if (AsyncResult.isFailure(deliveryResult) && !hasAccess()) return true;
925	const failure = reportFailure(deliveryResult, "start-turn");	943	const failure = reportFailure(deliveryResult, "start-turn");
926	if (failure?.action === "retry") {	944	if (failure?.action === "retry") {
927	return false;	945	return false;
...	@@ -952,6 +970,9 @@ export function useThreadOutboxDrain(): void {	...	@@ -952,6 +970,9 @@ export function useThreadOutboxDrain(): void {
952	creation: QueuedThreadCreation,	970	creation: QueuedThreadCreation,
953	projectCwd: string,	971	projectCwd: string,
954	) => {	972	) => {
		973	const hasAccess = () =>
		974	readEnvironmentScope(queuedMessage.environmentId, AuthOrchestrationOperateScope);
		975	if (!hasAccess()) return true;
955	const modelSelection = queuedMessage.modelSelection;	976	const modelSelection = queuedMessage.modelSelection;
956	if (modelSelection === undefined) {	977	if (modelSelection === undefined) {
957	return false;	978	return false;
...	@@ -997,6 +1018,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -997,6 +1018,7 @@ export function useThreadOutboxDrain(): void {
997	return true;	1018	return true;
998	}	1019	}
999	} catch (error) {	1020	} catch (error) {
		1021	if (!hasAccess()) return true;
1000	logThreadOutboxUploadFailure(queuedMessage, error);	1022	logThreadOutboxUploadFailure(queuedMessage, error);
1001	if (!shouldRetryThreadOutboxDelivery(error)) {	1023	if (!shouldRetryThreadOutboxDelivery(error)) {
1002	return restoreQueuedMessage(	1024	return restoreQueuedMessage(
...	@@ -1024,6 +1046,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -1024,6 +1046,7 @@ export function useThreadOutboxDrain(): void {
1024	settings,	1046	settings,
1025	currentConfig.providers,	1047	currentConfig.providers,
1026	);	1048	);
		1049	if (!hasAccess()) return true;
1027	const deliveryResult = await startTurn({	1050	const deliveryResult = await startTurn({
1028	environmentId: queuedMessage.environmentId,	1051	environmentId: queuedMessage.environmentId,
1029	input: buildProjectThreadStartTurnInput({	1052	input: buildProjectThreadStartTurnInput({
...	@@ -1054,6 +1077,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -1054,6 +1077,7 @@ export function useThreadOutboxDrain(): void {
1054	}),	1077	}),
1055	});	1078	});
1056	const { reportFailure } = makeDeliveryHelpers(queuedMessage);	1079	const { reportFailure } = makeDeliveryHelpers(queuedMessage);
		1080	if (AsyncResult.isFailure(deliveryResult) && !hasAccess()) return true;
1057	const failure = reportFailure(deliveryResult, "start-turn");	1081	const failure = reportFailure(deliveryResult, "start-turn");
1058	if (failure?.action === "retry") {	1082	if (failure?.action === "retry") {
1059	return false;	1083	return false;
...	@@ -1188,6 +1212,9 @@ export function useThreadOutboxDrain(): void {	...	@@ -1188,6 +1212,9 @@ export function useThreadOutboxDrain(): void {
1188	environmentConnected: environment?.connectionState === "connected",	1212	environmentConnected: environment?.connectionState === "connected",
1189	threadBusy: threadRuntimeIsActive(thread?.runtime),	1213	threadBusy: threadRuntimeIsActive(thread?.runtime),
1190	});	1214	});
		1215	if (deliveryAction === "send" && !operableEnvironments.has(nextQueuedMessage.environmentId)) {
		1216	continue;
		1217	}
1191	// The delivery action resolves first; capability checks apply only to	1218	// The delivery action resolves first; capability checks apply only to
1192	// a message that will send. Checking earlier would restore a	1219	// a message that will send. Checking earlier would restore a
1193	// creation whose startTurn already made the thread as a duplicate draft	1220	// creation whose startTurn already made the thread as a duplicate draft
...	@@ -1345,6 +1372,7 @@ export function useThreadOutboxDrain(): void {	...	@@ -1345,6 +1372,7 @@ export function useThreadOutboxDrain(): void {
1345	connectedEnvironments,	1372	connectedEnvironments,
1346	dispatchingQueuedMessageId,	1373	dispatchingQueuedMessageId,
1347	editingQueuedMessageIds,	1374	editingQueuedMessageIds,
		1375	operableEnvironments,
1348	projects,	1376	projects,
1349	queuedMessagesByThreadKey,	1377	queuedMessagesByThreadKey,
1350	retryTick,	1378	retryTick,

apps/server/src/auth/EnvironmentAuth.test.ts+3-18

 @@ -1,5 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { AuthAdministrativeScopes } from "@t3tools/contracts";
+import { AuthAdministrativeScopes, AuthStandardClientScopes } from "@t3tools/contracts";
 import { expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 @@ -328,13 +328,7 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
       );
       expect(verified.sessionId.length).toBeGreaterThan(0);
-      expect(verified.scopes).toEqual([
+      expect(verified.scopes).toEqual(AuthStandardClientScopes);
-        "orchestration:read",
-        "orchestration:operate",
-        "terminal:operate",
-        "review:write",
-        "relay:read",
-      ]);
       expect(verified.subject).toBe("one-time-token");
     }).pipe(Effect.provide(layerEnvironmentAuth())),
   );
 @@ -535,16 +529,7 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
         makeCookieRequest(sessions.cookieName, exchanged.sessionToken),
       );
-      expect(verified.scopes).toEqual([
+      expect(verified.scopes).toEqual(AuthAdministrativeScopes);
-        "orchestration:read",
-        "orchestration:operate",
-        "terminal:operate",
-        "review:write",
-        "relay:read",
-        "access:read",
-        "access:write",
-        "relay:write",
-      ]);
       expect(verified.subject).toBe("administrative-bootstrap");
     }).pipe(Effect.provide(layerEnvironmentAuth())),
   );

apps/server/src/auth/EnvironmentAuthAdmin.test.ts+3-20

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { AuthAdministrativeScopes } from "@t3tools/contracts";
1	import * as NodeServices from "@effect/platform-node/NodeServices";	2	import * as NodeServices from "@effect/platform-node/NodeServices";
2	import { expect, it } from "@effect/vitest";	3	import { expect, it } from "@effect/vitest";
3	import * as Effect from "effect/Effect";	4	import * as Effect from "effect/Effect";
...	@@ -79,29 +80,11 @@ it.layer(NodeServices.layer)("EnvironmentAuth administrative operations", (it) =	...	@@ -79,29 +80,11 @@ it.layer(NodeServices.layer)("EnvironmentAuth administrative operations", (it) =
79	const listedAfterRevoke = yield* environmentAuth.listSessions();	80	const listedAfterRevoke = yield* environmentAuth.listSessions();
80		81
81	expect(issued.method).toBe("bearer-access-token");	82	expect(issued.method).toBe("bearer-access-token");
82	expect(issued.scopes).toEqual([	83	expect(issued.scopes).toEqual(AuthAdministrativeScopes);
83	"orchestration:read",
84	"orchestration:operate",
85	"terminal:operate",
86	"review:write",
87	"relay:read",
88	"access:read",
89	"access:write",
90	"relay:write",
91	]);
92	expect(issued.client.deviceType).toBe("bot");	84	expect(issued.client.deviceType).toBe("bot");
93	expect(issued.client.label).toBe("deploy-bot");	85	expect(issued.client.label).toBe("deploy-bot");
94	expect(verified.sessionId).toBe(issued.sessionId);	86	expect(verified.sessionId).toBe(issued.sessionId);
95	expect(verified.scopes).toEqual([	87	expect(verified.scopes).toEqual(AuthAdministrativeScopes);
96	"orchestration:read",
97	"orchestration:operate",
98	"terminal:operate",
99	"review:write",
100	"relay:read",
101	"access:read",
102	"access:write",
103	"relay:write",
104	]);
105	expect(verified.method).toBe("bearer-access-token");	88	expect(verified.method).toBe("bearer-access-token");
106	expect(listedBeforeRevoke).toHaveLength(1);	89	expect(listedBeforeRevoke).toHaveLength(1);
107	expect(listedBeforeRevoke[0]?.sessionId).toBe(issued.sessionId);	90	expect(listedBeforeRevoke[0]?.sessionId).toBe(issued.sessionId);

apps/server/src/auth/EnvironmentAuthPolicy.test.ts+2

...	@@ -34,6 +34,7 @@ it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {	...	@@ -34,6 +34,7 @@ it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {
34		34
35	expect(descriptor.policy).toBe("desktop-managed-local");	35	expect(descriptor.policy).toBe("desktop-managed-local");
36	expect(descriptor.bootstrapMethods).toEqual(["desktop-bootstrap"]);	36	expect(descriptor.bootstrapMethods).toEqual(["desktop-bootstrap"]);
		37	expect(descriptor.serverUpdateScope).toBe("environment:maintain");
37	// Packaged desktop has no devUrl, but still needs the port scope: it	38	// Packaged desktop has no devUrl, but still needs the port scope: it
38	// scans upward from 3773 for a free port and binds 127.0.0.1, so a second	39	// scans upward from 3773 for a free port and binds 127.0.0.1, so a second
39	// instance shares this one's hostname on a different port.	40	// instance shares this one's hostname on a different port.
...	@@ -88,6 +89,7 @@ it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {	...	@@ -88,6 +89,7 @@ it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {
88		89
89	expect(descriptor.policy).toBe("loopback-browser");	90	expect(descriptor.policy).toBe("loopback-browser");
90	expect(descriptor.bootstrapMethods).toEqual(["one-time-token"]);	91	expect(descriptor.bootstrapMethods).toEqual(["one-time-token"]);
		92	expect(descriptor.serverUpdateScope).toBe("environment:maintain");
91	expect(descriptor.sessionCookieName).toMatch(/^t3_session_3773_[a-f0-9]{12}$/);	93	expect(descriptor.sessionCookieName).toMatch(/^t3_session_3773_[a-f0-9]{12}$/);
92	}).pipe(	94	}).pipe(
93	Effect.provide(	95	Effect.provide(

apps/server/src/auth/EnvironmentAuthPolicy.ts+2-1

...	@@ -1,4 +1,4 @@	...	@@ -1,4 +1,4 @@
1	import type { ServerAuthDescriptor } from "@t3tools/contracts";	1	import { AuthEnvironmentMaintainScope, type ServerAuthDescriptor } from "@t3tools/contracts";
2	import * as Context from "effect/Context";	2	import * as Context from "effect/Context";
3	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
4	import * as Layer from "effect/Layer";	4	import * as Layer from "effect/Layer";
...	@@ -40,6 +40,7 @@ export const make = Effect.gen(function* () {	...	@@ -40,6 +40,7 @@ export const make = Effect.gen(function* () {
40	policy,	40	policy,
41	bootstrapMethods,	41	bootstrapMethods,
42	sessionMethods: ["browser-session-cookie", "bearer-access-token", "dpop-access-token"],	42	sessionMethods: ["browser-session-cookie", "bearer-access-token", "dpop-access-token"],
		43	serverUpdateScope: AuthEnvironmentMaintainScope,
43	sessionCookieName: resolveSessionCookieName({	44	sessionCookieName: resolveSessionCookieName({
44	mode: config.mode,	45	mode: config.mode,
45	port: config.port,	46	port: config.port,

apps/server/src/auth/McpOAuth.test.ts+2-2

...	@@ -1,7 +1,7 @@	...	@@ -1,7 +1,7 @@
1	import * as NodeServices from "@effect/platform-node/NodeServices";	1	import * as NodeServices from "@effect/platform-node/NodeServices";
2	import {	2	import {
3	AuthAdministrativeScopes,	3	AuthAdministrativeScopes,
4	type AuthEnvironmentScope,	4	type AuthCreatePairingCredentialInput,
5	EnvironmentHttpApi,	5	EnvironmentHttpApi,
6	} from "@t3tools/contracts";	6	} from "@t3tools/contracts";
7	import { expect, it } from "@effect/vitest";	7	import { expect, it } from "@effect/vitest";
...	@@ -418,7 +418,7 @@ it.live("one-click approves only access the browser session holds the scopes for	...	@@ -418,7 +418,7 @@ it.live("one-click approves only access the browser session holds the scopes for
418	const clientId = yield* registeredClientId(handler);	418	const clientId = yield* registeredClientId(handler);
419	const params = authorizeParams(clientId);	419	const params = authorizeParams(clientId);
420	// Signs a browser in through the real route and returns its session cookie.	420	// Signs a browser in through the real route and returns its session cookie.
421	const browserCookie = (scopes: ReadonlyArray<AuthEnvironmentScope>) =>	421	const browserCookie = (scopes: NonNullable<AuthCreatePairingCredentialInput["scopes"]>) =>
422	Effect.gen(function* () {	422	Effect.gen(function* () {
423	const pairing = yield* auth.issuePairingCredential({ scopes });	423	const pairing = yield* auth.issuePairingCredential({ scopes });
424	const response = yield* handler(	424	const response = yield* handler(

apps/server/src/auth/PairingGrantStore.test.ts+3-17

 @@ -1,3 +1,4 @@
+import { AuthAdministrativeScopes, AuthStandardClientScopes } from "@t3tools/contracts";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { expect, it } from "@effect/vitest";
 import * as Duration from "effect/Duration";
 @@ -83,13 +84,7 @@ it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
       const second = yield* Effect.flip(bootstrapCredentials.consume(issued.credential));
       expect(first.method).toBe("one-time-token");
-      expect(first.scopes).toEqual([
+      expect(first.scopes).toEqual(AuthStandardClientScopes);
-        "orchestration:read",
-        "orchestration:operate",
-        "terminal:operate",
-        "review:write",
-        "relay:read",
-      ]);
       expect(first.subject).toBe("one-time-token");
       expect(first.label).toBe("Julius iPhone");
       expect(issued.label).toBe("Julius iPhone");
 @@ -168,16 +163,7 @@ it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
       const third = yield* bootstrapCredentials.consume("desktop-bootstrap-token");
       expect(first.method).toBe("desktop-bootstrap");
-      expect(first.scopes).toEqual([
+      expect(first.scopes).toEqual(AuthAdministrativeScopes);
-        "orchestration:read",
-        "orchestration:operate",
-        "terminal:operate",
-        "review:write",
-        "relay:read",
-        "access:read",
-        "access:write",
-        "relay:write",
-      ]);
       expect(first.subject).toBe("desktop-bootstrap");
       expect(second.method).toBe("desktop-bootstrap");
       expect(third.method).toBe("desktop-bootstrap");

apps/server/src/auth/RpcAuthorization.test.ts+80-6

...	@@ -1,4 +1,9 @@	...	@@ -1,4 +1,9 @@
1	import {	1	import {
		2	AuthEnvironmentMaintainScope,
		3	AuthProvidersManageScope,
		4	AuthSettingsWriteScope,
		5	DEFAULT_SERVER_SETTINGS,
		6	ProviderInstanceId,
2	AuthOrchestrationOperateScope,	7	AuthOrchestrationOperateScope,
3	AuthOrchestrationReadScope,	8	AuthOrchestrationReadScope,
4	AuthRelayReadScope,	9	AuthRelayReadScope,
...	@@ -28,7 +33,7 @@ describe("RPC authorization scopes", () => {	...	@@ -28,7 +33,7 @@ describe("RPC authorization scopes", () => {
28	AuthOrchestrationReadScope,	33	AuthOrchestrationReadScope,
29	);	34	);
30	expect(requiredScopeForRpcMethod(WS_METHODS.serverReportHostPowerState)).toBe(	35	expect(requiredScopeForRpcMethod(WS_METHODS.serverReportHostPowerState)).toBe(
31	AuthOrchestrationOperateScope,	36	AuthEnvironmentMaintainScope,
32	);	37	);
33	expect(requiredScopeForRpcMethod(WS_METHODS.serverGetBackgroundPolicy)).toBe(	38	expect(requiredScopeForRpcMethod(WS_METHODS.serverGetBackgroundPolicy)).toBe(
34	AuthOrchestrationReadScope,	39	AuthOrchestrationReadScope,
...	@@ -75,13 +80,13 @@ describe("RPC authorization scopes", () => {	...	@@ -75,13 +80,13 @@ describe("RPC authorization scopes", () => {
75	AuthOrchestrationReadScope,	80	AuthOrchestrationReadScope,
76	);	81	);
77	expect(requiredScopeForRpcMethod(WS_METHODS.serverPrepareAcpRegistryAgent)).toBe(	82	expect(requiredScopeForRpcMethod(WS_METHODS.serverPrepareAcpRegistryAgent)).toBe(
78	AuthOrchestrationOperateScope,	83	AuthProvidersManageScope,
79	);	84	);
80	expect(requiredScopeForRpcMethod(WS_METHODS.serverUninstallAcpRegistryManagedBinary)).toBe(	85	expect(requiredScopeForRpcMethod(WS_METHODS.serverUninstallAcpRegistryManagedBinary)).toBe(
81	AuthOrchestrationOperateScope,	86	AuthProvidersManageScope,
82	);	87	);
83	expect(requiredScopeForRpcMethod(WS_METHODS.serverAcceptAcpRegistryUrlAuth)).toBe(	88	expect(requiredScopeForRpcMethod(WS_METHODS.serverAcceptAcpRegistryUrlAuth)).toBe(
84	AuthOrchestrationOperateScope,	89	AuthProvidersManageScope,
85	);	90	);
86	expect(requiredScopeForRpcMethod(WS_METHODS.serverListAcpRegistrySessions)).toBe(	91	expect(requiredScopeForRpcMethod(WS_METHODS.serverListAcpRegistrySessions)).toBe(
87	AuthOrchestrationReadScope,	92	AuthOrchestrationReadScope,
...	@@ -90,7 +95,7 @@ describe("RPC authorization scopes", () => {	...	@@ -90,7 +95,7 @@ describe("RPC authorization scopes", () => {
90	AuthOrchestrationOperateScope,	95	AuthOrchestrationOperateScope,
91	);	96	);
92	expect(requiredScopeForRpcMethod(WS_METHODS.serverLogoutAcpRegistry)).toBe(	97	expect(requiredScopeForRpcMethod(WS_METHODS.serverLogoutAcpRegistry)).toBe(
93	AuthOrchestrationOperateScope,	98	AuthProvidersManageScope,
94	);	99	);
95	});	100	});
96		101
...	@@ -160,9 +165,78 @@ describe("RPC scope middleware", () => {	...	@@ -160,9 +165,78 @@ describe("RPC scope middleware", () => {
160	yield* client[WS_METHODS.serverRetryResourceTelemetry]({}).pipe(Effect.flip),	165	yield* client[WS_METHODS.serverRetryResourceTelemetry]({}).pipe(Effect.flip),
161	).toMatchObject({	166	).toMatchObject({
162	_tag: "EnvironmentAuthorizationError",	167	_tag: "EnvironmentAuthorizationError",
163	requiredScope: AuthOrchestrationOperateScope,	168	requiredScope: AuthEnvironmentMaintainScope,
164	});	169	});
165	expect(handled).toEqual([]);	170	expect(handled).toEqual([]);
166	}).pipe(Effect.scoped),	171	}).pipe(Effect.scoped),
167	);	172	);
168	});	173	});
		174
		175	describe("settings mutation authorization", () => {
		176	const group = WsRpcGroup.omit(
		177	...[...WsRpcGroup.requests.keys()].filter(
		178	(
		179	tag,
		180	): tag is Exclude<keyof typeof RPC_REQUIRED_SCOPES, typeof WS_METHODS.serverUpdateSettings> =>
		181	tag !== WS_METHODS.serverUpdateSettings,
		182	),
		183	);
		184	const providerInstanceMutation = {
		185	operation: "remove" as const,
		186	instanceId: ProviderInstanceId.make("codex_work"),
		187	};
		188
		189	it.effect("allows provider-only mutations while denying mixed settings without their grant", () =>
		190	Effect.gen(function* () {
		191	let handled = 0;
		192	const client = yield* RpcTest.makeClient(group).pipe(
		193	Effect.provide(
		194	Layer.mergeAll(
		195	group.toLayerHandler(WS_METHODS.serverUpdateSettings, () =>
		196	Effect.sync(() => {
		197	handled++;
		198	return DEFAULT_SERVER_SETTINGS;
		199	}),
		200	),
		201	RpcAuthorization.layer([AuthProvidersManageScope]),
		202	),
		203	),
		204	);
		205	yield* client[WS_METHODS.serverUpdateSettings]({ patch: {}, providerInstanceMutation });
		206	expect(handled).toBe(1);
		207	expect(
		208	yield* client[WS_METHODS.serverUpdateSettings]({
		209	patch: { defaultRuntimeMode: "full-access" },
		210	providerInstanceMutation,
		211	}).pipe(Effect.flip),
		212	).toMatchObject({ requiredScope: AuthSettingsWriteScope });
		213	expect(handled).toBe(1);
		214	}).pipe(Effect.scoped),
		215	);
		216
		217	it.effect("does not let a settings grant create or remove providers", () =>
		218	Effect.gen(function* () {
		219	let handled = false;
		220	const client = yield* RpcTest.makeClient(group).pipe(
		221	Effect.provide(
		222	Layer.mergeAll(
		223	group.toLayerHandler(WS_METHODS.serverUpdateSettings, () =>
		224	Effect.sync(() => {
		225	handled = true;
		226	return DEFAULT_SERVER_SETTINGS;
		227	}),
		228	),
		229	RpcAuthorization.layer([AuthSettingsWriteScope]),
		230	),
		231	),
		232	);
		233	expect(
		234	yield* client[WS_METHODS.serverUpdateSettings]({
		235	patch: {},
		236	providerInstanceMutation,
		237	}).pipe(Effect.flip),
		238	).toMatchObject({ requiredScope: AuthProvidersManageScope });
		239	expect(handled).toBe(false);
		240	}).pipe(Effect.scoped),
		241	);
		242	});

apps/server/src/auth/RpcAuthorization.ts+64-43

 @@ -1,6 +1,13 @@
 import {
+  CLIENT_GUARDED_RPC_SCOPES,
   type DeviceListInput,
   AuthAccessReadScope,
+  ServerSettingsPatch,
+  ProviderInstanceMutation,
+  requiredScopesForServerSettingsPatch,
+  AuthSettingsWriteScope,
+  AuthProvidersManageScope,
+  AuthEnvironmentMaintainScope,
   AuthOrchestrationOperateScope,
   AuthOrchestrationReadScope,
   AuthRelayReadScope,
 @@ -15,6 +22,7 @@ import {
   WsRpcGroup,
 } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
 import * as Layer from "effect/Layer";
 import type * as RpcGroup from "effect/rpc/RpcGroup";
 @@ -26,6 +34,7 @@ type WsRpcMethod = RpcGroup.Rpcs<typeof WsRpcGroup>["_tag"];
  * runtime failure.
  */
 export const RPC_REQUIRED_SCOPES = {
+  ...CLIENT_GUARDED_RPC_SCOPES,
   [ORCHESTRATION_V2_WS_METHODS.dispatchCommand]: AuthOrchestrationOperateScope,
   [ORCHESTRATION_V2_WS_METHODS.getWorkflowScript]: AuthOrchestrationReadScope,
   [ORCHESTRATION_V2_WS_METHODS.getTurnDiff]: AuthOrchestrationReadScope,
 @@ -41,61 +50,56 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.projectsMutate]: AuthOrchestrationOperateScope,
   [WS_METHODS.serverProbe]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetConfig]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverRefreshProviders]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverRefreshProviders]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverUpdateProvider]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUpdateProvider]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthStart]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthStart]: AuthProvidersManageScope,
-  [WS_METHODS.providerConsumeResetCredit]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerConsumeResetCredit]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthComplete]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthComplete]: AuthProvidersManageScope,
-  [WS_METHODS.chatGptReconnectProfile]: AuthOrchestrationOperateScope,
+  [WS_METHODS.chatGptReconnectProfile]: AuthProvidersManageScope,
-  [WS_METHODS.chatGptImportProfile]: AuthOrchestrationOperateScope,
+  [WS_METHODS.chatGptImportProfile]: AuthProvidersManageScope,
-  [WS_METHODS.chatGptHandoffSubscribe]: AuthOrchestrationOperateScope,
+  [WS_METHODS.chatGptHandoffSubscribe]: AuthProvidersManageScope,
-  [WS_METHODS.codexAuthCallbackSubscribe]: AuthOrchestrationOperateScope,
+  [WS_METHODS.codexAuthCallbackSubscribe]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthRespond]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthRespond]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthCancel]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthCancel]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthLogout]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthLogout]: AuthProvidersManageScope,
-  [WS_METHODS.providerAuthSubscribe]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerAuthSubscribe]: AuthProvidersManageScope,
-  [WS_METHODS.providerInstallStart]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerInstallStart]: AuthProvidersManageScope,
-  [WS_METHODS.providerInstallCancel]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerInstallCancel]: AuthProvidersManageScope,
   [WS_METHODS.providerInstallSubscribe]: AuthOrchestrationReadScope,
-  [WS_METHODS.providerInstallRemove]: AuthOrchestrationOperateScope,
+  [WS_METHODS.providerInstallRemove]: AuthProvidersManageScope,
-  [WS_METHODS.serverUpdateServer]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUpdateServer]: AuthEnvironmentMaintainScope,
-  [WS_METHODS.serverUpdateServerWithProgress]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUpdateServerWithProgress]: AuthEnvironmentMaintainScope,
-  [WS_METHODS.serverCommitDesktopUpdate]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverCommitDesktopUpdate]: AuthEnvironmentMaintainScope,
-  [WS_METHODS.serverUpsertKeybinding]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUpsertKeybinding]: AuthSettingsWriteScope,
-  [WS_METHODS.serverRemoveKeybinding]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverRemoveKeybinding]: AuthSettingsWriteScope,
   [WS_METHODS.serverGetSettings]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverUpdateSettings]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUpdateSettings]: AuthSettingsWriteScope,
   [WS_METHODS.serverSearchAcpRegistry]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverPrepareAcpRegistryAgent]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverPrepareAcpRegistryAgent]: AuthProvidersManageScope,
-  [WS_METHODS.serverUninstallAcpRegistryManagedBinary]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverUninstallAcpRegistryManagedBinary]: AuthProvidersManageScope,
-  [WS_METHODS.serverAcceptAcpRegistryUrlAuth]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverAcceptAcpRegistryUrlAuth]: AuthProvidersManageScope,
   [WS_METHODS.serverListAcpRegistrySessions]: AuthOrchestrationReadScope,
   [WS_METHODS.serverImportAcpRegistrySession]: AuthOrchestrationOperateScope,
   [WS_METHODS.serverDeleteAcpRegistrySession]: AuthOrchestrationOperateScope,
   [WS_METHODS.serverListAcpRegistryProviders]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverSetAcpRegistryProvider]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverSetAcpRegistryProvider]: AuthProvidersManageScope,
-  [WS_METHODS.serverDisableAcpRegistryProvider]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverDisableAcpRegistryProvider]: AuthProvidersManageScope,
-  [WS_METHODS.serverLogoutAcpRegistry]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverLogoutAcpRegistry]: AuthProvidersManageScope,
   [WS_METHODS.serverDiscoverSourceControl]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetTraceDiagnostics]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetProcessDiagnostics]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetHostResources]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetProcessResourceHistory]: AuthOrchestrationReadScope,
   [WS_METHODS.serverGetResourceTelemetryHistory]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverRetryResourceTelemetry]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverRetryResourceTelemetry]: AuthEnvironmentMaintainScope,
   [WS_METHODS.serverGetUsageSummary]: AuthOrchestrationReadScope,
   [WS_METHODS.serverRefreshUsageRates]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverSignalProcess]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverSignalProcess]: AuthEnvironmentMaintainScope,
   [WS_METHODS.serverReportClientActivity]: AuthOrchestrationReadScope,
-  [WS_METHODS.serverReportHostPowerState]: AuthOrchestrationOperateScope,
+  [WS_METHODS.serverReportHostPowerState]: AuthEnvironmentMaintainScope,
   [WS_METHODS.serverGetBackgroundPolicy]: AuthOrchestrationReadScope,
   [WS_METHODS.scheduledTasksList]: AuthOrchestrationReadScope,
   [WS_METHODS.scheduledTasksSubscribe]: AuthOrchestrationReadScope,
-  [WS_METHODS.scheduledTasksUpsert]: AuthOrchestrationOperateScope,
-  [WS_METHODS.scheduledTasksSetEnabled]: AuthOrchestrationOperateScope,
-  [WS_METHODS.scheduledTasksDelete]: AuthOrchestrationOperateScope,
-  [WS_METHODS.scheduledTasksRunNow]: AuthOrchestrationOperateScope,
-  [WS_METHODS.scheduledTasksRotateWebhookToken]: AuthOrchestrationOperateScope,
   [WS_METHODS.secretsAnswerRequest]: AuthOrchestrationOperateScope,
   // Delivery logs hold request bodies, so they need the same scope as the URL.
   [WS_METHODS.scheduledTasksListWebhookDeliveries]: AuthOrchestrationOperateScope,
 @@ -195,8 +199,8 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.previewReportStatus]: AuthOrchestrationOperateScope,
   [WS_METHODS.subscribePreviewEvents]: AuthOrchestrationReadScope,
   [WS_METHODS.subscribeDiscoveredLocalServers]: AuthOrchestrationReadScope,
-  [WS_METHODS.deviceConfigure]: AuthOrchestrationOperateScope,
+  [WS_METHODS.deviceConfigure]: AuthSettingsWriteScope,
-  [WS_METHODS.deviceTestHost]: AuthOrchestrationOperateScope,
+  [WS_METHODS.deviceTestHost]: AuthSettingsWriteScope,
   [WS_METHODS.deviceList]: AuthOrchestrationReadScope,
   [WS_METHODS.deviceOpen]: AuthOrchestrationOperateScope,
   [WS_METHODS.deviceClose]: AuthOrchestrationOperateScope,
 @@ -227,13 +231,30 @@ export const rpcAuthorizationError = (requiredScope: AuthEnvironmentScope) =>
     requiredScope,
   });
+const SettingsUpdate = Schema.Struct({
+  patch: ServerSettingsPatch,
+  providerInstanceMutation: Schema.optionalKey(ProviderInstanceMutation),
+});
+const requiredScopesForSettingsUpdate = (payload: unknown) => {
+  const input = Schema.decodeUnknownSync(SettingsUpdate)(payload);
+  const scopes = requiredScopesForServerSettingsPatch(input.patch);
+  if (input.providerInstanceMutation === undefined) return scopes;
+  // An atomic provider mutation carries an empty patch unless it also changes settings.
+  return Object.values(input.patch).every((value) => value === undefined)
+    ? [AuthProvidersManageScope]
+    : [...new Set([...scopes, AuthProvidersManageScope])];
+};
 /** Authorizes every RPC on one connection against that connection's session scopes. */
 export const layer = (scopes: ReadonlyArray<AuthEnvironmentScope>) =>
-  Layer.succeed(RpcScopeAuthorization)((effect, { rpc }) => {
+  Layer.succeed(RpcScopeAuthorization)((effect, { rpc, payload }) => {
-    const requiredScope = requiredScopeForRpcMethod(rpc._tag);
+    const requiredScopes =
-    return scopes.includes(requiredScope)
+      rpc._tag === WS_METHODS.serverUpdateSettings
-      ? effect
+        ? requiredScopesForSettingsUpdate(payload)
-      : Effect.fail(rpcAuthorizationError(requiredScope));
+        : [requiredScopeForRpcMethod(rpc._tag)];
+    const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
+    return requiredScope === undefined ? effect : Effect.fail(rpcAuthorizationError(requiredScope));
   });
 /** Retrying can install or restart tools even though ordinary listing is readable. */

apps/server/src/auth/SessionStore.test.ts+2-8

 @@ -1,5 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { EnvironmentId } from "@t3tools/contracts";
+import { AuthStandardClientScopes, EnvironmentId } from "@t3tools/contracts";
 import { expect, it } from "@effect/vitest";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 @@ -346,13 +346,7 @@ it.layer(NodeServices.layer)("SessionStore.layer", (it) => {
       expect(verified.method).toBe("bearer-access-token");
       expect(verified.subject).toBe("test-clock");
-      expect(verified.scopes).toEqual([
+      expect(verified.scopes).toEqual(AuthStandardClientScopes);
-        "orchestration:read",
-        "orchestration:operate",
-        "terminal:operate",
-        "review:write",
-        "relay:read",
-      ]);
     }).pipe(Effect.provide(Layer.merge(layerSessionStore(), TestClock.layer()))),
   );

apps/server/src/auth/http.ts+6

 @@ -2,6 +2,9 @@ import {
   AuthAccessReadScope,
   AuthAccessWriteScope,
   AuthStandardClientScopes,
+  AuthSettingsWriteScope,
+  AuthProvidersManageScope,
+  AuthEnvironmentMaintainScope,
   AuthOrchestrationOperateScope,
   AuthOrchestrationReadScope,
   AuthRelayReadScope,
 @@ -366,6 +369,9 @@ export const layer = HttpApiBuilder.group(
                     allowedScopes: new Set<AuthEnvironmentScope>([
                       AuthOrchestrationReadScope,
                       AuthOrchestrationOperateScope,
+                      AuthSettingsWriteScope,
+                      AuthProvidersManageScope,
+                      AuthEnvironmentMaintainScope,
                       AuthTerminalOperateScope,
                       AuthReviewWriteScope,
                       AuthAccessReadScope,

apps/server/src/observability/RpcInstrumentation.test.ts+2-2

...	@@ -1,6 +1,6 @@	...	@@ -1,6 +1,6 @@
1	import { assert, describe, it } from "@effect/vitest";	1	import { assert, describe, it } from "@effect/vitest";
2	import {	2	import {
3	AuthOrchestrationOperateScope,	3	AuthEnvironmentMaintainScope,
4	AuthOrchestrationReadScope,	4	AuthOrchestrationReadScope,
5	type AuthEnvironmentScope,	5	type AuthEnvironmentScope,
6	ScheduledTaskError,	6	ScheduledTaskError,
...	@@ -319,7 +319,7 @@ describe("WS RPC instrumentation middleware", () => {	...	@@ -319,7 +319,7 @@ describe("WS RPC instrumentation middleware", () => {
319	message: Option.none(),	319	message: Option.none(),
320	}).pipe(Effect.withSpan("signalProcess.child")),	320	}).pipe(Effect.withSpan("signalProcess.child")),
321	),	321	),
322	connectionMiddleware([AuthOrchestrationReadScope, AuthOrchestrationOperateScope]),	322	connectionMiddleware([AuthOrchestrationReadScope, AuthEnvironmentMaintainScope]),
323	),	323	),
324	),	324	),
325	);	325	);

apps/server/src/provider/ProviderRegistry.test.ts+93-1

...	@@ -2,7 +2,7 @@ import * as ServerSecretStore from "../auth/ServerSecretStore.ts";	...	@@ -2,7 +2,7 @@ import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
2	import * as CodexInstallation from "./CodexInstallation.ts";	2	import * as CodexInstallation from "./CodexInstallation.ts";
3	import * as ServerEnvironment from "../environment/ServerEnvironment.ts";	3	import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
4	import * as NodeServices from "@effect/platform-node/NodeServices";	4	import * as NodeServices from "@effect/platform-node/NodeServices";
5	import { describe, it, assert } from "@effect/vitest";	5	import { describe, it, assert, expect } from "@effect/vitest";
6	import * as DateTime from "effect/DateTime";	6	import * as DateTime from "effect/DateTime";
7	import * as Deferred from "effect/Deferred";	7	import * as Deferred from "effect/Deferred";
8	import * as Effect from "effect/Effect";	8	import * as Effect from "effect/Effect";
...	@@ -2077,6 +2077,98 @@ it.layer(	...	@@ -2077,6 +2077,98 @@ it.layer(
2077	]);	2077	]);
2078	});	2078	});
2079		2079
		2080	it.effect("shares one in-flight pass between concurrent untargeted refreshes", () =>
		2081	Effect.gen(function* () {
		2082	const driver = ProviderDriverKind.make("codex");
		2083	const instanceId = ProviderInstanceId.make("codex");
		2084	const provider = {
		2085	instanceId,
		2086	driver,
		2087	status: "ready",
		2088	enabled: true,
		2089	installed: true,
		2090	auth: { status: "authenticated" },
		2091	checkedAt: "2026-06-10T00:00:00.000Z",
		2092	version: "1.0.0",
		2093	models: [],
		2094	slashCommands: [],
		2095	skills: [],
		2096	} as const satisfies ServerProvider;
		2097	const refreshCalls = yield* Ref.make(0);
		2098	const probeStarted = yield* Deferred.make<void>();
		2099	const releaseProbe = yield* Deferred.make<void>();
		2100	const instances = [
		2101	{
		2102	instanceId,
		2103	driverKind: driver,
		2104	continuationIdentity: { driverKind: driver, continuationKey: "codex:instance:codex" },
		2105	displayName: undefined,
		2106	enabled: true,
		2107	snapshot: {
		2108	resolveMaintenance: () =>
		2109	Effect.succeed(
		2110	makeManualOnlyProviderMaintenanceCapabilities({
		2111	provider: driver,
		2112	packageName: null,
		2113	}),
		2114	),
		2115	getSnapshot: Effect.succeed(provider),
		2116	refresh: Effect.gen(function* () {
		2117	yield* Ref.update(refreshCalls, (count) => count + 1);
		2118	yield* Deferred.succeed(probeStarted, undefined);
		2119	yield* Deferred.await(releaseProbe);
		2120	return provider;
		2121	}),
		2122	streamChanges: Stream.empty,
		2123	applyUsageLimits: () => Effect.void,
		2124	},
		2125	orchestrationAdapter: {} as ProviderInstance["orchestrationAdapter"],
		2126	textGeneration: {} as ProviderInstance["textGeneration"],
		2127	},
		2128	] satisfies ReadonlyArray<ProviderInstance>;
		2129	const instanceRegistryLayer = Layer.succeed(
		2130	ProviderInstanceRegistry.ProviderInstanceRegistry,
		2131	{
		2132	getInstance: (requestedId) =>
		2133	Effect.succeed(instances.find((instance) => instance.instanceId === requestedId)),
		2134	listInstances: Effect.succeed(instances),
		2135	listUnavailable: Effect.succeed([]),
		2136	streamChanges: Stream.empty,
		2137	subscribeChanges: Effect.flatMap(PubSub.unbounded<void>(), PubSub.subscribe),
		2138	},
		2139	);
		2140	const scope = yield* Scope.make();
		2141	yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
		2142	const runtimeServices = yield* Layer.build(
		2143	ProviderRegistry.layer.pipe(
		2144	Layer.provideMerge(instanceRegistryLayer),
		2145	Layer.provideMerge(
		2146	ServerConfig.layerTest(process.cwd(), {
		2147	prefix: "t3-provider-registry-shared-refresh-",
		2148	}),
		2149	),
		2150	Layer.provideMerge(NodeServices.layer),
		2151	),
		2152	).pipe(Scope.provide(scope));
		2153
		2154	yield* Effect.gen(function* () {
		2155	const registry = yield* ProviderRegistry.ProviderRegistry;
		2156	const first = yield* registry.refresh().pipe(Effect.forkChild);
		2157	yield* Deferred.await(probeStarted);
		2158	const second = yield* registry.refresh().pipe(Effect.forkChild);
		2159	yield* Effect.yieldNow;
		2160	assert.strictEqual(yield* Ref.get(refreshCalls), 1);
		2161	yield* Deferred.succeed(releaseProbe, undefined);
		2162	expect(yield* Fiber.join(first)).toEqual([expect.objectContaining(provider)]);
		2163	expect(yield* Fiber.join(second)).toEqual([expect.objectContaining(provider)]);
		2164	assert.strictEqual(yield* Ref.get(refreshCalls), 1);
		2165
		2166	yield* registry.refresh();
		2167	assert.strictEqual(yield* Ref.get(refreshCalls), 2);
		2168	}).pipe(Effect.provide(runtimeServices));
		2169	}),
		2170	);
		2171
2080	it.effect("persists the merged snapshot when a live update has empty models", () =>	2172	it.effect("persists the merged snapshot when a live update has empty models", () =>
2081	Effect.gen(function* () {	2173	Effect.gen(function* () {
2082	const cursorDriver = ProviderDriverKind.make("cursor");	2174	const cursorDriver = ProviderDriverKind.make("cursor");

apps/server/src/provider/ProviderRegistry.ts+45-5

...	@@ -36,10 +36,12 @@ import {	...	@@ -36,10 +36,12 @@ import {
36	} from "@t3tools/contracts";	36	} from "@t3tools/contracts";
37	import * as Cause from "effect/Cause";	37	import * as Cause from "effect/Cause";
38	import * as Context from "effect/Context";	38	import * as Context from "effect/Context";
		39	import * as Deferred from "effect/Deferred";
39	import * as Effect from "effect/Effect";	40	import * as Effect from "effect/Effect";
40	import * as Equal from "effect/Equal";	41	import * as Equal from "effect/Equal";
41	import * as FileSystem from "effect/FileSystem";	42	import * as FileSystem from "effect/FileSystem";
42	import * as Layer from "effect/Layer";	43	import * as Layer from "effect/Layer";
		44	import * as Option from "effect/Option";
43	import * as Path from "effect/Path";	45	import * as Path from "effect/Path";
44	import * as PubSub from "effect/PubSub";	46	import * as PubSub from "effect/PubSub";
45	import * as Ref from "effect/Ref";	47	import * as Ref from "effect/Ref";
...	@@ -701,12 +703,50 @@ export const layer = Layer.effect(	...	@@ -701,12 +703,50 @@ export const layer = Layer.effect(
701	);	703	);
702	});	704	});
703		705
		706	type RefreshAllCompletion = Deferred.Deferred<ReadonlyArray<ServerProvider>>;
		707	const refreshAllInFlightRef = yield* Ref.make<Option.Option<RefreshAllCompletion>>(
		708	Option.none(),
		709	);
		710
		711	// Untargeted refreshes probe every live source, so any read-scoped client
		712	// can request them. Concurrent callers share one in-flight pass instead of
		713	// each starting their own set of provider processes.
704	const refreshAll = Effect.fn("refreshAll")(function* () {	714	const refreshAll = Effect.fn("refreshAll")(function* () {
705	const sources = yield* getLiveSources;	715	const claimed = yield* Ref.modify(
706	return yield* Effect.forEach(sources, (source) => refreshOneSource(source), {	716	refreshAllInFlightRef,
707	concurrency: "unbounded",	717	(
708	discard: true,	718	inFlight,
709	}).pipe(Effect.andThen(Ref.get(providersRef)));	719	): readonly [
		720	{ readonly owner: boolean; readonly completion: RefreshAllCompletion },
		721	Option.Option<RefreshAllCompletion>,
		722	] => {
		723	if (Option.isSome(inFlight)) {
		724	return [{ owner: false, completion: inFlight.value }, inFlight];
		725	}
		726	const completion = Deferred.makeUnsafe<ReadonlyArray<ServerProvider>>();
		727	return [{ owner: true, completion }, Option.some(completion)];
		728	},
		729	);
		730	if (claimed.owner) {
		731	// Detached so an interrupted first caller cannot cancel the pass that
		732	// other callers are already awaiting.
		733	yield* getLiveSources.pipe(
		734	Effect.flatMap((sources) =>
		735	Effect.forEach(sources, (source) => refreshOneSource(source), {
		736	concurrency: "unbounded",
		737	discard: true,
		738	}),
		739	),
		740	Effect.andThen(Ref.get(providersRef)),
		741	Effect.onExit((exit) =>
		742	Ref.set(refreshAllInFlightRef, Option.none()).pipe(
		743	Effect.andThen(Deferred.done(claimed.completion, exit)),
		744	),
		745	),
		746	Effect.forkDetach,
		747	);
		748	}
		749	return yield* Deferred.await(claimed.completion);
710	});	750	});
711		751
712	const refresh = Effect.fn("refresh")(function* (provider?: ProviderDriverKind) {	752	const refresh = Effect.fn("refresh")(function* (provider?: ProviderDriverKind) {

apps/server/src/serverSettings.test.ts+85

...	@@ -686,6 +686,91 @@ it.layer(NodeServices.layer)("server settings", (it) => {	...	@@ -686,6 +686,91 @@ it.layer(NodeServices.layer)("server settings", (it) => {
686	}).pipe(Effect.provide(layerServerSettings())),	686	}).pipe(Effect.provide(layerServerSettings())),
687	);	687	);
688		688
		689	// Only driver-keyed instances are fallback candidates; a custom instance id
		690	// is not one, so the selection stays put until the user changes it.
		691	it.effect.each(["codex"])(
		692	"falls back to enabled instance %s after disabling the selection",
		693	(fallbackId) =>
		694	Effect.scoped(
		695	Effect.gen(function* () {
		696	const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
		697	const serverConfig = yield* ServerConfig.ServerConfig;
		698	const fileSystem = yield* FileSystem.FileSystem;
		699	const writerId = ProviderInstanceId.make("writer");
		700	const fallbackInstanceId = ProviderInstanceId.make(fallbackId);
		701	const selection = { instanceId: writerId, model: "claude-sonnet-4-6" };
		702	const providerInstances = {
		703	[fallbackInstanceId]: {
		704	driver: ProviderDriverKind.make("codex"),
		705	enabled: true,
		706	config: {},
		707	},
		708	[writerId]: {
		709	driver: ProviderDriverKind.make("claudeAgent"),
		710	enabled: true,
		711	config: {},
		712	},
		713	};
		714
		715	yield* serverSettings.updateSettings({
		716	providers: Object.fromEntries(
		717	Object.keys(DEFAULT_SERVER_SETTINGS.providers).map(
		718	(provider) => [provider, { enabled: false }] as const,
		719	),
		720	),
		721	providerInstances,
		722	textGenerationModelSelection: selection,
		723	});
		724	const changes = yield* serverSettings.subscribeChanges;
		725
		726	const next = yield* serverSettings.updateSettings({
		727	providerInstances: {
		728	...providerInstances,
		729	[writerId]: { ...providerInstances[writerId]!, enabled: false },
		730	},
		731	});
		732	const fallbackSelection = {
		733	instanceId: fallbackInstanceId,
		734	model: DEFAULT_SERVER_SETTINGS.textGenerationModelSelection.model,
		735	};
		736	assert.deepEqual(next.textGenerationModelSelection, fallbackSelection);
		737	assert.deepEqual(
		738	(yield* serverSettings.getSettings).textGenerationModelSelection,
		739	fallbackSelection,
		740	);
		741	const change = Option.getOrUndefined(yield* Stream.runHead(changes));
		742	assert.deepEqual(change?.textGenerationModelSelection, fallbackSelection);
		743
		744	const persisted = yield* fileSystem
		745	.readFileString(serverConfig.settingsPath)
		746	.pipe(
		747	Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(ServerSettings))),
		748	);
		749	assert.deepEqual(persisted.textGenerationModelSelection, selection);
		750
		751	const restored = yield* serverSettings.updateSettings({ providerInstances });
		752	assert.deepEqual(restored.textGenerationModelSelection, selection);
		753	}),
		754	).pipe(Effect.provide(layerServerSettings())),
		755	);
		756
		757	it.effect("skips explicitly disabled instances when choosing a legacy fallback", () =>
		758	Effect.gen(function* () {
		759	const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
		760	const next = yield* serverSettings.updateSettings({
		761	providerInstances: {
		762	[ProviderInstanceId.make("codex")]: {
		763	driver: ProviderDriverKind.make("codex"),
		764	enabled: false,
		765	config: {},
		766	},
		767	},
		768	});
		769
		770	assert.equal(next.textGenerationModelSelection.instanceId, "claudeAgent");
		771	}).pipe(Effect.provide(layerServerSettings())),
		772	);
		773
689	it.effect("preserves enabled text generation selections for non-built-in drivers", () =>	774	it.effect("preserves enabled text generation selections for non-built-in drivers", () =>
690	Effect.gen(function* () {	775	Effect.gen(function* () {
691	const serverSettings = yield* ServerSettingsModule.ServerSettingsService;	776	const serverSettings = yield* ServerSettingsModule.ServerSettingsService;

apps/web/src/cloud/primaryCloudLinkState.ts+20-4

 @@ -1,5 +1,9 @@
 import { useAtomValue } from "@effect/atom-react";
-import type { EnvironmentCloudLinkStateResult } from "@t3tools/contracts";
+import {
+  AuthRelayReadScope,
+  EnvironmentId,
+  type EnvironmentCloudLinkStateResult,
+} from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 @@ -12,6 +16,7 @@ import { useCallback, useMemo } from "react";
 import { usePrimaryEnvironment } from "../state/environments";
 import { runtime } from "../lib/runtime";
 import { appAtomRegistry } from "../rpc/atomRegistry";
+import { readEnvironmentScope, useEnvironmentScope } from "../state/session";
 import { readPrimaryCloudLinkState, type CloudLinkTarget } from "./linkEnvironment";
 import { hasCloudPublicConfig } from "./publicConfig";
 @@ -44,13 +49,24 @@ function targetKey(target: CloudLinkTarget): string {
 }
 function refreshPrimaryCloudLinkState(target: CloudLinkTarget | null): void {
-  if (target) {
+  if (
+    target &&
+    readEnvironmentScope(EnvironmentId.make(target.environmentId), AuthRelayReadScope)
+  ) {
     appAtomRegistry.refresh(primaryCloudLinkStateAtom(targetKey(target)));
   }
 }
+export function readCachedPrimaryCloudLinkState(target: CloudLinkTarget) {
+  if (!readEnvironmentScope(EnvironmentId.make(target.environmentId), AuthRelayReadScope))
+    return null;
+  const result = appAtomRegistry.get(primaryCloudLinkStateAtom(targetKey(target)));
+  return result._tag === "Success" ? result.value : null;
+}
 export function usePrimaryCloudLinkState() {
   const primary = usePrimaryEnvironment();
+  const canReadRelay = useEnvironmentScope(primary?.environmentId ?? null, AuthRelayReadScope);
   const target = useMemo(
     () =>
       primary?.entry.target._tag === "PrimaryConnectionTarget"
 @@ -65,7 +81,7 @@ export function usePrimaryCloudLinkState() {
   );
   // Builds without T3 Connect have no link to read; skip the request.
   const atom =
-    target && hasCloudPublicConfig()
+    target && hasCloudPublicConfig() && canReadRelay
       ? primaryCloudLinkStateAtom(targetKey(target))
       : EMPTY_PRIMARY_CLOUD_LINK_STATE_ATOM;
   const result = useAtomValue(atom);
 @@ -79,7 +95,7 @@ export function usePrimaryCloudLinkState() {
   }
   return {
-    data: Option.getOrNull(AsyncResult.value(result)),
+    data: result._tag === "Failure" ? null : Option.getOrNull(AsyncResult.value(result)),
     error,
     isPending: result.waiting,
     refresh,

apps/web/src/cloud/useCloudLinkController.test.tsx created+230

...	@@ -0,0 +1,230 @@
1	import {
2	AuthRelayReadScope,
3	AuthRelayWriteScope,
4	EnvironmentId,
5	type EnvironmentCloudLinkStateResult,
6	} from "@t3tools/contracts";
7	import { AsyncResult } from "effect/reactivity";
8	import { act, useLayoutEffect } from "react";
9	import { create, type ReactTestRenderer } from "react-test-renderer";
10	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
11
12	const testState = vi.hoisted(() => ({
13	scopes: new Set<string>(),
14	snapshot: null as EnvironmentCloudLinkStateResult \| null,
15	renderedSnapshot: null as EnvironmentCloudLinkStateResult \| null,
16	getToken: vi.fn<() => Promise<string \| null>>(),
17	link: vi.fn(),
18	unlink: vi.fn(),
19	preferences: vi.fn(),
20	refreshDiscovery: vi.fn(),
21	refreshLink: vi.fn(),
22	toast: vi.fn(),
23	}));
24
25	vi.mock("@clerk/react", () => ({
26	useAuth: () => ({ getToken: testState.getToken, isSignedIn: true }),
27	}));
28	vi.mock("../components/ui/toast", () => ({ toastManager: { add: testState.toast } }));
29	vi.mock("../state/relay", () => ({
30	relayEnvironmentDiscovery: { refresh: testState.refreshDiscovery },
31	}));
32	vi.mock("../state/session", () => ({
33	readEnvironmentScope: (_environmentId: string, scope: string) => testState.scopes.has(scope),
34	}));
35	vi.mock("../state/use-atom-command", () => ({ useAtomCommand: (command: unknown) => command }));
36	vi.mock("./linkEnvironmentAtoms", () => ({
37	linkPrimaryEnvironment: testState.link,
38	unlinkPrimaryEnvironment: testState.unlink,
39	updatePrimaryEnvironmentPreferences: testState.preferences,
40	}));
41	vi.mock("./primaryCloudLinkState", () => ({
42	readCachedPrimaryCloudLinkState: () => testState.snapshot,
43	usePrimaryCloudLinkState: () => ({
44	target,
45	data: testState.renderedSnapshot,
46	error: null,
47	isPending: false,
48	refresh: testState.refreshLink,
49	}),
50	}));
51	vi.mock("./publicConfig", () => ({ resolveRelayClerkTokenOptions: () => ({}) }));
52
53	import { useCloudLinkController, type CloudLinkDesiredState } from "./useCloudLinkController";
54
55	const target = {
56	environmentId: EnvironmentId.make("primary"),
57	label: "Primary",
58	httpBaseUrl: "http://localhost:3773",
59	wsBaseUrl: "ws://localhost:3773/ws",
60	};
61	const linkedState: EnvironmentCloudLinkStateResult = {
62	linked: true,
63	cloudUserId: "account-1",
64	relayUrl: "https://relay.example.com",
65	relayIssuer: "https://relay.example.com",
66	managedTunnelActive: true,
67	publishAgentActivity: false,
68	};
69
70	let renderer: ReactTestRenderer \| null = null;
71	let controller: ReturnType<typeof useCloudLinkController> \| null = null;
72
73	function ControllerProbe() {
74	const value = useCloudLinkController();
75	useLayoutEffect(() => {
76	controller = value;
77	});
78	return null;
79	}
80
81	async function mountController() {
82	await act(() => {
83	renderer = create(<ControllerProbe />);
84	});
85	}
86
87	async function reconcile(desired: CloudLinkDesiredState) {
88	let succeeded = false;
89	await act(async () => {
90	if (controller === null) throw new Error("Controller is not mounted.");
91	succeeded = await controller.reconcileCloudState(desired);
92	});
93	return succeeded;
94	}
95
96	function expectNoMutations() {
97	expect(testState.link).not.toHaveBeenCalled();
98	expect(testState.unlink).not.toHaveBeenCalled();
99	expect(testState.preferences).not.toHaveBeenCalled();
100	}
101
102	beforeEach(() => {
103	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
104	vi.spyOn(console, "error").mockImplementation(() => undefined);
105	testState.scopes = new Set([AuthRelayReadScope, AuthRelayWriteScope]);
106	testState.snapshot = linkedState;
107	testState.renderedSnapshot = linkedState;
108	testState.getToken.mockReset().mockResolvedValue("clerk-token");
109	for (const command of [
110	testState.link,
111	testState.unlink,
112	testState.preferences,
113	testState.refreshDiscovery,
114	]) {
115	command.mockReset().mockResolvedValue(AsyncResult.success({}));
116	}
117	testState.refreshLink.mockReset();
118	testState.toast.mockReset();
119	});
120
121	afterEach(async () => {
122	await act(() => renderer?.unmount());
123	renderer = null;
124	controller = null;
125	vi.restoreAllMocks();
126	vi.unstubAllGlobals();
127	});
128
129	describe("useCloudLinkController", () => {
130	it.each([AuthRelayReadScope, AuthRelayWriteScope])(
131	"does not mutate without %s, even with a cached link snapshot",
132	async (scope) => {
133	await mountController();
134	testState.scopes.delete(scope);
135
136	expect(await reconcile({ managedTunnel: true, publish: true })).toBe(false);
137	expect(testState.getToken).not.toHaveBeenCalled();
138	expectNoMutations();
139	},
140	);
141
142	it("does not interpret unavailable link state as an unlinked environment", async () => {
143	testState.snapshot = null;
144	await mountController();
145
146	expect(await reconcile({ managedTunnel: false, publish: true })).toBe(false);
147	expect(testState.getToken).not.toHaveBeenCalled();
148	expectNoMutations();
149	});
150
151	it.each([AuthRelayReadScope, AuthRelayWriteScope])(
152	"rechecks %s after requesting the cloud token",
153	async (scope) => {
154	await mountController();
155	testState.getToken.mockImplementationOnce(async () => {
156	testState.scopes.delete(scope);
157	return "clerk-token";
158	});
159
160	expect(await reconcile({ managedTunnel: false, publish: false })).toBe(false);
161	expectNoMutations();
162	},
163	);
164
165	it("stops if the link-state read fails while requesting the cloud token", async () => {
166	await mountController();
167	testState.getToken.mockImplementationOnce(async () => {
168	testState.snapshot = null;
169	return "clerk-token";
170	});
171
172	expect(await reconcile({ managedTunnel: true, publish: true })).toBe(false);
173	expectNoMutations();
174	});
175
176	it("uses the latest linked mode to change publishing without replacing the tunnel", async () => {
177	testState.snapshot = { ...linkedState, linked: false, managedTunnelActive: false };
178	testState.renderedSnapshot = testState.snapshot;
179	await mountController();
180	testState.getToken.mockImplementationOnce(async () => {
181	testState.snapshot = linkedState;
182	return "clerk-token";
183	});
184
185	expect(await reconcile({ managedTunnel: true, publish: true })).toBe(true);
186	expect(testState.link).not.toHaveBeenCalled();
187	expect(testState.unlink).not.toHaveBeenCalled();
188	expect(testState.preferences).toHaveBeenCalledExactlyOnceWith({
189	target,
190	publishAgentActivity: true,
191	});
192	});
193
194	it("stops the preference write if management permission is lost after linking", async () => {
195	await mountController();
196	testState.link.mockImplementationOnce(async () => {
197	testState.scopes.delete(AuthRelayWriteScope);
198	return AsyncResult.success({});
199	});
200
201	expect(await reconcile({ managedTunnel: false, publish: true })).toBe(false);
202	expect(testState.link).toHaveBeenCalledOnce();
203	expect(testState.preferences).not.toHaveBeenCalled();
204	expect(testState.refreshLink).toHaveBeenCalledOnce();
205	});
206
207	it("still lets an authorized user unlink when the cloud token is unavailable", async () => {
208	await mountController();
209	testState.getToken.mockRejectedValueOnce(new Error("Cloud sign-in unavailable"));
210
211	expect(await reconcile({ managedTunnel: false, publish: false })).toBe(true);
212	expect(testState.unlink).toHaveBeenCalledExactlyOnceWith({ target, clerkToken: null });
213	expect(testState.link).not.toHaveBeenCalled();
214	expect(testState.preferences).not.toHaveBeenCalled();
215	});
216
217	it("unlinks if the link-state read fails while requesting the cloud token", async () => {
218	await mountController();
219	testState.getToken.mockImplementationOnce(async () => {
220	testState.snapshot = null;
221	throw new Error("Cloud sign-in unavailable");
222	});
223
224	expect(await reconcile({ managedTunnel: false, publish: false })).toBe(true);
225	expect(testState.unlink).toHaveBeenCalledExactlyOnceWith({ target, clerkToken: null });
226	expect(testState.link).not.toHaveBeenCalled();
227	expect(testState.preferences).not.toHaveBeenCalled();
228	expect(testState.refreshLink).toHaveBeenCalledOnce();
229	});
230	});

apps/web/src/cloud/useCloudLinkController.ts+35-3

 @@ -1,5 +1,6 @@
 import { useAuth } from "@clerk/react";
 import { findErrorTraceId } from "@t3tools/client-runtime/errors";
+import { EnvironmentId, AuthRelayReadScope, AuthRelayWriteScope } from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
   settlePromise,
 @@ -9,13 +10,14 @@ import { useState } from "react";
 import { toastManager } from "../components/ui/toast";
 import { relayEnvironmentDiscovery } from "../state/relay";
+import { readEnvironmentScope } from "../state/session";
 import { useAtomCommand } from "../state/use-atom-command";
 import {
   linkPrimaryEnvironment as linkPrimaryEnvironmentAtom,
   unlinkPrimaryEnvironment as unlinkPrimaryEnvironmentAtom,
   updatePrimaryEnvironmentPreferences as updatePrimaryEnvironmentPreferencesAtom,
 } from "./linkEnvironmentAtoms";
-import { usePrimaryCloudLinkState } from "./primaryCloudLinkState";
+import { readCachedPrimaryCloudLinkState, usePrimaryCloudLinkState } from "./primaryCloudLinkState";
 import { resolveRelayClerkTokenOptions } from "./publicConfig";
 export interface CloudLinkDesiredState {
 @@ -87,8 +89,31 @@ export function useCloudLinkController() {
       reportUpdateFailure(new Error("Local environment is not ready yet."));
       return false;
     }
-    const tokenResult = await settlePromise(() => getToken(resolveRelayClerkTokenOptions()));
+    const environmentId = EnvironmentId.make(target.environmentId);
+    const canManageLink = () => {
+      if (
+        !readEnvironmentScope(environmentId, AuthRelayReadScope) ||
+        !readEnvironmentScope(environmentId, AuthRelayWriteScope)
+      ) {
+        reportUpdateFailure(
+          new Error("This connection needs permission to view and manage T3 Connect settings."),
+        );
+        return false;
+      }
+      return true;
+    };
+    const readLinkState = () => {
+      const state = readCachedPrimaryCloudLinkState(target);
+      if (state === null) {
+        reportUpdateFailure(new Error("Wait until the current T3 Connect settings can be read."));
+      }
+      return state;
+    };
+    if (!canManageLink()) return false;
     const wantsLink = desired.managedTunnel || desired.publish;
+    if (wantsLink && readLinkState() === null) return false;
+    const tokenResult = await settlePromise(() => getToken(resolveRelayClerkTokenOptions()));
+    if (!canManageLink()) return false;
     // A failure after this point may follow a partially applied mutation (e.g.
     // the link succeeded but the preference update did not), so every exit —
 @@ -109,6 +134,8 @@ export function useCloudLinkController() {
         return false;
       }
     } else {
+      const currentLinkState = readLinkState();
+      if (currentLinkState === null) return false;
       if (tokenResult._tag === "Failure") {
         reportUpdateFailure(squashAtomCommandFailure(tokenResult));
         return false;
 @@ -118,7 +145,8 @@ export function useCloudLinkController() {
         reportUpdateFailure(new Error("Sign in to T3 Connect before enabling this."));
         return false;
       }
-      if (!linked || managedTunnelActive !== desired.managedTunnel) {
+      const currentManagedTunnel = currentLinkState.managedTunnelActive ?? currentLinkState.linked;
+      if (!currentLinkState.linked || currentManagedTunnel !== desired.managedTunnel) {
         const linkResult = await linkPrimaryEnvironment({
           target,
           clerkToken,
 @@ -132,6 +160,10 @@ export function useCloudLinkController() {
           return false;
         }
       }
+      if (!canManageLink() || readLinkState() === null) {
+        primaryCloudLinkState.refresh();
+        return false;
+      }
       const prefResult = await updatePrimaryEnvironmentPreferences({
         target,
         publishAgentActivity: desired.publish,

apps/web/src/components/ChatMarkdown.permissions.test.tsx created+299

...	@@ -0,0 +1,299 @@
1	import {
2	AuthOrchestrationOperateScope,
3	EnvironmentId,
4	ProjectId,
5	ThreadId,
6	type AuthEnvironmentScope,
7	type EditorId,
8	type ThreadLinkedPullRequest,
9	} from "@t3tools/contracts";
10	import { DEFAULT_CLIENT_SETTINGS } from "@t3tools/contracts/settings";
11	import { AsyncResult } from "effect/reactivity";
12	import { cloneElement, type ReactElement, type ReactNode } from "react";
13	import { act, create, type ReactTestRenderer } from "react-test-renderer";
14	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
15
16	const state = vi.hoisted(() => ({
17	allowed: true,
18	listeners: new Set<() => void>(),
19	openEditor: vi.fn(),
20	updateMetadata: vi.fn(),
21	search: vi.fn(),
22	choose: vi.fn(),
23	openFile: vi.fn(),
24	openExternal: vi.fn(),
25	copy: vi.fn(),
26	toast: vi.fn(),
27	linkedPullRequest: null as ThreadLinkedPullRequest \| null,
28	}));
29
30	vi.mock("@effect/atom-react", () => ({ useAtomValue: () => serverConfig }));
31	vi.mock("../hooks/useTheme", () => ({ useTheme: () => ({ resolvedTheme: "dark" }) }));
32	vi.mock("../hooks/useSettings", () => ({
33	getClientSettings: () => DEFAULT_CLIENT_SETTINGS,
34	useClientSettings: (select?: (value: typeof DEFAULT_CLIENT_SETTINGS) => unknown) =>
35	select ? select(DEFAULT_CLIENT_SETTINGS) : DEFAULT_CLIENT_SETTINGS,
36	}));
37	vi.mock("./ui/tooltip", () => ({
38	Tooltip: ({ children }: { children: ReactNode }) => children,
39	TooltipTrigger: ({ render, children }: { render: ReactElement; children?: ReactNode }) =>
40	children === undefined ? render : cloneElement(render, undefined, children),
41	TooltipPopup: () => null,
42	}));
43	vi.mock("./chat/PierreEntryIcon", () => ({ PierreEntryIcon: () => null }));
44	vi.mock("./ui/toast", () => ({
45	toastManager: { add: state.toast },
46	stackedThreadToast: (value: unknown) => value,
47	}));
48	vi.mock("../state/use-atom-query-runner", () => ({ useAtomQueryRunner: () => state.search }));
49	vi.mock("../state/use-atom-command", () => ({
50	useAtomCommand: (command: string) =>
51	command === "updateMetadata" ? state.updateMetadata : state.openEditor,
52	}));
53	vi.mock("../state/session", async () => {
54	const { useSyncExternalStore } = await import("react");
55	const readEnvironmentScope = (id: EnvironmentId \| null, scope: AuthEnvironmentScope) =>
56	id !== null &&
57	(scope !== AuthOrchestrationOperateScope \|\| id !== threadRef.environmentId \|\| state.allowed);
58	return {
59	// Asset atoms read these at module scope; the markdown tests only exercise
60	// the task grant.
61	environmentSession: {
62	sessionStateAtom: () => ({}),
63	preparedConnectionValueAtom: () => ({}),
64	},
65	readEnvironmentScope,
66	useEnvironmentScope: (id: EnvironmentId \| null, scope: AuthEnvironmentScope) =>
67	useSyncExternalStore(
68	(listener) => {
69	state.listeners.add(listener);
70	return () => state.listeners.delete(listener);
71	},
72	() => readEnvironmentScope(id, scope),
73	),
74	usePreparedConnection: () => ({ _tag: "None" }),
75	};
76	});
77	vi.mock("../state/server", () => ({
78	serverEnvironment: { configValueAtom: () => "config" },
79	}));
80	vi.mock("../state/threads", () => ({
81	threadEnvironment: { updateMetadata: "updateMetadata" },
82	}));
83	vi.mock("../state/entities", () => ({
84	readEnvironmentSupportsServerBrowser: () => false,
85	useServerConfigs: () => new Map([[threadRef.environmentId, serverConfig]]),
86	readThreadShell: () => ({ linkedPullRequest: state.linkedPullRequest }),
87	useProjects: () => [{ id: linkedPullRequest.projectId, environmentId: threadRef.environmentId }],
88	}));
89	vi.mock("../rightPanelStore", () => ({
90	useRightPanelStore: { getState: () => ({ openFile: state.openFile }) },
91	}));
92	vi.mock("../remoteOpen", () => ({
93	useRemoteOpenResolution: () => ({ state: { mode: "local-exec" }, isResolved: true }),
94	}));
95	vi.mock("../hooks/useLocalStorage", () => ({
96	useLocalStorage: () => ["vscode", vi.fn()],
97	getLocalStorageItem: () => "vscode",
98	setLocalStorageItem: vi.fn(),
99	}));
100	vi.mock("../hooks/useCopyToClipboard", () => ({
101	writeTextToClipboard: state.copy,
102	useCopyToClipboard: () => ({ copyToClipboard: state.copy, isCopied: false }),
103	}));
104	vi.mock("../localApi", () => ({
105	readLocalApi: () => ({
106	contextMenu: { show: state.choose },
107	shell: { openExternal: state.openExternal },
108	}),
109	}));
110	vi.mock("~/lib/openPullRequestLink", () => ({
111	resolvePullRequestPreviewTarget: () => null,
112	findProjectForChangeRequest: (projects: readonly { id: ProjectId }[]) => projects[0],
113	matchesLinkedPullRequestUrl: (candidate: ThreadLinkedPullRequest, href: string) =>
114	candidate.url === href,
115	parseChangeRequestUrl: (href: string) =>
116	href === linkedPullRequest.url
117	? {
118	host: "github.com",
119	repository: linkedPullRequest.repository,
120	number: linkedPullRequest.number,
121	}
122	: null,
123	useOpenChangeRequestLink: () => vi.fn(),
124	}));
125
126	import ChatMarkdown from "./ChatMarkdown";
127
128	const threadRef = {
129	environmentId: EnvironmentId.make("selected"),
130	threadId: ThreadId.make("thread"),
131	};
132	const linkedPullRequest: ThreadLinkedPullRequest = {
133	projectId: ProjectId.make("project"),
134	repository: "example/repo",
135	number: 42,
136	url: "https://github.com/example/repo/pull/42",
137	};
138	const serverConfig = {
139	availableEditors: ["vscode", "file-manager"] as readonly EditorId[],
140	shellRevealInFileManager: true,
141	shellRevealInFileManagerKind: "xdg-open",
142	environment: { platform: { os: "linux" }, capabilities: { threadPullRequestLinking: true } },
143	};
144	let renderer: ReactTestRenderer \| undefined;
145
146	beforeEach(() => {
147	state.allowed = true;
148	state.listeners.clear();
149	state.linkedPullRequest = null;
150	state.openEditor.mockReset().mockResolvedValue(AsyncResult.success(undefined));
151	state.updateMetadata.mockReset().mockResolvedValue(AsyncResult.success(undefined));
152	state.search.mockReset().mockResolvedValue(AsyncResult.success({ entries: [] }));
153	state.choose.mockReset().mockResolvedValue(null);
154	state.openFile.mockReset();
155	state.openExternal.mockReset().mockResolvedValue(undefined);
156	state.copy.mockReset().mockResolvedValue(undefined);
157	state.toast.mockReset();
158	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
159	vi.stubGlobal("window", {});
160	vi.stubGlobal("navigator", { clipboard: { writeText: state.copy } });
161	});
162
163	afterEach(async () => {
164	await act(async () => renderer?.unmount());
165	renderer = undefined;
166	vi.unstubAllGlobals();
167	});
168
169	async function renderMarkdown(text: string) {
170	await act(async () => {
171	renderer = create(<ChatMarkdown cwd="/work" threadRef={threadRef} text={text} />);
172	});
173	}
174
175	function menuEvent() {
176	return { preventDefault: vi.fn(), stopPropagation: vi.fn(), clientX: 10, clientY: 10 };
177	}
178
179	function anchor() {
180	return renderer!.root.findByType("a");
181	}
182
183	async function openContextMenu() {
184	await act(async () => anchor().props.onContextMenu(menuEvent()));
185	}
186
187	function offeredActions() {
188	return state.choose.mock.lastCall![0].map((item: { id: string }) => item.id);
189	}
190
191	it("removes host actions after revocation while keeping file preview and copying", async () => {
192	await renderMarkdown("[Readme](docs/readme.md)");
193	await openContextMenu();
194	expect(offeredActions()).toEqual(["open", "reveal", "copy-relative", "copy-full"]);
195	await act(async () => {
196	state.allowed = false;
197	for (const listener of state.listeners) listener();
198	});
199	state.choose.mockResolvedValue("copy-full");
200	await openContextMenu();
201	expect(offeredActions()).toEqual(["copy-relative", "copy-full"]);
202	expect(state.copy).toHaveBeenCalledWith("/work/docs/readme.md");
203	await act(async () => anchor().props.onClick(menuEvent()));
204	expect(state.openFile).toHaveBeenCalledWith(threadRef, "docs/readme.md", undefined);
205	expect(state.openEditor).not.toHaveBeenCalled();
206	});
207
208	it("does not launch an editor after revocation during a native context menu", async () => {
209	let choose: (action: string) => void = () => {
210	throw new Error("Menu not opened");
211	};
212	state.choose.mockImplementationOnce(
213	() =>
214	new Promise<string>((resolve) => {
215	choose = resolve;
216	}),
217	);
218	await renderMarkdown("[Readme](docs/readme.md)");
219	await openContextMenu();
220	expect(offeredActions()).toContain("open");
221	await act(async () => {
222	state.allowed = false;
223	choose("open");
224	});
225	expect(state.openEditor).not.toHaveBeenCalled();
226	});
227
228	it("does not reveal a file after revocation during its workspace lookup", async () => {
229	let finishLookup: () => void = () => {
230	throw new Error("Lookup not started");
231	};
232	state.search.mockImplementationOnce(
233	() =>
234	new Promise((resolve) => {
235	finishLookup = () => resolve(AsyncResult.success({ entries: [] }));
236	}),
237	);
238	state.choose.mockResolvedValue("reveal");
239	await renderMarkdown("[Readme](readme.md)");
240	await openContextMenu();
241	expect(state.search).toHaveBeenCalledOnce();
242	await act(async () => {
243	state.allowed = false;
244	finishLookup();
245	});
246	expect(state.openEditor).not.toHaveBeenCalled();
247	});
248
249	it.each([false, true])(
250	"keeps PR links usable without offering metadata edits (linked=%s)",
251	async (linked) => {
252	state.allowed = false;
253	state.linkedPullRequest = linked ? linkedPullRequest : null;
254	state.choose.mockResolvedValue("open-external");
255	await renderMarkdown(`[Review](${linkedPullRequest.url})`);
256	await openContextMenu();
257	expect(offeredActions()).toEqual(["open-external", "copy-link"]);
258	expect(state.openExternal).toHaveBeenCalledWith(linkedPullRequest.url);
259	expect(state.updateMetadata).not.toHaveBeenCalled();
260	},
261	);
262
263	it.each(["link-to-thread", "unlink-from-thread"])(
264	"rechecks %s after a native context menu returns",
265	async (action) => {
266	state.linkedPullRequest = action === "unlink-from-thread" ? linkedPullRequest : null;
267	let choose: (action: string) => void = () => {
268	throw new Error("Menu not opened");
269	};
270	state.choose.mockImplementationOnce(
271	() =>
272	new Promise<string>((resolve) => {
273	choose = resolve;
274	}),
275	);
276	await renderMarkdown(`[Review](${linkedPullRequest.url})`);
277	await openContextMenu();
278	expect(offeredActions()).toContain(action);
279	await act(async () => {
280	state.allowed = false;
281	choose(action);
282	});
283	expect(state.updateMetadata).not.toHaveBeenCalled();
284
285	await act(async () => {
286	state.allowed = true;
287	for (const listener of state.listeners) listener();
288	});
289	state.choose.mockResolvedValue(action);
290	await openContextMenu();
291	expect(state.updateMetadata).toHaveBeenCalledExactlyOnceWith({
292	environmentId: threadRef.environmentId,
293	input: {
294	threadId: threadRef.threadId,
295	linkedPullRequest: action === "link-to-thread" ? linkedPullRequest : null,
296	},
297	});
298	},
299	);

apps/web/src/components/ChatMarkdown.test.tsx+14-5

 @@ -1,6 +1,6 @@
 // @vitest-environment jsdom
-import { EnvironmentId } from "@t3tools/contracts";
+import { EnvironmentId, type AuthEnvironmentScope } from "@t3tools/contracts";
 import { act, type ComponentProps, type ReactNode } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { create, type ReactTestRenderer } from "react-test-renderer";
 @@ -38,10 +38,19 @@ vi.mock("./ui/tooltip", async () => {
 });
 vi.mock("../state/use-atom-query-runner", () => ({ useAtomQueryRunner: () => vi.fn() }));
 vi.mock("../state/use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));
-vi.mock("../state/session", async (importOriginal) => ({
+vi.mock("../state/session", async (importOriginal) => {
-  ...(await importOriginal<typeof import("../state/session")>()),
+  const actual = await importOriginal<typeof import("../state/session")>();
-  usePreparedConnection: () => ({ _tag: "Loading" }),
+  const { AuthStandardClientScopes } = await import("@t3tools/contracts");
-}));
+  const grantedScopes = new Set<AuthEnvironmentScope>(AuthStandardClientScopes);
+  const hasScope = (environmentId: EnvironmentId | null, scope: AuthEnvironmentScope) =>
+    environmentId !== null && grantedScopes.has(scope);
+  return {
+    ...actual,
+    useEnvironmentScope: hasScope,
+    readEnvironmentScope: hasScope,
+    usePreparedConnection: () => ({ _tag: "Loading" }),
+  };
+});
 vi.mock("../state/entities", () => ({
   readThreadShell: () => null,
   useProjects: () => [],

apps/web/src/components/ChatMarkdown.tsx+20-8

...	@@ -1,4 +1,5 @@	...	@@ -1,4 +1,5 @@
1	import { usePullRequestLinking } from "~/hooks/usePullRequestLinking";	1	import { usePullRequestLinking } from "~/hooks/usePullRequestLinking";
		2	import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
2	import { useAtomValue } from "@effect/atom-react";	3	import { useAtomValue } from "@effect/atom-react";
3	import {	4	import {
4	COMPOSER_CONTEXT_CLIPBOARD_MIME,	5	COMPOSER_CONTEXT_CLIPBOARD_MIME,
...	@@ -171,7 +172,7 @@ import { readThreadShell, useProjects } from "../state/entities";	...	@@ -171,7 +172,7 @@ import { readThreadShell, useProjects } from "../state/entities";
171	import { serverEnvironment } from "../state/server";	172	import { serverEnvironment } from "../state/server";
172	import { shellEnvironment } from "../state/shell";	173	import { shellEnvironment } from "../state/shell";
173	import { assetEnvironment } from "../state/assets";	174	import { assetEnvironment } from "../state/assets";
174	import { usePreparedConnection } from "../state/session";	175	import { readEnvironmentScope, usePreparedConnection, useEnvironmentScope } from "../state/session";
175	import { previewEnvironment } from "../state/preview";	176	import { previewEnvironment } from "../state/preview";
176	import { useAtomCommand } from "../state/use-atom-command";	177	import { useAtomCommand } from "../state/use-atom-command";
177	import { useAtomQueryRunner } from "../state/use-atom-query-runner";	178	import { useAtomQueryRunner } from "../state/use-atom-query-runner";
...	@@ -2516,12 +2517,11 @@ function useChatMarkdownState({	...	@@ -2516,12 +2517,11 @@ function useChatMarkdownState({
2516	});	2517	});
2517	const pullRequestLinking = usePullRequestLinking(threadRef?.environmentId);	2518	const pullRequestLinking = usePullRequestLinking(threadRef?.environmentId);
2518	const environmentId = threadRef?.environmentId ?? explicitEnvironmentId ?? null;	2519	const environmentId = threadRef?.environmentId ?? explicitEnvironmentId ?? null;
		2520	const canOperateHost = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
2519	const remoteOpen = useRemoteOpenResolution(environmentId);	2521	const remoteOpen = useRemoteOpenResolution(environmentId);
2520	const canUseShellActions = canUseMarkdownFileShellActions(	2522	const canUseShellActions =
2521	environmentId,	2523	canOperateHost &&
2522	remoteOpen.state.mode,	2524	canUseMarkdownFileShellActions(environmentId, remoteOpen.state.mode, remoteOpen.isResolved);
2523	remoteOpen.isResolved,
2524	);
2525	const preparedConnection = usePreparedConnection(environmentId);	2525	const preparedConnection = usePreparedConnection(environmentId);
2526	const openMarkdownMedia = useCallback(	2526	const openMarkdownMedia = useCallback(
2527	(source: string, resolvedFilePath?: string, clickedImage?: HTMLImageElement \| null) => {	2527	(source: string, resolvedFilePath?: string, clickedImage?: HTMLImageElement \| null) => {
...	@@ -2591,6 +2591,13 @@ function useChatMarkdownState({	...	@@ -2591,6 +2591,13 @@ function useChatMarkdownState({
2591	),	2591	),
2592	);	2592	);
2593	}	2593	}
		2594	if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) {
		2595	return Promise.resolve(
		2596	AsyncResult.failure<void, Error>(
		2597	Cause.fail(new Error("This connection cannot reveal files on this environment.")),
		2598	),
		2599	);
		2600	}
2594	return openInEditor({	2601	return openInEditor({
2595	environmentId,	2602	environmentId,
2596	input: { cwd: filePath, editor: "file-manager", reveal: true },	2603	input: { cwd: filePath, editor: "file-manager", reveal: true },
...	@@ -2687,6 +2694,7 @@ function useChatMarkdownState({	...	@@ -2687,6 +2694,7 @@ function useChatMarkdownState({
2687	const updateThreadPullRequestLink = useCallback(	2694	const updateThreadPullRequestLink = useCallback(
2688	async (href: string, linked: boolean) => {	2695	async (href: string, linked: boolean) => {
2689	if (threadRef === undefined \|\| (!linked && linkedThreadPullRequestFor(href) === null)) return;	2696	if (threadRef === undefined \|\| (!linked && linkedThreadPullRequestFor(href) === null)) return;
		2697	if (!readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope)) return;
2690	await pullRequestLinking.changeLink(threadRef, href, linked);	2698	await pullRequestLinking.changeLink(threadRef, href, linked);
2691	},	2699	},
2692	[linkedThreadPullRequestFor, pullRequestLinking, threadRef],	2700	[linkedThreadPullRequestFor, pullRequestLinking, threadRef],
...	@@ -2878,6 +2886,7 @@ function useChatMarkdownState({	...	@@ -2878,6 +2886,7 @@ function useChatMarkdownState({
2878		2886
2879	const componentState = useMemo(	2887	const componentState = useMemo(
2880	() => ({	2888	() => ({
		2889	canOperateHost,
2881	cwd,	2890	cwd,
2882	diffThemeName,	2891	diffThemeName,
2883	environmentId,	2892	environmentId,
...	@@ -2909,6 +2918,7 @@ function useChatMarkdownState({	...	@@ -2909,6 +2918,7 @@ function useChatMarkdownState({
2909	updateThreadPullRequestLink,	2918	updateThreadPullRequestLink,
2910	}),	2919	}),
2911	[	2920	[
		2921	canOperateHost,
2912	cwd,	2922	cwd,
2913	diffThemeName,	2923	diffThemeName,
2914	environmentId,	2924	environmentId,
...	@@ -3063,6 +3073,7 @@ const CHAT_MARKDOWN_COMPONENTS = {	...	@@ -3063,6 +3073,7 @@ const CHAT_MARKDOWN_COMPONENTS = {
3063	},	3073	},
3064	a: function MarkdownAnchor({ node, href, children, title: _title, ...props }) {	3074	a: function MarkdownAnchor({ node, href, children, title: _title, ...props }) {
3065	const {	3075	const {
		3076	canOperateHost,
3066	cwd,	3077	cwd,
3067	environmentId,	3078	environmentId,
3068	imageBaseDir,	3079	imageBaseDir,
...	@@ -3203,8 +3214,9 @@ const CHAT_MARKDOWN_COMPONENTS = {	...	@@ -3203,8 +3214,9 @@ const CHAT_MARKDOWN_COMPONENTS = {
3203	event.stopPropagation();	3214	event.stopPropagation();
3204	const api = readLocalApi();	3215	const api = readLocalApi();
3205	if (!api) return;	3216	if (!api) return;
3206	const threadLinkAction =	3217	const threadLinkAction = !canOperateHost
3207	linkedThreadPullRequestFor(href) !== null	3218	? undefined
		3219	: linkedThreadPullRequestFor(href) !== null
3208	? "unlink-from-thread"	3220	? "unlink-from-thread"
3209	: resolveThreadPullRequest(href) === null	3221	: resolveThreadPullRequest(href) === null
3210	? undefined	3222	? undefined

apps/web/src/components/ChatView.tsx+161-52

 @@ -48,12 +48,15 @@ import {
 } from "../questionAttachments";
 import { useAttachmentUploadStore } from "../lib/attachmentUploadQueue";
 import {
+  AuthOrchestrationOperateScope,
+  AuthSettingsWriteScope,
   type AssistantCitation,
   type ChatFileAttachment,
   CommandId,
   DEFAULT_MODEL,
   isProviderNativeSubagentThread,
   type ChatAttachment as ContractChatAttachment,
+  EnvironmentAuthorizationError,
   type EnvironmentId,
   type MessageId,
   type ModelSelection,
 @@ -285,9 +288,10 @@ import { DeviceSetup } from "./device/DeviceSetup";
 import { Dialog } from "./ui/dialog";
 import { WizardPopup } from "./ui/wizard";
 import { BranchToolbar, type BranchToolbarHandle } from "./BranchToolbar";
-import { resolveShortcutCommand, shortcutLabelForCommand } from "../keybindings";
 import { makeWorkspaceFileDropHandlers } from "./chat/workspaceFileDrop";
 import { isEditableFocused } from "../lib/editableFocus";
+import { DEFAULT_RESOLVED_KEYBINDINGS } from "@t3tools/shared/keybindings";
+import { resolveChatShortcutCommand, shortcutLabelForCommand } from "../keybindings";
 import ThreadTerminalDrawer from "./ThreadTerminalDrawer";
 import {
   AlarmClockIcon,
 @@ -555,8 +559,13 @@ import { clampFileAttachmentUploadBytes } from "@t3tools/client-runtime/state/at
 import { appAtomRegistry } from "../rpc/atomRegistry";
 import { fileAttachmentCapabilityBlockReason } from "./chat/composerAttachmentFiles";
 import { assetEnvironment } from "../state/assets";
-import { readPreparedConnection } from "../state/session";
+import {
+  readEnvironmentScope,
+  readPreparedConnection,
+  useEnvironmentScope,
+} from "../state/session";
 import { useAtomCommand } from "../state/use-atom-command";
+import { useOrchestrationCommand } from "../state/use-orchestration-command";
 import { useAtomQueryRunner } from "../state/use-atom-query-runner";
 import { Button, InlineButton } from "./ui/button";
 import {
 @@ -1535,6 +1544,7 @@ export default function ChatView(props: ChatViewProps) {
     reserveTitleBarControlInset = true,
     forceExpandedMobileComposer = false,
   } = props;
+  const canOperateThread = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
   const draftId = routeKind === "draft" ? props.draftId : null;
   const handleNewThread = useNewThreadHandler();
   const { settleThread, pinThread, confirmAndUnpinThread } = useThreadActions();
 @@ -1562,46 +1572,48 @@ export default function ChatView(props: ChatViewProps) {
   const openTerminal = useAtomCommand(terminalEnvironment.open, "terminal open");
   const writeTerminal = useAtomCommand(terminalEnvironment.write, "terminal write");
   const closeTerminalMutation = useAtomCommand(terminalEnvironment.close, "terminal close");
-  const createThread = useAtomCommand(threadEnvironment.create, { reportFailure: false });
+  const createThread = useOrchestrationCommand(threadEnvironment.create, { reportFailure: false });
-  const deleteThread = useAtomCommand(threadEnvironment.delete, { reportFailure: false });
+  const deleteThread = useOrchestrationCommand(threadEnvironment.delete, { reportFailure: false });
-  const updateThreadMetadata = useAtomCommand(threadEnvironment.updateMetadata, {
+  const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
     reportFailure: false,
   });
   const switchGitRef = useAtomCommand(vcsEnvironment.switchRef, { reportFailure: false });
-  const setThreadRuntimeMode = useAtomCommand(threadEnvironment.setRuntimeMode, {
+  const setThreadRuntimeMode = useOrchestrationCommand(threadEnvironment.setRuntimeMode, {
+    reportFailure: false,
+  });
+  const setThreadInteractionMode = useOrchestrationCommand(threadEnvironment.setInteractionMode, {
     reportFailure: false,
   });
-  const setThreadInteractionMode = useAtomCommand(threadEnvironment.setInteractionMode, {
+  const startThreadTurn = useOrchestrationCommand(threadEnvironment.startTurn, {
     reportFailure: false,
   });
-  const startThreadTurn = useAtomCommand(threadEnvironment.startTurn, { reportFailure: false });
+  const resumeThreadQueue = useOrchestrationCommand(threadEnvironment.resumeThreadQueue, {
-  const resumeThreadQueue = useAtomCommand(threadEnvironment.resumeThreadQueue, {
     reportFailure: false,
   });
-  const uploadThreadFeedback = useAtomCommand(threadEnvironment.uploadFeedback, {
+  const uploadThreadFeedback = useOrchestrationCommand(threadEnvironment.uploadFeedback, {
     reportFailure: false,
   });
   const createAttachmentAssetUrl = useAtomQueryRunner(assetEnvironment.createUrl, {
     reportFailure: false,
     refresh: true,
   });
-  const interruptThreadTurn = useAtomCommand(threadEnvironment.interruptTurn, {
+  const interruptThreadTurn = useOrchestrationCommand(threadEnvironment.interruptTurn, {
     reportFailure: false,
   });
   const loadEarlierThreadHistory = useAtomCommand(threadEnvironment.loadEarlierHistory, {
     label: "load earlier thread history",
     reportFailure: false,
   });
-  const respondToThreadApproval = useAtomCommand(threadEnvironment.respondToApproval, {
+  const respondToThreadApproval = useOrchestrationCommand(threadEnvironment.respondToApproval, {
     reportFailure: false,
   });
-  const respondToThreadUserInput = useAtomCommand(threadEnvironment.respondToUserInput, {
+  const respondToThreadUserInput = useOrchestrationCommand(threadEnvironment.respondToUserInput, {
     reportFailure: false,
   });
   const dismissThreadUserInput = useAtomCommand(threadEnvironment.dismissUserInput, {
     reportFailure: false,
   });
-  const revertThreadCheckpoint = useAtomCommand(threadEnvironment.revertCheckpoint, {
+  const revertThreadCheckpoint = useOrchestrationCommand(threadEnvironment.revertCheckpoint, {
     reportFailure: false,
   });
   const forkThreadFromRun = useAtomCommand(threadEnvironment.forkFromRun, {
 @@ -3228,6 +3240,7 @@ export default function ChatView(props: ChatViewProps) {
     providerStatuses.find((status) => status.instanceId === activeRuntime?.providerInstanceId) ??
     activeProviderStatus;
   const supportsConversationRollback =
+    canOperateThread &&
     conversationProviderStatus !== null &&
     conversationProviderStatus.supportsConversationRollback !== false;
   const phase = derivePhase(activeRuntime);
 @@ -4065,6 +4078,9 @@ export default function ChatView(props: ChatViewProps) {
     resourceKey: `git-status:${activeThreadKey ?? ""}:${gitStatusCwd ?? ""}`,
   });
   const keybindings = useAtomValue(primaryServerKeybindingsAtom);
+  const scriptKeybindings =
+    useAtomValue(serverEnvironment.configValueAtom(environmentId))?.keybindings ??
+    DEFAULT_RESOLVED_KEYBINDINGS;
   const availableEditors = useAtomValue(primaryServerAvailableEditorsAtom);
   const remoteOpenState = useRemoteOpenState(activeThread?.environmentId ?? environmentId);
   const showOpenInPicker = shouldShowOpenInPicker({
 @@ -4497,12 +4513,14 @@ export default function ChatView(props: ChatViewProps) {
   const focusComposer = useCallback(() => {
     composerRef.current?.focusAtEnd();
   }, [composerRef]);
-  const canInterruptRunningThread = deriveCanInterruptRunningThread(
+  const canInterruptRunningThread =
-    activeThread !== undefined,
+    canOperateThread && deriveCanInterruptRunningThread(activeThread !== undefined, activeRuntime);
-    activeRuntime,
-  );
   const onInterrupt = useCallback(async () => {
-    if (!activeThread) return;
+    if (
+      !activeThread ||
+      !readEnvironmentScope(activeThread.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     const result = await interruptThreadTurn({
       environmentId,
       input: { threadId: activeThread.id },
 @@ -4997,9 +5015,37 @@ export default function ChatView(props: ChatViewProps) {
       projectCwd: string;
       previousScripts: ReadonlyArray<ProjectScript>;
       nextScripts: ReadonlyArray<ProjectScript>;
-      keybinding?: string | null;
+      keybinding: NewProjectScriptInput["keybinding"];
       keybindingCommand: KeybindingCommand | null;
     }): Promise<AtomCommandResult<void, unknown>> => {
+      const previousKeybinding = keybindingValueForCommand(
+        appAtomRegistry.get(serverEnvironment.configValueAtom(environmentId))?.keybindings ?? [],
+        input.keybindingCommand,
+      );
+      const isDeletingScript = !input.nextScripts.some(
+        (script) => commandForProjectScript(script.id) === input.keybindingCommand,
+      );
+      const changesKeybinding =
+        isElectron &&
+        input.keybinding !== undefined &&
+        (input.keybinding?.trim() || null) !== previousKeybinding &&
+        (!isDeletingScript || readEnvironmentScope(environmentId, AuthSettingsWriteScope));
+      if (changesKeybinding && !readEnvironmentScope(environmentId, AuthSettingsWriteScope)) {
+        return AsyncResult.failure(
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthSettingsWriteScope,
+              message: "This connection cannot change keyboard shortcuts.",
+            }),
+          ),
+        );
+      }
+      const keybindingRule = changesKeybinding
+        ? decodeProjectScriptKeybindingRule({
+            keybinding: input.keybinding,
+            command: input.keybindingCommand,
+          })
+        : null;
       const updateResult = mapAtomCommandResult(
         await updateProjectScriptSettings({
           environmentId,
 @@ -5028,10 +5074,19 @@ export default function ChatView(props: ChatViewProps) {
         return updateResult;
       }
-      const keybindingRule = decodeProjectScriptKeybindingRule({
+      if (!changesKeybinding) return updateResult;
-        keybinding: input.keybinding,
+      if (!readEnvironmentScope(environmentId, AuthSettingsWriteScope)) {
-        command: input.keybindingCommand,
+        return AsyncResult.failure(
-      });
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthSettingsWriteScope,
+              message: isDeletingScript
+                ? "The script was deleted, but its keyboard shortcut could not be removed because permission changed."
+                : "The script was saved, but this connection can no longer change keyboard shortcuts.",
+            }),
+          ),
+        );
+      }
       if (!isElectron) return updateResult;
 @@ -6991,7 +7046,7 @@ export default function ChatView(props: ChatViewProps) {
   ]);
   const activeThreadSettled =
     supportsSettlement && activeThreadShell?.settledOverride === "settled";
-  const unsettleThreadMutation = useAtomCommand(threadEnvironment.unsettle, {
+  const unsettleThreadMutation = useOrchestrationCommand(threadEnvironment.unsettle, {
     reportFailure: false,
   });
   // Keyed by thread, not a boolean: the pending state must follow the thread
 @@ -7000,7 +7055,11 @@ export default function ChatView(props: ChatViewProps) {
   const [unsettlingThreadKey, setUnsettlingThreadKey] = useState<string | null>(null);
   const isUnsettling = unsettlingThreadKey !== null && unsettlingThreadKey === activeThreadKey;
   const handleUnsettleActiveThread = useCallback(async () => {
-    if (!activeThreadRef) return;
+    if (
+      !activeThreadRef ||
+      !readEnvironmentScope(activeThreadRef.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     const threadKey = scopedThreadKey(activeThreadRef);
     setUnsettlingThreadKey(threadKey);
     try {
 @@ -7022,13 +7081,17 @@ export default function ChatView(props: ChatViewProps) {
       setUnsettlingThreadKey((current) => (current === threadKey ? null : current));
     }
   }, [activeThreadRef, unsettleThreadMutation]);
-  const unsnoozeThreadMutation = useAtomCommand(threadEnvironment.unsnooze, {
+  const unsnoozeThreadMutation = useOrchestrationCommand(threadEnvironment.unsnooze, {
     reportFailure: false,
   });
   const [unsnoozingThreadKey, setUnsnoozingThreadKey] = useState<string | null>(null);
   const isUnsnoozing = unsnoozingThreadKey !== null && unsnoozingThreadKey === activeThreadKey;
   const handleUnsnoozeActiveThread = useCallback(async () => {
-    if (!activeThreadRef) return;
+    if (
+      !activeThreadRef ||
+      !readEnvironmentScope(activeThreadRef.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     const threadKey = scopedThreadKey(activeThreadRef);
     setUnsnoozingThreadKey(threadKey);
     try {
 @@ -7175,7 +7238,8 @@ export default function ChatView(props: ChatViewProps) {
   const isStoppingBackgroundWork =
     stoppingBackgroundWorkKey === `${environmentId}:${activeThreadId}`;
   const handleStopBackgroundWork = useCallback(async () => {
-    if (!activeThread) return;
+    if (!activeThread || !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope))
+      return;
     const requestKey = `${environmentId}:${activeThread.id}`;
     setStoppingBackgroundWorkKey(requestKey);
     const result = await interruptThreadTurn({
 @@ -7377,7 +7441,7 @@ export default function ChatView(props: ChatViewProps) {
         <Button
           size="xs"
           variant="ghost"
-          disabled={isStoppingBackgroundWork}
+          disabled={!canOperateThread || isStoppingBackgroundWork}
           onClick={() => void handleStopBackgroundWork()}
         >
           {isStoppingBackgroundWork ? "Stopping..." : "Stop"}
 @@ -7387,6 +7451,7 @@ export default function ChatView(props: ChatViewProps) {
   }, [
     activeBackgroundTasks,
     activeThread,
+    canOperateThread,
     handleStopBackgroundWork,
     isStoppingBackgroundWork,
     onOpenRelatedThread,
 @@ -7423,7 +7488,7 @@ export default function ChatView(props: ChatViewProps) {
         <Button
           size="xs"
           variant="ghost"
-          disabled={isSnoozed ? isUnsnoozing : isUnsettling}
+          disabled={!canOperateThread || (isSnoozed ? isUnsnoozing : isUnsettling)}
           onClick={() =>
             void (isSnoozed ? handleUnsnoozeActiveThread() : handleUnsettleActiveThread())
           }
 @@ -7442,6 +7507,7 @@ export default function ChatView(props: ChatViewProps) {
     activeThread?.id,
     activeThreadSettled,
     activeThreadSnoozed,
+    canOperateThread,
     handleUnsnoozeActiveThread,
     handleUnsettleActiveThread,
     isUnsnoozing,
 @@ -7463,6 +7529,7 @@ export default function ChatView(props: ChatViewProps) {
       (item.text.trim().toLowerCase() !== "/compact" || item.attachments.length > 0),
   );
   const compactThreadUnavailable =
+    !canOperateThread ||
     !activeThread ||
     !activeThreadHasCompactableConversation ||
     !activeProject ||
 @@ -7479,11 +7546,13 @@ export default function ChatView(props: ChatViewProps) {
     showPlanFollowUpPrompt;
   const compactDisabled = compactThreadUnavailable;
   const compactDisabledReason = compactDisabled
-    ? !activeProject
+    ? !canOperateThread
-      ? "Choose a project before compacting"
+      ? "This connection cannot change threads."
-      : !manualCompactionProviderAvailable
+      : !activeProject
-        ? "Compaction is unavailable for this provider"
+        ? "Choose a project before compacting"
-        : "Compacting is unavailable right now"
+        : !manualCompactionProviderAvailable
+          ? "Compaction is unavailable for this provider"
+          : "Compacting is unavailable right now"
     : null;
   const resumeCompactionBannerItem = useMemo<ComposerBannerStackItem | null>(() => {
     if (
 @@ -7813,7 +7882,7 @@ export default function ChatView(props: ChatViewProps) {
         }
       }
-      const command = resolveShortcutCommand(event, keybindings, {
+      const command = resolveChatShortcutCommand(event, keybindings, scriptKeybindings, {
         context: shortcutContext,
       });
       if (!command) return;
 @@ -7826,6 +7895,7 @@ export default function ChatView(props: ChatViewProps) {
       }
       if (command === "thread.settle") {
+        if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
         event.preventDefault();
         event.stopPropagation();
         if (!isServerThread || !activeThreadRef || !supportsSettlement) return;
 @@ -7849,6 +7919,7 @@ export default function ChatView(props: ChatViewProps) {
       }
       if (command === "thread.pin") {
+        if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
         event.preventDefault();
         event.stopPropagation();
         if (!isServerThread || !activeThreadRef || !supportsPinning) return;
 @@ -8069,6 +8140,7 @@ export default function ChatView(props: ChatViewProps) {
     splitTerminal,
     splitPanelTerminal,
     keybindings,
+    scriptKeybindings,
     handleUnsettleActiveThread,
     isServerThread,
     onInterrupt,
 @@ -8143,7 +8215,13 @@ export default function ChatView(props: ChatViewProps) {
   const onRevertToTurnCount = useCallback(
     async (turnCount: number, messageId: MessageId, restoreFiles?: boolean) => {
       const localApi = readLocalApi();
-      if (!localApi || !activeThread || isRevertingCheckpoint) return;
+      if (
+        !localApi ||
+        !activeThread ||
+        isRevertingCheckpoint ||
+        !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)
+      )
+        return;
       const sourceMessage = serverProjection?.messages.find((message) => message.id === messageId);
       const message = sourceMessage
         ? {
 @@ -8514,6 +8592,7 @@ export default function ChatView(props: ChatViewProps) {
       );
     };
     if (
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) ||
       !activeThread ||
       isSendBusy ||
       isConnecting ||
 @@ -9141,6 +9220,23 @@ export default function ChatView(props: ChatViewProps) {
       void dockTransition.catch(() => resolveDockStarted?.());
       await dockStarted;
     }
+    const attachmentCapabilitiesBeforeDispatch = readLiveAttachmentCapabilities();
+    if (
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) ||
+      attachmentCapabilitiesBeforeDispatch.fileBlockReason !== null
+    ) {
+      sendInFlightRef.current = false;
+      setThreadError(
+        threadIdForSend,
+        attachmentCapabilitiesBeforeDispatch.fileBlockReason ??
+          "This connection cannot change threads.",
+      );
+      setDockedDraftHeroThreadKey((currentThreadKey) =>
+        currentThreadKey === activeThreadKey ? null : currentThreadKey,
+      );
+      return;
+    }
     beginLocalDispatch({
       preparingWorktree: multipleModelSelections !== null || Boolean(baseBranchForWorktree),
       // Only a draft has a background submission to hide behind its hero.
 @@ -9815,7 +9911,8 @@ export default function ChatView(props: ChatViewProps) {
   const onRespondToApproval = useCallback(
     async (requestId: RuntimeRequestId, decision: ProviderApprovalDecision) => {
-      if (!activeThreadId) return;
+      if (!activeThreadId || !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope))
+        return;
       if (
         pendingApprovals.find((approval) => approval.requestId === requestId)
           ?.responseCapability !== "live"
 @@ -9848,7 +9945,8 @@ export default function ChatView(props: ChatViewProps) {
   const onRespondToUserInput = useCallback(
     async (requestId: RuntimeRequestId, answers: Record<string, unknown>) => {
-      if (!activeThreadId) return;
+      if (!activeThreadId || !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope))
+        return;
       const pendingInput = pendingUserInputs.find((input) => input.requestId === requestId);
       if (!pendingInput || pendingInput.responseCapability === "not_resumable") return;
       const responseKey = JSON.stringify([environmentId, activeThreadId, requestId]);
 @@ -10079,7 +10177,14 @@ export default function ChatView(props: ChatViewProps) {
     context?: ReturnType<typeof buildMessageContext>;
     interactionMode: "default" | "plan";
   }) {
-    if (!activeThread || !isServerThread || isSendBusy || isConnecting || sendInFlightRef.current) {
+    if (
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) ||
+      !activeThread ||
+      !isServerThread ||
+      isSendBusy ||
+      isConnecting ||
+      sendInFlightRef.current
+    ) {
       return false;
     }
 @@ -10213,6 +10318,7 @@ export default function ChatView(props: ChatViewProps) {
   const onImplementPlanInNewThread = useCallback(async () => {
     if (
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) ||
       !activeThread ||
       !activeProject ||
       !activeProposedPlan ||
 @@ -11264,6 +11370,7 @@ export default function ChatView(props: ChatViewProps) {
                           ) : null}
                           {!composerMounted ? null : (
                             <ChatComposer
+                              canOperateThread={canOperateThread}
                               reportedModelSelection={reportedModelSelection}
                               multipleModelSelections={multipleModelSelections}
                               supportsMultipleModels={
 @@ -11301,17 +11408,19 @@ export default function ChatView(props: ChatViewProps) {
                               canResume={resumableRunId !== null || hasHeldQueuedRuns}
                               isRevertingCheckpoint={isRevertingCheckpoint}
                               sendDisabledReason={
-                                isEnvironmentChanging
+                                !canOperateThread
-                                  ? "Preparing machine"
+                                  ? "This connection cannot change threads."
-                                  : isRevertingCheckpoint
+                                  : isEnvironmentChanging
-                                    ? "Rewinding conversation"
+                                    ? "Preparing machine"
-                                    : feedbackUploading
+                                    : isRevertingCheckpoint
-                                      ? "Sending feedback"
+                                      ? "Rewinding conversation"
-                                      : threadDetailLoading
+                                      : feedbackUploading
-                                        ? "Messages loading"
+                                        ? "Sending feedback"
-                                        : worktreeSetupBlocksSend
+                                        : threadDetailLoading
-                                          ? "Preparing worktree"
+                                          ? "Messages loading"
-                                          : projectCloneSendBlockReason
+                                          : worktreeSetupBlocksSend
+                                            ? "Preparing worktree"
+                                            : projectCloneSendBlockReason
                               }
                               isPreparingWorktree={isPreparingWorktree}
                               queuedRunsControl={

apps/web/src/components/KeybindingsConfigWarning.test.tsx created+119

...	@@ -0,0 +1,119 @@
1	import { RegistryContext } from "@effect/atom-react";
2	import {
3	AuthOrchestrationOperateScope,
4	EnvironmentId,
5	type AuthEnvironmentScope,
6	type AuthSessionState,
7	} from "@t3tools/contracts";
8	import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
9	import { act, create, type ReactTestRenderer } from "react-test-renderer";
10	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
11
12	type SessionResult = AsyncResult.AsyncResult<AuthSessionState, Error>;
13	const state = vi.hoisted(() => ({
14	registry: null as AtomRegistry.AtomRegistry \| null,
15	sessions: new Map<EnvironmentId, Atom.Writable<SessionResult>>(),
16	run: vi.fn(),
17	toast: vi.fn(),
18	}));
19
20	vi.mock("../connection/runtime", () => ({ connectionAtomRuntime: undefined }));
21	vi.mock("@t3tools/client-runtime/state/session", () => ({
22	createEnvironmentSessionAtoms: () => ({
23	sessionStateAtom: (id: EnvironmentId) => state.sessions.get(id)!,
24	}),
25	}));
26	vi.mock("../rpc/atomRegistry", () => ({
27	get appAtomRegistry() {
28	return state.registry;
29	},
30	}));
31	vi.mock("../state/shell", () => ({ shellEnvironment: { openInEditor: "openInEditor" } }));
32	vi.mock("../state/use-atom-command", () => ({ useAtomCommand: () => state.run }));
33	vi.mock("../hooks/useLocalStorage", () => ({
34	getLocalStorageItem: () => "vscode",
35	setLocalStorageItem: vi.fn(),
36	useLocalStorage: vi.fn(),
37	}));
38	vi.mock("./ui/button", () => ({ Button: "button" }));
39	vi.mock("./ui/toast", () => ({
40	toastManager: { add: state.toast },
41	stackedThreadToast: (value: unknown) => value,
42	}));
43
44	import { KeybindingsConfigWarning } from "./KeybindingsConfigWarning";
45
46	const environmentId = EnvironmentId.make("warning-environment");
47	let renderer: ReactTestRenderer \| undefined;
48	const session = (scopes: readonly AuthEnvironmentScope[]): AuthSessionState => ({
49	authenticated: true,
50	scopes,
51	auth: {
52	policy: "remote-reachable",
53	bootstrapMethods: ["one-time-token"],
54	sessionMethods: ["bearer-access-token"],
55	sessionCookieName: "t3_session",
56	},
57	});
58
59	beforeEach(() => {
60	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
61	state.registry = AtomRegistry.make();
62	state.sessions.set(
63	environmentId,
64	Atom.make<SessionResult>(AsyncResult.success(session([AuthOrchestrationOperateScope]))).pipe(
65	Atom.keepAlive,
66	),
67	);
68	state.run.mockReset().mockResolvedValue(AsyncResult.success(undefined));
69	state.toast.mockReset();
70	});
71
72	afterEach(async () => {
73	await act(async () => renderer?.unmount());
74	renderer = undefined;
75	state.registry?.dispose();
76	state.sessions.clear();
77	vi.unstubAllGlobals();
78	});
79
80	it("updates a visible warning on revocation and blocks its retained action until regrant", async () => {
81	await act(async () => {
82	renderer = create(
83	<RegistryContext.Provider value={state.registry!}>
84	<KeybindingsConfigWarning
85	environmentId={environmentId}
86	configPath="/t3/keybindings.json"
87	availableEditors={["vscode"]}
88	message="Invalid shortcut"
89	/>
90	</RegistryContext.Provider>,
91	);
92	});
93	const open = renderer!.root.findByType("button").props.onClick;
94	expect(renderer!.root.findByType("button").props.disabled).toBe(false);
95	await act(async () => {
96	state.registry!.set(state.sessions.get(environmentId)!, AsyncResult.success(session([])));
97	await open();
98	});
99	expect(renderer!.root.findByType("button").props.disabled).toBe(true);
100	expect(state.run).not.toHaveBeenCalled();
101	expect(state.toast).toHaveBeenCalledWith(
102	expect.objectContaining({
103	title: "Unable to open keybindings file",
104	}),
105	);
106
107	await act(async () => {
108	state.registry!.set(
109	state.sessions.get(environmentId)!,
110	AsyncResult.success(session([AuthOrchestrationOperateScope])),
111	);
112	});
113	expect(renderer!.root.findByType("button").props.disabled).toBe(false);
114	await act(async () => open());
115	expect(state.run).toHaveBeenCalledExactlyOnceWith({
116	environmentId,
117	input: { cwd: "/t3/keybindings.json", editor: "vscode" },
118	});
119	});

apps/web/src/components/KeybindingsConfigWarning.tsx created+54

...	@@ -0,0 +1,54 @@
1	import {
2	AuthOrchestrationOperateScope,
3	type EditorId,
4	type EnvironmentId,
5	} from "@t3tools/contracts";
6	import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
7
8	import { useOpenInPreferredEditor } from "../editorPreferences";
9	import { useEnvironmentScope } from "../state/session";
10	import { Button } from "./ui/button";
11	import { stackedThreadToast, toastManager } from "./ui/toast";
12
13	export function KeybindingsConfigWarning({
14	message,
15	environmentId,
16	configPath,
17	availableEditors,
18	}: {
19	message: string;
20	environmentId: EnvironmentId \| null;
21	configPath: string \| null;
22	availableEditors: readonly EditorId[];
23	}) {
24	const canOpenEditor = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
25	const openInEditor = useOpenInPreferredEditor(environmentId, availableEditors);
26
27	return (
28	<>
29	{message}
30	<span className="mt-2 flex justify-end">
31	<Button
32	size="xs"
33	variant="outline"
34	disabled={!canOpenEditor \|\| !configPath \|\| availableEditors.length === 0}
35	onClick={async () => {
36	if (!configPath) return;
37	const result = await openInEditor(configPath);
38	if (result._tag === "Success") return;
39	const error = squashAtomCommandFailure(result);
40	toastManager.add(
41	stackedThreadToast({
42	type: "error",
43	title: "Unable to open keybindings file",
44	description: error instanceof Error ? error.message : "Unknown error opening file.",
45	}),
46	);
47	}}
48	>
49	Open keybindings.json
50	</Button>
51	</span>
52	</>
53	);
54	}

apps/web/src/components/LegacySidebar.tsx+102-14

 @@ -45,7 +45,9 @@ import { SortableContext, useSortable, verticalListSortingStrategy } from "@dnd-
 import { restrictToFirstScrollableAncestor, restrictToVerticalAxis } from "@dnd-kit/modifiers";
 import { CSS } from "@dnd-kit/utilities";
 import {
+  AuthOrchestrationOperateScope,
   type ContextMenuItem,
+  type EnvironmentId,
   ProjectId,
   type ScopedThreadRef,
   type ResolvedKeybindingsConfig,
 @@ -96,7 +98,12 @@ import { useThreadRunningTerminalIds } from "../state/terminalSessions";
 import { useThreadDiscoveredPorts } from "../portDiscoveryState";
 import { openDiscoveredPort } from "./preview/openDiscoveredPort";
 import { useAtomCommand } from "../state/use-atom-command";
+import {
+  ORCHESTRATION_OPERATE_DENIED_MESSAGE,
+  useOrchestrationCommand,
+} from "../state/use-orchestration-command";
 import { previewEnvironment } from "../state/preview";
+import { readEnvironmentScope, useEnvironmentScope } from "../state/session";
 import {
   legacyProjectCwdPreferenceKey,
   resolveProjectExpanded,
 @@ -357,6 +364,18 @@ interface SidebarThreadRowProps {
   onFileDropThreads: (threadRef: ScopedThreadRef, files: File[]) => void;
 }
+function checkTaskPermission(environmentId: EnvironmentId): boolean {
+  if (readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return true;
+  toastManager.add(
+    stackedThreadToast({
+      type: "error",
+      title: "Action unavailable",
+      description: ORCHESTRATION_OPERATE_DENIED_MESSAGE,
+    }),
+  );
+  return false;
+}
 const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowProps) {
   const {
     orderedProjectThreadKeys,
 @@ -385,6 +404,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
     onFileDropThreads,
     thread,
   } = props;
+  const canOperateThread = useEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope);
   const threadRef = scopeThreadRef(thread.environmentId, thread.id);
   const threadKey = scopedThreadKey(threadRef);
   const [isFileDragOver, setIsFileDragOver] = useState(false);
 @@ -485,10 +505,11 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
     : null;
   const prStatus = prStatusIndicator(pr, linkedPullRequestStatus?.sourceControlProvider);
   const terminalStatus = terminalStatusFromRunningIds(runningTerminalIds);
-  const isConfirmingArchive = confirmingArchiveThreadKey === threadKey && !isThreadRunning;
+  const isConfirmingArchive =
+    canOperateThread && confirmingArchiveThreadKey === threadKey && !isThreadRunning;
   const threadMetaClassName = isConfirmingArchive
     ? "pointer-events-none opacity-0"
-    : !isThreadRunning
+    : canOperateThread && !isThreadRunning
       ? "pointer-events-none transition-opacity duration-150 max-sm:pr-6 group-hover/menu-sub-item:opacity-0 group-focus-within/menu-sub-item:opacity-0"
       : "pointer-events-none";
   const clearConfirmingArchive = useCallback(() => {
 @@ -517,6 +538,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
   );
   const handleRowDoubleClick = useCallback(
     (event: React.MouseEvent) => {
+      if (!readEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope)) return;
       // Already renaming this row: a double-click on the row chrome (outside the
       // input) must not restart and discard the in-progress edit.
       if (renamingThreadKey === threadKey) return;
 @@ -531,7 +553,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
       event.preventDefault();
       startThreadRename(threadKey, thread.title);
     },
-    [isMobile, renamingThreadKey, startThreadRename, threadKey, thread.title],
+    [isMobile, renamingThreadKey, startThreadRename, threadKey, thread.environmentId, thread.title],
   );
   const handleRowKeyDown = useCallback(
     (event: React.KeyboardEvent) => {
 @@ -685,12 +707,13 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
     (event: React.MouseEvent<HTMLButtonElement>) => {
       event.preventDefault();
       event.stopPropagation();
+      if (!checkTaskPermission(thread.environmentId)) return;
       setConfirmingArchiveThreadKey(threadKey);
       requestAnimationFrame(() => {
         confirmArchiveButtonRefs.current.get(threadKey)?.focus();
       });
     },
-    [confirmArchiveButtonRefs, setConfirmingArchiveThreadKey, threadKey],
+    [confirmArchiveButtonRefs, setConfirmingArchiveThreadKey, threadKey, thread.environmentId],
   );
   const handleArchiveImmediateClick = useCallback(
     (event: React.MouseEvent<HTMLButtonElement>) => {
 @@ -775,7 +798,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
             </a>
           ) : null}
           {threadStatus && <ThreadStatusLabel status={threadStatus} />}
-          {renamingThreadKey === threadKey ? (
+          {canOperateThread && renamingThreadKey === threadKey ? (
             <input
               ref={handleRenameInputRef}
               className="min-w-0 flex-1 truncate rounded border border-ring bg-transparent px-0.5 text-sm outline-none"
 @@ -861,7 +884,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: SidebarThreadRowP
               >
                 Confirm
               </button>
-            ) : !isThreadRunning ? (
+            ) : canOperateThread && !isThreadRunning ? (
               appSettingsConfirmThreadArchive ? (
                 <div className="pointer-events-none absolute top-1/2 right-0.5 -translate-y-1/2 opacity-0 transition-opacity duration-150 max-sm:pointer-events-auto max-sm:opacity-100 group-hover/menu-sub-item:pointer-events-auto group-hover/menu-sub-item:opacity-100 group-focus-within/menu-sub-item:pointer-events-auto group-focus-within/menu-sub-item:opacity-100">
                   <button
 @@ -1191,13 +1214,13 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
     (settings) => settings.confirmThreadArchive,
   );
   const projectGroupingSettings = useClientSettings(selectProjectGroupingSettings);
-  const deleteProject = useAtomCommand(projectEnvironment.delete, {
+  const deleteProject = useOrchestrationCommand(projectEnvironment.delete, {
     reportFailure: false,
   });
-  const updateProject = useAtomCommand(projectEnvironment.update, {
+  const updateProject = useOrchestrationCommand(projectEnvironment.update, {
     reportFailure: false,
   });
-  const updateThreadMetadata = useAtomCommand(threadEnvironment.updateMetadata, {
+  const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
     reportFailure: false,
   });
   const updateSettings = useUpdateClientSettings();
 @@ -1293,6 +1316,10 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
     null,
   );
   const [projectRenameTitle, setProjectRenameTitle] = useState("");
+  const canRenameProject = useEnvironmentScope(
+    projectRenameTarget?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
   const [projectGroupingTarget, setProjectGroupingTarget] =
     useState<SidebarProjectGroupMember | null>(null);
   const [projectGroupingSelection, setProjectGroupingSelection] = useState<
 @@ -1501,6 +1528,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
   );
   const openProjectRenameDialog = useCallback((member: SidebarProjectGroupMember) => {
+    if (!checkTaskPermission(member.environmentId)) return;
     setProjectRenameTarget(member);
     setProjectRenameTitle(member.title);
   }, []);
 @@ -1551,6 +1579,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
   const handleRemoveProject = useCallback(
     async (member: SidebarProjectGroupMember) => {
+      if (!checkTaskPermission(member.environmentId)) return;
       const api = readLocalApi();
       if (!api) {
         return;
 @@ -1573,6 +1602,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
                   await new Promise<void>((resolve) => {
                     window.setTimeout(resolve, 180);
                   });
+                  if (!checkTaskPermission(member.environmentId)) return;
                   const latestProjectThreads = Array.from(
                     sidebarThreadByKeyRef.current.values(),
 @@ -1765,12 +1795,17 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
         const clicked = await api.contextMenu.show(
           [
-            buildTargetedItem("rename", "Rename"),
+            buildTargetedItem("rename", "Rename", {
+              isDisabled: (member) =>
+                !readEnvironmentScope(member.environmentId, AuthOrchestrationOperateScope),
+            }),
             buildTargetedItem("grouping", "Group into..."),
             buildTargetedItem("copy-path", "Copy Path"),
             { id: "project-settings", label: "Project settings", icon: "settings" },
             buildTargetedItem("delete", "Remove", {
               destructive: true,
+              isDisabled: (member) =>
+                !readEnvironmentScope(member.environmentId, AuthOrchestrationOperateScope),
             }),
           ],
           {
 @@ -1907,9 +1942,16 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
       const hasRunningThread = selectedThreadEntries.some(
         ({ thread }) => !threadRuntimeCanArchive(thread.runtime),
       );
+      const canOperateSelection = selectedThreadEntries.every(({ threadRef }) =>
+        readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope),
+      );
       const clicked = await api.contextMenu.show(
-        buildMultiSelectThreadContextMenuItems({ count, hasRunningThread }),
+        buildMultiSelectThreadContextMenuItems({ count, hasRunningThread }).map((item) =>
+          item.id === "archive" || item.id === "delete"
+            ? { ...item, disabled: item.disabled || !canOperateSelection }
+            : item,
+        ),
         position,
       );
 @@ -1921,6 +1963,15 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
         return;
       }
+      if (
+        (clicked === "archive" || clicked === "delete") &&
+        !selectedThreadEntries.every(({ threadRef }) =>
+          checkTaskPermission(threadRef.environmentId),
+        )
+      ) {
+        return;
+      }
       if (clicked === "archive") {
         if (appSettingsConfirmThreadArchive) {
           const confirmed = await api.dialogs.confirm(
 @@ -1928,6 +1979,13 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
           );
           if (!confirmed) return;
         }
+        if (
+          !selectedThreadEntries.every(({ threadRef }) =>
+            checkTaskPermission(threadRef.environmentId),
+          )
+        ) {
+          return;
+        }
         const archiveOutcome = await archiveSelectedThreadEntries({
           entries: selectedThreadEntries,
 @@ -1974,6 +2032,13 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
         );
         if (!confirmed) return;
       }
+      if (
+        !selectedThreadEntries.every(({ threadRef }) =>
+          checkTaskPermission(threadRef.environmentId),
+        )
+      ) {
+        return;
+      }
       const { deletedThreadKeys, firstFailure } = await deleteSelectedThreadEntries({
         entries: selectedThreadEntries,
 @@ -2090,6 +2155,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
   const attemptArchiveThread = useCallback(
     async (threadRef: ScopedThreadRef) => {
+      if (!checkTaskPermission(threadRef.environmentId)) return;
       const result = await archiveThread(threadRef);
       if (result._tag === "Failure" && !isAtomCommandInterrupted(result)) {
         const error = squashAtomCommandFailure(result);
 @@ -2111,6 +2177,8 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
   }, []);
   const startThreadRename = useCallback((threadKey: string, title: string) => {
+    const threadRef = parseScopedThreadKey(threadKey);
+    if (!threadRef || !checkTaskPermission(threadRef.environmentId)) return;
     setRenamingThreadKey(threadKey);
     setRenamingTitle(title);
     renamingCommittedRef.current = false;
 @@ -2250,17 +2318,27 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
       );
       const threadWorkspacePath =
         thread.worktreePath ?? threadProject?.workspaceRoot ?? project.workspaceRoot ?? null;
+      const canOperateThread = readEnvironmentScope(
+        thread.environmentId,
+        AuthOrchestrationOperateScope,
+      );
       const clicked = await api.contextMenu.show(
         [
           ...(thread.branch
             ? [{ id: "new-thread-on-branch", label: `New thread on ${thread.branch}` }]
             : []),
-          { id: "rename", label: "Rename thread" },
+          { id: "rename", label: "Rename thread", disabled: !canOperateThread },
           { id: "mark-unread", label: "Mark unread" },
           { id: "copy-path", label: "Copy Path" },
           { id: "copy-thread-id", label: "Copy Thread ID" },
           { id: "project-settings", label: "Project settings" },
-          { id: "delete", label: "Delete", destructive: true, icon: "trash" },
+          {
+            id: "delete",
+            label: "Delete",
+            destructive: true,
+            icon: "trash",
+            disabled: !canOperateThread,
+          },
         ],
         position,
       );
 @@ -2326,6 +2404,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
         return;
       }
       if (clicked !== "delete") return;
+      if (!checkTaskPermission(threadRef.environmentId)) return;
       if (appSettingsConfirmThreadDelete) {
         const confirmed = await api.dialogs.confirm(
           [
 @@ -2338,6 +2417,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
           return;
         }
       }
+      if (!checkTaskPermission(threadRef.environmentId)) return;
       const result = await deleteThread(threadRef);
       if (result._tag === "Failure" && !isAtomCommandInterrupted(result)) {
         const error = squashAtomCommandFailure(result);
 @@ -2533,6 +2613,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
               <span className="text-xs font-medium text-foreground">Project title</span>
               <Input
                 aria-label="Project title"
+                disabled={!canRenameProject}
                 value={projectRenameTitle}
                 onChange={(event) => setProjectRenameTitle(event.target.value)}
                 onKeyDown={(event) => {
 @@ -2548,12 +2629,19 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
                 Environment: {projectRenameTarget.environmentLabel}
               </p>
             ) : null}
+            {!canRenameProject ? (
+              <p className="text-xs text-muted-foreground">
+                This connection cannot change projects.
+              </p>
+            ) : null}
           </DialogPanel>
           <DialogFooter>
             <Button variant="outline" onClick={closeProjectRenameDialog}>
               Cancel
             </Button>
-            <Button onClick={() => void submitProjectRename()}>Save</Button>
+            <Button disabled={!canRenameProject} onClick={() => void submitProjectRename()}>
+              Save
+            </Button>
           </DialogFooter>
         </DialogPopup>
       </Dialog>

apps/web/src/components/ProjectScriptsControl.tsx+17-7

 @@ -1,9 +1,13 @@
 import { ThreadDetailsControl } from "./chat/ThreadDetailsControl";
-import type {
+import {
-  ProjectScript,
+  AuthSettingsWriteScope,
-  ResolvedKeybindingsConfig,
+  type EnvironmentId,
-  T3ProjectFileScript,
+  type ProjectScript,
+  type T3ProjectFileScript,
+  type ResolvedKeybindingsConfig,
 } from "@t3tools/contracts";
+import { useAtomValue } from "@effect/atom-react";
+import { DEFAULT_RESOLVED_KEYBINDINGS } from "@t3tools/shared/keybindings";
 import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 @@ -13,6 +17,8 @@ import React, { useCallback, useMemo, useState } from "react";
 import { commandForProjectScript, primaryProjectScript } from "~/projectScripts";
 import { shortcutLabelForCommand } from "~/keybindings";
+import { serverEnvironment } from "~/state/server";
+import { readEnvironmentScope } from "~/state/session";
 import {
   EMPTY_PROJECT_SCRIPT_INPUT,
   editorRequestForScript,
 @@ -55,10 +61,10 @@ interface ProjectScriptsControlProps {
   displayMode?: "toolbar" | "panel";
   presentation?: "toolbar" | "menu";
   onRequestMenuClose?: () => void;
+  environmentId: EnvironmentId;
   scripts: ReadonlyArray<ProjectScript>;
   /** Scripts declared in the project's checked-in t3.json, offered for import. */
   fileScripts?: ReadonlyArray<T3ProjectFileScript>;
-  keybindings: ResolvedKeybindingsConfig;
   preferredScriptId?: string | null;
   onRunScript: (script: ProjectScript) => void;
   onAddScript: (input: NewProjectScriptInput) => Promise<ProjectScriptActionResult>;
 @@ -73,9 +79,9 @@ export default function ProjectScriptsControl({
   displayMode = "toolbar",
   presentation = "toolbar",
   onRequestMenuClose,
+  environmentId,
   scripts,
   fileScripts = NO_FILE_SCRIPTS,
-  keybindings,
   preferredScriptId = null,
   onRunScript,
   onAddScript,
 @@ -85,6 +91,9 @@ export default function ProjectScriptsControl({
   const isPanel = displayMode === "panel";
   const ActionGroup = isPanel ? "div" : Group;
   const panelAnchorRef = React.useRef<HTMLDivElement | null>(null);
+  const keybindings =
+    useAtomValue(serverEnvironment.configValueAtom(environmentId))?.keybindings ??
+    DEFAULT_RESOLVED_KEYBINDINGS;
   const [actionsMenuOpen, setActionsMenuOpen] = useState({
     presentation,
     scripts: false,
 @@ -138,7 +147,7 @@ export default function ProjectScriptsControl({
       icon: fileScript.icon ?? "play",
       runOnWorktreeCreate: fileScript.runOnWorktreeCreate ?? false,
       waitForSetup: fileScript.runOnWorktreeCreate === true && fileScript.async === false,
-      keybinding: null,
+      ...(readEnvironmentScope(environmentId, AuthSettingsWriteScope) ? { keybinding: null } : {}),
       previewUrl: fileScript.previewUrl ?? null,
       autoOpenPreview: fileScript.previewUrl ? (fileScript.autoOpenPreview ?? false) : false,
     };
 @@ -459,6 +468,7 @@ export default function ProjectScriptsControl({
       )}
       <ProjectScriptEditorDialog
+        environmentId={environmentId}
         request={editorRequest}
         scripts={scripts}
         onSubmit={submitScript}

apps/web/src/components/ProviderUpdateEnvironmentRows.test.tsx+14

 @@ -1,6 +1,8 @@
 import type { Dispatch, ReactElement, SetStateAction } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
 import {
+  AuthProvidersManageScope,
+  type AuthEnvironmentScope,
   type EnvironmentId,
   ProviderDriverKind,
   ProviderInstanceId,
 @@ -16,6 +18,7 @@ import type {
 const testState = vi.hoisted(() => ({
   groups: [] as LocalEnvironmentUpdateGroup[],
+  permittedEnvironmentIds: new Set<EnvironmentId>(),
   updateProvider: vi.fn(),
 }));
 @@ -90,6 +93,15 @@ vi.mock("~/state/server", () => ({
   serverEnvironment: { updateProvider: Symbol("updateProvider") },
 }));
+vi.mock("~/state/session", () => ({
+  readEnvironmentScope: (environmentId: EnvironmentId, scope: AuthEnvironmentScope) =>
+    scope === AuthProvidersManageScope && testState.permittedEnvironmentIds.has(environmentId),
+  useEnvironmentScope: (environmentId: EnvironmentId | null, scope: AuthEnvironmentScope) =>
+    environmentId !== null &&
+    scope === AuthProvidersManageScope &&
+    testState.permittedEnvironmentIds.has(environmentId),
+}));
 vi.mock("~/state/use-atom-command", () => ({
   useAtomCommand: () => testState.updateProvider,
 }));
 @@ -176,6 +188,8 @@ describe("ProviderUpdateEnvironmentRows", () => {
   beforeEach(() => {
     vi.useFakeTimers();
     hooks.reset();
+    testState.permittedEnvironmentIds.clear();
+    testState.permittedEnvironmentIds.add(environmentId);
     testState.updateProvider.mockReset();
     const candidate = provider() as ProviderUpdateCandidate;
     testState.groups = [

apps/web/src/components/ProviderUpdateEnvironmentRows.tsx+15-3

 @@ -1,6 +1,10 @@
 import { CheckIcon } from "lucide-react";
 import { type ReactNode, useCallback, useMemo, useRef, useState } from "react";
-import type { EnvironmentId, ServerProvider } from "@t3tools/contracts";
+import {
+  AuthProvidersManageScope,
+  type EnvironmentId,
+  type ServerProvider,
+} from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 @@ -9,6 +13,7 @@ import {
 import { cn } from "~/lib/utils";
 import { serverEnvironment } from "~/state/server";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { useAtomCommand } from "~/state/use-atom-command";
 import { useLocalEnvironmentUpdateGroups } from "./ProviderUpdateLaunchNotification.environments";
 import {
 @@ -115,6 +120,7 @@ function EnvironmentUpdateRow({
   readonly status: ProviderUpdateRowStatus;
   readonly onUpdate: () => void;
 }) {
+  const canManageProviders = useEnvironmentScope(group.environmentId, AuthProvidersManageScope);
   let trailing: ReactNode;
   switch (status.kind) {
     case "loading":
 @@ -126,14 +132,14 @@ function EnvironmentUpdateRow({
     case "failed":
     case "unchanged":
       trailing = (
-        <Button size="xs" variant="outline" onClick={onUpdate}>
+        <Button size="xs" variant="outline" disabled={!canManageProviders} onClick={onUpdate}>
           Retry
         </Button>
       );
       break;
     default:
       trailing = (
-        <Button size="xs" variant="outline" onClick={onUpdate}>
+        <Button size="xs" variant="outline" disabled={!canManageProviders} onClick={onUpdate}>
           Update
         </Button>
       );
 @@ -145,6 +151,11 @@ function EnvironmentUpdateRow({
       <div className="flex min-w-0 flex-col">
         <span className="truncate font-medium text-foreground">{group.label}</span>
         <span className={cn("truncate text-xs", rowToneClass(status.kind))}>{status.text}</span>
+        {!canManageProviders ? (
+          <span className="text-xs text-muted-foreground">
+            This connection cannot manage provider accounts.
+          </span>
+        ) : null}
       </div>
       <div className="shrink-0">{trailing}</div>
     </div>
 @@ -211,6 +222,7 @@ export function ProviderUpdateEnvironmentRows({
   const handleUpdate = useCallback(
     async (environmentId: EnvironmentId) => {
+      if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
       const group = groupByEnvironment.get(environmentId);
       if (!group || group.candidates.length === 0) {
         return;

apps/web/src/components/ProviderUpdatePrimaryNotification.tsx+83-39

 @@ -2,10 +2,15 @@ import { useNavigate } from "@tanstack/react-router";
 import { useAtomValue } from "@effect/atom-react";
 import { DownloadIcon } from "lucide-react";
 import { useCallback, useEffect, useMemo, useRef } from "react";
-import { type ServerProvider, type ProviderInstanceId } from "@t3tools/contracts";
+import {
+  AuthProvidersManageScope,
+  type ServerProvider,
+  type ProviderInstanceId,
+} from "@t3tools/contracts";
 import { primaryServerProvidersAtom, serverEnvironment } from "../state/server";
 import { usePrimaryEnvironment } from "../state/environments";
+import { readEnvironmentScope, useEnvironmentScope } from "../state/session";
 import { useDismissedProviderUpdateNotificationKeys } from "../providerUpdateDismissal";
 import { ProviderInstanceIcon } from "./chat/ProviderInstanceIcon";
 import {
 @@ -27,7 +32,12 @@ const seenProviderUpdateNotificationKeys = new Set<string>();
 type ProviderUpdateToastId = ReturnType<typeof toastManager.add>;
 type ActiveProviderUpdateToast =
-  | { readonly kind: "prompt"; readonly key: string; readonly toastId: ProviderUpdateToastId }
+  | {
+      readonly kind: "prompt";
+      readonly key: string;
+      readonly toastId: ProviderUpdateToastId;
+      readonly canManageProviders: boolean;
+    }
   | {
       readonly kind: "update";
       readonly key: string;
 @@ -100,6 +110,10 @@ export function ProviderUpdatePrimaryNotification() {
   const navigate = useNavigate();
   const providers = useAtomValue(primaryServerProvidersAtom);
   const primaryEnvironment = usePrimaryEnvironment();
+  const canManageProviders = useEnvironmentScope(
+    primaryEnvironment?.environmentId ?? null,
+    AuthProvidersManageScope,
+  );
   const updateProvider = useAtomCommand(serverEnvironment.updateProvider, {
     reportFailure: false,
   });
 @@ -178,11 +192,15 @@ export function ProviderUpdatePrimaryNotification() {
       activeToastRef.current = null;
     }
+    const updateExistingPrompt =
+      activeToast?.kind === "prompt" &&
+      activeToast.key === notificationKey &&
+      activeToast.canManageProviders !== canManageProviders;
     if (
       !notificationKey ||
       dismissedNotificationKeys.has(notificationKey) ||
-      seenProviderUpdateNotificationKeys.has(notificationKey) ||
+      (seenProviderUpdateNotificationKeys.has(notificationKey) && !updateExistingPrompt) ||
-      activeToastRef.current
+      (activeToastRef.current && !updateExistingPrompt)
     ) {
       return;
     }
 @@ -199,7 +217,12 @@ export function ProviderUpdatePrimaryNotification() {
     };
     const runUpdates = () => {
-      if (updateStarted || oneClickProviders.length === 0 || !primaryEnvironment) {
+      if (
+        updateStarted ||
+        oneClickProviders.length === 0 ||
+        !primaryEnvironment ||
+        !readEnvironmentScope(primaryEnvironment.environmentId, AuthProvidersManageScope)
+      ) {
         return;
       }
       updateStarted = true;
 @@ -219,6 +242,19 @@ export function ProviderUpdatePrimaryNotification() {
       void (async () => {
         const results = [];
         for (const provider of oneClickProviders) {
+          if (!readEnvironmentScope(primaryEnvironment.environmentId, AuthProvidersManageScope)) {
+            if (activeToastRef.current === activeUpdate) {
+              addProviderUpdateToast({
+                view: getProviderUpdateRejectedToastView(
+                  providerCount,
+                  "This connection cannot manage provider accounts.",
+                ),
+                openSettings: openProviderSettings,
+              });
+              activeToastRef.current = null;
+            }
+            return;
+          }
           results.push(
             await updateProvider({
               environmentId: primaryEnvironment.environmentId,
 @@ -260,44 +296,52 @@ export function ProviderUpdatePrimaryNotification() {
       })();
     };
-    toastId = toastManager.add(
+    const toastOptions = stackedThreadToast({
-      stackedThreadToast({
+      type: initialView.type,
-        type: initialView.type,
+      title: initialView.title,
-        title: initialView.title,
+      description: canManageProviders
-        description: initialView.description,
+        ? initialView.description
-        timeout: 0,
+        : "This connection cannot manage provider accounts. View provider settings for update details.",
-        actionProps:
+      timeout: 0,
-          oneClickProviders.length > 0
+      actionProps:
-            ? {
+        oneClickProviders.length > 0
-                children: "Update",
+          ? {
-                onClick: runUpdates,
+              children: "Update",
-              }
+              disabled: !canManageProviders,
-            : {
+              onClick: runUpdates,
+            }
+          : {
+              children: "Settings",
+              onClick: openSettings,
+            },
+      actionVariant: "outline",
+      data: {
+        leadingIcon:
+          updateProviders.length === 1 ? (
+            <ProviderUpdateToastIcon provider={updateProviders[0]!} />
+          ) : undefined,
+        hideCopyButton: true,
+        onClose: dismissPrompt,
+        ...(oneClickProviders.length > 0
+          ? {
+              secondaryActionProps: {
                 children: "Settings",
                 onClick: openSettings,
               },
-        actionVariant: "outline",
+              secondaryActionVariant: "outline" as const,
-        data: {
+            }
-          leadingIcon:
+          : {}),
-            updateProviders.length === 1 ? (
+      },
-              <ProviderUpdateToastIcon provider={updateProviders[0]!} />
+    });
-            ) : undefined,
+    if (updateExistingPrompt && activeToast?.kind === "prompt") {
-          hideCopyButton: true,
+      toastId = activeToast.toastId;
-          onClose: dismissPrompt,
+      toastManager.update(toastId, toastOptions);
-          ...(oneClickProviders.length > 0
+    } else {
-            ? {
+      toastId = toastManager.add(toastOptions);
-                secondaryActionProps: {
+    }
-                  children: "Settings",
+    activeToastRef.current = { kind: "prompt", key: notificationKey, toastId, canManageProviders };
-                  onClick: openSettings,
-                },
-                secondaryActionVariant: "outline" as const,
-              }
-            : {}),
-        },
-      }),
-    );
-    activeToastRef.current = { kind: "prompt", key: notificationKey, toastId };
   }, [
+    canManageProviders,
     updateProvider,
     dismissNotificationKey,
     dismissedNotificationKeys,

apps/web/src/components/ServerUpdateAction.test.tsx+87-1

...	@@ -1,8 +1,9 @@	...	@@ -1,8 +1,9 @@
1	import { act, type ReactElement } from "react";	1	import { act, type ReactElement } from "react";
2	import { create, type ReactTestRenderer } from "react-test-renderer";	2	import { create, type ReactTestRenderer } from "react-test-renderer";
3	import { renderToStaticMarkup } from "react-dom/server";	3	import { renderToStaticMarkup } from "react-dom/server";
4	import type { EnvironmentId, ServerInstallation } from "@t3tools/contracts";	4	import { AuthSessionState, type EnvironmentId, type ServerInstallation } from "@t3tools/contracts";
5	import * as Cause from "effect/Cause";	5	import * as Cause from "effect/Cause";
		6	import * as Schema from "effect/Schema";
6	import { AsyncResult } from "effect/reactivity";	7	import { AsyncResult } from "effect/reactivity";
7	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";	8	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
8		9
...	@@ -11,6 +12,8 @@ const testState = vi.hoisted(() => ({	...	@@ -11,6 +12,8 @@ const testState = vi.hoisted(() => ({
11	toast: vi.fn(),	12	toast: vi.fn(),
12	clipboard: vi.fn(),	13	clipboard: vi.fn(),
13	continueThreadsAfterServerUpdate: false,	14	continueThreadsAfterServerUpdate: false,
		15	session: null as AsyncResult.AsyncResult<AuthSessionState, Error> \| null,
		16	sessionAtom: Symbol("session"),
14	}));	17	}));
15		18
16	vi.mock("~/hooks/useCopyToClipboard", () => ({	19	vi.mock("~/hooks/useCopyToClipboard", () => ({
...	@@ -27,6 +30,13 @@ vi.mock("~/hooks/useSettings", () => ({	...	@@ -27,6 +30,13 @@ vi.mock("~/hooks/useSettings", () => ({
27	selector: (settings: { continueThreadsAfterServerUpdate: boolean }) => unknown,	30	selector: (settings: { continueThreadsAfterServerUpdate: boolean }) => unknown,
28	) => selector({ continueThreadsAfterServerUpdate: testState.continueThreadsAfterServerUpdate }),	31	) => selector({ continueThreadsAfterServerUpdate: testState.continueThreadsAfterServerUpdate }),
29	}));	32	}));
		33	vi.mock("@effect/atom-react", () => ({ useAtomValue: () => testState.session }));
		34	vi.mock("~/rpc/atomRegistry", () => ({
		35	appAtomRegistry: { get: () => testState.session },
		36	}));
		37	vi.mock("~/state/session", () => ({
		38	environmentSession: { sessionStateAtom: () => testState.sessionAtom },
		39	}));
30	vi.mock("~/state/server", () => ({	40	vi.mock("~/state/server", () => ({
31	serverEnvironment: { updateServer: Symbol("updateServer") },	41	serverEnvironment: { updateServer: Symbol("updateServer") },
32	}));	42	}));
...	@@ -50,6 +60,8 @@ import {	...	@@ -50,6 +60,8 @@ import {
50	type ServerUpdateTarget,	60	type ServerUpdateTarget,
51	} from "./ServerUpdateAction";	61	} from "./ServerUpdateAction";
52		62
		63	const decodeSessionState = Schema.decodeUnknownSync(AuthSessionState);
		64
53	type ActionElement = ReactElement<{	65	type ActionElement = ReactElement<{
54	readonly onClick?: () => void;	66	readonly onClick?: () => void;
55	}>;	67	}>;
...	@@ -68,12 +80,86 @@ async function flushPromises(): Promise<void> {	...	@@ -68,12 +80,86 @@ async function flushPromises(): Promise<void> {
68	await Promise.resolve();	80	await Promise.resolve();
69	}	81	}
70		82
		83	const legacyAuth = {
		84	policy: "remote-reachable",
		85	bootstrapMethods: ["one-time-token"],
		86	sessionMethods: ["bearer-access-token"],
		87	sessionCookieName: "t3_session",
		88	} as const;
		89
		90	const currentSession = {
		91	authenticated: true,
		92	scopes: ["environment:maintain"],
		93	auth: {
		94	...legacyAuth,
		95	serverUpdateScope: "environment:maintain",
		96	},
		97	} as const satisfies AuthSessionState;
		98
71	describe("ServerUpdateAction", () => {	99	describe("ServerUpdateAction", () => {
72	beforeEach(() => {	100	beforeEach(() => {
73	testState.updateServer.mockReset();	101	testState.updateServer.mockReset();
74	testState.toast.mockReset();	102	testState.toast.mockReset();
75	testState.clipboard.mockReset();	103	testState.clipboard.mockReset();
76	testState.continueThreadsAfterServerUpdate = false;	104	testState.continueThreadsAfterServerUpdate = false;
		105	testState.session = AsyncResult.success(currentSession);
		106	});
		107
		108	it.each([
		109	{ serverUpdateScope: undefined, scopes: ["orchestration:operate"], allowed: true },
		110	{ serverUpdateScope: undefined, scopes: ["orchestration:read"], allowed: false },
		111	{
		112	serverUpdateScope: "environment:maintain",
		113	scopes: ["orchestration:operate"],
		114	allowed: false,
		115	},
		116	{
		117	serverUpdateScope: "environment:maintain",
		118	scopes: ["environment:maintain"],
		119	allowed: true,
		120	},
		121	] as const)(
		122	"uses the advertised update scope $serverUpdateScope with grant $scopes",
		123	async ({ serverUpdateScope, scopes, allowed }) => {
		124	testState.session = AsyncResult.success(
		125	decodeSessionState({
		126	...currentSession,
		127	scopes,
		128	auth: {
		129	...legacyAuth,
		130	...(serverUpdateScope === undefined ? {} : { serverUpdateScope }),
		131	},
		132	}),
		133	);
		134	testState.updateServer.mockResolvedValue(
		135	AsyncResult.success({ targetVersion: "0.0.31", method: "boot-service" as const }),
		136	);
		137
		138	renderAction().props.onClick?.();
		139	await flushPromises();
		140
		141	expect(testState.updateServer).toHaveBeenCalledTimes(allowed ? 1 : 0);
		142	},
		143	);
		144
		145	it("keeps a known grant usable while the session refreshes", async () => {
		146	testState.session = AsyncResult.waiting(AsyncResult.success(currentSession));
		147	testState.updateServer.mockResolvedValue(
		148	AsyncResult.success({ targetVersion: "0.0.31", method: "boot-service" as const }),
		149	);
		150
		151	renderAction().props.onClick?.();
		152	await flushPromises();
		153
		154	expect(testState.updateServer).toHaveBeenCalledOnce();
		155	});
		156
		157	it("does not dispatch an update after maintenance access is removed", async () => {
		158	const action = renderAction();
		159	testState.session = AsyncResult.success({ ...currentSession, scopes: [] });
		160	action.props.onClick?.();
		161	await flushPromises();
		162	expect(testState.updateServer).not.toHaveBeenCalled();
77	});	163	});
78		164
79	it.each([	165	it.each([

apps/web/src/components/ServerUpdateAction.tsx+36-3

 @@ -1,3 +1,7 @@
+import { useAtomValue } from "@effect/atom-react";
+import { AuthOrchestrationOperateScope, type AuthSessionState } from "@t3tools/contracts";
+import type { AsyncResult } from "effect/reactivity";
+import { environmentSession } from "~/state/session";
 import type {
   EnvironmentId,
   ServerInstallation,
 @@ -15,6 +19,7 @@ import { requestConfirmDialog } from "~/confirmDialog";
 import { useCopyToClipboard } from "~/hooks/useCopyToClipboard";
 import { useEnvironmentSettings } from "~/hooks/useSettings";
 import { serverEnvironment, updateOutdatedServer } from "~/state/server";
+import { appAtomRegistry } from "~/rpc/atomRegistry";
 import { useAtomCommand } from "~/state/use-atom-command";
 import { manualServerUpdateCommand } from "~/versionSkew";
 import { Button } from "./ui/button";
 @@ -60,7 +65,11 @@ function useServerUpdate() {
   const updateServer = useAtomCommand(serverEnvironment.updateServer, { reportFailure: false });
   return async (target: ServerUpdateTarget, failureTitle = "Server update failed") => {
     const { environmentId, serverLabel, selfUpdate, targetVersion } = target;
-    if (pendingUpdateEnvironmentIds.has(environmentId)) return;
+    if (
+      !canUpdateServer(appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId))) ||
+      pendingUpdateEnvironmentIds.has(environmentId)
+    )
+      return;
     pendingUpdateEnvironmentIds.add(environmentId);
     try {
       const result = await updateServer({
 @@ -151,6 +160,17 @@ export function ServerUpdatesAction({
   );
 }
+function canUpdateServer(result: AsyncResult.AsyncResult<AuthSessionState, unknown>): boolean {
+  if (result._tag !== "Success" || !result.value.authenticated) return false;
+  const session = result.value;
+  // Only self-update bridges the old authorization protocol. Upgraded servers
+  // advertise the new scope even when this client's grant predates it.
+  return (
+    session.scopes?.includes(session.auth.serverUpdateScope ?? AuthOrchestrationOperateScope) ===
+    true
+  );
+}
 /**
  * One-row status for an in-flight server update: "Downloading…" then
  * "Restarting…". The update is a wait, not a warning: a single pulsing dot
 @@ -204,6 +224,8 @@ export function ServerUpdateAction({
   appearance = "button",
 }: Omit<ServerUpdateTarget, "continueThreadsAfterServerUpdate"> & UpdateButtonProps) {
   const isDesktopAppUpdate = selfUpdate === "desktop-managed";
+  const sessionStateAtom = environmentSession.sessionStateAtom(environmentId);
+  const canUpdate = canUpdateServer(useAtomValue(sessionStateAtom));
   const continueThreadsAfterServerUpdate = useEnvironmentSettings(
     environmentId,
     (settings) => settings.continueThreadsAfterServerUpdate,
 @@ -232,7 +254,10 @@ export function ServerUpdateAction({
   });
   const handleUpdate = async () => {
-    if (pendingUpdateEnvironmentIds.has(environmentId)) {
+    if (
+      !canUpdateServer(appAtomRegistry.get(sessionStateAtom)) ||
+      pendingUpdateEnvironmentIds.has(environmentId)
+    ) {
       return;
     }
     if (isDesktopAppUpdate) {
 @@ -247,6 +272,7 @@ export function ServerUpdateAction({
         return;
       }
     }
+    if (!canUpdateServer(appAtomRegistry.get(sessionStateAtom))) return;
     await update({
       environmentId,
       serverLabel,
 @@ -289,6 +315,7 @@ export function ServerUpdateAction({
               variant="ghost-muted"
               className={className}
               aria-label={`${actionLabel} for ${serverLabel}`}
+              disabled={manualCommand === null && !canUpdate}
               onClick={onClick}
             />
           }
 @@ -301,7 +328,13 @@ export function ServerUpdateAction({
   }
   return (
-    <Button size={size} variant={variant} className={className} onClick={onClick}>
+    <Button
+      size={size}
+      variant={variant}
+      className={className}
+      disabled={manualCommand === null && !canUpdate}
+      onClick={onClick}
+    >
       {actionLabel}
     </Button>
   );

apps/web/src/components/chat/ChatComposer.tsx+26-1

...	@@ -38,6 +38,7 @@ import type {	...	@@ -38,6 +38,7 @@ import type {
38	SnapShotSource,	38	SnapShotSource,
39	} from "@t3tools/contracts";	39	} from "@t3tools/contracts";
40	import {	40	import {
		41	AuthOrchestrationOperateScope,
41	ProviderDriverKind,	42	ProviderDriverKind,
42	ProviderInstanceId,	43	ProviderInstanceId,
43	PROVIDER_SEND_TURN_MAX_ATTACHMENTS,	44	PROVIDER_SEND_TURN_MAX_ATTACHMENTS,
...	@@ -1130,6 +1131,7 @@ import { useDelayedStatus } from "../../hooks/useDelayedStatus";	...	@@ -1130,6 +1131,7 @@ import { useDelayedStatus } from "../../hooks/useDelayedStatus";
1130	import { useMediaQuery } from "../../hooks/useMediaQuery";	1131	import { useMediaQuery } from "../../hooks/useMediaQuery";
1131	import { usePanelAnimationSettings } from "../../panelAnimations";	1132	import { usePanelAnimationSettings } from "../../panelAnimations";
1132	import { useAtomCommand } from "../../state/use-atom-command";	1133	import { useAtomCommand } from "../../state/use-atom-command";
		1134	import { readEnvironmentScope } from "../../state/session";
1133	import { serverEnvironment } from "../../state/server";	1135	import { serverEnvironment } from "../../state/server";
1134	import type { ReviewCommentContext } from "../../reviewCommentContext";	1136	import type { ReviewCommentContext } from "../../reviewCommentContext";
1135		1137
...	@@ -1348,6 +1350,7 @@ const ComposerFooterModeControls = memo(function ComposerFooterModeControls(prop	...	@@ -1348,6 +1350,7 @@ const ComposerFooterModeControls = memo(function ComposerFooterModeControls(prop
1348		1350
1349	const ComposerFooterPrimaryActions = memo(function ComposerFooterPrimaryActions(props: {	1351	const ComposerFooterPrimaryActions = memo(function ComposerFooterPrimaryActions(props: {
1350	compact: boolean;	1352	compact: boolean;
		1353	canOperateThread: boolean;
1351	activeContextWindow: ContextWindowSnapshot \| null;	1354	activeContextWindow: ContextWindowSnapshot \| null;
1352	reserveContextWindowMeter: boolean;	1355	reserveContextWindowMeter: boolean;
1353	activeThreadModelDisplayName: string \| null;	1356	activeThreadModelDisplayName: string \| null;
...	@@ -1397,6 +1400,7 @@ const ComposerFooterPrimaryActions = memo(function ComposerFooterPrimaryActions(	...	@@ -1397,6 +1400,7 @@ const ComposerFooterPrimaryActions = memo(function ComposerFooterPrimaryActions(
1397	) : null}	1400	) : null}
1398	<ComposerPrimaryActions	1401	<ComposerPrimaryActions
1399	compact={props.compact}	1402	compact={props.compact}
		1403	canOperateThread={props.canOperateThread}
1400	pendingAction={props.pendingAction}	1404	pendingAction={props.pendingAction}
1401	isRunning={props.isRunning}	1405	isRunning={props.isRunning}
1402	canInterrupt={props.canInterrupt}	1406	canInterrupt={props.canInterrupt}
...	@@ -1499,6 +1503,7 @@ export interface ChatComposerHandle {	...	@@ -1499,6 +1503,7 @@ export interface ChatComposerHandle {
1499	export interface ChatComposerProps {	1503	export interface ChatComposerProps {
1500	composerDraftTarget: ScopedThreadRef \| DraftId;	1504	composerDraftTarget: ScopedThreadRef \| DraftId;
1501	environmentId: EnvironmentId;	1505	environmentId: EnvironmentId;
		1506	canOperateThread: boolean;
1502	attachmentUploadsCapabilityKnown: boolean;	1507	attachmentUploadsCapabilityKnown: boolean;
1503	supportsAttachmentUploads: boolean;	1508	supportsAttachmentUploads: boolean;
1504	supportsQuestionAttachments: boolean;	1509	supportsQuestionAttachments: boolean;
...	@@ -1685,6 +1690,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -1685,6 +1690,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
1685	const {	1690	const {
1686	composerDraftTarget,	1691	composerDraftTarget,
1687	environmentId,	1692	environmentId,
		1693	canOperateThread,
1688	attachmentUploadsCapabilityKnown,	1694	attachmentUploadsCapabilityKnown,
1689	supportsAttachmentUploads,	1695	supportsAttachmentUploads,
1690	supportsQuestionAttachments,	1696	supportsQuestionAttachments,
...	@@ -2001,6 +2007,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -2001,6 +2007,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
2001	}	2007	}
2002	return;	2008	return;
2003	}	2009	}
		2010	if (!canOperateThread) return;
2004	const invalidFiles =	2011	const invalidFiles =
2005	maxFileAttachmentBytes === null	2012	maxFileAttachmentBytes === null
2006	? composerFiles	2013	? composerFiles
...	@@ -2027,6 +2034,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -2027,6 +2034,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
2027	}, [	2034	}, [
2028	attachmentUploadsCapabilityKnown,	2035	attachmentUploadsCapabilityKnown,
2029	attachmentDraftTarget,	2036	attachmentDraftTarget,
		2037	canOperateThread,
2030	composerFiles,	2038	composerFiles,
2031	composerImages,	2039	composerImages,
2032	environmentId,	2040	environmentId,
...	@@ -4147,7 +4155,11 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -4147,7 +4155,11 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
4147	dispatchMode?: ComposerDispatchMode,	4155	dispatchMode?: ComposerDispatchMode,
4148	submissionIntent?: ComposerSubmissionIntent,	4156	submissionIntent?: ComposerSubmissionIntent,
4149	) => {	4157	) => {
4150	if (noProviderAvailable \|\| isSendDisabled) {	4158	if (
		4159	noProviderAvailable \|\|
		4160	isSendDisabled \|\|
		4161	!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)
		4162	) {
4151	event?.preventDefault();	4163	event?.preventDefault();
4152	return;	4164	return;
4153	}	4165	}
...	@@ -4210,6 +4222,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -4210,6 +4222,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
4210	activePendingProgress,	4222	activePendingProgress,
4211	attachmentTargetKey,	4223	attachmentTargetKey,
4212	blurMobileComposerAfterSend,	4224	blurMobileComposerAfterSend,
		4225	environmentId,
4213	isSendDisabled,	4226	isSendDisabled,
4214	noProviderAvailable,	4227	noProviderAvailable,
4215	onSend,	4228	onSend,
...	@@ -4245,6 +4258,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -4245,6 +4258,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
4245	}, [phase, settings.followUpBehavior, submitComposer]);	4258	}, [phase, settings.followUpBehavior, submitComposer]);
4246	const compactThreadContext = useCallback(() => {	4259	const compactThreadContext = useCallback(() => {
4247	if (	4260	if (
		4261	!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) \|\|
4248	compactDisabled \|\|	4262	compactDisabled \|\|
4249	noProviderAvailable \|\|	4263	noProviderAvailable \|\|
4250	activePendingApproval !== null \|\|	4264	activePendingApproval !== null \|\|
...	@@ -4261,6 +4275,8 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -4261,6 +4275,8 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
4261	activePendingApproval,	4275	activePendingApproval,
4262	activeThreadId,	4276	activeThreadId,
4263	compactDisabled,	4277	compactDisabled,
		4278	composerDraftTarget,
		4279	environmentId,
4264	isConnecting,	4280	isConnecting,
4265	isSendBusy,	4281	isSendBusy,
4266	noProviderAvailable,	4282	noProviderAvailable,
...	@@ -6650,6 +6666,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -6650,6 +6666,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
6650	<ComposerBanner.Actions>	6666	<ComposerBanner.Actions>
6651	<ComposerPendingApprovalActions	6667	<ComposerPendingApprovalActions
6652	requestId={activePendingApproval.requestId}	6668	requestId={activePendingApproval.requestId}
		6669	disabled={!canOperateThread}
6653	isResponding={respondingRequestIds.includes(	6670	isResponding={respondingRequestIds.includes(
6654	activePendingApproval.requestId,	6671	activePendingApproval.requestId,
6655	)}	6672	)}
...	@@ -6662,6 +6679,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -6662,6 +6679,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
6662	) : !isComposerCollapsedMobile && pendingUserInputs.length > 0 ? (	6679	) : !isComposerCollapsedMobile && pendingUserInputs.length > 0 ? (
6663	<ComposerPendingUserInputPanel	6680	<ComposerPendingUserInputPanel
6664	pendingUserInputs={pendingUserInputs}	6681	pendingUserInputs={pendingUserInputs}
		6682	disabled={!canOperateThread}
6665	respondingRequestIds={	6683	respondingRequestIds={
6666	activePendingIsResponding && activePendingUserInput	6684	activePendingIsResponding && activePendingUserInput
6667	? [...respondingRequestIds, activePendingUserInput.requestId]	6685	? [...respondingRequestIds, activePendingUserInput.requestId]
...	@@ -6682,6 +6700,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -6682,6 +6700,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
6682	<div data-chat-composer-collapsed-controls="true">	6700	<div data-chat-composer-collapsed-controls="true">
6683	<ComposerPendingUserInputPanel	6701	<ComposerPendingUserInputPanel
6684	pendingUserInputs={pendingUserInputs}	6702	pendingUserInputs={pendingUserInputs}
		6703	disabled={!canOperateThread}
6685	respondingRequestIds={	6704	respondingRequestIds={
6686	activePendingIsResponding && activePendingUserInput	6705	activePendingIsResponding && activePendingUserInput
6687	? [...respondingRequestIds, activePendingUserInput.requestId]	6706	? [...respondingRequestIds, activePendingUserInput.requestId]
...	@@ -6723,6 +6742,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -6723,6 +6742,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
6723	{activePendingProgress?.activeQuestion?.multiSelect ? (	6742	{activePendingProgress?.activeQuestion?.multiSelect ? (
6724	<ComposerPrimaryActions	6743	<ComposerPrimaryActions
6725	compact	6744	compact
		6745	canOperateThread={canOperateThread}
6726	pendingAction={pendingPrimaryAction}	6746	pendingAction={pendingPrimaryAction}
6727	isRunning={false}	6747	isRunning={false}
6728	canInterrupt={false}	6748	canInterrupt={false}
...	@@ -7079,6 +7099,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -7079,6 +7099,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
7079	draftTarget: attachmentDraftTarget,	7099	draftTarget: attachmentDraftTarget,
7080	})	7100	})
7081	}	7101	}
		7102	disabled={!canOperateThread}
7082	aria-label={`Retry upload for ${image.name}`}	7103	aria-label={`Retry upload for ${image.name}`}
7083	/>	7104	/>
7084	}	7105	}
...	@@ -7178,6 +7199,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -7178,6 +7199,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
7178	draftTarget: attachmentDraftTarget,	7199	draftTarget: attachmentDraftTarget,
7179	})	7200	})
7180	}	7201	}
		7202	disabled={!canOperateThread}
7181	aria-label={`Retry upload for ${file.name}`}	7203	aria-label={`Retry upload for ${file.name}`}
7182	/>	7204	/>
7183	}	7205	}
...	@@ -7256,6 +7278,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -7256,6 +7278,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
7256	draftTarget: attachmentDraftTarget,	7278	draftTarget: attachmentDraftTarget,
7257	})	7279	})
7258	}	7280	}
		7281	disabled={!canOperateThread}
7259	aria-label={`Retry upload for ${file.name}`}	7282	aria-label={`Retry upload for ${file.name}`}
7260	/>	7283	/>
7261	}	7284	}
...	@@ -7408,6 +7431,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -7408,6 +7431,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
7408	>	7431	>
7409	<ComposerPrimaryActions	7432	<ComposerPrimaryActions
7410	compact	7433	compact
		7434	canOperateThread={canOperateThread}
7411	pendingAction={pendingPrimaryAction}	7435	pendingAction={pendingPrimaryAction}
7412	isRunning={false}	7436	isRunning={false}
7413	canInterrupt={false}	7437	canInterrupt={false}
...	@@ -7513,6 +7537,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)	...	@@ -7513,6 +7537,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
7513	) : null}	7537	) : null}
7514	<ComposerFooterPrimaryActions	7538	<ComposerFooterPrimaryActions
7515	compact={isComposerResting \|\| isComposerPrimaryActionsCompact}	7539	compact={isComposerResting \|\| isComposerPrimaryActionsCompact}
		7540	canOperateThread={canOperateThread}
7516	activeContextWindow={	7541	activeContextWindow={
7517	settings.contextWindowMeterEnabled ? activeContextWindow : null	7542	settings.contextWindowMeterEnabled ? activeContextWindow : null
7518	}	7543	}

apps/web/src/components/chat/ComposerPendingApprovalActions.tsx+14-5

 @@ -14,6 +14,7 @@ interface ComposerPendingApprovalActionsProps {
   requestId: RuntimeRequestId;
   isResponding: boolean;
   canRespond: boolean;
+  disabled?: boolean;
   options?: ReadonlyArray<ProviderApprovalOption> | undefined;
   onRespondToApproval: (
     requestId: RuntimeRequestId,
 @@ -32,6 +33,7 @@ export const ComposerPendingApprovalActions = memo(function ComposerPendingAppro
   requestId,
   isResponding,
   canRespond,
+  disabled = false,
   options = DEFAULT_APPROVAL_OPTIONS,
   onRespondToApproval,
 }: ComposerPendingApprovalActionsProps) {
 @@ -50,9 +52,13 @@ export const ComposerPendingApprovalActions = memo(function ComposerPendingAppro
             key={option.decision}
             size="xs"
             variant={option.decision === "accept" ? "default" : "outline"}
-            disabled={isResponding || !canRespond}
+            disabled={disabled || isResponding || !canRespond}
             aria-description={option.warning}
-            onClick={() => void onRespondToApproval(requestId, option.decision)}
+            onClick={() => {
+              if (!disabled && !isResponding) {
+                void onRespondToApproval(requestId, option.decision);
+              }
+            }}
           >
             {option.warning ? <TriangleAlertIcon className="size-3 shrink-0" /> : null}
             <span className="max-w-40 truncate">{option.label}</span>
 @@ -70,7 +76,7 @@ export const ComposerPendingApprovalActions = memo(function ComposerPendingAppro
       {moreOptions.length > 0 ? (
         <Menu>
           <MenuTrigger
-            disabled={isResponding}
+            disabled={disabled || isResponding}
             render={<Button size="icon-xs" variant="outline" aria-label="More approval options" />}
           >
             <EllipsisIcon />
 @@ -80,9 +86,12 @@ export const ComposerPendingApprovalActions = memo(function ComposerPendingAppro
               const item = (
                 <MenuItem
                   key={option.decision}
-                  disabled={isResponding}
+                  disabled={disabled || isResponding}
                   aria-description={option.warning}
-                  onClick={() => void onRespondToApproval(requestId, option.decision)}
+                  onClick={() => {
+                    if (!disabled && !isResponding)
+                      void onRespondToApproval(requestId, option.decision);
+                  }}
                   variant="ghost"
                   className="mb-1 last:mb-0"
                 >

apps/web/src/components/chat/ComposerPendingUserInputPanel.permissions.test.tsx created+93

...	@@ -0,0 +1,93 @@
1	import { RuntimeRequestId } from "@t3tools/contracts";
2	import { act, type ReactNode } from "react";
3	import { create, type ReactTestRenderer } from "react-test-renderer";
4	import { expect, it, vi } from "vite-plus/test";
5
6	vi.mock("../ui/collapsible", () => {
7	const Children = ({ children }: { children: ReactNode }) => <>{children}</>;
8	return {
9	Collapsible: Children,
10	CollapsiblePanel: Children,
11	CollapsibleTrigger: Children,
12	};
13	});
14
15	import { ComposerPendingUserInputPanel } from "./ComposerPendingUserInputPanel";
16
17	it("cancels an answer's pending auto-submit on revocation and resumes after a new grant", async () => {
18	vi.useFakeTimers();
19	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
20	vi.stubGlobal("window", {
21	setTimeout: globalThis.setTimeout,
22	clearTimeout: globalThis.clearTimeout,
23	});
24	vi.stubGlobal("document", { addEventListener: vi.fn(), removeEventListener: vi.fn() });
25	const onToggleOption = vi.fn();
26	const onAdvance = vi.fn();
27	const onDismiss = vi.fn();
28	const prompt = {
29	requestId: RuntimeRequestId.make("scoped-answer"),
30	createdAt: "2026-09-05T00:00:00.000Z",
31	dismissible: false,
32	responseCapability: "live" as const,
33	questions: [
34	{
35	id: "approach",
36	header: "Approach",
37	question: "Which approach?",
38	options: [{ label: "Incremental", description: "One module at a time" }],
39	multiSelect: false,
40	},
41	],
42	};
43	const panel = (disabled: boolean) => (
44	<ComposerPendingUserInputPanel
45	pendingUserInputs={[prompt]}
46	disabled={disabled}
47	respondingRequestIds={[]}
48	answers={{}}
49	questionIndex={0}
50	onToggleOption={onToggleOption}
51	onAdvance={onAdvance}
52	onDismiss={onDismiss}
53	/>
54	);
55	let renderer: ReactTestRenderer \| undefined;
56	const chooseOption = () => {
57	const option = renderer!.root
58	.findAllByType("button")
59	.find((button) =>
60	button.findAllByType("span").some((span) => span.children.includes("Incremental")),
61	);
62	expect(option).toBeDefined();
63	option!.props.onClick();
64	};
65	try {
66	await act(async () => {
67	renderer = create(panel(false));
68	});
69	await act(async () => chooseOption());
70	expect(onToggleOption).toHaveBeenCalledWith("approach", "Incremental");
71	expect(onAdvance).not.toHaveBeenCalled();
72
73	await act(async () => renderer!.update(panel(true)));
74	await act(async () => {
75	chooseOption();
76	vi.runAllTimers();
77	});
78	expect(onToggleOption).toHaveBeenCalledTimes(1);
79	expect(onAdvance).not.toHaveBeenCalled();
80
81	await act(async () => renderer!.update(panel(false)));
82	await act(async () => {
83	chooseOption();
84	vi.runAllTimers();
85	});
86	expect(onToggleOption).toHaveBeenCalledTimes(2);
87	expect(onAdvance).toHaveBeenCalledTimes(1);
88	} finally {
89	await act(async () => renderer?.unmount());
90	vi.unstubAllGlobals();
91	vi.useRealTimers();
92	}
93	});

apps/web/src/components/chat/ComposerPendingUserInputPanel.tsx+18-5

...	@@ -12,6 +12,7 @@ import { ComposerBanner } from "./ComposerBanner";	...	@@ -12,6 +12,7 @@ import { ComposerBanner } from "./ComposerBanner";
12		12
13	interface PendingUserInputPanelProps {	13	interface PendingUserInputPanelProps {
14	pendingUserInputs: PendingUserInput[];	14	pendingUserInputs: PendingUserInput[];
		15	disabled?: boolean;
15	respondingRequestIds: RuntimeRequestId[];	16	respondingRequestIds: RuntimeRequestId[];
16	answers: Record<string, PendingUserInputDraftAnswer>;	17	answers: Record<string, PendingUserInputDraftAnswer>;
17	questionIndex: number;	18	questionIndex: number;
...	@@ -22,6 +23,7 @@ interface PendingUserInputPanelProps {	...	@@ -22,6 +23,7 @@ interface PendingUserInputPanelProps {
22		23
23	export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserInputPanel({	24	export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserInputPanel({
24	pendingUserInputs,	25	pendingUserInputs,
		26	disabled = false,
25	respondingRequestIds,	27	respondingRequestIds,
26	answers,	28	answers,
27	questionIndex,	29	questionIndex,
...	@@ -37,6 +39,7 @@ export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserIn	...	@@ -37,6 +39,7 @@ export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserIn
37	<ComposerPendingUserInputCard	39	<ComposerPendingUserInputCard
38	key={activePrompt.requestId}	40	key={activePrompt.requestId}
39	prompt={activePrompt}	41	prompt={activePrompt}
		42	disabled={disabled}
40	isResponding={respondingRequestIds.includes(activePrompt.requestId)}	43	isResponding={respondingRequestIds.includes(activePrompt.requestId)}
41	answers={answers}	44	answers={answers}
42	questionIndex={questionIndex}	45	questionIndex={questionIndex}
...	@@ -49,6 +52,7 @@ export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserIn	...	@@ -49,6 +52,7 @@ export const ComposerPendingUserInputPanel = memo(function ComposerPendingUserIn
49		52
50	const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard({	53	const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard({
51	prompt,	54	prompt,
		55	disabled,
52	isResponding,	56	isResponding,
53	answers,	57	answers,
54	questionIndex,	58	questionIndex,
...	@@ -57,6 +61,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -57,6 +61,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
57	onDismiss,	61	onDismiss,
58	}: {	62	}: {
59	prompt: PendingUserInput;	63	prompt: PendingUserInput;
		64	disabled: boolean;
60	isResponding: boolean;	65	isResponding: boolean;
61	answers: Record<string, PendingUserInputDraftAnswer>;	66	answers: Record<string, PendingUserInputDraftAnswer>;
62	questionIndex: number;	67	questionIndex: number;
...	@@ -66,7 +71,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -66,7 +71,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
66	}) {	71	}) {
67	// Message-mode requests remain answerable after their provider turn ends.	72	// Message-mode requests remain answerable after their provider turn ends.
68	const canRespond = prompt.responseCapability !== "not_resumable";	73	const canRespond = prompt.responseCapability !== "not_resumable";
69	const responseDisabled = isResponding \|\| !canRespond;	74	const responseDisabled = disabled \|\| isResponding \|\| !canRespond;
70	const progress = derivePendingUserInputProgress(prompt.questions, answers, questionIndex);	75	const progress = derivePendingUserInputProgress(prompt.questions, answers, questionIndex);
71	const activeQuestion = progress.activeQuestion;	76	const activeQuestion = progress.activeQuestion;
72	const autoAdvanceTimerRef = useRef<number \| null>(null);	77	const autoAdvanceTimerRef = useRef<number \| null>(null);
...	@@ -88,6 +93,13 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -88,6 +93,13 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
88	onAdvanceRef.current = onAdvance;	93	onAdvanceRef.current = onAdvance;
89	}, [onAdvance]);	94	}, [onAdvance]);
90		95
		96	useEffect(() => {
		97	if (disabled && autoAdvanceTimerRef.current !== null) {
		98	window.clearTimeout(autoAdvanceTimerRef.current);
		99	autoAdvanceTimerRef.current = null;
		100	}
		101	}, [disabled]);
		102
91	useEffect(() => {	103	useEffect(() => {
92	if (!activeQuestion \|\| activeQuestion.multiSelect \|\| !optimisticSingleSelect) {	104	if (!activeQuestion \|\| activeQuestion.multiSelect \|\| !optimisticSingleSelect) {
93	return;	105	return;
...	@@ -120,6 +132,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -120,6 +132,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
120		132
121	const handleOptionSelection = useCallback(	133	const handleOptionSelection = useCallback(
122	(questionId: string, optionValue: string) => {	134	(questionId: string, optionValue: string) => {
		135	if (disabled \|\| isResponding) return;
123	if (activeQuestion?.multiSelect) {	136	if (activeQuestion?.multiSelect) {
124	onToggleOption(questionId, optionValue);	137	onToggleOption(questionId, optionValue);
125	return;	138	return;
...	@@ -134,7 +147,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -134,7 +147,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
134	onAdvanceRef.current();	147	onAdvanceRef.current();
135	}, 200);	148	}, 200);
136	},	149	},
137	[activeQuestion, onToggleOption],	150	[activeQuestion, disabled, isResponding, onToggleOption],
138	);	151	);
139		152
140	// Keyboard shortcut: number keys 1-9 select corresponding options when focus is	153	// Keyboard shortcut: number keys 1-9 select corresponding options when focus is
...	@@ -252,8 +265,8 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -252,8 +265,8 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
252	isSelected	265	isSelected
253	? "bg-muted/55 text-foreground"	266	? "bg-muted/55 text-foreground"
254	: "bg-transparent text-foreground/85 hover:bg-muted/30",	267	: "bg-transparent text-foreground/85 hover:bg-muted/30",
255	isResponding && "opacity-50 cursor-not-allowed",	268	(disabled \|\| isResponding) && "opacity-50 cursor-not-allowed",
256	!isResponding && "cursor-pointer",	269	!disabled && !isResponding && "cursor-pointer",
257	);	270	);
258	const content = (	271	const content = (
259	<>	272	<>
...	@@ -280,7 +293,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(	...	@@ -280,7 +293,7 @@ const ComposerPendingUserInputCard = memo(function ComposerPendingUserInputCard(
280	<button	293	<button
281	key={`${activeQuestion.id}:${optionValue}`}	294	key={`${activeQuestion.id}:${optionValue}`}
282	type="button"	295	type="button"
283	disabled={isResponding}	296	disabled={disabled \|\| isResponding}
284	onClick={() => {	297	onClick={() => {
285	handleOptionSelection(activeQuestion.id, optionValue);	298	handleOptionSelection(activeQuestion.id, optionValue);
286	}}	299	}}

apps/web/src/components/chat/ComposerPrimaryActions.test.tsx+2

...	@@ -21,6 +21,7 @@ function renderPendingActions(isRunning: boolean) {	...	@@ -21,6 +21,7 @@ function renderPendingActions(isRunning: boolean) {
21	return renderToStaticMarkup(	21	return renderToStaticMarkup(
22	createElement(ComposerPrimaryActions, {	22	createElement(ComposerPrimaryActions, {
23	compact: true,	23	compact: true,
		24	canOperateThread: true,
24	pendingAction: {	25	pendingAction: {
25	questionIndex: 0,	26	questionIndex: 0,
26	isLastQuestion: true,	27	isLastQuestion: true,
...	@@ -49,6 +50,7 @@ function renderSendButton(sendDisabledReason: string \| null = null) {	...	@@ -49,6 +50,7 @@ function renderSendButton(sendDisabledReason: string \| null = null) {
49	return renderToStaticMarkup(	50	return renderToStaticMarkup(
50	createElement(ComposerPrimaryActions, {	51	createElement(ComposerPrimaryActions, {
51	compact: true,	52	compact: true,
		53	canOperateThread: true,
52	pendingAction: null,	54	pendingAction: null,
53	isRunning: false,	55	isRunning: false,
54	canInterrupt: false,	56	canInterrupt: false,

apps/web/src/components/chat/ComposerPrimaryActions.tsx+11-3

...	@@ -26,6 +26,7 @@ interface PendingActionState {	...	@@ -26,6 +26,7 @@ interface PendingActionState {
26		26
27	interface ComposerPrimaryActionsProps {	27	interface ComposerPrimaryActionsProps {
28	compact: boolean;	28	compact: boolean;
		29	canOperateThread: boolean;
29	pendingAction: PendingActionState \| null;	30	pendingAction: PendingActionState \| null;
30	/** The turn is running: sending steers or queues instead of starting a turn. */	31	/** The turn is running: sending steers or queues instead of starting a turn. */
31	isRunning: boolean;	32	isRunning: boolean;
...	@@ -80,6 +81,7 @@ const preventPointerFocus: PointerEventHandler<HTMLElement> = (event) => {	...	@@ -80,6 +81,7 @@ const preventPointerFocus: PointerEventHandler<HTMLElement> = (event) => {
80		81
81	export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({	82	export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({
82	compact,	83	compact,
		84	canOperateThread,
83	pendingAction,	85	pendingAction,
84	isRunning,	86	isRunning,
85	canInterrupt,	87	canInterrupt,
...	@@ -115,7 +117,7 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({	...	@@ -115,7 +117,7 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({
115	alternateModifier: shortcutModifiers.metaKey \|\| shortcutModifiers.ctrlKey,	117	alternateModifier: shortcutModifiers.metaKey \|\| shortcutModifiers.ctrlKey,
116	}) === "queue";	118	}) === "queue";
117	const alternateAction = alternateComposerDispatchAction(followUpBehavior);	119	const alternateAction = alternateComposerDispatchAction(followUpBehavior);
118	const isSendDisabled = sendDisabledReason !== null;	120	const isSendDisabled = !canOperateThread \|\| sendDisabledReason !== null;
119	const stageBackdropVariant = useSidebarStageBackdropVariant(	121	const stageBackdropVariant = useSidebarStageBackdropVariant(
120	environmentIdentificationMode === "artwork",	122	environmentIdentificationMode === "artwork",
121	);	123	);
...	@@ -131,7 +133,10 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({	...	@@ -131,7 +133,10 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({
131	insidePendingAction ? "size-8 sm:size-7" : "size-8 sm:h-8 sm:w-8",	133	insidePendingAction ? "size-8 sm:size-7" : "size-8 sm:h-8 sm:w-8",
132	)}	134	)}
133	{...pointerFocusProps}	135	{...pointerFocusProps}
134	onClick={onInterrupt}	136	disabled={!canOperateThread}
		137	onClick={() => {
		138	if (canOperateThread) onInterrupt();
		139	}}
135	aria-label="Stop generation"	140	aria-label="Stop generation"
136	/>	141	/>
137	}	142	}
...	@@ -177,6 +182,7 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({	...	@@ -177,6 +182,7 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({
177	className={cn(messageActionPillClassName, "h-8 sm:h-7", compact ? "px-3" : "px-4")}	182	className={cn(messageActionPillClassName, "h-8 sm:h-7", compact ? "px-3" : "px-4")}
178	{...pointerFocusProps}	183	{...pointerFocusProps}
179	disabled={	184	disabled={
		185	!canOperateThread \|\|
180	isEnvironmentUnavailable \|\|	186	isEnvironmentUnavailable \|\|
181	pendingAction.isResponding \|\|	187	pendingAction.isResponding \|\|
182	(pendingAction.isLastQuestion ? !pendingAction.isComplete : !pendingAction.canAdvance)	188	(pendingAction.isLastQuestion ? !pendingAction.isComplete : !pendingAction.canAdvance)
...	@@ -237,7 +243,9 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({	...	@@ -237,7 +243,9 @@ export const ComposerPrimaryActions = memo(function ComposerPrimaryActions({
237	<MenuPopup align="end" side="top" {...composerFloatingLayerProps}>	243	<MenuPopup align="end" side="top" {...composerFloatingLayerProps}>
238	<MenuItem	244	<MenuItem
239	disabled={isSendBusy \|\| isSendDisabled \|\| isConnecting \|\| isEnvironmentUnavailable}	245	disabled={isSendBusy \|\| isSendDisabled \|\| isConnecting \|\| isEnvironmentUnavailable}
240	onClick={() => void onImplementPlanInNewThread()}	246	onClick={() => {
		247	if (canOperateThread) onImplementPlanInNewThread();
		248	}}
241	>	249	>
242	Implement in a new thread	250	Implement in a new thread
243	</MenuItem>	251	</MenuItem>

apps/web/src/components/chat/OpenInPicker.test.tsx created+226

...	@@ -0,0 +1,226 @@
1	import { AuthOrchestrationOperateScope, EnvironmentId, type EditorId } from "@t3tools/contracts";
2	import { DEFAULT_RESOLVED_KEYBINDINGS } from "@t3tools/shared/keybindings";
3	import { AsyncResult } from "effect/reactivity";
4	import { cloneElement, useState, type ReactElement, type ReactNode } from "react";
5	import { act, create, type ReactTestRenderer } from "react-test-renderer";
6	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
7
8	import type { RemoteOpenState } from "../../remoteOpen";
9
10	const state = vi.hoisted(() => ({
11	allowed: new Set<string>(),
12	remote: { mode: "local-exec" } as RemoteOpenState,
13	run: vi.fn(),
14	openUrl: vi.fn(),
15	setPreferred: vi.fn(),
16	markHintSeen: vi.fn(),
17	keydown: null as ((event: KeyboardEvent) => void) \| null,
18	listeners: new Set<() => void>(),
19	}));
20
21	vi.mock("../../state/session", async () => {
22	const { useSyncExternalStore } = await import("react");
23	const readEnvironmentScope = (environmentId: string, scope: string) =>
24	scope === AuthOrchestrationOperateScope && state.allowed.has(environmentId);
25	return {
26	readEnvironmentScope,
27	useEnvironmentScope: (environmentId: string, scope: string) =>
28	useSyncExternalStore(
29	(listener) => {
30	state.listeners.add(listener);
31	return () => state.listeners.delete(listener);
32	},
33	() => readEnvironmentScope(environmentId, scope),
34	),
35	};
36	});
37	vi.mock("../../state/shell", () => ({ shellEnvironment: { openInEditor: "openInEditor" } }));
38	vi.mock("../../state/use-atom-command", () => ({ useAtomCommand: () => state.run }));
39	vi.mock("../../state/environments", () => ({ useEnvironment: () => ({ label: "Test host" }) }));
40	vi.mock("../../editorPreferences", () => ({
41	usePreferredEditor: (available: readonly EditorId[]) => [
42	available[0] ?? null,
43	state.setPreferred,
44	],
45	}));
46	vi.mock("../../remoteOpen", () => ({
47	useRemoteOpenState: () => state.remote,
48	useRemoteCapableEditors: () => editors,
49	useRemoteOpenHint: () => [false, state.markHintSeen],
50	openRemoteEditorUrl: state.openUrl,
51	}));
52	vi.mock("../../keybindings", () => ({
53	isOpenFavoriteEditorShortcut: () => true,
54	shortcutLabelForCommand: () => "Ctrl+O",
55	}));
56	vi.mock("../ui/button", () => ({ Button: "button" }));
57	vi.mock("../ui/group", () => ({ Group: "div", GroupSeparator: "span" }));
58	vi.mock("../ui/menu", () => ({
59	Menu: ({
60	open,
61	onOpenChange,
62	children,
63	}: {
64	open?: boolean;
65	onOpenChange?: (open: boolean) => void;
66	children: ReactNode;
67	}) => {
68	const [uncontrolledOpen, setUncontrolledOpen] = useState(false);
69	const visible = open ?? uncontrolledOpen;
70	return (
71	<div
72	data-menu-open={visible}
73	onDoubleClick={() => {
74	setUncontrolledOpen(!visible);
75	onOpenChange?.(!visible);
76	}}
77	>
78	{children}
79	</div>
80	);
81	},
82	MenuTrigger: ({
83	render,
84	children,
85	disabled,
86	}: {
87	render: ReactElement<{ disabled?: boolean }>;
88	children: ReactNode;
89	disabled?: boolean;
90	}) => cloneElement(render, disabled === undefined ? {} : { disabled }, children),
91	MenuPopup: "section",
92	MenuItem: "button",
93	MenuItemLabel: "span",
94	MenuShortcut: "span",
95	}));
96
97	import { OpenInPicker } from "./OpenInPicker";
98
99	const primary = EnvironmentId.make("primary");
100	const selected = EnvironmentId.make("selected");
101	const editors: readonly EditorId[] = ["vscode"];
102	let renderer: ReactTestRenderer \| undefined;
103
104	beforeEach(() => {
105	state.allowed.clear();
106	state.remote = { mode: "local-exec" };
107	state.run.mockReset().mockResolvedValue(AsyncResult.success(undefined));
108	state.openUrl.mockReset().mockResolvedValue(true);
109	state.setPreferred.mockReset();
110	state.markHintSeen.mockReset();
111	state.keydown = null;
112	state.listeners.clear();
113	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
114	vi.stubGlobal("navigator", { platform: "Linux" });
115	vi.stubGlobal("window", {
116	addEventListener: (_type: string, callback: (event: KeyboardEvent) => void) => {
117	state.keydown = callback;
118	},
119	removeEventListener: (_type: string, callback: (event: KeyboardEvent) => void) => {
120	if (state.keydown === callback) state.keydown = null;
121	},
122	});
123	});
124
125	afterEach(async () => {
126	await act(async () => renderer?.unmount());
127	renderer = undefined;
128	vi.unstubAllGlobals();
129	});
130
131	async function renderPicker() {
132	await act(async () => {
133	for (const listener of state.listeners) listener();
134	const node = (
135	<OpenInPicker
136	environmentId={selected}
137	keybindings={DEFAULT_RESOLVED_KEYBINDINGS}
138	availableEditors={editors}
139	openInCwd="/work/project"
140	compact
141	/>
142	);
143	if (renderer) renderer.update(node);
144	else renderer = create(node);
145	});
146	}
147
148	function primaryButton() {
149	return renderer!.root.findByProps({ "aria-label": "Open file in preferred editor" });
150	}
151
152	function keyboardEvent() {
153	return { preventDefault: vi.fn() } as unknown as KeyboardEvent;
154	}
155
156	describe("host editor access", () => {
157	it("uses the selected grant for both the button and a retained shortcut", async () => {
158	state.allowed.add(selected);
159	await renderPicker();
160	const open = primaryButton().props.onClick;
161	const keydown = state.keydown!;
162	state.allowed.delete(selected);
163	state.allowed.add(primary);
164	const event = keyboardEvent();
165	await act(async () => {
166	open();
167	keydown(event);
168	});
169	expect(state.run).not.toHaveBeenCalled();
170	expect(state.setPreferred).not.toHaveBeenCalled();
171	expect(event.preventDefault).not.toHaveBeenCalled();
172
173	await renderPicker();
174	expect(primaryButton().props.disabled).toBe(true);
175	expect(renderer!.root.findByProps({ "aria-label": "Choose editor" }).props.disabled).toBe(true);
176	expect(state.keydown).toBeNull();
177	});
178
179	it("closes an open picker on revocation and launches only after a fresh grant", async () => {
180	state.allowed.add(selected);
181	await renderPicker();
182	await act(async () => {
183	renderer!.root.findByProps({ "data-menu-open": false }).props.onDoubleClick();
184	});
185	expect(renderer!.root.findByProps({ "data-menu-open": true })).toBeDefined();
186	state.allowed.delete(selected);
187	await renderPicker();
188	expect(renderer!.root.findByProps({ "data-menu-open": false })).toBeDefined();
189	state.allowed.add(selected);
190	await renderPicker();
191	expect(renderer!.root.findByProps({ "data-menu-open": false })).toBeDefined();
192	await act(async () => primaryButton().props.onClick());
193	expect(state.run).toHaveBeenCalledExactlyOnceWith({
194	environmentId: selected,
195	input: { cwd: "/work/project", editor: "vscode" },
196	});
197	});
198	});
199
200	describe("client editor links", () => {
201	it("opens an SSH editor URL without host operate permission", async () => {
202	state.remote = { mode: "remote-links", host: { kind: "ssh-alias", host: "test-host" } };
203	await renderPicker();
204	expect(primaryButton().props.disabled).toBe(false);
205	await act(async () => primaryButton().props.onClick());
206	expect(state.openUrl).toHaveBeenCalledExactlyOnceWith(
207	"vscode://vscode-remote/ssh-remote+test-host/work/project",
208	);
209	expect(state.run).not.toHaveBeenCalled();
210	expect(state.markHintSeen).toHaveBeenCalledOnce();
211	expect(state.setPreferred).toHaveBeenCalledExactlyOnceWith("vscode");
212	});
213
214	it("does not change preferences when the client rejects the SSH URL", async () => {
215	state.remote = { mode: "remote-links", host: { kind: "ssh-alias", host: "test-host" } };
216	state.openUrl.mockResolvedValue(false);
217	await renderPicker();
218	const event = keyboardEvent();
219	await act(async () => state.keydown!(event));
220	expect(state.openUrl).toHaveBeenCalledOnce();
221	expect(event.preventDefault).toHaveBeenCalledOnce();
222	expect(state.run).not.toHaveBeenCalled();
223	expect(state.setPreferred).not.toHaveBeenCalled();
224	expect(state.markHintSeen).not.toHaveBeenCalled();
225	});
226	});

apps/web/src/components/chat/OpenInPicker.tsx+30-6

 @@ -1,5 +1,6 @@
 import { ThreadDetailsControl } from "./ThreadDetailsControl";
 import {
+  AuthOrchestrationOperateScope,
   buildRemoteOpenUrl,
   EditorId,
   type EnvironmentId,
 @@ -66,6 +67,8 @@ import {
   THREAD_DETAILS_PANEL_SPLIT_GROUP_CLASS,
   THREAD_DETAILS_PANEL_SPLIT_SEPARATOR_CLASS,
 } from "./threadDetailsPanelStyles";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
+import { useComposerMenuState } from "./useComposerMenuState";
 type OpenInOption = {
   label: string;
 @@ -223,6 +226,10 @@ export const OpenInPicker = memo(function OpenInPicker({
   const panelAnchorRef = useRef<HTMLDivElement | null>(null);
   const openInEditorMutation = useAtomCommand(shellEnvironment.openInEditor, "open in editor");
   const remote = useRemoteOpenState(environmentId);
+  const canOperateHost = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
+  const isHostEditorDenied = remote.mode === "local-exec" && !canOperateHost;
+  const canOpenEditor = remote.mode !== "remote-unavailable" && !isHostEditorDenied;
+  const [menuOpen, setMenuOpen] = useComposerMenuState(isHostEditorDenied);
   const remoteCapableEditors = useRemoteCapableEditors();
   const [remoteHintSeen, markRemoteHintSeen] = useRemoteOpenHint();
   const environmentLabel = useEnvironment(environmentId)?.label ?? "this machine";
 @@ -258,6 +265,7 @@ export const OpenInPicker = memo(function OpenInPicker({
         });
         return;
       }
+      if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
       const result = openInEditorMutation({
         environmentId,
         input: {
 @@ -285,18 +293,32 @@ export const OpenInPicker = memo(function OpenInPicker({
   );
   useEffect(() => {
-    if (!enableShortcut) return;
+    if (!enableShortcut || !canOpenEditor) return;
     const handler = (e: globalThis.KeyboardEvent) => {
       if (!isOpenFavoriteEditorShortcut(e, keybindings)) return;
       if (!openInCwd) return;
       if (!preferredEditor) return;
+      if (
+        remote.mode === "local-exec" &&
+        !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)
+      )
+        return;
       e.preventDefault();
       void openInEditor(preferredEditor);
     };
     window.addEventListener("keydown", handler);
     return () => window.removeEventListener("keydown", handler);
-  }, [enableShortcut, keybindings, openInCwd, openInEditor, preferredEditor]);
+  }, [
+    canOpenEditor,
+    enableShortcut,
+    environmentId,
+    keybindings,
+    openInCwd,
+    openInEditor,
+    preferredEditor,
+    remote.mode,
+  ]);
   const primaryLabel = isPanel ? `Open in ${primaryOption?.label ?? "editor"}` : "Open";
   const editorItems = (
 @@ -315,6 +337,7 @@ export const OpenInPicker = memo(function OpenInPicker({
           {options.map(({ label, Icon, value, kind }) => (
             <MenuItem
               density={presentation === "menu" ? "touch" : "default"}
+              disabled={!openInCwd || !canOpenEditor}
               key={value}
               onClick={() => openInEditor(value)}
             >
 @@ -341,7 +364,7 @@ export const OpenInPicker = memo(function OpenInPicker({
           <MenuItem
             density={presentation === "menu" ? "touch" : "default"}
-            disabled={!openInCwd || remote.mode === "remote-unavailable"}
+            disabled={!openInCwd || !canOpenEditor}
             onClick={() => openInEditor(preferredEditor)}
           >
             <primaryOption.Icon className={cn("size-4", getOpenInIconClass(primaryOption.kind))} />
 @@ -352,7 +375,7 @@ export const OpenInPicker = memo(function OpenInPicker({
           </MenuItem>
         )}
         <MenuSub>
-          <MenuSubTrigger density="touch">
+          <MenuSubTrigger density="touch" disabled={isHostEditorDenied}>
             <SquareArrowOutUpRightIcon className="size-4" />
             <MenuItemLabel>Open in…</MenuItemLabel>
           </MenuSubTrigger>
 @@ -376,7 +399,7 @@ export const OpenInPicker = memo(function OpenInPicker({
         variant={isPanel ? "ghost" : "outline"}
         part="primary"
         panel={isPanel}
-        disabled={!preferredEditor || !openInCwd || remote.mode === "remote-unavailable"}
+        disabled={!preferredEditor || !openInCwd || !canOpenEditor}
         onClick={() => openInEditor(preferredEditor)}
       >
         {primaryOption?.Icon ? (
 @@ -409,8 +432,9 @@ export const OpenInPicker = memo(function OpenInPicker({
       ) : (
         <GroupSeparator {...(!compact ? { className: "hidden @3xl/header-actions:block" } : {})} />
       )}
-      <Menu>
+      <Menu open={menuOpen} onOpenChange={setMenuOpen}>
         <MenuTrigger
+          disabled={isHostEditorDenied}
           render={
             <ThreadDetailsControl
               aria-label="Choose editor"

apps/web/src/components/chat/ThreadAutomationsPanel.permissions.test.tsx created+84

...	@@ -0,0 +1,84 @@
1	import { EnvironmentId, ThreadId, ScheduledTaskId, type ScheduledTask } from "@t3tools/contracts";
2	import { act, create, type ReactTestRenderer } from "react-test-renderer";
3	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
4
5	const state = vi.hoisted(() => ({ allowed: true, toggle: vi.fn(), run: vi.fn() }));
6	vi.mock("../../state/session", () => ({
7	useEnvironmentScope: () => state.allowed,
8	readEnvironmentScope: () => state.allowed,
9	}));
10	vi.mock("@effect/atom-react", () => ({ useAtomValue: () => state.allowed }));
11	vi.mock("@tanstack/react-router", () => ({ useNavigate: () => vi.fn() }));
12	vi.mock("../settings/ScheduledTasksSettings", () => ({
13	relativeLabel: () => "later",
14	scheduleLabel: () => "daily",
15	}));
16	vi.mock("../../state/server", () => ({
17	serverEnvironment: {
18	scheduledTasksLive: () => null,
19	setScheduledTaskEnabled: "toggle",
20	runScheduledTaskNow: { permissionAtom: () => null },
21	},
22	}));
23	vi.mock("../../state/use-atom-command", () => ({
24	useAtomCommand: (command: string) => (command === "toggle" ? state.toggle : state.run),
25	}));
26	vi.mock("../../state/query", () => ({
27	useEnvironmentQuery: () => ({ data: { tasks: [task] }, error: null }),
28	}));
29	vi.mock("../ui/tooltip", () => ({
30	Tooltip: ({ children }: { children: React.ReactNode }) => children,
31	TooltipTrigger: ({ render }: { render: React.ReactNode }) => render,
32	TooltipPopup: () => null,
33	}));
34	vi.mock("../ui/toast", () => ({
35	toastManager: { add: vi.fn() },
36	stackedThreadToast: (x: unknown) => x,
37	}));
38
39	import { ThreadAutomationsPanel } from "./ThreadAutomationsPanel";
40	const environmentId = EnvironmentId.make("remote");
41	const threadId = ThreadId.make("thread");
42	const task = {
43	id: ScheduledTaskId.make("task"),
44	threadId,
45	title: "Daily review",
46	enabled: true,
47	schedule: { type: "interval", everyMs: 60000 },
48	lastRunStatus: "never",
49	} as ScheduledTask;
50	let renderer: ReactTestRenderer;
51	beforeEach(() => {
52	state.allowed = true;
53	state.toggle.mockReset().mockResolvedValue({ _tag: "Success" });
54	state.run.mockReset().mockResolvedValue({ _tag: "Success" });
55	});
56	afterEach(async () => {
57	if (renderer) await act(async () => renderer.unmount());
58	});
59
60	it.each([true, false])("runs scheduled work only with task permission (%s)", async (allowed) => {
61	state.allowed = allowed;
62	await act(async () => {
63	renderer = create(<ThreadAutomationsPanel environmentId={environmentId} threadId={threadId} />);
64	});
65	const run = renderer.root.findAllByProps({ "aria-label": "Run Daily review now" })[0]!;
66	await act(async () => {
67	await run.props.onClick();
68	});
69	expect(state.run).toHaveBeenCalledTimes(allowed ? 1 : 0);
70	});
71
72	it("rejects a retained toggle after task permission is revoked", async () => {
73	await act(async () => {
74	renderer = create(<ThreadAutomationsPanel environmentId={environmentId} threadId={threadId} />);
75	});
76	const toggle = renderer.root
77	.findAllByProps({ "aria-label": "Pause Daily review" })
78	.find((node) => node.props.onCheckedChange)!;
79	state.allowed = false;
80	await act(async () => {
81	await toggle.props.onCheckedChange(false);
82	});
83	expect(state.toggle).not.toHaveBeenCalled();
84	});

apps/web/src/components/chat/ThreadAutomationsPanel.tsx+25-5

 @@ -1,8 +1,14 @@
+import { useAtomValue } from "@effect/atom-react";
 import { ThreadDetailsControl } from "./ThreadDetailsControl";
 import { useNavigate } from "@tanstack/react-router";
 import { CalendarClockIcon, PencilIcon, PlayIcon, Settings2Icon } from "lucide-react";
 import { useState } from "react";
-import type { EnvironmentId, ScheduledTask, ThreadId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  type EnvironmentId,
+  type ScheduledTask,
+  type ThreadId,
+} from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 @@ -15,6 +21,7 @@ import { useEnvironmentQuery } from "../../state/query";
 import { serverEnvironment } from "../../state/server";
 import { useAtomCommand } from "../../state/use-atom-command";
+import { readEnvironmentScope } from "../../state/session";
 import { Switch } from "../ui/switch";
 import { stackedThreadToast, toastManager } from "../ui/toast";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 @@ -40,6 +47,9 @@ export function ThreadAutomationsPanel(props: {
   readonly environmentId: EnvironmentId;
   readonly threadId: ThreadId;
 }) {
+  const canOperate = useAtomValue(
+    serverEnvironment.runScheduledTaskNow.permissionAtom(props.environmentId),
+  );
   const tasksQuery = useEnvironmentQuery(
     serverEnvironment.scheduledTasksLive({ environmentId: props.environmentId, input: {} }),
   );
 @@ -71,7 +81,11 @@ export function ThreadAutomationsPanel(props: {
   };
   const toggleEnabled = async (task: ScheduledTask, enabled: boolean) => {
-    if (busyTaskId !== null) return;
+    if (
+      busyTaskId !== null ||
+      !readEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     setBusyTaskId(task.id);
     // Partial update: only the enabled flag changes, so a toggle can never
     // revert concurrent edits made to the task elsewhere.
 @@ -86,7 +100,11 @@ export function ThreadAutomationsPanel(props: {
   };
   const runNow = async (task: ScheduledTask) => {
-    if (busyTaskId !== null) return;
+    if (
+      busyTaskId !== null ||
+      !readEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     setBusyTaskId(task.id);
     const result = await runTaskNow({
       environmentId: props.environmentId,
 @@ -196,7 +214,9 @@ export function ThreadAutomationsPanel(props: {
                       variant="ghost"
                       part="icon"
                       aria-label={`Run ${task.title} now`}
-                      disabled={busyTaskId !== null || task.lastRunStatus === "running"}
+                      disabled={
+                        !canOperate || busyTaskId !== null || task.lastRunStatus === "running"
+                      }
                       onClick={() => void runNow(task)}
                     >
                       <PlayIcon className="size-3.5" />
 @@ -208,7 +228,7 @@ export function ThreadAutomationsPanel(props: {
             )}
             <Switch
               checked={task.enabled}
-              disabled={busyTaskId !== null}
+              disabled={!canOperate || busyTaskId !== null}
               aria-label={task.enabled ? `Pause ${task.title}` : `Resume ${task.title}`}
               onCheckedChange={(enabled) => void toggleEnabled(task, enabled)}
             />

apps/web/src/components/chat/ThreadDetailsPanel.tsx+2-2

 @@ -170,8 +170,8 @@ export function ThreadDetailsPanel(props: ThreadDetailsPanelProps) {
               {density !== "essential" && props.showOpenInPicker ? (
                 <OpenInPicker
-                  environmentId={props.environmentId}
                   keybindings={props.keybindings}
+                  environmentId={props.environmentId}
                   availableEditors={props.availableEditors}
                   openInCwd={props.gitCwd}
                   displayMode="panel"
 @@ -180,10 +180,10 @@ export function ThreadDetailsPanel(props: ThreadDetailsPanelProps) {
               {props.activeProjectScripts ? (
                 <ProjectScriptsControl
+                  environmentId={props.environmentId}
                   displayMode="panel"
                   scripts={props.activeProjectScripts}
                   fileScripts={fileScripts}
-                  keybindings={props.keybindings}
                   preferredScriptId={props.preferredScriptId}
                   onRunScript={props.onRunProjectScript}
                   onAddScript={props.onAddProjectScript}

apps/web/src/components/chat/TraitsPicker.tsx+5-2

 @@ -581,14 +581,16 @@ export const TraitsPicker = memo(function TraitsPicker({
   isComposerOwned,
   size = "sm",
   hidden = false,
+  disabled = false,
   ...persistence
 }: TraitsMenuContentProps &
   TraitsPersistence & {
     size?: ComposerControlSize;
     hidden?: boolean;
+    disabled?: boolean;
   }) {
   const composerFloatingLayerProps = useComposerMenuProps();
-  const [isMenuOpen, setIsMenuOpen] = useComposerMenuState(hidden);
+  const [isMenuOpen, setIsMenuOpen] = useComposerMenuState(hidden || disabled);
   const { descriptors, primarySelectDescriptor, ultrathinkPromptControlled } =
     getTraitsSectionVisibility({
       provider,
 @@ -627,7 +629,7 @@ export const TraitsPicker = memo(function TraitsPicker({
     <Menu
       open={isMenuOpen}
       onOpenChange={(open) => {
-        setIsMenuOpen(open);
+        setIsMenuOpen(open && !disabled);
       }}
     >
       <Tooltip>
 @@ -636,6 +638,7 @@ export const TraitsPicker = memo(function TraitsPicker({
             <MenuTrigger
               render={
                 <ComposerControl
+                  disabled={disabled}
                   aria-label={triggerLabel}
                   data-composer-shortcut={isComposerOwned ? "composer.effort" : undefined}
                   size={size}

apps/web/src/components/cloud/ConnectOnboardingDialog.tsx+69-19

 @@ -1,5 +1,12 @@
 import { useAuth } from "@clerk/react";
-import { AuthAdministrativeScopes, AuthRelayWriteScope } from "@t3tools/contracts";
+import { useAtomValue } from "@effect/atom-react";
+import {
+  AuthAdministrativeScopes,
+  AuthRelayReadScope,
+  AuthRelayWriteScope,
+  type AuthSessionState,
+} from "@t3tools/contracts";
+import { AsyncResult, Atom } from "effect/reactivity";
 import { useEffect, useRef, useState } from "react";
 import {
 @@ -9,9 +16,13 @@ import {
 } from "~/cloud/connectOnboarding";
 import { hasCloudPublicConfig } from "~/cloud/publicConfig";
 import { useCloudLinkController } from "~/cloud/useCloudLinkController";
-import { usePrimarySessionState } from "~/environments/primary";
 import { useLocalStorage } from "~/hooks/useLocalStorage";
-import { useEnvironments, usePrimaryEnvironment } from "~/state/environments";
+import {
+  useEnvironments,
+  usePrimaryEnvironment,
+  usePrimaryEnvironmentId,
+} from "~/state/environments";
+import { environmentSession, readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { CloudEnvironmentConnectRows } from "./CloudEnvironmentConnectList";
 import { Button } from "../ui/button";
 import { Checkbox } from "../ui/checkbox";
 @@ -37,6 +48,8 @@ export function ConnectOnboardingDialog() {
 type OnboardingStep = "publish" | "devices";
+const EMPTY_SESSION_STATE_ATOM = Atom.make(AsyncResult.initial<AuthSessionState>());
 function ConfiguredConnectOnboardingDialog() {
   // Mirrors ManagedRelayAuthProvider: a pending Clerk session must not read as
   // signed-out, or its later activation would look like a fresh sign-in.
 @@ -47,22 +60,22 @@ function ConfiguredConnectOnboardingDialog() {
     ConnectOnboardingOptOutSchema,
   );
-  const desktopBridge = window.desktopBridge;
+  const { isReady: environmentsReady } = useEnvironments();
-  const primarySessionState = usePrimarySessionState();
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
-  const currentSessionScopes = desktopBridge
+  const primarySessionState = useAtomValue(
-    ? AuthAdministrativeScopes
+    primaryEnvironmentId === null
-    : primarySessionState.data?.authenticated
+      ? EMPTY_SESSION_STATE_ATOM
-      ? (primarySessionState.data.scopes ?? null)
+      : environmentSession.sessionStateAtom(primaryEnvironmentId),
-      : null;
+  );
-  const canManageRelay = currentSessionScopes?.includes(AuthRelayWriteScope) ?? false;
+  const canReadRelay = useEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope);
+  const canWriteRelay = useEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope);
+  const canManageRelay = canReadRelay && canWriteRelay;
   // The publish step is only offered when we know the answer; opening the
   // wizard before the session state resolves would let the step set change
   // mid-flight. A failed session read still opens the wizard — it just means
   // no publish step.
   const sessionScopesKnown =
-    Boolean(desktopBridge) ||
+    primaryEnvironmentId === null ? environmentsReady : primarySessionState._tag !== "Initial";
-    primarySessionState.data !== null ||
-    primarySessionState.error !== null;
   const controller = useCloudLinkController();
   const showPublishStep = canManageRelay && controller.linkState.target !== null;
 @@ -80,6 +93,12 @@ function ConfiguredConnectOnboardingDialog() {
   const prefilledFromLinkStateRef = useRef(false);
   const observedAccountRef = useRef<string | null | undefined>(undefined);
+  useEffect(() => {
+    if (step === "publish" && sessionScopesKnown && !showPublishStep && !isApplying) {
+      setStep("devices");
+    }
+  }, [isApplying, sessionScopesKnown, showPublishStep, step]);
   const optOutAccounts = optOutState.optOutAccounts;
   // Every sign-in or account switch that completes during this session
 @@ -176,6 +195,16 @@ function ConfiguredConnectOnboardingDialog() {
   };
   const applyPublishSelection = async () => {
+    if (isApplying) return;
+    if (
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope) ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope)
+    ) {
+      setStep("devices");
+      return;
+    }
+    if (linkStateData === null || controller.linkState.error !== null) return;
     // The wizard only ever enables — with both toggles off there is nothing to
     // apply, and an existing link must not be torn down from onboarding.
     if (!exposeEnvironment && !publishAgentActivity) {
 @@ -225,6 +254,13 @@ function ConfiguredConnectOnboardingDialog() {
               isStepDisabled={() => isApplying}
               onStepChange={(index) => {
                 const next = steps[index];
+                if (
+                  next === "publish" &&
+                  (primaryEnvironmentId === null ||
+                    !readEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope) ||
+                    !readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope))
+                )
+                  return;
                 if (next) setStep(next);
               }}
             />
 @@ -235,10 +271,24 @@ function ConfiguredConnectOnboardingDialog() {
             <PublishStep
               exposeEnvironment={exposeEnvironment}
               publishAgentActivity={publishAgentActivity}
-              disabled={isApplying}
+              disabled={isApplying || !canManageRelay || linkStateData === null}
-              operationError={controller.operationError}
+              operationError={controller.operationError ?? controller.linkState.error}
-              onExposeEnvironmentChange={setExposeEnvironment}
+              onExposeEnvironmentChange={(enabled) => {
-              onPublishAgentActivityChange={setPublishAgentActivity}
+                if (
+                  primaryEnvironmentId !== null &&
+                  readEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope) &&
+                  readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope)
+                )
+                  setExposeEnvironment(enabled);
+              }}
+              onPublishAgentActivityChange={(enabled) => {
+                if (
+                  primaryEnvironmentId !== null &&
+                  readEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope) &&
+                  readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope)
+                )
+                  setPublishAgentActivity(enabled);
+              }}
             />
           ) : (
             <DevicesStep />
 @@ -261,7 +311,7 @@ function ConfiguredConnectOnboardingDialog() {
                 Not now
               </Button>
               <Button
-                disabled={isApplying || (controller.linkState.isPending && linkStateData === null)}
+                disabled={isApplying || !canManageRelay || linkStateData === null}
                 onClick={() => void applyPublishSelection()}
               >
                 {isApplying ? "Enabling…" : "Continue"}

apps/web/src/components/device/DeviceSetup.tsx+7-3

apps/web/src/components/onboarding/WelcomeWizard.import.test.tsx created+403

...	@@ -0,0 +1,403 @@
1	import { RegistryContext } from "@effect/atom-react";
2	import {
3	AuthOrchestrationOperateScope,
4	AuthOrchestrationReadScope,
5	EnvironmentId,
6	ProjectId,
7	type AgentSessionProjectCandidate,
8	type AuthEnvironmentScope,
9	type AuthSessionState,
10	} from "@t3tools/contracts";
11	import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
12	import { act, create, type ReactTestInstance, type ReactTestRenderer } from "react-test-renderer";
13	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
14
15	type SessionResult = AsyncResult.AsyncResult<AuthSessionState, Error>;
16	type Project = { id: ProjectId; environmentId: EnvironmentId; workspaceRoot: string };
17	type CreateProjectInput = {
18	environmentId: EnvironmentId;
19	input: { projectId: ProjectId; workspaceRoot: string };
20	};
21	const state = vi.hoisted(() => ({
22	selectedEnvironment: "primary",
23	registry: null as AtomRegistry.AtomRegistry \| null,
24	sessions: new Map<EnvironmentId, Atom.Writable<SessionResult>>(),
25	projects: null as Atom.Writable<ReadonlyArray<Project>> \| null,
26	providers: null as Atom.Atom<ReadonlyArray<never>> \| null,
27	config: null as Atom.Atom<null> \| null,
28	candidates: [] as AgentSessionProjectCandidate[],
29	createProject: vi.fn(),
30	importThreads: vi.fn(),
31	refreshProviders: vi.fn(),
32	connectPairing: vi.fn(),
33	completeOnboarding: vi.fn(),
34	onDone: vi.fn(),
35	scan: vi.fn(),
36	refreshScan: vi.fn(),
37	}));
38
39	vi.mock("../../connection/runtime", () => ({ connectionAtomRuntime: undefined }));
40	vi.mock("@t3tools/client-runtime/state/session", () => ({
41	createEnvironmentSessionAtoms: () => ({
42	sessionStateAtom: (id: EnvironmentId) => state.sessions.get(id)!,
43	}),
44	}));
45	vi.mock("../../rpc/atomRegistry", () => ({
46	get appAtomRegistry() {
47	return state.registry;
48	},
49	}));
50	vi.mock("@clerk/react", () => ({ useAuth: () => ({ isLoaded: true, isSignedIn: false }) }));
51	vi.mock("../../hooks/useTheme", () => ({ mountOnboardingTheme: () => () => {} }));
52	vi.mock("../../hooks/useLocalStorage", () => ({ useLocalStorage: () => [false, () => {}] }));
53	vi.mock("../../hooks/useCopyToClipboard", () => ({
54	useCopyToClipboard: () => ({ copyToClipboard: vi.fn(), copied: false }),
55	}));
56	vi.mock("../../cloud/publicConfig", () => ({ hasCloudPublicConfig: () => false }));
57	vi.mock("../clerk/useT3ConnectAuthPrompt", () => ({ useT3ConnectAuthPrompt: vi.fn() }));
58	vi.mock("../../onboarding/firstRun", () => ({
59	useCompleteOnboarding: () => state.completeOnboarding,
60	}));
61	vi.mock("../../env", () => ({ isElectron: false }));
62	vi.mock("../../state/environments", () => {
63	const environment = (environmentId: string) => ({
64	environmentId,
65	label: environmentId,
66	connection: { phase: "connected" },
67	entry: { target: { _tag: "DirectConnectionTarget" } },
68	});
69	const primary = environment("primary");
70	return {
71	usePrimaryEnvironment: () => primary,
72	useEnvironments: () => ({ environments: [environment(state.selectedEnvironment)] }),
73	};
74	});
75	vi.mock("../../state/server", () => ({
76	serverEnvironment: {
77	providersValueAtom: () => state.providers,
78	configValueAtom: () => state.config,
79	refreshProviders: "refreshProviders",
80	},
81	}));
82	vi.mock("../../state/entities", async () => {
83	const { useAtomValue } = await import("@effect/atom-react");
84	return {
85	useProjects: () => useAtomValue(state.projects!),
86	readProjects: () => state.registry!.get(state.projects!),
87	};
88	});
89	vi.mock("../../state/projects", () => ({ projectEnvironment: { create: "createProject" } }));
90	vi.mock("../../state/agentSessions", () => ({
91	agentSessionScan: (query: { environmentId: EnvironmentId }) => query,
92	agentSessionImport: "importThreads",
93	}));
94	vi.mock("../../onboarding/useProjectScans", () => ({
95	useProjectScans: (ids: EnvironmentId[]) =>
96	ids.map((environmentId) => {
97	state.scan({ environmentId });
98	return {
99	environmentId,
100	data: { candidates: state.candidates, truncated: false },
101	isPending: false,
102	error: null,
103	refresh: state.refreshScan,
104	};
105	}),
106	}));
107	vi.mock("../ui/dialog", () => ({
108	Dialog: "div",
109	DialogPopup: "div",
110	DialogTitle: "div",
111	DialogHeader: "div",
112	}));
113	vi.mock("../ui/wizard", () => ({
114	WizardPanel: "div",
115	WizardSteps: "div",
116	WizardPopup: "div",
117	WizardHeader: "div",
118	}));
119	vi.mock("../ui/scroll-area", () => ({ ScrollArea: "div" }));
120	vi.mock("../ui/tooltip", () => ({ Tooltip: "div", TooltipTrigger: "span", TooltipPopup: "span" }));
121	vi.mock("../../connection/onboarding", () => ({ connectPairing: "connectPairing" }));
122	vi.mock("../../state/use-atom-command", () => ({
123	useAtomCommand: (
124	command: "createProject" \| "importThreads" \| "refreshProviders" \| "connectPairing",
125	) => state[command],
126	}));
127	vi.mock("../../state/terminal", () => ({ terminalEnvironment: {} }));
128	vi.mock("../ThreadTerminalDrawer", () => ({ TerminalViewport: "div" }));
129	vi.mock("../cloud/CloudEnvironmentConnectList", () => ({ CloudEnvironmentConnectRows: "div" }));
130	vi.mock("../settings/ChatGptWelcomeCoordinator", () => ({ ChatGptWelcomeCoordinator: () => null }));
131	vi.mock("../settings/CodexSetupSection", () => ({
132	CodexSetupSection: () => null,
133	AddManagedCodexAccountDialog: () => null,
134	}));
135	vi.mock("../settings/providerDriverMeta", () => ({ getDriverOption: () => ({ label: "Agent" }) }));
136	vi.mock("../settings/providerStatus", () => ({
137	getProviderSummary: () => ({ headline: "Checking", detail: null }),
138	}));
139	vi.mock("../ui/button", () => ({ Button: "button" }));
140	vi.mock("../ui/input", () => ({ Input: "input" }));
141	vi.mock("../ui/checkbox", () => ({ Checkbox: "input" }));
142	vi.mock("../ui/collapsible", () => ({
143	Collapsible: "div",
144	CollapsiblePanel: "div",
145	CollapsibleTrigger: "button",
146	}));
147	vi.mock("../ui/toast", () => ({ toastManager: { add: vi.fn(), close: vi.fn(), update: vi.fn() } }));
148
149	import { WelcomeWizard } from "./WelcomeWizard";
150
151	const primaryId = EnvironmentId.make("primary");
152	const remoteId = EnvironmentId.make("remote");
153	const permissionMessage = "This connection cannot import projects or thread history.";
154	let renderer: ReactTestRenderer \| undefined;
155
156	function session(scopes: ReadonlyArray<AuthEnvironmentScope>): AuthSessionState {
157	return {
158	authenticated: true,
159	scopes: [AuthOrchestrationReadScope, ...scopes],
160	auth: {
161	policy: "remote-reachable",
162	bootstrapMethods: ["one-time-token"],
163	sessionMethods: ["bearer-access-token"],
164	sessionCookieName: "t3_session",
165	},
166	};
167	}
168
169	function setGrant(environmentId: EnvironmentId, allowed: boolean) {
170	state.registry!.set(
171	state.sessions.get(environmentId)!,
172	AsyncResult.success(session(allowed ? [AuthOrchestrationOperateScope] : [])),
173	);
174	}
175
176	function candidate(path: string): AgentSessionProjectCandidate {
177	return {
178	path,
179	title: path.split("/").at(-1)!,
180	sources: ["codex"],
181	threadCount: 10,
182	lastActiveAt: new Date(Date.now() - 60_000).toISOString(),
183	alreadyImported: false,
184	};
185	}
186
187	function recordProject({ environmentId, input }: CreateProjectInput) {
188	state.registry!.set(state.projects!, [
189	...state.registry!.get(state.projects!),
190	{ id: input.projectId, environmentId, workspaceRoot: input.workspaceRoot },
191	]);
192	return AsyncResult.success(undefined);
193	}
194
195	function deferred<T>() {
196	let resolve!: (value: T) => void;
197	const promise = new Promise<T>((complete) => {
198	resolve = complete;
199	});
200	return { promise, resolve };
201	}
202
203	function text(node: ReactTestInstance \| string): string {
204	return typeof node === "string" ? node : node.children.map(text).join("");
205	}
206
207	function button(label: string) {
208	const found = renderer!.root.findAllByType("button").find((node) => text(node) === label);
209	if (!found) throw new Error(`Missing button: ${label}`);
210	return found;
211	}
212
213	async function click(label: string) {
214	const target = button(label);
215	expect(target.props.disabled).not.toBe(true);
216	await act(async () => target.props.onClick());
217	}
218
219	async function mountImport(remote = false) {
220	state.selectedEnvironment = remote ? "remote" : "primary";
221	await act(async () => {
222	renderer = create(
223	<RegistryContext.Provider value={state.registry!}>
224	<WelcomeWizard localAvailable={!remote} onDone={state.onDone} />
225	</RegistryContext.Provider>,
226	);
227	});
228	await click("Continue");
229	await click("Continue");
230	expect(text(renderer!.root)).toContain("Choose your projects");
231	}
232
233	beforeEach(() => {
234	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
235	vi.stubGlobal("document", { activeElement: null, body: {}, getElementById: () => null });
236	state.registry = AtomRegistry.make();
237	for (const id of [primaryId, remoteId]) {
238	state.sessions.set(
239	id,
240	Atom.make<SessionResult>(AsyncResult.success(session([AuthOrchestrationOperateScope]))).pipe(
241	Atom.keepAlive,
242	),
243	);
244	}
245	state.projects = Atom.make<ReadonlyArray<Project>>([]).pipe(Atom.keepAlive);
246	state.providers = Atom.make<ReadonlyArray<never>>([]).pipe(Atom.keepAlive);
247	state.config = Atom.make(null).pipe(Atom.keepAlive);
248	state.candidates = [candidate("/projects/first"), candidate("/projects/second")];
249	state.createProject
250	.mockReset()
251	.mockImplementation(async (input: CreateProjectInput) => recordProject(input));
252	state.importThreads
253	.mockReset()
254	.mockResolvedValue(AsyncResult.success({ importedCount: 1, skippedCount: 0 }));
255	state.refreshProviders.mockReset().mockResolvedValue(AsyncResult.success(undefined));
256	state.connectPairing.mockReset().mockResolvedValue(AsyncResult.success(remoteId));
257	state.completeOnboarding.mockReset().mockResolvedValue(undefined);
258	state.onDone.mockReset();
259	state.scan.mockReset();
260	state.refreshScan.mockReset();
261	});
262
263	afterEach(async () => {
264	await act(async () => renderer?.unmount());
265	renderer = undefined;
266	state.registry?.dispose();
267	state.sessions.clear();
268	vi.unstubAllGlobals();
269	});
270
271	it("keeps scanning, choosing and skipping available to a paired read-only environment", async () => {
272	setGrant(remoteId, false);
273	await mountImport(true);
274	expect(state.scan).toHaveBeenCalledWith(expect.objectContaining({ environmentId: remoteId }));
275	expect(text(renderer!.root)).toContain("/projects/first");
276	expect(button("Import 2 projects").props.disabled).toBe(true);
277	expect(text(renderer!.root)).toContain(permissionMessage);
278	await click("Do not import projects");
279	expect(state.createProject).not.toHaveBeenCalled();
280	expect(state.importThreads).not.toHaveBeenCalled();
281	expect(state.completeOnboarding).toHaveBeenCalledOnce();
282	expect(state.onDone).toHaveBeenCalledOnce();
283	});
284
285	it("waits for the selected grant and enables import when it arrives", async () => {
286	state.registry!.set(state.sessions.get(primaryId)!, AsyncResult.initial());
287	await mountImport();
288	expect(button("Import 2 projects").props.disabled).toBe(true);
289	await act(async () => setGrant(primaryId, true));
290	await click("Import 2 projects");
291	expect(state.createProject).toHaveBeenCalledTimes(2);
292	expect(state.importThreads).toHaveBeenCalledTimes(2);
293	expect(state.onDone).toHaveBeenCalledWith(expect.objectContaining({ environmentId: primaryId }));
294	});
295
296	it("preserves selections and denies a retained action using the paired environment's fresh grant", async () => {
297	await mountImport(true);
298	await act(async () => {
299	renderer!.root.findAllByType("input")[1]!.props.onCheckedChange(false);
300	});
301	const retainedImport = button("Import 1 project").props.onClick;
302	await act(async () => {
303	setGrant(remoteId, false);
304	retainedImport();
305	});
306	expect(button("Import 1 project").props.disabled).toBe(true);
307	expect(renderer!.root.findAllByType("input")[1]!.props.checked).toBe(false);
308	expect(text(renderer!.root)).toContain(permissionMessage);
309	expect(state.createProject).not.toHaveBeenCalled();
310	expect(state.importThreads).not.toHaveBeenCalled();
311	expect(state.onDone).not.toHaveBeenCalled();
312
313	await act(async () => setGrant(remoteId, true));
314	expect(text(renderer!.root)).not.toContain(permissionMessage);
315	await click("Import 1 project");
316	expect(state.createProject).toHaveBeenCalledExactlyOnceWith(
317	expect.objectContaining({ environmentId: remoteId }),
318	);
319	expect(state.importThreads).toHaveBeenCalledExactlyOnceWith(
320	expect.objectContaining({ environmentId: remoteId }),
321	);
322	});
323
324	it("rechecks after project creation and can retry its history without recreating the project", async () => {
325	const creation = deferred<void>();
326	state.createProject.mockImplementationOnce(async (input: CreateProjectInput) => {
327	await creation.promise;
328	return recordProject(input);
329	});
330	await mountImport();
331	await click("Import 2 projects");
332	expect(state.createProject).toHaveBeenCalledOnce();
333	await act(async () => {
334	setGrant(primaryId, false);
335	creation.resolve();
336	await creation.promise;
337	});
338	expect(state.importThreads).not.toHaveBeenCalled();
339	expect(state.createProject).toHaveBeenCalledOnce();
340	expect(state.onDone).not.toHaveBeenCalled();
341	expect(text(renderer!.root)).toContain(permissionMessage);
342
343	await act(async () => setGrant(primaryId, true));
344	await click("Import 2 projects");
345	expect(state.createProject).toHaveBeenCalledTimes(2);
346	expect(state.importThreads).toHaveBeenCalledTimes(2);
347	expect(state.onDone).toHaveBeenCalledOnce();
348	});
349
350	it.each([false, true])(
351	"rechecks after history import before the next project write (existing: %s)",
352	async (existing) => {
353	if (existing) {
354	const projectId = ProjectId.make("second-existing");
355	state.candidates[1] = { ...state.candidates[1]!, projectId };
356	state.registry!.set(state.projects!, [
357	{ id: projectId, environmentId: primaryId, workspaceRoot: "/projects/second" },
358	]);
359	}
360	const imported = deferred<{ importedCount: number; skippedCount: number }>();
361	state.importThreads.mockImplementationOnce(async () =>
362	AsyncResult.success(await imported.promise),
363	);
364	await mountImport();
365	await click("Import 2 projects");
366	expect(state.createProject).toHaveBeenCalledOnce();
367	expect(state.importThreads).toHaveBeenCalledOnce();
368	await act(async () => {
369	setGrant(primaryId, false);
370	imported.resolve({ importedCount: 1, skippedCount: 0 });
371	await imported.promise;
372	});
373	expect(state.createProject).toHaveBeenCalledOnce();
374	expect(state.importThreads).toHaveBeenCalledOnce();
375	expect(state.onDone).not.toHaveBeenCalled();
376	expect(text(renderer!.root)).toContain(permissionMessage);
377
378	await act(async () => setGrant(primaryId, true));
379	await click("Import 2 projects");
380	expect(state.createProject).toHaveBeenCalledTimes(existing ? 1 : 2);
381	expect(state.importThreads).toHaveBeenCalledTimes(2);
382	expect(state.onDone).toHaveBeenCalledOnce();
383	},
384	);
385
386	it("completes accepted imports when permission is revoked after the final server write", async () => {
387	state.candidates = state.candidates.slice(0, 1);
388	const imported = deferred<{ importedCount: number; skippedCount: number }>();
389	state.importThreads.mockImplementationOnce(async () =>
390	AsyncResult.success(await imported.promise),
391	);
392	await mountImport();
393	await click("Import 1 project");
394	await act(async () => {
395	setGrant(primaryId, false);
396	imported.resolve({ importedCount: 1, skippedCount: 0 });
397	await imported.promise;
398	});
399	expect(state.createProject).toHaveBeenCalledOnce();
400	expect(state.importThreads).toHaveBeenCalledOnce();
401	expect(state.completeOnboarding).toHaveBeenCalledOnce();
402	expect(state.onDone).toHaveBeenCalledOnce();
403	});

apps/web/src/components/onboarding/WelcomeWizard.test.tsx+6

...	@@ -12,6 +12,12 @@ const mocks = vi.hoisted(() => ({	...	@@ -12,6 +12,12 @@ const mocks = vi.hoisted(() => ({
12	toast: vi.fn(),	12	toast: vi.fn(),
13	projects: [] as Array<{ id: string; environmentId: string; workspaceRoot: string }>,	13	projects: [] as Array<{ id: string; environmentId: string; workspaceRoot: string }>,
14	}));	14	}));
		15	vi.mock("../../state/session", () => ({
		16	useEnvironmentScope: () => true,
		17	useEnvironmentsWithScope: (environments: Array<{ environmentId: string }>) =>
		18	new Set(environments.map((entry) => entry.environmentId)),
		19	readEnvironmentScope: () => true,
		20	}));
15	vi.mock("../../state/agentSessions", () => ({ agentSessionImport: "import" }));	21	vi.mock("../../state/agentSessions", () => ({ agentSessionImport: "import" }));
16	vi.mock("../../state/projects", () => ({ projectEnvironment: { create: "create" } }));	22	vi.mock("../../state/projects", () => ({ projectEnvironment: { create: "create" } }));
17	vi.mock("../../state/use-atom-command", () => ({	23	vi.mock("../../state/use-atom-command", () => ({

apps/web/src/components/onboarding/WelcomeWizard.tsx+39-1

 @@ -17,6 +17,7 @@ import {
 import {
   CommandId,
   defaultInstanceIdForDriver,
+  AuthOrchestrationOperateScope,
   ProviderDriverKind,
   ThreadId,
 } from "@t3tools/contracts";
 @@ -60,6 +61,7 @@ import { isOnboardingRelayEnvironment } from "../../onboarding/targetEnvironment
 import { useProjectScans } from "../../onboarding/useProjectScans";
 import { projectEnvironment } from "../../state/projects";
 import { serverEnvironment } from "../../state/server";
+import { readEnvironmentScope, useEnvironmentsWithScope } from "../../state/session";
 import { terminalEnvironment } from "../../state/terminal";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { connectPairing } from "../../connection/onboarding";
 @@ -1145,6 +1147,8 @@ function AgentInstallTerminal({
 // ── Step 4: import ───────────────────────────────────────────
+const IMPORT_PERMISSION_MESSAGE = "This connection cannot import projects or thread history.";
 function ImportStep({
   scans,
   isImporting,
 @@ -1161,6 +1165,7 @@ function ImportStep({
   ) => Promise<boolean>;
 }) {
   const { environments } = useEnvironments();
+  const writableEnvironments = useEnvironmentsWithScope(scans, AuthOrchestrationOperateScope);
   const createProject = useAtomCommand(projectEnvironment.create, { reportFailure: false });
   const importThreads = useAtomCommand(agentSessionImport, { reportFailure: false });
   const projects = useProjects();
 @@ -1222,6 +1227,16 @@ function ImportStep({
   );
   const selected = candidates.filter((candidate) => selectedKeys.has(candidate.key));
+  const canImport = selected.every((candidate) =>
+    writableEnvironments.has(candidate.environmentId),
+  );
+  const [importError, setImportError] = useState("");
+  const visibleImportError = !canImport
+    ? IMPORT_PERMISSION_MESSAGE
+    : importError === IMPORT_PERMISSION_MESSAGE
+      ? ""
+      : importError;
   const finishAfterImport = () => {
     const projectRef = resolveOnboardingLandingProject(
       lastImportSelectionRef.current,
 @@ -1238,6 +1253,18 @@ function ImportStep({
   const runImport = async (selection: typeof candidates) => {
     if (isImporting) return;
+    const hasAccess = () =>
+      selection.every((candidate) =>
+        readEnvironmentScope(candidate.environmentId, AuthOrchestrationOperateScope),
+      );
+    const stopForDeniedAccess = () => {
+      setIsImporting(false);
+      setImportError(IMPORT_PERMISSION_MESSAGE);
+    };
+    if (!hasAccess()) {
+      stopForDeniedAccess();
+      return;
+    }
     if (selection.length === 0) {
       void onDone();
       return;
 @@ -1269,6 +1296,10 @@ function ImportStep({
       ) {
         return;
       }
+      if (!hasAccess()) {
+        stopForDeniedAccess();
+        return;
+      }
       if (importedProjects.has(candidate.key)) continue;
       let projectId = resolveOnboardingProjectId(readProjects(), environmentId, candidate);
       if (projectId === null) {
 @@ -1308,6 +1339,10 @@ function ImportStep({
         }
       }
+      if (!hasAccess()) {
+        stopForDeniedAccess();
+        return;
+      }
       const threadImportResult = await importThreads({
         environmentId,
         input: { projectId, expectedWorkspaceRoot: candidate.path },
 @@ -1457,13 +1492,16 @@ function ImportStep({
           })}
         </div>
       </ScrollArea>
+      {visibleImportError ? (
+        <p className="mt-3 text-sm text-destructive">{visibleImportError}</p>
+      ) : null}
       <div className="mt-6 flex flex-wrap items-center justify-end gap-3">
         <Button variant="ghost-muted" disabled={isImporting} onClick={finishAfterImport}>
           Do not import projects
         </Button>
         <Button
           autoFocus
-          disabled={isImporting || selected.length === 0}
+          disabled={!canImport || isImporting || selected.length === 0}
           onClick={() => void runImport(selected)}
         >
           {isImporting

apps/web/src/components/projectScriptEditor.permissions.test.tsx created+340

...	@@ -0,0 +1,340 @@
1	import {
2	AuthOrchestrationOperateScope,
3	AuthSettingsWriteScope,
4	EnvironmentId,
5	type AuthEnvironmentScope,
6	} from "@t3tools/contracts";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult } from "effect/reactivity";
9	import { act, create, type ReactTestRenderer } from "react-test-renderer";
10	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
11
12	const permissions = vi.hoisted(() => ({ canWriteSettings: false, canEditProject: true }));
13
14	vi.mock("~/state/session", () => ({
15	readEnvironmentScope: (_id: EnvironmentId, scope: AuthEnvironmentScope) =>
16	scope === AuthOrchestrationOperateScope
17	? permissions.canEditProject
18	: permissions.canWriteSettings,
19	useEnvironmentScope: (_id: EnvironmentId, scope: AuthEnvironmentScope) =>
20	scope === AuthOrchestrationOperateScope
21	? permissions.canEditProject
22	: permissions.canWriteSettings,
23	}));
24	vi.mock("./ui/dialog", () => ({
25	Dialog: "div",
26	DialogDescription: "div",
27	DialogFooter: "div",
28	DialogHeader: "div",
29	DialogPanel: "div",
30	DialogPopup: "div",
31	DialogTitle: "div",
32	}));
33	vi.mock("./ui/alert-dialog", () => ({
34	AlertDialog: "div",
35	AlertDialogClose: "button",
36	AlertDialogDescription: "div",
37	AlertDialogFooter: "div",
38	AlertDialogHeader: "div",
39	AlertDialogPopup: "div",
40	AlertDialogTitle: "div",
41	}));
42	vi.mock("./ui/popover", () => ({
43	Popover: "div",
44	PopoverPopup: "div",
45	PopoverTrigger: "button",
46	}));
47	vi.mock("./ui/button", () => ({ Button: "button" }));
48	vi.mock("./ui/input", () => ({ Input: "input" }));
49	vi.mock("./ui/label", () => ({ Label: "label" }));
50	vi.mock("./ui/switch", () => ({ Switch: "input" }));
51	vi.mock("./ui/textarea", () => ({ Textarea: "textarea" }));
52
53	import {
54	ProjectScriptEditorDialog,
55	type NewProjectScriptInput,
56	type ProjectScriptEditorRequest,
57	} from "./projectScriptEditor";
58
59	const request: ProjectScriptEditorRequest = {
60	scriptId: "test",
61	initial: {
62	name: "Test",
63	command: "vp test",
64	icon: "test",
65	runOnWorktreeCreate: false,
66	waitForSetup: false,
67	keybinding: "mod+k",
68	previewUrl: null,
69	autoOpenPreview: false,
70	},
71	};
72
73	describe("ProjectScriptEditorDialog", () => {
74	let renderer: ReactTestRenderer \| undefined;
75
76	beforeEach(() => {
77	permissions.canWriteSettings = false;
78	permissions.canEditProject = true;
79	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
80	});
81
82	afterEach(async () => {
83	await act(() => renderer?.unmount());
84	vi.unstubAllGlobals();
85	});
86
87	async function openEditor(
88	onSubmit = vi.fn().mockResolvedValue(AsyncResult.success(undefined)),
89	editorRequest = request,
90	actions = { onDelete: vi.fn(), onClose: vi.fn() },
91	editScope:
92	\| typeof AuthOrchestrationOperateScope
93	\| typeof AuthSettingsWriteScope = AuthOrchestrationOperateScope,
94	) {
95	await act(() => {
96	renderer = create(
97	<ProjectScriptEditorDialog
98	environmentId={EnvironmentId.make("script-editor-test")}
99	editScope={editScope}
100	request={editorRequest}
101	scripts={[]}
102	onSubmit={onSubmit}
103	onDelete={actions.onDelete}
104	onClose={actions.onClose}
105	/>,
106	);
107	});
108	return renderer!.root;
109	}
110
111	it.each([null, "test"])(
112	"saves a settings action without task access (id: %s)",
113	async (scriptId) => {
114	permissions.canEditProject = false;
115	permissions.canWriteSettings = true;
116	const onSubmit = vi.fn().mockResolvedValue(AsyncResult.success(undefined));
117	const root = await openEditor(
118	onSubmit,
119	{ ...request, scriptId },
120	undefined,
121	AuthSettingsWriteScope,
122	);
123	const submit = root.findByType("form").props.onSubmit;
124	permissions.canWriteSettings = false;
125	await act(async () => {
126	await submit({ preventDefault() {} });
127	});
128	expect(onSubmit).not.toHaveBeenCalled();
129	permissions.canWriteSettings = true;
130	await act(async () => {
131	await submit({ preventDefault() {} });
132	});
133	expect(onSubmit).toHaveBeenCalledExactlyOnceWith(
134	scriptId,
135	expect.objectContaining({ command: "vp test" }),
136	);
137	},
138	);
139
140	it("rechecks settings access before deleting a settings action", async () => {
141	permissions.canEditProject = false;
142	permissions.canWriteSettings = true;
143	const actions = { onDelete: vi.fn(), onClose: vi.fn() };
144	const root = await openEditor(undefined, request, actions, AuthSettingsWriteScope);
145	await act(() => {
146	root.findByProps({ variant: "destructive-outline" }).props.onClick();
147	});
148	const confirmDelete = root.findByProps({ variant: "destructive" }).props.onClick;
149	permissions.canWriteSettings = false;
150	await act(() => confirmDelete());
151	expect(actions.onDelete).not.toHaveBeenCalled();
152	permissions.canWriteSettings = true;
153	await act(() => confirmDelete());
154	expect(actions.onDelete).toHaveBeenCalledExactlyOnceWith(request.scriptId);
155	});
156
157	it("clears an old shortcut when adding an action with no shortcut", async () => {
158	permissions.canWriteSettings = true;
159	let persistedKeybinding: string \| null = "mod+k";
160	const onSubmit = vi.fn(async (_id: string \| null, input: NewProjectScriptInput) => {
161	if (input.keybinding !== undefined) persistedKeybinding = input.keybinding;
162	return AsyncResult.success(undefined);
163	});
164	const root = await openEditor(onSubmit, {
165	scriptId: null,
166	initial: { ...request.initial, keybinding: null },
167	});
168
169	await act(async () => {
170	await root.findByType("form").props.onSubmit({ preventDefault() {} });
171	});
172
173	expect(persistedKeybinding).toBeNull();
174	expect(onSubmit).toHaveBeenCalledWith(null, expect.objectContaining({ keybinding: null }));
175	});
176
177	it.each([false, true])(
178	"re-adds a deleted action while preserving its shortcut without settings access (revoked: %s)",
179	async (revokeBeforeSubmit) => {
180	permissions.canWriteSettings = revokeBeforeSubmit;
181	const persisted = { name: null as string \| null, keybinding: "mod+k" as string \| null };
182	const onSubmit = vi.fn(async (_id: string \| null, input: NewProjectScriptInput) => {
183	if (input.keybinding !== undefined && !permissions.canWriteSettings) {
184	return AsyncResult.failure(
185	Cause.fail(new Error("This connection cannot change keyboard shortcuts.")),
186	);
187	}
188	persisted.name = input.name;
189	if (input.keybinding !== undefined) persisted.keybinding = input.keybinding;
190	return AsyncResult.success(undefined);
191	});
192	const root = await openEditor(onSubmit, {
193	scriptId: null,
194	initial: { ...request.initial, keybinding: null },
195	});
196
197	permissions.canWriteSettings = false;
198	await act(async () => {
199	await root.findByType("form").props.onSubmit({ preventDefault() {} });
200	});
201
202	expect(persisted).toEqual({ name: "Test", keybinding: "mod+k" });
203	expect(onSubmit).toHaveBeenCalledOnce();
204	},
205	);
206
207	it.each([false, true])(
208	"requires settings access to override a retained shortcut when re-adding an action (revoked: %s)",
209	async (revokeBeforeSubmit) => {
210	permissions.canWriteSettings = true;
211	vi.stubGlobal("navigator", { platform: "Linux" });
212	const persisted = { name: null as string \| null, keybinding: "mod+k" as string \| null };
213	const onSubmit = vi.fn(async (_id: string \| null, input: NewProjectScriptInput) => {
214	persisted.name = input.name;
215	if (input.keybinding !== undefined) persisted.keybinding = input.keybinding;
216	return AsyncResult.success(undefined);
217	});
218	const root = await openEditor(onSubmit, {
219	scriptId: null,
220	initial: { ...request.initial, keybinding: null },
221	});
222	await act(() => {
223	root.findByProps({ id: "script-keybinding" }).props.onKeyDown({
224	key: "j",
225	ctrlKey: true,
226	metaKey: false,
227	altKey: false,
228	shiftKey: false,
229	preventDefault() {},
230	});
231	});
232	if (revokeBeforeSubmit) permissions.canWriteSettings = false;
233	await act(async () => {
234	await root.findByType("form").props.onSubmit({ preventDefault() {} });
235	});
236
237	expect(persisted).toEqual(
238	revokeBeforeSubmit
239	? { name: null, keybinding: "mod+k" }
240	: { name: "Test", keybinding: "mod+j" },
241	);
242	},
243	);
244
245	it.each([false, true])(
246	"preserves a concurrent shortcut change when saving only the script (settings access: %s)",
247	async (canWriteSettings) => {
248	permissions.canWriteSettings = canWriteSettings;
249	const persisted = { name: request.initial.name, keybinding: request.initial.keybinding };
250	const onSubmit = vi.fn(async (_id: string \| null, input: NewProjectScriptInput) => {
251	persisted.name = input.name;
252	if (input.keybinding !== undefined) persisted.keybinding = input.keybinding;
253	return AsyncResult.success(undefined);
254	});
255	const root = await openEditor(onSubmit);
256
257	// A second client changes the shortcut after this dialog snapshots it.
258	persisted.keybinding = "mod+j";
259	await act(() => {
260	root.findByProps({ id: "script-name" }).props.onChange({ target: { value: "Renamed" } });
261	});
262	await act(async () => {
263	await root.findByType("form").props.onSubmit({ preventDefault() {} });
264	});
265
266	expect(persisted).toEqual({ name: "Renamed", keybinding: "mod+j" });
267	expect(onSubmit).toHaveBeenCalledOnce();
268	},
269	);
270
271	it.each([false, true])(
272	"enforces settings access when submitting an explicit shortcut clear (revoked: %s)",
273	async (revokeBeforeSubmit) => {
274	permissions.canWriteSettings = true;
275	const onSubmit = vi.fn().mockResolvedValue(AsyncResult.success(undefined));
276	const root = await openEditor(onSubmit);
277	await act(() => {
278	root.findByProps({ id: "script-keybinding" }).props.onKeyDown({
279	key: "Backspace",
280	preventDefault() {},
281	});
282	});
283	if (revokeBeforeSubmit) permissions.canWriteSettings = false;
284	await act(async () => {
285	await root.findByType("form").props.onSubmit({ preventDefault() {} });
286	});
287
288	if (revokeBeforeSubmit) {
289	expect(onSubmit).not.toHaveBeenCalled();
290	} else {
291	expect(onSubmit).toHaveBeenCalledWith(
292	"test",
293	expect.objectContaining({ keybinding: null }),
294	);
295	}
296	},
297	);
298
299	it.each([false, true])(
300	"requires project access to save even with settings access (revoked: %s)",
301	async (revokeBeforeSubmit) => {
302	permissions.canEditProject = revokeBeforeSubmit;
303	permissions.canWriteSettings = true;
304	const onSubmit = vi.fn().mockResolvedValue(AsyncResult.success(undefined));
305	const root = await openEditor(onSubmit);
306	const submit = root.findByType("form").props.onSubmit;
307
308	permissions.canEditProject = false;
309	await act(async () => {
310	await submit({ preventDefault() {} });
311	});
312	expect(onSubmit).not.toHaveBeenCalled();
313
314	permissions.canEditProject = true;
315	await act(async () => {
316	await submit({ preventDefault() {} });
317	});
318	expect(onSubmit).toHaveBeenCalledOnce();
319	},
320	);
321
322	it("rechecks project access before deleting from an already open confirmation", async () => {
323	const actions = { onDelete: vi.fn(), onClose: vi.fn() };
324	const root = await openEditor(undefined, request, actions);
325	await act(() => {
326	root.findByProps({ variant: "destructive-outline" }).props.onClick();
327	});
328	const confirmDelete = root.findByProps({ variant: "destructive" }).props.onClick;
329
330	permissions.canEditProject = false;
331	await act(() => confirmDelete());
332	expect(actions.onDelete).not.toHaveBeenCalled();
333	expect(actions.onClose).not.toHaveBeenCalled();
334
335	permissions.canEditProject = true;
336	await act(() => confirmDelete());
337	expect(actions.onDelete).toHaveBeenCalledExactlyOnceWith(request.scriptId);
338	expect(actions.onClose).toHaveBeenCalledOnce();
339	});
340	});

apps/web/src/components/projectScriptEditor.test.tsx+6

 @@ -1,9 +1,14 @@
+import { EnvironmentId } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import { AsyncResult } from "effect/reactivity";
 import { act, StrictMode, type ReactNode } from "react";
 import { create, type ReactTestRenderer } from "react-test-renderer";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+vi.mock("~/state/session", () => ({
+  readEnvironmentScope: () => true,
+  useEnvironmentScope: () => true,
+}));
 vi.mock("./ui/dialog", () => ({
   Dialog: ({ open, children }: { open: boolean; children: ReactNode }) => (open ? children : null),
   DialogDescription: "p",
 @@ -58,6 +63,7 @@ function editor(nextRequest: ProjectScriptEditorRequest) {
   return (
     <StrictMode>
       <ProjectScriptEditorDialog
+        environmentId={EnvironmentId.make("test")}
         request={nextRequest}
         scripts={[]}
         onSubmit={onSubmit}

apps/web/src/components/projectScriptEditor.tsx+46-14

 @@ -1,7 +1,10 @@
-import type {
+import {
-  ProjectScript,
+  AuthOrchestrationOperateScope,
-  ProjectScriptIcon,
+  AuthSettingsWriteScope,
-  ResolvedKeybindingsConfig,
+  type EnvironmentId,
+  type ProjectScript,
+  type ProjectScriptIcon,
+  type ResolvedKeybindingsConfig,
 } from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
 @@ -31,6 +34,8 @@ import {
 } from "~/lib/projectScriptKeybindings";
 import { keybindingFromKeyboardEvent } from "~/components/settings/KeybindingsSettings.logic";
 import { commandForProjectScript, nextProjectScriptId } from "~/projectScripts";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
+import { useComposerMenuState } from "./chat/useComposerMenuState";
 import {
   AlertDialog,
   AlertDialogClose,
 @@ -87,7 +92,8 @@ export interface NewProjectScriptInput {
   runOnWorktreeCreate: boolean;
   /** Setup scripts only: hold the agent until the script exits. */
   waitForSetup: boolean;
-  keybinding: string | null;
+  /** Omit to preserve the current shortcut when the form did not edit it. */
+  keybinding?: string | null;
   /** Optional URL to open in the in-app preview when this script runs. */
   previewUrl: string | null;
   /** When true, automatically open the preview panel pointed at `previewUrl`. */
 @@ -140,12 +146,16 @@ export function editorRequestForScript(
  * being edited via `request`; the dialog owns the form state and validation.
  */
 export function ProjectScriptEditorDialog({
+  environmentId,
+  editScope = AuthOrchestrationOperateScope,
   request,
   scripts,
   onSubmit,
   onDelete,
   onClose,
 }: {
+  environmentId: EnvironmentId;
+  editScope?: typeof AuthOrchestrationOperateScope | typeof AuthSettingsWriteScope;
   request: ProjectScriptEditorRequest | null;
   /** Existing scripts, used to derive a unique id for new scripts. */
   scripts: ReadonlyArray<ProjectScript>;
 @@ -156,18 +166,20 @@ export function ProjectScriptEditorDialog({
   onDelete: (scriptId: string) => void;
   onClose: () => void;
 }) {
+  const canEditActions = useEnvironmentScope(environmentId, editScope);
+  const canWriteSettings = useEnvironmentScope(environmentId, AuthSettingsWriteScope);
   const formId = React.useId();
   const [name, setName] = useState("");
   const [command, setCommand] = useState("");
   const [icon, setIcon] = useState<ProjectScriptIcon>("play");
-  const [iconPickerOpen, setIconPickerOpen] = useState(false);
+  const [iconPickerOpen, setIconPickerOpen] = useComposerMenuState(!canEditActions);
   const [runOnWorktreeCreate, setRunOnWorktreeCreate] = useState(false);
   const [waitForSetup, setWaitForSetup] = useState(false);
   const [keybinding, setKeybinding] = useState("");
   const [previewUrl, setPreviewUrl] = useState("");
   const [autoOpenPreview, setAutoOpenPreview] = useState(false);
   const [validationError, setValidationError] = useState<string | null>(null);
-  const [deleteConfirmOpen, setDeleteConfirmOpen] = useState(false);
+  const [deleteConfirmOpen, setDeleteConfirmOpen] = useComposerMenuState(!canEditActions);
   const [savingRequest, setSavingRequest] = useState<ProjectScriptEditorRequest | null>(null);
   const pendingSubmissionRef = useRef<{ request: ProjectScriptEditorRequest } | null>(null);
 @@ -199,7 +211,7 @@ export function ProjectScriptEditorDialog({
     setAutoOpenPreview(request.initial.autoOpenPreview);
     setValidationError(request.error ?? null);
     setSavingRequest(null);
-  }, [request]);
+  }, [request, setIconPickerOpen]);
   const close = () => {
     pendingSubmissionRef.current = null;
 @@ -209,6 +221,8 @@ export function ProjectScriptEditorDialog({
   };
   const captureKeybinding = (event: KeyboardEvent<HTMLInputElement>) => {
+    if (!readEnvironmentScope(environmentId, editScope)) return;
+    if (!readEnvironmentScope(environmentId, AuthSettingsWriteScope)) return;
     if (event.key === "Tab") return;
     event.preventDefault();
     if (event.key === "Backspace" || event.key === "Delete") {
 @@ -223,6 +237,17 @@ export function ProjectScriptEditorDialog({
   const submit = async (event: FormEvent) => {
     event.preventDefault();
     if (!request || pendingSubmissionRef.current !== null) return;
+    if (!readEnvironmentScope(environmentId, editScope)) {
+      setValidationError("This connection cannot change project actions.");
+      return;
+    }
+    const changesKeybinding =
+      (keybinding.trim() || null) !== (request.initial.keybinding?.trim() || null);
+    const canChangeKeybinding = readEnvironmentScope(environmentId, AuthSettingsWriteScope);
+    if (changesKeybinding && !canChangeKeybinding) {
+      setValidationError("This connection cannot change keyboard shortcuts.");
+      return;
+    }
     const trimmedName = name.trim();
     const trimmedCommand = command.trim();
     if (trimmedName.length === 0) {
 @@ -254,7 +279,9 @@ export function ProjectScriptEditorDialog({
         icon,
         runOnWorktreeCreate,
         waitForSetup: runOnWorktreeCreate && waitForSetup,
-        keybinding: keybindingRule?.key ?? null,
+        ...((request.scriptId === null && canChangeKeybinding) || changesKeybinding
+          ? { keybinding: keybindingRule?.key ?? null }
+          : {}),
         previewUrl: trimmedPreviewUrl.length > 0 ? trimmedPreviewUrl : null,
         autoOpenPreview: trimmedPreviewUrl.length > 0 ? autoOpenPreview : false,
       } satisfies NewProjectScriptInput;
 @@ -309,7 +336,7 @@ export function ProjectScriptEditorDialog({
           </DialogHeader>
           <DialogPanel>
             <form id={formId} onSubmit={submit}>
-              <fieldset className="space-y-4" disabled={isSaving}>
+              <fieldset className="space-y-4" disabled={isSaving || !canEditActions}>
                 <div className="space-y-1.5">
                   <Label htmlFor="script-name">Name</Label>
                   <div className="flex items-center gap-2">
 @@ -364,6 +391,7 @@ export function ProjectScriptEditorDialog({
                 <div className="space-y-1.5">
                   <Label htmlFor="script-keybinding">Keybinding</Label>
                   <Input
+                    disabled={!canWriteSettings}
                     id="script-keybinding"
                     placeholder="Press shortcut"
                     value={keybinding}
 @@ -437,7 +465,7 @@ export function ProjectScriptEditorDialog({
                 type="button"
                 variant="destructive-outline"
                 className="mr-auto"
-                disabled={isSaving}
+                disabled={isSaving || !canEditActions}
                 onClick={() => setDeleteConfirmOpen(true)}
               >
                 Delete
 @@ -446,14 +474,14 @@ export function ProjectScriptEditorDialog({
             <Button type="button" variant="outline" onClick={close}>
               Cancel
             </Button>
-            <Button form={formId} type="submit" disabled={isSaving}>
+            <Button form={formId} type="submit" disabled={isSaving || !canEditActions}>
               {isSaving ? "Saving…" : isEditing ? "Save changes" : "Save action"}
             </Button>
           </DialogFooter>
         </DialogPopup>
       </Dialog>
-      <AlertDialog open={deleteConfirmOpen} onOpenChange={setDeleteConfirmOpen}>
+      <AlertDialog open={deleteConfirmOpen && canEditActions} onOpenChange={setDeleteConfirmOpen}>
         <AlertDialogPopup>
           <AlertDialogHeader>
             <AlertDialogTitle>Delete action "{name}"?</AlertDialogTitle>
 @@ -463,9 +491,13 @@ export function ProjectScriptEditorDialog({
             <AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
             <Button
               variant="destructive"
-              disabled={isSaving}
+              disabled={isSaving || !canEditActions}
               onClick={() => {
                 if (!request?.scriptId) return;
+                if (!readEnvironmentScope(environmentId, editScope)) {
+                  setValidationError("This connection cannot change project actions.");
+                  return;
+                }
                 setDeleteConfirmOpen(false);
                 close();
                 onDelete(request.scriptId);

apps/web/src/components/settings/AcpRegistrySearchStep.test.tsx+17

 @@ -14,6 +14,7 @@ const state = vi.hoisted(() => ({
   result: null as { readonly agents: ReadonlyArray<AcpRegistrySearchAgent> } | null,
   error: null as string | null,
   isPending: false,
+  canManage: true,
   refresh: vi.fn(),
   search: vi.fn(() => atoms.search),
   prepare: vi.fn(),
 @@ -53,6 +54,11 @@ vi.mock("../../state/server", () => ({
   },
 }));
+vi.mock("../../state/session", () => ({
+  useEnvironmentScope: () => state.canManage,
+  readEnvironmentScope: () => state.canManage,
+}));
 vi.mock("../../state/query", () => ({
   useEnvironmentQuery: () => ({
     data: state.result,
 @@ -119,6 +125,7 @@ function findByAriaLabel(
 describe("AcpRegistrySearchStep", () => {
   beforeEach(() => {
+    state.canManage = true;
     vi.useFakeTimers();
     hooks.reset();
     state.result = null;
 @@ -265,6 +272,16 @@ describe("AcpRegistrySearchStep", () => {
     });
   });
+  it("rechecks the grant before preparing an agent", async () => {
+    state.result = { agents: [gemini] };
+    const onPrepared = vi.fn();
+    const add = findByAriaLabel(render({ onPrepared }), "Add Gemini CLI");
+    state.canManage = false;
+    await (add.props.onClick as () => void)();
+    expect(state.prepare).not.toHaveBeenCalled();
+    expect(onPrepared).not.toHaveBeenCalled();
+  });
   it("ignores a stale prepare completion", async () => {
     let resolveFirst!: (value: { readonly _tag: "Success"; readonly value: unknown }) => void;
     let resolveSecond!: (value: { readonly _tag: "Success"; readonly value: unknown }) => void;

apps/web/src/components/settings/AcpRegistrySearchStep.tsx+5-1

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthProvidersManageScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
1	import {	3	import {
2	isAtomCommandInterrupted,	4	isAtomCommandInterrupted,
3	squashAtomCommandFailure,	5	squashAtomCommandFailure,
...	@@ -64,6 +66,7 @@ export function AcpRegistrySearchStep({	...	@@ -64,6 +66,7 @@ export function AcpRegistrySearchStep({
64	// An empty registry query is the compact compatible catalog. Start there so	66	// An empty registry query is the compact compatible catalog. Start there so
65	// entering this step is useful before the user knows what to search for.	67	// entering this step is useful before the user knows what to search for.
66	const [submittedQuery, setSubmittedQuery] = useState("");	68	const [submittedQuery, setSubmittedQuery] = useState("");
		69	const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
67	const [preparingId, setPreparingId] = useState<string \| null>(null);	70	const [preparingId, setPreparingId] = useState<string \| null>(null);
68	const [prepareError, setPrepareError] = useState<string \| null>(null);	71	const [prepareError, setPrepareError] = useState<string \| null>(null);
69	const prepareGeneration = useRef(0);	72	const prepareGeneration = useRef(0);
...	@@ -105,6 +108,7 @@ export function AcpRegistrySearchStep({	...	@@ -105,6 +108,7 @@ export function AcpRegistrySearchStep({
105	};	108	};
106		109
107	const handlePrepare = async (agent: AcpRegistrySearchAgent) => {	110	const handlePrepare = async (agent: AcpRegistrySearchAgent) => {
		111	if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
108	const generation = ++prepareGeneration.current;	112	const generation = ++prepareGeneration.current;
109	setPrepareError(null);	113	setPrepareError(null);
110	setPreparingId(agent.id);	114	setPreparingId(agent.id);
...	@@ -271,7 +275,7 @@ export function AcpRegistrySearchStep({	...	@@ -271,7 +275,7 @@ export function AcpRegistrySearchStep({
271	) : null}	275	) : null}
272	<Button	276	<Button
273	aria-label={`${alreadyAdded ? "Already added" : isPreparing ? progressLabel : "Add"} ${agent.name}`}	277	aria-label={`${alreadyAdded ? "Already added" : isPreparing ? progressLabel : "Add"} ${agent.name}`}
274	disabled={alreadyAdded \|\| preparingId !== null}	278	disabled={!canManageProviders \|\| alreadyAdded \|\| preparingId !== null}
275	onClick={() => void handlePrepare(agent)}	279	onClick={() => void handlePrepare(agent)}
276	size="xs"	280	size="xs"
277	variant={isPreparing ? "secondary" : "outline"}	281	variant={isPreparing ? "secondary" : "outline"}

apps/web/src/components/settings/AcpSessionManagementSection.test.tsx+86-49

 @@ -32,6 +32,12 @@ const commands = vi.hoisted(() => ({
   logout: vi.fn(),
 }));
+const grants = vi.hoisted(() => ({ scopes: new Set<string>() }));
+vi.mock("~/state/session", async (original) => ({
+  ...(await original<typeof import("~/state/session")>()),
+  useEnvironmentScope: (_id: unknown, scope: string) => grants.scopes.has(scope),
+  readEnvironmentScope: (_id: unknown, scope: string) => grants.scopes.has(scope),
+}));
 const dialogs = vi.hoisted(() => ({ confirm: vi.fn() }));
 vi.mock("react", async (importOriginal) => {
 @@ -105,14 +111,14 @@ const provider = {
   skills: [],
 } satisfies ServerProvider;
-function render(): ReactElement<Record<string, unknown>> {
+function render(readOnly = false): ReactElement<Record<string, unknown>> {
   hooks.beginRender();
   return AcpSessionManagementSection({
     environmentId,
     instanceId,
     provider,
     projects: [{ id: projectId, title: "Antigravity", workspaceRoot: session.cwd }],
-    readOnly: false,
+    readOnly,
   }) as ReactElement<Record<string, unknown>>;
 }
 @@ -139,55 +145,56 @@ async function flushPromises(): Promise<void> {
   await Promise.resolve();
 }
-describe("AcpSessionManagementSection", () => {
+beforeEach(() => {
-  beforeEach(() => {
+  hooks.reset();
-    hooks.reset();
+  grants.scopes = new Set(["orchestration:read", "orchestration:operate", "providers:manage"]);
-    commands.list.mockReset().mockResolvedValue({
+  commands.list.mockReset().mockResolvedValue({
-      _tag: "Success",
+    _tag: "Success",
-      value: {
+    value: {
-        sessions: [session],
+      sessions: [session],
-        nextCursor: null,
+      nextCursor: null,
-        canLoad: true,
+      canLoad: true,
-        canResume: true,
+      canResume: true,
-        canDelete: true,
+      canDelete: true,
-      },
+    },
-    });
+  });
-    commands.import.mockReset().mockResolvedValue({
+  commands.import.mockReset().mockResolvedValue({
-      _tag: "Success",
+    _tag: "Success",
-      value: { threadId: ThreadId.make("thread-imported"), imported: true },
+    value: { threadId: ThreadId.make("thread-imported"), imported: true },
-    });
+  });
-    commands.delete.mockReset().mockResolvedValue({
+  commands.delete.mockReset().mockResolvedValue({
-      _tag: "Success",
+    _tag: "Success",
-      value: { deleted: true },
+    value: { deleted: true },
-    });
-    commands.listProviders.mockReset().mockResolvedValue({
-      _tag: "Success",
-      value: {
-        providers: [
-          {
-            providerId: "google",
-            supported: ["openai"],
-            required: false,
-            current: { apiType: "openai", baseUrl: "https://api.example.test/v1" },
-          },
-        ],
-      },
-    });
-    commands.setProvider.mockReset().mockResolvedValue({
-      _tag: "Success",
-      value: { configured: true },
-    });
-    commands.disableProvider.mockReset().mockResolvedValue({
-      _tag: "Success",
-      value: { disabled: true },
-    });
-    commands.logout.mockReset().mockResolvedValue({
-      _tag: "Success",
-      value: { loggedOut: true },
-    });
-    dialogs.confirm.mockReset().mockResolvedValue(true);
   });
+  commands.listProviders.mockReset().mockResolvedValue({
+    _tag: "Success",
+    value: {
+      providers: [
+        {
+          providerId: "google",
+          supported: ["openai"],
+          required: false,
+          current: { apiType: "openai", baseUrl: "https://api.example.test/v1" },
+        },
+      ],
+    },
+  });
+  commands.setProvider.mockReset().mockResolvedValue({
+    _tag: "Success",
+    value: { configured: true },
+  });
+  commands.disableProvider.mockReset().mockResolvedValue({
+    _tag: "Success",
+    value: { disabled: true },
+  });
+  commands.logout.mockReset().mockResolvedValue({
+    _tag: "Success",
+    value: { loggedOut: true },
+  });
+  dialogs.confirm.mockReset().mockResolvedValue(true);
+});
+describe("AcpSessionManagementSection", () => {
   it("lists and imports native sessions through the owning environment", async () => {
     const initial = render();
     (findByLabel(initial, "List sessions").props.onClick as (() => void) | undefined)?.();
 @@ -292,3 +299,33 @@ describe("AcpSessionManagementSection", () => {
     });
   });
 });
+it("imports with task access even when provider configuration is read-only", async () => {
+  grants.scopes.delete("providers:manage");
+  (findByLabel(render(true), "List sessions").props.onClick as () => void)();
+  await flushPromises();
+  (findByLabel(render(true), "Import").props.onClick as () => void)();
+  await flushPromises();
+  expect(commands.import).toHaveBeenCalledOnce();
+});
+it("does not import with provider management alone", async () => {
+  grants.scopes.delete("orchestration:operate");
+  (findByLabel(render(), "List sessions").props.onClick as () => void)();
+  await flushPromises();
+  (findByLabel(render(), "Import").props.onClick as () => void)();
+  await flushPromises();
+  expect(commands.import).not.toHaveBeenCalled();
+});
+it("rechecks task access after confirming deletion", async () => {
+  (findByLabel(render(), "List sessions").props.onClick as () => void)();
+  await flushPromises();
+  dialogs.confirm.mockImplementationOnce(async () => {
+    grants.scopes.delete("orchestration:operate");
+    return true;
+  });
+  (findByLabel(render(), "Delete").props.onClick as () => void)();
+  await flushPromises();
+  expect(commands.delete).not.toHaveBeenCalled();
+});

apps/web/src/components/settings/AcpSessionManagementSection.tsx+31-12

...	@@ -1,3 +1,9 @@	...	@@ -1,3 +1,9 @@
		1	import {
		2	AuthOrchestrationOperateScope,
		3	AuthProvidersManageScope,
		4	AuthOrchestrationReadScope,
		5	} from "@t3tools/contracts";
		6	import { useEnvironmentScope, readEnvironmentScope } from "~/state/session";
1	import type {	7	import type {
2	AcpRegistryConfigurableProvider,	8	AcpRegistryConfigurableProvider,
3	AcpRegistrySession,	9	AcpRegistrySession,
...	@@ -45,6 +51,8 @@ export function AcpSessionManagementSection(props: {	...	@@ -45,6 +51,8 @@ export function AcpSessionManagementSection(props: {
45	readonly projects: ReadonlyArray<AcpSessionProject>;	51	readonly projects: ReadonlyArray<AcpSessionProject>;
46	readonly readOnly: boolean;	52	readonly readOnly: boolean;
47	}) {	53	}) {
		54	const canOperate = useEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope);
		55	const canRead = useEnvironmentScope(props.environmentId, AuthOrchestrationReadScope);
48	const [projectId, setProjectId] = useState<ProjectId \| null>(props.projects[0]?.id ?? null);	56	const [projectId, setProjectId] = useState<ProjectId \| null>(props.projects[0]?.id ?? null);
49	const [sessions, setSessions] = useState<ReadonlyArray<AcpRegistrySession>>([]);	57	const [sessions, setSessions] = useState<ReadonlyArray<AcpRegistrySession>>([]);
50	const [nextCursor, setNextCursor] = useState<string \| null>(null);	58	const [nextCursor, setNextCursor] = useState<string \| null>(null);
...	@@ -117,7 +125,12 @@ export function AcpSessionManagementSection(props: {	...	@@ -117,7 +125,12 @@ export function AcpSessionManagementSection(props: {
117	};	125	};
118		126
119	const importNativeSession = async (session: AcpRegistrySession) => {	127	const importNativeSession = async (session: AcpRegistrySession) => {
120	if (projectId === null \|\| importingSessionId !== null) return;	128	if (
		129	!readEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope) \|\|
		130	projectId === null \|\|
		131	importingSessionId !== null
		132	)
		133	return;
121	setImportingSessionId(session.sessionId);	134	setImportingSessionId(session.sessionId);
122	const result = await importSession({	135	const result = await importSession({
123	environmentId: props.environmentId,	136	environmentId: props.environmentId,
...	@@ -154,7 +167,8 @@ export function AcpSessionManagementSection(props: {	...	@@ -154,7 +167,8 @@ export function AcpSessionManagementSection(props: {
154	`Permanently delete native ACP session "${session.title ?? session.sessionId}"?`,	167	`Permanently delete native ACP session "${session.title ?? session.sessionId}"?`,
155	{ variant: "destructive" },	168	{ variant: "destructive" },
156	);	169	);
157	if (!confirmed) return;	170	if (!confirmed \|\| !readEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope))
		171	return;
158	setDeletingSessionId(session.sessionId);	172	setDeletingSessionId(session.sessionId);
159	const result = await deleteSession({	173	const result = await deleteSession({
160	environmentId: props.environmentId,	174	environmentId: props.environmentId,
...	@@ -199,7 +213,12 @@ export function AcpSessionManagementSection(props: {	...	@@ -199,7 +213,12 @@ export function AcpSessionManagementSection(props: {
199	};	213	};
200		214
201	const saveProvider = async (provider: AcpRegistryConfigurableProvider) => {	215	const saveProvider = async (provider: AcpRegistryConfigurableProvider) => {
202	if (projectId === null \|\| savingProviderId !== null) return;	216	if (
		217	!readEnvironmentScope(props.environmentId, AuthProvidersManageScope) \|\|
		218	projectId === null \|\|
		219	savingProviderId !== null
		220	)
		221	return;
203	const draft = providerDrafts[provider.providerId];	222	const draft = providerDrafts[provider.providerId];
204	if (draft === undefined \|\| draft.apiType.length === 0 \|\| draft.baseUrl.length === 0) return;	223	if (draft === undefined \|\| draft.apiType.length === 0 \|\| draft.baseUrl.length === 0) return;
205	let headers: Record<string, string> \| undefined;	224	let headers: Record<string, string> \| undefined;
...	@@ -251,7 +270,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -251,7 +270,7 @@ export function AcpSessionManagementSection(props: {
251	`Disable ACP provider "${provider.providerId}"?`,	270	`Disable ACP provider "${provider.providerId}"?`,
252	{ variant: "destructive" },	271	{ variant: "destructive" },
253	);	272	);
254	if (!confirmed) return;	273	if (!confirmed \|\| !readEnvironmentScope(props.environmentId, AuthProvidersManageScope)) return;
255	setSavingProviderId(provider.providerId);	274	setSavingProviderId(provider.providerId);
256	const result = await disableProvider({	275	const result = await disableProvider({
257	environmentId: props.environmentId,	276	environmentId: props.environmentId,
...	@@ -267,7 +286,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -267,7 +286,7 @@ export function AcpSessionManagementSection(props: {
267	};	286	};
268		287
269	const logoutProvider = async () => {	288	const logoutProvider = async () => {
270	if (loggingOut) return;	289	if (loggingOut \|\| !readEnvironmentScope(props.environmentId, AuthProvidersManageScope)) return;
271	setLoggingOut(true);	290	setLoggingOut(true);
272	const result = await logout({	291	const result = await logout({
273	environmentId: props.environmentId,	292	environmentId: props.environmentId,
...	@@ -310,7 +329,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -310,7 +329,7 @@ export function AcpSessionManagementSection(props: {
310	<>	329	<>
311	<Select	330	<Select
312	value={projectId ?? ""}	331	value={projectId ?? ""}
313	disabled={props.readOnly \|\| projectOperationPending}	332	disabled={!canRead \|\| projectOperationPending}
314	onValueChange={(value) => {	333	onValueChange={(value) => {
315	if (value === null) return;	334	if (value === null) return;
316	setProjectId(value as ProjectId);	335	setProjectId(value as ProjectId);
...	@@ -337,7 +356,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -337,7 +356,7 @@ export function AcpSessionManagementSection(props: {
337	type="button"	356	type="button"
338	size="sm"	357	size="sm"
339	variant="outline"	358	variant="outline"
340	disabled={props.readOnly \|\| loading \|\| projectId === null}	359	disabled={!canRead \|\| loading \|\| projectId === null}
341	onClick={() => void loadSessions()}	360	onClick={() => void loadSessions()}
342	>	361	>
343	{loading ? "Loading" : sessions.length === 0 ? "List sessions" : "Refresh"}	362	{loading ? "Loading" : sessions.length === 0 ? "List sessions" : "Refresh"}
...	@@ -370,7 +389,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -370,7 +389,7 @@ export function AcpSessionManagementSection(props: {
370	size="xs"	389	size="xs"
371	variant="ghost-muted"	390	variant="ghost-muted"
372	disabled={	391	disabled={
373	props.readOnly \|\|	392	!canOperate \|\|
374	!canImport \|\|	393	!canImport \|\|
375	session.importedThreadId !== null \|\|	394	session.importedThreadId !== null \|\|
376	importingSessionId !== null	395	importingSessionId !== null
...	@@ -389,7 +408,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -389,7 +408,7 @@ export function AcpSessionManagementSection(props: {
389	size="xs"	408	size="xs"
390	variant="ghost-muted"	409	variant="ghost-muted"
391	disabled={	410	disabled={
392	props.readOnly \|\|	411	!canOperate \|\|
393	session.importedThreadId !== null \|\|	412	session.importedThreadId !== null \|\|
394	deletingSessionId !== null	413	deletingSessionId !== null
395	}	414	}
...	@@ -410,7 +429,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -410,7 +429,7 @@ export function AcpSessionManagementSection(props: {
410	size="xs"	429	size="xs"
411	variant="ghost-muted"	430	variant="ghost-muted"
412	className="w-fit"	431	className="w-fit"
413	disabled={props.readOnly \|\| loading}	432	disabled={!canRead \|\| loading}
414	onClick={() => void loadSessions(nextCursor)}	433	onClick={() => void loadSessions(nextCursor)}
415	>	434	>
416	{loading ? "Loading" : "Load more"}	435	{loading ? "Loading" : "Load more"}
...	@@ -433,7 +452,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -433,7 +452,7 @@ export function AcpSessionManagementSection(props: {
433	type="button"	452	type="button"
434	size="xs"	453	size="xs"
435	variant="outline"	454	variant="outline"
436	disabled={props.readOnly \|\| loadingProviders \|\| projectId === null}	455	disabled={!canRead \|\| loadingProviders \|\| projectId === null}
437	onClick={() => void loadProviders()}	456	onClick={() => void loadProviders()}
438	>	457	>
439	{loadingProviders ? "Loading" : providers.length === 0 ? "List providers" : "Refresh"}	458	{loadingProviders ? "Loading" : providers.length === 0 ? "List providers" : "Refresh"}
...	@@ -443,7 +462,7 @@ export function AcpSessionManagementSection(props: {	...	@@ -443,7 +462,7 @@ export function AcpSessionManagementSection(props: {
443	{!canList && props.projects.length > 1 ? (	462	{!canList && props.projects.length > 1 ? (
444	<Select	463	<Select
445	value={projectId ?? ""}	464	value={projectId ?? ""}
446	disabled={props.readOnly \|\| projectOperationPending}	465	disabled={!canRead \|\| projectOperationPending}
447	onValueChange={(value) => {	466	onValueChange={(value) => {
448	if (value === null) return;	467	if (value === null) return;
449	setProjectId(value as ProjectId);	468	setProjectId(value as ProjectId);

apps/web/src/components/settings/AddCodexAccountDialog.tsx+10-2

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthProvidersManageScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
1	import { useAtomValue } from "@effect/atom-react";	3	import { useAtomValue } from "@effect/atom-react";
2	import {	4	import {
3	ProviderDriverKind,	5	ProviderDriverKind,
...	@@ -31,6 +33,7 @@ export function AddCodexAccountDialog({	...	@@ -31,6 +33,7 @@ export function AddCodexAccountDialog({
31	\| undefined;	33	\| undefined;
32	readonly renderSetup: (instanceId: ProviderInstanceId, provider: ServerProvider) => ReactNode;	34	readonly renderSetup: (instanceId: ProviderInstanceId, provider: ServerProvider) => ReactNode;
33	}) {	35	}) {
		36	const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
34	const settings = useEnvironmentSettings(environmentId);	37	const settings = useEnvironmentSettings(environmentId);
35	const providers = useAtomValue(serverEnvironment.providersValueAtom(environmentId));	38	const providers = useAtomValue(serverEnvironment.providersValueAtom(environmentId));
36	const update = useAtomCommand(serverEnvironment.updateSettings, "Add ChatGPT account");	39	const update = useAtomCommand(serverEnvironment.updateSettings, "Add ChatGPT account");
...	@@ -47,7 +50,8 @@ export function AddCodexAccountDialog({	...	@@ -47,7 +50,8 @@ export function AddCodexAccountDialog({
47	}, [connected]);	50	}, [connected]);
48		51
49	const createAccount = async () => {	52	const createAccount = async () => {
50	if (pending \|\| !name.trim()) return;	53	if (pending \|\| !name.trim() \|\| !readEnvironmentScope(environmentId, AuthProvidersManageScope))
		54	return;
51	setPending(true);	55	setPending(true);
52	// The ID is routing identity; the name is editable and need not be unique.	56	// The ID is routing identity; the name is editable and need not be unique.
53	const id = ProviderInstanceId.make(`codex_${randomUUID()}`);	57	const id = ProviderInstanceId.make(`codex_${randomUUID()}`);
...	@@ -131,7 +135,11 @@ export function AddCodexAccountDialog({	...	@@ -131,7 +135,11 @@ export function AddCodexAccountDialog({
131	<Button variant="outline" disabled={pending} onClick={onClose}>	135	<Button variant="outline" disabled={pending} onClick={onClose}>
132	Cancel	136	Cancel
133	</Button>	137	</Button>
134	<Button type="submit" form="add-codex-account" disabled={pending \|\| !name.trim()}>	138	<Button
		139	type="submit"
		140	form="add-codex-account"
		141	disabled={pending \|\| !name.trim() \|\| !canManageProviders}
		142	>
135	{pending ? "Adding account…" : "Continue"}	143	{pending ? "Adding account…" : "Continue"}
136	</Button>	144	</Button>
137	</>	145	</>

apps/web/src/components/settings/AddProviderInstanceDialog.environment.test.tsx+101

...	@@ -4,6 +4,13 @@ import { beforeEach, describe, expect, it, vi } from "vite-plus/test";	...	@@ -4,6 +4,13 @@ import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
4	import { visitElements } from "../../test/reactElementTree";	4	import { visitElements } from "../../test/reactElementTree";
5	import { reactHookHarness as hooks } from "../../test/reactHookHarness";	5	import { reactHookHarness as hooks } from "../../test/reactHookHarness";
6		6
		7	const actions = vi.hoisted(() => ({
		8	update: vi.fn(),
		9	toast: vi.fn(),
		10	onOpenChange: vi.fn(),
		11	canManageProviders: true,
		12	}));
		13
7	const settingsHooks = vi.hoisted(() => ({	14	const settingsHooks = vi.hoisted(() => ({
8	read: vi.fn(() => ({ providerInstances: {} })),	15	read: vi.fn(() => ({ providerInstances: {} })),
9	mutate: vi.fn(),	16	mutate: vi.fn(),
...	@@ -35,6 +42,15 @@ vi.mock("../../hooks/useSettings", () => ({	...	@@ -35,6 +42,15 @@ vi.mock("../../hooks/useSettings", () => ({
35	usePersistEnvironmentProviderInstanceMutation: settingsHooks.useMutation,	42	usePersistEnvironmentProviderInstanceMutation: settingsHooks.useMutation,
36	}));	43	}));
37		44
		45	vi.mock("../../state/session", async (importOriginal) => {
		46	const actual = await importOriginal<typeof import("../../state/session")>();
		47	const hasScope = (environmentId: EnvironmentId, scope: string) =>
		48	environmentId === "remote-device" && scope === "providers:manage" && actions.canManageProviders;
		49	return { ...actual, useEnvironmentScope: hasScope, readEnvironmentScope: hasScope };
		50	});
		51
		52	vi.mock("../ui/toast", () => ({ toastManager: { add: actions.toast } }));
		53
38	import { AddProviderInstanceDialog } from "./AddProviderInstanceDialog";	54	import { AddProviderInstanceDialog } from "./AddProviderInstanceDialog";
39		55
40	const remoteEnvironmentId = EnvironmentId.make("remote-device");	56	const remoteEnvironmentId = EnvironmentId.make("remote-device");
...	@@ -81,9 +97,45 @@ async function selectPreparedAcp() {	...	@@ -81,9 +97,45 @@ async function selectPreparedAcp() {
81	);	97	);
82	}	98	}
83		99
		100	function renderDialog() {
		101	hooks.beginRender();
		102	return AddProviderInstanceDialog({
		103	open: true,
		104	environmentId: remoteEnvironmentId,
		105	environmentLabel: "Remote device",
		106	onOpenChange: actions.onOpenChange,
		107	});
		108	}
		109
		110	function button(dialog: unknown, label: string) {
		111	const element = visitElements(
		112	dialog,
		113	(entry) => entry.props.children === label && typeof entry.props.onClick === "function",
		114	);
		115	if (!element) throw new Error(`Missing button: ${label}`);
		116	return element;
		117	}
		118
		119	function prepareInstance() {
		120	let dialog = renderDialog();
		121	(button(dialog, "Configure manually").props.onClick as () => void)();
		122	dialog = renderDialog();
		123	const label = visitElements(dialog, (entry) => entry.props.placeholder === "e.g. Work");
		124	if (!label) throw new Error("Missing instance label input.");
		125	(label.props.onChange as (event: { target: { value: string } }) => void)({
		126	target: { value: "Work" },
		127	});
		128	dialog = renderDialog();
		129	(button(dialog, "Next").props.onClick as () => void)();
		130	return renderDialog();
		131	}
		132
84	describe("AddProviderInstanceDialog environment routing", () => {	133	describe("AddProviderInstanceDialog environment routing", () => {
85	beforeEach(() => {	134	beforeEach(() => {
86	hooks.reset();	135	hooks.reset();
		136	actions.canManageProviders = true;
		137	actions.toast.mockReset();
		138	actions.onOpenChange.mockReset();
87	settingsHooks.read.mockReset().mockReturnValue({ providerInstances: {} });	139	settingsHooks.read.mockReset().mockReturnValue({ providerInstances: {} });
88	settingsHooks.mutate.mockReset().mockResolvedValue({ _tag: "Success", value: {} });	140	settingsHooks.mutate.mockReset().mockResolvedValue({ _tag: "Success", value: {} });
89	settingsHooks.useMutation.mockReset().mockReturnValue(settingsHooks.mutate);	141	settingsHooks.useMutation.mockReset().mockReturnValue(settingsHooks.mutate);
...	@@ -321,4 +373,53 @@ describe("AddProviderInstanceDialog environment routing", () => {	...	@@ -321,4 +373,53 @@ describe("AddProviderInstanceDialog environment routing", () => {
321		373
322	expect(onOpenChange).not.toHaveBeenCalled();	374	expect(onOpenChange).not.toHaveBeenCalled();
323	});	375	});
		376
		377	it("adds an instance with the selected environment's provider grant alone", async () => {
		378	const dialog = prepareInstance();
		379	(button(dialog, "Add instance").props.onClick as () => void)();
		380
		381	await Promise.resolve();
		382	expect(settingsHooks.mutate).toHaveBeenCalledWith({
		383	operation: "create",
		384	instanceId: "codex_work",
		385	instance: {
		386	driver: "codex",
		387	enabled: true,
		388	displayName: "Work",
		389	config: { setupMode: "existing" },
		390	},
		391	});
		392	expect(actions.toast).toHaveBeenCalledWith(
		393	expect.objectContaining({ type: "success", title: "Provider instance added" }),
		394	);
		395	expect(actions.onOpenChange).toHaveBeenCalledWith(false);
		396	});
		397
		398	it("rejects a queued save after the provider grant is revoked", () => {
		399	const dialog = prepareInstance();
		400	const save = button(dialog, "Add instance").props.onClick as () => void;
		401	actions.canManageProviders = false;
		402	save();
		403
		404	expect(settingsHooks.mutate).not.toHaveBeenCalled();
		405	expect(actions.toast).not.toHaveBeenCalled();
		406	expect(actions.onOpenChange).not.toHaveBeenCalled();
		407	expect(button(renderDialog(), "Add instance").props.disabled).toBe(true);
		408	});
		409
		410	it("keeps a denied draft available when the provider grant arrives", async () => {
		411	actions.canManageProviders = false;
		412	let dialog = prepareInstance();
		413	(button(dialog, "Add instance").props.onClick as () => void)();
		414	expect(settingsHooks.mutate).not.toHaveBeenCalled();
		415	expect(actions.toast).not.toHaveBeenCalled();
		416
		417	actions.canManageProviders = true;
		418	dialog = renderDialog();
		419	expect(button(dialog, "Add instance").props.disabled).toBe(false);
		420	(button(dialog, "Add instance").props.onClick as () => void)();
		421	await Promise.resolve();
		422	expect(settingsHooks.mutate).toHaveBeenCalledOnce();
		423	expect(actions.onOpenChange).toHaveBeenCalledWith(false);
		424	});
324	});	425	});

apps/web/src/components/settings/AddProviderInstanceDialog.tsx+9-1

...	@@ -9,6 +9,7 @@ import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime"	...	@@ -9,6 +9,7 @@ import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime"
9	import {	9	import {
10	DEFAULT_UNIFIED_SETTINGS,	10	DEFAULT_UNIFIED_SETTINGS,
11	type AcpRegistrySearchAgent,	11	type AcpRegistrySearchAgent,
		12	AuthProvidersManageScope,
12	ProviderInstanceId,	13	ProviderInstanceId,
13	ProviderDriverKind,	14	ProviderDriverKind,
14	type EnvironmentId,	15	type EnvironmentId,
...	@@ -24,6 +25,7 @@ import * as Equal from "effect/Equal";	...	@@ -24,6 +25,7 @@ import * as Equal from "effect/Equal";
24		25
25	import { cn } from "../../lib/utils";	26	import { cn } from "../../lib/utils";
26	import { normalizeProviderAccentColor } from "../../providerInstances";	27	import { normalizeProviderAccentColor } from "../../providerInstances";
		28	import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
27	import { Button } from "../ui/button";	29	import { Button } from "../ui/button";
28	import { ChatGptConnectionButton } from "./ChatGptConnectionButton";	30	import { ChatGptConnectionButton } from "./ChatGptConnectionButton";
29	import { Dialog } from "../ui/dialog";	31	import { Dialog } from "../ui/dialog";
...	@@ -113,6 +115,7 @@ export function AddProviderInstanceDialog({	...	@@ -113,6 +115,7 @@ export function AddProviderInstanceDialog({
113	}: AddProviderInstanceDialogProps) {	115	}: AddProviderInstanceDialogProps) {
114	const settings = useEnvironmentSettings(environmentId);	116	const settings = useEnvironmentSettings(environmentId);
115	const persistProviderInstance = usePersistEnvironmentProviderInstanceMutation(environmentId);	117	const persistProviderInstance = usePersistEnvironmentProviderInstanceMutation(environmentId);
		118	const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
116		119
117	const [wizardStep, setWizardStep] = useState(0);	120	const [wizardStep, setWizardStep] = useState(0);
118	const [addingChatGptAccount, setAddingChatGptAccount] = useState(false);	121	const [addingChatGptAccount, setAddingChatGptAccount] = useState(false);
...	@@ -308,6 +311,7 @@ export function AddProviderInstanceDialog({	...	@@ -308,6 +311,7 @@ export function AddProviderInstanceDialog({
308	};	311	};
309		312
310	const handleSave = async () => {	313	const handleSave = async () => {
		314	if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
311	if (isSaving \|\| createdInstanceId) return;	315	if (isSaving \|\| createdInstanceId) return;
312	setHasAttemptedSubmit(true);	316	setHasAttemptedSubmit(true);
313	if (instanceIdError !== null \|\| (isAcpRegistry && acpSelectionError !== null)) return;	317	if (instanceIdError !== null \|\| (isAcpRegistry && acpSelectionError !== null)) return;
...	@@ -694,7 +698,11 @@ export function AddProviderInstanceDialog({	...	@@ -694,7 +698,11 @@ export function AddProviderInstanceDialog({
694	Next	698	Next
695	</Button>	699	</Button>
696	) : (	700	) : (
697	<Button size="sm" disabled={isSaving} onClick={() => void handleSave()}>	701	<Button
		702	size="sm"
		703	disabled={isSaving \|\| !canManageProviders}
		704	onClick={() => void handleSave()}
		705	>
698	{isSaving	706	{isSaving
699	? "Adding..."	707	? "Adding..."
700	: isAcpRegistry && !isLocalAcp	708	: isAcpRegistry && !isLocalAcp

apps/web/src/components/settings/CodexSetupSection.tsx+4

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthProvidersManageScope } from "@t3tools/contracts";
		2	import { useEnvironmentScope } from "../../state/session";
1	import {	3	import {
2	isAtomCommandInterrupted,	4	isAtomCommandInterrupted,
3	squashAtomCommandFailure,	5	squashAtomCommandFailure,
...	@@ -167,6 +169,7 @@ export function AddManagedCodexAccountDialog({	...	@@ -167,6 +169,7 @@ export function AddManagedCodexAccountDialog({
167	\| ((instanceId: ProviderInstanceId, displayName: string) => void)	169	\| ((instanceId: ProviderInstanceId, displayName: string) => void)
168	\| undefined;	170	\| undefined;
169	}) {	171	}) {
		172	const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
170	return (	173	return (
171	<AddCodexAccountDialog	174	<AddCodexAccountDialog
172	environmentId={environmentId}	175	environmentId={environmentId}
...	@@ -180,6 +183,7 @@ export function AddManagedCodexAccountDialog({	...	@@ -180,6 +183,7 @@ export function AddManagedCodexAccountDialog({
180	provider={provider}	183	provider={provider}
181	mode="managed"	184	mode="managed"
182	enabled	185	enabled
		186	readOnly={!canManageProviders}
183	autoStart	187	autoStart
184	onAutoStartConsumed={noop}	188	onAutoStartConsumed={noop}
185	onModeChange={noop}	189	onModeChange={noop}

apps/web/src/components/settings/ConnectionsSettings.logic.test.ts+13

...	@@ -2,6 +2,7 @@ import type { AdvertisedEndpoint, DesktopWslState } from "@t3tools/contracts";	...	@@ -2,6 +2,7 @@ import type { AdvertisedEndpoint, DesktopWslState } from "@t3tools/contracts";
2	import { describe, expect, it, vi } from "vite-plus/test";	2	import { describe, expect, it, vi } from "vite-plus/test";
3	import {	3	import {
4	applyWslEnableSelection,	4	applyWslEnableSelection,
		5	canRevokeOtherClients,
5	isQrShareableEndpoint,	6	isQrShareableEndpoint,
6	isWslSettingsRowVisible,	7	isWslSettingsRowVisible,
7	selectQrEndpointOption,	8	selectQrEndpointOption,
...	@@ -183,3 +184,15 @@ describe("selectQrEndpointOption", () => {	...	@@ -183,3 +184,15 @@ describe("selectQrEndpointOption", () => {
183	expect(selectQrEndpointOption([], "anything", "anything")).toBeNull();	184	expect(selectQrEndpointOption([], "anything", "anything")).toBeNull();
184	});	185	});
185	});	186	});
		187
		188	describe("canRevokeOtherClients", () => {
		189	it("permits revocation when a write-only grant cannot list clients", () => {
		190	expect(canRevokeOtherClients(null)).toBe(true);
		191	});
		192
		193	it("disables revocation only when a loaded list has no other clients", () => {
		194	expect(canRevokeOtherClients([])).toBe(false);
		195	expect(canRevokeOtherClients([{ current: true }])).toBe(false);
		196	expect(canRevokeOtherClients([{ current: true }, { current: false }])).toBe(true);
		197	});
		198	});

apps/web/src/components/settings/ConnectionsSettings.logic.ts+7

...	@@ -1,5 +1,12 @@	...	@@ -1,5 +1,12 @@
1	import type { AdvertisedEndpoint, DesktopBridge, DesktopWslState } from "@t3tools/contracts";	1	import type { AdvertisedEndpoint, DesktopBridge, DesktopWslState } from "@t3tools/contracts";
2		2
		3	/** A missing access list says nothing about whether other clients exist. */
		4	export function canRevokeOtherClients(
		5	clientSessions: ReadonlyArray<{ readonly current: boolean }> \| null,
		6	): boolean {
		7	return clientSessions === null \|\| clientSessions.some((session) => !session.current);
		8	}
		9
3	type WslEnableBridge = Pick<DesktopBridge, "setWslBackendEnabled" \| "setWslDistro" \| "setWslOnly">;	10	type WslEnableBridge = Pick<DesktopBridge, "setWslBackendEnabled" \| "setWslDistro" \| "setWslOnly">;
4		11
5	/**	12	/**

apps/web/src/components/settings/ConnectionsSettings.tsx+281-121

 @@ -23,7 +23,9 @@ import {
 import {
   AuthAccessReadScope,
   AuthAccessWriteScope,
-  AuthAdministrativeScopes,
+  AuthSettingsWriteScope,
+  AuthProvidersManageScope,
+  AuthEnvironmentMaintainScope,
   AuthOrchestrationOperateScope,
   AuthOrchestrationReadScope,
   AuthRelayReadScope,
 @@ -64,6 +66,7 @@ import { formatElapsedDurationLabel, formatExpiresInLabel } from "../../timestam
 import { resolveDesktopPairingUrl, resolveHostedPairingUrl } from "./pairingUrls";
 import {
   applyWslEnableSelection,
+  canRevokeOtherClients,
   isQrShareableEndpoint,
   isWslSettingsRowVisible,
   selectQrEndpointOption,
 @@ -162,6 +165,7 @@ import {
   connectPairing as connectPairingAtom,
   connectSshEnvironment as connectSshEnvironmentAtom,
 } from "~/connection/onboarding";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { useEnvironmentQuery } from "~/state/query";
 import {
   desktopNetworkAccessStateAtom,
 @@ -174,6 +178,7 @@ import {
   useEnvironments,
   usePrimaryEnvironment,
   useRelayEnvironmentDiscovery,
+  usePrimaryEnvironmentId,
 } from "~/state/environments";
 import { APP_VERSION } from "~/branding";
 import { requestConfirmDialog } from "~/confirmDialog";
 @@ -234,6 +239,21 @@ const PAIRING_SCOPE_OPTIONS: ReadonlyArray<{
     title: "Operate tasks",
     description: "Start tasks and perform changes in the environment.",
   },
+  {
+    scope: AuthSettingsWriteScope,
+    title: "Change environment settings",
+    description: "Edit environment preferences and keybindings.",
+  },
+  {
+    scope: AuthProvidersManageScope,
+    title: "Manage providers",
+    description: "Configure, install, sign in to, and update providers and usage sources.",
+  },
+  {
+    scope: AuthEnvironmentMaintainScope,
+    title: "Maintain environment",
+    description: "Update the server and control environment processes.",
+  },
   {
     scope: AuthTerminalOperateScope,
     title: "Use terminals",
 @@ -600,6 +620,7 @@ type PairingLinkListRowProps = {
   presentation?: AccessSectionPresentation;
   revokingPairingLinkId: string | null;
   onRevoke: (id: string) => void;
+  canRevoke: boolean;
 };
 const PairingLinkListRow = memo(function PairingLinkListRow({
 @@ -611,6 +632,7 @@ const PairingLinkListRow = memo(function PairingLinkListRow({
   presentation = "current",
   revokingPairingLinkId,
   onRevoke,
+  canRevoke,
 }: PairingLinkListRowProps) {
   const nowMs = useRelativeTimeTick(1_000);
   const expiresAtMs = useMemo(
 @@ -877,7 +899,7 @@ const PairingLinkListRow = memo(function PairingLinkListRow({
           <Button
             size="xs"
             variant="destructive-outline"
-            disabled={revokingPairingLinkId === pairingLink.id}
+            disabled={!canRevoke || revokingPairingLinkId === pairingLink.id}
             onClick={() => void onRevoke(pairingLink.id)}
           >
             {revokingPairingLinkId === pairingLink.id ? "Revoking…" : "Revoke"}
 @@ -982,6 +1004,7 @@ type ConnectedClientListRowProps = {
   presentation?: AccessSectionPresentation;
   revokingClientSessionId: string | null;
   onRevokeSession: (sessionId: ServerClientSessionRecord["sessionId"]) => void;
+  canRevoke: boolean;
 };
 const ConnectedClientListRow = memo(function ConnectedClientListRow({
 @@ -989,6 +1012,7 @@ const ConnectedClientListRow = memo(function ConnectedClientListRow({
   presentation = "current",
   revokingClientSessionId,
   onRevokeSession,
+  canRevoke,
 }: ConnectedClientListRowProps) {
   const nowMs = useRelativeTimeTick(1_000);
   const isLive = clientSession.current || clientSession.connected;
 @@ -1045,7 +1069,7 @@ const ConnectedClientListRow = memo(function ConnectedClientListRow({
             <Button
               size="xs"
               variant="destructive-outline"
-              disabled={revokingClientSessionId === clientSession.sessionId}
+              disabled={!canRevoke || revokingClientSessionId === clientSession.sessionId}
               onClick={() => void onRevokeSession(clientSession.sessionId)}
             >
               {revokingClientSessionId === clientSession.sessionId ? "Revoking…" : "Revoke"}
 @@ -1059,9 +1083,10 @@ const ConnectedClientListRow = memo(function ConnectedClientListRow({
 type AuthorizedClientsHeaderActionProps = {
   onPairingLinkCreated: (result: AuthPairingCredentialResult) => void;
-  clientSessions: ReadonlyArray<ServerClientSessionRecord>;
+  clientSessions: ReadonlyArray<ServerClientSessionRecord> | null;
   isRevokingOtherClients: boolean;
   onRevokeOtherClients: () => void;
+  delegatableScopes: ReadonlyArray<AuthEnvironmentScope>;
 };
 const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderAction({
 @@ -1069,24 +1094,36 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
   clientSessions,
   isRevokingOtherClients,
   onRevokeOtherClients,
+  delegatableScopes,
 }: AuthorizedClientsHeaderActionProps) {
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
   const [dialogOpen, setDialogOpen] = useState(false);
   const [pairingLabel, setPairingLabel] = useState("");
   const [pairingScopes, setPairingScopes] = useState<ReadonlyArray<AuthEnvironmentScope>>([
     ...AuthStandardClientScopes,
   ]);
+  const selectedScopes = pairingScopes.filter((scope) => delegatableScopes.includes(scope));
   const [isCreatingPairingLink, setIsCreatingPairingLink] = useState(false);
   const handleCreatePairingLink = useCallback(async () => {
+    if (
+      primaryEnvironmentId === null ||
+      selectedScopes.length === 0 ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthAccessWriteScope) ||
+      !selectedScopes.every((scope) => readEnvironmentScope(primaryEnvironmentId, scope))
+    )
+      return;
     setIsCreatingPairingLink(true);
     try {
       const created = await createServerPairingCredential({
         label: pairingLabel,
-        scopes: pairingScopes,
+        scopes: selectedScopes,
       });
       onPairingLinkCreated(created);
       setPairingLabel("");
-      setPairingScopes([...AuthStandardClientScopes]);
+      setPairingScopes(
+        AuthStandardClientScopes.filter((scope) => delegatableScopes.includes(scope)),
+      );
       setDialogOpen(false);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to create pairing URL.";
 @@ -1100,7 +1137,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
     } finally {
       setIsCreatingPairingLink(false);
     }
-  }, [onPairingLinkCreated, pairingLabel, pairingScopes]);
+  }, [delegatableScopes, onPairingLinkCreated, pairingLabel, primaryEnvironmentId, selectedScopes]);
   const togglePairingScope = useCallback((scope: AuthEnvironmentScope, checked: boolean) => {
     setPairingScopes((current) =>
 @@ -1113,9 +1150,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
       <Button
         size="xs"
         variant="destructive-outline"
-        disabled={
+        disabled={isRevokingOtherClients || !canRevokeOtherClients(clientSessions)}
-          isRevokingOtherClients || clientSessions.every((clientSession) => clientSession.current)
-        }
         onClick={() => void onRevokeOtherClients()}
       >
         {isRevokingOtherClients ? "Revoking…" : "Revoke others"}
 @@ -1126,7 +1161,9 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
           setDialogOpen(open);
           if (!open) {
             setPairingLabel("");
-            setPairingScopes([...AuthStandardClientScopes]);
+            setPairingScopes(
+              AuthStandardClientScopes.filter((scope) => delegatableScopes.includes(scope)),
+            );
           }
         }}
       >
 @@ -1172,7 +1209,13 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
                     size="xs"
                     variant="outline"
                     disabled={isCreatingPairingLink}
-                    onClick={() => setPairingScopes([AuthOrchestrationReadScope])}
+                    onClick={() =>
+                      setPairingScopes(
+                        delegatableScopes.includes(AuthOrchestrationReadScope)
+                          ? [AuthOrchestrationReadScope]
+                          : [],
+                      )
+                    }
                   >
                     Read only
                   </Button>
 @@ -1180,36 +1223,44 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
                     size="xs"
                     variant="outline"
                     disabled={isCreatingPairingLink}
-                    onClick={() => setPairingScopes([...AuthStandardClientScopes])}
+                    onClick={() =>
+                      setPairingScopes(
+                        AuthStandardClientScopes.filter((scope) =>
+                          delegatableScopes.includes(scope),
+                        ),
+                      )
+                    }
                   >
                     Standard
                   </Button>
                 </div>
               </div>
               <div className="divide-y divide-border/60 rounded-lg border border-input bg-muted/25">
-                {PAIRING_SCOPE_OPTIONS.map(({ scope, title, description }) => (
+                {PAIRING_SCOPE_OPTIONS.filter(({ scope }) => delegatableScopes.includes(scope)).map(
-                  <label
+                  ({ scope, title, description }) => (
-                    key={scope}
+                    <label
-                    className="flex cursor-pointer items-start gap-3 px-3 py-2.5 transition-colors hover:bg-muted/40"
+                      key={scope}
-                  >
+                      className="flex cursor-pointer items-start gap-3 px-3 py-2.5 transition-colors hover:bg-muted/40"
-                    <Checkbox
+                    >
-                      className="mt-0.5"
+                      <Checkbox
-                      checked={pairingScopes.includes(scope)}
+                        className="mt-0.5"
-                      disabled={isCreatingPairingLink}
+                        checked={pairingScopes.includes(scope)}
-                      onCheckedChange={(checked) => togglePairingScope(scope, checked === true)}
+                        disabled={isCreatingPairingLink}
-                    />
+                        onCheckedChange={(checked) => togglePairingScope(scope, checked === true)}
-                    <span className="min-w-0">
+                      />
-                      <span className="block text-xs font-medium text-foreground">{title}</span>
+                      <span className="min-w-0">
-                      <span className="block text-xs leading-snug text-muted-foreground">
+                        <span className="block text-xs font-medium text-foreground">{title}</span>
-                        {description}
+                        <span className="block text-xs leading-snug text-muted-foreground">
+                          {description}
+                        </span>
                       </span>
-                    </span>
+                    </label>
-                  </label>
+                  ),
-                ))}
+                )}
               </div>
-              {pairingScopes.length === 0 ? (
+              {selectedScopes.length === 0 ? (
                 <p className="text-xs text-destructive">Select at least one permission.</p>
-              ) : pairingScopes.includes(AuthAccessWriteScope) ? (
+              ) : selectedScopes.includes(AuthAccessWriteScope) ? (
                 <p className="text-xs text-warning">
                   This client can create or revoke access for other devices.
                 </p>
 @@ -1225,7 +1276,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
               Cancel
             </Button>
             <Button
-              disabled={isCreatingPairingLink || pairingScopes.length === 0}
+              disabled={isCreatingPairingLink || selectedScopes.length === 0}
               onClick={() => void handleCreatePairingLink()}
             >
               {isCreatingPairingLink ? "Creating…" : "Create link"}
 @@ -1250,6 +1301,7 @@ type PairingClientsListProps = {
   revokingClientSessionId: string | null;
   onRevokePairingLink: (id: string) => void;
   onRevokeClientSession: (sessionId: ServerClientSessionRecord["sessionId"]) => void;
+  canRevoke: boolean;
 };
 const PairingClientsList = memo(function PairingClientsList({
 @@ -1265,6 +1317,7 @@ const PairingClientsList = memo(function PairingClientsList({
   revokingClientSessionId,
   onRevokePairingLink,
   onRevokeClientSession,
+  canRevoke,
 }: PairingClientsListProps) {
   return (
     <>
 @@ -1279,6 +1332,7 @@ const PairingClientsList = memo(function PairingClientsList({
           presentation={presentation}
           revokingPairingLinkId={revokingPairingLinkId}
           onRevoke={onRevokePairingLink}
+          canRevoke={canRevoke}
         />
       ))}
 @@ -1289,6 +1343,7 @@ const PairingClientsList = memo(function PairingClientsList({
           presentation={presentation}
           revokingClientSessionId={revokingClientSessionId}
           onRevokeSession={onRevokeClientSession}
+          canRevoke={canRevoke}
         />
       ))}
 @@ -1793,6 +1848,7 @@ function CloudLinkSwitch({
 }
 function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: boolean }) {
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
   const {
     isSignedIn,
     linkState: primaryCloudLinkState,
 @@ -1813,6 +1869,11 @@ function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: b
   const isBusy = isUpdating || isUpdatingPreference;
   const updateManagedTunnel = async (enabled: boolean) => {
+    if (
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope)
+    )
+      return;
     setIsUpdating(true);
     const ok = await reconcileCloudState({ managedTunnel: enabled, publish: publishAgentActivity });
     if (ok) {
 @@ -1836,6 +1897,11 @@ function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: b
   };
   const updatePublishAgentActivity = async (enabled: boolean) => {
+    if (
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope)
+    )
+      return;
     setIsUpdatingPreference(true);
     const ok = await reconcileCloudState({ managedTunnel: managedTunnelActive, publish: enabled });
     if (ok) {
 @@ -1883,7 +1949,13 @@ function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: b
           control={
             <CloudLinkSwitch
               checked={managedTunnelActive}
-              disabled={!canManageRelay || !isSignedIn || primaryCloudLinkState.isPending || isBusy}
+              disabled={
+                !canManageRelay ||
+                !isSignedIn ||
+                primaryCloudLinkState.data === null ||
+                primaryCloudLinkState.isPending ||
+                isBusy
+              }
               disabledReason={disabledReason}
               onCheckedChange={(enabled) => void updateManagedTunnel(enabled)}
             />
 @@ -1897,7 +1969,13 @@ function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: b
           <CloudLinkSwitch
             ariaLabel="Publish agent activity to mobile clients"
             checked={publishAgentActivity}
-            disabled={!canManageRelay || !isSignedIn || primaryCloudLinkState.isPending || isBusy}
+            disabled={
+              !canManageRelay ||
+              !isSignedIn ||
+              primaryCloudLinkState.data === null ||
+              primaryCloudLinkState.isPending ||
+              isBusy
+            }
             disabledReason={disabledReason}
             onCheckedChange={(enabled) => void updatePublishAgentActivity(enabled)}
           />
 @@ -1922,8 +2000,23 @@ function ConfiguredCloudLinkRow({ canManageRelay }: { readonly canManageRelay: b
   );
 }
-function CloudLinkRow({ canManageRelay }: { readonly canManageRelay: boolean }) {
+function CloudLinkRow({
-  return hasCloudPublicConfig() ? <ConfiguredCloudLinkRow canManageRelay={canManageRelay} /> : null;
+  canReadRelay,
+  canManageRelay,
+}: {
+  readonly canReadRelay: boolean;
+  readonly canManageRelay: boolean;
+}) {
+  if (!hasCloudPublicConfig()) return null;
+  if (!canReadRelay) {
+    return (
+      <SettingsRow
+        title="T3 Connect"
+        description="To edit these settings, pair this connection with both View relay and Manage relay permissions."
+      />
+    );
+  }
+  return <ConfiguredCloudLinkRow canManageRelay={canManageRelay} />;
 }
 function EmptyRemoteEnvironments({ cloudEnabled = true }: { readonly cloudEnabled?: boolean }) {
 @@ -1981,11 +2074,9 @@ export function ConnectionsSettings() {
   });
   const primaryEnvironmentId = primaryEnvironment?.environmentId ?? null;
   const primarySessionState = usePrimarySessionState();
-  const currentSessionScopes = desktopBridge
+  const currentSessionScopes = primarySessionState.data?.authenticated
-    ? AuthAdministrativeScopes
+    ? (primarySessionState.data.scopes ?? null)
-    : primarySessionState.data?.authenticated
+    : null;
-      ? (primarySessionState.data.scopes ?? null)
-      : null;
   const currentAuthPolicy = desktopBridge ? null : (primarySessionState.data?.auth.policy ?? null);
   // Catalog order is the order the machines were added; rows never jump when
   // one is switched off.
 @@ -2165,12 +2256,14 @@ export function ConnectionsSettings() {
   const setDefaultAdvertisedEndpointKey = useUiStateStore(
     (state) => state.setDefaultAdvertisedEndpointKey,
   );
-  const canManageLocalBackend =
+  const canReadAccess = useEnvironmentScope(primaryEnvironmentId, AuthAccessReadScope);
-    !isLocalEnvironmentDisabled() &&
+  const canWriteAccess = useEnvironmentScope(primaryEnvironmentId, AuthAccessWriteScope);
-    (currentSessionScopes?.includes(AuthAccessWriteScope) ?? false);
+  const canReadRelay = useEnvironmentScope(primaryEnvironmentId, AuthRelayReadScope);
-  const canManageRelay = currentSessionScopes?.includes(AuthRelayWriteScope) ?? false;
+  const canMaintain = useEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope);
+  const canManageRelay = useEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope);
+  const canManageLocalBackend = !isLocalEnvironmentDisabled() && canMaintain;
   const authAccessChanges = useEnvironmentQuery(
-    canManageLocalBackend && primaryEnvironmentId !== null
+    canReadAccess && primaryEnvironmentId !== null
       ? authEnvironment.accessChanges({
           environmentId: primaryEnvironmentId,
           input: null,
 @@ -2273,7 +2366,12 @@ export function ConnectionsSettings() {
   const handleDesktopServerExposureChange = useCallback(
     async (checked: boolean) => {
-      if (!desktopBridge) return;
+      if (
+        !desktopBridge ||
+        primaryEnvironmentId === null ||
+        !readEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope)
+      )
+        return;
       setIsUpdatingDesktopServerExposure(true);
       setDesktopServerExposureMutationError(null);
       try {
 @@ -2296,7 +2394,7 @@ export function ConnectionsSettings() {
         setIsUpdatingDesktopServerExposure(false);
       }
     },
-    [desktopBridge],
+    [desktopBridge, primaryEnvironmentId],
   );
   const handleConfirmDesktopServerExposureChange = useCallback(() => {
 @@ -2306,7 +2404,12 @@ export function ConnectionsSettings() {
   }, [handleDesktopServerExposureChange, pendingDesktopServerExposureMode]);
   const handleConfirmTailscaleServeSetup = useCallback(async () => {
-    if (!desktopBridge) return;
+    if (
+      !desktopBridge ||
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope)
+    )
+      return;
     if (!isTailscaleServePortValid) return;
     setIsUpdatingTailscaleServe(true);
     setDesktopServerExposureMutationError(null);
 @@ -2331,7 +2434,7 @@ export function ConnectionsSettings() {
     } finally {
       setIsUpdatingTailscaleServe(false);
     }
-  }, [desktopBridge, isTailscaleServePortValid, parsedTailscaleServePort]);
+  }, [desktopBridge, isTailscaleServePortValid, parsedTailscaleServePort, primaryEnvironmentId]);
   const handleStartTailscaleServeSetup = useCallback(
     (endpoint: AdvertisedEndpoint) => {
 @@ -2344,7 +2447,12 @@ export function ConnectionsSettings() {
   );
   const handleConfirmTailscaleServeDisable = useCallback(async () => {
-    if (!desktopBridge) return;
+    if (
+      !desktopBridge ||
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope)
+    )
+      return;
     setIsUpdatingTailscaleServe(true);
     setDesktopServerExposureMutationError(null);
     try {
 @@ -2367,34 +2475,47 @@ export function ConnectionsSettings() {
     } finally {
       setIsUpdatingTailscaleServe(false);
     }
-  }, [desktopBridge, desktopServerExposureState?.tailscaleServePort]);
+  }, [desktopBridge, desktopServerExposureState, primaryEnvironmentId]);
   const handleStartTailscaleServeDisable = useCallback((_endpoint: AdvertisedEndpoint) => {
     setDisableTailscaleServeDialogOpen(true);
   }, []);
-  const handleRevokeDesktopPairingLink = useCallback(async (id: string) => {
+  const handleRevokeDesktopPairingLink = useCallback(
-    setRevokingDesktopPairingLinkId(id);
+    async (id: string) => {
-    setDesktopAccessManagementMutationError(null);
+      if (
-    try {
+        primaryEnvironmentId === null ||
-      await revokeServerPairingLink(id);
+        !readEnvironmentScope(primaryEnvironmentId, AuthAccessWriteScope)
-    } catch (error) {
+      )
-      const message = error instanceof Error ? error.message : "Failed to revoke pairing link.";
+        return;
-      setDesktopAccessManagementMutationError(message);
+      setRevokingDesktopPairingLinkId(id);
-      toastManager.add(
+      setDesktopAccessManagementMutationError(null);
-        stackedThreadToast({
+      try {
-          type: "error",
+        await revokeServerPairingLink(id);
-          title: "Could not revoke pairing link",
+      } catch (error) {
-          description: message,
+        const message = error instanceof Error ? error.message : "Failed to revoke pairing link.";
-        }),
+        setDesktopAccessManagementMutationError(message);
-      );
+        toastManager.add(
-    } finally {
+          stackedThreadToast({
-      setRevokingDesktopPairingLinkId(null);
+            type: "error",
-    }
+            title: "Could not revoke pairing link",
-  }, []);
+            description: message,
+          }),
+        );
+      } finally {
+        setRevokingDesktopPairingLinkId(null);
+      }
+    },
+    [primaryEnvironmentId],
+  );
   const handleRevokeDesktopClientSession = useCallback(
     async (sessionId: ServerClientSessionRecord["sessionId"]) => {
+      if (
+        primaryEnvironmentId === null ||
+        !readEnvironmentScope(primaryEnvironmentId, AuthAccessWriteScope)
+      )
+        return;
       setRevokingDesktopClientSessionId(sessionId);
       setDesktopAccessManagementMutationError(null);
       try {
 @@ -2413,10 +2534,15 @@ export function ConnectionsSettings() {
         setRevokingDesktopClientSessionId(null);
       }
     },
-    [],
+    [primaryEnvironmentId],
   );
   const handleRevokeOtherDesktopClients = useCallback(async () => {
+    if (
+      primaryEnvironmentId === null ||
+      !readEnvironmentScope(primaryEnvironmentId, AuthAccessWriteScope)
+    )
+      return;
     setIsRevokingOtherDesktopClients(true);
     setDesktopAccessManagementMutationError(null);
     try {
 @@ -2439,7 +2565,7 @@ export function ConnectionsSettings() {
     } finally {
       setIsRevokingOtherDesktopClients(false);
     }
-  }, []);
+  }, [primaryEnvironmentId]);
   // Shared by manual SSH submission and discovered-host selection.
   const connectSavedBackendSshTarget = useCallback(
 @@ -2743,8 +2869,6 @@ export function ConnectionsSettings() {
         : visibleDesktopNetworkAdvertisedEndpoints,
     [tailscaleHttpsEndpoint, visibleDesktopNetworkAdvertisedEndpoints],
   );
-  const isLocalBackendRemotelyReachable =
-    isLocalBackendNetworkAccessible || tailscaleHttpsEndpoint?.status === "available";
   const defaultDesktopNetworkAdvertisedEndpoint = useMemo(
     () =>
       selectPairingEndpoint(visibleDesktopNetworkAdvertisedEndpoints, defaultAdvertisedEndpointKey),
 @@ -3074,7 +3198,12 @@ export function ConnectionsSettings() {
   // entry catches up (registers/unregisters) without a reload.
   const applyWslSettingChange = useCallback(
     async (apply: () => Promise<DesktopWslState>) => {
-      if (!desktopBridge) return;
+      if (
+        !desktopBridge ||
+        primaryEnvironmentId === null ||
+        !readEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope)
+      )
+        return;
       setIsUpdatingWslBackend(true);
       setDesktopWslMutationError(null);
       try {
 @@ -3099,7 +3228,7 @@ export function ConnectionsSettings() {
         setIsUpdatingWslBackend(false);
       }
     },
-    [desktopBridge],
+    [desktopBridge, primaryEnvironmentId],
   );
   // Reload the keep-alive WSL state atom. Clearing the mutation error before
 @@ -3428,6 +3557,7 @@ export function ConnectionsSettings() {
         revokingClientSessionId={revokingDesktopClientSessionId}
         onRevokePairingLink={handleRevokeDesktopPairingLink}
         onRevokeClientSession={handleRevokeDesktopClientSession}
+        canRevoke={canWriteAccess}
       />
     </>
   );
 @@ -3467,35 +3597,42 @@ export function ConnectionsSettings() {
     <SettingsRow
       title={searchableSetting("network-access").title}
       description={
-        currentAuthPolicy === "remote-reachable"
+        desktopBridge
-          ? "Remote access is already configured. Change network exposure where the server starts."
+          ? "This connection cannot view or change network exposure."
-          : "Only this machine can connect. Restart with a non-loopback host for remote pairing."
+          : currentAuthPolicy === "remote-reachable"
+            ? "Remote access is already configured. Change network exposure where the server starts."
+            : currentAuthPolicy === "loopback-browser"
+              ? "Only this machine can connect. Restart with a non-loopback host for remote pairing."
+              : "Network exposure information is unavailable."
       }
       control={
-        <Tooltip>
+        !desktopBridge &&
-          <TooltipTrigger
+        (currentAuthPolicy === "remote-reachable" || currentAuthPolicy === "loopback-browser") ? (
-            render={
+          <Tooltip>
-              <span className="inline-flex">
+            <TooltipTrigger
-                <Switch
+              render={
-                  checked={isLocalBackendNetworkAccessible}
+                <span className="inline-flex">
-                  disabled
+                  <Switch
-                  aria-label="Enable network access"
+                    checked={isLocalBackendNetworkAccessible}
-                />
+                    disabled
-              </span>
+                    aria-label="Enable network access"
-            }
+                  />
-          />
+                </span>
-          <TooltipPopup side="top">
+              }
-            Network exposure changes restart the backend and must be controlled where the server
+            />
-            process is launched.
+            <TooltipPopup side="top">
-          </TooltipPopup>
+              Network exposure changes restart the backend and must be controlled where the server
-        </Tooltip>
+              process is launched.
+            </TooltipPopup>
+          </Tooltip>
+        ) : undefined
       }
     />
   );
   const primarySettings = (
     <>
-      {desktopBridge || canManageLocalBackend ? (
+      {primaryEnvironmentId !== null ? (
         <>
           <SettingsSection
             {...searchableSetting("connections-environment")}
 @@ -3591,17 +3728,21 @@ export function ConnectionsSettings() {
                 {renderEndpointRows("endpoint-rail")}
                 {renderTailscaleRow()}
                 {renderWslRow()}
-                <CloudLinkRow canManageRelay={canManageRelay} />
+                {canReadRelay || canManageRelay ? (
+                  <CloudLinkRow canReadRelay={canReadRelay} canManageRelay={canManageRelay} />
+                ) : null}
               </>
             ) : canManageLocalBackend ? (
               <>
                 {renderDisabledNetworkAccessRow()}
-                <CloudLinkRow canManageRelay={canManageRelay} />
+                {canReadRelay || canManageRelay ? (
+                  <CloudLinkRow canReadRelay={canReadRelay} canManageRelay={canManageRelay} />
+                ) : null}
               </>
             ) : null}
           </SettingsSection>
-          {isLocalBackendRemotelyReachable ? (
+          {canReadAccess || canWriteAccess ? (
             <FoldedSettingsSection
               id="authorized-clients"
               title="Authorized clients"
 @@ -3610,12 +3751,21 @@ export function ConnectionsSettings() {
                 visibleDesktopPairingLinks,
               )}
               control={
-                <AuthorizedClientsHeaderAction
+                canWriteAccess ? (
-                  onPairingLinkCreated={handlePairingLinkCreated}
+                  <AuthorizedClientsHeaderAction
-                  clientSessions={desktopClientSessions}
+                    delegatableScopes={currentSessionScopes ?? []}
-                  isRevokingOtherClients={isRevokingOtherDesktopClients}
+                    onPairingLinkCreated={handlePairingLinkCreated}
-                  onRevokeOtherClients={handleRevokeOtherDesktopClients}
+                    clientSessions={
-                />
+                      canReadAccess &&
+                      authAccessChanges.error === null &&
+                      authAccessChanges.data?.type === "snapshot"
+                        ? desktopClientSessions
+                        : null
+                    }
+                    isRevokingOtherClients={isRevokingOtherDesktopClients}
+                    onRevokeOtherClients={handleRevokeOtherDesktopClients}
+                  />
+                ) : undefined
               }
             >
               <ScrollArea
 @@ -3624,12 +3774,18 @@ export function ConnectionsSettings() {
                 className="max-h-[22.5rem]"
                 data-testid="authorized-clients-scroll-area"
               >
-                {renderAuthorizedClients("current")}
+                {canReadAccess ? (
+                  renderAuthorizedClients("current")
+                ) : (
+                  <p className="px-4 py-3 text-xs text-muted-foreground">
+                    This connection can create access links but cannot view authorized clients.
+                  </p>
+                )}
               </ScrollArea>
             </FoldedSettingsSection>
           ) : null}
           <AlertDialog
-            open={isDesktopServerExposureDialogOpen}
+            open={isDesktopServerExposureDialogOpen && canManageLocalBackend}
             onOpenChange={(open) => {
               if (isUpdatingDesktopServerExposure) return;
               setIsDesktopServerExposureDialogOpen(open);
 @@ -3662,7 +3818,9 @@ export function ConnectionsSettings() {
                   variant="default"
                   onClick={handleConfirmDesktopServerExposureChange}
                   disabled={
-                    pendingDesktopServerExposureMode === null || isUpdatingDesktopServerExposure
+                    !canManageLocalBackend ||
+                    pendingDesktopServerExposureMode === null ||
+                    isUpdatingDesktopServerExposure
                   }
                 >
                   {isUpdatingDesktopServerExposure && <Spinner size="sm" />}
 @@ -3678,7 +3836,7 @@ export function ConnectionsSettings() {
             </AlertDialogPopup>
           </AlertDialog>
           <AlertDialog
-            open={isWslConfirmDialogOpen}
+            open={isWslConfirmDialogOpen && canManageLocalBackend}
             onOpenChange={(open) => {
               if (isUpdatingWslBackend) return;
               if (!open) setPendingWslChange(null);
 @@ -3725,7 +3883,7 @@ export function ConnectionsSettings() {
                     <Button
                       variant="outline"
                       onClick={() => handleConfirmEnableWsl("wsl-only")}
-                      disabled={isUpdatingWslBackend}
+                      disabled={isUpdatingWslBackend || !canManageLocalBackend}
                     >
                       {isUpdatingWslBackend ? (
                         <>
 @@ -3739,7 +3897,7 @@ export function ConnectionsSettings() {
                     <Button
                       variant="default"
                       onClick={() => handleConfirmEnableWsl("both")}
-                      disabled={isUpdatingWslBackend}
+                      disabled={isUpdatingWslBackend || !canManageLocalBackend}
                     >
                       {isUpdatingWslBackend ? (
                         <>
 @@ -3760,7 +3918,7 @@ export function ConnectionsSettings() {
                         : "default"
                     }
                     onClick={handleConfirmWslChange}
-                    disabled={isUpdatingWslBackend}
+                    disabled={isUpdatingWslBackend || !canManageLocalBackend}
                   >
                     {isUpdatingWslBackend ? (
                       <>
 @@ -3786,7 +3944,7 @@ export function ConnectionsSettings() {
             </AlertDialogPopup>
           </AlertDialog>
           <AlertDialog
-            open={disableTailscaleServeDialogOpen}
+            open={disableTailscaleServeDialogOpen && canManageLocalBackend}
             onOpenChange={(open) => {
               if (isUpdatingTailscaleServe) return;
               setDisableTailscaleServeDialogOpen(open);
 @@ -3809,7 +3967,7 @@ export function ConnectionsSettings() {
                 <Button
                   variant="destructive"
                   onClick={() => void handleConfirmTailscaleServeDisable()}
-                  disabled={isUpdatingTailscaleServe}
+                  disabled={isUpdatingTailscaleServe || !canManageLocalBackend}
                 >
                   {isUpdatingTailscaleServe ? (
                     <>
 @@ -3899,10 +4057,12 @@ export function ConnectionsSettings() {
       ) : (
         <SettingsSection {...searchableSetting("connections-environment")}>
           <SettingsRow
-            title="Administrative access"
+            title="No environment selected"
-            description="Pairing links and client-session management require the access:write scope for this backend."
+            description="Connect an environment to view its settings and access."
           />
-          <CloudLinkRow canManageRelay={canManageRelay} />
+          {canReadRelay || canManageRelay ? (
+            <CloudLinkRow canReadRelay={canReadRelay} canManageRelay={canManageRelay} />
+          ) : null}
         </SettingsSection>
       )}
     </>

apps/web/src/components/settings/DeviceHostsSettings.tsx+10-2

...	@@ -1,4 +1,6 @@	...	@@ -1,4 +1,6 @@
1	import { DeviceToolVersions } from "../device/DeviceToolVersions";	1	import { DeviceToolVersions } from "../device/DeviceToolVersions";
		2	import { AuthSettingsWriteScope } from "@t3tools/contracts";
		3	import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
2	import { Tooltip, TooltipTrigger, TooltipPopup } from "../ui/tooltip";	4	import { Tooltip, TooltipTrigger, TooltipPopup } from "../ui/tooltip";
3	import { AppleIcon, AndroidIcon } from "../Icons";	5	import { AppleIcon, AndroidIcon } from "../Icons";
4	import { Spinner } from "../ui/spinner";	6	import { Spinner } from "../ui/spinner";
...	@@ -22,6 +24,7 @@ import { deviceHostConnectionKey } from "./deviceHostConnectionChecks";	...	@@ -22,6 +24,7 @@ import { deviceHostConnectionKey } from "./deviceHostConnectionChecks";
22		24
23	export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null }) {	25	export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null }) {
24	const { scope, environments, connectedEnvironments } = useSettingsScope();	26	const { scope, environments, connectedEnvironments } = useSettingsScope();
		27	const canConfigure = useEnvironmentScope(props.environmentId, AuthSettingsWriteScope);
25	const projectScope = scope.kind === "project" \|\| scope.kind === "checkout";	28	const projectScope = scope.kind === "project" \|\| scope.kind === "checkout";
26	const update = useAtomCommand(serverEnvironment.updateSettings, { reportFailure: false });	29	const update = useAtomCommand(serverEnvironment.updateSettings, { reportFailure: false });
27	const [editing, setEditing] = useState<SshDeviceHostConfig \| null>(null);	30	const [editing, setEditing] = useState<SshDeviceHostConfig \| null>(null);
...	@@ -42,6 +45,9 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null	...	@@ -42,6 +45,9 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null
42	if (environment.connection.phase !== "connected" \|\| !environment.serverConfig) {	45	if (environment.connection.phase !== "connected" \|\| !environment.serverConfig) {
43	throw new Error("Environment disconnected");	46	throw new Error("Environment disconnected");
44	}	47	}
		48	if (!readEnvironmentScope(environment.environmentId, AuthSettingsWriteScope)) {
		49	throw new Error("This connection cannot change device settings.");
		50	}
45	return update({	51	return update({
46	environmentId: environment.environmentId,	52	environmentId: environment.environmentId,
47	input: {	53	input: {
...	@@ -85,7 +91,9 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null	...	@@ -85,7 +91,9 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null
85	<Button	91	<Button
86	size="sm"	92	size="sm"
87	variant="outline"	93	variant="outline"
88	disabled={projectScope \|\| busy \|\| !props.environmentId \|\| editing !== null}	94	disabled={
		95	!canConfigure \|\| projectScope \|\| busy \|\| !props.environmentId \|\| editing !== null
		96	}
89	onClick={() => {	97	onClick={() => {
90	setOriginalHost(null);	98	setOriginalHost(null);
91	setEditing({ id: randomUUID(), label: "", target: "" });	99	setEditing({ id: randomUUID(), label: "", target: "" });
...	@@ -113,7 +121,7 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null	...	@@ -113,7 +121,7 @@ export function DeviceHostsSettings(props: { environmentId: EnvironmentId \| null
113	environmentLabel={environment.label}	121	environmentLabel={environment.label}
114	environmentId={environment.environmentId}	122	environmentId={environment.environmentId}
115	hosts={environment.serverConfig?.settings.deviceHosts ?? []}	123	hosts={environment.serverConfig?.settings.deviceHosts ?? []}
116	busy={projectScope \|\| busy}	124	busy={!canConfigure \|\| projectScope \|\| busy}
117	checks={checks}	125	checks={checks}
118	testConnection={async (host) => {	126	testConnection={async (host) => {
119	const results = await testConnection(host);	127	const results = await testConnection(host);

apps/web/src/components/settings/DiagnosticsSettings.tsx+34-23

 @@ -1,4 +1,7 @@
 import { ProcessSignalActions } from "./ProcessSignalActions";
+import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
+import { AuthEnvironmentMaintainScope } from "@t3tools/contracts";
 import { RefreshIcon } from "~/components/ui/refresh-icon";
 import { AlertTriangleIcon, CopyIcon, FolderOpenIcon, InfoIcon } from "lucide-react";
 import { ChevronDown, ChevronRight } from "lucide";
 @@ -17,7 +20,7 @@ import * as Option from "effect/Option";
 import { cn } from "../../lib/utils";
 import { ensureLocalApi } from "../../localApi";
-import { resolveAndPersistPreferredEditor } from "../../editorPreferences";
+import { useOpenInPreferredEditor } from "../../editorPreferences";
 import { formatRelativeTimeLabel, getRelativeTimeState } from "../../timestampFormat";
 import { useEnvironmentQuery } from "../../state/query";
 import { serverEnvironment } from "../../state/server";
 @@ -296,11 +299,13 @@ function ProcessNameCell({
 function ProcessDiagnosticsTable({
   processes,
+  canMaintainEnvironment,
   signalingPid,
   onSignal,
   emptyLabel,
 }: {
   processes: ReadonlyArray<ServerProcessDiagnosticsEntry>;
+  canMaintainEnvironment: boolean;
   signalingPid: number | null;
   onSignal: (pid: number, signal: ServerProcessSignal) => void;
   emptyLabel?: string;
 @@ -408,7 +413,7 @@ function ProcessDiagnosticsTable({
                 </td>
                 <td className="p-2 align-middle sm:pr-4">
                   <ProcessSignalActions
-                    disabled={signalingPid === process.pid}
+                    disabled={!canMaintainEnvironment || signalingPid === process.pid}
                     onSignal={(signal) => onSignal(process.pid, signal)}
                   />
                 </td>
 @@ -710,14 +715,14 @@ export function DiagnosticsSettingsPanel() {
   // The boundary only mounts this page when the selection resolves to one
   // connected environment, so the representative is the one to inspect.
   const environmentId = environment?.environmentId ?? null;
+  const canMaintainEnvironment = useEnvironmentScope(environmentId, AuthEnvironmentMaintainScope);
   const observability = environment?.serverConfig?.observability;
   const availableEditors = environment?.serverConfig?.availableEditors;
+  const canOpenHostEditor = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
   const signalServerProcess = useAtomCommand(serverEnvironment.signalProcess, {
     reportFailure: false,
   });
-  const openInEditor = useAtomCommand(shellEnvironment.openInEditor, {
+  const openInEditor = useOpenInPreferredEditor(environmentId, availableEditors ?? []);
-    reportFailure: false,
-  });
   const [resourceWindowMs, setResourceWindowMs] = useState(15 * 60_000);
   const selectedResourceWindow =
     RESOURCE_HISTORY_WINDOWS.find((option) => option.windowMs === resourceWindowMs) ??
 @@ -773,26 +778,17 @@ export function DiagnosticsSettingsPanel() {
     const logsDirectoryPath = observability?.logsDirectoryPath ?? null;
     if (!logsDirectoryPath) return;
-    const editor = resolveAndPersistPreferredEditor(availableEditors ?? []);
+    if (
-    if (!editor) {
+      environmentId === null ||
-      setOpenLogsDirectoryError("No available editors found.");
+      !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)
-      return;
+    ) {
-    }
-    if (environmentId === null) {
-      setOpenLogsDirectoryError("No environment is selected.");
       return;
     }
     setIsOpeningLogsDirectory(true);
     setOpenLogsDirectoryError(null);
     void (async () => {
-      const result = await openInEditor({
+      const result = await openInEditor(logsDirectoryPath);
-        environmentId,
-        input: {
-          cwd: logsDirectoryPath,
-          editor,
-        },
-      });
       setIsOpeningLogsDirectory(false);
       if (result._tag === "Failure" && !isAtomCommandInterrupted(result)) {
         const error = squashAtomCommandFailure(result);
 @@ -801,7 +797,7 @@ export function DiagnosticsSettingsPanel() {
         );
       }
     })();
-  }, [availableEditors, environmentId, observability?.logsDirectoryPath, openInEditor]);
+  }, [environmentId, observability?.logsDirectoryPath, openInEditor]);
   const isInitialLoading = isPending && data === null;
   const isProcessInitialLoading = isProcessPending && processData === null;
 @@ -809,7 +805,12 @@ export function DiagnosticsSettingsPanel() {
     async (pid: number, signal: ServerProcessSignal) => {
       const targetEnvironmentId = environmentIdRef.current;
       const process = processDataRef.current?.processes.find((entry) => entry.pid === pid);
-      if (targetEnvironmentId === null || process === undefined) return;
+      if (
+        targetEnvironmentId === null ||
+        process === undefined ||
+        !readEnvironmentScope(targetEnvironmentId, AuthEnvironmentMaintainScope)
+      )
+        return;
       if (signalingPidRef.current !== null) return;
       signalingPidRef.current = pid;
       setSignalingPid(pid);
 @@ -838,7 +839,12 @@ export function DiagnosticsSettingsPanel() {
           return;
         }
       }
-      if (environmentIdRef.current !== targetEnvironmentId) {
+      const currentEnvironmentId = environmentIdRef.current;
+      if (
+        currentEnvironmentId === null ||
+        currentEnvironmentId !== targetEnvironmentId ||
+        !readEnvironmentScope(currentEnvironmentId, AuthEnvironmentMaintainScope)
+      ) {
         clearSignaling();
         return;
       }
 @@ -956,6 +962,7 @@ export function DiagnosticsSettingsPanel() {
         ) : null}
         <ProcessDiagnosticsTable
           processes={processData?.processes ?? []}
+          canMaintainEnvironment={canMaintainEnvironment}
           signalingPid={signalingPid}
           onSignal={signalProcess}
           emptyLabel={
 @@ -1041,7 +1048,11 @@ export function DiagnosticsSettingsPanel() {
                   <Button
                     size="icon-xs"
                     variant="ghost-muted"
-                    disabled={!observability?.logsDirectoryPath || isOpeningLogsDirectory}
+                    disabled={
+                      !canOpenHostEditor ||
+                      !observability?.logsDirectoryPath ||
+                      isOpeningLogsDirectory
+                    }
                     onClick={openLogsDirectory}
                     aria-label="Open logs folder"
                   >

apps/web/src/components/settings/EnvironmentIconPicker.test.ts+2-2

...	@@ -30,10 +30,10 @@ describe("resolveEnvironmentIconPickerLock", () => {	...	@@ -30,10 +30,10 @@ describe("resolveEnvironmentIconPickerLock", () => {
30	).toMatch(/cannot change/);	30	).toMatch(/cannot change/);
31	});	31	});
32		32
33	it("stays open while access is still resolving so a slow session does not flicker", () => {	33	it("waits for a settings grant before allowing changes", () => {
34	expect(	34	expect(
35	resolveEnvironmentIconPickerLock({ serverConfig: config(true), operateAccess: "pending" }),	35	resolveEnvironmentIconPickerLock({ serverConfig: config(true), operateAccess: "pending" }),
36	).toBeNull();	36	).toMatch(/cannot change/);
37	expect(	37	expect(
38	resolveEnvironmentIconPickerLock({ serverConfig: config(true), operateAccess: "granted" }),	38	resolveEnvironmentIconPickerLock({ serverConfig: config(true), operateAccess: "granted" }),
39	).toBeNull();	39	).toBeNull();

apps/web/src/components/settings/EnvironmentIconPicker.tsx+6-35

 @@ -1,4 +1,5 @@
 import {
+  AuthSettingsWriteScope,
   ENVIRONMENT_MACHINE_KINDS,
   isEnvironmentMachineKind,
   resolveEnvironmentMachineKind,
 @@ -6,11 +7,8 @@ import {
   type ServerConfig,
 } from "@t3tools/contracts";
-import { isElectron } from "../../env";
-import { usePrimarySessionState } from "../../environments/primary";
 import { useUpdateEnvironmentSettings } from "../../hooks/useSettings";
-import { usePrimaryEnvironmentId } from "../../state/environments";
+import { useEnvironmentScope } from "../../state/session";
-import { useEnvironmentSessionState } from "../../state/session";
 import { ENVIRONMENT_MACHINE_KIND_LABELS, EnvironmentMachineIcon } from "../EnvironmentMachineIcon";
 import {
   MenuItem,
 @@ -21,10 +19,6 @@ import {
   MenuSubPopup,
   MenuSubTrigger,
 } from "../ui/menu";
-import {
-  resolvePrimaryOperateAccess,
-  resolveRemoteOperateAccess,
-} from "./ProviderSettingsPanel.logic";
 /**
  * Why the picker is inert, in the order the user can do something about it.
 @@ -40,37 +34,12 @@ export function resolveEnvironmentIconPickerLock(input: {
   if (input.serverConfig.environment.capabilities.environmentIcon !== true) {
     return "This environment's server is too old to keep an icon. Update it to choose one.";
   }
-  if (input.operateAccess === "denied") {
+  if (input.operateAccess !== "granted") {
     return "Your session on this environment cannot change its settings.";
   }
   return null;
 }
-// Same split the provider settings use: the desktop app owns its primary
-// server outright, a browser session on the primary checks its cookie
-// session's scopes, and a remote checks the scopes its own server reports.
-function useEnvironmentOperateAccess(environmentId: EnvironmentId) {
-  const isPrimary = usePrimaryEnvironmentId() === environmentId;
-  const primarySession = usePrimarySessionState();
-  const remoteSession = useEnvironmentSessionState(environmentId);
-  if (isPrimary) {
-    return isElectron
-      ? "granted"
-      : resolvePrimaryOperateAccess({
-          isPrimary: true,
-          hasDesktopBridge: false,
-          session: primarySession.data,
-          isPending: primarySession.isPending,
-          hasError: primarySession.error !== null,
-        });
-  }
-  return resolveRemoteOperateAccess({
-    session: remoteSession.data,
-    isPending: remoteSession.isPending,
-    hasError: remoteSession.hasError,
-  });
-}
 /**
  * "Icon" submenu for an environment's row menu. Lists the machine kinds with
  * the server's own detection marked, so the user can tell whether detection
 @@ -86,7 +55,9 @@ export function EnvironmentIconMenu({
   readonly serverConfig: ServerConfig | null;
 }) {
   const updateSettings = useUpdateEnvironmentSettings(environmentId);
-  const operateAccess = useEnvironmentOperateAccess(environmentId);
+  const operateAccess = useEnvironmentScope(environmentId, AuthSettingsWriteScope)
+    ? "granted"
+    : "denied";
   const lock = resolveEnvironmentIconPickerLock({ serverConfig, operateAccess });
   // With no detection the server falls back to "server", so picking that
   // kind clears the override the same way picking the detected kind does.

apps/web/src/components/settings/IntegrationsSettings.test.tsx+12

...	@@ -17,6 +17,16 @@ const { listBrowserImportSources } = vi.hoisted(() => ({	...	@@ -17,6 +17,16 @@ const { listBrowserImportSources } = vi.hoisted(() => ({
17	listBrowserImportSources: vi.fn().mockResolvedValue([]),	17	listBrowserImportSources: vi.fn().mockResolvedValue([]),
18	}));	18	}));
19		19
		20	vi.mock("../ui/tooltip", () => ({
		21	Tooltip: ({ children }: { children: ReactNode }) => children,
		22	TooltipTrigger: ({ render, children }: { render: ReactNode; children: ReactNode }) => (
		23	<>
		24	{render}
		25	{children}
		26	</>
		27	),
		28	TooltipPopup: () => null,
		29	}));
20	vi.mock("../preview/previewBridge", () => ({	30	vi.mock("../preview/previewBridge", () => ({
21	previewBridge: { listBrowserImportSources },	31	previewBridge: { listBrowserImportSources },
22	}));	32	}));
...	@@ -24,6 +34,8 @@ vi.mock("../../env", () => ({ isElectron: true }));	...	@@ -24,6 +34,8 @@ vi.mock("../../env", () => ({ isElectron: true }));
24	vi.mock("../../state/environments", () => ({	34	vi.mock("../../state/environments", () => ({
25	useEnvironments: () => ({ environments: [], isReady: true }),	35	useEnvironments: () => ({ environments: [], isReady: true }),
26	usePrimaryEnvironment: () => null,	36	usePrimaryEnvironment: () => null,
		37	// Settings rows resolve the primary grant before rendering server controls.
		38	usePrimaryEnvironmentId: () => null,
27	}));	39	}));
28	vi.mock("../../hooks/useSettings", async (importOriginal) => ({	40	vi.mock("../../hooks/useSettings", async (importOriginal) => ({
29	...(await importOriginal<typeof import("../../hooks/useSettings")>()),	41	...(await importOriginal<typeof import("../../hooks/useSettings")>()),

apps/web/src/components/settings/IntegrationsSettings.tsx+16-2

...	@@ -12,6 +12,7 @@ import { DeviceHostsSettings } from "./DeviceHostsSettings";	...	@@ -12,6 +12,7 @@ import { DeviceHostsSettings } from "./DeviceHostsSettings";
12	* @module IntegrationsSettings	12	* @module IntegrationsSettings
13	*/	13	*/
14	import {	14	import {
		15	AuthSettingsWriteScope,
15	BrowserImportFailureReason,	16	BrowserImportFailureReason,
16	BROWSER_PROFILE_MAX_COUNT,	17	BROWSER_PROFILE_MAX_COUNT,
17	type BrowserLinkTarget,	18	type BrowserLinkTarget,
...	@@ -49,6 +50,7 @@ import { previewBridge } from "~/components/preview/previewBridge";	...	@@ -49,6 +50,7 @@ import { previewBridge } from "~/components/preview/previewBridge";
49	import { cn, randomUUID } from "~/lib/utils";	50	import { cn, randomUUID } from "~/lib/utils";
50	import { useEnvironments, usePrimaryEnvironment } from "~/state/environments";	51	import { useEnvironments, usePrimaryEnvironment } from "~/state/environments";
51	import { deviceEnvironment, useDeviceState } from "~/state/device";	52	import { deviceEnvironment, useDeviceState } from "~/state/device";
		53	import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
52	import { useAtomCommand } from "~/state/use-atom-command";	54	import { useAtomCommand } from "~/state/use-atom-command";
53	import { previewEnvironment } from "~/state/preview";	55	import { previewEnvironment } from "~/state/preview";
54	import { useServerConfigs } from "~/state/entities";	56	import { useServerConfigs } from "~/state/entities";
...	@@ -647,6 +649,7 @@ function DeviceIntegrationControls({	...	@@ -647,6 +649,7 @@ function DeviceIntegrationControls({
647	enabled: boolean;	649	enabled: boolean;
648	agentAccessEnabled: boolean;	650	agentAccessEnabled: boolean;
649	}) {	651	}) {
		652	const canConfigure = useEnvironmentScope(environmentId, AuthSettingsWriteScope);
650	const { state, loaded } = useDeviceState(environmentId);	653	const { state, loaded } = useDeviceState(environmentId);
651	const { scope, environments, connectedEnvironments } = useSettingsScope();	654	const { scope, environments, connectedEnvironments } = useSettingsScope();
652	const updateSettings = useUpdateScopedSettings();	655	const updateSettings = useUpdateScopedSettings();
...	@@ -679,7 +682,7 @@ function DeviceIntegrationControls({	...	@@ -679,7 +682,7 @@ function DeviceIntegrationControls({
679	kind: NonNullable<typeof pending>,	682	kind: NonNullable<typeof pending>,
680	input: { enabled?: boolean; agentAccessEnabled?: boolean },	683	input: { enabled?: boolean; agentAccessEnabled?: boolean },
681	) => {	684	) => {
682	if (!environmentId) return;	685	if (!environmentId \|\| !readEnvironmentScope(environmentId, AuthSettingsWriteScope)) return;
683	setPending(kind);	686	setPending(kind);
684	try {	687	try {
685	const results = await Promise.allSettled(	688	const results = await Promise.allSettled(
...	@@ -687,6 +690,9 @@ function DeviceIntegrationControls({	...	@@ -687,6 +690,9 @@ function DeviceIntegrationControls({
687	if (environment.connection.phase !== "connected" \|\| !environment.serverConfig) {	690	if (environment.connection.phase !== "connected" \|\| !environment.serverConfig) {
688	throw new Error("Environment disconnected");	691	throw new Error("Environment disconnected");
689	}	692	}
		693	if (!readEnvironmentScope(environment.environmentId, AuthSettingsWriteScope)) {
		694	throw new Error("This connection cannot change device settings.");
		695	}
690	return configure({	696	return configure({
691	environmentId: environment.environmentId,	697	environmentId: environment.environmentId,
692	input: { ...input, ...(input.enabled ? { onboardingCompleted: true } : {}) },	698	input: { ...input, ...(input.enabled ? { onboardingCompleted: true } : {}) },
...	@@ -786,7 +792,14 @@ function DeviceIntegrationControls({	...	@@ -786,7 +792,14 @@ function DeviceIntegrationControls({
786	<ScopedSwitch	792	<ScopedSwitch
787	settingKeys={["enableDeviceSupport"]}	793	settingKeys={["enableDeviceSupport"]}
788	checked={enabled}	794	checked={enabled}
789	disabled={projectScope \|\| !loaded \|\| !environmentId \|\| busy \|\| pending !== null}	795	disabled={
		796	!canConfigure \|\|
		797	projectScope \|\|
		798	!loaded \|\|
		799	!environmentId \|\|
		800	busy \|\|
		801	pending !== null
		802	}
790	aria-label="Device hub"	803	aria-label="Device hub"
791	onCheckedChange={(checked) =>	804	onCheckedChange={(checked) =>
792	void update("hub", {	805	void update("hub", {
...	@@ -851,6 +864,7 @@ function DeviceIntegrationControls({	...	@@ -851,6 +864,7 @@ function DeviceIntegrationControls({
851	settingKeys={["enableAgentDeviceAccess"]}	864	settingKeys={["enableAgentDeviceAccess"]}
852	checked={agentAccessEnabled}	865	checked={agentAccessEnabled}
853	disabled={	866	disabled={
		867	!canConfigure \|\|
854	connectedEnvironments.length === 0 \|\|	868	connectedEnvironments.length === 0 \|\|
855	(!projectScope && (!loaded \|\| !anyHubEnabled \|\| busy)) \|\|	869	(!projectScope && (!loaded \|\| !anyHubEnabled \|\| busy)) \|\|
856	pending !== null	870	pending !== null

apps/web/src/components/settings/KeybindingsSettings.environment.test.tsx created+143

...	@@ -0,0 +1,143 @@
1	import type { EnvironmentId } from "@t3tools/contracts";
2	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
3
4	import { visitElements } from "../../test/reactElementTree";
5	import { reactHookHarness as hooks } from "../../test/reactHookHarness";
6
7	const state = vi.hoisted(() => ({
8	canOperate: false,
9	canWriteSettings: true,
10	openEditor: vi.fn(),
11	upsert: vi.fn(),
12	remove: vi.fn(),
13	}));
14
15	vi.mock("react", async (importOriginal) => {
16	const actual = await importOriginal<typeof import("react")>();
17	const { reactHookHarness } = await import("../../test/reactHookHarness");
18	return {
19	...actual,
20	useCallback: reactHookHarness.useCallback,
21	useEffect: () => undefined,
22	useMemo: reactHookHarness.useMemo,
23	useRef: reactHookHarness.useRef,
24	useState: reactHookHarness.useState,
25	};
26	});
27
28	vi.mock("react/compiler-runtime", async () => {
29	const { reactHookHarness } = await import("../../test/reactHookHarness");
30	return { c: reactHookHarness.useMemoCache };
31	});
32
33	vi.mock("@effect/atom-react", () => ({
34	useAtomValue: (atom: string) => (atom === "config-path" ? "/fixture/keybindings.json" : []),
35	}));
36
37	vi.mock("@tanstack/react-router", () => ({ useLocation: () => "" }));
38	vi.mock("../ProjectFavicon", () => ({ ProjectFavicon: () => null }));
39	vi.mock("../../state/server", () => ({
40	primaryServerKeybindingsAtom: "keybindings",
41	primaryServerKeybindingsConfigPathAtom: "config-path",
42	primaryServerAvailableEditorsAtom: "editors",
43	serverEnvironment: { upsertKeybinding: state.upsert, removeKeybinding: state.remove },
44	}));
45
46	vi.mock("../../state/environments", () => ({
47	usePrimaryEnvironment: () => ({ environmentId: "primary-settings" }),
48	}));
49
50	vi.mock("./SettingsScopeContext", () => ({
51	useSettingsScope: () => {
52	const environment = {
53	environmentId: "primary-settings",
54	serverConfig: {
55	keybindings: [],
56	keybindingsConfigPath: "/fixture/keybindings.json",
57	availableEditors: [],
58	},
59	};
60	return { environment, connectedEnvironments: [environment] };
61	},
62	}));
63
64	vi.mock("../../state/session", () => {
65	const hasScope = (environmentId: EnvironmentId \| null, scope: string) =>
66	environmentId === "primary-settings" &&
67	(scope === "orchestration:operate"
68	? state.canOperate
69	: scope === "settings:write" && state.canWriteSettings);
70	return {
71	useEnvironmentScope: hasScope,
72	readEnvironmentScope: hasScope,
73	useEnvironmentsWithScope: () => new Set(state.canWriteSettings ? ["primary-settings"] : []),
74	};
75	});
76
77	vi.mock("../../state/use-atom-command", () => ({
78	useAtomCommand: (command: unknown) => command,
79	}));
80
81	vi.mock("../../editorPreferences", () => ({
82	useOpenInPreferredEditor: (environmentId: EnvironmentId) => (path: string) =>
83	state.openEditor({ environmentId, path }),
84	}));
85
86	import { KeybindingsSettingsPanel } from "./KeybindingsSettings";
87
88	function renderPanel() {
89	hooks.beginRender();
90	return KeybindingsSettingsPanel();
91	}
92
93	function openButton(panel: unknown) {
94	const button = visitElements(
95	panel,
96	(element) => element.props["aria-label"] === "Open keybindings.json",
97	);
98	if (!button) throw new Error("Missing Open keybindings.json action.");
99	return button;
100	}
101
102	describe("KeybindingsSettings editor permission", () => {
103	beforeEach(() => {
104	hooks.reset();
105	state.canOperate = false;
106	state.canWriteSettings = true;
107	state.openEditor.mockReset().mockResolvedValue({ _tag: "Success", value: undefined });
108	state.upsert.mockReset().mockResolvedValue({ _tag: "Success", value: undefined });
109	state.remove.mockReset().mockResolvedValue({ _tag: "Success", value: undefined });
110	});
111
112	it("rejects editor launches when settings writes are the only write grant", () => {
113	const button = openButton(renderPanel());
114	(button.props.onClick as () => void)();
115
116	expect(state.openEditor).not.toHaveBeenCalled();
117	expect(button.props.disabled).toBe(true);
118	});
119
120	it("opens the primary environment's file after operate is granted without settings writes", () => {
121	state.canWriteSettings = false;
122	renderPanel();
123	state.canOperate = true;
124	const button = openButton(renderPanel());
125	expect(button.props.disabled).toBe(false);
126	(button.props.onClick as () => void)();
127
128	expect(state.openEditor).toHaveBeenCalledWith({
129	environmentId: "primary-settings",
130	path: "/fixture/keybindings.json",
131	});
132	});
133
134	it("rejects a queued editor launch after operate is revoked", () => {
135	state.canOperate = true;
136	const open = openButton(renderPanel()).props.onClick as () => void;
137	state.canOperate = false;
138	open();
139
140	expect(state.openEditor).not.toHaveBeenCalled();
141	expect(openButton(renderPanel()).props.disabled).toBe(true);
142	});
143	});

apps/web/src/components/settings/KeybindingsSettings.tsx+67-31

 @@ -1,3 +1,5 @@
+import { useEnvironmentScope } from "../../state/session";
+import { useEnvironmentsWithScope, readEnvironmentScope } from "../../state/session";
 import {
   ChevronDownIcon,
   CircleXIcon,
 @@ -22,6 +24,8 @@ import {
   useState,
 } from "react";
 import {
+  AuthOrchestrationOperateScope,
+  AuthSettingsWriteScope,
   type KeybindingCommand,
   type KeybindingWhenNode,
   type ServerRemoveKeybindingInput,
 @@ -1281,6 +1285,14 @@ export function KeybindingsSettingsPanel() {
   // fan out to every connected environment in the selection, so one
   // shortcut change reaches each machine the user runs T3 Code on.
   const { environment: primaryEnvironment, connectedEnvironments } = useSettingsScope();
+  const canOpenKeybindingsFile = useEnvironmentScope(
+    primaryEnvironment?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
+  const writableIds = useEnvironmentsWithScope(connectedEnvironments, AuthSettingsWriteScope);
+  const canWriteSettings =
+    connectedEnvironments.length > 0 &&
+    connectedEnvironments.every((target) => writableIds.has(target.environmentId));
   const serverKeybindings = primaryEnvironment?.serverConfig?.keybindings;
   const keybindings = useMemo(
     () => mergeWithDefaultKeybindings(serverKeybindings ?? []),
 @@ -1351,7 +1363,12 @@ export function KeybindingsSettingsPanel() {
   }, []);
   const openKeybindingsFile = useCallback(() => {
-    if (!keybindingsConfigPath) return;
+    if (
+      !keybindingsConfigPath ||
+      !primaryEnvironment ||
+      !readEnvironmentScope(primaryEnvironment.environmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     void (async () => {
       const result = await openInPreferredEditor(keybindingsConfigPath);
       if (result._tag === "Success" || isAtomCommandInterrupted(result)) {
 @@ -1365,11 +1382,17 @@ export function KeybindingsSettingsPanel() {
         type: "error",
       });
     })();
-  }, [keybindingsConfigPath, openInPreferredEditor]);
+  }, [keybindingsConfigPath, openInPreferredEditor, primaryEnvironment]);
   const saveKeybinding = useCallback(
     (input: ServerUpsertKeybindingInput) => {
-      if (!primaryEnvironment) return;
+      if (
+        !primaryEnvironment ||
+        !connectedEnvironments.every((target) =>
+          readEnvironmentScope(target.environmentId, AuthSettingsWriteScope),
+        )
+      )
+        return;
       setSavingCommand(input.command);
       const payload: ServerUpsertKeybindingInput = {
         command: input.command,
 @@ -1404,7 +1427,13 @@ export function KeybindingsSettingsPanel() {
   const removeKeybinding = useCallback(
     (row: KeybindingRow) => {
-      if (!primaryEnvironment) return;
+      if (
+        !primaryEnvironment ||
+        !connectedEnvironments.every((target) =>
+          readEnvironmentScope(target.environmentId, AuthSettingsWriteScope),
+        )
+      )
+        return;
       setSavingCommand(row.command);
       void (async () => {
         const results = await Promise.all(
 @@ -1468,7 +1497,7 @@ export function KeybindingsSettingsPanel() {
           <Button
             type="button"
             variant="outline"
-            disabled={isAddingBinding}
+            disabled={isAddingBinding || !canWriteSettings}
             onClick={() => setIsAddingBinding(true)}
           >
             <PlusIcon aria-hidden className="size-4" />
 @@ -1481,7 +1510,7 @@ export function KeybindingsSettingsPanel() {
                   type="button"
                   variant="outline"
                   size="icon"
-                  disabled={!keybindingsConfigPath}
+                  disabled={!keybindingsConfigPath || !canOpenKeybindingsFile}
                   onClick={openKeybindingsFile}
                   aria-label="Open keybindings.json"
                 >
 @@ -1494,33 +1523,40 @@ export function KeybindingsSettingsPanel() {
         </div>
       </SettingsSection>
-      {isAddingBinding ? (
+      {!canWriteSettings ? (
-        <SettingsGroup>
+        <p className="text-xs text-muted-foreground">
-          <NewKeybindingSettingsRow
+          This connection can view keybindings but cannot change them.
-            commandOptions={commandOptions}
+        </p>
-            allRows={rows}
-            variables={whenVariables}
-            isSaving={savingCommand !== null}
-            onSave={saveKeybinding}
-            onCancel={cancelAdd}
-          />
-        </SettingsGroup>
       ) : null}
+      <div inert={!canWriteSettings}>
+        {isAddingBinding ? (
+          <SettingsGroup>
+            <NewKeybindingSettingsRow
+              commandOptions={commandOptions}
+              allRows={rows}
+              variables={whenVariables}
+              isSaving={savingCommand !== null}
+              onSave={saveKeybinding}
+              onCancel={cancelAdd}
+            />
+          </SettingsGroup>
+        ) : null}
-      {groups.length > 0 ? (
+        {groups.length > 0 ? (
-        <KeybindingsGroups
+          <KeybindingsGroups
-          groups={groups}
+            groups={groups}
-          anchorIds={anchorIds}
+            anchorIds={anchorIds}
-          savingCommand={savingCommand}
+            savingCommand={savingCommand}
-          {...rowActions}
+            {...rowActions}
-        />
+          />
-      ) : (
+        ) : (
-        <SettingsGroup>
+          <SettingsGroup>
-          <div className="px-4 py-12 text-center text-sm text-muted-foreground">
+            <div className="px-4 py-12 text-center text-sm text-muted-foreground">
-            No keybindings match your search.
+              No keybindings match your search.
-          </div>
+            </div>
-        </SettingsGroup>
+          </SettingsGroup>
-      )}
+        )}
+      </div>
     </SettingsPageContainer>
   );
 }

apps/web/src/components/settings/ProjectActionsSettings.tsx+19-12

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { useScopedSettingsWriteAllowed } from "./useScopedSettings";
		2	import { AuthSettingsWriteScope } from "@t3tools/contracts";
1	import { EnvironmentId, type T3ProjectFileScript } from "@t3tools/contracts";	3	import { EnvironmentId, type T3ProjectFileScript } from "@t3tools/contracts";
2	import {	4	import {
3	isAtomCommandInterrupted,	5	isAtomCommandInterrupted,
...	@@ -52,6 +54,7 @@ export function ProjectActionsSettings() {	...	@@ -52,6 +54,7 @@ export function ProjectActionsSettings() {
52	(candidate) =>	54	(candidate) =>
53	JSON.stringify(candidate.settings.defaultProjectScripts) !== JSON.stringify(scripts),	55	JSON.stringify(candidate.settings.defaultProjectScripts) !== JSON.stringify(scripts),
54	);	56	);
		57	const canWriteSettings = useScopedSettingsWriteAllowed();
55	const [request, setRequest] = useState<ProjectScriptEditorRequest \| null>(null);	58	const [request, setRequest] = useState<ProjectScriptEditorRequest \| null>(null);
56	const memberById = new Map(	59	const memberById = new Map(
57	isProjectScope ? scope.members.map((member) => [member.id, member]) : [],	60	isProjectScope ? scope.members.map((member) => [member.id, member]) : [],
...	@@ -148,7 +151,7 @@ export function ProjectActionsSettings() {	...	@@ -148,7 +151,7 @@ export function ProjectActionsSettings() {
148	id="import-scripts"	151	id="import-scripts"
149	size="xs"	152	size="xs"
150	variant="ghost"	153	variant="ghost"
151	disabled={saving}	154	disabled={saving \|\| !canWriteSettings}
152	type="button"	155	type="button"
153	/>	156	/>
154	}	157	}
...	@@ -184,7 +187,7 @@ export function ProjectActionsSettings() {	...	@@ -184,7 +187,7 @@ export function ProjectActionsSettings() {
184	<Button	187	<Button
185	size="xs"	188	size="xs"
186	variant="outline"	189	variant="outline"
187	disabled={saving \|\| targets.length === 0}	190	disabled={saving \|\| !canWriteSettings \|\| targets.length === 0}
188	onClick={() => setRequest({ scriptId: null, initial: EMPTY_PROJECT_SCRIPT_INPUT })}	191	onClick={() => setRequest({ scriptId: null, initial: EMPTY_PROJECT_SCRIPT_INPUT })}
189	>	192	>
190	<PlusIcon className="size-3.5" />	193	<PlusIcon className="size-3.5" />
...	@@ -202,7 +205,7 @@ export function ProjectActionsSettings() {	...	@@ -202,7 +205,7 @@ export function ProjectActionsSettings() {
202	<ProjectActionsList	205	<ProjectActionsList
203	scripts={scripts}	206	scripts={scripts}
204	keybindings={keybindings}	207	keybindings={keybindings}
205	disabled={saving}	208	disabled={saving \|\| !canWriteSettings}
206	onEdit={(script) => setRequest(editorRequestForScript(script, keybindings))}	209	onEdit={(script) => setRequest(editorRequestForScript(script, keybindings))}
207	/>	210	/>
208	)}	211	)}
...	@@ -213,15 +216,19 @@ export function ProjectActionsSettings() {	...	@@ -213,15 +216,19 @@ export function ProjectActionsSettings() {
213	className="text-warning"	216	className="text-warning"
214	/>	217	/>
215	) : null}	218	) : null}
216	<ProjectScriptEditorDialog	219	{target && (
217	request={request}	220	<ProjectScriptEditorDialog
218	scripts={scripts}	221	environmentId={target.environmentId}
219	onSubmit={submit}	222	editScope={AuthSettingsWriteScope}
220	onDelete={(id) =>	223	request={request}
221	void persist((current) => current.filter((script) => script.id !== id), id, null)	224	scripts={scripts}
222	}	225	onSubmit={submit}
223	onClose={() => setRequest(null)}	226	onDelete={(id) =>
224	/>	227	void persist((current) => current.filter((script) => script.id !== id), id, null)
		228	}
		229	onClose={() => setRequest(null)}
		230	/>
		231	)}
225	</SettingsSection>	232	</SettingsSection>
226	);	233	);
227	}	234	}

apps/web/src/components/settings/ProjectSettingsPanel.test.tsx created+476

...	@@ -0,0 +1,476 @@
1	import { RegistryContext } from "@effect/atom-react";
2	import type {
3	DeleteProjectInput,
4	UpdateProjectInput,
5	} from "@t3tools/client-runtime/state/projects";
6	import {
7	AuthOrchestrationOperateScope,
8	AuthSettingsWriteScope,
9	DEFAULT_SERVER_SETTINGS,
10	EnvironmentId,
11	ProjectId,
12	ProviderDriverKind,
13	ProviderInstanceId,
14	type AuthEnvironmentScope,
15	type AuthSessionState,
16	type ResolvedKeybindingsConfig,
17	type ServerProvider,
18	} from "@t3tools/contracts";
19	import { DEFAULT_CLIENT_SETTINGS } from "@t3tools/contracts/settings";
20	import { DEFAULT_RESOLVED_KEYBINDINGS } from "@t3tools/shared/keybindings";
21	import * as Cause from "effect/Cause";
22	import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
23	import { cloneElement, type ReactElement, type ReactNode } from "react";
24	import { act, create, type ReactTestRenderer } from "react-test-renderer";
25	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
26
27	import type { Project } from "../../types";
28
29	type SessionResult = AsyncResult.AsyncResult<AuthSessionState, Error>;
30	const state = vi.hoisted(() => ({
31	registry: null as AtomRegistry.AtomRegistry \| null,
32	sessions: new Map<EnvironmentId, Atom.Writable<SessionResult>>(),
33	providers: null as Atom.Atom<ReadonlyArray<ServerProvider>> \| null,
34	config: null as Atom.Atom<{ keybindings: ResolvedKeybindingsConfig }> \| null,
35	projects: [] as Project[],
36	update:
37	vi.fn<
38	(request: {
39	environmentId: EnvironmentId;
40	input: UpdateProjectInput;
41	}) => Promise<AsyncResult.Success<void>>
42	>(),
43	delete:
44	vi.fn<
45	(request: {
46	environmentId: EnvironmentId;
47	input: DeleteProjectInput;
48	}) => Promise<AsyncResult.Success<void>>
49	>(),
50	confirm: vi.fn<() => Promise<boolean>>(),
51	updateSettings: vi.fn(),
52	upsertKeybinding: vi.fn(),
53	removeKeybinding: vi.fn(),
54	updateClientSettings: vi.fn(),
55	releaseUploads: vi.fn(),
56	clearDraft: vi.fn(),
57	copy: vi.fn(),
58	navigate: vi.fn(),
59	}));
60
61	vi.mock("~/connection/runtime", () => ({ connectionAtomRuntime: undefined }));
62	vi.mock("@t3tools/client-runtime/state/session", () => ({
63	createEnvironmentSessionAtoms: () => ({
64	sessionStateAtom: (id: EnvironmentId) => state.sessions.get(id)!,
65	}),
66	}));
67	vi.mock("~/rpc/atomRegistry", () => ({
68	get appAtomRegistry() {
69	return state.registry;
70	},
71	}));
72	vi.mock("~/state/environments", () => ({
73	useEnvironments: () => ({ environments }),
74	usePrimaryEnvironmentId: () => primaryId,
75	}));
76	vi.mock("~/state/entities", () => ({
77	useProjects: () => state.projects,
78	useThreadShells: () => [],
79	}));
80	vi.mock("~/state/projects", () => ({
81	projectEnvironment: { update: "update", delete: "delete" },
82	}));
83	vi.mock("~/state/server", () => ({
84	EMPTY_SERVER_PROVIDERS: [],
85	serverEnvironment: {
86	providersValueAtom: () => state.providers!,
87	configValueAtom: () => state.config!,
88	updateSettings: "updateSettings",
89	upsertKeybinding: "upsertKeybinding",
90	removeKeybinding: "removeKeybinding",
91	},
92	}));
93	vi.mock("~/state/use-atom-command", () => ({
94	useAtomCommand: (
95	command: "update" \| "delete" \| "updateSettings" \| "upsertKeybinding" \| "removeKeybinding",
96	) => state[command],
97	}));
98	vi.mock("~/hooks/useSettings", () => ({
99	useClientSettings: () => DEFAULT_CLIENT_SETTINGS,
100	useUpdateClientSettings: () => state.updateClientSettings,
101	usePrimarySettings: () => DEFAULT_SERVER_SETTINGS,
102	useEnvironmentSettings: () => DEFAULT_SERVER_SETTINGS,
103	}));
104	vi.mock("~/hooks/useT3ProjectFileScripts", () => ({
105	useT3ProjectFileState: () => ({
106	status: "valid",
107	file: null,
108	scripts: [{ name: "Imported", command: "vp test" }],
109	}),
110	}));
111	vi.mock("~/hooks/useCopyToClipboard", () => ({
112	useCopyToClipboard: () => ({ copyToClipboard: state.copy }),
113	}));
114	vi.mock("~/localApi", () => ({ readLocalApi: () => ({ dialogs: { confirm: state.confirm } }) }));
115	vi.mock("~/composerDraftStore", () => ({
116	useComposerDraftStore: {
117	getState: () => ({
118	getDraftThreadByProjectRef: () => null,
119	clearProjectDraftThreadId: state.clearDraft,
120	}),
121	},
122	}));
123	vi.mock("~/lib/composerDraftUploads", () => ({ releaseProjectDraftUploads: state.releaseUploads }));
124	vi.mock("~/env", () => ({ isElectron: true }));
125	vi.mock("@tanstack/react-router", () => ({
126	useNavigate: () => state.navigate,
127	useLocation: () => "/settings/projects",
128	}));
129	vi.mock("../ui/toast", () => ({
130	toastManager: { add: vi.fn() },
131	stackedThreadToast: (value: unknown) => value,
132	}));
133	vi.mock("../ui/button", () => ({ Button: "button" }));
134	vi.mock("../ui/input", () => ({ Input: "input" }));
135	vi.mock("../ui/switch", () => ({ Switch: "input" }));
136	vi.mock("../ui/select", () => ({
137	Select: "select",
138	SelectItem: "option",
139	SelectPopup: "div",
140	SelectTrigger: "button",
141	SelectValue: "span",
142	}));
143	vi.mock("../ui/menu", () => ({
144	Menu: "div",
145	MenuGroup: "div",
146	MenuGroupLabel: "div",
147	MenuItem: "button",
148	MenuPopup: "div",
149	MenuSeparator: "hr",
150	MenuTrigger: ({ render, children }: { render: ReactElement; children: ReactNode }) =>
151	cloneElement(render, {}, children),
152	}));
153	vi.mock("../ui/tooltip", () => ({
154	Tooltip: "div",
155	TooltipPopup: "span",
156	TooltipTrigger: ({ render }: { render: ReactNode }) => render,
157	}));
158	vi.mock("./settingsLayout", () => ({
159	SETTINGS_PICKER_TRIGGER_CLASSNAME: "",
160	SettingsPageContainer: "div",
161	SettingsSection: ({
162	children,
163	headerAction,
164	}: {
165	children: ReactNode;
166	headerAction?: ReactNode;
167	}) => (
168	<section>
169	{headerAction}
170	{children}
171	</section>
172	),
173	SettingsRow: ({ control, resetAction }: { control?: ReactNode; resetAction?: ReactNode }) => (
174	<div>
175	{resetAction}
176	{control}
177	</div>
178	),
179	SettingResetButton: ({
180	label,
181	...props
182	}: {
183	label: string;
184	disabled?: boolean;
185	onClick: () => void;
186	}) => <button {...props} aria-label={`Reset ${label} to default`} />,
187	}));
188	vi.mock("./ProjectDefaultsSettings", () => ({ ProjectDefaultsSettings: () => null }));
189	vi.mock("./ProjectActionsSettings", () => ({ ProjectActionsSettings: () => null }));
190	vi.mock("../ProjectFavicon", () => ({ ProjectFavicon: () => null }));
191	vi.mock("../chat/ProviderModelPicker", () => ({ ProviderModelPicker: "model-picker" }));
192	vi.mock("../chat/TraitsPicker", () => ({ TraitsPicker: "traits-picker" }));
193	vi.mock("./ProjectFaviconPickerDialog", () => ({
194	canPickExternalProjectFavicon: () => false,
195	ProjectFaviconPickerDialog: "favicon-picker",
196	}));
197	vi.mock("./ProjectIconPickerDialog", () => ({ ProjectIconPickerDialog: "icon-picker" }));
198	vi.mock("../projectScriptEditor", async (importOriginal) => ({
199	...(await importOriginal<typeof import("../projectScriptEditor")>()),
200	ProjectScriptEditorDialog: "script-editor",
201	}));
202
203	import { buildSidebarProjectSnapshots } from "../../sidebarProjectGrouping";
204	import { ProjectFaviconPickerDialog } from "./ProjectFaviconPickerDialog";
205	import { ProjectSettingsPanel } from "./ProjectSettingsPanel";
206
207	const primaryId = EnvironmentId.make("primary");
208	const remoteId = EnvironmentId.make("remote");
209	const instanceId = ProviderInstanceId.make("codex");
210	const environments = [primaryId, remoteId].map((environmentId) => ({
211	environmentId,
212	label: environmentId,
213	connection: { phase: "connected" },
214	serverConfig: { keybindings: DEFAULT_RESOLVED_KEYBINDINGS },
215	}));
216	const session = (scopes: ReadonlyArray<AuthEnvironmentScope>): AuthSessionState => ({
217	authenticated: true,
218	scopes,
219	auth: {
220	policy: "remote-reachable",
221	bootstrapMethods: ["one-time-token"],
222	sessionMethods: ["bearer-access-token"],
223	sessionCookieName: "t3_session",
224	},
225	});
226	const writable = () => AsyncResult.success(session([AuthOrchestrationOperateScope]));
227
228	function deferred<T>() {
229	let resolve!: (value: T) => void;
230	const promise = new Promise<T>((complete) => {
231	resolve = complete;
232	});
233	return { promise, resolve };
234	}
235
236	let renderer: ReactTestRenderer \| undefined;
237
238	beforeEach(() => {
239	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
240	vi.clearAllMocks();
241	state.registry = AtomRegistry.make();
242	state.sessions.clear();
243	for (const id of [primaryId, remoteId])
244	state.sessions.set(id, Atom.make<SessionResult>(writable()).pipe(Atom.keepAlive));
245	state.projects = [primaryId, remoteId].map((environmentId) => ({
246	id: ProjectId.make(`project-${environmentId}`),
247	environmentId,
248	title: "Shared repo",
249	workspaceRoot: `/work/${environmentId}`,
250	repositoryIdentity: {
251	canonicalKey: "github.com/example/shared-repo",
252	locator: {
253	source: "git-remote",
254	remoteName: "origin",
255	remoteUrl: "https://github.com/example/shared-repo.git",
256	},
257	},
258	defaultModelSelection: { instanceId, model: "gpt-5-codex" },
259	createdAt: "2026-01-01T00:00:00.000Z",
260	updatedAt: "2026-01-01T00:00:00.000Z",
261	scripts: [],
262	}));
263	state.providers = Atom.make<ReadonlyArray<ServerProvider>>([
264	{
265	instanceId,
266	driver: ProviderDriverKind.make("codex"),
267	enabled: true,
268	installed: true,
269	version: null,
270	status: "ready",
271	auth: { status: "authenticated" },
272	checkedAt: "2026-01-01T00:00:00.000Z",
273	models: [],
274	slashCommands: [],
275	skills: [],
276	},
277	]);
278	state.config = Atom.make({ keybindings: DEFAULT_RESOLVED_KEYBINDINGS });
279	state.update.mockImplementation(async ({ environmentId, input }) => {
280	const { projectId, ...updates } = input;
281	const patch = Object.fromEntries(
282	Object.entries(updates).filter(([, value]) => value !== undefined),
283	) as Partial<Project>;
284	state.projects = state.projects.map((project) =>
285	project.environmentId === environmentId && project.id === projectId
286	? { ...project, ...patch }
287	: project,
288	);
289	return AsyncResult.success(undefined);
290	});
291	state.delete.mockResolvedValue(AsyncResult.success(undefined));
292	state.updateSettings.mockResolvedValue(AsyncResult.success(undefined));
293	state.confirm.mockResolvedValue(true);
294	});
295
296	afterEach(async () => {
297	await act(() => renderer?.unmount());
298	renderer = undefined;
299	state.registry?.dispose();
300	vi.unstubAllGlobals();
301	});
302
303	function group() {
304	return buildSidebarProjectSnapshots({
305	projects: state.projects,
306	settings: DEFAULT_CLIENT_SETTINGS,
307	primaryEnvironmentId: primaryId,
308	resolveEnvironmentLabel: (id) => id,
309	})[0]!;
310	}
311
312	async function mountPanel() {
313	await act(() => {
314	renderer = create(
315	<RegistryContext.Provider value={state.registry!}>
316	<ProjectSettingsPanel projectKey={group().projectKey} />
317	</RegistryContext.Provider>,
318	);
319	});
320	return renderer!.root;
321	}
322
323	function button(label: string) {
324	return renderer!.root.findAllByType("button").find((node) => node.children.includes(label))!;
325	}
326
327	async function grant(id: EnvironmentId, result: SessionResult) {
328	await act(() => state.registry!.set(state.sessions.get(id)!, result));
329	}
330
331	describe("project settings permissions", () => {
332	it("preflights every member before any shared field update", async () => {
333	await grant(remoteId, AsyncResult.success(session([AuthSettingsWriteScope])));
334	const root = await mountPanel();
335	const name = root.findByProps({ "aria-label": "Project name" });
336
337	await act(async () => {
338	name.props.onChange();
339	name.props.onBlur({ currentTarget: { value: "Renamed" } });
340	root.findByType(ProjectFaviconPickerDialog).props.onSelect("/work/icon.png");
341	});
342
343	expect(state.update).not.toHaveBeenCalled();
344	expect(state.projects.every((project) => project.title === "Shared repo")).toBe(true);
345	expect(name.props.disabled).toBe(true);
346	expect(button("Remove all entries").props.disabled).toBe(true);
347	});
348
349	it("updates every member when all have project access without settings access", async () => {
350	const root = await mountPanel();
351	await act(async () => {
352	const name = root.findByProps({ "aria-label": "Project name" });
353	name.props.onChange();
354	name.props.onBlur({ currentTarget: { value: "Renamed" } });
355	});
356	expect(state.update.mock.calls.map(([request]) => request.environmentId)).toEqual([
357	primaryId,
358	remoteId,
359	]);
360	expect(state.projects.map((project) => project.title)).toEqual(["Renamed", "Renamed"]);
361	});
362
363	it("stops before the next member if its grant is revoked during an earlier update", async () => {
364	const firstUpdate = deferred<AsyncResult.Success<void>>();
365	state.update.mockReturnValueOnce(firstUpdate.promise);
366	const root = await mountPanel();
367	await act(async () => {
368	const name = root.findByProps({ "aria-label": "Project name" });
369	name.props.onChange();
370	name.props.onBlur({ currentTarget: { value: "Renamed" } });
371	});
372	expect(state.update).toHaveBeenCalledOnce();
373
374	await grant(remoteId, AsyncResult.success(session([])));
375	await act(async () => {
376	firstUpdate.resolve(AsyncResult.success(undefined));
377	await firstUpdate.promise;
378	});
379	expect(state.update).toHaveBeenCalledOnce();
380	expect(state.update.mock.calls[0]![0].environmentId).toBe(primaryId);
381	});
382
383	it("disables removal for a checkout whose project grant is missing", async () => {
384	await grant(remoteId, AsyncResult.success(session([])));
385	const root = await mountPanel();
386	const denied = root.findByProps({ "aria-label": "Remove checkout /work/remote" });
387	expect(denied.props.disabled).toBe(true);
388	await act(async () => denied.props.onClick());
389	expect(state.confirm).not.toHaveBeenCalled();
390	expect(state.delete).not.toHaveBeenCalled();
391	expect(root.findByProps({ "aria-label": "Remove checkout /work/primary" }).props.disabled).toBe(
392	false,
393	);
394	});
395
396	it("allows removing a writable checkout while denying removal of the mixed group", async () => {
397	await grant(remoteId, AsyncResult.success(session([])));
398	await mountPanel();
399	await act(async () => button("Remove all entries").props.onClick());
400	expect(state.confirm).not.toHaveBeenCalled();
401	expect(state.delete).not.toHaveBeenCalled();
402	await act(async () =>
403	renderer!.root.findByProps({ "aria-label": "Remove checkout /work/primary" }).props.onClick(),
404	);
405	expect(state.delete).toHaveBeenCalledExactlyOnceWith({
406	environmentId: primaryId,
407	input: { projectId: state.projects[0]!.id, force: true },
408	});
409	expect(state.releaseUploads).toHaveBeenCalledOnce();
410	expect(state.clearDraft).toHaveBeenCalledOnce();
411	});
412
413	it("rechecks every removal target after confirmation before deleting or clearing drafts", async () => {
414	const confirmed = deferred<boolean>();
415	state.confirm.mockReturnValueOnce(confirmed.promise);
416	await mountPanel();
417	await act(async () => button("Remove all entries").props.onClick());
418	expect(state.confirm).toHaveBeenCalledOnce();
419	await grant(remoteId, AsyncResult.success(session([])));
420	await act(async () => {
421	confirmed.resolve(true);
422	await confirmed.promise;
423	});
424	expect(state.delete).not.toHaveBeenCalled();
425	expect(state.releaseUploads).not.toHaveBeenCalled();
426	expect(state.clearDraft).not.toHaveBeenCalled();
427	});
428
429	it("reacts to another member's revoked and restored grant and guards a stale handler", async () => {
430	await grant(
431	primaryId,
432	AsyncResult.success(session([AuthOrchestrationOperateScope, AuthSettingsWriteScope])),
433	);
434	const root = await mountPanel();
435	const name = () => root.findByProps({ "aria-label": "Project name" });
436	const staleSave = name().props.onBlur;
437	await act(async () => {
438	state.registry!.set(state.sessions.get(remoteId)!, AsyncResult.success(session([])));
439	name().props.onChange();
440	staleSave({ currentTarget: { value: "Renamed" } });
441	});
442	expect(state.update).not.toHaveBeenCalled();
443	expect(name().props.disabled).toBe(true);
444
445	await grant(remoteId, writable());
446	expect(name().props.disabled).toBe(false);
447	await act(async () => {
448	name().props.onChange();
449	name().props.onBlur({ currentTarget: { value: "Renamed" } });
450	});
451	expect(state.projects.map((project) => project.title)).toEqual(["Renamed", "Renamed"]);
452	});
453
454	it.each([
455	["loading", () => AsyncResult.initial<AuthSessionState, Error>(), false],
456	[
457	"failed",
458	() => AsyncResult.failure<AuthSessionState, Error>(Cause.fail(new Error("Disconnected"))),
459	false,
460	],
461	["refreshing", () => AsyncResult.waiting(writable()), true],
462	] as const)(
463	"uses the current grant while a member's session is %s",
464	async (_state, result, allowed) => {
465	await grant(remoteId, result());
466	const root = await mountPanel();
467	const name = root.findByProps({ "aria-label": "Project name" });
468	expect(name.props.disabled).toBe(!allowed);
469	await act(async () => {
470	name.props.onChange();
471	name.props.onBlur({ currentTarget: { value: "Renamed" } });
472	});
473	expect(state.update).toHaveBeenCalledTimes(allowed ? 2 : 0);
474	},
475	);
476	});

apps/web/src/components/settings/ProjectSettingsPanel.tsx+59-11

 @@ -1,3 +1,7 @@
+import { useComposerMenuState } from "../chat/useComposerMenuState";
+import { useOrchestrationCommand } from "../../state/use-orchestration-command";
+import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
+import { useEnvironmentsWithScope, readEnvironmentScope } from "../../state/session";
 import {
   isAtomCommandInterrupted,
   mapAtomCommandResult,
 @@ -23,7 +27,6 @@ import {
 import { useEnvironments, usePrimaryEnvironmentId } from "../../state/environments";
 import { useThreadShells } from "../../state/entities";
 import { projectEnvironment } from "../../state/projects";
-import { useAtomCommand } from "../../state/use-atom-command";
 import { ProjectFavicon } from "../ProjectFavicon";
 import { Alert, AlertDescription } from "../ui/alert";
 import { Button } from "../ui/button";
 @@ -171,13 +174,21 @@ function ProjectDetail({
     () => new Map(environments.map((environment) => [environment.environmentId, environment])),
     [environments],
   );
+  const editableIds = useEnvironmentsWithScope(group.memberProjects, AuthOrchestrationOperateScope);
+  const canEditGroup = group.memberProjects.every((member) =>
+    editableIds.has(member.environmentId),
+  );
   const representative =
     group.memberProjects.find(
       (member) => environmentById.get(member.environmentId)?.serverConfig != null,
     ) ?? group.memberProjects[0]!;
   const threads = useThreadShells();
-  const updateProject = useAtomCommand(projectEnvironment.update, { reportFailure: false });
+  const updateProject = useOrchestrationCommand(projectEnvironment.update, {
-  const deleteProject = useAtomCommand(projectEnvironment.delete, { reportFailure: false });
+    reportFailure: false,
+  });
+  const deleteProject = useOrchestrationCommand(projectEnvironment.delete, {
+    reportFailure: false,
+  });
   const projectNameEditedRef = useRef(false);
   const faviconPath = representative.faviconPath ?? null;
 @@ -204,6 +215,25 @@ function ProjectDetail({
     );
   }, []);
+  const checkProjectAccess = useCallback(
+    (members: ReadonlyArray<SidebarProjectGroupMember>, failureTitle: string) => {
+      const denied = members.find(
+        (member) => !readEnvironmentScope(member.environmentId, AuthOrchestrationOperateScope),
+      );
+      if (!denied) return null;
+      const result = AsyncResult.failure<void, Error>(
+        Cause.fail(
+          new Error(
+            `This connection cannot change projects in ${denied.environmentLabel ?? "this environment"}.`,
+          ),
+        ),
+      );
+      reportFailure(failureTitle, result);
+      return result;
+    },
+    [reportFailure],
+  );
   // Group-shared fields live on each physical project record, so a
   // group-level edit fans out to every member.
   const updateAllMembers = useCallback(
 @@ -215,6 +245,8 @@ function ProjectDetail({
       }>,
       failureTitle: string,
     ): Promise<AtomCommandResult<void, unknown>> => {
+      const denied = checkProjectAccess(group.memberProjects, failureTitle);
+      if (denied) return denied;
       const unavailable = group.memberProjects.find((member) => {
         const environment = environmentById.get(member.environmentId);
         return environment?.connection.phase !== "connected" || !environment.serverConfig;
 @@ -228,6 +260,8 @@ function ProjectDetail({
         return result;
       }
       for (const member of group.memberProjects) {
+        const revoked = checkProjectAccess([member], failureTitle);
+        if (revoked) return revoked;
         const result = mapAtomCommandResult(
           await updateProject({
             environmentId: member.environmentId,
 @@ -249,7 +283,7 @@ function ProjectDetail({
       }
       return AsyncResult.success(undefined);
     },
-    [environmentById, group.memberProjects, reportFailure, updateProject],
+    [checkProjectAccess, environmentById, group.memberProjects, reportFailure, updateProject],
   );
   const renameGroup = useCallback(
 @@ -274,8 +308,8 @@ function ProjectDetail({
   );
   // ----- project icon -----
-  const [faviconPickerOpen, setFaviconPickerOpen] = useState(false);
+  const [faviconPickerOpen, setFaviconPickerOpen] = useComposerMenuState(!canEditGroup);
-  const [iconPickerOpen, setIconPickerOpen] = useState(false);
+  const [iconPickerOpen, setIconPickerOpen] = useComposerMenuState(!canEditGroup);
   const [isSavingFavicon, setIsSavingFavicon] = useState(false);
   const savingFaviconRef = useRef(false);
   const setProjectIcon = useCallback(
 @@ -297,6 +331,7 @@ function ProjectDetail({
   const removeMembers = useCallback(
     async (members: ReadonlyArray<SidebarProjectGroupMember>) => {
+      if (checkProjectAccess(members, "Failed to remove project")) return;
       const api = readLocalApi();
       if (!api) return;
 @@ -336,9 +371,11 @@ function ProjectDetail({
         ),
       );
       if (confirmed._tag === "Failure" || !confirmed.value) return;
+      if (checkProjectAccess(members, "Failed to remove project")) return;
       const draftStore = useComposerDraftStore.getState();
       for (const member of members) {
+        if (checkProjectAccess([member], "Failed to remove project")) return;
         const memberThreads = projectThreads.filter(
           (thread) =>
             thread.environmentId === member.environmentId && thread.projectId === member.id,
 @@ -374,6 +411,7 @@ function ProjectDetail({
       }
     },
     [
+      checkProjectAccess,
       deleteProject,
       group.displayName,
       group.memberProjects.length,
 @@ -395,6 +433,7 @@ function ProjectDetail({
             <Button
               size="sm"
               variant="outline"
+              disabled={!editableIds.has(member.environmentId)}
               onClick={() => void removeMembers([member])}
               aria-label={`Remove checkout ${member.workspaceRoot}`}
             >
 @@ -416,6 +455,13 @@ function ProjectDetail({
           </AlertDescription>
         </Alert>
         <SettingsSection id="project-overview" title="Project" hideTitle>
+          {!canEditGroup ? (
+            <p className="px-3 py-2 text-sm text-muted-foreground sm:px-4">
+              {group.memberProjects.length > 1
+                ? "Shared settings require permission to change every checkout in this group."
+                : "This connection cannot change this project."}
+            </p>
+          ) : null}
           <SettingsRow
             title="Name"
             description="The shared name for this project group in the sidebar and thread lists."
 @@ -425,6 +471,7 @@ function ProjectDetail({
                 size="sm"
                 className="w-full sm:w-64"
                 aria-label="Project name"
+                disabled={!canEditGroup}
                 defaultValue={group.displayName}
                 onChange={() => {
                   projectNameEditedRef.current = true;
 @@ -457,7 +504,7 @@ function ProjectDetail({
               ) ? (
                 <SettingResetButton
                   label="project icon"
-                  disabled={isSavingFavicon}
+                  disabled={isSavingFavicon || !canEditGroup}
                   onClick={() => void setProjectIcon({ faviconPath: null, projectIcon: null })}
                 />
               ) : null
 @@ -470,7 +517,7 @@ function ProjectDetail({
                   variant="outline"
                   type="button"
                   aria-label="Choose a project icon"
-                  disabled={isSavingFavicon}
+                  disabled={isSavingFavicon || !canEditGroup}
                   onClick={() => setIconPickerOpen(true)}
                 >
                   Choose icon
 @@ -480,7 +527,7 @@ function ProjectDetail({
                   variant="outline"
                   type="button"
                   aria-label="Choose a project icon file"
-                  disabled={isSavingFavicon}
+                  disabled={isSavingFavicon || !canEditGroup}
                   onClick={() => setFaviconPickerOpen(true)}
                 >
                   Choose file
 @@ -512,6 +559,7 @@ function ProjectDetail({
               <Button
                 size="sm"
                 variant="destructive-outline"
+                disabled={!canEditGroup}
                 onClick={() => void removeMembers(group.memberProjects)}
               >
                 <Trash2Icon />
 @@ -535,10 +583,10 @@ function ProjectDetail({
           ? { onPickExternal: () => pickProjectFavicon(representative.workspaceRoot) }
           : {})}
         onSelect={(path) => void setProjectIcon({ faviconPath: path, projectIcon: null })}
-        open={faviconPickerOpen}
+        open={faviconPickerOpen && canEditGroup}
         projectName={group.displayName}
       />
-      {iconPickerOpen ? (
+      {iconPickerOpen && canEditGroup ? (
         <Suspense fallback={null}>
           <ProjectIconPickerDialog
             current={projectIcon}

apps/web/src/components/settings/ProviderInstanceCard.tsx+14-15

 @@ -478,6 +478,7 @@ interface ProviderInstanceCardProps {
   readonly selected?: boolean | undefined;
   readonly onSelect?: (() => void) | undefined;
   readonly readOnly?: boolean | undefined;
+  readonly canWriteSettings?: boolean;
   readonly onUpdate: (nextInstance: ProviderInstanceConfig) => void;
   /**
    * Pass `undefined` to hide the delete footer entirely. Built-in default
 @@ -546,6 +547,7 @@ export function ProviderInstanceCard({
   selected = false,
   onSelect,
   readOnly = false,
+  canWriteSettings = true,
   onUpdate,
   onDelete,
   headerAction,
 @@ -1116,30 +1118,27 @@ export function ProviderInstanceCard({
           environment={genericEnvironment}
           onChange={updateGenericEnvironment}
         />
-        {environmentId !== undefined && liveProvider?.driver === "acpRegistry" ? (
-          <AcpSessionManagementSection
-            environmentId={environmentId}
-            instanceId={instanceId}
-            provider={liveProvider}
-            projects={acpProjects}
-            readOnly={readOnly}
-          />
-        ) : null}
       </SettingsSection>
+      {environmentId !== undefined && liveProvider?.driver === "acpRegistry" ? (
+        <AcpSessionManagementSection
+          environmentId={environmentId}
+          instanceId={instanceId}
+          provider={liveProvider}
+          projects={acpProjects}
+          readOnly={readOnly}
+        />
+      ) : null}
       {driverOption !== undefined ? (
-        <SettingsSection
+        <SettingsSection title="Models">
-          title="Models"
-          inert={readOnly}
-          aria-disabled={readOnly || undefined}
-          className={readOnly ? "opacity-50 select-none" : undefined}
-        >
           <div className="px-3 py-3 sm:px-4">
             <p className="mb-3 text-xs text-muted-foreground">
               Favorites, visibility, and ordering are saved on this device. Custom models are saved
               on the selected environment.
             </p>
             <ProviderModelsSection
+              canManageCustomModels={!readOnly}
+              canWritePreferences={canWriteSettings}
               instanceId={instanceId}
               driverKind={driverKind}
               models={modelsForDisplay}

apps/web/src/components/settings/ProviderModelsSection.tsx+22-10

...	@@ -131,6 +131,8 @@ interface ProviderModelsSectionProps {	...	@@ -131,6 +131,8 @@ interface ProviderModelsSectionProps {
131	* removed) via `onChange`.	131	* removed) via `onChange`.
132	*/	132	*/
133	readonly customModels: ReadonlyArray<CustomModelDefinition>;	133	readonly customModels: ReadonlyArray<CustomModelDefinition>;
		134	readonly canManageCustomModels: boolean;
		135	readonly canWritePreferences?: boolean;
134	/** Server-returned model slugs hidden from the model picker. */	136	/** Server-returned model slugs hidden from the model picker. */
135	readonly hiddenModels: ReadonlyArray<string>;	137	readonly hiddenModels: ReadonlyArray<string>;
136	/** Model slugs favorited for this provider instance. */	138	/** Model slugs favorited for this provider instance. */
...	@@ -164,6 +166,8 @@ export function ProviderModelsSection({	...	@@ -164,6 +166,8 @@ export function ProviderModelsSection({
164	driverKind,	166	driverKind,
165	models,	167	models,
166	customModels,	168	customModels,
		169	canManageCustomModels,
		170	canWritePreferences = true,
167	hiddenModels,	171	hiddenModels,
168	favoriteModels,	172	favoriteModels,
169	modelOrder,	173	modelOrder,
...	@@ -224,7 +228,7 @@ export function ProviderModelsSection({	...	@@ -224,7 +228,7 @@ export function ProviderModelsSection({
224	}, [displayModels]);	228	}, [displayModels]);
225		229
226	const handleAdd = () => {	230	const handleAdd = () => {
227	if (driverKind === "antigravity") return;	231	if (!canManageCustomModels \|\| driverKind === "antigravity") return;
228	const normalized = normalizeCustomModelSlug(input);	232	const normalized = normalizeCustomModelSlug(input);
229	if (!normalized) {	233	if (!normalized) {
230	setError("Enter a model slug.");	234	setError("Enter a model slug.");
...	@@ -260,6 +264,7 @@ export function ProviderModelsSection({	...	@@ -260,6 +264,7 @@ export function ProviderModelsSection({
260	};	264	};
261		265
262	const handleRemove = (slug: string) => {	266	const handleRemove = (slug: string) => {
		267	if (!canManageCustomModels) return;
263	if (editingSlug === slug) setEditingSlug(null);	268	if (editingSlug === slug) setEditingSlug(null);
264	onChange(customModels.filter((entry) => entry.slug !== slug));	269	onChange(customModels.filter((entry) => entry.slug !== slug));
265	onModelOrderChange(modelOrder.filter((model) => model !== slug));	270	onModelOrderChange(modelOrder.filter((model) => model !== slug));
...	@@ -268,18 +273,20 @@ export function ProviderModelsSection({	...	@@ -268,18 +273,20 @@ export function ProviderModelsSection({
268	};	273	};
269		274
270	const handleSaveEdit = (next: CustomModelDefinition) => {	275	const handleSaveEdit = (next: CustomModelDefinition) => {
		276	if (!canManageCustomModels) return;
271	onChange(customModels.map((entry) => (entry.slug === next.slug ? next : entry)));	277	onChange(customModels.map((entry) => (entry.slug === next.slug ? next : entry)));
272	setEditingSlug(null);	278	setEditingSlug(null);
273	};	279	};
274		280
275	const setHidden = (slug: string, hidden: boolean) => {	281	const setHidden = (slug: string, hidden: boolean) => {
276	if (hidden === hiddenModelSet.has(slug)) return;	282	if (!canWritePreferences \|\| hidden === hiddenModelSet.has(slug)) return;
277	onHiddenModelsChange(	283	onHiddenModelsChange(
278	hidden ? [...hiddenModels, slug] : hiddenModels.filter((model) => model !== slug),	284	hidden ? [...hiddenModels, slug] : hiddenModels.filter((model) => model !== slug),
279	);	285	);
280	};	286	};
281		287
282	const handleToggleFavorite = (slug: string) => {	288	const handleToggleFavorite = (slug: string) => {
		289	if (!canWritePreferences) return;
283	if (favoriteModelSet.has(slug)) {	290	if (favoriteModelSet.has(slug)) {
284	onFavoriteModelsChange(favoriteModels.filter((model) => model !== slug));	291	onFavoriteModelsChange(favoriteModels.filter((model) => model !== slug));
285	return;	292	return;
...	@@ -296,6 +303,7 @@ export function ProviderModelsSection({	...	@@ -296,6 +303,7 @@ export function ProviderModelsSection({
296	? "hidden"	303	? "hidden"
297	: "visible";	304	: "visible";
298	const handleMove = (slug: string, direction: -1 \| 1) => {	305	const handleMove = (slug: string, direction: -1 \| 1) => {
		306	if (!canWritePreferences) return;
299	const index = displayModels.findIndex((model) => model.slug === slug);	307	const index = displayModels.findIndex((model) => model.slug === slug);
300	const nextIndex = index + direction;	308	const nextIndex = index + direction;
301	if (index < 0 \|\| nextIndex < 0 \|\| nextIndex >= displayModels.length) return;	309	if (index < 0 \|\| nextIndex < 0 \|\| nextIndex >= displayModels.length) return;
...	@@ -314,6 +322,7 @@ export function ProviderModelsSection({	...	@@ -314,6 +322,7 @@ export function ProviderModelsSection({
314	<Button	322	<Button
315	size="icon-micro"	323	size="icon-micro"
316	variant="ghost-muted"	324	variant="ghost-muted"
		325	disabled={!canWritePreferences}
317	onClick={() => handleToggleFavorite(model.slug)}	326	onClick={() => handleToggleFavorite(model.slug)}
318	aria-label={`${isFavorite ? "Remove" : "Add"} ${model.name} ${	327	aria-label={`${isFavorite ? "Remove" : "Add"} ${model.name} ${
319	isFavorite ? "from" : "to"	328	isFavorite ? "from" : "to"
...	@@ -348,7 +357,7 @@ export function ProviderModelsSection({	...	@@ -348,7 +357,7 @@ export function ProviderModelsSection({
348	<Button	357	<Button
349	size="icon-micro"	358	size="icon-micro"
350	variant="ghost-muted"	359	variant="ghost-muted"
351	disabled={!options.canMoveUp}	360	disabled={!canWritePreferences \|\| !options.canMoveUp}
352	onClick={() => handleMove(model.slug, -1)}	361	onClick={() => handleMove(model.slug, -1)}
353	aria-label={`Move ${model.name} up`}	362	aria-label={`Move ${model.name} up`}
354	/>	363	/>
...	@@ -364,7 +373,7 @@ export function ProviderModelsSection({	...	@@ -364,7 +373,7 @@ export function ProviderModelsSection({
364	<Button	373	<Button
365	size="icon-micro"	374	size="icon-micro"
366	variant="ghost-muted"	375	variant="ghost-muted"
367	disabled={!options.canMoveDown}	376	disabled={!canWritePreferences \|\| !options.canMoveDown}
368	onClick={() => handleMove(model.slug, 1)}	377	onClick={() => handleMove(model.slug, 1)}
369	aria-label={`Move ${model.name} down`}	378	aria-label={`Move ${model.name} down`}
370	/>	379	/>
...	@@ -384,10 +393,12 @@ export function ProviderModelsSection({	...	@@ -384,10 +393,12 @@ export function ProviderModelsSection({
384	<Button	393	<Button
385	size="icon-micro"	394	size="icon-micro"
386	variant="ghost-muted"	395	variant="ghost-muted"
		396	disabled={!canManageCustomModels}
387	aria-label={`Edit ${model.slug}`}	397	aria-label={`Edit ${model.slug}`}
388	onClick={() =>	398	onClick={() => {
389	setEditingSlug((current) => (current === model.slug ? null : model.slug))	399	if (!canManageCustomModels) return;
390	}	400	setEditingSlug((current) => (current === model.slug ? null : model.slug));
		401	}}
391	/>	402	/>
392	}	403	}
393	>	404	>
...	@@ -401,6 +412,7 @@ export function ProviderModelsSection({	...	@@ -401,6 +412,7 @@ export function ProviderModelsSection({
401	<Button	412	<Button
402	size="icon-micro"	413	size="icon-micro"
403	variant="ghost-muted"	414	variant="ghost-muted"
		415	disabled={!canManageCustomModels}
404	aria-label={`Remove ${model.slug}`}	416	aria-label={`Remove ${model.slug}`}
405	onClick={() => handleRemove(model.slug)}	417	onClick={() => handleRemove(model.slug)}
406	/>	418	/>
...	@@ -430,7 +442,7 @@ export function ProviderModelsSection({	...	@@ -430,7 +442,7 @@ export function ProviderModelsSection({
430	<Switch	442	<Switch
431	size="sm"	443	size="sm"
432	checked={!isHidden}	444	checked={!isHidden}
433	disabled={model.isCustom}	445	disabled={!canWritePreferences \|\| model.isCustom}
434	onCheckedChange={(checked) => setHidden(model.slug, !checked)}	446	onCheckedChange={(checked) => setHidden(model.slug, !checked)}
435	aria-label={`Show ${model.name} in the model picker`}	447	aria-label={`Show ${model.name} in the model picker`}
436	/>	448	/>
...	@@ -562,7 +574,7 @@ export function ProviderModelsSection({	...	@@ -562,7 +574,7 @@ export function ProviderModelsSection({
562	const previous = visibleModels[index - 1];	574	const previous = visibleModels[index - 1];
563	const startsGroup = previous === undefined \|\| groupOf(previous) !== group;	575	const startsGroup = previous === undefined \|\| groupOf(previous) !== group;
564	const editingEntry =	576	const editingEntry =
565	model.isCustom && editingSlug === model.slug	577	canManageCustomModels && model.isCustom && editingSlug === model.slug
566	? customModels.find((entry) => entry.slug === model.slug)	578	? customModels.find((entry) => entry.slug === model.slug)
567	: undefined;	579	: undefined;
568	return (	580	return (
...	@@ -593,7 +605,7 @@ export function ProviderModelsSection({	...	@@ -593,7 +605,7 @@ export function ProviderModelsSection({
593	})}	605	})}
594	</div>	606	</div>
595		607
596	{driverKind === "antigravity" ? null : isAdding ? (	608	{driverKind === "antigravity" \|\| !canManageCustomModels ? null : isAdding ? (
597	<div className="mt-3 flex flex-col gap-2 sm:flex-row">	609	<div className="mt-3 flex flex-col gap-2 sm:flex-row">
598	<Input	610	<Input
599	id={`provider-instance-${instanceId}-custom-model`}	611	id={`provider-instance-${instanceId}-custom-model`}

apps/web/src/components/settings/ProviderSettingsPanel.environment.test.tsx+39-1

...	@@ -26,6 +26,8 @@ const commands = vi.hoisted(() => ({	...	@@ -26,6 +26,8 @@ const commands = vi.hoisted(() => ({
26	updateProvider: vi.fn(),	26	updateProvider: vi.fn(),
27	uninstall: vi.fn(),	27	uninstall: vi.fn(),
28	acceptUrlAuth: vi.fn(),	28	acceptUrlAuth: vi.fn(),
		29	canManageProviders: true,
		30	canWriteSettings: true,
29	}));	31	}));
30		32
31	const settingsState = vi.hoisted(() => ({	33	const settingsState = vi.hoisted(() => ({
...	@@ -118,6 +120,20 @@ vi.mock("../../environments/primary", () => ({	...	@@ -118,6 +120,20 @@ vi.mock("../../environments/primary", () => ({
118		120
119	vi.mock("../../state/session", () => ({	121	vi.mock("../../state/session", () => ({
120	useEnvironmentSessionState: () => ({ data: null, hasError: false, isPending: true }),	122	useEnvironmentSessionState: () => ({ data: null, hasError: false, isPending: true }),
		123	useEnvironmentScope: (environmentId: EnvironmentId, scope: string) =>
		124	environmentId === "remote-device" &&
		125	(scope === "providers:manage"
		126	? commands.canManageProviders
		127	: scope === "settings:write"
		128	? commands.canWriteSettings
		129	: scope === "orchestration:read"),
		130	readEnvironmentScope: (environmentId: EnvironmentId, scope: string) =>
		131	environmentId === "remote-device" &&
		132	(scope === "providers:manage"
		133	? commands.canManageProviders
		134	: scope === "settings:write"
		135	? commands.canWriteSettings
		136	: scope === "orchestration:read"),
121	}));	137	}));
122		138
123	vi.mock("../../state/entities", () => ({	139	vi.mock("../../state/entities", () => ({
...	@@ -125,6 +141,7 @@ vi.mock("../../state/entities", () => ({	...	@@ -125,6 +141,7 @@ vi.mock("../../state/entities", () => ({
125	}));	141	}));
126		142
127	import { EnvironmentProviderSettings } from "./ProviderSettingsPanel";	143	import { EnvironmentProviderSettings } from "./ProviderSettingsPanel";
		144	import { AddProviderInstanceDialog } from "./AddProviderInstanceDialog";
128		145
129	const environmentId = EnvironmentId.make("remote-device");	146	const environmentId = EnvironmentId.make("remote-device");
130	const codexId = ProviderInstanceId.make("codex");	147	const codexId = ProviderInstanceId.make("codex");
...	@@ -209,6 +226,8 @@ describe("EnvironmentProviderSettings routing", () => {	...	@@ -209,6 +226,8 @@ describe("EnvironmentProviderSettings routing", () => {
209	settingsState.mutateProviderInstance	226	settingsState.mutateProviderInstance
210	.mockReset()	227	.mockReset()
211	.mockResolvedValue({ _tag: "Success", value: {} });	228	.mockResolvedValue({ _tag: "Success", value: {} });
		229	commands.canManageProviders = true;
		230	commands.canWriteSettings = true;
212	commands.refresh.mockReset().mockResolvedValue({ _tag: "Success" });	231	commands.refresh.mockReset().mockResolvedValue({ _tag: "Success" });
213	commands.updateProvider.mockReset().mockResolvedValue({ _tag: "Success" });	232	commands.updateProvider.mockReset().mockResolvedValue({ _tag: "Success" });
214	commands.uninstall.mockReset().mockResolvedValue({ _tag: "Success", value: {} });	233	commands.uninstall.mockReset().mockResolvedValue({ _tag: "Success", value: {} });
...	@@ -355,6 +374,7 @@ describe("EnvironmentProviderSettings routing", () => {	...	@@ -355,6 +374,7 @@ describe("EnvironmentProviderSettings routing", () => {
355	});	374	});
356		375
357	it("keeps provider selection available while write controls are read only", () => {	376	it("keeps provider selection available while write controls are read only", () => {
		377	commands.canWriteSettings = false;
358	settingsState.value = {	378	settingsState.value = {
359	...DEFAULT_UNIFIED_SETTINGS,	379	...DEFAULT_UNIFIED_SETTINGS,
360	providerInstances: {	380	providerInstances: {
...	@@ -388,7 +408,7 @@ describe("EnvironmentProviderSettings routing", () => {	...	@@ -388,7 +408,7 @@ describe("EnvironmentProviderSettings routing", () => {
388	const notice = visitElements(panel, (element) => element.props.title === "Limited permissions");	408	const notice = visitElements(panel, (element) => element.props.title === "Limited permissions");
389	expect(notice).not.toBeNull();	409	expect(notice).not.toBeNull();
390		410
391	expect(visitElements(panel, isRefreshButton)).toBeNull();	411	expect(visitElements(panel, isRefreshButton)).not.toBeNull();
392	expect(visitElements(panel, isAddProviderButton)).toBeNull();	412	expect(visitElements(panel, isAddProviderButton)).toBeNull();
393	});	413	});
394		414
...	@@ -403,6 +423,24 @@ describe("EnvironmentProviderSettings routing", () => {	...	@@ -403,6 +423,24 @@ describe("EnvironmentProviderSettings routing", () => {
403	expect(visitElements(panel, isAddProviderButton)).not.toBeNull();	423	expect(visitElements(panel, isAddProviderButton)).not.toBeNull();
404	});	424	});
405		425
		426	it("removes an open add-instance dialog when the provider grant is revoked", () => {
		427	let panel = renderPanel();
		428	const add = visitElements(panel, isAddProviderButton);
		429	if (!add) throw new Error("Missing Add provider action.");
		430	(add.props.onClick as () => void)();
		431	panel = renderPanel();
		432	expect(
		433	visitElements(panel, (element) => element.type === AddProviderInstanceDialog),
		434	).not.toBeNull();
		435
		436	commands.canManageProviders = false;
		437	panel = renderPanel({ readOnly: true });
		438	expect(
		439	visitElements(panel, (element) => element.type === AddProviderInstanceDialog),
		440	).toBeNull();
		441	expect(settingsState.updateSettings).not.toHaveBeenCalled();
		442	});
		443
406	it("keeps Advanced visible when search targets the provider health interval", () => {	444	it("keeps Advanced visible when search targets the provider health interval", () => {
407	let panel = renderPanel();	445	let panel = renderPanel();
408	expect(visitElements(panel, (element) => element.props.title === "Advanced")).not.toBeNull();	446	expect(visitElements(panel, (element) => element.props.title === "Advanced")).not.toBeNull();

apps/web/src/components/settings/ProviderSettingsPanel.logic.test.ts+21-14

 @@ -1,4 +1,4 @@
-import { AuthOrchestrationOperateScope, EnvironmentId } from "@t3tools/contracts";
+import { AuthProvidersManageScope, EnvironmentId } from "@t3tools/contracts";
 import { describe, expect, it } from "vite-plus/test";
 import {
 @@ -136,7 +136,7 @@ describe("provider environment access", () => {
 describe("primary operate access", () => {
   const authenticated = {
     authenticated: true as const,
-    scopes: [AuthOrchestrationOperateScope],
+    scopes: [AuthProvidersManageScope],
   };
   it("keeps cached session data authoritative while SWR revalidates", () => {
 @@ -163,7 +163,7 @@ describe("primary operate access", () => {
     ).toBe("pending");
   });
-  it("treats a failed session fetch as a transport problem, not a denial", () => {
+  it("denies writes when the session fetch fails", () => {
     expect(
       resolvePrimaryOperateAccess({
         isPrimary: true,
 @@ -172,7 +172,7 @@ describe("primary operate access", () => {
         isPending: false,
         hasError: true,
       }),
-    ).toBe("granted");
+    ).toBe("denied");
   });
   it("denies unauthenticated sessions and sessions without the operate scope", () => {
 @@ -205,7 +205,7 @@ describe("primary operate access", () => {
     ).toBe("denied");
   });
-  it("grants desktop bridge and remote environments without blocking on the primary session", () => {
+  it("waits for explicit grants on desktop and remote environments", () => {
     expect(
       resolvePrimaryOperateAccess({
         isPrimary: true,
 @@ -214,7 +214,7 @@ describe("primary operate access", () => {
         isPending: true,
         hasError: false,
       }),
-    ).toBe("granted");
+    ).toBe("pending");
     expect(
       resolvePrimaryOperateAccess({
         isPrimary: false,
 @@ -223,15 +223,24 @@ describe("primary operate access", () => {
         isPending: true,
         hasError: false,
       }),
-    ).toBe("granted");
+    ).toBe("pending");
   });
 });
 describe("remote operate access", () => {
+  it("does not treat the old orchestration grant as provider management", () => {
+    expect(
+      resolveRemoteOperateAccess({
+        session: { authenticated: true, scopes: ["orchestration:operate"] },
+        isPending: false,
+        hasError: false,
+      }),
+    ).toBe("denied");
+  });
   it("derives access from the environment session's granted scopes", () => {
     expect(
       resolveRemoteOperateAccess({
-        session: { authenticated: true, scopes: [AuthOrchestrationOperateScope] },
+        session: { authenticated: true, scopes: [AuthProvidersManageScope] },
         isPending: false,
         hasError: false,
       }),
 @@ -258,18 +267,16 @@ describe("remote operate access", () => {
     );
     expect(
       resolveRemoteOperateAccess({
-        session: { authenticated: true, scopes: [AuthOrchestrationOperateScope] },
+        session: { authenticated: true, scopes: [AuthProvidersManageScope] },
         isPending: true,
         hasError: false,
       }),
     ).toBe("granted");
   });
-  it("stays optimistic when the session fetch fails or an older server omits scopes", () => {
+  it("denies writes when the session fetch fails or scopes are missing", () => {
-    // Transport failures and pre-scope-reporting servers are not permission
-    // decisions; the environment RPC layer still rejects unauthorized writes.
     expect(resolveRemoteOperateAccess({ session: null, isPending: false, hasError: true })).toBe(
-      "granted",
+      "denied",
     );
     expect(
       resolveRemoteOperateAccess({
 @@ -277,6 +284,6 @@ describe("remote operate access", () => {
         isPending: false,
         hasError: false,
       }),
-    ).toBe("granted");
+    ).toBe("denied");
   });
 });

apps/web/src/components/settings/ProviderSettingsPanel.logic.ts+9-51

...	@@ -1,6 +1,6 @@	...	@@ -1,6 +1,6 @@
1	import type { EnvironmentConnectionPhase } from "@t3tools/client-runtime/connection";	1	import type { EnvironmentConnectionPhase } from "@t3tools/client-runtime/connection";
2	import {	2	import {
3	AuthOrchestrationOperateScope,	3	AuthProvidersManageScope,
4	type AuthSessionState,	4	type AuthSessionState,
5	type EnvironmentId,	5	type EnvironmentId,
6	} from "@t3tools/contracts";	6	} from "@t3tools/contracts";
...	@@ -74,46 +74,19 @@ export type ProviderEnvironmentAccess =	...	@@ -74,46 +74,19 @@ export type ProviderEnvironmentAccess =
74	*/	74	*/
75	export type ProviderOperateAccess = "granted" \| "denied" \| "pending";	75	export type ProviderOperateAccess = "granted" \| "denied" \| "pending";
76		76
77	/**	77	/** Cached grants remain usable during revalidation; unknown or failed lookups grant nothing. */
78	* Resolve operate access from an environment's `/api/auth/session` answer.
79	*
80	* Cached session data wins over an in-flight revalidation. The session atoms
81	* are SWR-backed, so they report `isPending` on every background refresh;
82	* treating that as unknown would flip a working panel back to loading and
83	* discard in-progress edits.
84	*
85	* `missingScopesAccess` decides the case where the session resolved but did
86	* not report scopes: the primary serves the web app itself so its server
87	* always reports them (absence means denial), while a remote device may run an
88	* older server version that predates scope reporting, where denial would lock
89	* out a legitimate session. The environment RPC layer stays authoritative
90	* either way.
91	*/
92	function resolveSessionOperateAccess(input: {	78	function resolveSessionOperateAccess(input: {
93	readonly session: Pick<AuthSessionState, "authenticated" \| "scopes"> \| null;	79	readonly session: Pick<AuthSessionState, "authenticated" \| "scopes"> \| null;
94	readonly isPending: boolean;	80	readonly isPending: boolean;
95	readonly hasError: boolean;	81	readonly hasError: boolean;
96	readonly missingScopesAccess: "granted" \| "denied";
97	}): ProviderOperateAccess {	82	}): ProviderOperateAccess {
98	if (input.session === null) {	83	if (input.hasError) return "denied";
99	if (input.isPending) {	84	if (input.session === null) return input.isPending ? "pending" : "denied";
100	return "pending";	85	return input.session.authenticated && input.session.scopes?.includes(AuthProvidersManageScope)
101	}	86	? "granted"
102	// A failed session fetch is a transport problem, not a permission	87	: "denied";
103	// decision — locking the panel read-only would misreport it. Stay
104	// optimistic; the environment RPC layer still rejects unauthorized writes.
105	return input.hasError ? "granted" : "denied";
106	}
107	if (!input.session.authenticated) {
108	return "denied";
109	}
110	if (input.session.scopes === undefined) {
111	return input.missingScopesAccess;
112	}
113	return input.session.scopes.includes(AuthOrchestrationOperateScope) ? "granted" : "denied";
114	}	88	}
115		89
116	/** Operate access for the primary environment's own browser session. */
117	export function resolvePrimaryOperateAccess(input: {	90	export function resolvePrimaryOperateAccess(input: {
118	readonly isPrimary: boolean;	91	readonly isPrimary: boolean;
119	readonly hasDesktopBridge: boolean;	92	readonly hasDesktopBridge: boolean;
...	@@ -121,30 +94,15 @@ export function resolvePrimaryOperateAccess(input: {	...	@@ -121,30 +94,15 @@ export function resolvePrimaryOperateAccess(input: {
121	readonly isPending: boolean;	94	readonly isPending: boolean;
122	readonly hasError: boolean;	95	readonly hasError: boolean;
123	}): ProviderOperateAccess {	96	}): ProviderOperateAccess {
124	if (!input.isPrimary \|\| input.hasDesktopBridge) {	97	return resolveSessionOperateAccess(input);
125	return "granted";
126	}
127	return resolveSessionOperateAccess({
128	session: input.session,
129	isPending: input.isPending,
130	hasError: input.hasError,
131	missingScopesAccess: "denied",
132	});
133	}	98	}
134		99
135	/**
136	* Operate access for a non-primary environment, derived from the scopes its
137	* `/api/auth/session` endpoint reports for this client's credential.
138	*/
139	export function resolveRemoteOperateAccess(input: {	100	export function resolveRemoteOperateAccess(input: {
140	readonly session: Pick<AuthSessionState, "authenticated" \| "scopes"> \| null;	101	readonly session: Pick<AuthSessionState, "authenticated" \| "scopes"> \| null;
141	readonly isPending: boolean;	102	readonly isPending: boolean;
142	readonly hasError: boolean;	103	readonly hasError: boolean;
143	}): ProviderOperateAccess {	104	}): ProviderOperateAccess {
144	return resolveSessionOperateAccess({	105	return resolveSessionOperateAccess(input);
145	...input,
146	missingScopesAccess: "granted",
147	});
148	}	106	}
149		107
150	export function classifyProviderEnvironmentAccess(input: {	108	export function classifyProviderEnvironmentAccess(input: {

apps/web/src/components/settings/ProviderSettingsPanel.tsx+67-110

 @@ -1,5 +1,11 @@
 import { SettingsGroup } from "./SettingsGroup";
 import { RefreshIcon } from "~/components/ui/refresh-icon";
+import {
+  AuthSettingsWriteScope,
+  AuthProvidersManageScope,
+  AuthOrchestrationReadScope,
+} from "@t3tools/contracts";
+import { useEnvironmentScope, readEnvironmentScope } from "../../state/session";
 import { useAtomValue } from "@effect/atom-react";
 import { connectionStatusTitle } from "@t3tools/client-runtime/connection";
 import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 @@ -31,8 +37,6 @@ import { PlusIcon } from "lucide-react";
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { isDesktopLocalConnectionTarget } from "../../connection/desktopLocal";
-import { isElectron } from "../../env";
-import { usePrimarySessionState } from "../../environments/primary";
 import {
   useEnvironmentSettings,
   usePersistEnvironmentProviderInstanceMutation,
 @@ -115,7 +119,6 @@ import {
   isProviderSettingsEnvironmentAvailable,
   type ProviderEnvironmentAccess,
   type ProviderOperateAccess,
-  resolvePrimaryOperateAccess,
   resolveRemoteOperateAccess,
   resolveSelectedProviderEnvironmentId,
 } from "./ProviderSettingsPanel.logic";
 @@ -465,28 +468,6 @@ function SelectedEnvironmentProviderSettings({
   readonly deviceTabs?: ReactNode;
   readonly targetInstanceId?: ProviderInstanceId | undefined;
 }) {
-  const isPrimary = environment.entry.target._tag === "PrimaryConnectionTarget";
-  if (isPrimary) {
-    // The desktop app owns its primary server outright; a browser session
-    // checks the scopes its cookie session was granted.
-    if (isElectron) {
-      return (
-        <AccessGatedProviderSettings
-          environment={environment}
-          operateAccess="granted"
-          deviceTabs={deviceTabs}
-          targetInstanceId={targetInstanceId}
-        />
-      );
-    }
-    return (
-      <PrimarySessionGatedProviderSettings
-        environment={environment}
-        deviceTabs={deviceTabs}
-        targetInstanceId={targetInstanceId}
-      />
-    );
-  }
   return (
     <RemoteSessionGatedProviderSettings
       environment={environment}
 @@ -496,33 +477,6 @@ function SelectedEnvironmentProviderSettings({
   );
 }
-function PrimarySessionGatedProviderSettings({
-  environment,
-  deviceTabs,
-  targetInstanceId,
-}: {
-  readonly environment: EnvironmentPresentation;
-  readonly deviceTabs?: ReactNode;
-  readonly targetInstanceId?: ProviderInstanceId | undefined;
-}) {
-  const primarySessionState = usePrimarySessionState();
-  const operateAccess = resolvePrimaryOperateAccess({
-    isPrimary: true,
-    hasDesktopBridge: false,
-    session: primarySessionState.data,
-    isPending: primarySessionState.isPending,
-    hasError: primarySessionState.error !== null,
-  });
-  return (
-    <AccessGatedProviderSettings
-      environment={environment}
-      operateAccess={operateAccess}
-      deviceTabs={deviceTabs}
-      targetInstanceId={targetInstanceId}
-    />
-  );
-}
 function RemoteSessionGatedProviderSettings({
   environment,
   deviceTabs,
 @@ -597,15 +551,15 @@ export function EnvironmentProviderSettings({
   readonly targetInstanceId?: ProviderInstanceId | undefined;
   /**
    * Grey out and freeze every write control when this session's credential
-   * lacks `orchestration:operate` on the environment. Selecting providers
+   * lacks `providers:manage` on the environment. Selecting providers
    * still works so the real configuration stays readable; switches, forms,
-   * and the health interval are inert so no write is offered and then rejected.
+   * are inert so no write is offered and then rejected.
    */
   readonly readOnly?: boolean;
 }) {
   const settings = useEnvironmentSettings(environmentId);
-  // Provider instances hold per-machine credentials and binaries, so this
+  const canWriteSettings = useEnvironmentScope(environmentId, AuthSettingsWriteScope);
-  // page always edits exactly the environment it displays.
+  const canRefreshProviders = useEnvironmentScope(environmentId, AuthOrchestrationReadScope);
   const updateSettings = useUpdateEnvironmentSettings(environmentId);
   const persistProviderInstance = usePersistEnvironmentProviderInstanceMutation(environmentId);
   const updateClientSettings = useUpdateClientSettings();
 @@ -700,7 +654,8 @@ export function EnvironmentProviderSettings({
       : null;
   const refreshProviders = useCallback(() => {
-    if (refreshingRef.current) return;
+    if (refreshingRef.current || !readEnvironmentScope(environmentId, AuthOrchestrationReadScope))
+      return;
     refreshingRef.current = true;
     setIsRefreshingProviders(true);
     void (async () => {
 @@ -725,6 +680,7 @@ export function EnvironmentProviderSettings({
       candidate: Pick<ProviderSettingsUpdateCandidate, "driver" | "instanceId">,
       targetVersion?: string,
     ) => {
+      if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
       // Ref-based re-entry guard, mirroring refreshProviders: a state updater
       // may run after this function returns, so it cannot gate the dispatch.
       if (updatingInstanceIdsRef.current.has(candidate.instanceId)) {
 @@ -1062,6 +1018,7 @@ export function EnvironmentProviderSettings({
             />
           ) : undefined
         }
+        canWriteSettings={canWriteSettings}
         setup={
           mode === "editor" && row.driver === "antigravity" ? (
             <ProviderSetupSection
 @@ -1125,7 +1082,10 @@ export function EnvironmentProviderSettings({
         onUpdate={(next) => {
           const wasEnabled = resolveProviderInstanceEnabled(row.instance);
           const isDisabling = next.enabled === false && wasEnabled;
-          const shouldClearTextGen = isDisabling && textGenInstanceId === row.instanceId;
+          const shouldClearTextGen =
+            isDisabling &&
+            textGenInstanceId === row.instanceId &&
+            readEnvironmentScope(environmentId, AuthSettingsWriteScope);
           updateProviderInstance(
             row,
             next,
 @@ -1197,53 +1157,47 @@ export function EnvironmentProviderSettings({
         headerAction={
           <div className="flex min-w-0 items-center gap-2">
             <ProviderUpdatesAction />
-            {readOnly ? (
+            <Tooltip>
-              <span className="min-w-0 truncate text-xs text-muted-foreground">
+              <TooltipTrigger
-                <ProviderLastChecked lastCheckedAt={lastCheckedAt} />
+                render={
-              </span>
+                  <Button
-            ) : (
+                    size="xs"
-              <>
+                    variant="ghost-muted"
-                <Tooltip>
+                    disabled={isRefreshingProviders || !canRefreshProviders}
-                  <TooltipTrigger
+                    aria-busy={isRefreshingProviders}
-                    render={
+                    onClick={() => void refreshProviders()}
-                      <Button
+                  >
-                        size="xs"
+                    <RefreshIcon refreshing={isRefreshingProviders} />
-                        variant="ghost-muted"
+                    <span className="sr-only">Refresh provider status</span>
-                        disabled={isRefreshingProviders}
+                    <span className="hidden min-w-0 truncate sm:inline">
-                        aria-busy={isRefreshingProviders}
+                      {isRefreshingProviders ? (
-                        onClick={() => void refreshProviders()}
+                        "Refreshing providers"
-                      >
+                      ) : (
-                        <RefreshIcon refreshing={isRefreshingProviders} />
+                        <ProviderLastChecked lastCheckedAt={lastCheckedAt} />
-                        <span className="sr-only">Refresh provider status</span>
+                      )}
-                        <span className="hidden min-w-0 truncate sm:inline">
+                    </span>
-                          {isRefreshingProviders ? (
+                  </Button>
-                            "Refreshing providers"
+                }
-                          ) : (
+              />
-                            <ProviderLastChecked lastCheckedAt={lastCheckedAt} />
+              <TooltipPopup side="top">Refresh provider status</TooltipPopup>
-                          )}
+            </Tooltip>
-                        </span>
+            {!readOnly ? (
-                      </Button>
+              <Tooltip>
-                    }
+                <TooltipTrigger
-                  />
+                  render={
-                  <TooltipPopup side="top">Refresh provider status</TooltipPopup>
+                    <Button
-                </Tooltip>
+                      size="icon-xs"
-                <Tooltip>
+                      variant="ghost-muted"
-                  <TooltipTrigger
+                      onClick={() => setIsAddInstanceDialogOpen(true)}
-                    render={
+                      aria-label="Add provider"
-                      <Button
+                    >
-                        size="icon-xs"
+                      <PlusIcon />
-                        variant="ghost-muted"
+                    </Button>
-                        onClick={() => setIsAddInstanceDialogOpen(true)}
+                  }
-                        aria-label="Add provider"
+                />
-                      >
+                <TooltipPopup side="top">Add provider</TooltipPopup>
-                        <PlusIcon />
+              </Tooltip>
-                      </Button>
+            ) : null}
-                    }
-                  />
-                  <TooltipPopup side="top">Add provider</TooltipPopup>
-                </Tooltip>
-              </>
-            )}
           </div>
         }
       >
 @@ -1318,7 +1272,10 @@ export function EnvironmentProviderSettings({
           description="Refresh provider status, versions, and models in the background. Set to 0 to disable."
           resetAction={
             providerHealthRefreshIntervalSeconds !== defaultProviderHealthRefreshIntervalSeconds ? (
-              <span inert={readOnly} className={readOnly ? "opacity-50" : undefined}>
+              <span
+                inert={!canWriteSettings}
+                className={!canWriteSettings ? "opacity-50" : undefined}
+              >
                 <SettingResetButton
                   label="provider health check interval"
                   onClick={() =>
 @@ -1336,11 +1293,11 @@ export function EnvironmentProviderSettings({
           }
           control={
             <div
-              inert={readOnly}
+              inert={!canWriteSettings}
-              aria-disabled={readOnly || undefined}
+              aria-disabled={!canWriteSettings || undefined}
               className={cn(
                 "flex shrink-0 items-center gap-2",
-                readOnly && "opacity-50 select-none",
+                !canWriteSettings && "opacity-50 select-none",
               )}
             >
               <NumberField
 @@ -1375,7 +1332,7 @@ export function EnvironmentProviderSettings({
         />
       </SettingsSection>
-      {isAddInstanceDialogOpen ? (
+      {isAddInstanceDialogOpen && !readOnly ? (
         <AddProviderInstanceDialog
           open
           environmentId={environmentId}

apps/web/src/components/settings/ResourceTelemetryDiagnostics.tsx+28-3

 @@ -1,4 +1,5 @@
 import { ProcessSignalActions } from "./ProcessSignalActions";
+import { AuthEnvironmentMaintainScope } from "@t3tools/contracts";
 import { RefreshIcon } from "~/components/ui/refresh-icon";
 import {
   ActivityIcon,
 @@ -40,6 +41,7 @@ import {
 import { cn } from "../../lib/utils";
 import { ensureLocalApi } from "../../localApi";
 import { serverEnvironment } from "../../state/server";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { formatRelativeTime } from "../../timestampFormat";
 import { Button } from "../ui/button";
 @@ -520,10 +522,12 @@ function canSignalProcess(process: ResourceTelemetryProcess): boolean {
 function ProcessActions({
   process,
+  canMaintainEnvironment,
   signalingKeys,
   onSignal,
 }: {
   process: ResourceTelemetryProcess;
+  canMaintainEnvironment: boolean;
   signalingKeys: ReadonlySet<string>;
   onSignal: (process: ResourceTelemetryProcess, signal: ServerProcessSignal) => void;
 }) {
 @@ -532,16 +536,21 @@ function ProcessActions({
   }
   const isSignaling = signalingKeys.has(processIdentityKey(process));
   return (
-    <ProcessSignalActions disabled={isSignaling} onSignal={(signal) => onSignal(process, signal)} />
+    <ProcessSignalActions
+      disabled={!canMaintainEnvironment || isSignaling}
+      onSignal={(signal) => onSignal(process, signal)}
+    />
   );
 }
 function ProcessTable({
   processes,
+  canMaintainEnvironment,
   signalingKeys,
   onSignal,
 }: {
   processes: ReadonlyArray<ResourceTelemetryProcess>;
+  canMaintainEnvironment: boolean;
   signalingKeys: ReadonlySet<string>;
   onSignal: (process: ResourceTelemetryProcess, signal: ServerProcessSignal) => void;
 }) {
 @@ -650,6 +659,7 @@ function ProcessTable({
                 <td className="px-2 py-2 text-right sm:pr-4">
                   <ProcessActions
                     process={process}
+                    canMaintainEnvironment={canMaintainEnvironment}
                     signalingKeys={signalingKeys}
                     onSignal={onSignal}
                   />
 @@ -820,6 +830,7 @@ export function ResourceTelemetryDiagnostics({
   const [windowMs, setWindowMs] = useState(15 * 60_000);
   const selectedWindow =
     HISTORY_WINDOWS.find((option) => option.windowMs === windowMs) ?? HISTORY_WINDOWS[1];
+  const canMaintainEnvironment = useEnvironmentScope(environmentId, AuthEnvironmentMaintainScope);
   const telemetry = useResourceTelemetry(environmentId);
   const retryTelemetry = telemetry.retry;
   const history = useResourceTelemetryHistory(
 @@ -848,7 +859,11 @@ export function ResourceTelemetryDiagnostics({
   const signalProcess = useCallback(
     async (process: ResourceTelemetryProcess, signal: ServerProcessSignal) => {
       const targetEnvironmentId = environmentIdRef.current;
-      if (targetEnvironmentId === null) return;
+      if (
+        targetEnvironmentId === null ||
+        !readEnvironmentScope(targetEnvironmentId, AuthEnvironmentMaintainScope)
+      )
+        return;
       const identityKey = processIdentityKey(process);
       if (signalingKeysRef.current.has(identityKey)) return;
       const nextSignalingKeys = new Set(signalingKeysRef.current).add(identityKey);
 @@ -882,7 +897,10 @@ export function ResourceTelemetryDiagnostics({
           return;
         }
       }
-      if (environmentIdRef.current !== targetEnvironmentId) {
+      if (
+        environmentIdRef.current !== targetEnvironmentId ||
+        !readEnvironmentScope(targetEnvironmentId, AuthEnvironmentMaintainScope)
+      ) {
         clearSignaling();
         return;
       }
 @@ -924,6 +942,12 @@ export function ResourceTelemetryDiagnostics({
   );
   const retryCollector = useCallback(() => {
+    const environmentId = environmentIdRef.current;
+    if (
+      environmentId === null ||
+      !readEnvironmentScope(environmentId, AuthEnvironmentMaintainScope)
+    )
+      return;
     setIsRetrying(true);
     void retryTelemetry()
       .catch((error: unknown) => {
 @@ -1253,6 +1277,7 @@ export function ResourceTelemetryDiagnostics({
         <div className="overflow-hidden rounded-2xl border border-border/70 bg-card shadow-xs/5">
           <ProcessTable
             processes={snapshot?.processes ?? []}
+            canMaintainEnvironment={canMaintainEnvironment}
             signalingKeys={signalingKeys}
             onSignal={signalProcess}
           />

apps/web/src/components/settings/ScheduledTasksSettings.tsx+21-6

...	@@ -59,6 +59,8 @@ import { EMPTY_SERVER_PROVIDERS, serverEnvironment } from "../../state/server";	...	@@ -59,6 +59,8 @@ import { EMPTY_SERVER_PROVIDERS, serverEnvironment } from "../../state/server";
59	import { useAtomCommand } from "../../state/use-atom-command";	59	import { useAtomCommand } from "../../state/use-atom-command";
60	import { WorktreeBaseBranchPicker } from "../WorktreeBaseBranchPicker";	60	import { WorktreeBaseBranchPicker } from "../WorktreeBaseBranchPicker";
61	import { EnvironmentMachineIcon } from "../EnvironmentMachineIcon";	61	import { EnvironmentMachineIcon } from "../EnvironmentMachineIcon";
		62	import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
		63	import { readEnvironmentScope } from "~/state/session";
62	import { useSettingsScope } from "./SettingsScopeContext";	64	import { useSettingsScope } from "./SettingsScopeContext";
63	import {	65	import {
64	WEBHOOK_SIGNATURE_DEFAULTS,	66	WEBHOOK_SIGNATURE_DEFAULTS,
...	@@ -246,6 +248,9 @@ export function ScheduledTasksSettings(target: {	...	@@ -246,6 +248,9 @@ export function ScheduledTasksSettings(target: {
246	setEditor({ environmentId, task });	248	setEditor({ environmentId, task });
247	}, []);	249	}, []);
248	const defaultEnvironment = environment ?? connectedEnvironments[0];	250	const defaultEnvironment = environment ?? connectedEnvironments[0];
		251	const canCreate = useAtomValue(
		252	serverEnvironment.upsertScheduledTask.permissionAtom(defaultEnvironment?.environmentId ?? null),
		253	);
249	return (	254	return (
250	<SettingsPageContainer>	255	<SettingsPageContainer>
251	<SettingsSection	256	<SettingsSection
...	@@ -255,7 +260,7 @@ export function ScheduledTasksSettings(target: {	...	@@ -255,7 +260,7 @@ export function ScheduledTasksSettings(target: {
255	<Button	260	<Button
256	size="xs"	261	size="xs"
257	variant="ghost-muted"	262	variant="ghost-muted"
258	disabled={!defaultEnvironment}	263	disabled={!defaultEnvironment \|\| !canCreate}
259	onClick={() =>	264	onClick={() =>
260	defaultEnvironment &&	265	defaultEnvironment &&
261	setEditor({ environmentId: defaultEnvironment.environmentId, task: null })	266	setEditor({ environmentId: defaultEnvironment.environmentId, task: null })
...	@@ -404,6 +409,9 @@ function ScheduledTaskRow({	...	@@ -404,6 +409,9 @@ function ScheduledTaskRow({
404	readonly task: ScheduledTask;	409	readonly task: ScheduledTask;
405	readonly onEdit: () => void;	410	readonly onEdit: () => void;
406	}) {	411	}) {
		412	const canOperate = useAtomValue(
		413	serverEnvironment.upsertScheduledTask.permissionAtom(environmentId),
		414	);
407	const [busy, setBusy] = useState(false);	415	const [busy, setBusy] = useState(false);
408	const [deliveriesOpen, setDeliveriesOpen] = useState(false);	416	const [deliveriesOpen, setDeliveriesOpen] = useState(false);
409	const isWebhook = task.schedule.type === "webhook";	417	const isWebhook = task.schedule.type === "webhook";
...	@@ -417,7 +425,7 @@ function ScheduledTaskRow({	...	@@ -417,7 +425,7 @@ function ScheduledTaskRow({
417	label: "scheduled task delete",	425	label: "scheduled task delete",
418	});	426	});
419	const act = async (action: "toggle" \| "run" \| "delete") => {	427	const act = async (action: "toggle" \| "run" \| "delete") => {
420	if (busy) return;	428	if (busy \|\| !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
421	setBusy(true);	429	setBusy(true);
422	const result =	430	const result =
423	action === "toggle"	431	action === "toggle"
...	@@ -462,7 +470,7 @@ function ScheduledTaskRow({	...	@@ -462,7 +470,7 @@ function ScheduledTaskRow({
462	<div className="flex items-center gap-2">	470	<div className="flex items-center gap-2">
463	<Switch	471	<Switch
464	checked={task.enabled}	472	checked={task.enabled}
465	disabled={busy}	473	disabled={busy \|\| !canOperate}
466	aria-label={`Enable ${task.title}`}	474	aria-label={`Enable ${task.title}`}
467	onCheckedChange={() => void act("toggle")}	475	onCheckedChange={() => void act("toggle")}
468	/>	476	/>
...	@@ -472,7 +480,7 @@ function ScheduledTaskRow({	...	@@ -472,7 +480,7 @@ function ScheduledTaskRow({
472	<Button	480	<Button
473	size="icon-sm"	481	size="icon-sm"
474	variant="ghost"	482	variant="ghost"
475	disabled={busy}	483	disabled={busy \|\| !canOperate}
476	aria-label={`Actions for ${task.title}`}	484	aria-label={`Actions for ${task.title}`}
477	/>	485	/>
478	}	486	}
...	@@ -668,6 +676,9 @@ function WebhookEndpointField({	...	@@ -668,6 +676,9 @@ function WebhookEndpointField({
668	readonly environmentId: EnvironmentId;	676	readonly environmentId: EnvironmentId;
669	readonly task: ScheduledTask \| null;	677	readonly task: ScheduledTask \| null;
670	}) {	678	}) {
		679	const canRotate = useAtomValue(
		680	serverEnvironment.rotateScheduledTaskWebhookToken.permissionAtom(environmentId),
		681	);
671	const httpBaseUrl = useEnvironmentHttpBaseUrl(environmentId);	682	const httpBaseUrl = useEnvironmentHttpBaseUrl(environmentId);
672	const { copyToClipboard, isCopied } = useCopyToClipboard({ target: "webhook URL" });	683	const { copyToClipboard, isCopied } = useCopyToClipboard({ target: "webhook URL" });
673	const rotate = useAtomCommand(serverEnvironment.rotateScheduledTaskWebhookToken, {	684	const rotate = useAtomCommand(serverEnvironment.rotateScheduledTaskWebhookToken, {
...	@@ -725,7 +736,7 @@ function WebhookEndpointField({	...	@@ -725,7 +736,7 @@ function WebhookEndpointField({
725	size="sm"	736	size="sm"
726	variant="outline"	737	variant="outline"
727	type="button"	738	type="button"
728	disabled={rotating}	739	disabled={rotating \|\| !canRotate}
729	onClick={() => void rotateUrl()}	740	onClick={() => void rotateUrl()}
730	>	741	>
731	Rotate	742	Rotate
...	@@ -787,6 +798,9 @@ function ScheduledTaskEditorDialog({	...	@@ -787,6 +798,9 @@ function ScheduledTaskEditorDialog({
787	const settings = useEnvironmentSettings(environmentId);	798	const settings = useEnvironmentSettings(environmentId);
788	const providers =	799	const providers =
789	useAtomValue(serverEnvironment.providersValueAtom(environmentId)) ?? EMPTY_SERVER_PROVIDERS;	800	useAtomValue(serverEnvironment.providersValueAtom(environmentId)) ?? EMPTY_SERVER_PROVIDERS;
		801	const canOperate = useAtomValue(
		802	serverEnvironment.upsertScheduledTask.permissionAtom(environmentId),
		803	);
790	const upsertTask = useAtomCommand(serverEnvironment.upsertScheduledTask, {	804	const upsertTask = useAtomCommand(serverEnvironment.upsertScheduledTask, {
791	label: "scheduled task upsert",	805	label: "scheduled task upsert",
792	});	806	});
...	@@ -840,6 +854,7 @@ function ScheduledTaskEditorDialog({	...	@@ -840,6 +854,7 @@ function ScheduledTaskEditorDialog({
840		854
841	const submit = async () => {	855	const submit = async () => {
842	if (	856	if (
		857	!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope) \|\|
843	submissionPending.current \|\|	858	submissionPending.current \|\|
844	saving \|\|	859	saving \|\|
845	editingTaskMissing \|\|	860	editingTaskMissing \|\|
...	@@ -1348,7 +1363,7 @@ function ScheduledTaskEditorDialog({	...	@@ -1348,7 +1363,7 @@ function ScheduledTaskEditorDialog({
1348	</DialogClose>	1363	</DialogClose>
1349	<Button	1364	<Button
1350	size="sm"	1365	size="sm"
1351	disabled={saving \|\| editingTaskMissing \|\| !connected \|\| !tasksQuery.data}	1366	disabled={!canOperate \|\| saving \|\| editingTaskMissing \|\| !connected \|\| !tasksQuery.data}
1352	onClick={() => void submit()}	1367	onClick={() => void submit()}
1353	>	1368	>
1354	{draft.editingId ? "Save task" : "Create task"}	1369	{draft.editingId ? "Save task" : "Create task"}

apps/web/src/components/settings/SettingsPanels.tsx+9-3

...	@@ -1,4 +1,5 @@	...	@@ -1,4 +1,5 @@
1	import { SettingsGroup } from "./SettingsGroup";	1	import { SettingsGroup } from "./SettingsGroup";
		2	import { useScopedSettingsWriteAllowed } from "./useScopedSettings";
2	import { Spinner } from "~/components/ui/spinner";	3	import { Spinner } from "~/components/ui/spinner";
3	import { NotificationSettings } from "./NotificationSettings";	4	import { NotificationSettings } from "./NotificationSettings";
4	import { PRIVACY_POLICY_URL } from "../../legalLinks";	5	import { PRIVACY_POLICY_URL } from "../../legalLinks";
...	@@ -876,6 +877,7 @@ function BackgroundActivityAdvancedDialog({	...	@@ -876,6 +877,7 @@ function BackgroundActivityAdvancedDialog({
876	readonly open: boolean;	877	readonly open: boolean;
877	readonly onOpenChange: (open: boolean) => void;	878	readonly onOpenChange: (open: boolean) => void;
878	}) {	879	}) {
		880	const canWriteSettings = useScopedSettingsWriteAllowed();
879	const settings = useScopedSettings();	881	const settings = useScopedSettings();
880	const updateSettings = useUpdateScopedSettings();	882	const updateSettings = useUpdateScopedSettings();
881	const resolvedBackgroundActivity = resolveServerBackgroundActivitySettings(settings);	883	const resolvedBackgroundActivity = resolveServerBackgroundActivitySettings(settings);
...	@@ -894,7 +896,7 @@ function BackgroundActivityAdvancedDialog({	...	@@ -894,7 +896,7 @@ function BackgroundActivityAdvancedDialog({
894	);	896	);
895		897
896	return (	898	return (
897	<Dialog open={open} onOpenChange={onOpenChange}>	899	<Dialog open={open && canWriteSettings} onOpenChange={onOpenChange}>
898	<DialogPopup className="max-w-xl">	900	<DialogPopup className="max-w-xl">
899	<DialogHeader>	901	<DialogHeader>
900	<DialogTitle>Background Activity</DialogTitle>	902	<DialogTitle>Background Activity</DialogTitle>
...	@@ -903,7 +905,10 @@ function BackgroundActivityAdvancedDialog({	...	@@ -903,7 +905,10 @@ function BackgroundActivityAdvancedDialog({
903	</DialogDescription>	905	</DialogDescription>
904	</DialogHeader>	906	</DialogHeader>
905	<DialogPanel>	907	<DialogPanel>
906	<div className="overflow-hidden rounded-xl border bg-card text-card-foreground">	908	<fieldset
		909	disabled={!canWriteSettings}
		910	className="min-w-0 overflow-hidden rounded-xl border bg-card text-card-foreground"
		911	>
907	<div className="flex flex-col gap-3 border-b px-4 py-3 sm:flex-row sm:items-center sm:justify-between">	912	<div className="flex flex-col gap-3 border-b px-4 py-3 sm:flex-row sm:items-center sm:justify-between">
908	<div className="min-w-0 space-y-1">	913	<div className="min-w-0 space-y-1">
909	<div className="text-sm font-medium">Shared policy</div>	914	<div className="text-sm font-medium">Shared policy</div>
...	@@ -1125,11 +1130,12 @@ function BackgroundActivityAdvancedDialog({	...	@@ -1125,11 +1130,12 @@ function BackgroundActivityAdvancedDialog({
1125	</label>	1130	</label>
1126	))}	1131	))}
1127	</div>	1132	</div>
1128	</div>	1133	</fieldset>
1129	</DialogPanel>	1134	</DialogPanel>
1130	<DialogFooter>	1135	<DialogFooter>
1131	<Button	1136	<Button
1132	variant="outline"	1137	variant="outline"
		1138	disabled={!canWriteSettings}
1133	onClick={() => updateSettings(resetBackgroundActivitySettings())}	1139	onClick={() => updateSettings(resetBackgroundActivitySettings())}
1134	>	1140	>
1135	Reset all	1141	Reset all

apps/web/src/components/settings/SnapShotSettings.test.tsx+4

 @@ -25,6 +25,10 @@ vi.mock("react/compiler-runtime", async () => {
   return { c: reactHookHarness.useMemoCache };
 });
 vi.mock("@effect/atom-react", () => ({ useAtomValue: () => [] }));
+vi.mock("../../state/environments", () => ({
+  usePrimaryEnvironmentId: () => null,
+  useEnvironments: () => [],
+}));
 vi.mock("../../state/server", () => ({ primaryServerKeybindingsAtom: {} }));
 vi.mock("./SettingsScopeContext", () => ({ useOptionalSettingsScope: () => null }));
 vi.mock("./SettingsScopeSentence", () => ({ SettingsScopeSentence: () => null }));

apps/web/src/components/settings/settingsLayout.tsx+27-5

 @@ -1,4 +1,7 @@
 import { SettingsGroup } from "./SettingsGroup";
+import { AuthSettingsWriteScope } from "@t3tools/contracts";
+import { usePrimaryEnvironmentId } from "../../state/environments";
+import { useEnvironmentScope, useEnvironmentsWithScope } from "../../state/session";
 import { InfoIcon, Undo2Icon } from "lucide-react";
 import { DEFAULT_SERVER_SETTINGS, type ServerSettings } from "@t3tools/contracts";
 import * as Equal from "effect/Equal";
 @@ -27,6 +30,7 @@ import { SettingsScopeSentence } from "./SettingsScopeSentence";
 import {
   isProjectScopedSettingKey,
   listProjectOverrides,
+  type ProjectOverrideEntry,
   scopedSettingsAreMixed,
   scopedSettingsSource,
 } from "./scopedSettings";
 @@ -281,6 +285,16 @@ export function SettingsRow({
   const targetRef = useSettingsSearchTarget<HTMLDivElement>(rowProps.id);
   const primarySettingsAvailable = usePrimarySettingsAvailable();
   const context = useOptionalSettingsScope();
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
+  const primaryCanWrite = useEnvironmentScope(primaryEnvironmentId, AuthSettingsWriteScope);
+  const writableIds = useEnvironmentsWithScope(
+    context?.connectedEnvironments ?? [],
+    AuthSettingsWriteScope,
+  );
+  const canWriteSettings = context
+    ? context.connectedEnvironments.length > 0 &&
+      context.connectedEnvironments.every((target) => writableIds.has(target.environmentId))
+    : primaryCanWrite;
   const clearOverrides = useClearScopedSettings();
   const clearProjectOverrides = useClearProjectOverrides();
   const isProjectScope =
 @@ -295,7 +309,8 @@ export function SettingsRow({
     context && isProjectScope ? scopedSettingsSource(context.targets, scopedKeys) : null;
   const unavailable =
     serverScoped &&
-    !(context ? context.connectedEnvironments.length > 0 : primarySettingsAvailable);
+    (!canWriteSettings ||
+      !(context ? context.connectedEnvironments.length > 0 : primarySettingsAvailable));
   const inheritedFrom =
     source === "environment" && context?.scope.environmentIds.length === 1
       ? (context.environments.find(
 @@ -375,9 +390,11 @@ export function SettingsRow({
   const renderedControl =
     unavailable && control
       ? inertControl(
-          context
+          !canWriteSettings
-            ? "Reconnect the selected environment to change this setting."
+            ? "This connection does not have permission to change environment settings."
-            : PRIMARY_SETTINGS_UNAVAILABLE_MESSAGE,
+            : context
+              ? "Reconnect the selected environment to change this setting."
+              : PRIMARY_SETTINGS_UNAVAILABLE_MESSAGE,
         )
       : environmentWide && control
         ? inertControl("Environment-wide setting. Select an environment to change it.")
 @@ -415,7 +432,12 @@ export function SettingsRow({
         environments={context.connectedEnvironments}
         keys={settingKeys}
         overridingProjects={overridingProjects}
-        onClearOverrides={(entries) => clearProjectOverrides(entries, scopedKeys)}
+        {...(canWriteSettings
+          ? {
+              onClearOverrides: (entries: readonly ProjectOverrideEntry[]) =>
+                clearProjectOverrides(entries, scopedKeys),
+            }
+          : {})}
       />
     ) : null;
   const renderedStatus = status;

apps/web/src/components/settings/settingsSearch.ts-1

...	@@ -813,7 +813,6 @@ export const SETTINGS_SEARCH_ITEMS = [	...	@@ -813,7 +813,6 @@ export const SETTINGS_SEARCH_ITEMS = [
813	to: "/settings/connections",	813	to: "/settings/connections",
814	targetId: "connections-environment",	814	targetId: "connections-environment",
815	searchTerms: ["machine glyph sidebar mac mini studio laptop desktop server cloud vm"],	815	searchTerms: ["machine glyph sidebar mac mini studio laptop desktop server cloud vm"],
816	localBackendManagementOnly: true,
817	},	816	},
818	{	817	{
819	id: "local-environment",	818	id: "local-environment",

apps/web/src/components/settings/useAvailableSettingsSearchItems.ts+7-11

 @@ -1,14 +1,14 @@
 import { useMemo } from "react";
-import { AuthAccessWriteScope } from "@t3tools/contracts";
+import { AuthEnvironmentMaintainScope } from "@t3tools/contracts";
 import { usePrimaryCloudLinkState } from "~/cloud/primaryCloudLinkState";
 import { hasCloudPublicConfig } from "~/cloud/publicConfig";
 import { isElectron } from "~/env";
 import { isLocalEnvironmentDisabled } from "~/localEnvironment";
 import { desktopWslStateAtom } from "~/state/desktopWslState";
-import { useEnvironments } from "~/state/environments";
+import { useEnvironments, usePrimaryEnvironmentId } from "~/state/environments";
 import { useEnvironmentQuery } from "~/state/query";
-import { usePrimarySessionState } from "~/environments/primary";
+import { useEnvironmentScope } from "~/state/session";
 import { isWslSettingsRowVisible } from "./ConnectionsSettings.logic";
 import { isProviderSettingsEnvironmentAvailable } from "./ProviderSettingsPanel.logic";
 import type { SettingsScopeSearch } from "./settingsScope";
 @@ -19,21 +19,17 @@ import {
 export function useAvailableSettingsSearchItems(scopeSearch: SettingsScopeSearch = {}) {
   const { environments } = useEnvironments();
-  const primarySessionState = usePrimarySessionState();
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
   const localEnvironmentDisabled = isLocalEnvironmentDisabled();
+  const canMaintain = useEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope);
+  const canManageLocalBackend = !localEnvironmentDisabled && canMaintain;
   const desktopWsl = useEnvironmentQuery(
-    isElectron && !localEnvironmentDisabled ? desktopWslStateAtom : null,
+    isElectron && canManageLocalBackend ? desktopWslStateAtom : null,
   );
   const cloudLinkState = usePrimaryCloudLinkState().data;
   // Same fallback as the Connections row: older servers imply a tunnel from `linked`.
   const managedTunnelActive =
     cloudLinkState?.managedTunnelActive ?? cloudLinkState?.linked ?? false;
-  const canManageLocalBackend =
-    !localEnvironmentDisabled &&
-    (isElectron ||
-      ((primarySessionState.data?.authenticated &&
-        primarySessionState.data.scopes?.includes(AuthAccessWriteScope)) ??
-        false));
   return useMemo(
     () =>

apps/web/src/components/settings/useHostConnectionChecks.ts+5

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthSettingsWriteScope } from "@t3tools/contracts";
		2	import { readEnvironmentScope } from "../../state/session";
1	import { useRef, useState } from "react";	3	import { useRef, useState } from "react";
2	import * as Cause from "effect/Cause";	4	import * as Cause from "effect/Cause";
3	import type { SshDeviceHostConfig } from "@t3tools/contracts";	5	import type { SshDeviceHostConfig } from "@t3tools/contracts";
...	@@ -25,6 +27,9 @@ export function useHostConnectionChecks(targets: ReadonlyArray<DeviceHostCheckTa	...	@@ -25,6 +27,9 @@ export function useHostConnectionChecks(targets: ReadonlyArray<DeviceHostCheckTa
25	targets,	27	targets,
26	host,	28	host,
27	async (environmentId, input) => {	29	async (environmentId, input) => {
		30	if (!readEnvironmentScope(environmentId, AuthSettingsWriteScope)) {
		31	throw new Error("This connection cannot test device hosts.");
		32	}
28	const result = await test({ environmentId, input });	33	const result = await test({ environmentId, input });
29	if (result._tag === "Failure") throw new Error(Cause.pretty(result.cause));	34	if (result._tag === "Failure") throw new Error(Cause.pretty(result.cause));
30	return result.value;	35	return result.value;

apps/web/src/components/settings/useProjectScriptSettings.ts+18

...	@@ -1,3 +1,5 @@	...	@@ -1,3 +1,5 @@
		1	import { AuthSettingsWriteScope, EnvironmentAuthorizationError } from "@t3tools/contracts";
		2	import { readEnvironmentScope } from "../../state/session";
1	import {	3	import {
2	isAtomCommandInterrupted,	4	isAtomCommandInterrupted,
3	mapAtomCommandResult,	5	mapAtomCommandResult,
...	@@ -80,6 +82,22 @@ export function useProjectScriptSettings(	...	@@ -80,6 +82,22 @@ export function useProjectScriptSettings(
80	toastManager.add({ type: "error", title: "Actions not saved", description: message });	82	toastManager.add({ type: "error", title: "Actions not saved", description: message });
81	return AsyncResult.failure(Cause.fail(new Error(message)));	83	return AsyncResult.failure(Cause.fail(new Error(message)));
82	}	84	}
		85	if (
		86	targets.some(
		87	({ environmentId }) => !readEnvironmentScope(environmentId, AuthSettingsWriteScope),
		88	)
		89	) {
		90	return reportScriptFailure(
		91	AsyncResult.failure(
		92	Cause.fail(
		93	new EnvironmentAuthorizationError({
		94	requiredScope: AuthSettingsWriteScope,
		95	message: "This connection cannot change environment settings.",
		96	}),
		97	),
		98	),
		99	);
		100	}
83	savingRef.current = true;	101	savingRef.current = true;
84	setSaving(true);	102	setSaving(true);
85	try {	103	try {

apps/web/src/components/settings/useScopedSettings.ts+44-12

...	@@ -1,3 +1,12 @@	...	@@ -1,3 +1,12 @@
		1	import { AuthSettingsWriteScope } from "@t3tools/contracts";
		2	import { useEnvironmentsWithScope } from "../../state/session";
		3	import {
		4	requiredScopesForServerSettingsPatch,
		5	EnvironmentAuthorizationError,
		6	} from "@t3tools/contracts";
		7	import { readEnvironmentScope } from "../../state/session";
		8	import * as Cause from "effect/Cause";
		9	import { AsyncResult } from "effect/reactivity";
1	import {	10	import {
2	DEFAULT_SERVER_SETTINGS,	11	DEFAULT_SERVER_SETTINGS,
3	type ProjectScopedServerSettingKey,	12	type ProjectScopedServerSettingKey,
...	@@ -63,19 +72,33 @@ function useRunScopedPlan() {	...	@@ -63,19 +72,33 @@ function useRunScopedPlan() {
63	});	72	});
64	return;	73	return;
65	}	74	}
66	void persistScopedSettingsPatch(plan, persistServer, persistClientSettingsPatch).then(	75	void persistScopedSettingsPatch(
67	({ failedEnvironments, savedEnvironmentCount }) => {	76	plan,
68	if (failedEnvironments.length === 0) return;	77	async (request) => {
69	toastManager.add({	78	const missing = requiredScopesForServerSettingsPatch(request.input.patch).find(
70	type: "error",	79	(scope) => !readEnvironmentScope(request.environmentId, scope),
71	title:	80	);
72	savedEnvironmentCount > 0	81	if (missing)
73	? "Setting saved on some environments"	82	return AsyncResult.failure(
74	: "Setting not saved",	83	Cause.fail(
75	description: `Could not update ${failedEnvironments.map((environment) => environment.label).join(", ")}.${savedEnvironmentCount > 0 ? " The other selected environments saved the change." : ""}`,	84	new EnvironmentAuthorizationError({
76	});	85	requiredScope: missing,
		86	message: "This connection cannot change these settings.",
		87	}),
		88	),
		89	);
		90	return persistServer(request);
77	},	91	},
78	);	92	persistClientSettingsPatch,
		93	).then(({ failedEnvironments, savedEnvironmentCount }) => {
		94	if (failedEnvironments.length === 0) return;
		95	toastManager.add({
		96	type: "error",
		97	title:
		98	savedEnvironmentCount > 0 ? "Setting saved on some environments" : "Setting not saved",
		99	description: `Could not update ${failedEnvironments.map((environment) => environment.label).join(", ")}.${savedEnvironmentCount > 0 ? " The other selected environments saved the change." : ""}`,
		100	});
		101	});
79	},	102	},
80	[persistServer],	103	[persistServer],
81	);	104	);
...	@@ -119,3 +142,12 @@ export function useClearProjectOverrides() {	...	@@ -119,3 +142,12 @@ export function useClearProjectOverrides() {
119	[context, run],	142	[context, run],
120	);	143	);
121	}	144	}
		145
		146	export function useScopedSettingsWriteAllowed() {
		147	const { connectedEnvironments } = useSettingsScope();
		148	const writable = useEnvironmentsWithScope(connectedEnvironments, AuthSettingsWriteScope);
		149	return (
		150	connectedEnvironments.length > 0 &&
		151	connectedEnvironments.every((target) => writable.has(target.environmentId))
		152	);
		153	}

apps/web/src/components/usage/UsageLimits.tsx+23-4

 @@ -1,4 +1,5 @@
 import {
+  AuthProvidersManageScope,
   type EnvironmentId,
   type ProviderConsumeResetCreditOutcome,
   ProviderConsumeResetCreditInput,
 @@ -21,6 +22,7 @@ import { Fragment, type ReactNode, useState } from "react";
 import { usePrimarySettings } from "../../hooks/useSettings";
 import { environmentPresentations } from "../../state/presentation";
+import { useEnvironmentScope, readEnvironmentScope } from "../../state/session";
 import { serverEnvironment } from "../../state/server";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { formatUpcomingTimestamp } from "../../timestampFormat";
 @@ -206,6 +208,7 @@ export function useResetCredit(
   environmentId: EnvironmentId,
   input: ProviderConsumeResetCreditInput,
 ) {
+  const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
   const consume = useAtomCommand(serverEnvironment.consumeResetCredit, { reportFailure: false });
   const [confirming, setConfirming] = useState(false);
   const [busy, setBusy] = useState(false);
 @@ -213,6 +216,7 @@ export function useResetCredit(
   const redeem = async () => {
     setConfirming(false);
+    if (!readEnvironmentScope(environmentId, AuthProvidersManageScope)) return;
     setBusy(true);
     setStatus(null);
     const result = await consume({ environmentId, input });
 @@ -228,7 +232,7 @@ export function useResetCredit(
     );
   };
-  return { confirming, setConfirming, busy, status, redeem };
+  return { canManageProviders, confirming, setConfirming, busy, status, redeem };
 }
 /**
 @@ -241,10 +245,12 @@ export function ResetCreditDialog({
   open,
   onOpenChange,
   onConfirm,
+  disabled = false,
 }: {
   readonly open: boolean;
   readonly onOpenChange: (open: boolean) => void;
   readonly onConfirm: () => void;
+  readonly disabled?: boolean;
 }) {
   return (
     <AlertDialog open={open} onOpenChange={onOpenChange}>
 @@ -258,7 +264,9 @@ export function ResetCreditDialog({
         </AlertDialogHeader>
         <AlertDialogFooter>
           <AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
-          <Button onClick={onConfirm}>Use credit</Button>
+          <Button disabled={disabled} onClick={onConfirm}>
+            Use credit
+          </Button>
         </AlertDialogFooter>
       </AlertDialogPopup>
     </AlertDialog>
 @@ -294,13 +302,23 @@ export function ResetCredits({
   readonly credits: ServerProviderResetCredits;
   readonly now: number;
 }) {
-  const { confirming, setConfirming, busy, status, redeem } = useResetCredit(environmentId, input);
+  const { canManageProviders, confirming, setConfirming, busy, status, redeem } = useResetCredit(
+    environmentId,
+    input,
+  );
   if (credits.availableCount === 0 && status === null) return null;
   return (
     <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-muted-foreground">
       <span className="tabular-nums">{resetCreditsSummary(credits, now)}</span>
       {credits.availableCount > 0 ? (
-        <Button size="xs" variant="outline" disabled={busy} onClick={() => setConfirming(true)}>
+        <Button
+          size="xs"
+          variant="outline"
+          disabled={busy || !canManageProviders}
+          onClick={() => {
+            if (readEnvironmentScope(environmentId, AuthProvidersManageScope)) setConfirming(true);
+          }}
+        >
           {busy ? "Using…" : "Use reset"}
         </Button>
       ) : null}
 @@ -309,6 +327,7 @@ export function ResetCredits({
         open={confirming}
         onOpenChange={setConfirming}
         onConfirm={() => void redeem()}
+        disabled={!canManageProviders}
       />
     </div>
   );

apps/web/src/components/usage/UsageLimitsPooled.tsx+2-1

...	@@ -204,7 +204,7 @@ function SegmentPopover({	...	@@ -204,7 +204,7 @@ function SegmentPopover({
204	<Button	204	<Button
205	size="xs"	205	size="xs"
206	variant="outline"	206	variant="outline"
207	disabled={redeem.busy}	207	disabled={redeem.busy \|\| !redeem.canManageProviders}
208	className="ms-auto"	208	className="ms-auto"
209	onClick={onRedeem}	209	onClick={onRedeem}
210	>	210	>
...	@@ -429,6 +429,7 @@ function RedeemableSegmentPopup({	...	@@ -429,6 +429,7 @@ function RedeemableSegmentPopup({
429	open={redeem.confirming}	429	open={redeem.confirming}
430	onOpenChange={redeem.setConfirming}	430	onOpenChange={redeem.setConfirming}
431	onConfirm={() => void redeem.redeem()}	431	onConfirm={() => void redeem.redeem()}
		432	disabled={!redeem.canManageProviders}
432	/>	433	/>
433	{/* The popover closed before the confirm, so the outcome needs a home outside it. */}	434	{/* The popover closed before the confirm, so the outcome needs a home outside it. */}
434	{redeem.status ? (	435	{redeem.status ? (

apps/web/src/components/usage/UsagePriceOverrides.tsx+17-17

 @@ -1,21 +1,16 @@
 import { useAtomValue } from "@effect/atom-react";
-import type { EnvironmentId } from "@t3tools/contracts";
+import { AuthSettingsWriteScope, type EnvironmentId } from "@t3tools/contracts";
 import { ChevronDownIcon, PlusIcon, RotateCcwIcon, XIcon } from "lucide-react";
 import * as Option from "effect/Option";
 import { AsyncResult, Atom } from "effect/reactivity";
 import { useRef, useState } from "react";
-import { isElectron } from "../../env";
 import { cn } from "../../lib/utils";
 import { environmentPresentations } from "../../state/presentation";
 import { serverEnvironment } from "../../state/server";
-import { environmentSession } from "../../state/session";
+import { environmentSession, readEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
 import type { EnvironmentUsageStatus } from "../../state/usage";
-import {
-  resolvePrimaryOperateAccess,
-  resolveRemoteOperateAccess,
-} from "../settings/ProviderSettingsPanel.logic";
 import { Button } from "../ui/button";
 import {
   Dialog,
 @@ -51,15 +46,17 @@ const priceTargetsAtom = Atom.make((get): readonly UsagePriceTarget[] =>
   [...get(environmentPresentations.presentationsAtom)].map(([environmentId, environment]) => {
     const settings = get(serverEnvironment.settingsValueAtom(environmentId));
     const session = get(environmentSession.sessionStateAtom(environmentId));
-    const sessionAccess = {
+    const sessionData = Option.getOrNull(AsyncResult.value(session));
-      session: Option.getOrNull(AsyncResult.value(session)),
+    const access =
-      isPending: session.waiting,
+      session._tag === "Failure"
-      hasError: session._tag === "Failure",
+        ? "denied"
-    };
+        : sessionData === null
-    const isPrimary = environment.entry.target._tag === "PrimaryConnectionTarget";
+          ? session.waiting
-    const access = isPrimary
+            ? "pending"
-      ? resolvePrimaryOperateAccess({ ...sessionAccess, isPrimary, hasDesktopBridge: isElectron })
+            : "denied"
-      : resolveRemoteOperateAccess(sessionAccess);
+          : sessionData.authenticated && sessionData.scopes?.includes(AuthSettingsWriteScope)
+            ? "granted"
+            : "denied";
     return {
       environmentId,
       label: environment.entry.target.label,
 @@ -262,7 +259,10 @@ export function UsagePriceOverrides({
           target.unavailable ?? [...changes.get(target.environmentId)!.errors.values()][0] ?? null,
       })),
       changes: new Map([...changes].map(([id, plan]) => [id, plan.changes])),
-      write: updateSettings,
+      write: async (input) =>
+        readEnvironmentScope(input.environmentId, AuthSettingsWriteScope)
+          ? updateSettings(input)
+          : { _tag: "Failure" },
       onResult: (environmentId, result) => {
         if (result.status === "failed") failed = true;
         setAttempt((previous) =>

apps/web/src/editorPreferences.test.ts created+88

...	@@ -0,0 +1,88 @@
1	import {
2	AuthOrchestrationOperateScope,
3	EnvironmentAuthorizationError,
4	EnvironmentId,
5	} from "@t3tools/contracts";
6	import * as Cause from "effect/Cause";
7	import { AsyncResult } from "effect/reactivity";
8	import { assert, beforeEach, expect, it, vi } from "vite-plus/test";
9
10	const state = vi.hoisted(() => ({
11	allowed: new Set<string>(),
12	run: vi.fn(),
13	getPreference: vi.fn(),
14	setPreference: vi.fn(),
15	}));
16
17	vi.mock("react", () => ({ useCallback: (callback: unknown) => callback }));
18	vi.mock("./state/shell", () => ({ shellEnvironment: { openInEditor: "openInEditor" } }));
19	vi.mock("./state/use-atom-command", () => ({ useAtomCommand: () => state.run }));
20	vi.mock("./state/session", () => ({
21	readEnvironmentScope: (environmentId: string, scope: string) =>
22	scope === AuthOrchestrationOperateScope && state.allowed.has(environmentId),
23	}));
24	vi.mock("./hooks/useLocalStorage", () => ({
25	getLocalStorageItem: state.getPreference,
26	setLocalStorageItem: state.setPreference,
27	useLocalStorage: vi.fn(),
28	}));
29
30	import { useOpenInPreferredEditor } from "./editorPreferences";
31
32	const primary = EnvironmentId.make("primary");
33	const secondary = EnvironmentId.make("secondary");
34
35	beforeEach(() => {
36	state.allowed.clear();
37	state.run.mockReset().mockResolvedValue(AsyncResult.success(undefined));
38	state.getPreference.mockReset().mockReturnValue(null);
39	state.setPreference.mockReset();
40	});
41
42	it("does not use another environment's grant or change preferences when denied", async () => {
43	state.allowed.add(primary);
44	const open = useOpenInPreferredEditor(secondary, ["vscode"]);
45	const result = await open("/work/readme.md");
46	assert(result._tag === "Failure");
47	const error = Cause.squash(result.cause);
48	expect(error).toBeInstanceOf(EnvironmentAuthorizationError);
49	expect(error).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });
50	expect(state.run).not.toHaveBeenCalled();
51	expect(state.getPreference).not.toHaveBeenCalled();
52	expect(state.setPreference).not.toHaveBeenCalled();
53	});
54
55	it("checks revocation and regrant when a retained editor callback is invoked", async () => {
56	state.allowed.add(secondary);
57	const open = useOpenInPreferredEditor(secondary, ["vscode"]);
58	state.allowed.delete(secondary);
59	expect((await open("/work/readme.md:5"))._tag).toBe("Failure");
60	expect(state.run).not.toHaveBeenCalled();
61
62	state.allowed.add(secondary);
63	expect(await open("/work/readme.md:5")).toMatchObject({ _tag: "Success", value: "vscode" });
64	expect(state.run).toHaveBeenCalledExactlyOnceWith({
65	environmentId: secondary,
66	input: { cwd: "/work/readme.md:5", editor: "vscode" },
67	});
68	expect(state.setPreference).toHaveBeenCalledTimes(1);
69	});
70
71	it("keeps the stored available editor for an authorized launch", async () => {
72	state.allowed.add(secondary);
73	state.getPreference.mockReturnValue("cursor");
74	const open = useOpenInPreferredEditor(secondary, ["vscode", "cursor"]);
75	expect(await open("/work")).toMatchObject({ _tag: "Success", value: "cursor" });
76	expect(state.run).toHaveBeenCalledExactlyOnceWith({
77	environmentId: secondary,
78	input: { cwd: "/work", editor: "cursor" },
79	});
80	expect(state.setPreference).not.toHaveBeenCalled();
81	});
82
83	it("returns the existing failures for a missing environment or editor", async () => {
84	state.allowed.add(secondary);
85	expect((await useOpenInPreferredEditor(null, ["vscode"])("/work"))._tag).toBe("Failure");
86	expect((await useOpenInPreferredEditor(secondary, [])("/work"))._tag).toBe("Failure");
87	expect(state.run).not.toHaveBeenCalled();
88	});

apps/web/src/editorPreferences.ts+20-4

 @@ -1,4 +1,10 @@
-import { EDITORS, EditorId, EnvironmentId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  EDITORS,
+  EditorId,
+  EnvironmentAuthorizationError,
+  EnvironmentId,
+} from "@t3tools/contracts";
 import {
   mapAtomCommandResult,
   type AtomCommandFailure,
 @@ -11,6 +17,7 @@ import { getLocalStorageItem, setLocalStorageItem, useLocalStorage } from "./hoo
 import { useCallback, useMemo } from "react";
 import { shellEnvironment } from "./state/shell";
 import { useAtomCommand } from "./state/use-atom-command";
+import { readEnvironmentScope } from "./state/session";
 const LAST_EDITOR_KEY = "t3code:last-editor";
 @@ -49,9 +56,7 @@ export function usePreferredEditor(availableEditors: ReadonlyArray<EditorId>) {
   return [effectiveEditor, setLastEditor] as const;
 }
-export function resolveAndPersistPreferredEditor(
+function resolveAndPersistPreferredEditor(availableEditors: readonly EditorId[]): EditorId | null {
-  availableEditors: readonly EditorId[],
-): EditorId | null {
   const availableEditorIds = new Set(availableEditors);
   const stored = getLocalStorageItem(LAST_EDITOR_KEY, EditorId);
   if (stored && availableEditorIds.has(stored)) return stored;
 @@ -78,6 +83,7 @@ export function useOpenInPreferredEditor(
         | OpenInEditorError
         | PreferredEditorEnvironmentRequiredError
         | PreferredEditorUnavailableError
+        | EnvironmentAuthorizationError
       >
     > => {
       if (environmentId === null) {
 @@ -89,6 +95,16 @@ export function useOpenInPreferredEditor(
           ),
         );
       }
+      if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) {
+        return AsyncResult.failure(
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthOrchestrationOperateScope,
+              message: "This connection cannot open an editor on this environment.",
+            }),
+          ),
+        );
+      }
       const editor = resolveAndPersistPreferredEditor(availableEditors);
       if (!editor) {
         return AsyncResult.failure(

apps/web/src/hooks/useSettings.sync.test.tsx created+201

...	@@ -0,0 +1,201 @@
1	import { RegistryContext } from "@effect/atom-react";
2	import {
3	AuthSettingsWriteScope,
4	DEFAULT_SERVER_SETTINGS,
5	EnvironmentId,
6	type AuthEnvironmentScope,
7	type AuthSessionState,
8	type ServerSettingsPatch,
9	} from "@t3tools/contracts";
10	import * as Cause from "effect/Cause";
11	import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
12	import { act } from "react";
13	import { create, type ReactTestRenderer } from "react-test-renderer";
14	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
15
16	type SessionResult = AsyncResult.AsyncResult<AuthSessionState, Error>;
17	const state = vi.hoisted(() => ({
18	registry: null as AtomRegistry.AtomRegistry \| null,
19	sessions: new Map<EnvironmentId, Atom.Writable<SessionResult>>(),
20	environments: [] as Array<{
21	environmentId: EnvironmentId;
22	label: string;
23	connection: { phase: "connected" \| "disconnected" };
24	serverConfig: {
25	environment: { capabilities: { threadAutoSettlement: boolean } };
26	settings: typeof DEFAULT_SERVER_SETTINGS;
27	};
28	}>,
29	persist: vi.fn(),
30	toast: vi.fn(),
31	}));
32
33	vi.mock("~/connection/runtime", () => ({ connectionAtomRuntime: undefined }));
34	vi.mock("@t3tools/client-runtime/state/session", () => ({
35	createEnvironmentSessionAtoms: () => ({
36	sessionStateAtom: (id: EnvironmentId) => state.sessions.get(id)!,
37	}),
38	}));
39	vi.mock("~/rpc/atomRegistry", () => ({
40	get appAtomRegistry() {
41	return state.registry;
42	},
43	}));
44	vi.mock("~/state/environments", () => ({
45	useEnvironments: () => ({ environments: state.environments }),
46	usePrimaryEnvironment: () =>
47	state.environments.find((environment) => environment.environmentId === primaryId) ?? null,
48	}));
49	vi.mock("~/state/server", () => ({
50	serverEnvironment: { updateSettings: Symbol("updateSettings") },
51	primaryServerSettingsAtom: undefined,
52	}));
53	vi.mock("~/state/use-atom-command", () => ({ useAtomCommand: () => state.persist }));
54	vi.mock("~/components/ui/toast", () => ({ toastManager: { add: state.toast } }));
55	vi.mock("~/themePalette", () => ({}));
56	vi.mock("./useTheme", () => ({}));
57
58	import { useUpdatePrimarySettings } from "./useSettings";
59
60	const primaryId = EnvironmentId.make("primary");
61	const remoteId = EnvironmentId.make("remote");
62	const patch = { sidebarAutoSettleOnMerge: false } satisfies ServerSettingsPatch;
63	const session = (scopes: ReadonlyArray<AuthEnvironmentScope>): AuthSessionState => ({
64	authenticated: true,
65	scopes,
66	auth: {
67	policy: "remote-reachable",
68	bootstrapMethods: ["one-time-token"],
69	sessionMethods: ["bearer-access-token"],
70	sessionCookieName: "t3_session",
71	},
72	});
73	let renderer: ReactTestRenderer \| undefined;
74
75	function SettingsEditor() {
76	const updateSettings = useUpdatePrimarySettings();
77	return <button onClick={() => updateSettings(patch)}>Save shared setting</button>;
78	}
79
80	function saveSharedSettings() {
81	renderer!.root.findByType("button").props.onClick();
82	}
83
84	async function mountEditor() {
85	await act(() => {
86	renderer = create(
87	<RegistryContext.Provider value={state.registry!}>
88	<SettingsEditor />
89	</RegistryContext.Provider>,
90	);
91	});
92	}
93
94	beforeEach(() => {
95	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
96	state.registry = AtomRegistry.make();
97	state.sessions.clear();
98	state.sessions.set(
99	primaryId,
100	Atom.make<SessionResult>(AsyncResult.success(session([AuthSettingsWriteScope]))),
101	);
102	state.sessions.set(remoteId, Atom.make<SessionResult>(AsyncResult.initial()));
103	state.environments = [primaryId, remoteId].map((environmentId) => ({
104	environmentId,
105	label: environmentId,
106	connection: { phase: "connected" },
107	serverConfig: {
108	environment: { capabilities: { threadAutoSettlement: true } },
109	settings: DEFAULT_SERVER_SETTINGS,
110	},
111	}));
112	state.persist.mockReset();
113	state.persist.mockResolvedValue(AsyncResult.success(DEFAULT_SERVER_SETTINGS));
114	state.toast.mockReset();
115	});
116
117	afterEach(async () => {
118	await act(() => renderer?.unmount());
119	renderer = undefined;
120	state.registry?.dispose();
121	vi.unstubAllGlobals();
122	});
123
124	describe("shared settings writes", () => {
125	it("dispatches to the primary and connected remote before the remote grant finishes loading", async () => {
126	await mountEditor();
127	saveSharedSettings();
128
129	expect(state.persist.mock.calls).toEqual([
130	[{ environmentId: primaryId, input: { patch } }],
131	[{ environmentId: remoteId, input: { patch } }],
132	]);
133	expect(state.registry!.get(state.sessions.get(remoteId)!)).toMatchObject({ _tag: "Initial" });
134	});
135
136	it.each([
137	["denied", () => AsyncResult.success(session([]))],
138	["denied while refreshing", () => AsyncResult.waiting(AsyncResult.success(session([])))],
139	[
140	"failed",
141	() => AsyncResult.failure<AuthSessionState, Error>(Cause.fail(new Error("session rejected"))),
142	],
143	] as const)("skips a remote whose grant is %s", async (_label, result) => {
144	state.registry!.set(state.sessions.get(remoteId)!, result());
145	await mountEditor();
146	saveSharedSettings();
147
148	expect(state.persist).toHaveBeenCalledExactlyOnceWith({
149	environmentId: primaryId,
150	input: { patch },
151	});
152	});
153
154	it.each(["disconnected", "unsupported"] as const)(
155	"skips a %s remote even with a cold grant",
156	async (condition) => {
157	const remote = state.environments[1]!;
158	if (condition === "disconnected") remote.connection.phase = "disconnected";
159	else remote.serverConfig.environment.capabilities.threadAutoSettlement = false;
160	await mountEditor();
161	saveSharedSettings();
162
163	expect(state.persist).toHaveBeenCalledExactlyOnceWith({
164	environmentId: primaryId,
165	input: { patch },
166	});
167	},
168	);
169
170	it.each(["primary", "hosted"] as const)(
171	"rechecks a cold remote grant that resolves to denied after the %s handler renders",
172	async (mode) => {
173	if (mode === "hosted") {
174	state.environments = state.environments.filter(
175	(environment) => environment.environmentId !== primaryId,
176	);
177	}
178	await mountEditor();
179	const previousUpdate = renderer!.root.findByType("button").props.onClick as () => void;
180	await act(() => {
181	state.registry!.set(state.sessions.get(remoteId)!, AsyncResult.success(session([])));
182	});
183	previousUpdate();
184
185	if (mode === "primary") {
186	expect(state.persist).toHaveBeenCalledExactlyOnceWith({
187	environmentId: primaryId,
188	input: { patch },
189	});
190	expect(state.toast).not.toHaveBeenCalled();
191	} else {
192	expect(state.persist).not.toHaveBeenCalled();
193	expect(state.toast).toHaveBeenCalledExactlyOnceWith({
194	type: "warning",
195	title: "Setting not saved",
196	description: "This connection does not have permission to change these settings.",
197	});
198	}
199	},
200	);
201	});

apps/web/src/hooks/useSettings.ts+65-6

 @@ -13,6 +13,8 @@ import { useCallback, useMemo, useSyncExternalStore } from "react";
 import { useAtomValue } from "@effect/atom-react";
 import {
   DEFAULT_SERVER_SETTINGS,
+  AuthSettingsWriteScope,
+  requiredScopesForServerSettingsPatch,
   type EnvironmentId,
   type ProviderInstanceMutation,
   ServerSettings,
 @@ -40,12 +42,16 @@ import {
   themeAllowsSidebarArtwork,
 } from "~/themePalette";
 import * as Struct from "effect/Struct";
+import * as Option from "effect/Option";
+import { AsyncResult, Atom } from "effect/reactivity";
 import { toastManager } from "~/components/ui/toast";
 import { isHostedStaticApp } from "~/hostedPairing";
 import { primaryServerSettingsAtom, serverEnvironment } from "~/state/server";
 import { useEnvironments, usePrimaryEnvironment } from "~/state/environments";
 import { useAtomCommand } from "~/state/use-atom-command";
 import { useTheme } from "./useTheme";
+import { environmentSession, readEnvironmentScope, useEnvironmentScope } from "~/state/session";
+import { appAtomRegistry } from "~/rpc/atomRegistry";
 const CLIENT_SETTINGS_PERSISTENCE_ERROR_SCOPE = "[CLIENT_SETTINGS]";
 @@ -425,6 +431,31 @@ export function usePrimarySettingsAvailable(): boolean {
   return primaryEnvironment !== null || !isHostedStaticApp();
 }
+/** Connected sync targets, excluding grants already known to forbid settings writes. */
+function useSharedSettingsSyncTargetIds(includePending = false): ReadonlyArray<EnvironmentId> {
+  const { environments } = useEnvironments();
+  const writableTargetsAtom = useMemo(
+    () =>
+      Atom.make((get) =>
+        environments.filter(supportsSharedSettingsSync).flatMap((environment) => {
+          const result = get(environmentSession.sessionStateAtom(environment.environmentId));
+          // A cold grant must not drop a shared edit. The server authorizes the
+          // write; mismatch suggestions still wait for a confirmed grant.
+          if (includePending && result._tag === "Initial") {
+            return [environment.environmentId];
+          }
+          const session =
+            result._tag === "Failure" ? null : Option.getOrNull(AsyncResult.value(result));
+          return session?.authenticated && session.scopes?.includes(AuthSettingsWriteScope)
+            ? [environment.environmentId]
+            : [];
+        }),
+      ),
+    [environments, includePending],
+  );
+  return useAtomValue(writableTargetsAtom);
+}
 /**
  * Returns an updater that routes each key to the correct backing store.
  *
 @@ -435,16 +466,31 @@ export function usePrimarySettingsAvailable(): boolean {
  * through client persistence.
  */
 function useUpdateSettingsTarget(environmentId: EnvironmentId | null) {
+  // Mount this session even on pages without a visible permission-gated control.
+  useEnvironmentScope(environmentId, AuthSettingsWriteScope);
   const persistServerSettings = useAtomCommand(
     serverEnvironment.updateSettings,
     "server settings update",
   );
   const { environments } = useEnvironments();
+  const sharedSettingsSyncTargetIds = useSharedSettingsSyncTargetIds(true);
   const updateSettings = useCallback(
     (patch: UnifiedSettingsPatch) => {
       const { serverPatch, clientPatch } = splitPatch(patch);
-      if (Object.keys(serverPatch).length > 0) {
+      const canWriteServerPatch =
+        environmentId === null ||
+        requiredScopesForServerSettingsPatch(serverPatch).every((scope) =>
+          readEnvironmentScope(environmentId, scope),
+        );
+      if (Object.keys(serverPatch).length > 0 && !canWriteServerPatch) {
+        toastManager.add({
+          type: "warning",
+          title: "Setting not saved",
+          description: "This connection does not have permission to change these settings.",
+        });
+      }
+      if (Object.keys(serverPatch).length > 0 && canWriteServerPatch) {
         const { sharedPatch, localPatch } = splitSharedServerPatch(serverPatch);
         // Dropping the write silently leaves the control looking saved.
         const warnUnsaved = (description = PRIMARY_SETTINGS_UNAVAILABLE_MESSAGE) =>
 @@ -467,13 +513,12 @@ function useUpdateSettingsTarget(environmentId: EnvironmentId | null) {
           const sourceSettings = environments.find(
             (target) => target.environmentId === environmentId,
           )?.serverConfig?.settings;
-          const targets = new Set(
+          const targets = new Set(sharedSettingsSyncTargetIds);
-            environments.filter(supportsSharedSettingsSync).map((target) => target.environmentId),
-          );
           if (environmentId) {
             targets.add(environmentId);
           }
           let wroteToTarget = false;
+          let permissionDenied = false;
           for (const targetId of targets) {
             const target = environments.find((candidate) => candidate.environmentId === targetId);
             const targetPatch = filterSharedServerPatch(
 @@ -484,6 +529,16 @@ function useUpdateSettingsTarget(environmentId: EnvironmentId | null) {
               targetId === environmentId,
             );
             if (Object.keys(targetPatch).length === 0) continue;
+            const session = appAtomRegistry.get(environmentSession.sessionStateAtom(targetId));
+            if (
+              session._tag !== "Initial" &&
+              !requiredScopesForServerSettingsPatch(sharedPatch).every((scope) =>
+                readEnvironmentScope(targetId, scope),
+              )
+            ) {
+              permissionDenied = true;
+              continue;
+            }
             wroteToTarget = true;
             void persistServerSettings({
               environmentId: targetId,
 @@ -492,7 +547,11 @@ function useUpdateSettingsTarget(environmentId: EnvironmentId | null) {
           }
           if (!wroteToTarget) {
             warnUnsaved(
-              targets.size > 0 ? "Update older servers to save this setting." : undefined,
+              permissionDenied
+                ? "This connection does not have permission to change these settings."
+                : targets.size > 0
+                  ? "Update older servers to save this setting."
+                  : undefined,
             );
           }
         }
 @@ -501,7 +560,7 @@ function useUpdateSettingsTarget(environmentId: EnvironmentId | null) {
         void persistClientSettingsPatch(clientPatch);
       }
     },
-    [environmentId, environments, persistServerSettings],
+    [environmentId, environments, persistServerSettings, sharedSettingsSyncTargetIds],
   );
   return updateSettings;

apps/web/src/keybindings.test.ts+97

...	@@ -25,6 +25,7 @@ import {	...	@@ -25,6 +25,7 @@ import {
25	isTerminalSplitShortcut,	25	isTerminalSplitShortcut,
26	isTerminalSplitVerticalShortcut,	26	isTerminalSplitVerticalShortcut,
27	isTerminalToggleShortcut,	27	isTerminalToggleShortcut,
		28	resolveChatShortcutCommand,
28	resolveShortcutCommand,	29	resolveShortcutCommand,
29	shouldShowThreadJumpHintsForModifiers,	30	shouldShowThreadJumpHintsForModifiers,
30	shortcutLabelForCommand,	31	shortcutLabelForCommand,
...	@@ -886,6 +887,102 @@ describe("cross-command precedence", () => {	...	@@ -886,6 +887,102 @@ describe("cross-command precedence", () => {
886	});	887	});
887	});	888	});
888		889
		890	describe("resolveChatShortcutCommand", () => {
		891	it("runs the active environment's script shortcut instead of the primary environment's", () => {
		892	const primary = compile([{ shortcut: modShortcut("r"), command: "script.setup.run" }]);
		893	const active = compile([{ shortcut: modShortcut("t"), command: "script.setup.run" }]);
		894
		895	assert.strictEqual(
		896	resolveChatShortcutCommand(event({ key: "t", ctrlKey: true }), primary, active, {
		897	platform: "Linux",
		898	}),
		899	"script.setup.run",
		900	);
		901	assert.isNull(
		902	resolveChatShortcutCommand(event({ key: "r", ctrlKey: true }), primary, active, {
		903	platform: "Linux",
		904	}),
		905	);
		906	});
		907
		908	it("resolves shared chords to the active environment's script ID", () => {
		909	const primary = compile([{ shortcut: modShortcut("r"), command: "script.setup.run" }]);
		910	const active = compile([{ shortcut: modShortcut("r"), command: "script.deploy.run" }]);
		911
		912	assert.strictEqual(
		913	resolveChatShortcutCommand(event({ key: "r", metaKey: true }), primary, active, {
		914	platform: "MacIntel",
		915	}),
		916	"script.deploy.run",
		917	);
		918	});
		919
		920	it("does not run primary scripts before the active environment's bindings arrive", () => {
		921	const primary = compile([{ shortcut: modShortcut("r"), command: "script.setup.run" }]);
		922
		923	assert.isNull(
		924	resolveChatShortcutCommand(event({ key: "r", ctrlKey: true }), primary, [], {
		925	platform: "Linux",
		926	}),
		927	);
		928	});
		929
		930	it("keeps primary app commands ahead of conflicting active script shortcuts", () => {
		931	const primary = compile([{ shortcut: modShortcut("k"), command: "commandPalette.toggle" }]);
		932	const active = compile([{ shortcut: modShortcut("k"), command: "script.setup.run" }]);
		933
		934	assert.strictEqual(
		935	resolveChatShortcutCommand(event({ key: "k", ctrlKey: true }), primary, active, {
		936	platform: "Linux",
		937	}),
		938	"commandPalette.toggle",
		939	);
		940	});
		941
		942	it("keeps app shortcuts on the primary environment when the active environment remaps them", () => {
		943	const primary = compile([{ shortcut: modShortcut("j"), command: "terminal.toggle" }]);
		944	const active = compile([{ shortcut: modShortcut("t"), command: "terminal.toggle" }]);
		945
		946	assert.strictEqual(
		947	resolveChatShortcutCommand(event({ key: "j", ctrlKey: true }), primary, active, {
		948	platform: "Linux",
		949	}),
		950	"terminal.toggle",
		951	);
		952	assert.isNull(
		953	resolveChatShortcutCommand(event({ key: "t", ctrlKey: true }), primary, active, {
		954	platform: "Linux",
		955	}),
		956	);
		957	});
		958
		959	it.each([false, true])(
		960	"preserves active binding precedence with terminalFocus=%s",
		961	(terminalFocus) => {
		962	const primary = compile([{ shortcut: modShortcut("r"), command: "script.setup.run" }]);
		963	const active = compile([
		964	{ shortcut: modShortcut("r"), command: "script.deploy.run" },
		965	{
		966	shortcut: modShortcut("r"),
		967	command: "terminal.new",
		968	whenAst: whenIdentifier("terminalFocus"),
		969	},
		970	]);
		971	const options = { platform: "Linux", context: { terminalFocus } };
		972	const shortcut = event({ key: "r", ctrlKey: true });
		973
		974	assert.strictEqual(
		975	resolveChatShortcutCommand(shortcut, primary, active, options),
		976	terminalFocus ? null : "script.deploy.run",
		977	);
		978	assert.strictEqual(
		979	resolveChatShortcutCommand(shortcut, active, active, options),
		980	resolveShortcutCommand(shortcut, active, options),
		981	);
		982	},
		983	);
		984	});
		985
889	describe("resolveShortcutCommand", () => {	986	describe("resolveShortcutCommand", () => {
890	it("resolves a custom stop-thread shortcut", () => {	987	it("resolves a custom stop-thread shortcut", () => {
891	const keybindings = compile([{ shortcut: modShortcut("escape"), command: "thread.stop" }]);	988	const keybindings = compile([{ shortcut: modShortcut("escape"), command: "thread.stop" }]);

apps/web/src/keybindings.ts+19

...	@@ -18,6 +18,7 @@ import {	...	@@ -18,6 +18,7 @@ import {
18	type ShortcutModifierStateLike,	18	type ShortcutModifierStateLike,
19	} from "@t3tools/shared/keybindings";	19	} from "@t3tools/shared/keybindings";
20	import { isElectron } from "./env";	20	import { isElectron } from "./env";
		21	import { projectScriptIdFromCommand } from "./projectScripts";
21		22
22	export type { ShortcutEventLike, ShortcutModifierStateLike } from "@t3tools/shared/keybindings";	23	export type { ShortcutEventLike, ShortcutModifierStateLike } from "@t3tools/shared/keybindings";
23	export { shortcutKeyFromEvent } from "@t3tools/shared/keybindings";	24	export { shortcutKeyFromEvent } from "@t3tools/shared/keybindings";
...	@@ -169,6 +170,24 @@ export function resolveShortcutCommand(	...	@@ -169,6 +170,24 @@ export function resolveShortcutCommand(
169	return null;	170	return null;
170	}	171	}
171		172
		173	/** App shortcuts use the primary environment; script shortcuts belong to the active project. */
		174	export function resolveChatShortcutCommand(
		175	event: ShortcutEventLike,
		176	primaryKeybindings: ResolvedKeybindingsConfig,
		177	activeKeybindings: ResolvedKeybindingsConfig,
		178	options?: ShortcutMatchOptions,
		179	): KeybindingCommand \| null {
		180	const primaryCommand = resolveShortcutCommand(event, primaryKeybindings, options);
		181	if (primaryCommand !== null && projectScriptIdFromCommand(primaryCommand) === null) {
		182	return primaryCommand;
		183	}
		184
		185	const activeCommand = resolveShortcutCommand(event, activeKeybindings, options);
		186	return activeCommand !== null && projectScriptIdFromCommand(activeCommand) !== null
		187	? activeCommand
		188	: null;
		189	}
		190
172	export function formatShortcutKeyLabel(key: string): string {	191	export function formatShortcutKeyLabel(key: string): string {
173	if (key === " ") return "Space";	192	if (key === " ") return "Space";
174	if (key.length === 1) return key.toUpperCase();	193	if (key.length === 1) return key.toUpperCase();

apps/web/src/lib/attachmentUploadQueue.test.ts+111

...	@@ -18,6 +18,7 @@ const mocks = vi.hoisted(() => ({	...	@@ -18,6 +18,7 @@ const mocks = vi.hoisted(() => ({
18	executeAtomQuery: vi.fn(),	18	executeAtomQuery: vi.fn(),
19	removeUpload: Symbol("remove-upload"),	19	removeUpload: Symbol("remove-upload"),
20	runAtomCommand: vi.fn(),	20	runAtomCommand: vi.fn(),
		21	readEnvironmentScope: vi.fn(),
21	readPreparedConnection: vi.fn(),	22	readPreparedConnection: vi.fn(),
22	}));	23	}));
23		24
...	@@ -48,6 +49,7 @@ vi.mock("../state/attachments", () => ({	...	@@ -48,6 +49,7 @@ vi.mock("../state/attachments", () => ({
48	}));	49	}));
49		50
50	vi.mock("../state/session", () => ({	51	vi.mock("../state/session", () => ({
		52	readEnvironmentScope: mocks.readEnvironmentScope,
51	readPreparedConnection: mocks.readPreparedConnection,	53	readPreparedConnection: mocks.readPreparedConnection,
52	}));	54	}));
53		55
...	@@ -172,6 +174,7 @@ describe("attachmentUploadQueue", () => {	...	@@ -172,6 +174,7 @@ describe("attachmentUploadQueue", () => {
172	mocks.executeAtomQuery.mockReset();	174	mocks.executeAtomQuery.mockReset();
173	mocks.executeAtomQuery.mockResolvedValue({ _tag: "Success", value: {} });	175	mocks.executeAtomQuery.mockResolvedValue({ _tag: "Success", value: {} });
174	mocks.runAtomCommand.mockReset();	176	mocks.runAtomCommand.mockReset();
		177	mocks.readEnvironmentScope.mockReset().mockReturnValue(true);
175	mocks.readPreparedConnection.mockReset();	178	mocks.readPreparedConnection.mockReset();
176	mocks.readPreparedConnection.mockReturnValue({ httpBaseUrl: "https://environment.test/" });	179	mocks.readPreparedConnection.mockReturnValue({ httpBaseUrl: "https://environment.test/" });
177	mocks.runAtomCommand.mockImplementation(	180	mocks.runAtomCommand.mockImplementation(
...	@@ -266,6 +269,114 @@ describe("attachmentUploadQueue", () => {	...	@@ -266,6 +269,114 @@ describe("attachmentUploadQueue", () => {
266	expect(readAttachmentUpload(image.id)).toBeUndefined();	269	expect(readAttachmentUpload(image.id)).toBeUndefined();
267	});	270	});
268		271
		272	it("keeps an attachment local until its own environment grants write access", async () => {
		273	const image = makeImage("permission-gain");
		274	mocks.readEnvironmentScope.mockImplementation(
		275	(environmentId) => environmentId === firstEnvironment,
		276	);
		277
		278	startAttachmentUpload({ environmentId: secondEnvironment, image });
		279	expect(mocks.runAtomCommand).not.toHaveBeenCalled();
		280	expect(TestXmlHttpRequest.requests).toHaveLength(0);
		281	expect(readAttachmentUpload(image.id)).toBeUndefined();
		282	expect(image.file).not.toBeNull();
		283
		284	mocks.readEnvironmentScope.mockReturnValue(true);
		285	startAttachmentUpload({ environmentId: secondEnvironment, image });
		286	await Promise.resolve();
		287	const settled = awaitAttachmentUploads([image.id]);
		288	TestXmlHttpRequest.requests[0]!.complete();
		289	await settled;
		290
		291	expect(readAttachmentUpload(image.id)).toMatchObject({
		292	status: "ready",
		293	environmentId: secondEnvironment,
		294	});
		295	});
		296
		297	it("does not transfer bytes or retry when access is revoked while minting an upload", async () => {
		298	const image = makeImage("revoke-before-bytes");
		299	let finishMint: (() => void) \| undefined;
		300	mocks.runAtomCommand.mockImplementationOnce(
		301	() =>
		302	new Promise((resolve) => {
		303	finishMint = () =>
		304	resolve({
		305	_tag: "Success",
		306	value: {
		307	attachmentId: "pending-revoked",
		308	relativeUrl: "/api/attachments/upload/pending-revoked",
		309	expiresAt: 1,
		310	},
		311	});
		312	}),
		313	);
		314	startAttachmentUpload({ environmentId: firstEnvironment, image });
		315	const settled = awaitAttachmentUploads([image.id]);
		316	mocks.readEnvironmentScope.mockReturnValue(false);
		317	finishMint!();
		318	await settled;
		319
		320	expect(TestXmlHttpRequest.requests).toHaveLength(0);
		321	expect(readAttachmentUpload(image.id)).toMatchObject({
		322	status: "failed",
		323	reason: "This connection cannot upload attachments.",
		324	attachmentId: "pending-revoked",
		325	});
		326	retryAttachmentUpload({ environmentId: firstEnvironment, image });
		327	expect(readAttachmentUpload(image.id)?.status).toBe("failed");
		328	releaseAttachmentUpload(image.id);
		329	expect(readAttachmentUpload(image.id)).toBeUndefined();
		330	expect(mocks.runAtomCommand).toHaveBeenCalledTimes(1);
		331	});
		332
		333	it("does not mint queued uploads after access is revoked", async () => {
		334	const images = Array.from({ length: 4 }, (_, index) => makeImage(`queued-${index}`));
		335	for (const image of images) {
		336	startAttachmentUpload({ environmentId: firstEnvironment, image });
		337	}
		338	await Promise.resolve();
		339	expect(TestXmlHttpRequest.requests).toHaveLength(3);
		340	const settled = awaitAttachmentUploads(images.map((image) => image.id));
		341	mocks.readEnvironmentScope.mockReturnValue(false);
		342	for (const request of TestXmlHttpRequest.requests) {
		343	request.complete();
		344	}
		345	await settled;
		346
		347	expect(mocks.runAtomCommand).toHaveBeenCalledTimes(3);
		348	expect(TestXmlHttpRequest.requests).toHaveLength(3);
		349	expect(readAttachmentUpload(images[3]!.id)).toMatchObject({
		350	status: "failed",
		351	reason: "This connection cannot upload attachments.",
		352	});
		353	});
		354
		355	it("does not delete a persisted upload using another environment's grant", () => {
		356	mocks.readEnvironmentScope.mockImplementation(
		357	(environmentId) => environmentId === firstEnvironment,
		358	);
		359	releasePersistedAttachmentUpload({
		360	id: "local-file",
		361	environmentId: secondEnvironment,
		362	attachmentId: "persisted-file",
		363	});
		364	expect(mocks.runAtomCommand).not.toHaveBeenCalled();
		365
		366	mocks.readEnvironmentScope.mockReturnValue(true);
		367	releasePersistedAttachmentUpload({
		368	id: "local-file",
		369	environmentId: secondEnvironment,
		370	attachmentId: "persisted-file",
		371	});
		372	expect(mocks.runAtomCommand).toHaveBeenCalledWith(
		373	expect.anything(),
		374	mocks.removeUpload,
		375	{ environmentId: secondEnvironment, input: { attachmentId: "persisted-file" } },
		376	expect.anything(),
		377	);
		378	});
		379
269	it("uploads images immediately and sends attachment references", async () => {	380	it("uploads images immediately and sends attachment references", async () => {
270	const image = {	381	const image = {
271	...makeImage("image-1"),	382	...makeImage("image-1"),

apps/web/src/lib/attachmentUploadQueue.ts+33-3

 @@ -1,4 +1,5 @@
 import {
+  AuthOrchestrationOperateScope,
   PROVIDER_SEND_TURN_SUPPORTED_IMAGE_MIME_TYPES,
   type ChatAttachment,
   type EnvironmentId,
 @@ -26,7 +27,7 @@ import { appAtomRegistry } from "../rpc/atomRegistry";
 import { environmentCatalog } from "../connection/catalog";
 import { assetEnvironment } from "../state/assets";
 import { attachmentEnvironment } from "../state/attachments";
-import { readPreparedConnection } from "../state/session";
+import { readEnvironmentScope, readPreparedConnection } from "../state/session";
 import type { AttachmentUploadState, ReadyAttachmentUpload } from "./attachmentUploadState";
 const MAX_UPLOADS_PER_ENVIRONMENT = 3;
 @@ -138,6 +139,7 @@ function stampDraftFileUpload(job: UploadJob, attachmentId: string): void {
 }
 function deletePendingUpload(environmentId: EnvironmentId, attachmentId: string): void {
+  if (!readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)) return;
   deletePendingAttachmentUpload({
     registry: appAtomRegistry,
     remove: attachmentEnvironment.remove,
 @@ -179,6 +181,15 @@ function uploadBytes(input: {
 }
 async function runUpload(job: UploadJob): Promise<void> {
+  if (!readEnvironmentScope(job.environmentId, AuthOrchestrationOperateScope)) {
+    setUploadState(job.image.id, {
+      status: "failed",
+      environmentId: job.environmentId,
+      reason: "This connection cannot upload attachments.",
+      ...(job.previous ? { previous: job.previous } : {}),
+    });
+    return;
+  }
   if (job.persistedAttachmentId) {
     const verification = await verifyPersistedAttachmentUpload({
       registry: appAtomRegistry,
 @@ -260,6 +271,15 @@ async function runUpload(job: UploadJob): Promise<void> {
   }
   let lastStep = -1;
+  if (!readEnvironmentScope(job.environmentId, AuthOrchestrationOperateScope)) {
+    setUploadState(job.image.id, {
+      status: "failed",
+      environmentId: job.environmentId,
+      reason: "This connection cannot upload attachments.",
+      ...(job.previous ? { previous: job.previous } : {}),
+    });
+    return;
+  }
   const result = await runAttachmentUploadCycle({
     registry: appAtomRegistry,
     createUploadUrl: attachmentEnvironment.createUploadUrl,
 @@ -272,6 +292,12 @@ async function runUpload(job: UploadJob): Promise<void> {
       sizeBytes: file.size,
     },
     resolveUploadUrl: (relativeUrl) => {
+      if (
+        job.cancelled ||
+        !readEnvironmentScope(job.environmentId, AuthOrchestrationOperateScope)
+      ) {
+        return null;
+      }
       const connection = readPreparedConnection(job.environmentId);
       return connection ? resolveAssetUrl(connection.httpBaseUrl, relativeUrl) : null;
     },
 @@ -295,7 +321,7 @@ async function runUpload(job: UploadJob): Promise<void> {
         },
       }),
     onMinted: (attachmentId) => {
-      if (job.cancelled) {
+      if (job.cancelled && readEnvironmentScope(job.environmentId, AuthOrchestrationOperateScope)) {
         return "cancel";
       }
       job.attachmentId = attachmentId;
 @@ -328,7 +354,9 @@ async function runUpload(job: UploadJob): Promise<void> {
       result.step === "mint"
         ? "Upload could not start"
         : result.step === "resolve-url"
-          ? "Not connected"
+          ? readEnvironmentScope(job.environmentId, AuthOrchestrationOperateScope)
+            ? "Not connected"
+            : "This connection cannot upload attachments."
           : result.error instanceof Error
             ? result.error.message
             : "Upload failed",
 @@ -388,6 +416,7 @@ export function startAttachmentUpload(input: {
   /** Draft that owns the file; lets a background completion persist its ids. */
   readonly draftTarget?: ComposerThreadTarget;
 }): void {
+  if (!readEnvironmentScope(input.environmentId, AuthOrchestrationOperateScope)) return;
   const existingJob = jobsByImageId.get(input.image.id);
   if (existingJob?.environmentId === input.environmentId) {
     return;
 @@ -545,6 +574,7 @@ export function retryAttachmentUpload(input: {
   readonly image: ComposerImageAttachment | ComposerFileAttachment;
   readonly draftTarget?: ComposerThreadTarget;
 }): void {
+  if (!readEnvironmentScope(input.environmentId, AuthOrchestrationOperateScope)) return;
   const previous = readAttachmentUpload(input.image.id);
   cancelAttachmentUpload(input.image.id);
   // A failed state's `attachmentId` is always one this queue minted, so this

apps/web/src/lib/resourceTelemetryState.ts+5

apps/web/src/routes/__root.tsx+9-43

 @@ -1,6 +1,5 @@
 import { type ServerLifecycleWelcomePayload } from "@t3tools/contracts";
 import { scopedProjectKey, scopeProjectRef } from "@t3tools/client-runtime/environment";
-import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import {
   Outlet,
   Link,
 @@ -20,6 +19,7 @@ import { AppSidebarLayout } from "../components/AppSidebarLayout";
 import { CommandPalette } from "../components/CommandPalette";
 import { CustomSnoozeDialogHost } from "../components/CustomSnoozeDialog";
 import { ConfirmDialogHost } from "../components/ConfirmDialogHost";
+import { KeybindingsConfigWarning } from "../components/KeybindingsConfigWarning";
 import { FirstRunGate } from "../components/onboarding/FirstRunGate";
 import { ConnectOnboardingDialog } from "../components/cloud/ConnectOnboardingDialog";
 import { RelayClientInstallDialog } from "../components/cloud/RelayClientInstallDialog";
 @@ -49,7 +49,6 @@ import {
   ToastProvider,
   toastManager,
 } from "../components/ui/toast";
-import { resolveAndPersistPreferredEditor } from "../editorPreferences";
 import { isElectron } from "../env";
 import { cn } from "../lib/utils";
 import { applyAppearanceFontVariables } from "~/appearanceFonts";
 @@ -66,9 +65,7 @@ import { configureClientTracing } from "../observability/clientTracing";
 import { resolveInitialServerAuthGateState } from "../environments/primary";
 import { hasHostedPairingRequest, isHostedStaticApp } from "../hostedPairing";
 import { isLocalEnvironmentDisabled } from "../localEnvironment";
-import { shellEnvironment } from "../state/shell";
 import { useAtomValue } from "@effect/atom-react";
-import { useAtomCommand } from "../state/use-atom-command";
 import { useEnvironments, usePrimaryEnvironment } from "../state/environments";
 import {
   primaryServerConfigAtom,
 @@ -496,9 +493,6 @@ function EventRouter({
   const pathname = useLocation({ select: (loc) => loc.pathname });
   const projectGroupingSettings = useClientSettings(selectProjectGroupingSettings);
   const primaryEnvironment = usePrimaryEnvironment();
-  const openInEditor = useAtomCommand(shellEnvironment.openInEditor, {
-    reportFailure: false,
-  });
   const serverConfig = useAtomValue(primaryServerConfigAtom);
   const serverConfigEvent = useAtomValue(primaryServerConfigEventAtom);
   const serverWelcome = useAtomValue(primaryServerWelcomeAtom);
 @@ -575,42 +569,14 @@ function EventRouter({
       stackedThreadToast({
         type: "warning",
         title: "Invalid keybindings configuration",
-        description: decision.message,
+        description: (
-        actionVariant: "outline",
+          <KeybindingsConfigWarning
-        actionProps: {
+            message={decision.message}
-          children: "Open keybindings.json",
+            environmentId={primaryEnvironment?.environmentId ?? null}
-          onClick: () => {
+            configPath={serverConfig?.keybindingsConfigPath ?? null}
-            if (!serverConfig || !primaryEnvironment) {
+            availableEditors={serverConfig?.availableEditors ?? []}
-              return;
+          />
-            }
+        ),
-            const editor = resolveAndPersistPreferredEditor(serverConfig.availableEditors);
-            if (!editor) {
-              return;
-            }
-            void (async () => {
-              const result = await openInEditor({
-                environmentId: primaryEnvironment.environmentId,
-                input: {
-                  cwd: serverConfig.keybindingsConfigPath,
-                  editor,
-                },
-              });
-              if (result._tag === "Success") {
-                return;
-              }
-              const error = squashAtomCommandFailure(result);
-              toastManager.add(
-                stackedThreadToast({
-                  type: "error",
-                  title: "Unable to open keybindings file",
-                  description:
-                    error instanceof Error ? error.message : "Unknown error opening file.",
-                }),
-              );
-            })();
-          },
-        },
       }),
     );
   });

apps/web/src/state/session.ts+62-1

...	@@ -1,6 +1,7 @@	...	@@ -1,6 +1,7 @@
1	import { useAtomValue } from "@effect/atom-react";	1	import { useAtomValue } from "@effect/atom-react";
2	import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";	2	import { createEnvironmentSessionAtoms } from "@t3tools/client-runtime/state/session";
3	import type { EnvironmentId } from "@t3tools/contracts";	3	import type { AuthEnvironmentScope, AuthSessionState, EnvironmentId } from "@t3tools/contracts";
		4	import { useMemo } from "react";
4	import * as Option from "effect/Option";	5	import * as Option from "effect/Option";
5	import { AsyncResult, Atom } from "effect/reactivity";	6	import { AsyncResult, Atom } from "effect/reactivity";
6		7
...	@@ -9,6 +10,66 @@ import { appAtomRegistry } from "../rpc/atomRegistry";	...	@@ -9,6 +10,66 @@ import { appAtomRegistry } from "../rpc/atomRegistry";
9		10
10	export const environmentSession = createEnvironmentSessionAtoms(connectionAtomRuntime);	11	export const environmentSession = createEnvironmentSessionAtoms(connectionAtomRuntime);
11		12
		13	const EMPTY_SESSION_STATE_ATOM = Atom.make(AsyncResult.initial<AuthSessionState>());
		14
		15	/** Uses the selected environment's grant, including cached scopes during a refresh. */
		16	export function useEnvironmentScope(
		17	environmentId: EnvironmentId \| null,
		18	scope: AuthEnvironmentScope,
		19	): boolean {
		20	const result = useAtomValue(
		21	environmentId === null
		22	? EMPTY_SESSION_STATE_ATOM
		23	: environmentSession.sessionStateAtom(environmentId),
		24	);
		25	const session = Option.getOrNull(AsyncResult.value(result));
		26	return (
		27	result._tag !== "Failure" &&
		28	session?.authenticated === true &&
		29	session.scopes?.includes(scope) === true
		30	);
		31	}
		32
		33	/** Subscribe to the grants of every selected environment. */
		34	export function useEnvironmentsWithScope(
		35	environments: ReadonlyArray<{ readonly environmentId: EnvironmentId }>,
		36	scope: AuthEnvironmentScope,
		37	): ReadonlySet<EnvironmentId> {
		38	const permitted = useMemo(
		39	() =>
		40	Atom.make((get) => {
		41	const ids = new Set<EnvironmentId>();
		42	for (const { environmentId } of environments) {
		43	const result = get(environmentSession.sessionStateAtom(environmentId));
		44	const session = Option.getOrNull(AsyncResult.value(result));
		45	if (
		46	result._tag !== "Failure" &&
		47	session?.authenticated === true &&
		48	session.scopes?.includes(scope)
		49	) {
		50	ids.add(environmentId);
		51	}
		52	}
		53	return ids;
		54	}),
		55	[environments, scope],
		56	);
		57	return useAtomValue(permitted);
		58	}
		59
		60	export function readEnvironmentScope(
		61	environmentId: EnvironmentId,
		62	scope: AuthEnvironmentScope,
		63	): boolean {
		64	const result = appAtomRegistry.get(environmentSession.sessionStateAtom(environmentId));
		65	const session = Option.getOrNull(AsyncResult.value(result));
		66	return (
		67	result._tag !== "Failure" &&
		68	session?.authenticated === true &&
		69	session.scopes?.includes(scope) === true
		70	);
		71	}
		72
12	const EMPTY_PREPARED_CONNECTION_ATOM = Atom.make(Option.none()).pipe(	73	const EMPTY_PREPARED_CONNECTION_ATOM = Atom.make(Option.none()).pipe(
13	Atom.withLabel("web-prepared-connection:empty"),	74	Atom.withLabel("web-prepared-connection:empty"),
14	);	75	);

apps/web/src/state/use-orchestration-command.test.ts created+85

...	@@ -0,0 +1,85 @@
1	import type { AtomCommand } from "@t3tools/client-runtime/state/runtime";
2	import {
3	AuthOrchestrationOperateScope,
4	EnvironmentAuthorizationError,
5	EnvironmentId,
6	} from "@t3tools/contracts";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult } from "effect/reactivity";
9	import { assert, beforeEach, expect, it, vi } from "vite-plus/test";
10
11	const state = vi.hoisted(() => ({
12	allowed: new Set<string>(),
13	readScope: vi.fn(),
14	run: vi.fn(),
15	}));
16
17	vi.mock("react", () => ({ useCallback: (callback: unknown) => callback }));
18	vi.mock("./session", () => ({ readEnvironmentScope: state.readScope }));
19	vi.mock("./use-atom-command", () => ({ useAtomCommand: () => state.run }));
20
21	import { useOrchestrationCommand } from "./use-orchestration-command";
22
23	const first = EnvironmentId.make("primary");
24	const second = EnvironmentId.make("secondary");
25	type Target = { environmentId: EnvironmentId; input: { threadId: string } };
26	const command: AtomCommand<Target, string, Error> = { label: "thread mutation", run: state.run };
27	const target = (environmentId: EnvironmentId): Target => ({
28	environmentId,
29	input: { threadId: "thread-1" },
30	});
31
32	beforeEach(() => {
33	state.allowed.clear();
34	state.run.mockReset().mockResolvedValue(AsyncResult.success("receipt"));
35	state.readScope
36	.mockReset()
37	.mockImplementation(
38	(environmentId, scope) =>
39	scope === AuthOrchestrationOperateScope && state.allowed.has(environmentId),
40	);
41	});
42
43	it("checks the command's environment instead of borrowing the primary grant", async () => {
44	state.allowed.add(first);
45	const mutate = useOrchestrationCommand(command, { reportFailure: false });
46	const result = await mutate(target(second));
47	assert(result._tag === "Failure");
48	const error = Cause.squash(result.cause);
49	expect(error).toBeInstanceOf(EnvironmentAuthorizationError);
50	expect(error).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });
51	expect(state.run).not.toHaveBeenCalled();
52
53	expect(await mutate(target(first))).toMatchObject({ _tag: "Success", value: "receipt" });
54	expect(state.run).toHaveBeenCalledWith(target(first));
55	});
56
57	it("a retained callback follows both revocation and a new grant without remounting", async () => {
58	state.allowed.add(second);
59	const mutate = useOrchestrationCommand(command);
60	state.allowed.delete(second);
61	expect((await mutate(target(second)))._tag).toBe("Failure");
62	expect(state.run).not.toHaveBeenCalled();
63
64	state.allowed.add(second);
65	expect((await mutate(target(second)))._tag).toBe("Success");
66	expect(state.run).toHaveBeenCalledTimes(1);
67	});
68
69	it("does not dispatch a later mutation after access changes while awaiting a receipt", async () => {
70	state.allowed.add(second);
71	let finish: (() => void) \| undefined;
72	state.run.mockImplementationOnce(
73	() =>
74	new Promise((resolve) => {
75	finish = () => resolve(AsyncResult.success("first receipt"));
76	}),
77	);
78	const mutate = useOrchestrationCommand(command);
79	const pending = mutate(target(second));
80	state.allowed.delete(second);
81	finish!();
82	expect((await pending)._tag).toBe("Success");
83	expect((await mutate(target(second)))._tag).toBe("Failure");
84	expect(state.run).toHaveBeenCalledTimes(1);
85	});

apps/web/src/state/use-orchestration-command.ts created+43

...	@@ -0,0 +1,43 @@
1	import type {
2	AtomCommand,
3	AtomCommandOptions,
4	AtomCommandResult,
5	} from "@t3tools/client-runtime/state/runtime";
6	import {
7	AuthOrchestrationOperateScope,
8	EnvironmentAuthorizationError,
9	type EnvironmentId,
10	} from "@t3tools/contracts";
11	import * as Cause from "effect/Cause";
12	import { AsyncResult } from "effect/reactivity";
13	import { useCallback } from "react";
14
15	import { readEnvironmentScope } from "./session";
16	import { useAtomCommand } from "./use-atom-command";
17
18	export const ORCHESTRATION_OPERATE_DENIED_MESSAGE =
19	"This connection cannot change threads or projects.";
20
21	/** Recheck the target grant for every step of a thread or project mutation. */
22	export function useOrchestrationCommand<W extends { readonly environmentId: EnvironmentId }, A, E>(
23	command: AtomCommand<W, A, E>,
24	options?: string \| AtomCommandOptions,
25	): (value: W) => Promise<AtomCommandResult<A, E \| EnvironmentAuthorizationError>> {
26	const run = useAtomCommand(command, options);
27	return useCallback(
28	async (value: W): Promise<AtomCommandResult<A, E \| EnvironmentAuthorizationError>> => {
29	if (!readEnvironmentScope(value.environmentId, AuthOrchestrationOperateScope)) {
30	return AsyncResult.failure(
31	Cause.fail(
32	new EnvironmentAuthorizationError({
33	requiredScope: AuthOrchestrationOperateScope,
34	message: ORCHESTRATION_OPERATE_DENIED_MESSAGE,
35	}),
36	),
37	);
38	}
39	return run(value);
40	},
41	[run],
42	);
43	}

docs/internals/environment-auth.md+5

...	@@ -58,6 +58,11 @@ extra authority: [every RPC declares a required	...	@@ -58,6 +58,11 @@ extra authority: [every RPC declares a required
58	scope](../../apps/server/src/auth/RpcAuthorization.ts), and the WebSocket RPC	58	scope](../../apps/server/src/auth/RpcAuthorization.ts), and the WebSocket RPC
59	group's `RpcScopeAuthorization` middleware checks it before any handler runs.	59	group's `RpcScopeAuthorization` middleware checks it before any handler runs.
60		60
		61	Self-update must work across authorization protocol changes. New servers advertise
		62	`auth.serverUpdateScope`; only an older server that omits it uses
		63	`orchestration:operate` for updates. An unchanged grant on an upgraded server must
		64	still include `environment:maintain`.
		65
61	Desktop restarts forget the previous local bearer token, so its reusable	66	Desktop restarts forget the previous local bearer token, so its reusable
62	bootstrap grant replaces earlier sessions for the same subject and method.	67	bootstrap grant replaces earlier sessions for the same subject and method.
63	Revocation and insertion share a [database	68	Revocation and insertion share a [database

docs/user/remote-access.md+10

...	@@ -277,6 +277,16 @@ in web or desktop, use Add Environment with the fresh link or code; pairing	...	@@ -277,6 +277,16 @@ in web or desktop, use Add Environment with the fresh link or code; pairing
277	the same environment replaces its saved grant. Reconnecting alone does not change	277	the same environment replaces its saved grant. Reconnecting alone does not change
278	permissions.	278	permissions.
279		279
		280	Grouping checkouts does not combine their permissions. Shared project settings
		281	require `orchestration:operate` on every member environment; actions on one
		282	checkout use that checkout's permissions.
		283
		284	Settings changes, provider management, and environment maintenance can be granted
		285	separately from access administration. New standard pairings include these
		286	permissions. Existing clients keep their original grants after an update; to
		287	receive newly separated permissions, pair the client again with the scopes it
		288	needs. Reconnecting or refreshing a session does not expand its grant.
		289
280	To remove an environment from T3 Connect, open your account menu's T3 Connect	290	To remove an environment from T3 Connect, open your account menu's T3 Connect
281	page, or Settings → T3 Connect on mobile, and choose Deregister. This	291	page, or Settings → T3 Connect on mobile, and choose Deregister. This
282	revokes its cloud access and frees its host space even when the environment is	292	revokes its cloud access and frees its host space even when the environment is

oxlint-plugin-t3code/index.ts+2

oxlint-plugin-t3code/rules/no-rpc-permission-bypass.test.ts created+69

...	@@ -0,0 +1,69 @@
1	import { createOxlintRuleHarness } from "../test/utils.ts";
2	const state = createOxlintRuleHarness("t3code/no-rpc-permission-bypass", {
3	filename: "fixture.ts",
4	});
5	state.invalid("blocks direct session calls", "session.client[tag](input);");
6	state.invalid("blocks extracting the raw client", 'const raw = session["client"];');
7	state.invalid(
8	"blocks replacing the permission guard",
9	'import { RpcPermissionGuard as Guard } from "../rpc/client.ts";',
10	);
11	state.invalid(
12	"blocks namespace guard access",
13	'import * as Rpc from "../rpc/client.ts"; const guard = Rpc.RpcPermissionGuard;',
14	);
15	state.invalid("blocks raw protocol imports", 'import { makeClient } from "../rpc/protocol.ts";');
16	state.valid(
17	"allows typed requests",
18	'import { request } from "../rpc/client.ts"; request(method, input);',
19	);
20	const rpc = createOxlintRuleHarness("t3code/no-rpc-permission-bypass", {
21	filename: "fixture.ts",
22	ruleOptions: [{ allowRawClientAccess: true }],
23	});
24	rpc.valid("allows the transport boundary", "session.client[tag](input);");
25
26	const app = createOxlintRuleHarness("t3code/no-rpc-permission-bypass", {
27	filename: "fixture.ts",
28	});
29	app.invalid(
30	"blocks guard imports through the barrel",
31	'import { RpcPermissionGuard as Guard } from "@t3tools/client-runtime/rpc";',
32	);
33	app.invalid(
34	"blocks explicit index imports",
35	'import { RpcPermissionGuard } from "@t3tools/client-runtime/rpc/index.ts";',
36	);
37	app.invalid(
38	"blocks raw session access in subscription callbacks",
39	"subscribeDynamic(tag, session => session.client[method](input));",
40	);
41	app.invalid(
42	"blocks raw client destructuring",
43	"const { client: raw } = session; raw[method](input);",
44	);
45	app.valid(
46	"allows public typed RPC helpers",
47	'import { request, runStream } from "@t3tools/client-runtime/rpc";',
48	);
49
50	rpc.invalid(
51	"raw client allowance does not permit installing the guard",
52	'import { RpcPermissionGuard } from "@t3tools/client-runtime/rpc";',
53	);
54	const boundary = createOxlintRuleHarness("t3code/no-rpc-permission-bypass", {
55	filename: "fixture.ts",
56	ruleOptions: [{ allowGuardInstallation: true }],
57	});
58	boundary.valid(
59	"permits guard installation when configured",
60	'import { RpcPermissionGuard } from "@t3tools/client-runtime/rpc"; RpcPermissionGuard.of({ authorize });',
61	);
62	boundary.invalid(
63	"guard installation allowance does not permit raw clients",
64	"session.client[tag](input);",
65	);
66	boundary.invalid(
67	"guard installation allowance does not permit raw protocol imports",
68	'import { makeWsRpcProtocolClient } from "../rpc/protocol.ts";',
69	);

oxlint-plugin-t3code/rules/no-rpc-permission-bypass.ts created+91

...	@@ -0,0 +1,91 @@
1	import { defineRule } from "@oxlint/plugins";
2	import * as Option from "effect/Option";
3	import { getPropertyName } from "../utils.ts";
4
5	const readOptions = (options: ReadonlyArray<unknown>) => {
6	const [first] = options;
7	return {
8	allowRawClientAccess:
9	typeof first === "object" &&
10	first !== null &&
11	"allowRawClientAccess" in first &&
12	first.allowRawClientAccess === true,
13	allowGuardInstallation:
14	typeof first === "object" &&
15	first !== null &&
16	"allowGuardInstallation" in first &&
17	first.allowGuardInstallation === true,
18	};
19	};
20
21	/** A guardrail for ordinary edits, not a security boundary against deliberate casts or aliases. */
22	export default defineRule({
23	meta: {
24	type: "problem",
25	docs: {
26	description:
27	"Keep raw RPC access and permission guard installation inside their shared boundaries.",
28	},
29	schema: [
30	{
31	type: "object",
32	properties: {
33	allowRawClientAccess: {
34	type: "boolean",
35	description: "Permit .client access for non-RPC clients in the configured files.",
36	},
37	allowGuardInstallation: {
38	type: "boolean",
39	description: "Permit installing RpcPermissionGuard in a reviewed command boundary.",
40	},
41	},
42	additionalProperties: false,
43	},
44	],
45	defaultOptions: [{ allowRawClientAccess: false, allowGuardInstallation: false }],
46	},
47	create(context) {
48	const { allowRawClientAccess, allowGuardInstallation } = readOptions(context.options);
49	const report = (node: NonNullable<Parameters<typeof context.report>[0]["node"]>) =>
50	context.report({
51	node,
52	message:
53	"Use permission-aware environment commands. Raw RPC access and RpcPermissionGuard belong in the shared RPC/command boundary.",
54	});
55	return {
56	ImportDeclaration(node) {
57	if (typeof node.source.value !== "string") return;
58	const source = node.source.value;
59	if (/(?:^\|\/)rpc\/protocol(?:\.ts)?$/.test(source) && node.importKind !== "type")
60	report(node);
61	if (
62	!allowGuardInstallation &&
63	/(?:^\|\/)rpc(?:\/(?:client\|index)(?:\.ts)?)?$/.test(source)
64	) {
65	for (const specifier of node.specifiers) {
66	if (
67	specifier.type === "ImportSpecifier" &&
68	Option.getOrNull(getPropertyName(specifier.imported)) === "RpcPermissionGuard"
69	)
70	report(specifier);
71	}
72	}
73	},
74	VariableDeclarator(node) {
75	if (allowRawClientAccess \|\| node.id.type !== "ObjectPattern") return;
76	for (const property of node.id.properties) {
77	if (
78	property.type === "Property" &&
79	Option.getOrNull(getPropertyName(property.key)) === "client"
80	)
81	report(property);
82	}
83	},
84	MemberExpression(node) {
85	const property = Option.getOrNull(getPropertyName(node.property));
86	if (!allowGuardInstallation && property === "RpcPermissionGuard") report(node);
87	if (!allowRawClientAccess && property === "client") report(node);
88	},
89	};
90	},
91	});

packages/client-runtime/src/rpc/client.ts+57-4

...	@@ -1,5 +1,8 @@	...	@@ -1,5 +1,8 @@
1	import {	1	import {
2	EnvironmentAuthorizationError,	2	EnvironmentAuthorizationError,
		3	clientRpcRequiredScopes,
		4	type EnvironmentId,
		5	type ClientGuardedRpcTag,
3	ORCHESTRATION_V2_WS_METHODS,	6	ORCHESTRATION_V2_WS_METHODS,
4	WS_METHODS,	7	WS_METHODS,
5	} from "@t3tools/contracts";	8	} from "@t3tools/contracts";
...	@@ -146,7 +149,40 @@ export const getInitialServerConfig = Effect.fn("EnvironmentRpc.getInitialServer	...	@@ -146,7 +149,40 @@ export const getInitialServerConfig = Effect.fn("EnvironmentRpc.getInitialServer
146	},	149	},
147	);	150	);
148		151
149	export const request = Effect.fn("EnvironmentRpc.request")(function* <	152	/** Installed by the shared command boundary. A missing boundary denies protected writes. */
		153	export class RpcPermissionGuard extends Context.Reference<{
		154	readonly authorize: (
		155	environmentId: EnvironmentId,
		156	method: string,
		157	input: unknown,
		158	) => Effect.Effect<void, EnvironmentAuthorizationError>;
		159	}>("@t3tools/client-runtime/rpc/RpcPermissionGuard", {
		160	defaultValue: () => ({
		161	authorize: (_environmentId, method, input) => {
		162	const scope = clientRpcRequiredScopes(method, input)[0];
		163	return scope === undefined
		164	? Effect.void
		165	: Effect.fail(
		166	new EnvironmentAuthorizationError({
		167	requiredScope: scope,
		168	message: `This connection requires ${scope}.`,
		169	}),
		170	);
		171	},
		172	}),
		173	}) {}
		174
		175	const authorizeRequest = Effect.fn("EnvironmentRpc.authorize")(function* (
		176	method: string,
		177	input: unknown,
		178	) {
		179	if (clientRpcRequiredScopes(method, input).length === 0) return;
		180	const supervisor = yield* EnvironmentSupervisor.EnvironmentSupervisor;
		181	const guard = yield* RpcPermissionGuard;
		182	yield* guard.authorize(supervisor.target.environmentId, method, input);
		183	});
		184
		185	export const requestGuarded = Effect.fn("EnvironmentRpc.request")(function* <
150	TTag extends EnvironmentUnaryRpcTag,	186	TTag extends EnvironmentUnaryRpcTag,
151	>(tag: TTag, input: EnvironmentRpcInput<TTag>) {	187	>(tag: TTag, input: EnvironmentRpcInput<TTag>) {
152	const supervisor = yield* EnvironmentSupervisor.EnvironmentSupervisor;	188	const supervisor = yield* EnvironmentSupervisor.EnvironmentSupervisor;
...	@@ -155,6 +191,7 @@ export const request = Effect.fn("EnvironmentRpc.request")(function* <	...	@@ -155,6 +191,7 @@ export const request = Effect.fn("EnvironmentRpc.request")(function* <
155	"rpc.method": tag,	191	"rpc.method": tag,
156	});	192	});
157	const session = yield* currentSession();	193	const session = yield* currentSession();
		194	yield* authorizeRequest(tag, input);
158	const observer = yield* EnvironmentRpcRequestObserver;	195	const observer = yield* EnvironmentRpcRequestObserver;
159	const method = session.client[tag] as (	196	const method = session.client[tag] as (
160	input: EnvironmentRpcInput<TTag>,	197	input: EnvironmentRpcInput<TTag>,
...	@@ -166,16 +203,19 @@ export const request = Effect.fn("EnvironmentRpc.request")(function* <	...	@@ -166,16 +203,19 @@ export const request = Effect.fn("EnvironmentRpc.request")(function* <
166	return yield* method(input).pipe(Effect.ensuring(completeObservation));	203	return yield* method(input).pipe(Effect.ensuring(completeObservation));
167	});	204	});
168		205
169	export function runStream<TTag extends EnvironmentStreamCommandRpcTag>(	206	function runStreamGuarded<TTag extends EnvironmentStreamCommandRpcTag>(
170	tag: TTag,	207	tag: TTag,
171	input: EnvironmentRpcInput<TTag>,	208	input: EnvironmentRpcInput<TTag>,
172	): Stream.Stream<	209	): Stream.Stream<
173	EnvironmentRpcStreamValue<TTag>,	210	EnvironmentRpcStreamValue<TTag>,
174	EnvironmentRpcStreamFailure<TTag> \| EnvironmentRpcUnavailableError,	211	\| EnvironmentRpcStreamFailure<TTag>
		212	\| EnvironmentRpcUnavailableError
		213	\| EnvironmentAuthorizationError,
175	EnvironmentSupervisor.EnvironmentSupervisor	214	EnvironmentSupervisor.EnvironmentSupervisor
176	> {	215	> {
177	return Stream.unwrap(	216	return Stream.unwrap(
178	currentSession().pipe(	217	authorizeRequest(tag, input).pipe(
		218	Effect.andThen(currentSession()),
179	Effect.map((session) => {	219	Effect.map((session) => {
180	const method = session.client[tag] as (	220	const method = session.client[tag] as (
181	input: EnvironmentRpcInput<TTag>,	221	input: EnvironmentRpcInput<TTag>,
...	@@ -393,3 +433,16 @@ export function subscribe<TTag extends EnvironmentSubscriptionRpcTag>(	...	@@ -393,3 +433,16 @@ export function subscribe<TTag extends EnvironmentSubscriptionRpcTag>(
393	> {	433	> {
394	return subscribeDynamic(tag, () => Effect.succeed(input), options);	434	return subscribeDynamic(tag, () => Effect.succeed(input), options);
395	}	435	}
		436
		437	/** Protected writes must go through the permission-aware command layer. */
		438	export const request = <TTag extends Exclude<EnvironmentUnaryRpcTag, ClientGuardedRpcTag>>(
		439	tag: TTag,
		440	input: EnvironmentRpcInput<TTag>,
		441	) => requestGuarded(tag, input);
		442
		443	export const runStream = <
		444	TTag extends Exclude<EnvironmentStreamCommandRpcTag, ClientGuardedRpcTag>,
		445	>(
		446	tag: TTag,
		447	input: EnvironmentRpcInput<TTag>,
		448	) => runStreamGuarded(tag, input);

packages/client-runtime/src/rpc/index.ts+1-1

...	@@ -1,4 +1,4 @@	...	@@ -1,4 +1,4 @@
1	export * from "./client.ts";	1	export * from "./client.ts";
2	export * from "./http.ts";	2	export * from "./http.ts";
3	export * from "./protocol.ts";	3	export type { WsRpcProtocolClient } from "./protocol.ts";
4	export { type RpcSession } from "./session.ts";	4	export { type RpcSession } from "./session.ts";

packages/client-runtime/src/state/commandPermissions.test.ts created+152

...	@@ -0,0 +1,152 @@
1	import { describe, expect, it } from "@effect/vitest";
2	import { vi } from "vite-plus/test";
3	import {
4	AuthOrchestrationOperateScope,
5	EnvironmentId,
6	ScheduledTaskId,
7	WS_METHODS,
8	type AuthSessionState,
9	} from "@t3tools/contracts";
10	import * as Cause from "effect/Cause";
11	import * as Effect from "effect/Effect";
12	import * as Fiber from "effect/Fiber";
13	import * as Layer from "effect/Layer";
14	import * as TestClock from "effect/testing/TestClock";
15	import { Atom, AtomRegistry, AsyncResult } from "effect/reactivity";
16	import { EnvironmentRegistry } from "../connection/registry.ts";
17	import { createCommandPermissions } from "./commandPermissions.ts";
18	import { createEnvironmentRpcCommand } from "./runtime.ts";
19
20	vi.mock("./session.ts", () => ({
21	createEnvironmentSessionAtoms: () => ({ sessionStateAtom: sessions }),
22	}));
23	const sessions = Atom.family((_id: EnvironmentId) =>
24	Atom.make<AsyncResult.AsyncResult<AuthSessionState, string>>(AsyncResult.initial()),
25	);
26	const env = EnvironmentId.make("target");
27	const other = EnvironmentId.make("other");
28	const grant = (allowed: boolean): AuthSessionState => ({
29	authenticated: true,
30	auth: {
31	policy: "remote-reachable",
32	bootstrapMethods: [],
33	sessionMethods: [],
34	sessionCookieName: "test",
35	},
36	scopes: allowed ? [AuthOrchestrationOperateScope] : [],
37	});
38	const runtime = Atom.runtime(
39	Layer.succeed(EnvironmentRegistry, {
40	run: (_id: EnvironmentId, effect: Effect.Effect<unknown>) => effect,
41	} as unknown as EnvironmentRegistry["Service"]),
42	);
43	const permissions = createCommandPermissions(runtime, WS_METHODS.scheduledTasksDelete);
44	const setup = Effect.gen(function* () {
45	const registry = AtomRegistry.make();
46	registry.mount(sessions(env));
47	yield* Effect.addFinalizer(() => Effect.sync(() => registry.dispose()));
48	return registry;
49	});
50
51	describe("command permissions", () => {
52	it.effect("uses the target grant for both availability and execution", () =>
53	Effect.scoped(
54	Effect.gen(function* () {
55	const registry = yield* setup;
56	registry.set(sessions(env), AsyncResult.success(grant(true)));
57	expect(registry.get(permissions.permissionAtom(env))).toBe(true);
58	expect(permissions.permissionAtom(env)).toBe(permissions.permissionAtom(env));
59	yield* permissions.authorize(registry, env);
60	registry.set(sessions(other), AsyncResult.success(grant(false)));
61	expect(registry.get(permissions.permissionAtom(other))).toBe(false);
62	const denied = yield* permissions.authorize(registry, other).pipe(Effect.flip);
63	expect(denied._tag).toBe("EnvironmentAuthorizationError");
64	}),
65	),
66	);
67	it.effect("waits for an initial grant", () =>
68	Effect.scoped(
69	Effect.gen(function* () {
70	const registry = yield* setup;
71	const fiber = yield* permissions.authorize(registry, env).pipe(Effect.forkChild);
72	yield* Effect.yieldNow;
73	registry.set(sessions(env), AsyncResult.success(grant(true)));
74	yield* Fiber.join(fiber);
75	}),
76	),
77	);
78	it.effect("bounds a session that never loads", () =>
79	Effect.scoped(
80	Effect.gen(function* () {
81	const registry = yield* setup;
82	const fiber = yield* permissions
83	.authorize(registry, env)
84	.pipe(Effect.flip, Effect.forkChild);
85	yield* TestClock.adjust("6 seconds");
86	expect((yield* Fiber.join(fiber))._tag).toBe("EnvironmentAuthorizationError");
87	}),
88	),
89	);
90	it.effect(
91	"denies failed and unauthenticated sessions, but accepts a cached refreshing grant",
92	() =>
93	Effect.scoped(
94	Effect.gen(function* () {
95	const registry = yield* setup;
96	registry.set(sessions(env), AsyncResult.failure(Cause.fail("offline")));
97	expect((yield* permissions.authorize(registry, env).pipe(Effect.flip))._tag).toBe(
98	"EnvironmentAuthorizationError",
99	);
100	registry.set(
101	sessions(env),
102	AsyncResult.success({ ...grant(true), authenticated: false }),
103	);
104	expect((yield* permissions.authorize(registry, env).pipe(Effect.flip))._tag).toBe(
105	"EnvironmentAuthorizationError",
106	);
107	registry.set(sessions(env), AsyncResult.waiting(AsyncResult.success(grant(true))));
108	yield* permissions.authorize(registry, env);
109	}),
110	),
111	);
112	it("rechecks permission after waiting in a serial command lane", async () => {
113	const registry = AtomRegistry.make();
114	const unmount = registry.mount(sessions(env));
115	registry.set(sessions(env), AsyncResult.success(grant(true)));
116	let release!: () => void;
117	let started!: () => void;
118	const entered = new Promise<void>((resolve) => {
119	started = resolve;
120	});
121	const gate = new Promise<void>((resolve) => {
122	release = resolve;
123	});
124	let calls = 0;
125	const command = createEnvironmentRpcCommand(runtime, {
126	label: "test.delete",
127	tag: WS_METHODS.scheduledTasksDelete,
128	concurrency: { mode: "serial", key: () => "target" },
129	execute: () =>
130	Effect.promise(async () => {
131	calls++;
132	started();
133	await gate;
134	return { id: ScheduledTaskId.make("task") };
135	}),
136	});
137	const target = { environmentId: env, input: { id: ScheduledTaskId.make("task") } };
138	try {
139	const first = command.run(registry, target);
140	await entered;
141	const second = command.run(registry, target);
142	registry.set(sessions(env), AsyncResult.success(grant(false)));
143	release();
144	expect((await first)._tag).toBe("Success");
145	expect((await second)._tag).toBe("Failure");
146	expect(calls).toBe(1);
147	} finally {
148	unmount();
149	registry.dispose();
150	}
151	});
152	});

packages/client-runtime/src/state/commandPermissions.ts created+97

...	@@ -0,0 +1,97 @@
1	import {
2	clientRpcRequiredScopes,
3	EnvironmentAuthorizationError,
4	type EnvironmentId,
5	type AuthSessionState,
6	type AuthEnvironmentScope,
7	} from "@t3tools/contracts";
8	import * as Effect from "effect/Effect";
9	import * as Option from "effect/Option";
10	import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
11	import type { EnvironmentRegistry } from "../connection/registry.ts";
12	import { createEnvironmentSessionAtoms } from "./session.ts";
13
14	function grants(session: AuthSessionState, scope: AuthEnvironmentScope) {
15	return session.authenticated && session.scopes?.includes(scope) === true;
16	}
17
18	/** UI availability and dispatch use the same target session and method policy. */
19	function makeCommandPermissions<R, E>(
20	runtime: Atom.AtomRuntime<EnvironmentRegistry \| R, E>,
21	method: string,
22	) {
23	const sessions = createEnvironmentSessionAtoms(runtime);
24	const requiredScopes = (input?: unknown) => clientRpcRequiredScopes(method, input);
25	const atomsByEnvironment = Atom.family((environmentId: EnvironmentId \| null) =>
26	Atom.family((scopeKey: string) =>
27	Atom.make((get) => {
28	if (environmentId === null) return false;
29	const scopes = scopeKey.split(",").filter(Boolean) as AuthEnvironmentScope[];
30	if (scopes.length === 0) return true;
31	const result = get(sessions.sessionStateAtom(environmentId));
32	const session = Option.getOrNull(AsyncResult.value(result));
33	return (
34	result._tag !== "Failure" &&
35	session !== null &&
36	scopes.every((scope) => grants(session, scope))
37	);
38	}),
39	),
40	);
41	const permissionAtom = (environmentId: EnvironmentId \| null, input?: unknown) =>
42	atomsByEnvironment(environmentId)(requiredScopes(input).join(","));
43	const authorize = (
44	registry: AtomRegistry.AtomRegistry,
45	environmentId: EnvironmentId,
46	input?: unknown,
47	) =>
48	Effect.suspend(() => {
49	const scopes = requiredScopes(input);
50	if (scopes.length === 0) return Effect.void;
51	const atom = sessions.sessionStateAtom(environmentId);
52	return Effect.scoped(
53	Effect.gen(function* () {
54	yield* AtomRegistry.mount(registry, atom);
55	const session = yield* AtomRegistry.getResult(registry, atom, {
56	suspendOnWaiting: false,
57	}).pipe(
58	Effect.timeoutOption(6_000),
59	Effect.catch(() => Effect.succeed(Option.none<AuthSessionState>())),
60	);
61	const missing = scopes.find(
62	(scope) => Option.isNone(session) \|\| !grants(session.value, scope),
63	);
64	if (missing !== undefined)
65	return yield* Effect.fail(
66	new EnvironmentAuthorizationError({
67	requiredScope: missing,
68	message: `This connection requires ${missing}.`,
69	}),
70	);
71	}),
72	);
73	});
74	return { requiredScopes, permissionAtom, authorize };
75	}
76
77	const permissionsByRuntime = new WeakMap<
78	object,
79	Map<string, ReturnType<typeof makeCommandPermissions>>
80	>();
81
82	/** Reuse availability atoms and dispatch guards across commands on the same runtime. */
83	export function createCommandPermissions<R, E>(
84	runtime: Atom.AtomRuntime<EnvironmentRegistry \| R, E>,
85	method: string,
86	) {
87	let permissions = permissionsByRuntime.get(runtime);
88	if (permissions === undefined) {
89	permissions = new Map();
90	permissionsByRuntime.set(runtime, permissions);
91	}
92	const existing = permissions.get(method);
93	if (existing !== undefined) return existing;
94	const created = makeCommandPermissions(runtime, method);
95	permissions.set(method, created);
96	return created;
97	}

packages/client-runtime/src/state/environmentStreams.ts created+35

...	@@ -0,0 +1,35 @@
1	import type { EnvironmentId as EnvironmentIdType } from "@t3tools/contracts";
2	import * as Effect from "effect/Effect";
3	import * as Stream from "effect/Stream";
4	import * as EnvironmentRegistry from "../connection/registry.ts";
5	import type * as EnvironmentSupervisor from "../connection/supervisor.ts";
6
7	export function runStreamInEnvironment<A, E, R>(
8	environmentId: EnvironmentIdType,
9	stream: Stream.Stream<A, E, R>,
10	): Stream.Stream<
11	A,
12	E \| EnvironmentRegistry.EnvironmentNotRegisteredError,
13	EnvironmentRegistry.EnvironmentRegistry \| Exclude<R, EnvironmentSupervisor.EnvironmentSupervisor>
14	> {
15	return Stream.unwrap(
16	EnvironmentRegistry.EnvironmentRegistry.pipe(
17	Effect.map((registry) => registry.runStream(environmentId, stream)),
18	),
19	);
20	}
21
22	export function followStreamInEnvironment<A, E, R>(
23	environmentId: EnvironmentIdType,
24	stream: Stream.Stream<A, E, R>,
25	): Stream.Stream<
26	A,
27	E,
28	EnvironmentRegistry.EnvironmentRegistry \| Exclude<R, EnvironmentSupervisor.EnvironmentSupervisor>
29	> {
30	return Stream.unwrap(
31	EnvironmentRegistry.EnvironmentRegistry.pipe(
32	Effect.map((registry) => registry.followStream(environmentId, stream)),
33	),
34	);
35	}

packages/client-runtime/src/state/pullRequestRouting.ts+1-1

...	@@ -24,7 +24,7 @@ import type { ConnectionCatalogEntry } from "../connection/catalog.ts";	...	@@ -24,7 +24,7 @@ import type { ConnectionCatalogEntry } from "../connection/catalog.ts";
24	import * as ConnectionProfileStore from "../connection/profileStore.ts";	24	import * as ConnectionProfileStore from "../connection/profileStore.ts";
25	import type { RpcSession } from "../rpc/session.ts";	25	import type { RpcSession } from "../rpc/session.ts";
26	import {	26	import {
27	request,	27	requestGuarded as request,
28	EnvironmentRpcUnavailableError,	28	EnvironmentRpcUnavailableError,
29	type EnvironmentRpcInput,	29	type EnvironmentRpcInput,
30	type EnvironmentUnaryRpcTag,	30	type EnvironmentUnaryRpcTag,

packages/client-runtime/src/state/runtime.ts+30-34

 @@ -1,4 +1,11 @@
-import { EnvironmentId, type EnvironmentId as EnvironmentIdType } from "@t3tools/contracts";
+import { createCommandPermissions } from "./commandPermissions.ts";
+import { runStreamInEnvironment, followStreamInEnvironment } from "./environmentStreams.ts";
+export { runStreamInEnvironment, followStreamInEnvironment } from "./environmentStreams.ts";
+import {
+  type ClientGuardedRpcTag,
+  EnvironmentId,
+  type EnvironmentId as EnvironmentIdType,
+} from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 @@ -19,6 +26,8 @@ import {
   type EnvironmentUnaryRpcTag,
   EnvironmentRpcUnavailableError,
   request,
+  requestGuarded,
+  RpcPermissionGuard,
   subscribe,
 } from "../rpc/client.ts";
 import * as EnvironmentSupervisor from "../connection/supervisor.ts";
 @@ -459,36 +468,6 @@ function runInEnvironment<A, E, R>(
   );
 }
-export function runStreamInEnvironment<A, E, R>(
-  environmentId: EnvironmentIdType,
-  stream: Stream.Stream<A, E, R>,
-): Stream.Stream<
-  A,
-  E | EnvironmentRegistry.EnvironmentNotRegisteredError,
-  EnvironmentRegistry.EnvironmentRegistry | Exclude<R, EnvironmentSupervisor.EnvironmentSupervisor>
-> {
-  return Stream.unwrap(
-    EnvironmentRegistry.EnvironmentRegistry.pipe(
-      Effect.map((registry) => registry.runStream(environmentId, stream)),
-    ),
-  );
-}
-export function followStreamInEnvironment<A, E, R>(
-  environmentId: EnvironmentIdType,
-  stream: Stream.Stream<A, E, R>,
-): Stream.Stream<
-  A,
-  E,
-  EnvironmentRegistry.EnvironmentRegistry | Exclude<R, EnvironmentSupervisor.EnvironmentSupervisor>
-> {
-  return Stream.unwrap(
-    EnvironmentRegistry.EnvironmentRegistry.pipe(
-      Effect.map((registry) => registry.followStream(environmentId, stream)),
-    ),
-  );
-}
 /**
  * Refreshes a query when `signal` changes, but only while something reads it.
  * `Atom.makeRefreshOnSignal` subscribes to the signal, so a query that outlives its view on an
 @@ -660,7 +639,11 @@ export function createEnvironmentCommand<R, ER, Input, A, E>(
   });
 }
-export function createEnvironmentRpcQueryAtomFamily<R, ER, TTag extends EnvironmentUnaryRpcTag>(
+export function createEnvironmentRpcQueryAtomFamily<
+  R,
+  ER,
+  TTag extends Exclude<EnvironmentUnaryRpcTag, ClientGuardedRpcTag>,
+>(
   runtime: Atom.AtomRuntime<EnvironmentRegistry.EnvironmentRegistry | R, ER>,
   options: {
     readonly label: string;
 @@ -767,7 +750,8 @@ export function createEnvironmentRpcCommand<R, ER, TTag extends EnvironmentUnary
     ) => Effect.Effect<void, never, R>;
   },
 ) {
-  return createEnvironmentCommand(runtime, {
+  const permissions = createCommandPermissions(runtime, options.tag);
+  const command = createEnvironmentCommand(runtime, {
     label: options.label,
     ...(options.scheduler === undefined ? {} : { scheduler: options.scheduler }),
     ...(options.concurrency === undefined ? {} : { concurrency: options.concurrency }),
 @@ -776,10 +760,22 @@ export function createEnvironmentRpcCommand<R, ER, TTag extends EnvironmentUnary
         environmentId,
         input,
       };
-      return (options.execute?.(input) ?? request(options.tag, input)).pipe(
+      // Routing requires consent on the origin as well as the actual destination.
+      // The transport check below deliberately checks the destination again.
+      return permissions.authorize(registry, environmentId, input).pipe(
+        Effect.andThen(() => options.execute?.(input) ?? requestGuarded(options.tag, input)),
+        Effect.provideService(RpcPermissionGuard, {
+          authorize: (id, method, payload) =>
+            createCommandPermissions(runtime, method).authorize(registry, id, payload),
+        }),
         Effect.tap(() => options.onSuccess?.(target, registry) ?? Effect.void),
         Effect.ensuring(options.onSettled?.(target, registry) ?? Effect.void),
       );
     },
   });
+  return {
+    ...command,
+    requiredScopes: permissions.requiredScopes,
+    permissionAtom: permissions.permissionAtom,
+  };
 }

packages/client-runtime/src/state/session.ts+30-5

 @@ -1,9 +1,10 @@
 import type { AuthSessionState, EnvironmentId, ServerConfig } from "@t3tools/contracts";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import * as SubscriptionRef from "effect/SubscriptionRef";
-import type { HttpClient } from "effect/http";
+import { HttpClient } from "effect/http";
 import { AsyncResult, Atom } from "effect/reactivity";
 import * as RemoteEnvironmentAuthorization from "../authorization/service.ts";
 @@ -14,7 +15,12 @@ import { environmentEndpointUrl } from "../environment/endpoint.ts";
 import * as ManagedRelay from "../relay/managedRelay.ts";
 import { safeErrorLogAttributes } from "../errors/safeLog.ts";
 import { executeAuthenticatedEnvironmentHttpRequest } from "./environmentHttpAuth.ts";
-import { followStreamInEnvironment } from "./runtime.ts";
+import { followStreamInEnvironment } from "./environmentStreams.ts";
+/** @public Required to name the error in consumers' inferred session results. */
+export class SessionHttpClientUnavailable extends Data.TaggedError(
+  "SessionHttpClientUnavailable",
+) {}
 function initialConfigOption<E>(
   initialConfig: Effect.Effect<ServerConfig, E>,
 @@ -61,8 +67,8 @@ export const fetchEnvironmentSessionState = Effect.fn(
   });
 });
-export function createEnvironmentSessionAtoms<R, E>(
+function makeEnvironmentSessionAtoms<R, E>(
-  runtime: Atom.AtomRuntime<EnvironmentRegistry.EnvironmentRegistry | HttpClient.HttpClient | R, E>,
+  runtime: Atom.AtomRuntime<EnvironmentRegistry.EnvironmentRegistry | R, E>,
 ) {
   const initialConfigAtom = Atom.family((environmentId: EnvironmentId) =>
     runtime.atom(
 @@ -137,7 +143,13 @@ export function createEnvironmentSessionAtoms<R, E>(
           const remoteAuthorization = yield* Effect.serviceOption(
             RemoteEnvironmentAuthorization.RemoteEnvironmentAuthorization,
           );
-          return yield* fetchEnvironmentSessionState({ prepared, signer, remoteAuthorization });
+          const client = yield* Effect.serviceOption(HttpClient.HttpClient);
+          if (Option.isNone(client)) return yield* new SessionHttpClientUnavailable();
+          return yield* fetchEnvironmentSessionState({
+            prepared,
+            signer,
+            remoteAuthorization,
+          }).pipe(Effect.provideService(HttpClient.HttpClient, client.value));
         });
       })
       .pipe(
 @@ -163,3 +175,16 @@ export function createEnvironmentSessionAtoms<R, E>(
     sessionStateValueAtom,
   };
 }
+const sessionAtomsByRuntime = new WeakMap<object, ReturnType<typeof makeEnvironmentSessionAtoms>>();
+/** Commands and UI share one session fetch and the same reconnect invalidation. */
+export function createEnvironmentSessionAtoms<R, E>(
+  runtime: Atom.AtomRuntime<EnvironmentRegistry.EnvironmentRegistry | R, E>,
+): ReturnType<typeof makeEnvironmentSessionAtoms<R, E>> {
+  const existing = sessionAtomsByRuntime.get(runtime);
+  if (existing) return existing as ReturnType<typeof makeEnvironmentSessionAtoms<R, E>>;
+  const atoms = makeEnvironmentSessionAtoms(runtime);
+  sessionAtomsByRuntime.set(runtime, atoms);
+  return atoms;
+}

packages/client-runtime/src/state/usage.test.ts+2

...	@@ -75,6 +75,8 @@ function harness(ids = ["a"]) {	...	@@ -75,6 +75,8 @@ function harness(ids = ["a"]) {
75	get(environmentId).query,	75	get(environmentId).query,
76	refreshUsageRates: {	76	refreshUsageRates: {
77	label: "test:rates",	77	label: "test:rates",
		78	requiredScopes: () => [],
		79	permissionAtom: () => Atom.make(true),
78	run: (	80	run: (
79	_registry: AtomRegistry.AtomRegistry,	81	_registry: AtomRegistry.AtomRegistry,
80	{ environmentId }: { environmentId: EnvironmentId },	82	{ environmentId }: { environmentId: EnvironmentId },

packages/contracts/src/auth.ts+11

...	@@ -80,6 +80,9 @@ export type ServerAuthSessionMethod = typeof ServerAuthSessionMethod.Type;	...	@@ -80,6 +80,9 @@ export type ServerAuthSessionMethod = typeof ServerAuthSessionMethod.Type;
80		80
81	export const AuthOrchestrationReadScope = "orchestration:read" as const;	81	export const AuthOrchestrationReadScope = "orchestration:read" as const;
82	export const AuthOrchestrationOperateScope = "orchestration:operate" as const;	82	export const AuthOrchestrationOperateScope = "orchestration:operate" as const;
		83	export const AuthSettingsWriteScope = "settings:write" as const;
		84	export const AuthProvidersManageScope = "providers:manage" as const;
		85	export const AuthEnvironmentMaintainScope = "environment:maintain" as const;
83	export const AuthTerminalOperateScope = "terminal:operate" as const;	86	export const AuthTerminalOperateScope = "terminal:operate" as const;
84	export const AuthReviewWriteScope = "review:write" as const;	87	export const AuthReviewWriteScope = "review:write" as const;
85	export const AuthAccessReadScope = "access:read" as const;	88	export const AuthAccessReadScope = "access:read" as const;
...	@@ -89,6 +92,9 @@ export const AuthRelayWriteScope = "relay:write" as const;	...	@@ -89,6 +92,9 @@ export const AuthRelayWriteScope = "relay:write" as const;
89	export const AuthEnvironmentScope = Schema.Literals([	92	export const AuthEnvironmentScope = Schema.Literals([
90	AuthOrchestrationReadScope,	93	AuthOrchestrationReadScope,
91	AuthOrchestrationOperateScope,	94	AuthOrchestrationOperateScope,
		95	AuthSettingsWriteScope,
		96	AuthProvidersManageScope,
		97	AuthEnvironmentMaintainScope,
92	AuthTerminalOperateScope,	98	AuthTerminalOperateScope,
93	AuthReviewWriteScope,	99	AuthReviewWriteScope,
94	AuthAccessReadScope,	100	AuthAccessReadScope,
...	@@ -103,6 +109,9 @@ export type AuthEnvironmentScopes = typeof AuthEnvironmentScopes.Type;	...	@@ -103,6 +109,9 @@ export type AuthEnvironmentScopes = typeof AuthEnvironmentScopes.Type;
103	export const AuthStandardClientScopes = [	109	export const AuthStandardClientScopes = [
104	AuthOrchestrationReadScope,	110	AuthOrchestrationReadScope,
105	AuthOrchestrationOperateScope,	111	AuthOrchestrationOperateScope,
		112	AuthSettingsWriteScope,
		113	AuthProvidersManageScope,
		114	AuthEnvironmentMaintainScope,
106	AuthTerminalOperateScope,	115	AuthTerminalOperateScope,
107	AuthReviewWriteScope,	116	AuthReviewWriteScope,
108	AuthRelayReadScope,	117	AuthRelayReadScope,
...	@@ -145,6 +154,8 @@ export const ServerAuthDescriptor = Schema.Struct({	...	@@ -145,6 +154,8 @@ export const ServerAuthDescriptor = Schema.Struct({
145	bootstrapMethods: Schema.Array(ServerAuthBootstrapMethod),	154	bootstrapMethods: Schema.Array(ServerAuthBootstrapMethod),
146	sessionMethods: Schema.Array(ServerAuthSessionMethod),	155	sessionMethods: Schema.Array(ServerAuthSessionMethod),
147	sessionCookieName: TrimmedNonEmptyString,	156	sessionCookieName: TrimmedNonEmptyString,
		157	/** Older servers omit this and authorize self-updates with orchestration:operate. */
		158	serverUpdateScope: Schema.optionalKey(Schema.Literal(AuthEnvironmentMaintainScope)),
148	});	159	});
149	export type ServerAuthDescriptor = typeof ServerAuthDescriptor.Type;	160	export type ServerAuthDescriptor = typeof ServerAuthDescriptor.Type;
150		161

packages/contracts/src/clientRpcPermissions.ts created+21

...	@@ -0,0 +1,21 @@
1	import { AuthOrchestrationOperateScope, type AuthEnvironmentScope } from "./auth.ts";
2	import { WS_METHODS } from "./rpc.ts";
3
4	/** Incremental client enforcement; the server still authorizes every request. */
5	export const CLIENT_GUARDED_RPC_SCOPES = {
6	[WS_METHODS.scheduledTasksUpsert]: AuthOrchestrationOperateScope,
7	[WS_METHODS.scheduledTasksSetEnabled]: AuthOrchestrationOperateScope,
8	[WS_METHODS.scheduledTasksDelete]: AuthOrchestrationOperateScope,
9	[WS_METHODS.scheduledTasksRunNow]: AuthOrchestrationOperateScope,
10	[WS_METHODS.scheduledTasksRotateWebhookToken]: AuthOrchestrationOperateScope,
11	} as const;
12	export type ClientGuardedRpcTag = keyof typeof CLIENT_GUARDED_RPC_SCOPES;
13
14	export function clientRpcRequiredScopes(
15	method: string,
16	_input: unknown,
17	): readonly AuthEnvironmentScope[] {
18	return Object.hasOwn(CLIENT_GUARDED_RPC_SCOPES, method)
19	? [CLIENT_GUARDED_RPC_SCOPES[method as ClientGuardedRpcTag]]
20	: [];
21	}

packages/contracts/src/index.ts+1

...	@@ -62,3 +62,4 @@ export * from "./resourceTelemetry.ts";	...	@@ -62,3 +62,4 @@ export * from "./resourceTelemetry.ts";
62	export * from "./rpc.ts";	62	export * from "./rpc.ts";
63	export * from "./worktreeSetup.ts";	63	export * from "./worktreeSetup.ts";
64	export * from "./secretRequest.ts";	64	export * from "./secretRequest.ts";
		65	export * from "./clientRpcPermissions.ts";

packages/contracts/src/settings.ts+25

...	@@ -1,4 +1,9 @@	...	@@ -1,4 +1,9 @@
1	import { SshDeviceHostConfigs } from "./device.ts";	1	import { SshDeviceHostConfigs } from "./device.ts";
		2	import {
		3	AuthSettingsWriteScope,
		4	AuthProvidersManageScope,
		5	type AuthEnvironmentScope,
		6	} from "./auth.ts";
2	import * as Effect from "effect/Effect";	7	import * as Effect from "effect/Effect";
3	import * as Duration from "effect/Duration";	8	import * as Duration from "effect/Duration";
4	import * as Schema from "effect/Schema";	9	import * as Schema from "effect/Schema";
...	@@ -1790,6 +1795,26 @@ export const ServerSettingsPatch = Schema.Struct({	...	@@ -1790,6 +1795,26 @@ export const ServerSettingsPatch = Schema.Struct({
1790	});	1795	});
1791	export type ServerSettingsPatch = typeof ServerSettingsPatch.Type;	1796	export type ServerSettingsPatch = typeof ServerSettingsPatch.Type;
1792		1797
		1798	/** A mixed settings patch must be authorized for every configuration domain it changes. */
		1799	export function requiredScopesForServerSettingsPatch(
		1800	patch: ServerSettingsPatch,
		1801	): ReadonlyArray<AuthEnvironmentScope> {
		1802	let changesProviders = false;
		1803	let changesSettings = false;
		1804	for (const [key, value] of Object.entries(patch)) {
		1805	if (value === undefined) continue;
		1806	if (key === "providers" \|\| key === "providerInstances" \|\| key === "usageLimitSources") {
		1807	changesProviders = true;
		1808	} else {
		1809	changesSettings = true;
		1810	}
		1811	}
		1812	return [
		1813	...(changesSettings \|\| !changesProviders ? [AuthSettingsWriteScope] : []),
		1814	...(changesProviders ? [AuthProvidersManageScope] : []),
		1815	];
		1816	}
		1817
1793	export const ClientSettingsPatch = Schema.Struct({	1818	export const ClientSettingsPatch = Schema.Struct({
1794	notificationMode: Schema.optionalKey(NotificationMode),	1819	notificationMode: Schema.optionalKey(NotificationMode),
1795	inAppNotificationsEnabled: Schema.optionalKey(Schema.Boolean),	1820	inAppNotificationsEnabled: Schema.optionalKey(Schema.Boolean),

vite.config.ts+41

...	@@ -169,12 +169,53 @@ export default defineConfig({	...	@@ -169,12 +169,53 @@ export default defineConfig({
169	"t3code/no-native-title-tooltip": "error",	169	"t3code/no-native-title-tooltip": "error",
170	"t3code/no-raw-mcp-registration": "error",	170	"t3code/no-raw-mcp-registration": "error",
171	"t3code/no-test-in-loop": "error",	171	"t3code/no-test-in-loop": "error",
		172	"t3code/no-rpc-permission-bypass": ["error", { allowRawClientAccess: true }],
172	"t3code/no-unscoped-has": "error",	173	"t3code/no-unscoped-has": "error",
173	"t3code/namespace-node-imports": "error",	174	"t3code/namespace-node-imports": "error",
174	"t3code/prefer-catch-tags": "error",	175	"t3code/prefer-catch-tags": "error",
175	"t3code/require-suppression-reason": "error",	176	"t3code/require-suppression-reason": "error",
176	},	177	},
177	overrides: [	178	overrides: [
		179	{
		180	files: ["packages/client-runtime/src/state/", "apps/{web,mobile,desktop}/src/"],
		181	rules: { "t3code/no-rpc-permission-bypass": ["error", { allowRawClientAccess: false }] },
		182	},
		183	{
		184	// Only shared command boundaries install the session-backed permission guard.
		185	files: [
		186	"packages/client-runtime/src/state/runtime.ts",
		187	"packages/client-runtime/src/state/vcsAction.ts",
		188	],
		189	rules: {
		190	"t3code/no-rpc-permission-bypass": [
		191	"error",
		192	{ allowGuardInstallation: true, allowRawClientAccess: false },
		193	],
		194	},
		195	},
		196	{
		197	// These clients are session metadata, device streams, and an Expo update adapter.
		198	files: [
		199	"apps/web/src/components/settings/ConnectionsSettings.tsx",
		200	"apps/mobile/src/features/updates/app-updates.ts",
		201	"apps/web/src/components/device/DevicePhoneViewport.tsx",
		202	"apps/web/src/components/device/DeviceDuoViewport.tsx",
		203	],
		204	rules: { "t3code/no-rpc-permission-bypass": ["error", { allowRawClientAccess: true }] },
		205	},
		206	{
		207	// Incompatible hosts cannot open a normal session; their updater uses a dedicated socket.
		208	files: ["packages/client-runtime/src/connection/outdatedHostUpdate.ts"],
		209	rules: { "t3code/no-rpc-permission-bypass": "off" },
		210	},
		211	{
		212	// RPC implementation and transport test fixtures need the raw client.
		213	files: [
		214	"packages/client-runtime/src/rpc/**",
		215	"*/.{test,spec}.{ts,tsx,js,jsx,mts,cts,mjs,cjs}",
		216	],
		217	rules: { "t3code/no-rpc-permission-bypass": "off" },
		218	},
178	{	219	{
179	// The one place that reads the host platform to seed the injected references.	220	// The one place that reads the host platform to seed the injected references.
180	files: ["packages/shared/src/hostProcess.ts"],	221	files: ["packages/shared/src/hostProcess.ts"],

author	Julius Marminge <julius0216@outlook.com> 2026-10-06 20:30:11-07:00
committer	GitHub <noreply@github.com> 2026-10-06 20:30:11-07:00
log	28ce9d1c1751d70c869e3de3287b96d5e28fc845
tree	815ff97b068e373f6c6ff5705ed5a35f0f253a20
parent	e9c3d950f023130791d8ac5fe7aa0992e3430738
signature	Signed by PGP key B5690EEEBB952194

...	@@ -1,6 +1,7 @@	...	@@ -1,6 +1,7 @@
1	import type { ThreadMoveDestination } from "../threads/threadOrder";	1	import type { ThreadMoveDestination } from "../threads/threadOrder";
2	import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";	2	import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";
3	import { canSnooze, effectiveSnoozed } from "@t3tools/client-runtime/state/thread-settled";	3	import { canSnooze, effectiveSnoozed } from "@t3tools/client-runtime/state/thread-settled";
		4	import { AuthOrchestrationOperateScope } from "@t3tools/contracts";
4	import * as Cause from "effect/Cause";	5	import * as Cause from "effect/Cause";
5	import * as Haptics from "expo-haptics";	6	import * as Haptics from "expo-haptics";
6	import { useCallback, useRef } from "react";	7	import { useCallback, useRef } from "react";
...	@@ -13,6 +14,7 @@ import { refreshArchivedThreadsForEnvironment } from "../archive/useArchivedThre	...	@@ -13,6 +14,7 @@ import { refreshArchivedThreadsForEnvironment } from "../archive/useArchivedThre
13	import { pinOrderKeyBetween } from "@t3tools/client-runtime/state/thread-sort";	14	import { pinOrderKeyBetween } from "@t3tools/client-runtime/state/thread-sort";
14	import { appAtomRegistry } from "../../state/atom-registry";	15	import { appAtomRegistry } from "../../state/atom-registry";
15	import { environmentServerConfigsAtom } from "../../state/server";	16	import { environmentServerConfigsAtom } from "../../state/server";
		17	import { readEnvironmentScope } from "../../state/session";
16	import { environmentThreadShells, threadEnvironment } from "../../state/threads";	18	import { environmentThreadShells, threadEnvironment } from "../../state/threads";
17	import { queuedThreadKeysAtom } from "../../state/use-thread-outbox";	19	import { queuedThreadKeysAtom } from "../../state/use-thread-outbox";
18	import { useAtomCommand } from "../../state/use-atom-command";	20	import { useAtomCommand } from "../../state/use-atom-command";
...	@@ -108,6 +110,12 @@ function actionFailureTitle(action: ThreadListAction): string {	...	@@ -108,6 +110,12 @@ function actionFailureTitle(action: ThreadListAction): string {
108	return "Could not delete thread";	110	return "Could not delete thread";
109	}	111	}
110		112
		113	function checkThreadOperationPermission(thread: EnvironmentThreadShell, title: string): boolean {
		114	if (readEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope)) return true;
		115	Alert.alert(title, "This connection cannot change threads.");
		116	return false;
		117	}
		118
111	/** Resolves to true iff the action was dispatched and succeeded. */	119	/** Resolves to true iff the action was dispatched and succeeded. */
112	function useThreadActionExecutor(	120	function useThreadActionExecutor(
113	onCompleted?: (action: ThreadListAction, thread: EnvironmentThreadShell) => void,	121	onCompleted?: (action: ThreadListAction, thread: EnvironmentThreadShell) => void,
...	@@ -121,6 +129,7 @@ function useThreadActionExecutor(	...	@@ -121,6 +129,7 @@ function useThreadActionExecutor(
121		129
122	const executeAction = useCallback(	130	const executeAction = useCallback(
123	async (action: ThreadListAction, thread: EnvironmentThreadShell) => {	131	async (action: ThreadListAction, thread: EnvironmentThreadShell) => {
		132	if (!checkThreadOperationPermission(thread, actionFailureTitle(action))) return false;
124	const key = scopedThreadKey(thread.environmentId, thread.id);	133	const key = scopedThreadKey(thread.environmentId, thread.id);
125	if (inFlightThreadKeys.current.has(key)) {	134	if (inFlightThreadKeys.current.has(key)) {
126	return false;	135	return false;
...	@@ -205,6 +214,7 @@ function useConfirmDeleteThread(	...	@@ -205,6 +214,7 @@ function useConfirmDeleteThread(
205	) {	214	) {
206	return useCallback(	215	return useCallback(
207	(thread: EnvironmentThreadShell) => {	216	(thread: EnvironmentThreadShell) => {
		217	if (!checkThreadOperationPermission(thread, actionFailureTitle("delete"))) return;
208	const title = "Delete thread?";	218	const title = "Delete thread?";
209	const message = `“${thread.title}” will be permanently deleted, including its terminal history.`;	219	const message = `“${thread.title}” will be permanently deleted, including its terminal history.`;
210	if (process.env.EXPO_OS === "ios") {	220	if (process.env.EXPO_OS === "ios") {
...	@@ -281,6 +291,7 @@ export function useThreadListActions(): {	...	@@ -281,6 +291,7 @@ export function useThreadListActions(): {
281	);	291	);
282	const snoozeThread = useCallback(	292	const snoozeThread = useCallback(
283	async (thread: EnvironmentThreadShell, snoozedUntil: string) => {	293	async (thread: EnvironmentThreadShell, snoozedUntil: string) => {
		294	if (!checkThreadOperationPermission(thread, "Could not snooze thread")) return false;
284	const key = scopedThreadKey(thread.environmentId, thread.id);	295	const key = scopedThreadKey(thread.environmentId, thread.id);
285	if (snoozeInFlightThreadKeys.current.has(key)) {	296	if (snoozeInFlightThreadKeys.current.has(key)) {
286	return false;	297	return false;
...	@@ -336,6 +347,7 @@ export function useThreadListActions(): {	...	@@ -336,6 +347,7 @@ export function useThreadListActions(): {
336	);	347	);
337	const unsnoozeThread = useCallback(	348	const unsnoozeThread = useCallback(
338	async (thread: EnvironmentThreadShell) => {	349	async (thread: EnvironmentThreadShell) => {
		350	if (!checkThreadOperationPermission(thread, "Could not wake thread")) return false;
339	const key = scopedThreadKey(thread.environmentId, thread.id);	351	const key = scopedThreadKey(thread.environmentId, thread.id);
340	if (snoozeInFlightThreadKeys.current.has(key)) {	352	if (snoozeInFlightThreadKeys.current.has(key)) {
341	return false;	353	return false;
...	@@ -383,6 +395,7 @@ export function useThreadListActions(): {	...	@@ -383,6 +395,7 @@ export function useThreadListActions(): {
383	);	395	);
384	const pinThread = useCallback(	396	const pinThread = useCallback(
385	async (thread: EnvironmentThreadShell) => {	397	async (thread: EnvironmentThreadShell) => {
		398	if (!checkThreadOperationPermission(thread, "Could not pin thread")) return false;
386	if (!environmentSupportsPinning(thread.environmentId)) {	399	if (!environmentSupportsPinning(thread.environmentId)) {
387	Alert.alert(	400	Alert.alert(
388	"Could not pin thread",	401	"Could not pin thread",
...	@@ -423,6 +436,7 @@ export function useThreadListActions(): {	...	@@ -423,6 +436,7 @@ export function useThreadListActions(): {
423	);	436	);
424	const unpinThread = useCallback(	437	const unpinThread = useCallback(
425	async (thread: EnvironmentThreadShell) => {	438	async (thread: EnvironmentThreadShell) => {
		439	if (!checkThreadOperationPermission(thread, "Could not unpin thread")) return false;
426	if (!environmentSupportsPinning(thread.environmentId)) {	440	if (!environmentSupportsPinning(thread.environmentId)) {
427	Alert.alert(	441	Alert.alert(
428	"Could not unpin thread",	442	"Could not unpin thread",
...	@@ -479,6 +493,7 @@ export function useThreadListActions(): {	...	@@ -479,6 +493,7 @@ export function useThreadListActions(): {
479	);	493	);
480	const regenerateThreadTitle = useCallback(	494	const regenerateThreadTitle = useCallback(
481	async (thread: EnvironmentThreadShell) => {	495	async (thread: EnvironmentThreadShell) => {
		496	if (!checkThreadOperationPermission(thread, "Could not regenerate title")) return false;
482	const key = scopedThreadKey(thread.environmentId, thread.id);	497	const key = scopedThreadKey(thread.environmentId, thread.id);
483	if (	498	if (
484	thread.titleRegeneration != null \|\|	499	thread.titleRegeneration != null \|\|
...	@@ -572,6 +587,7 @@ export function useThreadListActions(): {	...	@@ -572,6 +587,7 @@ export function useThreadListActions(): {
572	});	587	});
573	const moveThread = useCallback(	588	const moveThread = useCallback(
574	async (thread: EnvironmentThreadShell, direction: ThreadMoveDestination) => {	589	async (thread: EnvironmentThreadShell, direction: ThreadMoveDestination) => {
		590	if (!checkThreadOperationPermission(thread, "Could not move thread")) return false;
575	if (getPendingThreadOrder() !== null \|\| appAtomRegistry.get(threadDropBusyAtom)) return false;	591	if (getPendingThreadOrder() !== null \|\| appAtomRegistry.get(threadDropBusyAtom)) return false;
576	const shells = appAtomRegistry.get(environmentThreadShells.threadShellsAtom);	592	const shells = appAtomRegistry.get(environmentThreadShells.threadShellsAtom);
577	const current = shells.find(	593	const current = shells.find(
...	@@ -648,6 +664,11 @@ export function useThreadListActions(): {	...	@@ -648,6 +664,11 @@ export function useThreadListActions(): {
648	const shellByKey = new Map(	664	const shellByKey = new Map(
649	shells.map((shell) => [scopedThreadKey(shell.environmentId, shell.id), shell]),	665	shells.map((shell) => [scopedThreadKey(shell.environmentId, shell.id), shell]),
650	);	666	);
		667	for (const assignment of assignments) {
		668	const target = shellByKey.get(assignment.id);
		669	if (target && !checkThreadOperationPermission(target, "Could not move thread"))
		670	return false;
		671	}
651	selectionHaptic();	672	selectionHaptic();
652	appAtomRegistry.set(threadDropBusyAtom, true);	673	appAtomRegistry.set(threadDropBusyAtom, true);
653	const pending = crossSection	674	const pending = crossSection
...	@@ -694,6 +715,7 @@ export function useThreadListActions(): {	...	@@ -694,6 +715,7 @@ export function useThreadListActions(): {
694	if (pending !== null && !pending.isPending()) return false;	715	if (pending !== null && !pending.isPending()) return false;
695	const target = shellByKey.get(assignment.id);	716	const target = shellByKey.get(assignment.id);
696	if (target === undefined) continue;	717	if (target === undefined) continue;
		718	if (!checkThreadOperationPermission(target, "Could not move thread")) return false;
697	const result = await reorder({	719	const result = await reorder({
698	environmentId: target.environmentId,	720	environmentId: target.environmentId,
699	input: { threadId: target.id, orderKey: assignment.orderKey },	721	input: { threadId: target.id, orderKey: assignment.orderKey },

...	@@ -148,6 +148,7 @@ import { useGlobalVoiceInput } from "../voice-input/VoiceInputProvider";	...	@@ -148,6 +148,7 @@ import { useGlobalVoiceInput } from "../voice-input/VoiceInputProvider";
148	export interface ThreadDetailScreenProps {	148	export interface ThreadDetailScreenProps {
149	readonly worktreeSetup?: WorktreeSetupCardProps \| null;	149	readonly worktreeSetup?: WorktreeSetupCardProps \| null;
150	readonly setupWorkingStartedAt?: string \| null;	150	readonly setupWorkingStartedAt?: string \| null;
		151	readonly canOperateThread: boolean;
151	readonly selectedThread: EnvironmentThreadShell;	152	readonly selectedThread: EnvironmentThreadShell;
152	readonly contentPresentation: ThreadContentPresentation;	153	readonly contentPresentation: ThreadContentPresentation;
153	readonly screenTone: StatusTone;	154	readonly screenTone: StatusTone;
...	@@ -1297,6 +1298,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread	...	@@ -1297,6 +1298,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread
1297	>	1298	>
1298	{props.activePendingApproval ? (	1299	{props.activePendingApproval ? (
1299	<PendingApprovalCard	1300	<PendingApprovalCard
		1301	canOperateThread={props.canOperateThread}
1300	approval={props.activePendingApproval}	1302	approval={props.activePendingApproval}
1301	respondingApprovalId={props.respondingApprovalId}	1303	respondingApprovalId={props.respondingApprovalId}
1302	onRespond={props.onRespondToApproval}	1304	onRespond={props.onRespondToApproval}
...	@@ -1304,6 +1306,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread	...	@@ -1304,6 +1306,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread
1304	) : null}	1306	) : null}
1305	{props.activePendingUserInput ? (	1307	{props.activePendingUserInput ? (
1306	<PendingUserInputCard	1308	<PendingUserInputCard
		1309	canOperateThread={props.canOperateThread}
1307	pendingUserInput={props.activePendingUserInput}	1310	pendingUserInput={props.activePendingUserInput}
1308	maxHeight={pendingUserInputMaxHeight}	1311	maxHeight={pendingUserInputMaxHeight}
1309	collapsed={userInputCollapsed}	1312	collapsed={userInputCollapsed}
...	@@ -1371,6 +1374,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread	...	@@ -1371,6 +1374,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread
1371	) : (	1374	) : (
1372	<>	1375	<>
1373	<ThreadComposer	1376	<ThreadComposer
		1377	canOperateThread={props.canOperateThread}
1374	reportedModelSelection={reportedModelSelection}	1378	reportedModelSelection={reportedModelSelection}
1375	editorRef={composerEditorRef}	1379	editorRef={composerEditorRef}
1376	draftMessage={props.draftMessage}	1380	draftMessage={props.draftMessage}

...	@@ -17,7 +17,7 @@ import type {	...	@@ -17,7 +17,7 @@ import type {
17	EnvironmentThreadShell,	17	EnvironmentThreadShell,
18	} from "@t3tools/client-runtime/state/shell";	18	} from "@t3tools/client-runtime/state/shell";
19	import type { EnvironmentThreadSearchMatch } from "@t3tools/client-runtime/state/thread-search";	19	import type { EnvironmentThreadSearchMatch } from "@t3tools/client-runtime/state/thread-search";
20	import type { EnvironmentMachineKind } from "@t3tools/contracts";	20	import { AuthOrchestrationOperateScope, type EnvironmentMachineKind } from "@t3tools/contracts";
21	import { canSnooze, resolveSnoozePresets } from "@t3tools/client-runtime/state/thread-settled";	21	import { canSnooze, resolveSnoozePresets } from "@t3tools/client-runtime/state/thread-settled";
22	import type { MenuAction } from "@react-native-menu/menu";	22	import type { MenuAction } from "@react-native-menu/menu";
23	import { memo, useCallback, useEffect, useMemo, useState, type ComponentProps } from "react";	23	import { memo, useCallback, useEffect, useMemo, useState, type ComponentProps } from "react";
...	@@ -34,6 +34,7 @@ import { ProviderIcon, ProviderInstanceIcon } from "../../components/ProviderIco	...	@@ -34,6 +34,7 @@ import { ProviderIcon, ProviderInstanceIcon } from "../../components/ProviderIco
34	import { cn } from "../../lib/cn";	34	import { cn } from "../../lib/cn";
35	import { copyTextWithHaptic } from "../../lib/copyTextWithHaptic";	35	import { copyTextWithHaptic } from "../../lib/copyTextWithHaptic";
36	import { useUniwindTheme } from "../../lib/useUniwindTheme";	36	import { useUniwindTheme } from "../../lib/useUniwindTheme";
		37	import { useEnvironmentScope } from "../../state/session";
37	import type { PendingNewTask } from "../../state/use-pending-new-tasks";	38	import type { PendingNewTask } from "../../state/use-pending-new-tasks";
38	import { useThreadPr } from "../../state/use-thread-pr";	39	import { useThreadPr } from "../../state/use-thread-pr";
39	import { useSwipeRowDormant } from "../home/swipe-row-activation";	40	import { useSwipeRowDormant } from "../home/swipe-row-activation";
...	@@ -600,6 +601,7 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {	...	@@ -600,6 +601,7 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
600		601
601	const handleDelete = useCallback(() => onDeleteThread(thread), [onDeleteThread, thread]);	602	const handleDelete = useCallback(() => onDeleteThread(thread), [onDeleteThread, thread]);
602	const handleRename = useCallback(() => onRenameThread(thread), [onRenameThread, thread]);	603	const handleRename = useCallback(() => onRenameThread(thread), [onRenameThread, thread]);
		604	const canOperateThread = useEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope);
603	const handleRegenerateTitle = useCallback(	605	const handleRegenerateTitle = useCallback(
604	() => onRegenerateThreadTitle(thread),	606	() => onRegenerateThreadTitle(thread),
605	[onRegenerateThreadTitle, thread],	607	[onRegenerateThreadTitle, thread],
...	@@ -917,8 +919,9 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {	...	@@ -917,8 +919,9 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
917	: null,	919	: null,
918	[handleMenuAction, snoozePresetActions, swipeActions.secondary, thread.title],	920	[handleMenuAction, snoozePresetActions, swipeActions.secondary, thread.title],
919	);	921	);
920	const swipeAccessibilityHint =	922	const swipeAccessibilityHint = !canOperateThread
921	secondaryAction === null	923	? "Opens the thread"
		924	: secondaryAction === null
922	? `Opens the thread. Swipe left to ${primaryAction.label.toLowerCase()}.`	925	? `Opens the thread. Swipe left to ${primaryAction.label.toLowerCase()}.`
923	: `Opens the thread. Swipe left for ${primaryAction.label.toLowerCase()} and snooze actions.`;	926	: `Opens the thread. Swipe left for ${primaryAction.label.toLowerCase()} and snooze actions.`;
924		927
...	@@ -1224,6 +1227,8 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {	...	@@ -1224,6 +1227,8 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
1224	</RowPressable>	1227	</RowPressable>
1225	);	1228	);
1226		1229
		1230	if (!canOperateThread) return rowContent(() => {});
		1231
1227	return (	1232	return (
1228	<View collapsable={false}>	1233	<View collapsable={false}>
1229	{customSnoozeOpen && (	1234	{customSnoozeOpen && (

...	@@ -2,6 +2,7 @@ import { DeviceHostUpdates } from "./DeviceHostUpdates";	...	@@ -2,6 +2,7 @@ import { DeviceHostUpdates } from "./DeviceHostUpdates";
2	import type { DevicePlatform, DeviceServiceState, EnvironmentId } from "@t3tools/contracts";	2	import type { DevicePlatform, DeviceServiceState, EnvironmentId } from "@t3tools/contracts";
3	import { Check } from "lucide-react";	3	import { Check } from "lucide-react";
4	import { Check as CheckGlyph, CircleAlert } from "lucide";	4	import { Check as CheckGlyph, CircleAlert } from "lucide";
		5	import { AuthSettingsWriteScope } from "@t3tools/contracts";
5	import { useState } from "react";	6	import { useState } from "react";
6		7
7	import { Button } from "~/components/ui/button";	8	import { Button } from "~/components/ui/button";
...	@@ -12,6 +13,7 @@ import { Spinner } from "~/components/ui/spinner";	...	@@ -12,6 +13,7 @@ import { Spinner } from "~/components/ui/spinner";
12	import { Switch } from "~/components/ui/switch";	13	import { Switch } from "~/components/ui/switch";
13	import { deviceEnvironment } from "~/state/device";	14	import { deviceEnvironment } from "~/state/device";
14	import { useAtomCommand } from "~/state/use-atom-command";	15	import { useAtomCommand } from "~/state/use-atom-command";
		16	import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
15	import { cn } from "~/lib/utils";	17	import { cn } from "~/lib/utils";
16		18
17	const platformName = (platform: DevicePlatform) => (platform === "ios" ? "iOS" : "Android");	19	const platformName = (platform: DevicePlatform) => (platform === "ios" ? "iOS" : "Android");
...	@@ -57,6 +59,7 @@ export function DeviceSetup(props: {	...	@@ -57,6 +59,7 @@ export function DeviceSetup(props: {
57	readonly state: DeviceServiceState;	59	readonly state: DeviceServiceState;
58	readonly onComplete?: () => void;	60	readonly onComplete?: () => void;
59	}) {	61	}) {
		62	const canConfigure = useEnvironmentScope(props.environmentId, AuthSettingsWriteScope);
60	const configure = useAtomCommand(deviceEnvironment.configure);	63	const configure = useAtomCommand(deviceEnvironment.configure);
61	const list = useAtomCommand(deviceEnvironment.list, { reportFailure: false });	64	const list = useAtomCommand(deviceEnvironment.list, { reportFailure: false });
62	const [pending, setPending] = useState<"hub" \| "check" \| "agent" \| "complete" \| null>(null);	65	const [pending, setPending] = useState<"hub" \| "check" \| "agent" \| "complete" \| null>(null);
...	@@ -71,6 +74,7 @@ export function DeviceSetup(props: {	...	@@ -71,6 +74,7 @@ export function DeviceSetup(props: {
71	kind: NonNullable<typeof pending>,	74	kind: NonNullable<typeof pending>,
72	input: { enabled?: boolean; agentAccessEnabled?: boolean; onboardingCompleted?: boolean },	75	input: { enabled?: boolean; agentAccessEnabled?: boolean; onboardingCompleted?: boolean },
73	) => {	76	) => {
		77	if (!readEnvironmentScope(props.environmentId, AuthSettingsWriteScope)) return;
74	setPending(kind);	78	setPending(kind);
75	try {	79	try {
76	const result = await configure({ environmentId: props.environmentId, input });	80	const result = await configure({ environmentId: props.environmentId, input });
...	@@ -103,7 +107,7 @@ export function DeviceSetup(props: {	...	@@ -103,7 +107,7 @@ export function DeviceSetup(props: {
103	<p className="text-muted-foreground">{deviceHubDescription}</p>	107	<p className="text-muted-foreground">{deviceHubDescription}</p>
104	<Switch	108	<Switch
105	checked={enabled}	109	checked={enabled}
106	disabled={busy \|\| pending !== null}	110	disabled={!canConfigure \|\| busy \|\| pending !== null}
107	aria-label="Enable device hub"	111	aria-label="Enable device hub"
108	onCheckedChange={(checked) =>	112	onCheckedChange={(checked) =>
109	void update("hub", {	113	void update("hub", {
...	@@ -144,7 +148,7 @@ export function DeviceSetup(props: {	...	@@ -144,7 +148,7 @@ export function DeviceSetup(props: {
144	<p className="text-muted-foreground">{agentDeviceDescription}</p>	148	<p className="text-muted-foreground">{agentDeviceDescription}</p>
145	<Switch	149	<Switch
146	checked={props.state.agentAccessEnabled}	150	checked={props.state.agentAccessEnabled}
147	disabled={!enabled \|\| busy \|\| pending !== null}	151	disabled={!canConfigure \|\| !enabled \|\| busy \|\| pending !== null}
148	aria-label="Allow agents to control devices"	152	aria-label="Allow agents to control devices"
149	onCheckedChange={(checked) =>	153	onCheckedChange={(checked) =>
150	void update("agent", { agentAccessEnabled: Boolean(checked) })	154	void update("agent", { agentAccessEnabled: Boolean(checked) })
...	@@ -185,7 +189,7 @@ export function DeviceSetup(props: {	...	@@ -185,7 +189,7 @@ export function DeviceSetup(props: {
185	</Button>	189	</Button>
186	) : (	190	) : (
187	<Button	191	<Button
188	disabled={props.state.hostStatus !== "ready" \|\| pending !== null}	192	disabled={!canConfigure \|\| props.state.hostStatus !== "ready" \|\| pending !== null}
189	onClick={() => void update("complete", { onboardingCompleted: true })}	193	onClick={() => void update("complete", { onboardingCompleted: true })}
190	>	194	>
191	{pending === "complete" ? "Saving…" : "Done"}	195	{pending === "complete" ? "Saving…" : "Done"}

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { AuthEnvironmentMaintainScope } from "@t3tools/contracts";
1	import type {	2	import type {
2	EnvironmentId,	3	EnvironmentId,
3	ResourceTelemetryHistoryInput,	4	ResourceTelemetryHistoryInput,
...	@@ -9,6 +10,7 @@ import { useCallback } from "react";	...	@@ -9,6 +10,7 @@ import { useCallback } from "react";
9	import { usePrimaryEnvironment } from "../state/environments";	10	import { usePrimaryEnvironment } from "../state/environments";
10	import { useEnvironmentQuery } from "../state/query";	11	import { useEnvironmentQuery } from "../state/query";
11	import { serverEnvironment } from "../state/server";	12	import { serverEnvironment } from "../state/server";
		13	import { readEnvironmentScope } from "../state/session";
12	import { useAtomCommand } from "../state/use-atom-command";	14	import { useAtomCommand } from "../state/use-atom-command";
13		15
14	export interface ResourceTelemetryState {	16	export interface ResourceTelemetryState {
...	@@ -39,6 +41,9 @@ export function useResourceTelemetry(	...	@@ -39,6 +41,9 @@ export function useResourceTelemetry(
39	if (environmentId === null) {	41	if (environmentId === null) {
40	throw new Error("No environment is selected.");	42	throw new Error("No environment is selected.");
41	}	43	}
		44	if (!readEnvironmentScope(environmentId, AuthEnvironmentMaintainScope)) {
		45	throw new Error("This connection cannot restart the resource monitor.");
		46	}
42	const result = await retryCommand({ environmentId, input: {} });	47	const result = await retryCommand({ environmentId, input: {} });
43	if (result._tag === "Failure") {	48	if (result._tag === "Failure") {
44	throw Cause.squash(result.cause);	49	throw Cause.squash(result.cause);

...	@@ -9,6 +9,7 @@ import noMobileUniwindThemeEscapeHatches from "./rules/no-mobile-uniwind-theme-e	...	@@ -9,6 +9,7 @@ import noMobileUniwindThemeEscapeHatches from "./rules/no-mobile-uniwind-theme-e
9	import noNativeTitleTooltip from "./rules/no-native-title-tooltip.ts";	9	import noNativeTitleTooltip from "./rules/no-native-title-tooltip.ts";
10	import noRawMcpRegistration from "./rules/no-raw-mcp-registration.ts";	10	import noRawMcpRegistration from "./rules/no-raw-mcp-registration.ts";
11	import noTestInLoop from "./rules/no-test-in-loop.ts";	11	import noTestInLoop from "./rules/no-test-in-loop.ts";
		12	import noRpcPermissionBypass from "./rules/no-rpc-permission-bypass.ts";
12	import noUnscopedHas from "./rules/no-unscoped-has.ts";	13	import noUnscopedHas from "./rules/no-unscoped-has.ts";
13	import preferCatchTags from "./rules/prefer-catch-tags.ts";	14	import preferCatchTags from "./rules/prefer-catch-tags.ts";
14	import requireSuppressionReason from "./rules/require-suppression-reason.ts";	15	import requireSuppressionReason from "./rules/require-suppression-reason.ts";
...	@@ -27,6 +28,7 @@ export default definePlugin({	...	@@ -27,6 +28,7 @@ export default definePlugin({
27	"no-native-title-tooltip": noNativeTitleTooltip,	28	"no-native-title-tooltip": noNativeTitleTooltip,
28	"no-raw-mcp-registration": noRawMcpRegistration,	29	"no-raw-mcp-registration": noRawMcpRegistration,
29	"no-test-in-loop": noTestInLoop,	30	"no-test-in-loop": noTestInLoop,
		31	"no-rpc-permission-bypass": noRpcPermissionBypass,
30	"no-unscoped-has": noUnscopedHas,	32	"no-unscoped-has": noUnscopedHas,
31	"prefer-catch-tags": preferCatchTags,	33	"prefer-catch-tags": preferCatchTags,
32	"require-suppression-reason": requireSuppressionReason,	34	"require-suppression-reason": requireSuppressionReason,

feat(auth): separate environment administration permissions (#9786)