Commit 2eda8ac6a3151b70b8ee49b438bfb6fcd835802e | the-knife

apps/mobile/src/features/projects/AddProjectScreen.test.ts created+273

...	@@ -0,0 +1,273 @@
1	import * as NodeFS from "node:fs";
2	import * as NodeFSP from "node:fs/promises";
3	import * as NodeOS from "node:os";
4	import * as NodePath from "node:path";
5	import { AuthOrchestrationOperateScope, AuthSourceControlWriteScope } from "@t3tools/contracts";
6	import * as Cause from "effect/Cause";
7	import { AsyncResult } from "effect/reactivity";
8	import { isValidElement, type ReactNode } from "react";
9	import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
10
11	const state = vi.hoisted(() => ({
12	scopes: new Set<string>(),
13	otherScopes: new Set<string>(),
14	baseDirectory: "",
15	projects: [] as string[],
16	createRequests: [] as { environmentId: string; workspaceRoot: string }[],
17	}));
18
19	vi.mock("react", async (importOriginal) => ({
20	...(await importOriginal<typeof import("react")>()),
21	useCallback: (callback: unknown) => callback,
22	useMemo: (factory: () => unknown) => factory(),
23	useState: (initial: unknown) => [typeof initial === "function" ? initial() : initial, () => {}],
24	useRef: (current: unknown) => ({ current }),
25	useEffect: () => {},
26	}));
27	vi.mock("../../components/MaterialListRow", () => ({ MaterialListRow: "MaterialListRow" }));
28	vi.mock("../../components/MaterialButton", () => ({ MaterialButton: "MaterialButton" }));
29	vi.mock("../../components/ScreenScrollView", () => ({ ScreenScrollView: "ScrollView" }));
30	vi.mock("../settings/components/SettingsScreen", () => ({ SettingsScreen: "SettingsScreen" }));
31	vi.mock("../../components/ThemedSwitch", () => ({ ThemedSwitch: "Switch" }));
32	vi.mock("react-native", () => ({
33	Platform: { OS: "ios" },
34	ActivityIndicator: "ActivityIndicator",
35	Alert: { alert: () => {} },
36	Pressable: "Pressable",
37	ScrollView: "ScrollView",
38	View: "View",
39	}));
40	vi.mock("@react-navigation/native", () => ({
41	useNavigation: () => ({ dispatch: () => {} }),
42	CommonActions: { reset: (input: unknown) => input },
43	StackActions: {},
44	}));
45	vi.mock("react-native-safe-area-context", () => ({
46	useSafeAreaInsets: () => ({ bottom: 0 }),
47	}));
48	vi.mock("../../components/AppSymbol", () => ({ SymbolView: "SymbolView" }));
49	vi.mock("../../components/AppText", () => ({ AppText: "Text", AppTextInput: "TextInput" }));
50	vi.mock("../../components/EnvironmentMachineSymbol", () => ({
51	EnvironmentMachineSymbol: "EnvironmentMachineSymbol",
52	}));
53	vi.mock("../../components/ErrorBanner", () => ({ ErrorBanner: "ErrorBanner" }));
54	vi.mock("../../components/SourceControlIcon", () => ({ SourceControlIcon: "SourceControlIcon" }));
55	vi.mock("../../lib/uuid", () => ({ uuidv4: () => "project" }));
56	vi.mock("../../state/session", () => ({
57	useEnvironmentScope: (environmentId: string, scope: string) =>
58	(environmentId === "environment" ? state.scopes : state.otherScopes).has(scope),
59	readEnvironmentScope: (environmentId: string, scope: string) =>
60	(environmentId === "environment" ? state.scopes : state.otherScopes).has(scope),
61	}));
62	vi.mock("../../state/entities", () => ({
63	useProjects: () => [],
64	useServerConfigs: () =>
65	new Map([
66	[
67	"environment",
68	{
69	environment: { platform: { os: "linux" }, capabilities: {} },
70	settings: { addProjectBaseDirectory: state.baseDirectory },
71	},
72	],
73	[
74	"other-environment",
75	{
76	environment: { platform: { os: "linux" }, capabilities: {} },
77	settings: { addProjectBaseDirectory: state.baseDirectory },
78	},
79	],
80	]),
81	}));
82	vi.mock("../../state/use-remote-environment-registry", () => ({
83	useRemoteEnvironmentRuntime: () => ({ connectionState: "connected" }),
84	useRemoteConnectionStatus: () => ({
85	connectedEnvironments: [
86	{ environmentId: "environment", connectionState: "connected" },
87	{ environmentId: "other-environment", connectionState: "connected" },
88	],
89	}),
90	useSavedRemoteConnections: () => ({
91	savedConnectionsById: {
92	connection: { environmentId: "environment", environmentLabel: "Environment" },
93	other: { environmentId: "other-environment", environmentLabel: "Other environment" },
94	},
95	}),
96	}));
97	vi.mock("../../state/use-atom-command", () => ({ useAtomCommand: (command: unknown) => command }));
98	vi.mock("../../state/use-atom-query-runner", () => ({ useAtomQueryRunner: () => () => {} }));
99	vi.mock("../../state/query", () => ({ useEnvironmentQuery: () => ({ data: null }) }));
100	vi.mock("../../state/presentation", () => ({
101	useEnvironmentPresentation: () => ({ isReady: true, presentation: null }),
102	}));
103	vi.mock("../../state/filesystem", () => ({ filesystemEnvironment: {} }));
104	vi.mock("../../state/sourceControl", () => ({
105	sourceControlEnvironment: {
106	cloneRepository: async ({ input }: { input: { destinationPath: string } }) => {
107	NodeFS.mkdirSync(input.destinationPath);
108	return AsyncResult.success({ cwd: input.destinationPath });
109	},
110	},
111	}));
112	vi.mock("../../state/projects", () => ({
113	projectEnvironment: {
114	create: async ({
115	environmentId,
116	input,
117	}: {
118	environmentId: string;
119	input: { workspaceRoot: string };
120	}) => {
121	state.createRequests.push({ environmentId, workspaceRoot: input.workspaceRoot });
122	const scopes = environmentId === "environment" ? state.scopes : state.otherScopes;
123	if (!scopes.has(AuthOrchestrationOperateScope)) {
124	return AsyncResult.failure(Cause.fail(new Error("Project creation denied")));
125	}
126	state.projects.push(input.workspaceRoot);
127	return AsyncResult.success(undefined);
128	},
129	},
130	}));
131
132	import { AddProjectDestinationScreen, AddProjectLocalFolderScreen } from "./AddProjectScreen";
133
134	function findAction(node: ReactNode, label: string): (() => unknown) \| null {
135	if (Array.isArray(node)) {
136	for (const child of node) {
137	const action = findAction(child, label);
138	if (action) return action;
139	}
140	return null;
141	}
142	if (!isValidElement<{ label?: string; onPress?: () => unknown; children?: ReactNode }>(node)) {
143	return null;
144	}
145	if (node.props.label === label) return node.props.onPress ?? null;
146	return findAction(node.props.children, label);
147	}
148
149	function cloneAction() {
150	const action = findAction(
151	AddProjectDestinationScreen({
152	environmentId: "environment",
153	remoteUrl: "https://example.com/repo.git",
154	repositoryName: "repo",
155	}),
156	"Clone project",
157	);
158	if (!action) throw new Error("Clone action missing");
159	return action;
160	}
161
162	function localProjectAction(environmentId = "environment") {
163	const action = findAction(AddProjectLocalFolderScreen({ environmentId }), "Add project");
164	if (!action) throw new Error("Add project action missing");
165	return action;
166	}
167
168	describe("clone project permissions", () => {
169	beforeEach(async () => {
170	state.baseDirectory = await NodeFSP.mkdtemp(
171	NodePath.join(NodeOS.tmpdir(), "t3-clone-permissions-"),
172	);
173	state.scopes = new Set([AuthSourceControlWriteScope]);
174	state.otherScopes = new Set();
175	state.projects = [];
176	state.createRequests = [];
177	});
178
179	afterEach(async () => {
180	await NodeFSP.rm(state.baseDirectory, { recursive: true, force: true });
181	});
182
183	it("does not leave a clone on disk when project creation is denied", async () => {
184	await cloneAction()();
185
186	expect(NodeFS.existsSync(NodePath.join(state.baseDirectory, "repo"))).toBe(false);
187	expect(state.projects).toEqual([]);
188	});
189
190	it("clones and registers the project when both permissions are granted", async () => {
191	state.scopes.add(AuthOrchestrationOperateScope);
192	await cloneAction()();
193
194	const destination = NodePath.join(state.baseDirectory, "repo");
195	expect(NodeFS.existsSync(destination)).toBe(true);
196	expect(state.projects).toEqual([destination]);
197	});
198
199	it.each([AuthSourceControlWriteScope, AuthOrchestrationOperateScope])(
200	"rechecks %s before a retained clone action creates a directory",
201	async (scope) => {
202	state.scopes.add(AuthOrchestrationOperateScope);
203	const submit = cloneAction();
204	state.scopes.delete(scope);
205	await submit();
206
207	expect(NodeFS.existsSync(NodePath.join(state.baseDirectory, "repo"))).toBe(false);
208	expect(state.projects).toEqual([]);
209	},
210	);
211	});
212
213	describe("local project permissions", () => {
214	beforeEach(() => {
215	state.baseDirectory = "/workspace/project";
216	state.scopes = new Set();
217	state.otherScopes = new Set();
218	state.projects = [];
219	state.createRequests = [];
220	});
221
222	it.each([false, true])(
223	"does not dispatch project creation without the current grant (revoked: %s)",
224	async (revokeBeforeSubmit) => {
225	if (revokeBeforeSubmit) state.scopes.add(AuthOrchestrationOperateScope);
226	const submit = localProjectAction();
227	state.scopes.delete(AuthOrchestrationOperateScope);
228
229	await submit();
230
231	expect(state.createRequests).toEqual([]);
232	expect(state.projects).toEqual([]);
233	},
234	);
235
236	it("adds a typed local path with only task-operation permission", async () => {
237	state.scopes.add(AuthOrchestrationOperateScope);
238
239	await localProjectAction()();
240
241	expect(state.createRequests).toEqual([
242	{ environmentId: "environment", workspaceRoot: state.baseDirectory },
243	]);
244	expect(state.projects).toEqual([state.baseDirectory]);
245	});
246
247	it("uses a grant added while the local-folder form is open", async () => {
248	const submit = localProjectAction();
249	state.scopes.add(AuthOrchestrationOperateScope);
250
251	await submit();
252
253	expect(state.projects).toEqual([state.baseDirectory]);
254	});
255
256	it.each([false, true])(
257	"uses the selected environment's grant (allowed: %s)",
258	async (allowSelectedEnvironment) => {
259	(allowSelectedEnvironment ? state.otherScopes : state.scopes).add(
260	AuthOrchestrationOperateScope,
261	);
262
263	await localProjectAction("other-environment")();
264
265	expect(state.createRequests).toEqual(
266	allowSelectedEnvironment
267	? [{ environmentId: "other-environment", workspaceRoot: state.baseDirectory }]
268	: [],
269	);
270	expect(state.projects).toEqual(allowSelectedEnvironment ? [state.baseDirectory] : []);
271	},
272	);
273	});

apps/mobile/src/features/projects/AddProjectScreen.tsx+72-21

 @@ -39,6 +39,8 @@ import {
   isWindowsPlatform,
 } from "@t3tools/client-runtime/state/projects";
 import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
   CommandId,
   type EnvironmentId,
   type EnvironmentMachineKind,
 @@ -59,6 +61,7 @@ import { useProjects, useServerConfigs, waitForProject } from "../../state/entit
 import { filesystemEnvironment } from "../../state/filesystem";
 import { projectEnvironment } from "../../state/projects";
 import { useEnvironmentQuery } from "../../state/query";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
 import { sourceControlEnvironment } from "../../state/sourceControl";
 import { AppText as Text, AppTextInput as TextInput } from "../../components/AppText";
 import { EnvironmentMachineSymbol } from "../../components/EnvironmentMachineSymbol";
 @@ -522,6 +525,15 @@ export function AddProjectSourceScreen() {
   const navigation = useNavigation();
   const { environmentOptions, selectedEnvironment, setSelectedEnvironmentId } =
     useSelectedEnvironment();
+  const canWriteSourceControl = useEnvironmentScope(
+    selectedEnvironment?.environmentId ?? null,
+    AuthSourceControlWriteScope,
+  );
+  const canCreateProject = useEnvironmentScope(
+    selectedEnvironment?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
+  const canCloneProject = canWriteSourceControl && canCreateProject;
   const discoveryState = useEnvironmentQuery(
     selectedEnvironment === null
       ? null
 @@ -610,7 +622,11 @@ export function AddProjectSourceScreen() {
             ) : null}
             <ListRow
               title="Local folder"
-              subtitle="Browse a folder on disk"
+              subtitle={
+                canCreateProject
+                  ? "Browse a folder on disk"
+                  : "This connection cannot add projects."
+              }
               icon={
                 <SymbolView
                   name="folder.badge.plus"
 @@ -620,6 +636,7 @@ export function AddProjectSourceScreen() {
                 />
               }
               isFirst={selectedEnvironment.newProjectsRoot === null}
+              disabled={!canCreateProject}
               onPress={() =>
                 navigation.dispatch(
                   StackActions.push("AddProjectLocal", {
 @@ -634,11 +651,13 @@ export function AddProjectSourceScreen() {
                   key={candidate}
                   source={candidate}
                   selectedEnvironmentId={selectedEnvironment.environmentId}
-                  ready={readiness[candidate].ready}
+                  ready={canCloneProject && readiness[candidate].ready}
                   hint={
-                    readiness[candidate].ready
+                    !canCloneProject
-                      ? addProjectRemoteSourcePathHint(candidate)
+                      ? "This connection cannot clone projects."
-                      : (readiness[candidate].hint ?? "")
+                      : readiness[candidate].ready
+                        ? addProjectRemoteSourcePathHint(candidate)
+                        : (readiness[candidate].hint ?? "")
                   }
                   isFirst={false}
                 />
 @@ -670,7 +689,17 @@ function useCreateProject(environment: EnvironmentOption | null) {
   return useCallback(
     async (workspaceRoot: string) => {
-      if (!environment || !canCreateProjectInEnvironment(environment.connectionState)) return;
+      if (
+        !environment ||
+        !canCreateProjectInEnvironment(environment.connectionState) ||
+        !readEnvironmentScope(environment.environmentId, AuthOrchestrationOperateScope)
+      ) {
+        Alert.alert(
+          "Project not added",
+          `This connection cannot add projects right now. Any existing files remain at ${workspaceRoot}.`,
+        );
+        return;
+      }
       const existing = findExistingAddProject({
         projects,
 @@ -1159,6 +1188,10 @@ export function AddProjectNewScreen(props: { readonly environmentId?: string | s
 export function AddProjectLocalFolderScreen(props: { readonly environmentId?: string | string[] }) {
   const environment = useEnvironmentFromParam(props.environmentId);
+  const canCreateProject = useEnvironmentScope(
+    environment?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
   const createProject = useCreateProject(environment);
   const { isBrowseNavigating, navigateToBrowsePath, pathInput, setPathInput } =
     useBrowsePathInput(environment);
 @@ -1191,15 +1224,14 @@ export function AddProjectLocalFolderScreen(props: { readonly environmentId?: st
       {error ? <ErrorBanner message={error} /> : null}
       {environment ? (
         <>
-          <ProjectPathInput
+          {!canCreateProject ? (
-            value={pathInput}
+            <ErrorBanner message="This connection cannot add projects." />
-            onChangeText={setPathInput}
+          ) : null}
-            onSubmit={() => void submitPath()}
+          <ProjectPathInput value={pathInput} onChangeText={setPathInput} onSubmit={submitPath} />
-          />
           <PrimaryActionButton
             label="Add project"
-            disabled={isBrowseNavigating || isSubmitting}
+            disabled={!canCreateProject || isBrowseNavigating || isSubmitting}
-            onPress={() => void submitPath()}
+            onPress={submitPath}
             loading={isSubmitting}
           />
           <FolderBrowser
 @@ -1230,6 +1262,15 @@ export function AddProjectDestinationScreen(props: {
   });
   const navigation = useNavigation();
   const environment = useEnvironmentFromParam(props.environmentId);
+  const canWriteSourceControl = useEnvironmentScope(
+    environment?.environmentId ?? null,
+    AuthSourceControlWriteScope,
+  );
+  const canCreateProject = useEnvironmentScope(
+    environment?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
+  const canCloneProject = canWriteSourceControl && canCreateProject;
   const createProject = useCreateProject(environment);
   const remoteUrl = stringParam(props.remoteUrl);
   const repositoryTitle = stringParam(props.repositoryTitle);
 @@ -1246,7 +1287,16 @@ export function AddProjectDestinationScreen(props: {
   const [error, setError] = useState<string | null>(null);
   const submitPath = useCallback(async () => {
-    if (!environment || !remoteUrl || isBrowseNavigating || isSubmitting) return;
+    if (
+      !environment ||
+      !readEnvironmentScope(environment.environmentId, AuthSourceControlWriteScope) ||
+      !readEnvironmentScope(environment.environmentId, AuthOrchestrationOperateScope) ||
+      !remoteUrl ||
+      isBrowseNavigating ||
+      isSubmitting
+    ) {
+      return;
+    }
     setError(null);
     const resolved = resolveAddProjectPath({
       rawPath: pathInput,
 @@ -1342,17 +1392,18 @@ export function AddProjectDestinationScreen(props: {
       ) : null}
       {environment ? (
         <>
-          <ProjectPathInput
+          <ProjectPathInput value={pathInput} onChangeText={setPathInput} onSubmit={submitPath} />
-            value={pathInput}
-            onChangeText={setPathInput}
-            onSubmit={() => void submitPath()}
-          />
           <PrimaryActionButton
             label="Clone project"
-            disabled={isBrowseNavigating || isSubmitting || !remoteUrl}
+            disabled={!canCloneProject || isBrowseNavigating || isSubmitting || !remoteUrl}
-            onPress={() => void submitPath()}
+            onPress={submitPath}
             loading={isSubmitting}
           />
+          {!canCloneProject ? (
+            <Text className="text-sm text-foreground-muted">
+              This connection cannot clone projects.
+            </Text>
+          ) : null}
           <FolderBrowser
             environment={environment}
             navigateToBrowsePath={navigateToBrowsePath}

apps/mobile/src/features/threads/NewTaskContextPickerScreens.tsx+14-2

...	@@ -1,7 +1,8 @@	...	@@ -1,7 +1,8 @@
1	import { MaterialListRow } from "../../components/MaterialListRow";	1	import { MaterialListRow } from "../../components/MaterialListRow";
2	import type { EnvironmentProject } from "@t3tools/client-runtime/state/shell";	2	import type { EnvironmentProject } from "@t3tools/client-runtime/state/shell";
		3	import { shouldCheckoutNewTaskBranch } from "./new-task-context-presentation";
3	import type { VcsRef } from "@t3tools/client-runtime/state/vcs";	4	import type { VcsRef } from "@t3tools/client-runtime/state/vcs";
4	import { resolveEnvironmentMachineKind } from "@t3tools/contracts";	5	import { AuthSourceControlWriteScope, resolveEnvironmentMachineKind } from "@t3tools/contracts";
5	import { LegendList } from "@legendapp/list/react-native";	6	import { LegendList } from "@legendapp/list/react-native";
6	import {	7	import {
7	isAtomCommandInterrupted,	8	isAtomCommandInterrupted,
...	@@ -30,6 +31,7 @@ import { ThemedSwitch } from "../../components/ThemedSwitch";	...	@@ -30,6 +31,7 @@ import { ThemedSwitch } from "../../components/ThemedSwitch";
30	import { cn } from "../../lib/cn";	31	import { cn } from "../../lib/cn";
31	import { NativeHeaderToolbar, NativeStackScreenOptions } from "../../native/StackHeader";	32	import { NativeHeaderToolbar, NativeStackScreenOptions } from "../../native/StackHeader";
32	import { useServerConfigs } from "../../state/entities";	33	import { useServerConfigs } from "../../state/entities";
		34	import { useEnvironmentScope } from "../../state/session";
33	import { useAtomCommand } from "../../state/use-atom-command";	35	import { useAtomCommand } from "../../state/use-atom-command";
34	import { vcsEnvironment } from "../../state/vcs";	36	import { vcsEnvironment } from "../../state/vcs";
35	import {	37	import {
...	@@ -264,6 +266,10 @@ export function NewTaskEnvironmentPickerRouteScreen() {	...	@@ -264,6 +266,10 @@ export function NewTaskEnvironmentPickerRouteScreen() {
264		266
265	export function NewTaskBranchPickerRouteScreen() {	267	export function NewTaskBranchPickerRouteScreen() {
266	const flow = useNewTaskFlow();	268	const flow = useNewTaskFlow();
		269	const canWriteSourceControl = useEnvironmentScope(
		270	flow.selectedProject?.environmentId ?? null,
		271	AuthSourceControlWriteScope,
		272	);
267	const navigation = useNavigation();	273	const navigation = useNavigation();
268	const switchRef = useAtomCommand(vcsEnvironment.switchRef, { reportFailure: false });	274	const switchRef = useAtomCommand(vcsEnvironment.switchRef, { reportFailure: false });
269	const [switchingBranchName, setSwitchingBranchName] = useState<string \| null>(null);	275	const [switchingBranchName, setSwitchingBranchName] = useState<string \| null>(null);
...	@@ -291,7 +297,12 @@ export function NewTaskBranchPickerRouteScreen() {	...	@@ -291,7 +297,12 @@ export function NewTaskBranchPickerRouteScreen() {
291		297
292	const selectBranch = useCallback(	298	const selectBranch = useCallback(
293	async (branch: VcsRef) => {	299	async (branch: VcsRef) => {
294	if (selectingBranchNameRef.current !== null) {	300	const needsCheckout = shouldCheckoutNewTaskBranch({
		301	branchIsCurrent: branch.current,
		302	branchWorktreePath: branch.worktreePath,
		303	workspaceMode: flow.workspaceMode,
		304	});
		305	if (selectingBranchNameRef.current !== null \|\| (needsCheckout && !canWriteSourceControl)) {
295	return;	306	return;
296	}	307	}
297	selectingBranchNameRef.current = branch.name;	308	selectingBranchNameRef.current = branch.name;
...	@@ -336,6 +347,7 @@ export function NewTaskBranchPickerRouteScreen() {	...	@@ -336,6 +347,7 @@ export function NewTaskBranchPickerRouteScreen() {
336	}	347	}
337	},	348	},
338	[	349	[
		350	canWriteSourceControl,
339	flow.selectBranch,	351	flow.selectBranch,
340	flow.selectedProject,	352	flow.selectedProject,
341	flow.setBranchQuery,	353	flow.setBranchQuery,

apps/mobile/src/features/threads/ThreadGitControls.tsx+35-13

 @@ -1,6 +1,7 @@
 import { createNativeHeaderMenu } from "../../components/nativeHeaderMenu.ios";
 import type { ScreenHeaderMenu } from "../../components/ScreenHeader.types";
 import {
+  AuthSourceControlWriteScope,
   EnvironmentId,
   type GitRunStackedActionResult,
   type ProjectScript,
 @@ -17,6 +18,7 @@ import { NativeHeaderToolbar } from "../../native/StackHeader";
 import { useCallback, useMemo } from "react";
 import { Alert } from "react-native";
 import { tryOpenExternalUrl } from "../../lib/openExternalUrl";
+import { useEnvironmentScope } from "../../state/session";
 import {
   basename,
   getTerminalStatusLabel,
 @@ -113,6 +115,10 @@ type ThreadGitControlsProps = ThreadGitMenuProps & {
 function useThreadGitControlModel(props: ThreadGitMenuProps) {
   const navigation = useNavigation();
   const environmentId = props.environmentId;
+  const canWriteSourceControl = useEnvironmentScope(
+    environmentId ? EnvironmentId.make(String(environmentId)) : null,
+    AuthSourceControlWriteScope,
+  );
   const threadId = props.threadId;
   const { gitStatus, gitOperationLabel, onPull, onRunAction } = props;
 @@ -122,18 +128,24 @@ function useThreadGitControlModel(props: ThreadGitMenuProps) {
   const hasPrimaryRemote = gitStatus?.hasPrimaryRemote ?? false;
   const isDefaultRef = gitStatus?.isDefaultRef ?? false;
-  const quickAction = useMemo(
+  const quickAction = useMemo(() => {
-    () =>
+    if (!isRepo) {
-      isRepo
+      return {
-        ? resolveQuickAction(gitStatus, busy, isDefaultRef, hasPrimaryRemote)
+        label: "Git unavailable",
-        : {
+        disabled: true,
-            label: "Git unavailable",
+        kind: "show_hint" as const,
-            disabled: true,
+        hint: "This workspace is not a git repository.",
-            kind: "show_hint" as const,
+      };
-            hint: "This workspace is not a git repository.",
+    }
-          },
+    const action = resolveQuickAction(gitStatus, busy, isDefaultRef, hasPrimaryRemote);
-    [busy, gitStatus, hasPrimaryRemote, isDefaultRef, isRepo],
+    return !canWriteSourceControl && (action.kind === "run_pull" || action.kind === "run_action")
-  );
+      ? {
+          ...action,
+          disabled: true,
+          hint: "This connection cannot change source control.",
+        }
+      : action;
+  }, [busy, canWriteSourceControl, gitStatus, hasPrimaryRemote, isDefaultRef, isRepo]);
   const quickActionHint = quickAction.disabled
     ? (quickAction.hint ?? "This action is unavailable.")
 @@ -163,6 +175,7 @@ function useThreadGitControlModel(props: ThreadGitMenuProps) {
   const runActionWithPrompt = useCallback(
     async (input: GitActionRequestInput) => {
+      if (!canWriteSourceControl) return;
       const confirmableAction =
         input.action === "push" ||
         input.action === "create_pr" ||
 @@ -191,10 +204,19 @@ function useThreadGitControlModel(props: ThreadGitMenuProps) {
       await onRunAction(input);
     },
-    [environmentId, gitStatus, isDefaultRef, onRunAction, navigation, threadId],
+    [
+      canWriteSourceControl,
+      environmentId,
+      gitStatus,
+      isDefaultRef,
+      onRunAction,
+      navigation,
+      threadId,
+    ],
   );
   const runQuickAction = useCallback(async () => {
+    if (quickAction.disabled) return;
     if (quickAction.kind === "open_pr") {
       await openExistingPr();
       return;

apps/mobile/src/features/threads/git/GitBranchesSheet.test.tsx created+172

...	@@ -0,0 +1,172 @@
1	import { isValidElement, type ReactNode } from "react";
2	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
3
4	const state = vi.hoisted(() => ({
5	fields: [] as string[],
6	fieldIndex: 0,
7	canChangeThreadBranch: true,
8	navigations: 0,
9	result: Promise.resolve(null) as Promise<unknown>,
10	}));
11
12	vi.mock("react", async (importOriginal) => ({
13	...(await importOriginal<typeof import("react")>()),
14	useState: (initial: string) => {
15	const index = state.fieldIndex++;
16	state.fields[index] ??= initial;
17	return [state.fields[index], (value: string) => (state.fields[index] = value)];
18	},
19	}));
20	vi.mock("react-native", () => ({
21	Platform: { OS: "ios" },
22	useWindowDimensions: () => ({ height: 800, width: 400 }),
23	Pressable: "Pressable",
24	ScrollView: "ScrollView",
25	View: "View",
26	}));
27	vi.mock("@react-navigation/native", () => ({
28	useNavigation: () => ({ goBack: () => state.navigations++ }),
29	}));
30	vi.mock("react-native-safe-area-context", () => ({
31	useSafeAreaInsets: () => ({ bottom: 0 }),
32	}));
33	vi.mock("../../../components/AndroidScreenHeader", () => ({
34	AndroidSheetHeader: "AndroidSheetHeader",
35	}));
36	vi.mock("../../../components/AppText", () => ({ AppText: "Text", AppTextInput: "TextInput" }));
37	vi.mock("./gitSheetComponents", () => ({ SheetActionButton: "SheetActionButton" }));
38	vi.mock("../../../state/query", () => ({
39	useEnvironmentQuery: () => ({ data: { refName: "main" } }),
40	}));
41	vi.mock("../../../state/vcs", () => ({ vcsEnvironment: { status: () => null } }));
42	vi.mock("../../../state/use-thread-selection", () => ({
43	useThreadSelection: () => ({ selectedThread: { environmentId: "environment", branch: "main" } }),
44	}));
45	vi.mock("../../../state/use-selected-thread-worktree", () => ({
46	useSelectedThreadWorktree: () => ({
47	selectedThreadCwd: "/repo",
48	selectedThreadWorktreePath: null,
49	}),
50	}));
51	vi.mock("../../../state/use-selected-thread-git-state", () => ({
52	useSelectedThreadGitState: () => ({
53	selectedThreadBranches: [{ name: "main", current: true, isDefault: true, worktreePath: null }],
54	selectedThreadBranchesLoading: false,
55	gitOperationLabel: null,
56	}),
57	}));
58	vi.mock("../../../state/use-selected-thread-git-actions", () => ({
59	useSelectedThreadGitActions: () => ({
60	canChangeThreadBranch: state.canChangeThreadBranch,
61	onCreateSelectedThreadBranch: () => state.result,
62	onCreateSelectedThreadWorktree: () => state.result,
63	onCheckoutSelectedThreadBranch: () => state.result,
64	}),
65	}));
66
67	import { GitBranchesSheet } from "./GitBranchesSheet";
68
69	type ControlProps = {
70	label?: string;
71	placeholder?: string;
72	onPress?: () => unknown;
73	onChangeText?: (value: string) => void;
74	value?: string;
75	children?: ReactNode;
76	};
77
78	function findControl(node: ReactNode, label: string): ControlProps \| null {
79	if (Array.isArray(node)) {
80	for (const child of node) {
81	const control = findControl(child, label);
82	if (control) return control;
83	}
84	return null;
85	}
86	if (!isValidElement<ControlProps>(node)) return null;
87	if (
88	node.props.label === label \|\|
89	node.props.placeholder === label \|\|
90	(label === "checkout" && node.type === "Pressable")
91	) {
92	return node.props;
93	}
94	return findControl(node.props.children, label);
95	}
96
97	function control(label: string) {
98	state.fieldIndex = 0;
99	const found = findControl(
100	GitBranchesSheet({ route: { params: { environmentId: "environment", threadId: "thread" } } }),
101	label,
102	);
103	if (!found) throw new Error(`Missing sheet control: ${label}`);
104	return found;
105	}
106
107	function deferred<T>() {
108	let resolve!: (value: T) => void;
109	const promise = new Promise<T>((complete) => {
110	resolve = complete;
111	});
112	return { promise, resolve };
113	}
114
115	describe("branch sheet operation completion", () => {
116	beforeEach(() => {
117	state.fields = [];
118	state.fieldIndex = 0;
119	state.canChangeThreadBranch = true;
120	state.navigations = 0;
121	control("feature/mobile-polish").onChangeText?.("feature/branch");
122	control("main").onChangeText?.("release");
123	control("feature/mobile-thread").onChangeText?.("feature/worktree");
124	});
125
126	it.each(["Create & checkout", "Create worktree", "checkout"])(
127	"keeps the sheet and its input when %s cannot complete",
128	async (operation) => {
129	const result = deferred<null>();
130	state.result = result.promise;
131	const press = control(operation).onPress;
132	if (!press) throw new Error("Missing operation handler");
133	state.canChangeThreadBranch = false;
134	const completion = press();
135	result.resolve(null);
136	await result.promise;
137	await completion;
138
139	expect(state.navigations).toBe(0);
140	expect(control("feature/mobile-polish").value).toBe("feature/branch");
141	expect(control("main").value).toBe("release");
142	expect(control("feature/mobile-thread").value).toBe("feature/worktree");
143	},
144	);
145
146	it.each(["Create & checkout", "Create worktree", "checkout"])(
147	"dismisses after accepted %s completion even if the source grant changes",
148	async (operation) => {
149	const result = deferred<unknown>();
150	state.result = result.promise;
151	const press = control(operation).onPress;
152	if (!press) throw new Error("Missing operation handler");
153	const completion = press();
154	state.canChangeThreadBranch = false;
155	result.resolve(
156	operation === "Create worktree"
157	? { worktree: { path: "/repo-worktree", refName: "feature/worktree" } }
158	: { refName: operation === "checkout" ? "main" : "feature/branch" },
159	);
160	await result.promise;
161	await completion;
162
163	expect(state.navigations).toBe(1);
164	expect(control("feature/mobile-polish").value).toBe(
165	operation === "Create & checkout" ? "" : "feature/branch",
166	);
167	expect(control("feature/mobile-thread").value).toBe(
168	operation === "Create worktree" ? "" : "feature/worktree",
169	);
170	},
171	);
172	});

apps/mobile/src/features/threads/git/GitBranchesSheet.tsx+10-5

...	@@ -30,6 +30,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {	...	@@ -30,6 +30,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
30	const { selectedThreadCwd, selectedThreadWorktreePath } = useSelectedThreadWorktree();	30	const { selectedThreadCwd, selectedThreadWorktreePath } = useSelectedThreadWorktree();
31	const gitState = useSelectedThreadGitState();	31	const gitState = useSelectedThreadGitState();
32	const gitActions = useSelectedThreadGitActions();	32	const gitActions = useSelectedThreadGitActions();
		33	const { canChangeThreadBranch } = gitActions;
33		34
34	const gitStatus = useEnvironmentQuery(	35	const gitStatus = useEnvironmentQuery(
35	selectedThread !== null && selectedThreadCwd !== null	36	selectedThread !== null && selectedThreadCwd !== null
...	@@ -109,11 +110,12 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {	...	@@ -109,11 +110,12 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
109	icon="plus"	110	icon="plus"
110	label="Create & checkout"	111	label="Create & checkout"
111	tone="primary"	112	tone="primary"
112	disabled={busy \|\| newBranchName.trim().length === 0}	113	disabled={!canChangeThreadBranch \|\| busy \|\| newBranchName.trim().length === 0}
113	onPress={() => {	114	onPress={() => {
114	const branch = sanitizeFeatureBranchName(newBranchName.trim());	115	const branch = sanitizeFeatureBranchName(newBranchName.trim());
115	if (branch.length === 0) return;	116	if (branch.length === 0) return;
116	void gitActions.onCreateSelectedThreadBranch(branch).then(() => {	117	void gitActions.onCreateSelectedThreadBranch(branch).then((result) => {
		118	if (result === null) return;
117	setNewBranchName("");	119	setNewBranchName("");
118	navigation.goBack();	120	navigation.goBack();
119	});	121	});
...	@@ -150,6 +152,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {	...	@@ -150,6 +152,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
150	label="Create worktree"	152	label="Create worktree"
151	tone="primary"	153	tone="primary"
152	disabled={	154	disabled={
		155	!canChangeThreadBranch \|\|
153	busy \|\|	156	busy \|\|
154	worktreeBaseBranch.trim().length === 0 \|\|	157	worktreeBaseBranch.trim().length === 0 \|\|
155	worktreeBranchName.trim().length === 0	158	worktreeBranchName.trim().length === 0
...	@@ -160,7 +163,8 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {	...	@@ -160,7 +163,8 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
160	if (baseBranch.length === 0 \|\| newBranch.length === 0) return;	163	if (baseBranch.length === 0 \|\| newBranch.length === 0) return;
161	void gitActions	164	void gitActions
162	.onCreateSelectedThreadWorktree({ baseBranch, newBranch })	165	.onCreateSelectedThreadWorktree({ baseBranch, newBranch })
163	.then(() => {	166	.then((result) => {
		167	if (result === null) return;
164	setWorktreeBranchName("");	168	setWorktreeBranchName("");
165	navigation.goBack();	169	navigation.goBack();
166	});	170	});
...	@@ -203,9 +207,10 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {	...	@@ -203,9 +207,10 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
203	)}	207	)}
204	accessibilityRole="button"	208	accessibilityRole="button"
205	accessibilityState={{ selected: branch.current, disabled: busy \|\| disabled }}	209	accessibilityState={{ selected: branch.current, disabled: busy \|\| disabled }}
206	disabled={busy \|\| disabled}	210	disabled={!canChangeThreadBranch \|\| busy \|\| disabled}
207	onPress={() => {	211	onPress={() => {
208	void gitActions.onCheckoutSelectedThreadBranch(branch.name).then(() => {	212	void gitActions.onCheckoutSelectedThreadBranch(branch.name).then((result) => {
		213	if (result === null) return;
209	navigation.goBack();	214	navigation.goBack();
210	});	215	});
211	}}	216	}}

apps/mobile/src/features/threads/git/GitCommitSheet.tsx+13-3

...	@@ -30,6 +30,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {	...	@@ -30,6 +30,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {
30	const { selectedThreadCwd } = useSelectedThreadWorktree();	30	const { selectedThreadCwd } = useSelectedThreadWorktree();
31	const gitState = useSelectedThreadGitState();	31	const gitState = useSelectedThreadGitState();
32	const gitActions = useSelectedThreadGitActions();	32	const gitActions = useSelectedThreadGitActions();
		33	const { canWriteSourceControl, canChangeThreadBranch } = gitActions;
33		34
34	const gitStatus = useEnvironmentQuery(	35	const gitStatus = useEnvironmentQuery(
35	selectedThread !== null && selectedThreadCwd !== null	36	selectedThread !== null && selectedThreadCwd !== null
...	@@ -57,6 +58,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {	...	@@ -57,6 +58,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {
57		58
58	const runCommitAction = useCallback(	59	const runCommitAction = useCallback(
59	async (featureBranch: boolean) => {	60	async (featureBranch: boolean) => {
		61	if (!canWriteSourceControl \|\| (featureBranch && !canChangeThreadBranch)) return;
60	const commitMessage = dialogCommitMessage.trim();	62	const commitMessage = dialogCommitMessage.trim();
61	navigation.goBack();	63	navigation.goBack();
62	await gitActions.onRunSelectedThreadGitAction({	64	await gitActions.onRunSelectedThreadGitAction({
...	@@ -66,7 +68,15 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {	...	@@ -66,7 +68,15 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {
66	...(!allSelected ? { filePaths: selectedFiles.map((file) => file.path) } : {}),	68	...(!allSelected ? { filePaths: selectedFiles.map((file) => file.path) } : {}),
67	});	69	});
68	},	70	},
69	[allSelected, dialogCommitMessage, gitActions, navigation, selectedFiles],	71	[
		72	allSelected,
		73	canWriteSourceControl,
		74	canChangeThreadBranch,
		75	dialogCommitMessage,
		76	gitActions,
		77	navigation,
		78	selectedFiles,
		79	],
70	);	80	);
71		81
72	return (	82	return (
...	@@ -274,7 +284,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {	...	@@ -274,7 +284,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {
274	<SheetActionButton	284	<SheetActionButton
275	icon="arrow.branch"	285	icon="arrow.branch"
276	label="Commit on new branch"	286	label="Commit on new branch"
277	disabled={noneSelected \|\| busy}	287	disabled={!canChangeThreadBranch \|\| noneSelected \|\| busy}
278	onPress={() => void runCommitAction(true)}	288	onPress={() => void runCommitAction(true)}
279	/>	289	/>
280	</View>	290	</View>
...	@@ -283,7 +293,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {	...	@@ -283,7 +293,7 @@ export function GitCommitSheet(_props: GitCommitSheetProps) {
283	icon="checkmark.circle"	293	icon="checkmark.circle"
284	label="Commit"	294	label="Commit"
285	tone="primary"	295	tone="primary"
286	disabled={noneSelected \|\| busy}	296	disabled={!canWriteSourceControl \|\| noneSelected \|\| busy}
287	onPress={() => void runCommitAction(false)}	297	onPress={() => void runCommitAction(false)}
288	/>	298	/>
289	</View>	299	</View>

apps/mobile/src/features/threads/git/GitConfirmSheet.tsx+17-4

 @@ -32,6 +32,7 @@ export function GitConfirmSheet(props: GitConfirmSheetProps) {
   const { height: windowHeight } = useWindowDimensions();
   const gitState = useSelectedThreadGitState();
   const gitActions = useSelectedThreadGitActions();
+  const { canWriteSourceControl, canChangeThreadBranch } = gitActions;
   const params = props.route.params;
 @@ -59,17 +60,25 @@ export function GitConfirmSheet(props: GitConfirmSheetProps) {
   );
   const continuePendingAction = useCallback(async () => {
-    if (!confirmAction) return;
+    if (!canWriteSourceControl || !confirmAction) return;
     navigation.dispatch(StackActions.replace("Thread", { environmentId, threadId }));
     await gitActions.onRunSelectedThreadGitAction({
       action: confirmAction,
       ...(params.commitMessage ? { commitMessage: params.commitMessage } : {}),
       ...(params.filePaths ? { filePaths: params.filePaths.split(",") } : {}),
     });
-  }, [confirmAction, environmentId, gitActions, params, navigation, threadId]);
+  }, [
+    canWriteSourceControl,
+    confirmAction,
+    environmentId,
+    gitActions,
+    params,
+    navigation,
+    threadId,
+  ]);
   const movePendingActionToFeatureBranch = useCallback(async () => {
-    if (!confirmAction) return;
+    if (!canChangeThreadBranch || !confirmAction) return;
     navigation.dispatch(StackActions.replace("Thread", { environmentId, threadId }));
     if (includesCommit) {
 @@ -91,9 +100,11 @@ export function GitConfirmSheet(props: GitConfirmSheetProps) {
         branch.isRemote ? Result.failVoid : Result.succeed(branch.name),
       ),
     );
-    await gitActions.onCreateSelectedThreadBranch(newBranchName);
+    const created = await gitActions.onCreateSelectedThreadBranch(newBranchName);
+    if (created === null) return;
     await gitActions.onRunSelectedThreadGitAction({ action: confirmAction });
   }, [
+    canChangeThreadBranch,
     confirmAction,
     gitActions,
     gitState.selectedThreadBranches,
 @@ -164,11 +175,13 @@ export function GitConfirmSheet(props: GitConfirmSheetProps) {
             <SheetActionButton
               icon="arrow.right.circle"
               label={copy?.continueLabel ?? "Continue"}
+              disabled={!canWriteSourceControl}
               onPress={() => void continuePendingAction()}
             />
             <SheetActionButton
               icon="arrow.branch"
               label="Feature branch & continue"
+              disabled={!canChangeThreadBranch}
               tone="primary"
               onPress={() => void movePendingActionToFeatureBranch()}
             />

apps/mobile/src/features/threads/git/GitOverviewSheet.tsx+46-13

 @@ -87,6 +87,7 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
   );
   const gitState = useSelectedThreadGitState();
   const gitActions = useSelectedThreadGitActions();
+  const { canWriteSourceControl, canChangeThreadBranch } = gitActions;
   const theme = useUniwindTheme();
   const foregroundColor = theme["--color-foreground"];
   const sheetColor = theme["--color-sheet"];
 @@ -117,15 +118,21 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
   const sheetMenuItems = useMemo(
     () =>
       menuItems.map((item) => ({
-        item,
+        item: {
-        disabledReason: getGitActionDisabledReason({
+          ...item,
-          item,
+          disabled: item.disabled || (!canWriteSourceControl && item.kind !== "open_pr"),
-          gitStatus: gitStatus.data,
+        },
-          isBusy: busy,
+        disabledReason:
-          hasOriginRemote: hasPrimaryRemote,
+          !canWriteSourceControl && item.kind !== "open_pr"
-        }),
+            ? "This connection cannot change source control."
+            : getGitActionDisabledReason({
+                item,
+                gitStatus: gitStatus.data,
+                isBusy: busy,
+                hasOriginRemote: hasPrimaryRemote,
+              }),
       })),
-    [busy, gitStatus.data, hasPrimaryRemote, menuItems],
+    [busy, canWriteSourceControl, gitStatus.data, hasPrimaryRemote, menuItems],
   );
   useEffect(() => {
 @@ -145,6 +152,7 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
   const runActionWithPrompt = useCallback(
     async (input: GitActionRequestInput) => {
+      if (!canWriteSourceControl) return;
       const confirmableAction =
         input.action === "push" ||
         input.action === "create_pr" ||
 @@ -176,7 +184,16 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
       }
       await gitActions.onRunSelectedThreadGitAction(input);
     },
-    [environmentId, gitActions, gitStatus.data, isDefaultRef, isInspector, navigation, threadId],
+    [
+      canWriteSourceControl,
+      environmentId,
+      gitActions,
+      gitStatus.data,
+      isDefaultRef,
+      isInspector,
+      navigation,
+      threadId,
+    ],
   );
   const onPressMenuItem = useCallback(
 @@ -186,6 +203,7 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
         await openExistingPr();
         return;
       }
+      if (!canWriteSourceControl) return;
       if (item.dialogAction === "commit") {
         navigation.navigate("GitCommit", {
           environmentId: String(environmentId),
 @@ -201,7 +219,14 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
         await runActionWithPrompt({ action: "create_pr" });
       }
     },
-    [environmentId, openExistingPr, navigation, runActionWithPrompt, threadId],
+    [
+      canWriteSourceControl,
+      environmentId,
+      openExistingPr,
+      navigation,
+      runActionWithPrompt,
+      threadId,
+    ],
   );
   // Status facts live on the relevant rows instead of crowding the header
 @@ -284,8 +309,12 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
             <SheetListRow
               icon="arrow.down.circle"
               title="Pull latest"
-              subtitle={`${behindCount} commit${behindCount === 1 ? "" : "s"} behind upstream`}
+              subtitle={
-              disabled={busy || !isRepo}
+                canWriteSourceControl
+                  ? `${behindCount} commit${behindCount === 1 ? "" : "s"} behind upstream`
+                  : "This connection cannot change source control."
+              }
+              disabled={!canWriteSourceControl || busy || !isRepo}
               onPress={() => void gitActions.onPullSelectedThreadBranch()}
             />
           </>
 @@ -309,7 +338,11 @@ function GitOverviewSheetContent(props: GitOverviewSheetProps) {
         <SheetListRow
           icon="point.topleft.down.curvedto.point.bottomright.up"
           title="Branches & worktrees"
-          subtitle="Switch branch, create branch, or move to a worktree"
+          subtitle={
+            canChangeThreadBranch
+              ? "Switch branch, create branch, or move to a worktree"
+              : "View branches and worktrees"
+          }
           disabled={busy || !isRepo}
           onPress={() =>
             navigation.navigate("GitBranches", {

apps/mobile/src/state/use-selected-thread-git-actions.test.ts created+283

...	@@ -0,0 +1,283 @@
1	import { AuthOrchestrationOperateScope, AuthSourceControlWriteScope } from "@t3tools/contracts";
2	import * as Cause from "effect/Cause";
3	import { AsyncResult } from "effect/reactivity";
4	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
5
6	const state = vi.hoisted(() => ({
7	scopes: new Set<string>(),
8	primaryScopes: new Set<string>(),
9	branch: "main",
10	worktrees: [] as string[],
11	thread: {
12	id: "thread",
13	environmentId: "environment",
14	branch: "main",
15	worktreePath: null as string \| null,
16	},
17	commits: 0,
18	pushes: 0,
19	metadataRequests: [] as { environmentId: string; branch: string }[],
20	results: [] as { type: string; description?: string }[],
21	afterGitAction: undefined as (() => void) \| undefined,
22	statusRefreshes: 0,
23	}));
24
25	vi.mock("react", () => ({
26	useCallback: (callback: unknown) => callback,
27	useMemo: (factory: () => unknown) => factory(),
28	useEffect: () => {},
29	}));
30	vi.mock("./session", () => ({
31	useEnvironmentScope: (environmentId: unknown, scope: string) =>
32	(environmentId === state.thread.environmentId ? state.scopes : state.primaryScopes).has(scope),
33	readEnvironmentScope: (environmentId: unknown, scope: string) =>
34	(environmentId === state.thread.environmentId ? state.scopes : state.primaryScopes).has(scope),
35	}));
36	vi.mock("./use-thread-selection", () => ({
37	useThreadSelection: () => ({
38	selectedThread: state.thread,
39	selectedThreadProject: { workspaceRoot: "/repo" },
40	}),
41	}));
42	vi.mock("./use-selected-thread-worktree", () => ({
43	useSelectedThreadWorktree: () => ({
44	selectedThreadCwd: "/repo",
45	selectedThreadWorktreePath: null,
46	}),
47	}));
48	vi.mock("./queries", () => ({
49	useBranches: () => ({ data: { refs: [] }, refresh: () => {} }),
50	}));
51	vi.mock("./use-atom-command", () => ({ useAtomCommand: (command: unknown) => command }));
52	vi.mock("./atom-registry", () => ({ appAtomRegistry: {} }));
53	vi.mock("./use-remote-environment-registry", () => ({ setPendingConnectionError: () => {} }));
54	vi.mock("./use-vcs-action-state", () => ({
55	showGitActionResult: (result: { type: string; description?: string }) =>
56	state.results.push(result),
57	}));
58	vi.mock("../lib/uuid", () => ({ uuidv4: () => "action" }));
59	vi.mock("./threads", () => ({
60	threadEnvironment: {
61	updateMetadata: async ({
62	environmentId,
63	input,
64	}: {
65	environmentId: string;
66	input: { branch: string; worktreePath: string \| null };
67	}) => {
68	state.metadataRequests.push({ environmentId, branch: input.branch });
69	if (!state.scopes.has(AuthOrchestrationOperateScope)) {
70	return AsyncResult.failure(Cause.fail(new Error("Task operation denied")));
71	}
72	Object.assign(state.thread, input);
73	return AsyncResult.success(undefined);
74	},
75	},
76	}));
77	vi.mock("./vcs", () => ({
78	vcsEnvironment: {
79	refreshStatus: async () => {
80	state.statusRefreshes += 1;
81	return AsyncResult.success({ refName: state.branch });
82	},
83	switchRef: async ({ input }: { input: { refName: string } }) => {
84	state.branch = input.refName;
85	state.afterGitAction?.();
86	return AsyncResult.success({ refName: state.branch });
87	},
88	createRef: async ({ input }: { input: { refName: string } }) => {
89	state.branch = input.refName;
90	state.afterGitAction?.();
91	return AsyncResult.success({ refName: state.branch });
92	},
93	createWorktree: async ({ input }: { input: { newRefName: string } }) => {
94	state.worktrees.push("/repo-worktree");
95	state.afterGitAction?.();
96	return AsyncResult.success({
97	worktree: { path: "/repo-worktree", refName: input.newRefName },
98	});
99	},
100	pull: async () => AsyncResult.success({ status: "pulled", refName: state.branch }),
101	},
102	vcsActionManager: {
103	track: (_registry: unknown, _target: unknown, _operation: unknown, run: () => unknown) => run(),
104	runStackedAction: () => async (input: { action: string; featureBranch?: boolean }) => {
105	if (input.featureBranch) state.branch = "feature";
106	if (input.action === "commit") state.commits += 1;
107	if (input.action === "push") state.pushes += 1;
108	state.afterGitAction?.();
109	return AsyncResult.success({
110	branch: input.featureBranch
111	? { status: "created", name: "feature" }
112	: { status: "skipped_not_requested" },
113	toast: { title: "Done", description: "Done", cta: { kind: "none" } },
114	});
115	},
116	},
117	}));
118
119	import { useSelectedThreadGitActions } from "./use-selected-thread-git-actions";
120
121	describe("thread Git mutation permissions", () => {
122	beforeEach(() => {
123	state.scopes = new Set([AuthSourceControlWriteScope]);
124	state.primaryScopes = new Set([AuthSourceControlWriteScope, AuthOrchestrationOperateScope]);
125	state.branch = "main";
126	state.worktrees = [];
127	state.thread.branch = "main";
128	state.thread.worktreePath = null;
129	state.commits = 0;
130	state.pushes = 0;
131	state.metadataRequests = [];
132	state.results = [];
133	state.afterGitAction = undefined;
134	state.statusRefreshes = 0;
135	});
136
137	it.each([false, true])(
138	"requires task permission before creating and attaching a worktree: %s",
139	async (canOperate) => {
140	if (canOperate) state.scopes.add(AuthOrchestrationOperateScope);
141	const actions = useSelectedThreadGitActions();
142	const result = await actions.onCreateSelectedThreadWorktree({
143	baseBranch: "main",
144	newBranch: "feature/task",
145	});
146	expect(result).toEqual(
147	canOperate ? { worktree: { path: "/repo-worktree", refName: "feature/task" } } : null,
148	);
149	expect(state.worktrees).toEqual(canOperate ? ["/repo-worktree"] : []);
150	expect(state.thread.worktreePath).toBe(canOperate ? "/repo-worktree" : null);
151	expect(state.thread.branch).toBe(canOperate ? "feature/task" : "main");
152	},
153	);
154
155	it.each(["create", "checkout", "commit on new branch"] as const)(
156	"requires task permission before %s",
157	async (operation) => {
158	const actions = useSelectedThreadGitActions();
159	if (operation === "create") {
160	expect(await actions.onCreateSelectedThreadBranch("feature")).toBeNull();
161	}
162	if (operation === "checkout")
163	expect(await actions.onCheckoutSelectedThreadBranch("feature")).toBeNull();
164	if (operation === "commit on new branch")
165	await actions.onRunSelectedThreadGitAction({ action: "commit", featureBranch: true });
166	expect(state.branch).toBe("main");
167	expect(state.thread.branch).toBe("main");
168	expect(state.commits).toBe(0);
169	},
170	);
171
172	it("rechecks task permission when a retained menu callback runs", async () => {
173	state.scopes.add(AuthOrchestrationOperateScope);
174	const actions = useSelectedThreadGitActions();
175	state.scopes.delete(AuthOrchestrationOperateScope);
176	expect(
177	await actions.onCreateSelectedThreadWorktree({
178	baseBranch: "main",
179	newBranch: "feature/task",
180	}),
181	).toBeNull();
182	expect(state.worktrees).toEqual([]);
183	expect(state.thread.worktreePath).toBeNull();
184	});
185
186	it("keeps ordinary commits and pushes available without task permission", async () => {
187	const actions = useSelectedThreadGitActions();
188	await actions.onRunSelectedThreadGitAction({ action: "commit" });
189	await actions.onRunSelectedThreadGitAction({ action: "push" });
190	expect(state.commits).toBe(1);
191	expect(state.pushes).toBe(1);
192	expect(state.thread.branch).toBe("main");
193	expect(state.metadataRequests).toEqual([]);
194	});
195
196	it.each(["create", "checkout", "worktree", "commit"] as const)(
197	"does not send thread metadata after task permission is revoked during %s",
198	async (operation) => {
199	state.scopes.add(AuthOrchestrationOperateScope);
200	state.afterGitAction = () => state.scopes.delete(AuthOrchestrationOperateScope);
201	const actions = useSelectedThreadGitActions();
202	if (operation === "create")
203	expect(await actions.onCreateSelectedThreadBranch("feature")).toBeNull();
204	if (operation === "checkout")
205	expect(await actions.onCheckoutSelectedThreadBranch("feature")).toBeNull();
206	if (operation === "worktree")
207	expect(
208	await actions.onCreateSelectedThreadWorktree({
209	baseBranch: "main",
210	newBranch: "feature",
211	}),
212	).toBeNull();
213	if (operation === "commit")
214	expect(
215	await actions.onRunSelectedThreadGitAction({ action: "commit", featureBranch: true }),
216	).toBeNull();
217	if (operation === "worktree") expect(state.worktrees).toEqual(["/repo-worktree"]);
218	else expect(state.branch).toBe("feature");
219	expect(state.thread.branch).toBe("main");
220	expect(state.thread.worktreePath).toBeNull();
221	expect(state.metadataRequests).toEqual([]);
222	expect(state.results.map((result) => result.type)).toEqual(["error"]);
223	},
224	);
225
226	it("refreshes the worktree status when the metadata update is denied after checkout", async () => {
227	state.scopes.add(AuthOrchestrationOperateScope);
228	// Git already switched the branch, so the sheet must show it even though the
229	// thread record could not be updated.
230	state.afterGitAction = () => state.scopes.delete(AuthOrchestrationOperateScope);
231	expect(
232	await useSelectedThreadGitActions().onCheckoutSelectedThreadBranch("feature"),
233	).toBeNull();
234	expect(state.branch).toBe("feature");
235	expect(state.statusRefreshes).toBe(1);
236	});
237
238	it("uses a newly granted task permission for a retained branch callback", async () => {
239	state.primaryScopes.clear();
240	const actions = useSelectedThreadGitActions();
241	state.scopes.add(AuthOrchestrationOperateScope);
242	await actions.onCreateSelectedThreadBranch("feature");
243	expect(state.thread.branch).toBe("feature");
244	expect(state.metadataRequests).toEqual([{ environmentId: "environment", branch: "feature" }]);
245	});
246
247	it.each(["create", "checkout", "worktree"] as const)(
248	"returns the accepted %s result when only source-control permission is revoked after Git",
249	async (operation) => {
250	state.scopes.add(AuthOrchestrationOperateScope);
251	state.afterGitAction = () => state.scopes.delete(AuthSourceControlWriteScope);
252	const actions = useSelectedThreadGitActions();
253	const result =
254	operation === "create"
255	? await actions.onCreateSelectedThreadBranch("feature/task")
256	: operation === "checkout"
257	? await actions.onCheckoutSelectedThreadBranch("feature/task")
258	: await actions.onCreateSelectedThreadWorktree({
259	baseBranch: "main",
260	newBranch: "feature/task",
261	});
262	expect(result).toEqual(
263	operation === "worktree"
264	? { worktree: { path: "/repo-worktree", refName: "feature/task" } }
265	: { refName: "feature/task" },
266	);
267	expect(state.thread.branch).toBe("feature/task");
268	expect(state.metadataRequests).toHaveLength(1);
269	expect(state.results).toEqual([]);
270	},
271	);
272
273	it("returns a successful checkout when the requested branch is already selected", async () => {
274	state.scopes.add(AuthOrchestrationOperateScope);
275
276	expect(await useSelectedThreadGitActions().onCheckoutSelectedThreadBranch("main")).toEqual({
277	refName: "main",
278	});
279	expect(state.branch).toBe("main");
280	expect(state.thread.branch).toBe("main");
281	expect(state.results).toEqual([]);
282	});
283	});

apps/mobile/src/state/use-selected-thread-git-actions.ts+60-22

 @@ -7,7 +7,12 @@ import {
   type VcsActionOperation,
   type VcsRef,
 } from "@t3tools/client-runtime/state/vcs";
-import type { GitRunStackedActionResult } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
+  EnvironmentAuthorizationError,
+  type GitRunStackedActionResult,
+} from "@t3tools/contracts";
 import {
   dedupeRemoteBranchesWithLocalMatches,
   sanitizeFeatureBranchName,
 @@ -20,6 +25,7 @@ import { threadEnvironment } from "../state/threads";
 import { vcsActionManager, vcsEnvironment } from "../state/vcs";
 import { uuidv4 } from "../lib/uuid";
 import { appAtomRegistry } from "./atom-registry";
+import { readEnvironmentScope, useEnvironmentScope } from "./session";
 import { setPendingConnectionError } from "./use-remote-environment-registry";
 import { useAtomCommand } from "./use-atom-command";
 import { showGitActionResult } from "./use-vcs-action-state";
 @@ -36,6 +42,15 @@ export function useSelectedThreadGitActions() {
   const createWorktree = useAtomCommand(vcsEnvironment.createWorktree, { reportFailure: false });
   const pull = useAtomCommand(vcsEnvironment.pull, { reportFailure: false });
   const { selectedThread, selectedThreadProject } = useThreadSelection();
+  const canWriteSourceControl = useEnvironmentScope(
+    selectedThread?.environmentId ?? null,
+    AuthSourceControlWriteScope,
+  );
+  const canOperateThread = useEnvironmentScope(
+    selectedThread?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
+  const canChangeThreadBranch = canWriteSourceControl && canOperateThread;
   const { selectedThreadCwd, selectedThreadWorktreePath } = useSelectedThreadWorktree();
   const runStackedAction = useAtomCommand(
     vcsActionManager.runStackedAction({
 @@ -63,6 +78,16 @@ export function useSelectedThreadGitActions() {
         readonly worktreePath?: string | null;
       },
     ) => {
+      if (!readEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope)) {
+        return AsyncResult.failure<never, EnvironmentAuthorizationError>(
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthOrchestrationOperateScope,
+              message: "This connection cannot update the thread's branch.",
+            }),
+          ),
+        );
+      }
       return updateThreadMetadata({
         environmentId: thread.environmentId,
         input: {
 @@ -131,9 +156,16 @@ export function useSelectedThreadGitActions() {
         readonly project: EnvironmentProject;
         readonly cwd: string;
       }) => Promise<AtomCommandResult<T, E>>,
-      options?: { readonly managedExternally?: boolean },
+      options?: { readonly managedExternally?: boolean; readonly changesThreadBranch?: boolean },
     ): Promise<T | null> => {
-      if (!selectedThread || !selectedThreadProject || !selectedThreadCwd) {
+      if (
+        !selectedThread ||
+        !selectedThreadProject ||
+        !selectedThreadCwd ||
+        !readEnvironmentScope(selectedThread.environmentId, AuthSourceControlWriteScope) ||
+        (options?.changesThreadBranch === true &&
+          !readEnvironmentScope(selectedThread.environmentId, AuthOrchestrationOperateScope))
+      ) {
         return null;
       }
 @@ -180,22 +212,24 @@ export function useSelectedThreadGitActions() {
         readonly worktreePath?: string | null;
       };
     }): Promise<AtomCommandResult<void, unknown>> => {
-      if (input.nextThreadState) {
+      // The Git mutation already landed; refresh what the worktree shows even
-        const updateResult = await updateThreadGitContext(input.thread, input.nextThreadState);
+      // when the thread metadata update is denied, so the sheet does not keep
-        if (AsyncResult.isFailure(updateResult)) {
+      // displaying the previous branch.
-          return AsyncResult.failure(updateResult.cause);
+      const updateResult = input.nextThreadState
-        }
+        ? await updateThreadGitContext(input.thread, input.nextThreadState)
-      }
+        : AsyncResult.success(undefined);
       branchState.refresh();
       await refreshSelectedThreadGitStatus({ quiet: true, cwd: input.cwd });
-      return AsyncResult.success(undefined);
+      return AsyncResult.isFailure(updateResult)
+        ? AsyncResult.failure(updateResult.cause)
+        : AsyncResult.success(undefined);
     },
     [branchState, refreshSelectedThreadGitStatus, updateThreadGitContext],
   );
   const onCheckoutSelectedThreadBranch = useCallback(
     async (branch: string) => {
-      await runSelectedThreadGitMutation(
+      return runSelectedThreadGitMutation(
         "switch_ref",
         "Switching branch",
         async ({ thread, cwd }) => {
 @@ -216,6 +250,7 @@ export function useSelectedThreadGitActions() {
           });
           return AsyncResult.isFailure(syncResult) ? AsyncResult.failure(syncResult.cause) : result;
         },
+        { changesThreadBranch: true },
       );
     },
     [
 @@ -228,7 +263,7 @@ export function useSelectedThreadGitActions() {
   const onCreateSelectedThreadBranch = useCallback(
     async (branch: string) => {
-      await runSelectedThreadGitMutation(
+      return runSelectedThreadGitMutation(
         "create_ref",
         "Creating branch",
         async ({ thread, cwd }) => {
 @@ -249,6 +284,7 @@ export function useSelectedThreadGitActions() {
           });
           return AsyncResult.isFailure(syncResult) ? AsyncResult.failure(syncResult.cause) : result;
         },
+        { changesThreadBranch: true },
       );
     },
     [
 @@ -261,7 +297,7 @@ export function useSelectedThreadGitActions() {
   const onCreateSelectedThreadWorktree = useCallback(
     async (nextWorktree: { readonly baseBranch: string; readonly newBranch: string }) => {
-      await runSelectedThreadGitMutation(
+      return runSelectedThreadGitMutation(
         "create_worktree",
         "Creating worktree",
         async ({ thread, project }) => {
 @@ -287,6 +323,7 @@ export function useSelectedThreadGitActions() {
           });
           return AsyncResult.isFailure(syncResult) ? AsyncResult.failure(syncResult.cause) : result;
         },
+        { changesThreadBranch: true },
       );
     },
     [createWorktree, runSelectedThreadGitMutation, syncSelectedThreadBranchState],
 @@ -337,14 +374,6 @@ export function useSelectedThreadGitActions() {
             return result;
           }
-          showGitActionResult({
-            type: "success",
-            title: result.value.toast.title,
-            description: result.value.toast.description,
-            prUrl:
-              result.value.toast.cta.kind === "open_pr" ? result.value.toast.cta.url : undefined,
-          });
           if (result.value.branch.status === "created" && result.value.branch.name) {
             const syncResult = await syncSelectedThreadBranchState({
               thread,
 @@ -360,9 +389,16 @@ export function useSelectedThreadGitActions() {
           } else {
             await refreshSelectedThreadGitStatus({ quiet: true, cwd });
           }
+          showGitActionResult({
+            type: "success",
+            title: result.value.toast.title,
+            description: result.value.toast.description,
+            prUrl:
+              result.value.toast.cta.kind === "open_pr" ? result.value.toast.cta.url : undefined,
+          });
           return result;
         },
-        { managedExternally: true },
+        { managedExternally: true, changesThreadBranch: input.featureBranch === true },
       );
     },
     [
 @@ -375,6 +411,8 @@ export function useSelectedThreadGitActions() {
   );
   return {
+    canWriteSourceControl,
+    canChangeThreadBranch,
     refreshSelectedThreadGitStatus,
     refreshSelectedThreadBranches,
     onCheckoutSelectedThreadBranch,

apps/server/src/auth/RpcAuthorization.test.ts+61

...	@@ -4,8 +4,10 @@ import {	...	@@ -4,8 +4,10 @@ import {
4	AuthSettingsWriteScope,	4	AuthSettingsWriteScope,
5	DEFAULT_SERVER_SETTINGS,	5	DEFAULT_SERVER_SETTINGS,
6	ProviderInstanceId,	6	ProviderInstanceId,
		7	ThreadId,
7	AuthOrchestrationOperateScope,	8	AuthOrchestrationOperateScope,
8	AuthOrchestrationReadScope,	9	AuthOrchestrationReadScope,
		10	AuthSourceControlWriteScope,
9	AuthRelayReadScope,	11	AuthRelayReadScope,
10	AuthRelayWriteScope,	12	AuthRelayWriteScope,
11	WS_METHODS,	13	WS_METHODS,
...	@@ -113,6 +115,28 @@ describe("RPC authorization scopes", () => {	...	@@ -113,6 +115,28 @@ describe("RPC authorization scopes", () => {
113	);	115	);
114	});	116	});
115		117
		118	it("requires source control writes to start, retry, or cancel project clones", () => {
		119	for (const method of [
		120	WS_METHODS.projectCloneStart,
		121	WS_METHODS.projectCloneRetry,
		122	WS_METHODS.projectCloneCancel,
		123	]) {
		124	expect(requiredScopeForRpcMethod(method)).toBe(AuthSourceControlWriteScope);
		125	}
		126	expect(requiredScopeForRpcMethod(WS_METHODS.subscribeProjectClones)).toBe(
		127	AuthOrchestrationReadScope,
		128	);
		129	});
		130
		131	it("separates viewing pull request file progress from writing it", () => {
		132	expect(requiredScopeForRpcMethod(WS_METHODS.pullRequestsFilesViewed)).toBe(
		133	AuthOrchestrationReadScope,
		134	);
		135	expect(requiredScopeForRpcMethod(WS_METHODS.pullRequestsSetFilesViewed)).toBe(
		136	AuthSourceControlWriteScope,
		137	);
		138	});
		139
116	it("rejects unknown RPC method names", () => {	140	it("rejects unknown RPC method names", () => {
117	for (const method of ["server.notRegistered", "toString", "constructor"]) {	141	for (const method of ["server.notRegistered", "toString", "constructor"]) {
118	expect(() => requiredScopeForRpcMethod(method)).toThrow(	142	expect(() => requiredScopeForRpcMethod(method)).toThrow(
...	@@ -240,3 +264,40 @@ describe("settings mutation authorization", () => {	...	@@ -240,3 +264,40 @@ describe("settings mutation authorization", () => {
240	}).pipe(Effect.scoped),	264	}).pipe(Effect.scoped),
241	);	265	);
242	});	266	});
		267
		268	it.effect("requires task permission before attaching a prepared worktree to a thread", () =>
		269	Effect.gen(function* () {
		270	const group = WsRpcGroup.omit(
		271	...[...WsRpcGroup.requests.keys()].filter(
		272	(
		273	tag,
		274	): tag is Exclude<
		275	keyof typeof RPC_REQUIRED_SCOPES,
		276	typeof WS_METHODS.gitPreparePullRequestThread
		277	> => tag !== WS_METHODS.gitPreparePullRequestThread,
		278	),
		279	);
		280	let handled = false;
		281	const client = yield* RpcTest.makeClient(group).pipe(
		282	Effect.provide(
		283	Layer.mergeAll(
		284	group.toLayerHandler(WS_METHODS.gitPreparePullRequestThread, () =>
		285	Effect.sync(() => {
		286	handled = true;
		287	}).pipe(Effect.andThen(Effect.never)),
		288	),
		289	RpcAuthorization.layer([AuthSourceControlWriteScope]),
		290	),
		291	),
		292	);
		293	expect(
		294	yield* client[WS_METHODS.gitPreparePullRequestThread]({
		295	cwd: "/repo",
		296	reference: "42",
		297	mode: "worktree",
		298	threadId: ThreadId.make("thread"),
		299	}).pipe(Effect.flip),
		300	).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });
		301	expect(handled).toBe(false);
		302	}).pipe(Effect.scoped),
		303	);

apps/server/src/auth/RpcAuthorization.ts+13-29

 @@ -1,6 +1,7 @@
 import {
   CLIENT_GUARDED_RPC_SCOPES,
   type DeviceListInput,
+  clientRpcRequiredScopes,
   AuthAccessReadScope,
   ServerSettingsPatch,
   ProviderInstanceMutation,
 @@ -120,15 +121,6 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.pullRequestsThreadComments]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsDiffFileContents]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsFilesViewed]: AuthOrchestrationReadScope,
-  [WS_METHODS.pullRequestsRunAction]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsUpdate]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsComment]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsUpdateComment]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsSubmitReview]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsReplyToThread]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsSetThreadResolution]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsSetReaction]: AuthOrchestrationOperateScope,
-  [WS_METHODS.pullRequestsSetFilesViewed]: AuthOrchestrationOperateScope,
   // Read scope like the reads it un-caches: refreshing is part of reading, and a read-only
   // client pressing refresh must not be told it may not look again.
   [WS_METHODS.pullRequestsInvalidate]: AuthOrchestrationReadScope,
 @@ -136,15 +128,8 @@ export const RPC_REQUIRED_SCOPES = {
   // The candidate list is a read like the detail beside it; asking somebody for a review is a
   // write like every other one.
   [WS_METHODS.pullRequestsReviewerCandidates]: AuthOrchestrationReadScope,
-  [WS_METHODS.pullRequestsRequestReviewers]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsLabelCandidates]: AuthOrchestrationReadScope,
-  [WS_METHODS.pullRequestsSetLabels]: AuthOrchestrationOperateScope,
   [WS_METHODS.sourceControlLookupRepository]: AuthOrchestrationReadScope,
-  [WS_METHODS.sourceControlCloneRepository]: AuthOrchestrationOperateScope,
-  [WS_METHODS.sourceControlPublishRepository]: AuthOrchestrationOperateScope,
-  [WS_METHODS.projectCloneStart]: AuthOrchestrationOperateScope,
-  [WS_METHODS.projectCloneCancel]: AuthOrchestrationOperateScope,
-  [WS_METHODS.projectCloneRetry]: AuthOrchestrationOperateScope,
   [WS_METHODS.subscribeProjectClones]: AuthOrchestrationReadScope,
   [WS_METHODS.projectsListEntries]: AuthOrchestrationReadScope,
   [WS_METHODS.projectsReadFile]: AuthOrchestrationReadScope,
 @@ -167,16 +152,8 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.worktreeSetupCancel]: AuthOrchestrationOperateScope,
   [WS_METHODS.subscribeResourceTelemetry]: AuthOrchestrationReadScope,
   [WS_METHODS.vcsRefreshStatus]: AuthOrchestrationReadScope,
-  [WS_METHODS.vcsPull]: AuthOrchestrationOperateScope,
+  [WS_METHODS.gitResolvePullRequest]: AuthOrchestrationReadScope,
-  [WS_METHODS.gitRunStackedAction]: AuthOrchestrationOperateScope,
-  [WS_METHODS.gitResolvePullRequest]: AuthOrchestrationOperateScope,
-  [WS_METHODS.gitPreparePullRequestThread]: AuthOrchestrationOperateScope,
   [WS_METHODS.vcsListRefs]: AuthOrchestrationReadScope,
-  [WS_METHODS.vcsCreateWorktree]: AuthOrchestrationOperateScope,
-  [WS_METHODS.vcsRemoveWorktree]: AuthOrchestrationOperateScope,
-  [WS_METHODS.vcsCreateRef]: AuthOrchestrationOperateScope,
-  [WS_METHODS.vcsSwitchRef]: AuthOrchestrationOperateScope,
-  [WS_METHODS.vcsInit]: AuthOrchestrationOperateScope,
   [WS_METHODS.reviewGetDiffPreview]: AuthReviewWriteScope,
   [WS_METHODS.reviewGetDiffFileContents]: AuthReviewWriteScope,
   [WS_METHODS.terminalOpen]: AuthTerminalOperateScope,
 @@ -246,13 +223,20 @@ const requiredScopesForSettingsUpdate = (payload: unknown) => {
     : [...new Set([...scopes, AuthProvidersManageScope])];
 };
+const requiredScopesForRpcCall = (
+  method: string,
+  payload: unknown,
+): ReadonlyArray<AuthEnvironmentScope> => {
+  if (method === WS_METHODS.serverUpdateSettings) return requiredScopesForSettingsUpdate(payload);
+  const guarded = clientRpcRequiredScopes(method, payload);
+  if (guarded.length > 0) return guarded;
+  return [requiredScopeForRpcMethod(method)];
+};
 /** Authorizes every RPC on one connection against that connection's session scopes. */
 export const layer = (scopes: ReadonlyArray<AuthEnvironmentScope>) =>
   Layer.succeed(RpcScopeAuthorization)((effect, { rpc, payload }) => {
-    const requiredScopes =
+    const requiredScopes = requiredScopesForRpcCall(rpc._tag, payload);
-      rpc._tag === WS_METHODS.serverUpdateSettings
-        ? requiredScopesForSettingsUpdate(payload)
-        : [requiredScopeForRpcMethod(rpc._tag)];
     const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
     return requiredScope === undefined ? effect : Effect.fail(rpcAuthorizationError(requiredScope));
   });

apps/server/src/auth/http.ts+2

...	@@ -10,6 +10,7 @@ import {	...	@@ -10,6 +10,7 @@ import {
10	AuthRelayReadScope,	10	AuthRelayReadScope,
11	AuthRelayWriteScope,	11	AuthRelayWriteScope,
12	AuthReviewWriteScope,	12	AuthReviewWriteScope,
		13	AuthSourceControlWriteScope,
13	AuthTerminalOperateScope,	14	AuthTerminalOperateScope,
14	EnvironmentAuthInvalidError,	15	EnvironmentAuthInvalidError,
15	type EnvironmentAuthInvalidReason,	16	type EnvironmentAuthInvalidReason,
...	@@ -374,6 +375,7 @@ export const layer = HttpApiBuilder.group(	...	@@ -374,6 +375,7 @@ export const layer = HttpApiBuilder.group(
374	AuthEnvironmentMaintainScope,	375	AuthEnvironmentMaintainScope,
375	AuthTerminalOperateScope,	376	AuthTerminalOperateScope,
376	AuthReviewWriteScope,	377	AuthReviewWriteScope,
		378	AuthSourceControlWriteScope,
377	AuthAccessReadScope,	379	AuthAccessReadScope,
378	AuthAccessWriteScope,	380	AuthAccessWriteScope,
379	AuthRelayReadScope,	381	AuthRelayReadScope,

apps/web/src/components/BranchPicker.tsx+3

...	@@ -264,6 +264,7 @@ export function BranchPickerRefItem({	...	@@ -264,6 +264,7 @@ export function BranchPickerRefItem({
264	projectCwd: activeProjectCwd,	264	projectCwd: activeProjectCwd,
265	index,	265	index,
266	value,	266	value,
		267	disabled,
267	onClick,	268	onClick,
268	onContextMenu,	269	onContextMenu,
269	}: {	270	}: {
...	@@ -271,6 +272,7 @@ export function BranchPickerRefItem({	...	@@ -271,6 +272,7 @@ export function BranchPickerRefItem({
271	projectCwd: string \| null;	272	projectCwd: string \| null;
272	index: number;	273	index: number;
273	value?: string;	274	value?: string;
		275	disabled?: boolean;
274	onClick: ComponentProps<typeof ComboboxItem>["onClick"];	276	onClick: ComponentProps<typeof ComboboxItem>["onClick"];
275	onContextMenu?: ComponentProps<typeof ComboboxItem>["onContextMenu"];	277	onContextMenu?: ComponentProps<typeof ComboboxItem>["onContextMenu"];
276	}) {	278	}) {
...	@@ -288,6 +290,7 @@ export function BranchPickerRefItem({	...	@@ -288,6 +290,7 @@ export function BranchPickerRefItem({
288	: null;	290	: null;
289	return (	291	return (
290	<ComboboxItem	292	<ComboboxItem
		293	disabled={disabled}
291	hideIndicator	294	hideIndicator
292	key={itemValue}	295	key={itemValue}
293	index={index}	296	index={index}

apps/web/src/components/BranchToolbarBranchSelector.tsx+51-5

 @@ -8,7 +8,14 @@ import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
-import type { ContextMenuItem, EnvironmentId, VcsRef, ThreadId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
+  type ContextMenuItem,
+  type EnvironmentId,
+  type VcsRef,
+  type ThreadId,
+} from "@t3tools/contracts";
 import { ChevronDownIcon, GitBranchIcon } from "lucide-react";
 import {
   useCallback,
 @@ -30,6 +37,7 @@ import { useOpenPrLink } from "../lib/openPullRequestLink";
 import { usePaginatedBranches } from "../state/queries";
 import { useProject, useThreadShell } from "../state/entities";
 import { useEnvironmentQuery } from "../state/query";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { threadEnvironment } from "../state/threads";
 import { useAtomCommand } from "../state/use-atom-command";
 import { vcsEnvironment } from "../state/vcs";
 @@ -110,6 +118,8 @@ export function BranchToolbarBranchSelector({
   onComposerFocusRequest,
 }: BranchToolbarBranchSelectorProps) {
   const composerFloatingLayerProps = useComposerMenuProps();
+  const canWriteSourceControl = useEnvironmentScope(environmentId, AuthSourceControlWriteScope);
+  const canOperateThread = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
   const stopThreadSession = useAtomCommand(threadEnvironment.stopSession, "thread session stop");
   const updateThreadMetadata = useAtomCommand(
     threadEnvironment.updateMetadata,
 @@ -153,6 +163,8 @@ export function BranchToolbarBranchSelector({
   const activeProjectCwd = activeProject?.workspaceRoot ?? null;
   const branchCwd = activeWorktreePath ?? activeProjectCwd;
   const hasServerThread = serverThread !== null;
+  const canUpdateThreadBranch = !hasServerThread || canOperateThread;
+  const canChangeThreadBranch = canWriteSourceControl && canUpdateThreadBranch;
   const effectiveEnvMode =
     effectiveEnvModeOverride ??
     resolveEffectiveEnvMode({
 @@ -166,7 +178,12 @@ export function BranchToolbarBranchSelector({
   // ---------------------------------------------------------------------------
   const setThreadBranch = useCallback(
     (branch: string | null, worktreePath: string | null, automatic = false) => {
-      if (!activeThreadId || !activeProject) return;
+      if (
+        !activeThreadId ||
+        !activeProject ||
+        (hasServerThread && !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope))
+      )
+        return;
       if (serverSession && worktreePath !== activeWorktreePath) {
         void stopThreadSession({
           environmentId,
 @@ -273,8 +290,11 @@ export function BranchToolbarBranchSelector({
   const isSelectingWorktreeBase =
     effectiveEnvMode === "worktree" && !envLocked && !activeWorktreePath;
   const checkoutPullRequestItemValue =
-    prReference && onCheckoutPullRequestRequest ? `__checkout_pull_request__:${prReference}` : null;
+    canChangeThreadBranch && prReference && onCheckoutPullRequestRequest
-  const canCreateBranch = !isSelectingWorktreeBase && trimmedBranchQuery.length > 0;
+      ? `__checkout_pull_request__:${prReference}`
+      : null;
+  const canCreateBranch =
+    canChangeThreadBranch && !isSelectingWorktreeBase && trimmedBranchQuery.length > 0;
   // The ref is created under its sanitized name, so the collision check has to
   // use that name too. Matching on the raw query would offer to create a ref
   // that already exists whenever sanitizing changes the name.
 @@ -392,6 +412,20 @@ export function BranchToolbarBranchSelector({
   );
   const runBranchAction = (action: () => Promise<void>) => {
+    if (
+      !readEnvironmentScope(environmentId, AuthSourceControlWriteScope) ||
+      (hasServerThread && !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope))
+    ) {
+      // The menu already closed when the item was chosen; explain the no-op.
+      toastManager.add(
+        stackedThreadToast({
+          type: "error",
+          title: "Action unavailable",
+          description: "This connection cannot change the thread's branch.",
+        }),
+      );
+      return;
+    }
     startBranchActionTransition(async () => {
       await action();
       branchRefState.refresh();
 @@ -400,7 +434,7 @@ export function BranchToolbarBranchSelector({
   };
   const selectBranch = (refName: VcsRef) => {
-    if (!branchCwd || !activeProjectCwd || isBranchActionPending) return;
+    if (!canUpdateThreadBranch || !branchCwd || !activeProjectCwd || isBranchActionPending) return;
     if (isSelectingWorktreeBase) {
       setThreadBranch(refName.name, null);
 @@ -461,6 +495,7 @@ export function BranchToolbarBranchSelector({
   };
   const createRef = (rawName: string) => {
+    if (!canChangeThreadBranch) return;
     const name = sanitizeNewRefName(rawName);
     if (!branchCwd || !name || isBranchActionPending) return;
 @@ -647,6 +682,17 @@ export function BranchToolbarBranchSelector({
         projectCwd={activeProjectCwd}
         index={index}
         value={itemValue}
+        disabled={
+          !canUpdateThreadBranch ||
+          (!canWriteSourceControl &&
+            !isSelectingWorktreeBase &&
+            (!activeProjectCwd ||
+              !resolveBranchSelectionTarget({
+                activeProjectCwd,
+                activeWorktreePath,
+                refName,
+              }).reuseExistingWorktree))
+        }
         onClick={() => selectPickerItem(itemValue)}
         onContextMenu={(event) => handleBranchContextMenu(event, itemValue)}
       />

apps/web/src/components/ChatView.tsx+20-8

...	@@ -50,6 +50,7 @@ import { useAttachmentUploadStore } from "../lib/attachmentUploadQueue";	...	@@ -50,6 +50,7 @@ import { useAttachmentUploadStore } from "../lib/attachmentUploadQueue";
50	import {	50	import {
51	AuthOrchestrationOperateScope,	51	AuthOrchestrationOperateScope,
52	AuthSettingsWriteScope,	52	AuthSettingsWriteScope,
		53	AuthSourceControlWriteScope,
53	type AssistantCitation,	54	type AssistantCitation,
54	type ChatFileAttachment,	55	type ChatFileAttachment,
55	CommandId,	56	CommandId,
...	@@ -397,6 +398,7 @@ import { useEnvironmentDisconnectDelay } from "../hooks/useEnvironmentDisconnect	...	@@ -397,6 +398,7 @@ import { useEnvironmentDisconnectDelay } from "../hooks/useEnvironmentDisconnect
397	import { selectThreadTerminalUiState, useTerminalUiStateStore } from "../terminalUiStateStore";	398	import { selectThreadTerminalUiState, useTerminalUiStateStore } from "../terminalUiStateStore";
398	import { useKnownTerminalSessions, useThreadRunningTerminalIds } from "../state/terminalSessions";	399	import { useKnownTerminalSessions, useThreadRunningTerminalIds } from "../state/terminalSessions";
399	import { useEnvironmentQuery } from "../state/query";	400	import { useEnvironmentQuery } from "../state/query";
		401	import { useEnvironmentScope } from "~/state/session";
400	import {	402	import {
401	environmentServerConfigsAtom,	403	environmentServerConfigsAtom,
402	primaryServerAvailableEditorsAtom,	404	primaryServerAvailableEditorsAtom,
...	@@ -559,11 +561,7 @@ import { clampFileAttachmentUploadBytes } from "@t3tools/client-runtime/state/at	...	@@ -559,11 +561,7 @@ import { clampFileAttachmentUploadBytes } from "@t3tools/client-runtime/state/at
559	import { appAtomRegistry } from "../rpc/atomRegistry";	561	import { appAtomRegistry } from "../rpc/atomRegistry";
560	import { fileAttachmentCapabilityBlockReason } from "./chat/composerAttachmentFiles";	562	import { fileAttachmentCapabilityBlockReason } from "./chat/composerAttachmentFiles";
561	import { assetEnvironment } from "../state/assets";	563	import { assetEnvironment } from "../state/assets";
562	import {	564	import { readEnvironmentScope, readPreparedConnection } from "../state/session";
563	readEnvironmentScope,
564	readPreparedConnection,
565	useEnvironmentScope,
566	} from "../state/session";
567	import { useAtomCommand } from "../state/use-atom-command";	565	import { useAtomCommand } from "../state/use-atom-command";
568	import { useOrchestrationCommand } from "../state/use-orchestration-command";	566	import { useOrchestrationCommand } from "../state/use-orchestration-command";
569	import { useAtomQueryRunner } from "../state/use-atom-query-runner";	567	import { useAtomQueryRunner } from "../state/use-atom-query-runner";
...	@@ -1577,6 +1575,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -1577,6 +1575,7 @@ export default function ChatView(props: ChatViewProps) {
1577	const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {	1575	const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
1578	reportFailure: false,	1576	reportFailure: false,
1579	});	1577	});
		1578	const canWriteSourceControl = useEnvironmentScope(environmentId, AuthSourceControlWriteScope);
1580	const switchGitRef = useAtomCommand(vcsEnvironment.switchRef, { reportFailure: false });	1579	const switchGitRef = useAtomCommand(vcsEnvironment.switchRef, { reportFailure: false });
1581	const setThreadRuntimeMode = useOrchestrationCommand(threadEnvironment.setRuntimeMode, {	1580	const setThreadRuntimeMode = useOrchestrationCommand(threadEnvironment.setRuntimeMode, {
1582	reportFailure: false,	1581	reportFailure: false,
...	@@ -2164,7 +2163,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -2164,7 +2163,7 @@ export default function ChatView(props: ChatViewProps) {
2164	(isServerThread ? activeThread?.runtimeMode : undefined) ??	2163	(isServerThread ? activeThread?.runtimeMode : undefined) ??
2165	defaultRuntimeMode;	2164	defaultRuntimeMode;
2166	const isLocalDraftThread = !isServerThread && localDraftThread !== undefined;	2165	const isLocalDraftThread = !isServerThread && localDraftThread !== undefined;
2167	const canCheckoutPullRequestIntoThread = isLocalDraftThread;	2166	const canCheckoutPullRequestIntoThread = canWriteSourceControl && isLocalDraftThread;
2168	const activeThreadId = activeThread?.id ?? null;	2167	const activeThreadId = activeThread?.id ?? null;
2169	// Prefer the larger of turn-item-committed ids and projection messages so	2168	// Prefer the larger of turn-item-committed ids and projection messages so
2170	// env lock does not unlock while turn items lag projection hydration.	2169	// env lock does not unlock while turn items lag projection hydration.
...	@@ -7161,6 +7160,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7161,6 +7160,7 @@ export default function ChatView(props: ChatViewProps) {
7161	});	7160	});
7162	}, [activeBranchMismatchKey, showBranchMismatchBanner]);	7161	}, [activeBranchMismatchKey, showBranchMismatchBanner]);
7163	const handleSwitchCheckoutToThread = useCallback(async () => {	7162	const handleSwitchCheckoutToThread = useCallback(async () => {
		7163	if (!canWriteSourceControl) return;
7164	if (	7164	if (
7165	!activeProjectCwd \|\|	7165	!activeProjectCwd \|\|
7166	!activeThread \|\|	7166	!activeThread \|\|
...	@@ -7191,6 +7191,10 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7191,6 +7191,10 @@ export default function ChatView(props: ChatViewProps) {
7191	return;	7191	return;
7192	}	7192	}
7193		7193
		7194	if (!readEnvironmentScope(environmentId, AuthSourceControlWriteScope)) {
		7195	setIsRestoringThreadBranch(false);
		7196	return;
		7197	}
7194	const nextBranch = checkoutResult.value.refName ?? localCheckoutBranchMismatch.threadBranch;	7198	const nextBranch = checkoutResult.value.refName ?? localCheckoutBranchMismatch.threadBranch;
7195	if (nextBranch !== activeThread.branch) {	7199	if (nextBranch !== activeThread.branch) {
7196	const updateResult = await updateThreadMetadata({	7200	const updateResult = await updateThreadMetadata({
...	@@ -7216,6 +7220,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7216,6 +7220,7 @@ export default function ChatView(props: ChatViewProps) {
7216	setIsRestoringThreadBranch(false);	7220	setIsRestoringThreadBranch(false);
7217	scheduleComposerFocus();	7221	scheduleComposerFocus();
7218	}, [	7222	}, [
		7223	canWriteSourceControl,
7219	activeProjectCwd,	7224	activeProjectCwd,
7220	activeThread,	7225	activeThread,
7221	environmentId,	7226	environmentId,
...	@@ -7622,12 +7627,17 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7622,12 +7627,17 @@ export default function ChatView(props: ChatViewProps) {
7622	selectedProvider,	7627	selectedProvider,
7623	]);	7628	]);
7624	const handleRestoreThreadBranch = useCallback(() => {	7629	const handleRestoreThreadBranch = useCallback(() => {
		7630	if (!canWriteSourceControl) return;
7625	if (gitStatusQuery.data?.hasWorkingTreeChanges) {	7631	if (gitStatusQuery.data?.hasWorkingTreeChanges) {
7626	setBranchRestoreConfirmOpen(true);	7632	setBranchRestoreConfirmOpen(true);
7627	return;	7633	return;
7628	}	7634	}
7629	void handleSwitchCheckoutToThread();	7635	void handleSwitchCheckoutToThread();
7630	}, [gitStatusQuery.data?.hasWorkingTreeChanges, handleSwitchCheckoutToThread]);	7636	}, [
		7637	canWriteSourceControl,
		7638	gitStatusQuery.data?.hasWorkingTreeChanges,
		7639	handleSwitchCheckoutToThread,
		7640	]);
7631	const feedbackBannerItems = useMemo(	7641	const feedbackBannerItems = useMemo(
7632	() =>	7642	() =>
7633	feedbackSubmissions.flatMap((submission) => {	7643	feedbackSubmissions.flatMap((submission) => {
...	@@ -7722,7 +7732,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7722,7 +7732,7 @@ export default function ChatView(props: ChatViewProps) {
7722	<Button	7732	<Button
7723	size="xs"	7733	size="xs"
7724	variant="ghost"	7734	variant="ghost"
7725	disabled={isRestoringThreadBranch}	7735	disabled={!canWriteSourceControl \|\| isRestoringThreadBranch}
7726	onClick={handleRestoreThreadBranch}	7736	onClick={handleRestoreThreadBranch}
7727	>	7737	>
7728	{isRestoringThreadBranch ? "Restoring..." : "Restore branch"}	7738	{isRestoringThreadBranch ? "Restoring..." : "Restore branch"}
...	@@ -7740,6 +7750,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -7740,6 +7750,7 @@ export default function ChatView(props: ChatViewProps) {
7740	activeBranchMismatchKey,	7750	activeBranchMismatchKey,
7741	activeThreadShell,	7751	activeThreadShell,
7742	serverRuntime?.usageLimitResetAt,	7752	serverRuntime?.usageLimitResetAt,
		7753	canWriteSourceControl,
7743	feedbackBannerItems,	7754	feedbackBannerItems,
7744	limitRecoveryBanner,	7755	limitRecoveryBanner,
7745	handleRestoreThreadBranch,	7756	handleRestoreThreadBranch,
...	@@ -11654,6 +11665,7 @@ export default function ChatView(props: ChatViewProps) {	...	@@ -11654,6 +11665,7 @@ export default function ChatView(props: ChatViewProps) {
11654	<AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>	11665	<AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
11655	<Button	11666	<Button
11656	variant="default"	11667	variant="default"
		11668	disabled={!canWriteSourceControl}
11657	onClick={() => {	11669	onClick={() => {
11658	setBranchRestoreConfirmOpen(false);	11670	setBranchRestoreConfirmOpen(false);
11659	void handleSwitchCheckoutToThread();	11671	void handleSwitchCheckoutToThread();

apps/web/src/components/CommandPalette.tsx+45-4

 @@ -30,6 +30,8 @@ import {
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
 import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
   type DesktopWslState,
   type EnvironmentId,
   type EnvironmentMachineKind,
 @@ -103,6 +105,7 @@ import { projectEnvironment } from "../state/projects";
 import { useEnvironmentQuery } from "../state/query";
 import { serverEnvironment } from "../state/server";
 import { threadEnvironment } from "../state/threads";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { sourceControlEnvironment } from "../state/sourceControl";
 import { useAtomCommand } from "../state/use-atom-command";
 import { useAtomQueryRunner } from "../state/use-atom-query-runner";
 @@ -1039,6 +1042,7 @@ function OpenCommandPaletteDialog(props: {
     [addProjectEnvironmentOptions, environments],
   );
   const browseEnvironmentId = addProjectEnvironmentId ?? defaultAddProjectEnvironmentId;
+  const canCreateProject = useEnvironmentScope(browseEnvironmentId, AuthOrchestrationOperateScope);
   const browseEnvironment =
     environments.find((environment) => environment.environmentId === browseEnvironmentId) ?? null;
   // A desktop-local secondary backend (today: the WSL backend). The picker is
 @@ -2418,6 +2422,16 @@ function OpenCommandPaletteDialog(props: {
         return;
       }
+      if (!readEnvironmentScope(input.environmentId, AuthOrchestrationOperateScope)) {
+        toastManager.add(
+          stackedThreadToast({
+            type: "error",
+            title: "Cannot add project",
+            description: "This connection cannot add projects.",
+          }),
+        );
+        return;
+      }
       const projectId = newProjectId();
       const createResult = await createProject({
         environmentId: input.environmentId,
 @@ -2607,9 +2621,20 @@ function OpenCommandPaletteDialog(props: {
     }
     const rawDestination = (destinationPathInput ?? query).trim();
-    if (rawDestination.length === 0 || isRemoteProjectCloning) {
+    if (
+      !readEnvironmentScope(addProjectCloneFlow.environmentId, AuthSourceControlWriteScope) ||
+      !readEnvironmentScope(addProjectCloneFlow.environmentId, AuthOrchestrationOperateScope)
+    ) {
+      toastManager.add(
+        stackedThreadToast({
+          type: "error",
+          title: "Clone unavailable",
+          description: "This connection needs permission to write source control and add projects.",
+        }),
+      );
       return;
     }
+    if (rawDestination.length === 0 || isRemoteProjectCloning) return;
     if (isUnsupportedWindowsProjectPath(rawDestination, browseEnvironmentPlatform)) {
       toastManager.add(
 @@ -2948,9 +2973,21 @@ function OpenCommandPaletteDialog(props: {
         getCommandPaletteInputPlaceholder(paletteMode));
   const isSubmenu = paletteMode === "submenu" || paletteMode === "submenu-browse";
   const hasHighlightedBrowseItem = highlightedItemValue?.startsWith("browse:") ?? false;
+  const canWriteSourceControl = useEnvironmentScope(
+    addProjectCloneFlow?.environmentId ?? null,
+    AuthSourceControlWriteScope,
+  );
+  const canCreateClonedProject = useEnvironmentScope(
+    addProjectCloneFlow?.environmentId ?? null,
+    AuthOrchestrationOperateScope,
+  );
+  const canCloneProject = canWriteSourceControl && canCreateClonedProject;
+  const isCloneDestinationStep = addProjectCloneFlow?.step === "confirm";
   const canSubmitBrowsePath =
     isBrowsing &&
     !relativePathNeedsActiveProject &&
+    canCreateProject &&
+    (!isCloneDestinationStep || canCloneProject) &&
     canCreateProjectInEnvironment(browseEnvironment?.connection.phase);
   const willCreateProjectPath =
     canSubmitBrowsePath &&
 @@ -2960,7 +2997,6 @@ function OpenCommandPaletteDialog(props: {
     (hasTrailingPathSeparator(query) ? !browseResult : exactBrowseEntry === null);
   const useMetaForMod = isMacPlatform(navigator.platform);
   const submitModifierLabel = useMetaForMod ? "\u2318" : "Ctrl";
-  const isCloneDestinationStep = addProjectCloneFlow?.step === "confirm";
   const submitActionLabel = isCloneDestinationStep
     ? willCreateProjectPath
       ? "Create & Clone"
 @@ -3327,9 +3363,10 @@ function OpenCommandPaletteDialog(props: {
               className="absolute inset-e-2.5 top-1/2 -translate-y-1/2"
               aria-label={`${submitActionLabel} (${addShortcutLabel})`}
               disabled={
+                !canCreateProject ||
                 !canCreateProjectInEnvironment(browseEnvironment?.connection.phase) ||
                 relativePathNeedsActiveProject ||
-                (isCloneDestinationStep && isRemoteProjectPending)
+                (isCloneDestinationStep && (!canCloneProject || isRemoteProjectPending))
               }
               onMouseDown={(event) => {
                 event.preventDefault();
 @@ -3355,7 +3392,11 @@ function OpenCommandPaletteDialog(props: {
           </KbdGroup>
         </TooltipTrigger>
         <TooltipPopup side="top">
-          {submitActionLabel} ({addShortcutLabel})
+          {isCloneDestinationStep && !canCloneProject
+            ? "This connection needs permission to write source control and add projects."
+            : canCreateProject
+              ? `${submitActionLabel} (${addShortcutLabel})`
+              : "This connection cannot add projects."}
         </TooltipPopup>
       </Tooltip>
     ) : null;

apps/web/src/components/GitActionsControl.test.ts created+295

...	@@ -0,0 +1,295 @@
1	import {
2	AuthOrchestrationOperateScope,
3	AuthSourceControlWriteScope,
4	EnvironmentId,
5	ThreadId,
6	} from "@t3tools/contracts";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult } from "effect/reactivity";
9	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
10
11	const state = vi.hoisted(() => ({
12	scopes: new Set<string>(),
13	primaryScopes: new Set<string>(),
14	shell: { branch: "main" } as { branch: string } \| null,
15	detail: null as { branch: string } \| null,
16	draft: null as { branch: string; worktreePath: null; envMode: "local" } \| null,
17	branch: "main",
18	commits: 0,
19	metadataRequests: [] as { environmentId: string; branch: string }[],
20	afterGitAction: undefined as (() => void) \| undefined,
21	run: null as ((input: { action: "commit"; featureBranch?: boolean }) => Promise<void>) \| null,
22	}));
23
24	vi.mock("react", async (importOriginal) => ({
25	...(await importOriginal<typeof import("react")>()),
26	useCallback: (callback: unknown) => callback,
27	useMemo: (factory: () => unknown) => factory(),
28	useState: (initial: unknown) => [typeof initial === "function" ? initial() : initial, () => {}],
29	useRef: (current: unknown) => ({ current }),
30	useEffect: () => {},
31	useEffectEvent: (callback: typeof state.run) => {
32	state.run = callback;
33	return callback;
34	},
35	}));
36	vi.mock("@effect/atom-react", () => ({
37	useAtomValue: (atom: unknown) => (atom === "vcs-state" ? { isRunning: false } : null),
38	}));
39	vi.mock("~/state/entities", () => ({
40	useThreadProjection: (ref: unknown) =>
41	ref === null \|\| state.detail === null ? null : { projection: { thread: state.detail } },
42	useThreadShell: () => state.shell,
43	}));
44	vi.mock("~/state/session", () => ({
45	useEnvironmentScope: (environmentId: unknown, scope: string) =>
46	(environmentId === "environment" ? state.scopes : state.primaryScopes).has(scope),
47	readEnvironmentScope: (environmentId: unknown, scope: string) =>
48	(environmentId === "environment" ? state.scopes : state.primaryScopes).has(scope),
49	}));
50	vi.mock("~/state/use-atom-command", () => ({ useAtomCommand: (command: unknown) => command }));
51	vi.mock("~/state/server", () => ({ serverEnvironment: { configValueAtom: () => null } }));
52	vi.mock("~/state/sourceControl", () => ({ sourceControlEnvironment: {} }));
53	vi.mock("~/state/vcs", () => ({
54	vcsEnvironment: { status: () => null },
55	vcsActionManager: { stateAtom: () => "vcs-state" },
56	}));
57	vi.mock("~/state/threads", () => ({
58	threadEnvironment: {
59	updateMetadata: async ({
60	environmentId,
61	input,
62	}: {
63	environmentId: string;
64	input: { branch: string };
65	}) => {
66	state.metadataRequests.push({ environmentId, branch: input.branch });
67	if (!state.scopes.has(AuthOrchestrationOperateScope))
68	return AsyncResult.failure(Cause.fail(new Error("Task denied")));
69	if (state.shell) state.shell.branch = input.branch;
70	if (state.detail) state.detail.branch = input.branch;
71	return AsyncResult.success(undefined);
72	},
73	},
74	}));
75	vi.mock("~/state/query", () => ({
76	useEnvironmentQuery: () => ({
77	data: {
78	isRepo: true,
79	refName: "main",
80	isDefaultRef: false,
81	hasPrimaryRemote: true,
82	hasWorkingTreeChanges: true,
83	workingTree: { files: [{ path: "file.ts", status: "modified" }] },
84	},
85	error: null,
86	}),
87	}));
88	vi.mock("~/composerDraftStore", () => ({
89	useComposerDraftStore: (
90	select: (store: {
91	getDraftSession: () => typeof state.draft;
92	getDraftThreadByRef: () => typeof state.draft;
93	setDraftThreadContext: (_target: unknown, input: { branch: string }) => void;
94	}) => unknown,
95	) =>
96	select({
97	getDraftSession: () => state.draft,
98	getDraftThreadByRef: () => state.draft,
99	setDraftThreadContext: (_target, input) => {
100	if (state.draft) state.draft.branch = input.branch;
101	},
102	}),
103	}));
104	vi.mock("~/lib/sourceControlActions", () => ({
105	useSourceControlActionRunning: () => false,
106	useVcsInitAction: () => ({}),
107	useVcsPullAction: () => ({}),
108	useSourceControlPublishRepositoryAction: () => ({}),
109	useGitStackedAction: () => ({
110	run: async ({ featureBranch }: { featureBranch?: boolean }) => {
111	state.commits += 1;
112	if (featureBranch) state.branch = "feature";
113	state.afterGitAction?.();
114	return {
115	_tag: "Success",
116	value: {
117	branch: featureBranch
118	? { status: "created", name: "feature" }
119	: { status: "skipped_not_requested" },
120	toast: { title: "Committed", description: "Committed", cta: { kind: "none" } },
121	},
122	};
123	},
124	}),
125	}));
126	vi.mock("~/lib/utils", () => ({ cn: () => "", randomUUID: () => "action" }));
127	vi.mock("~/editorPreferences", () => ({ useOpenInPreferredEditor: () => () => {} }));
128	vi.mock("~/browser/useOpenLink", () => ({ useOpenLink: () => () => {} }));
129	vi.mock("~/lib/openPullRequestLink", () => ({ useOpenPrLink: () => () => {} }));
130	vi.mock("~/components/ui/toast", () => ({
131	stackedThreadToast: (input: unknown) => input,
132	toastManager: { add: () => "toast", update: () => {}, close: () => {} },
133	}));
134	vi.mock("~/components/ui/dialog", () => ({
135	Dialog: "Dialog",
136	DialogDescription: "DialogDescription",
137	DialogFooter: "DialogFooter",
138	DialogHeader: "DialogHeader",
139	DialogPanel: "DialogPanel",
140	DialogPopup: "DialogPopup",
141	DialogTitle: "DialogTitle",
142	}));
143	vi.mock("~/components/ui/group", () => ({ Group: "Group", GroupSeparator: "GroupSeparator" }));
144	vi.mock("~/components/ui/menu", () => ({
145	Menu: "Menu",
146	MenuItem: "MenuItem",
147	MenuItemLabel: "MenuItemLabel",
148	MenuPopup: "MenuPopup",
149	MenuTrigger: "MenuTrigger",
150	}));
151	vi.mock("~/components/ui/popover", () => ({
152	Popover: "Popover",
153	PopoverPopup: "PopoverPopup",
154	PopoverTrigger: "PopoverTrigger",
155	}));
156	vi.mock("~/components/ui/tooltip", () => ({
157	Tooltip: "Tooltip",
158	TooltipPopup: "TooltipPopup",
159	TooltipTrigger: "TooltipTrigger",
160	}));
161	vi.mock("~/components/ui/button", () => ({ Button: "Button" }));
162	vi.mock("~/components/ui/checkbox", () => ({ Checkbox: "Checkbox" }));
163	vi.mock("~/components/ui/input", () => ({ Input: "Input" }));
164	vi.mock("~/components/ui/radio-group", () => ({ RadioGroup: "RadioGroup" }));
165	vi.mock("~/components/ui/scroll-area", () => ({ ScrollArea: "ScrollArea" }));
166	vi.mock("~/components/ui/spinner", () => ({ Spinner: "Spinner" }));
167	vi.mock("~/components/ui/textarea", () => ({ Textarea: "Textarea" }));
168	vi.mock("~/components/ui/toggle", () => ({ toggleVariants: () => "" }));
169	vi.mock("./AnimatedHeight", () => ({ AnimatedHeight: "AnimatedHeight" }));
170
171	import GitActionsControl from "./GitActionsControl";
172
173	function renderActions() {
174	GitActionsControl({
175	gitCwd: "/repo",
176	activeThreadRef: {
177	environmentId: EnvironmentId.make("environment"),
178	threadId: ThreadId.make("thread"),
179	},
180	});
181	if (!state.run) throw new Error("Git action missing");
182	return state.run;
183	}
184
185	describe("Git actions while thread details load", () => {
186	beforeEach(() => {
187	state.scopes = new Set([AuthSourceControlWriteScope]);
188	state.primaryScopes = new Set([AuthSourceControlWriteScope, AuthOrchestrationOperateScope]);
189	state.shell = { branch: "main" };
190	state.detail = null;
191	state.draft = null;
192	state.branch = "main";
193	state.commits = 0;
194	state.metadataRequests = [];
195	state.afterGitAction = undefined;
196	state.run = null;
197	});
198
199	it("does not create a feature branch for a server thread without task permission", async () => {
200	await renderActions()({ action: "commit", featureBranch: true });
201
202	expect(state.branch).toBe("main");
203	expect(state.commits).toBe(0);
204	expect(state.shell?.branch).toBe("main");
205	});
206
207	it("commits and synchronizes the server thread before details finish loading", async () => {
208	state.primaryScopes.clear();
209	state.scopes.add(AuthOrchestrationOperateScope);
210	await renderActions()({ action: "commit", featureBranch: true });
211
212	expect(state.branch).toBe("feature");
213	expect(state.commits).toBe(1);
214	expect(state.shell?.branch).toBe("feature");
215	expect(state.metadataRequests).toEqual([{ environmentId: "environment", branch: "feature" }]);
216	});
217
218	it("synchronizes archived thread detail after its shell disappears", async () => {
219	state.scopes.add(AuthOrchestrationOperateScope);
220	state.detail = { branch: "main" };
221	renderActions();
222	state.shell = null;
223
224	await renderActions()({ action: "commit", featureBranch: true });
225
226	expect(state.commits).toBe(1);
227	expect(state.branch).toBe("feature");
228	expect(state.detail.branch).toBe("feature");
229	expect(state.metadataRequests).toEqual([{ environmentId: "environment", branch: "feature" }]);
230	});
231
232	it("requires task permission before changing an archived thread's branch", async () => {
233	state.shell = null;
234	state.detail = { branch: "main" };
235
236	await renderActions()({ action: "commit", featureBranch: true });
237
238	expect(state.commits).toBe(0);
239	expect(state.detail.branch).toBe("main");
240	expect(state.metadataRequests).toEqual([]);
241	});
242
243	it("uses the current shell branch when cached detail names the new branch", async () => {
244	state.scopes.add(AuthOrchestrationOperateScope);
245	state.detail = { branch: "feature" };
246
247	await renderActions()({ action: "commit", featureBranch: true });
248
249	expect(state.commits).toBe(1);
250	expect(state.shell?.branch).toBe("feature");
251	expect(state.metadataRequests).toEqual([{ environmentId: "environment", branch: "feature" }]);
252	});
253
254	it("synchronizes a retained callback after the thread grant is gained", async () => {
255	const run = renderActions();
256	state.scopes.add(AuthOrchestrationOperateScope);
257	await run({ action: "commit", featureBranch: true });
258	expect(state.commits).toBe(1);
259	expect(state.shell?.branch).toBe("feature");
260	expect(state.metadataRequests).toHaveLength(1);
261	});
262
263	it.each([
264	[AuthOrchestrationOperateScope, false],
265	[AuthSourceControlWriteScope, true],
266	] as const)(
267	"uses the fresh task grant after Git finishes, revoking %s",
268	async (revokedScope, syncsThread) => {
269	state.scopes.add(AuthOrchestrationOperateScope);
270	state.afterGitAction = () => state.scopes.delete(revokedScope);
271	await renderActions()({ action: "commit", featureBranch: true });
272	expect(state.commits).toBe(1);
273	expect(state.branch).toBe("feature");
274	expect(state.shell?.branch).toBe(syncsThread ? "feature" : "main");
275	expect(state.metadataRequests).toHaveLength(syncsThread ? 1 : 0);
276	},
277	);
278
279	it("keeps ordinary commits available while details load", async () => {
280	await renderActions()({ action: "commit" });
281
282	expect(state.commits).toBe(1);
283	expect(state.branch).toBe("main");
284	});
285
286	it("keeps feature-branch commits available for a local draft", async () => {
287	state.shell = null;
288	state.draft = { branch: "main", worktreePath: null, envMode: "local" };
289	await renderActions()({ action: "commit", featureBranch: true });
290
291	expect(state.commits).toBe(1);
292	expect(state.draft.branch).toBe("feature");
293	expect(state.metadataRequests).toEqual([]);
294	});
295	});

apps/web/src/components/GitActionsControl.tsx+61-17

 @@ -1,6 +1,10 @@
 import { ThreadDetailsControl } from "./chat/ThreadDetailsControl";
 import { useAtomValue } from "@effect/atom-react";
-import { type ScopedThreadRef } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
+  type ScopedThreadRef,
+} from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 @@ -108,7 +112,8 @@ import {
   useVcsInitAction,
   useVcsPullAction,
 } from "~/lib/sourceControlActions";
-import { useThreadShell } from "~/state/entities";
+import { useThreadProjection, useThreadShell } from "~/state/entities";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { useEnvironmentQuery } from "~/state/query";
 import { serverEnvironment } from "~/state/server";
 import { sourceControlEnvironment } from "~/state/sourceControl";
 @@ -630,14 +635,19 @@ function PublishRepositoryDialog(props: PublishRepositoryDialogProps) {
   ] as const;
   const canSubmitPublishRepository = useMemo(() => {
-    if (!selectedPublishProviderReadiness.ready) return false;
+    if (!publishRepositoryAction.isAllowed || !selectedPublishProviderReadiness.ready) return false;
     if (publishRepositoryAction.isPending) return false;
     const repositoryParts = publishRepository.trim().split("/");
     const owner = repositoryParts[0]?.trim() ?? "";
     const rest = repositoryParts.slice(1);
     const name = rest.join("/").trim();
     return owner.length > 0 && name.length > 0;
-  }, [publishRepository, publishRepositoryAction.isPending, selectedPublishProviderReadiness]);
+  }, [
+    publishRepository,
+    publishRepositoryAction.isAllowed,
+    publishRepositoryAction.isPending,
+    selectedPublishProviderReadiness,
+  ]);
   const submitPublishRepository = useCallback(() => {
     if (!canSubmitPublishRepository) {
 @@ -1070,6 +1080,11 @@ export default function GitActionsControl({
   );
   const activeEnvironmentId = activeThreadRef?.environmentId ?? null;
   const successScopeKey = `${activeEnvironmentId ?? ""}\u0000${gitCwd ?? ""}`;
+  const canWriteSourceControl = useEnvironmentScope(
+    activeEnvironmentId,
+    AuthSourceControlWriteScope,
+  );
+  const canOperateThread = useEnvironmentScope(activeEnvironmentId, AuthOrchestrationOperateScope);
   const serverConfig = useAtomValue(serverEnvironment.configValueAtom(activeEnvironmentId));
   const openInPreferredEditor = useOpenInPreferredEditor(
     activeEnvironmentId,
 @@ -1079,7 +1094,7 @@ export default function GitActionsControl({
     () => (activeThreadRef ? { threadRef: activeThreadRef } : undefined),
     [activeThreadRef],
   );
-  const activeServerThread = useThreadShell(activeThreadRef);
+  const activeServerThreadShell = useThreadShell(activeThreadRef);
   const openPrLink = useOpenPrLink(activeThreadRef ?? undefined);
   const activeDraftThread = useComposerDraftStore((store) =>
     draftId
 @@ -1088,6 +1103,13 @@ export default function GitActionsControl({
         ? store.getDraftThreadByRef(activeThreadRef)
         : null,
   );
+  const activeServerThreadProjection = useThreadProjection(
+    activeDraftThread !== null && activeServerThreadShell === null ? null : activeThreadRef,
+  );
+  const activeServerThread =
+    activeServerThreadShell ?? activeServerThreadProjection?.projection.thread ?? null;
+  const isLocalDraftThread = activeDraftThread !== null && activeServerThread === null;
+  const canChangeThreadBranch = canWriteSourceControl && (isLocalDraftThread || canOperateThread);
   const setDraftThreadContext = useComposerDraftStore((store) => store.setDraftThreadContext);
   const [isCommitDialogOpen, setIsCommitDialogOpen] = useState(false);
   const [dialogCommitMessage, setDialogCommitMessage] = useState("");
 @@ -1120,7 +1142,10 @@ export default function GitActionsControl({
       }
       if (activeServerThread) {
-        if (activeServerThread.branch === branch) {
+        if (
+          !readEnvironmentScope(activeThreadRef.environmentId, AuthOrchestrationOperateScope) ||
+          activeServerThread.branch === branch
+        ) {
           return;
         }
 @@ -1248,9 +1273,11 @@ export default function GitActionsControl({
       resolveQuickAction(gitStatusForActions, isGitActionRunning, isDefaultRef, hasPrimaryRemote),
     [gitStatusForActions, hasPrimaryRemote, isDefaultRef, isGitActionRunning],
   );
-  const quickActionDisabledReason = quickAction.disabled
+  const quickActionDisabledReason = !canWriteSourceControl
-    ? (quickAction.hint ?? "This action is currently unavailable.")
+    ? "This connection cannot change source control."
-    : null;
+    : quickAction.disabled
+      ? (quickAction.hint ?? "This action is currently unavailable.")
+      : null;
   const gitActionProgress = resolveGitActionProgressPresentation(vcsActionState);
   const pendingDefaultBranchActionCopy = pendingDefaultBranchAction
     ? resolveDefaultBranchActionDialogCopy({
 @@ -1304,6 +1331,14 @@ export default function GitActionsControl({
       featureBranch = false,
       filePaths,
     }: RunGitActionWithToastInput) => {
+      if (
+        activeEnvironmentId === null ||
+        !readEnvironmentScope(activeEnvironmentId, AuthSourceControlWriteScope) ||
+        (featureBranch &&
+          !isLocalDraftThread &&
+          !readEnvironmentScope(activeEnvironmentId, AuthOrchestrationOperateScope))
+      )
+        return;
       const actionStatus = statusOverride ?? gitStatusForActions;
       const actionBranch = actionStatus?.refName ?? null;
       const actionIsDefaultBranch = featureBranch ? false : isDefaultRef;
 @@ -1459,7 +1494,7 @@ export default function GitActionsControl({
   };
   const checkoutFeatureBranchAndContinuePendingAction = () => {
-    if (!pendingDefaultBranchAction) return;
+    if (!canChangeThreadBranch || !pendingDefaultBranchAction) return;
     const { action, commitMessage, onConfirmed, filePaths } = pendingDefaultBranchAction;
     setPendingDefaultBranchAction(null);
     void runGitActionWithToast({
 @@ -1473,7 +1508,7 @@ export default function GitActionsControl({
   };
   const runDialogActionOnNewBranch = () => {
-    if (!isCommitDialogOpen) return;
+    if (!canChangeThreadBranch || !isCommitDialogOpen) return;
     const commitMessage = dialogCommitMessage.trim();
     setIsCommitDialogOpen(false);
 @@ -1616,7 +1651,8 @@ export default function GitActionsControl({
     [gitCwd, openInPreferredEditor, threadToastData],
   );
-  const canPublishRepository = isRepo && gitStatusForActions !== null && !hasPrimaryRemote;
+  const canPublishRepository =
+    canWriteSourceControl && isRepo && gitStatusForActions !== null && !hasPrimaryRemote;
   const initializeGit = () => {
     void (async () => {
 @@ -1683,7 +1719,7 @@ export default function GitActionsControl({
           <MenuItem
             density={presentation === "menu" ? "touch" : "default"}
             key={`${item.id}-${item.label}`}
-            disabled={item.disabled}
+            disabled={!canWriteSourceControl || item.disabled}
             onClick={() => {
               openDialogForMenuItem(item);
             }}
 @@ -1777,7 +1813,7 @@ export default function GitActionsControl({
           variant={isPanel ? "ghost" : "outline"}
           part="row"
           panel={isPanel}
-          disabled={initAction.isPending}
+          disabled={!canWriteSourceControl || initAction.isPending}
           onClick={initializeGit}
         >
           <GitBranchPlusIcon className="size-3.5" aria-hidden />
 @@ -1855,7 +1891,7 @@ export default function GitActionsControl({
               size="xs"
               part="primary"
               panel={isPanel}
-              disabled={isGitActionRunning || quickAction.disabled}
+              disabled={!canWriteSourceControl || isGitActionRunning || quickAction.disabled}
               onClick={runQuickAction}
             >
               <GitQuickActionIcon
 @@ -2035,6 +2071,8 @@ export default function GitActionsControl({
                                 <button
                                   type="button"
                                   className="flex min-w-0 flex-1 items-center justify-between gap-3 text-left"
+                                  disabled={!canOperateThread}
+                                  aria-label={`Open ${file.path} in editor`}
                                   onClick={() => openChangedFileInEditor(file.path)}
                                 >
                                   <StartTruncatedPath
 @@ -2102,12 +2140,16 @@ export default function GitActionsControl({
             <Button
               variant="outline"
               size="sm"
-              disabled={noneSelected}
+              disabled={!canChangeThreadBranch || noneSelected}
               onClick={runDialogActionOnNewBranch}
             >
               Commit on new branch
             </Button>
-            <Button size="sm" disabled={noneSelected} onClick={runDialogAction}>
+            <Button
+              size="sm"
+              disabled={!canWriteSourceControl || noneSelected}
+              onClick={runDialogAction}
+            >
               Commit
             </Button>
           </DialogFooter>
 @@ -2151,6 +2193,7 @@ export default function GitActionsControl({
               variant="outline"
               size="sm-multiline"
               onClick={continuePendingDefaultBranchAction}
+              disabled={!canWriteSourceControl}
             >
               {pendingDefaultBranchActionCopy?.continueLabel ?? "Continue"}
             </Button>
 @@ -2158,6 +2201,7 @@ export default function GitActionsControl({
               className="w-full max-w-full sm:w-auto"
               size="sm-multiline"
               onClick={checkoutFeatureBranchAndContinuePendingAction}
+              disabled={!canChangeThreadBranch}
             >
               Check out feature branch & continue
             </Button>

apps/web/src/components/PullRequestThreadDialog.test.ts created+273

...	@@ -0,0 +1,273 @@
1	import {
2	AuthOrchestrationOperateScope,
3	AuthSourceControlWriteScope,
4	EnvironmentId,
5	ThreadId,
6	} from "@t3tools/contracts";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult } from "effect/reactivity";
9	import { isValidElement, type ReactNode } from "react";
10	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
11
12	const state = vi.hoisted(() => ({
13	canOperate: false,
14	canWriteSourceControl: true,
15	hookValues: [] as unknown[],
16	hookIndex: 0,
17	tracks: 0,
18	resets: 0,
19	manager: { operation: null as string \| null, error: null, isRunning: false },
20	interrupted: false,
21	pendingResponse: undefined as Promise<void> \| undefined,
22	openChanges: [] as boolean[],
23	checkouts: [] as string[],
24	setupScripts: 0,
25	prepared: [] as { branch: string; worktreePath: string \| null }[],
26	}));
27
28	vi.mock("react", async (importOriginal) => ({
29	...(await importOriginal<typeof import("react")>()),
30	useCallback: (callback: unknown) => callback,
31	useMemo: (factory: () => unknown) => factory(),
32	useState: (initial: unknown) => {
33	const index = state.hookIndex++;
34	if (index === state.hookValues.length) state.hookValues.push(initial);
35	return [state.hookValues[index], (value: unknown) => (state.hookValues[index] = value)];
36	},
37	useRef: (current: unknown) => ({ current }),
38	useEffect: () => {},
39	}));
40	vi.mock("@tanstack/react-pacer", () => ({
41	useDebouncedValue: (value: unknown) => [value, { state: { isPending: false } }],
42	}));
43	vi.mock("~/state/session", () => ({
44	useEnvironmentScope: (_environmentId: unknown, scope: string) =>
45	scope === AuthOrchestrationOperateScope
46	? state.canOperate
47	: scope === AuthSourceControlWriteScope && state.canWriteSourceControl,
48	readEnvironmentScope: (_environmentId: unknown, scope: string) =>
49	scope === AuthOrchestrationOperateScope
50	? state.canOperate
51	: scope === AuthSourceControlWriteScope && state.canWriteSourceControl,
52	}));
53	vi.mock("~/lib/sourceControlActions", async () => {
54	const { usePreparePullRequestThreadAction } = await vi.importActual<
55	typeof import("~/state/sourceControlActions")
56	>("~/state/sourceControlActions");
57	return {
58	readCachedPullRequestResolution: () => null,
59	usePullRequestResolution: () => ({
60	data: { pullRequest: { number: 123, title: "Pull request", state: "open" } },
61	}),
62	usePreparePullRequestThreadAction,
63	};
64	});
65	vi.mock("@effect/atom-react", () => ({ useAtomValue: () => state.manager }));
66	vi.mock("~/rpc/atomRegistry", () => ({ appAtomRegistry: {} }));
67	vi.mock("~/state/use-atom-command", () => ({
68	useAtomCommand: (command: unknown) => command,
69	}));
70	vi.mock("~/state/sourceControl", () => ({ sourceControlEnvironment: {} }));
71	vi.mock("~/state/git", () => ({
72	gitEnvironment: {
73	preparePullRequestThread: async ({
74	input: { mode, threadId },
75	}: {
76	input: { mode: string; threadId?: string };
77	}) => {
78	state.checkouts.push(mode);
79	if (mode === "worktree" && threadId) state.setupScripts += 1;
80	await state.pendingResponse;
81	if (state.interrupted) return AsyncResult.failure(Cause.interrupt());
82	return AsyncResult.success({
83	branch: "feature/pr",
84	worktreePath: mode === "worktree" ? "/worktree" : null,
85	});
86	},
87	},
88	}));
89	vi.mock("~/lib/utils", () => ({ cn: () => "" }));
90	vi.mock("~/state/query", () => ({ useEnvironmentQuery: () => ({ data: null }) }));
91	vi.mock("~/state/vcs", () => ({
92	vcsEnvironment: { status: () => null },
93	vcsActionManager: {
94	stateAtom: () => "vcs-state",
95	track: (_registry: unknown, _target: unknown, _input: unknown, execute: () => unknown) => {
96	state.tracks += 1;
97	return execute();
98	},
99	resetError: () => state.resets++,
100	},
101	}));
102	vi.mock("./ui/button", () => ({ Button: "Button" }));
103	vi.mock("./ui/input", () => ({ Input: "Input" }));
104	vi.mock("./ui/spinner", () => ({ Spinner: "Spinner" }));
105	vi.mock("./ui/dialog", () => ({
106	Dialog: "Dialog",
107	DialogDescription: "DialogDescription",
108	DialogFooter: "DialogFooter",
109	DialogHeader: "DialogHeader",
110	DialogPanel: "DialogPanel",
111	DialogPopup: "DialogPopup",
112	DialogTitle: "DialogTitle",
113	}));
114
115	import { PullRequestThreadDialog } from "./PullRequestThreadDialog";
116
117	function findAction(node: ReactNode, label: string): (() => unknown) \| null {
118	if (Array.isArray(node)) {
119	for (const child of node) {
120	const action = findAction(child, label);
121	if (action) return action;
122	}
123	return null;
124	}
125	if (!isValidElement<{ children?: ReactNode; onClick?: () => unknown }>(node)) return null;
126	if (node.props.children === label) return node.props.onClick ?? null;
127	return findAction(node.props.children, label);
128	}
129
130	function renderDialog() {
131	state.hookIndex = 0;
132	return PullRequestThreadDialog({
133	open: true,
134	environmentId: EnvironmentId.make("environment"),
135	threadId: ThreadId.make("thread"),
136	cwd: "/repo",
137	initialReference: "123",
138	onOpenChange: (open) => state.openChanges.push(open),
139	onPrepared: (input) => {
140	state.prepared.push(input);
141	},
142	});
143	}
144
145	function prepareAction(label: "Local" \| "Worktree") {
146	const action = findAction(renderDialog(), label);
147	if (!action) throw new Error(`${label} action missing`);
148	return action;
149	}
150
151	function visibleText(node: ReactNode): string {
152	if (Array.isArray(node)) return node.map(visibleText).join(" ");
153	if (typeof node === "string" \|\| typeof node === "number") return String(node);
154	return isValidElement<{ children?: ReactNode }>(node) ? visibleText(node.props.children) : "";
155	}
156
157	function deferred<T>() {
158	let resolve!: (value: T) => void;
159	const promise = new Promise<T>((complete) => {
160	resolve = complete;
161	});
162	return { promise, resolve };
163	}
164
165	describe("pull request worktree permissions", () => {
166	beforeEach(() => {
167	state.canOperate = false;
168	state.canWriteSourceControl = true;
169	state.hookValues = [];
170	state.hookIndex = 0;
171	state.tracks = 0;
172	state.resets = 0;
173	state.manager = { operation: null, error: null, isRunning: false };
174	state.interrupted = false;
175	state.pendingResponse = undefined;
176	state.openChanges = [];
177	state.checkouts = [];
178	state.setupScripts = 0;
179	state.prepared = [];
180	});
181
182	it("does not prepare a worktree or run setup with only source-control permission", async () => {
183	await prepareAction("Worktree")();
184
185	expect(state.checkouts).toEqual([]);
186	expect(state.setupScripts).toBe(0);
187	expect(state.prepared).toEqual([]);
188	});
189
190	it("prepares the worktree and thread when task permission is also granted", async () => {
191	state.canOperate = true;
192	await prepareAction("Worktree")();
193
194	expect(state.checkouts).toEqual(["worktree"]);
195	expect(state.setupScripts).toBe(1);
196	expect(state.prepared).toEqual([{ branch: "feature/pr", worktreePath: "/worktree" }]);
197	});
198
199	it("rechecks task permission before invoking a retained worktree action", async () => {
200	state.canOperate = true;
201	const prepare = prepareAction("Worktree");
202	state.canOperate = false;
203	await prepare();
204
205	expect(state.checkouts).toEqual([]);
206	expect(state.setupScripts).toBe(0);
207	});
208
209	it("keeps local checkout available without task permission", async () => {
210	await prepareAction("Local")();
211
212	expect(state.checkouts).toEqual(["local"]);
213	expect(state.setupScripts).toBe(0);
214	expect(state.prepared).toEqual([{ branch: "feature/pr", worktreePath: null }]);
215	});
216
217	it.each(["Local", "Worktree"] as const)(
218	"shows the returned scope denial for a retained %s callback without starting a checkout",
219	async (label) => {
220	state.canOperate = true;
221	state.manager = { operation: "pull", error: null, isRunning: true };
222	const prepare = prepareAction(label);
223	state.canWriteSourceControl = false;
224
225	await prepare();
226
227	expect(visibleText(renderDialog())).toContain(
228	"This connection cannot change source control.",
229	);
230	expect(state.checkouts).toEqual([]);
231	expect(state.setupScripts).toBe(0);
232	expect(state.prepared).toEqual([]);
233	expect(state.openChanges).toEqual([]);
234	expect(state.tracks).toBe(0);
235	expect(state.manager).toEqual({ operation: "pull", error: null, isRunning: true });
236	},
237	);
238
239	it("clears a returned error when a newly authorized retry starts, then completes normally", async () => {
240	const prepare = prepareAction("Local");
241	state.canWriteSourceControl = false;
242	await prepare();
243	expect(visibleText(renderDialog())).toContain("This connection cannot change source control.");
244
245	state.canWriteSourceControl = true;
246	const response = deferred<void>();
247	state.pendingResponse = response.promise;
248	const completion = prepareAction("Local")();
249
250	expect(visibleText(renderDialog())).not.toContain(
251	"This connection cannot change source control.",
252	);
253	expect(state.checkouts).toEqual(["local"]);
254	expect(state.prepared).toEqual([]);
255	response.resolve(undefined);
256	await completion;
257
258	expect(state.prepared).toEqual([{ branch: "feature/pr", worktreePath: null }]);
259	expect(state.openChanges).toEqual([false]);
260	});
261
262	it("keeps interrupted preparations quiet and preserves error reset behavior", async () => {
263	state.interrupted = true;
264	const before = visibleText(renderDialog());
265
266	await prepareAction("Local")();
267
268	expect(visibleText(renderDialog())).toBe(before);
269	expect(state.resets).toBe(1);
270	expect(state.prepared).toEqual([]);
271	expect(state.openChanges).toEqual([]);
272	});
273	});

apps/web/src/components/PullRequestThreadDialog.tsx+35-8

 @@ -1,5 +1,12 @@
-import type { EnvironmentId, ThreadId } from "@t3tools/contracts";
+import {
-import { isAtomCommandInterrupted } from "@t3tools/client-runtime/state/runtime";
+  AuthOrchestrationOperateScope,
+  type EnvironmentId,
+  type ThreadId,
+} from "@t3tools/contracts";
+import {
+  isAtomCommandInterrupted,
+  squashAtomCommandFailure,
+} from "@t3tools/client-runtime/state/runtime";
 import { useDebouncedValue } from "@tanstack/react-pacer";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 @@ -12,6 +19,7 @@ import { cn } from "~/lib/utils";
 import { parsePullRequestReference } from "~/pullRequestReference";
 import { getSourceControlPresentation } from "~/sourceControlPresentation";
 import { useEnvironmentQuery } from "~/state/query";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { vcsEnvironment } from "~/state/vcs";
 import { Button } from "./ui/button";
 import {
 @@ -49,6 +57,7 @@ export function PullRequestThreadDialog({
   const [reference, setReference] = useState(initialReference ?? "");
   const [referenceDirty, setReferenceDirty] = useState(false);
   const [preparingMode, setPreparingMode] = useState<"local" | "worktree" | null>(null);
+  const [prepareErrorMessage, setPrepareErrorMessage] = useState<string | null>(null);
   const [debouncedReference, referenceDebouncer] = useDebouncedValue(
     reference,
     { wait: 450 },
 @@ -102,6 +111,7 @@ export function PullRequestThreadDialog({
     );
   }, [parsedReference, sourceControlScope]);
   const preparePullRequestThreadAction = usePreparePullRequestThreadAction(sourceControlScope);
+  const canOperateThread = useEnvironmentScope(environmentId, AuthOrchestrationOperateScope);
   const liveResolvedPullRequest =
     parsedReference !== null && parsedReference === parsedDebouncedReference
 @@ -131,6 +141,13 @@ export function PullRequestThreadDialog({
   const handleConfirm = useCallback(
     async (mode: "local" | "worktree") => {
+      if (!preparePullRequestThreadAction.isAllowed) return;
+      if (
+        mode === "worktree" &&
+        !readEnvironmentScope(environmentId, AuthOrchestrationOperateScope)
+      ) {
+        return;
+      }
       if (!parsedReference) {
         setReferenceDirty(true);
         return;
 @@ -138,6 +155,7 @@ export function PullRequestThreadDialog({
       if (!parsedReference || !resolvedPullRequest || !cwd) {
         return;
       }
+      setPrepareErrorMessage(null);
       setPreparingMode(mode);
       const result = await preparePullRequestThreadAction.run({
         reference: parsedReference,
 @@ -148,6 +166,13 @@ export function PullRequestThreadDialog({
       if (result._tag === "Failure") {
         if (isAtomCommandInterrupted(result)) {
           preparePullRequestThreadAction.resetError();
+        } else {
+          const error = squashAtomCommandFailure(result);
+          setPrepareErrorMessage(
+            error instanceof Error
+              ? error.message
+              : `Failed to prepare ${terminology.singular} thread.`,
+          );
         }
         return;
       }
 @@ -159,11 +184,13 @@ export function PullRequestThreadDialog({
     },
     [
       cwd,
+      environmentId,
       onOpenChange,
       onPrepared,
       parsedReference,
       preparePullRequestThreadAction,
       resolvedPullRequest,
+      terminology.singular,
       threadId,
     ],
   );
 @@ -177,6 +204,7 @@ export function PullRequestThreadDialog({
         : null;
   const errorMessage =
     validationMessage ??
+    prepareErrorMessage ??
     (resolvedPullRequest === null && pullRequestResolution.error
       ? pullRequestResolution.error
       : preparePullRequestThreadAction.error instanceof Error
 @@ -273,10 +301,9 @@ export function PullRequestThreadDialog({
             type="button"
             size="sm"
             variant="outline"
-            onClick={() => {
+            onClick={() => handleConfirm("local")}
-              void handleConfirm("local");
-            }}
             disabled={
+              !preparePullRequestThreadAction.isAllowed ||
               !cwd ||
               !resolvedPullRequest ||
               isResolving ||
 @@ -288,10 +315,10 @@ export function PullRequestThreadDialog({
           <Button
             type="button"
             size="sm"
-            onClick={() => {
+            onClick={() => handleConfirm("worktree")}
-              void handleConfirm("worktree");
-            }}
             disabled={
+              !preparePullRequestThreadAction.isAllowed ||
+              !canOperateThread ||
               !cwd ||
               !resolvedPullRequest ||
               isResolving ||

apps/web/src/components/Sidebar.tsx+183-61

 @@ -1,3 +1,4 @@
+import { type EnvironmentId } from "@t3tools/contracts";
 import { ThreadHoverCard, ThreadHoverCardPopup } from "./ThreadHoverCard";
 import { CollapsibleSectionHeader } from "./ui/collapsible-section-header";
 import { setThreadChangeRequestSnapshot } from "./ThreadStatusIndicators";
 @@ -52,6 +53,7 @@ import {
   scopedThreadKey,
 } from "@t3tools/client-runtime/environment";
 import {
+  AuthOrchestrationOperateScope,
   type EnvironmentMachineKind,
   type ScopedThreadRef,
   type ThreadId,
 @@ -158,7 +160,8 @@ import { vcsEnvironment } from "../state/vcs";
 import { threadEnvironment } from "../state/threads";
 import { useEnvironmentQuery } from "../state/query";
 import { useThreadSearch } from "../state/queries";
-import { useAtomCommand } from "../state/use-atom-command";
+import { useOrchestrationCommand } from "../state/use-orchestration-command";
+import { readEnvironmentScope, useEnvironmentScope } from "../state/session";
 import {
   buildThreadRouteParams,
   resolveActiveThreadRouteRef,
 @@ -170,7 +173,11 @@ import type { EnvironmentProject } from "@t3tools/client-runtime/state/shell";
 import { cn } from "~/lib/utils";
 import { EnvironmentMachineIcon } from "./EnvironmentMachineIcon";
 import { ProjectEnvironmentBadge } from "./ProjectEnvironmentBadge";
-import { buildDraftActionMenuItems, buildThreadActionMenuItems } from "./threadActionMenu.logic";
+import {
+  buildDraftActionMenuItems,
+  buildThreadActionMenuItems,
+  threadActionRequiresOperate,
+} from "./threadActionMenu.logic";
 import {
   animateSidebarLayoutChanges,
   applySidebarThreadDrop,
 @@ -296,6 +303,26 @@ const WORKING_SHELF_EXPANDED_KEY = "t3code:sidebar:working-expanded";
 // Module scope keeps the inbox order across routes that unmount the sidebar.
 const inboxReturns = createInboxReturnTracker();
+function canOperateThreads(
+  threads: ReadonlyArray<Pick<SidebarThreadSummary, "environmentId">>,
+): boolean {
+  return threads.every((thread) =>
+    readEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope),
+  );
+}
+function checkThreadOperations(
+  threads: ReadonlyArray<Pick<SidebarThreadSummary, "environmentId">>,
+): boolean {
+  if (canOperateThreads(threads)) return true;
+  toastManager.add({
+    type: "error",
+    title: "Thread action unavailable",
+    description: "This connection cannot change one or more selected threads.",
+  });
+  return false;
+}
 function compactSidebarTimeLabel(label: string): string {
   if (label === "just now") return "now";
   return label.endsWith(" ago") ? label.slice(0, -4) : label;
 @@ -619,11 +646,13 @@ function SortableThreadRow(props: {
   id: string;
   disabled: boolean;
   contextDrag: boolean;
+  environmentId: EnvironmentId;
   children: (bag: SortableThreadRowBag) => ReactNode;
 }) {
+  const canOperateThread = useEnvironmentScope(props.environmentId, AuthOrchestrationOperateScope);
   const { listeners, setNodeRef, transform, transition, isDragging } = useSortable({
     id: props.id,
-    disabled: { draggable: props.disabled },
+    disabled: { draggable: props.disabled || !canOperateThread },
     animateLayoutChanges: animateSidebarLayoutChanges,
   });
   // dnd-kit memoizes each field but not the bag, so the memoized row would
 @@ -1173,6 +1202,10 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
     [thread.environmentId, thread.id],
   );
   const threadKey = scopedThreadKey(threadRef);
+  const canOperateThread = useEnvironmentScope(thread.environmentId, AuthOrchestrationOperateScope);
+  useEffect(() => {
+    if (!canOperateThread && isRenaming) onCancelRename();
+  }, [canOperateThread, isRenaming, onCancelRename]);
   const { leaseLiveStatus, rowRef } = useSidebarRowSubscriptionLease(props.isActive);
   const isRegeneratingTitle = thread.titleRegeneration != null;
   const localLastVisitedAt = useUiStateStore((state) => state.threadLastVisitedAtById[threadKey]);
 @@ -1389,7 +1422,14 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
   );
   const handleDoubleClick = useCallback(
     (event: ReactMouseEvent) => {
-      if (isRenaming || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) {
+      if (
+        !readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope) ||
+        isRenaming ||
+        event.metaKey ||
+        event.ctrlKey ||
+        event.shiftKey ||
+        event.altKey
+      ) {
         return;
       }
       if ((event.target as HTMLElement).closest("button, a, input")) return;
 @@ -1497,7 +1537,11 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
   // Snooze is offered only where it can succeed: capability-gated and never
   // on blocked-on-you work or queued turns (the server rejects both).
   const showSnoozeButton =
-    props.snoozeSupported && canSnooze(thread, { now: new Date().toISOString() });
+    canOperateThread &&
+    props.snoozeSupported &&
+    canSnooze(thread, { now: new Date().toISOString() });
+  const showHoverActions =
+    (canOperateThread && props.settlementSupported) || showSnoozeButton || hasUnsentDraft;
   // If the thread becomes blocked while the popover is open, the button
   // unmounts without firing onOpenChange(false). Deriving the flag keeps a
   // stale true from permanently hiding the status label / pinning the
 @@ -1600,52 +1644,53 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
     isActive: props.isActive,
   });
-  const title = isRenaming ? (
+  const title =
-    <input
+    isRenaming && canOperateThread ? (
-      autoFocus
+      <input
-      value={renamingTitle}
+        autoFocus
-      aria-label="Thread title"
+        value={renamingTitle}
-      onChange={(event) => onRenameTitleChange(event.target.value)}
+        aria-label="Thread title"
-      onFocus={(event) => event.currentTarget.select()}
+        onChange={(event) => onRenameTitleChange(event.target.value)}
-      onKeyDown={handleRenameKeyDown}
+        onFocus={(event) => event.currentTarget.select()}
-      onBlur={handleRenameBlur}
+        onKeyDown={handleRenameKeyDown}
-      onClick={(event) => event.stopPropagation()}
+        onBlur={handleRenameBlur}
-      onDoubleClick={(event) => event.stopPropagation()}
+        onClick={(event) => event.stopPropagation()}
-      className="min-w-0 flex-1 rounded-sm border border-input bg-card px-1 text-sm font-medium text-card-foreground outline-none focus:border-foreground"
+        onDoubleClick={(event) => event.stopPropagation()}
-    />
+        className="min-w-0 flex-1 rounded-sm border border-input bg-card px-1 text-sm font-medium text-card-foreground outline-none focus:border-foreground"
-  ) : (
+      />
-    <span
+    ) : (
-      aria-hidden
+      <span
-      className={cn(
+        aria-hidden
-        "min-w-0 flex-1 text-sm transition-opacity motion-reduce:transition-none",
+        className={cn(
-        shouldRecede ? "font-normal" : "font-medium",
+          "min-w-0 flex-1 text-sm transition-opacity motion-reduce:transition-none",
-        variant === "card"
+          shouldRecede ? "font-normal" : "font-medium",
-          ? cn(
+          variant === "card"
-              "truncate",
+            ? cn(
-              shouldRecede
+                "truncate",
-                ? "text-secondary-label"
+                shouldRecede
-                : isUnread || isWoke || status === "input"
+                  ? "text-secondary-label"
-                  ? "text-foreground"
+                  : isUnread || isWoke || status === "input"
-                  : status === "failed"
+                    ? "text-foreground"
-                    ? "text-foreground/95"
+                    : status === "failed"
-                    : "text-foreground/90",
+                      ? "text-foreground/95"
-            )
+                      : "text-foreground/90",
-          : cn(
+              )
-              "truncate group-focus-within/sidebar-row:text-foreground group-hover/sidebar-row:text-foreground",
+            : cn(
-              shouldRecede
+                "truncate group-focus-within/sidebar-row:text-foreground group-hover/sidebar-row:text-foreground",
-                ? "text-secondary-label/70"
+                shouldRecede
-                : props.isActive || isWoke || status === "input"
+                  ? "text-secondary-label/70"
-                  ? "text-foreground"
+                  : props.isActive || isWoke || status === "input"
-                  : isUnread
+                    ? "text-foreground"
-                    ? "text-muted-foreground"
+                    : isUnread
-                    : "text-secondary-label/70",
+                      ? "text-muted-foreground"
-            ),
+                      : "text-secondary-label/70",
-        isRegeneratingTitle && "opacity-55",
+              ),
-      )}
+          isRegeneratingTitle && "opacity-55",
-    >
+        )}
-      {thread.title}
+      >
-    </span>
+        {thread.title}
-  );
+      </span>
+    );
   const accessibleTitle = isRenaming ? null : <span className="sr-only">{thread.title}</span>;
   // Stacks show their layer count; multiple unrelated links show their total count.
 @@ -1706,7 +1751,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
   const showPin =
     props.isPinned && (!sortable?.isDragging || (props.dragOverPinned && props.dropVerb === null));
   const pinIndicator = showPin ? (
-    props.pinningSupported && !sortable?.isDragging ? (
+    props.pinningSupported && canOperateThread && !sortable?.isDragging ? (
       <Tooltip>
         <TooltipTrigger
           render={
 @@ -2350,7 +2395,7 @@ export default function Sidebar() {
     archiveThread,
     deleteThread,
   } = useThreadActions();
-  const updateThreadMetadata = useAtomCommand(threadEnvironment.updateMetadata, {
+  const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
     reportFailure: false,
   });
   const { copyToClipboard: copyPathToClipboard } = useCopyToClipboard<{ path: string }>({
 @@ -3180,6 +3225,7 @@ export default function Sidebar() {
   const [renamingThreadKey, setRenamingThreadKey] = useState<string | null>(null);
   const [renamingTitle, setRenamingTitle] = useState("");
   const startThreadRename = useCallback((threadRef: ScopedThreadRef, title: string) => {
+    if (!readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope)) return;
     setRenamingThreadKey(scopedThreadKey(threadRef));
     setRenamingTitle(title);
   }, []);
 @@ -3187,6 +3233,7 @@ export default function Sidebar() {
   const commitThreadRename = useCallback(
     (threadRef: ScopedThreadRef, title: string, originalTitle: string) => {
       void (async () => {
+        if (!readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope)) return;
         const trimmed = title.trim();
         setRenamingThreadKey(null);
         if (trimmed.length === 0) {
 @@ -3960,6 +4007,17 @@ export default function Sidebar() {
           : plan.kind === "reorder-pinned" || plan.kind === "move-active"
             ? plan.assignments
             : [];
+      // A drop rewrites the dragged row and every row it renumbers, so all of
+      // them must be writable before any of them changes.
+      if (
+        !checkThreadOperations(
+          [activeKey, ...assignments.map(({ id }) => id)].flatMap((key) => {
+            const thread = threadByKey.get(key);
+            return thread ? [thread] : [];
+          }),
+        )
+      )
+        return;
       const drop = {
         key: activeKey,
         sourceSection: activeSection,
 @@ -4174,6 +4232,9 @@ export default function Sidebar() {
         const thread = threadByKeyRef.current.get(threadKey);
         return thread ? [thread] : [];
       });
+      const settlingThreads = selectedThreads.filter(
+        (thread) => thread.settledOverride !== "settled",
+      );
       const canSnoozeSelection = selectedThreads.every(
         (thread) =>
           serverConfigs.get(thread.environmentId)?.environment.capabilities.threadSnooze === true &&
 @@ -4206,31 +4267,73 @@ export default function Sidebar() {
       const clicked = await settlePromise(() =>
         api.contextMenu.show(
           [
-            ...(unpinMenuItem ? [unpinMenuItem] : []),
+            ...(unpinMenuItem
-            { id: "settle", label: `Settle (${count})` },
+              ? [{ ...unpinMenuItem, disabled: !canOperateThreads(pinnedSelectedThreads) }]
+              : []),
+            {
+              id: "settle",
+              label: `Settle (${count})`,
+              disabled: settlingThreads.length === 0 || !canOperateThreads(settlingThreads),
+            },
             ...(canSnoozeSelection
               ? [
                   {
                     id: "snooze",
                     label: `Snooze (${count})`,
+                    disabled: !canOperateThreads(selectedThreads),
                     children: [
                       ...snoozePresets.map((preset) => ({
                         id: `snooze:${preset.id}`,
                         label: `${preset.label} (${preset.whenLabel})`,
+                        disabled: !canOperateThreads(selectedThreads),
                       })),
-                      { id: "snooze:custom", label: "Custom…", separatorBefore: true },
+                      {
+                        id: "snooze:custom",
+                        label: "Custom…",
+                        separatorBefore: true,
+                        disabled: !canOperateThreads(selectedThreads),
+                      },
                     ],
                   },
                 ]
               : []),
-            ...(titleRegenerationMenuItem ? [titleRegenerationMenuItem] : []),
+            ...(titleRegenerationMenuItem
+              ? [
+                  {
+                    ...titleRegenerationMenuItem,
+                    disabled:
+                      titleRegenerationMenuItem.disabled ||
+                      !canOperateThreads(regeneratableTitleThreads),
+                  },
+                ]
+              : []),
             { id: "mark-unread", label: `Mark unread (${count})` },
-            { id: "delete", label: `Delete (${count})`, destructive: true },
+            {
+              id: "delete",
+              label: `Delete (${count})`,
+              destructive: true,
+              disabled: !canOperateThreads(selectedThreads),
+            },
           ],
           position,
         ),
       );
-      if (clicked._tag === "Failure") return;
+      if (clicked._tag === "Failure" || clicked.value === null) return;
+      const actionTargets =
+        clicked.value === "unpin"
+          ? pinnedSelectedThreads
+          : clicked.value === "regenerate-title"
+            ? regeneratableTitleThreads
+            : clicked.value === "settle"
+              ? settlingThreads.flatMap((thread) => {
+                  const current = threadByKeyRef.current.get(
+                    scopedThreadKey(scopeThreadRef(thread.environmentId, thread.id)),
+                  );
+                  return current && current.settledOverride !== "settled" ? [current] : [];
+                })
+              : selectedThreads;
+      if (clicked.value === "settle" && actionTargets.length === 0) return;
+      if (clicked.value !== "mark-unread" && !checkThreadOperations(actionTargets)) return;
       if (clicked.value?.startsWith("snooze:")) {
         const preset =
           clicked.value === "snooze:custom"
 @@ -4303,7 +4406,11 @@ export default function Sidebar() {
         return;
       }
       if (clicked.value === "settle") {
-        settleThreads(threadKeys);
+        settleThreads(
+          actionTargets.map((thread) =>
+            scopedThreadKey(scopeThreadRef(thread.environmentId, thread.id)),
+          ),
+        );
         clearSelection();
         return;
       }
 @@ -4328,6 +4435,15 @@ export default function Sidebar() {
         );
         if (confirmed._tag === "Failure" || !confirmed.value) return;
       }
+      if (
+        !checkThreadOperations(
+          threadKeys.flatMap((threadKey) => {
+            const thread = threadByKeyRef.current.get(threadKey);
+            return thread ? [thread] : [];
+          }),
+        )
+      )
+        return;
       const { deletedThreadKeys, firstFailure } = await deleteSelectedThreadEntries({
         entries: threadKeys.map((threadKey) => ({ threadKey })),
         delete: async ({ threadKey }, deletedThreadKeys) => {
 @@ -4469,6 +4585,10 @@ export default function Sidebar() {
         const clicked = await settlePromise(() =>
           api.contextMenu.show(
             buildThreadActionMenuItems({
+              canOperate: readEnvironmentScope(
+                threadRef.environmentId,
+                AuthOrchestrationOperateScope,
+              ),
               branch: thread.branch ?? null,
               projectFilter: threadProjectGroup
                 ? {
 @@ -4495,7 +4615,8 @@ export default function Sidebar() {
             position,
           ),
         );
-        if (clicked._tag === "Failure") return;
+        if (clicked._tag === "Failure" || clicked.value === null) return;
+        if (threadActionRequiresOperate(clicked.value) && !checkThreadOperations([thread])) return;
         if (clicked.value?.startsWith("snooze:")) {
           const preset =
             clicked.value === "snooze:custom"
 @@ -5228,6 +5349,7 @@ export default function Sidebar() {
                             key={threadKey}
                             id={threadKey}
                             contextDrag={isContextDrag}
+                            environmentId={thread.environmentId}
                             disabled={
                               renamingThreadKey === threadKey ||
                               section === "working" ||

apps/web/src/components/chat/ChatHeader.tsx+30-7

 @@ -1,4 +1,8 @@
-import { type EnvironmentId, type ThreadId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  type EnvironmentId,
+  type ThreadId,
+} from "@t3tools/contracts";
 import { scopeThreadRef } from "@t3tools/client-runtime/environment";
 import type { EnvironmentProject } from "@t3tools/client-runtime/state/shell";
 import {
 @@ -23,6 +27,8 @@ import { useThreadActionMenu } from "~/hooks/useThreadActionMenu";
 import { readLocalApi } from "~/localApi";
 import { threadEnvironment } from "../../state/threads";
 import { useAtomCommand } from "../../state/use-atom-command";
+import { useOrchestrationCommand } from "../../state/use-orchestration-command";
+import { readEnvironmentScope, useEnvironmentScope } from "../../state/session";
 import { ProjectFavicon } from "../ProjectFavicon";
 import {
   WorkspaceBreadcrumb,
 @@ -81,7 +87,11 @@ export const ChatHeader = memo(function ChatHeader({
     () => scopeThreadRef(activeThreadEnvironmentId, activeThreadId),
     [activeThreadEnvironmentId, activeThreadId],
   );
-  const updateThreadMetadata = useAtomCommand(threadEnvironment.updateMetadata, {
+  const canOperateThread = useEnvironmentScope(
+    activeThreadEnvironmentId,
+    AuthOrchestrationOperateScope,
+  );
+  const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
     reportFailure: false,
   });
   // Inline rename, keyed by thread: navigating away drops an in-progress
 @@ -94,23 +104,36 @@ export const ChatHeader = memo(function ChatHeader({
   } | null>(null);
   if (
     renaming !== null &&
-    (renaming.threadId !== activeThreadId || renaming.environmentId !== activeThreadEnvironmentId)
+    (renaming.threadId !== activeThreadId ||
+      renaming.environmentId !== activeThreadEnvironmentId ||
+      !canOperateThread)
   ) {
     setRenaming(null);
   }
-  const renamingTitle = renaming?.threadId === activeThreadId ? renaming.title : null;
+  const renamingTitle =
+    canOperateThread &&
+    renaming?.threadId === activeThreadId &&
+    renaming.environmentId === activeThreadEnvironmentId
+      ? renaming.title
+      : null;
   const renameCommittedRef = useRef(false);
   const startRename = useCallback(() => {
+    if (
+      !isServerThread ||
+      !readEnvironmentScope(activeThreadEnvironmentId, AuthOrchestrationOperateScope)
+    )
+      return;
     renameCommittedRef.current = false;
     setRenaming({
-      threadId: activeThreadId,
       environmentId: activeThreadEnvironmentId,
+      threadId: activeThreadId,
       title: activeThreadTitle,
     });
-  }, [activeThreadEnvironmentId, activeThreadId, activeThreadTitle]);
+  }, [activeThreadEnvironmentId, activeThreadId, activeThreadTitle, isServerThread]);
   const commitRename = useCallback(
     (title: string) => {
       setRenaming(null);
+      if (!readEnvironmentScope(activeThreadEnvironmentId, AuthOrchestrationOperateScope)) return;
       const resolution = resolveRenameCommit({ title, originalTitle: activeThreadTitle });
       if (resolution.action === "reject-empty") {
         toastManager.add({ type: "warning", title: "Thread title cannot be empty" });
 @@ -303,7 +326,7 @@ export const ChatHeader = memo(function ChatHeader({
                     aria-label={`Thread actions for ${activeThreadTitle}`}
                     aria-haspopup="menu"
                     onClick={openMenuFromTitle}
-                    onDoubleClick={handleTitleDoubleClick}
+                    onDoubleClick={canOperateThread ? handleTitleDoubleClick : undefined}
                     onBlur={cancelPendingTitleMenu}
                     className="group/thread-title inline-flex min-w-0 max-w-full cursor-pointer items-center gap-1 rounded-sm text-left focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
                   />

apps/web/src/components/pullRequest/PullRequestCommentForm.tsx+4-2

apps/web/src/components/pullRequest/PullRequestDetailPanel.test.tsx+6-1

 @@ -24,6 +24,11 @@ const { newThread, prepareThread, refresh, Wrapper, Trigger } = vi.hoisted(() =>
     </>
   ),
 }));
+vi.mock("~/state/session", async (original) => ({
+  ...(await original<typeof import("~/state/session")>()),
+  useEnvironmentScope: () => true,
+  readEnvironmentScope: () => true,
+}));
 vi.mock("@effect/atom-react", () => ({ useAtomValue: () => [] }));
 vi.mock("~/state/server", () => ({ primaryServerKeybindingsAtom: {} }));
 vi.mock("~/state/entities", () => ({ useProjects: () => [], useServerConfigs: () => new Map() }));
 @@ -39,7 +44,7 @@ vi.mock("~/hooks/useSettings", () => ({
 vi.mock("~/hooks/useLiveRefresh", () => ({ useLiveRefresh: () => {} }));
 vi.mock("~/hooks/useHandleNewThread", () => ({ useNewThreadHandler: () => newThread }));
 vi.mock("~/lib/sourceControlActions", () => ({
-  usePreparePullRequestThreadAction: () => ({ run: prepareThread }),
+  usePreparePullRequestThreadAction: () => ({ run: prepareThread, isAllowed: true, error: null }),
 }));
 vi.mock("~/state/use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));
 vi.mock("~/state/pullRequests", async (importOriginal) => ({

apps/web/src/components/pullRequest/PullRequestDetailPanel.tsx+59-12

 @@ -5,6 +5,8 @@ import { RefreshIcon } from "~/components/ui/refresh-icon";
 import { scopedThreadKey, scopeProjectRef } from "@t3tools/client-runtime/environment";
 import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
   type EnvironmentId,
   type PullRequestAction,
   type PullRequestMergeMethod,
 @@ -70,6 +72,7 @@ import type { ReviewCommentContext } from "~/reviewCommentContext";
 import { useProjects, useServerConfigs } from "~/state/entities";
 import { useEnvironments } from "~/state/environments";
 import { useEnvironmentQuery } from "~/state/query";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { useLiveRefresh } from "~/hooks/useLiveRefresh";
 import {
   pullRequestEnvironment,
 @@ -578,6 +581,7 @@ export function PullRequestDetailPanel({
   // Which handoff is preparing, keyed so a per-finding button can say "Preparing..." on itself
   // alone. One at a time whatever the key: they all check the same pull request out.
   const [handoff, setHandoff] = useState<string | null>(null);
+  const canWriteSourceControl = useEnvironmentScope(environmentId, AuthSourceControlWriteScope);
   const detailQuery = useEnvironmentQuery(
     pullRequestEnvironment.detail({ environmentId, input: reference }),
   );
 @@ -690,6 +694,25 @@ export function PullRequestDetailPanel({
         ? null
         : {
             ...coreDetail,
+            capabilities: canWriteSourceControl
+              ? coreDetail.capabilities
+              : {
+                  ...coreDetail.capabilities,
+                  reactions: false,
+                  edit: { changeRequest: false, comment: false },
+                },
+            viewerPermissions: canWriteSourceControl
+              ? coreDetail.viewerPermissions
+              : {
+                  ...coreDetail.viewerPermissions,
+                  actions: [],
+                  comment: false,
+                  resolve: false,
+                  verdicts: [],
+                  requestReviewers: false,
+                  updateMethods: [],
+                  labels: false,
+                },
             author: activity?.author ?? coreDetail.author,
             reviewers: activity?.reviewers ?? coreDetail.reviewers,
             comments: activity?.comments ?? [],
 @@ -699,7 +722,7 @@ export function PullRequestDetailPanel({
             commits: activity?.commits ?? [],
             reactions: activity?.reactions ?? [],
           },
-    [activity, coreDetail],
+    [activity, canWriteSourceControl, coreDetail],
   );
   const handoffSummary = detail ?? sharedSummary;
   const keybindings = useAtomValue(primaryServerKeybindingsAtom);
 @@ -857,8 +880,12 @@ export function PullRequestDetailPanel({
     appliedForcedToken.current = forcedRefreshToken;
     void refreshFromHost();
   }, [forcedRefreshToken, refreshFromHost]);
-  const runAction = useAtomCommand(pullRequestEnvironment.runAction, { reportFailure: false });
+  const runAction = useAtomCommand(pullRequestEnvironment.runAction, {
-  const postComment = useAtomCommand(pullRequestEnvironment.comment, { reportFailure: false });
+    reportFailure: false,
+  });
+  const postComment = useAtomCommand(pullRequestEnvironment.comment, {
+    reportFailure: false,
+  });
   // Which action is in flight, not merely that one is: every control here is disabled while any
   // of them runs, but only the button that was pressed may say what it is doing.
   const [pendingAction, setPendingAction] = useState<PullRequestAction | null>(null);
 @@ -912,6 +939,7 @@ export function PullRequestDetailPanel({
   const actingEnvironmentId = acting?.environmentId ?? environmentId;
   const checkoutRoot =
     acting?.workspaceRoot ?? detail?.workspaceRoot ?? project?.workspaceRoot ?? null;
+  const canOperateThread = useEnvironmentScope(actingEnvironmentId, AuthOrchestrationOperateScope);
   const prepareThread = usePreparePullRequestThreadAction({
     environmentId: actingEnvironmentId,
     cwd: checkoutRoot,
 @@ -973,13 +1001,13 @@ export function PullRequestDetailPanel({
     method?: PullRequestMergeMethod,
     updateMethod?: PullRequestUpdateMethod,
   ) => {
-    if (pendingAction !== null) return false;
+    if (!canWriteSourceControl || pendingAction !== null) return false;
     setPendingAction(action);
     return finishAction(action, method, updateMethod);
   };
   const performCommentAction = async (body: string, action: "close" | "reopen") => {
-    if (pendingAction !== null) return { commentPosted: false };
+    if (!canWriteSourceControl || pendingAction !== null) return { commentPosted: false };
     setPendingAction(action);
     const commentResult = await postComment({
       environmentId,
 @@ -999,7 +1027,7 @@ export function PullRequestDetailPanel({
   const saveTitle = async (next: string) => {
     const title = next.trim();
-    if (detail === null || titleSaving) return;
+    if (!canWriteSourceControl || detail === null || titleSaving) return;
     if (title.length === 0 || title === detail.title) {
       setTitleScope(null);
       return;
 @@ -1030,6 +1058,8 @@ export function PullRequestDetailPanel({
   };
   const attachTarget = composerDraftTarget ?? null;
+  const canPrepareWorktree = prepareThread.isAllowed && canOperateThread;
+  const canFixFindings = attachTarget !== null || canPrepareWorktree;
   const handoffLabels = pullRequestHandoffLabels(attachTarget !== null);
   const writeTaskToComposer = (target: ScopedThreadRef | DraftId, task: ThreadTask) => {
 @@ -1158,6 +1188,18 @@ export function PullRequestDetailPanel({
       return;
     }
     if (checkoutRoot === null) return;
+    if (
+      !prepareThread.isAllowed ||
+      !readEnvironmentScope(actingEnvironmentId, AuthSourceControlWriteScope)
+    ) {
+      return;
+    }
+    if (
+      mode === "worktree" &&
+      !readEnvironmentScope(actingEnvironmentId, AuthOrchestrationOperateScope)
+    ) {
+      return;
+    }
     setHandoff(kind);
     // The menu closes on the press and takes its "Preparing..." label with it, so this is the
     // only thing answering for the checkout. It carries no timeout of its own: a loading toast
 @@ -1528,7 +1570,7 @@ export function PullRequestDetailPanel({
           <TooltipPopup>Check out this pull request</TooltipPopup>
         </Tooltip>
         <MenuPopup align="end" side="bottom">
-          <MenuItem onClick={() => startCheckout("worktree")}>
+          <MenuItem disabled={!canPrepareWorktree} onClick={() => startCheckout("worktree")}>
             <GitBranchIcon className="mt-1 size-3.5 shrink-0 self-start" />
             <span className="flex min-w-0 flex-col">
               <span>In a separate worktree</span>
 @@ -1537,7 +1579,7 @@ export function PullRequestDetailPanel({
               </span>
             </span>
           </MenuItem>
-          <MenuItem onClick={() => startCheckout("local")}>
+          <MenuItem disabled={!prepareThread.isAllowed} onClick={() => startCheckout("local")}>
             <FolderGit2Icon className="mt-1 size-3.5 shrink-0 self-start" />
             <span className="flex min-w-0 flex-col">
               <span>In this repository</span>
 @@ -2016,7 +2058,10 @@ export function PullRequestDetailPanel({
                       </span>
                     </span>
                   </MenuItem>
-                  <MenuItem disabled={handoff !== null} onClick={startFixFindings}>
+                  <MenuItem
+                    disabled={handoff !== null || !canFixFindings}
+                    onClick={startFixFindings}
+                  >
                     <HammerIcon className="size-3.5" />
                     {handoff === "findings" ? "Preparing..." : handoffLabels.fixFindings}
                   </MenuItem>
 @@ -2383,7 +2428,9 @@ export function PullRequestDetailPanel({
                       <Button
                         size="xs"
                         variant="outline"
-                        disabled={titleSaving || titleDraft.trim().length === 0}
+                        disabled={
+                          !canWriteSourceControl || titleSaving || titleDraft.trim().length === 0
+                        }
                         onClick={() => void saveTitle(titleDraft)}
                       >
                         {titleSaving ? "Saving..." : "Save"}
 @@ -2706,7 +2753,7 @@ export function PullRequestDetailPanel({
                   pendingFinding={handoff}
                   fixFindingLabel={handoffLabels.fixFinding}
                   fixCheckLabel={handoffLabels.fixCheck}
-                  onFixFinding={startFixFinding}
+                  {...(canFixFindings ? { onFixFinding: startFixFinding } : {})}
                   onRefresh={refreshDetail}
                   onRefreshChecks={refreshFromHost}
                 />
 @@ -2746,7 +2793,7 @@ export function PullRequestDetailPanel({
                     onSelectedCommitChange={selectCodeCommit}
                     pendingFinding={handoff}
                     fixFindingLabel={handoffLabels.fixFinding}
-                    onFixFinding={startFixFinding}
+                    {...(canFixFindings ? { onFixFinding: startFixFinding } : {})}
                     onRefresh={refreshDetail}
                     refreshToken={codeRefreshToken}
                   />

apps/web/src/components/pullRequest/PullRequestLabelPicker.tsx+4-2

apps/web/src/components/pullRequest/PullRequestMarkdownEditor.test.tsx created+148

...	@@ -0,0 +1,148 @@
1	import { AuthSourceControlWriteScope, EnvironmentId } from "@t3tools/contracts";
2	import { act } from "react";
3	import { create, type ReactTestRenderer } from "react-test-renderer";
4	import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
5
6	const permissions = vi.hoisted(() => ({
7	allowed: new Set<string>(),
8	listeners: new Set<() => void>(),
9	}));
10
11	vi.mock("~/state/session", async () => {
12	const { useSyncExternalStore } = await import("react");
13	const canWrite = (environmentId: string, scope: string) =>
14	scope === AuthSourceControlWriteScope && permissions.allowed.has(environmentId);
15	return {
16	readEnvironmentScope: canWrite,
17	useEnvironmentScope: (environmentId: string, scope: string) =>
18	useSyncExternalStore(
19	(listener) => {
20	permissions.listeners.add(listener);
21	return () => permissions.listeners.delete(listener);
22	},
23	() => canWrite(environmentId, scope),
24	),
25	};
26	});
27	vi.mock("~/lib/utils", () => ({ cn: () => "" }));
28	vi.mock("../ui/button", () => ({ Button: "button" }));
29	vi.mock("../ui/textarea", () => ({ Textarea: "textarea" }));
30	vi.mock("../ui/toggle-group", () => ({ Toggle: "button", ToggleGroup: "div" }));
31	vi.mock("./PullRequestMarkdown", () => ({ PullRequestMarkdown: "article" }));
32
33	import { PullRequestMarkdownEditor } from "./PullRequestMarkdownEditor";
34
35	const primary = EnvironmentId.make("primary");
36	const secondary = EnvironmentId.make("secondary");
37	let renderer: ReactTestRenderer \| undefined;
38	const onSave = vi.fn<(next: string) => void>();
39	const onCancel = vi.fn<() => void>();
40
41	beforeEach(() => {
42	permissions.allowed.clear();
43	permissions.listeners.clear();
44	renderer = undefined;
45	onSave.mockReset();
46	onCancel.mockReset();
47	vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
48	});
49
50	afterEach(async () => {
51	await act(() => renderer?.unmount());
52	vi.unstubAllGlobals();
53	});
54
55	async function openEditor(options?: { value?: string; allowEmpty?: boolean }) {
56	await act(() => {
57	renderer = create(
58	<PullRequestMarkdownEditor
59	value={options?.value ?? "Original description"}
60	cwd="/repo"
61	environmentId={secondary}
62	label="Pull request description"
63	saving={false}
64	allowEmpty={options?.allowEmpty ?? false}
65	onSave={onSave}
66	onCancel={onCancel}
67	/>,
68	);
69	});
70	}
71
72	function saveHandler(): () => void {
73	return renderer!.root.findByProps({ children: "Save" }).props.onClick;
74	}
75
76	async function grant(allowed: boolean) {
77	await act(() => {
78	if (allowed) permissions.allowed.add(secondary);
79	else permissions.allowed.delete(secondary);
80	permissions.listeners.forEach((listener) => listener());
81	});
82	}
83
84	it("does not save a secondary environment's description using the primary grant", async () => {
85	permissions.allowed.add(primary);
86	await openEditor();
87
88	await act(() => saveHandler()());
89
90	expect(onSave).not.toHaveBeenCalled();
91	});
92
93	it("rejects a retained Save callback when the grant changes before React updates", async () => {
94	permissions.allowed.add(secondary);
95	await openEditor();
96	const save = saveHandler();
97	permissions.allowed.delete(secondary);
98
99	await act(() => save());
100
101	expect(onSave).not.toHaveBeenCalled();
102	});
103
104	it("keeps an edited draft through revocation and saves it after access returns without remounting", async () => {
105	permissions.allowed.add(secondary);
106	await openEditor();
107	await act(() => {
108	renderer!.root.findByType("textarea").props.onChange({
109	target: { value: "Keep these unsaved edits" },
110	});
111	});
112
113	await grant(false);
114	await act(() => saveHandler()());
115	expect(onSave).not.toHaveBeenCalled();
116
117	await grant(true);
118	await act(() => saveHandler()());
119	expect(onSave).toHaveBeenCalledExactlyOnceWith("Keep these unsaved edits");
120	});
121
122	it("saves with source-control permission alone", async () => {
123	permissions.allowed.add(secondary);
124	await openEditor();
125
126	await act(() => saveHandler()());
127
128	expect(onSave).toHaveBeenCalledExactlyOnceWith("Original description");
129	});
130
131	it("allows clearing a description only after a pending grant becomes available", async () => {
132	await openEditor({ value: "", allowEmpty: true });
133	await act(() => saveHandler()());
134	expect(onSave).not.toHaveBeenCalled();
135
136	await grant(true);
137	await act(() => saveHandler()());
138	expect(onSave).toHaveBeenCalledExactlyOnceWith("");
139	});
140
141	it("keeps cancelling a local edit available without a write grant", async () => {
142	await openEditor();
143
144	await act(() => renderer!.root.findByProps({ children: "Cancel" }).props.onClick());
145
146	expect(onCancel).toHaveBeenCalledOnce();
147	expect(onSave).not.toHaveBeenCalled();
148	});

apps/web/src/components/pullRequest/PullRequestMarkdownEditor.tsx+28-4

 @@ -1,7 +1,12 @@
 import { useState } from "react";
-import type { EnvironmentId, ScopedThreadRef } from "@t3tools/contracts";
+import {
+  AuthSourceControlWriteScope,
+  type EnvironmentId,
+  type ScopedThreadRef,
+} from "@t3tools/contracts";
 import { cn } from "~/lib/utils";
+import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { Button } from "../ui/button";
 import { Textarea } from "../ui/textarea";
 @@ -43,6 +48,7 @@ export function PullRequestMarkdownEditor({
   readonly onSave: (next: string) => void;
   readonly onCancel: () => void;
 }) {
+  const canWriteSourceControl = useEnvironmentScope(environmentId, AuthSourceControlWriteScope);
   const [draft, setDraft] = useState(value);
   const [preview, setPreview] = useState(false);
   // The words this draft started from. React keeps a component instance wherever the same
 @@ -55,7 +61,7 @@ export function PullRequestMarkdownEditor({
     setDraft(value);
   }
   const empty = draft.trim().length === 0;
-  const saveDisabled = saving || (empty && !allowEmpty);
+  const saveDisabled = !canWriteSourceControl || saving || (empty && !allowEmpty);
   return (
     <div
 @@ -70,7 +76,12 @@ export function PullRequestMarkdownEditor({
         ) {
           event.preventDefault();
           event.stopPropagation();
-          if (!saveDisabled && !event.repeat) onSave(draft);
+          if (
+            !saveDisabled &&
+            !event.repeat &&
+            readEnvironmentScope(environmentId, AuthSourceControlWriteScope)
+          )
+            onSave(draft);
           return;
         }
         if (event.key !== "Escape" || saving) return;
 @@ -119,7 +130,20 @@ export function PullRequestMarkdownEditor({
         <Button size="xs" variant="ghost" disabled={saving} onClick={onCancel}>
           Cancel
         </Button>
-        <Button size="xs" variant="outline" disabled={saveDisabled} onClick={() => onSave(draft)}>
+        <Button
+          size="xs"
+          variant="outline"
+          disabled={!canWriteSourceControl || saving || (empty && !allowEmpty)}
+          onClick={() => {
+            if (
+              !readEnvironmentScope(environmentId, AuthSourceControlWriteScope) ||
+              saving ||
+              (empty && !allowEmpty)
+            )
+              return;
+            onSave(draft);
+          }}
+        >
           {saving ? "Saving..." : "Save"}
         </Button>
       </div>

apps/web/src/components/pullRequest/PullRequestReactions.tsx+4-2

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { useAtomCommand } from "~/state/use-atom-command";
1	import type {	2	import type {
2	EnvironmentId,	3	EnvironmentId,
3	PullRequestReaction,	4	PullRequestReaction,
...	@@ -9,7 +10,6 @@ import { useState } from "react";	...	@@ -9,7 +10,6 @@ import { useState } from "react";
9		10
10	import { cn } from "~/lib/utils";	11	import { cn } from "~/lib/utils";
11	import { pullRequestEnvironment } from "~/state/pullRequests";	12	import { pullRequestEnvironment } from "~/state/pullRequests";
12	import { useAtomCommand } from "~/state/use-atom-command";
13		13
14	import { Popover, PopoverPopup, PopoverTrigger } from "../ui/popover";	14	import { Popover, PopoverPopup, PopoverTrigger } from "../ui/popover";
15	import { toastManager } from "../ui/toast";	15	import { toastManager } from "../ui/toast";
...	@@ -58,7 +58,9 @@ export function PullRequestReactionBar({	...	@@ -58,7 +58,9 @@ export function PullRequestReactionBar({
58	readonly signature: string;	58	readonly signature: string;
59	readonly values: ReadonlyMap<PullRequestReactionContent, boolean>;	59	readonly values: ReadonlyMap<PullRequestReactionContent, boolean>;
60	}>({ signature: "", values: EMPTY_PENDING });	60	}>({ signature: "", values: EMPTY_PENDING });
61	const setReaction = useAtomCommand(pullRequestEnvironment.setReaction, { reportFailure: false });	61	const setReaction = useAtomCommand(pullRequestEnvironment.setReaction, {
		62	reportFailure: false,
		63	});
62		64
63	const signature = reactionsSignature(reactions);	65	const signature = reactionsSignature(reactions);
64	const values = pending.signature === signature ? pending.values : EMPTY_PENDING;	66	const values = pending.signature === signature ? pending.values : EMPTY_PENDING;

apps/web/src/components/pullRequest/PullRequestReviewForm.tsx+1-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { useAtomCommand } from "~/state/use-atom-command";
1	/**	2	/**
2	* The review half of the floating composer: the summary and the verdict that sends it, together	3	* The review half of the floating composer: the summary and the verdict that sends it, together
3	* with whatever line comments the review is holding. The count of those lives on the composer's	4	* with whatever line comments the review is holding. The count of those lives on the composer's
...	@@ -9,7 +10,6 @@ import { CheckIcon, MessageSquareIcon, XCircleIcon } from "lucide-react";	...	@@ -9,7 +10,6 @@ import { CheckIcon, MessageSquareIcon, XCircleIcon } from "lucide-react";
9	import { useState, type ReactNode, type RefObject } from "react";	10	import { useState, type ReactNode, type RefObject } from "react";
10		11
11	import { pullRequestEnvironment } from "~/state/pullRequests";	12	import { pullRequestEnvironment } from "~/state/pullRequests";
12	import { useAtomCommand } from "~/state/use-atom-command";
13		13
14	import { Button } from "../ui/button";	14	import { Button } from "../ui/button";
15	import { Select, SelectItem, SelectPopup, SelectTrigger } from "../ui/select";	15	import { Select, SelectItem, SelectPopup, SelectTrigger } from "../ui/select";

apps/web/src/components/pullRequest/PullRequestReviewerPicker.tsx+1-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { useAtomCommand } from "~/state/use-atom-command";
1	/**	2	/**
2	* Asking someone to review, from the row that says who is already reviewing.	3	* Asking someone to review, from the row that says who is already reviewing.
3	*	4	*
...	@@ -15,7 +16,6 @@ import { useMemo, useState } from "react";	...	@@ -15,7 +16,6 @@ import { useMemo, useState } from "react";
15		16
16	import { pullRequestEnvironment } from "~/state/pullRequests";	17	import { pullRequestEnvironment } from "~/state/pullRequests";
17	import { useEnvironmentQuery } from "~/state/query";	18	import { useEnvironmentQuery } from "~/state/query";
18	import { useAtomCommand } from "~/state/use-atom-command";
19	import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";	19	import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
20		20
21	import { toastManager } from "../ui/toast";	21	import { toastManager } from "../ui/toast";

apps/web/src/components/pullRequest/PullRequestSpeedActions.tsx+6-1

...	@@ -1,4 +1,6 @@	...	@@ -1,4 +1,6 @@
		1	import { useAtomValue } from "@effect/atom-react";
1	import type { PullRequestAction } from "@t3tools/contracts";	2	import type { PullRequestAction } from "@t3tools/contracts";
		3	import { pullRequestEnvironment } from "~/state/pullRequests";
2	import { useUiStateStore } from "~/uiStateStore";	4	import { useUiStateStore } from "~/uiStateStore";
3	import { Button } from "../ui/button";	5	import { Button } from "../ui/button";
4	import { Spinner } from "../ui/spinner";	6	import { Spinner } from "../ui/spinner";
...	@@ -37,6 +39,9 @@ export function PullRequestSpeedActions<Entry extends PullRequestSpeedActionEntr	...	@@ -37,6 +39,9 @@ export function PullRequestSpeedActions<Entry extends PullRequestSpeedActionEntr
37	sweeping?: boolean;	39	sweeping?: boolean;
38	onCloseSweepStart?: (entry: Entry, event: PointerEvent) => void;	40	onCloseSweepStart?: (entry: Entry, event: PointerEvent) => void;
39	}) {	41	}) {
		42	const canWrite = useAtomValue(
		43	pullRequestEnvironment.runAction.permissionAtom(entry.environmentId),
		44	);
40	const resolveProjectDefault = usePullRequestDefaultMergeMethodResolver(	45	const resolveProjectDefault = usePullRequestDefaultMergeMethodResolver(
41	entry.environmentId,	46	entry.environmentId,
42	entry.projectId,	47	entry.projectId,
...	@@ -90,7 +95,7 @@ export function PullRequestSpeedActions<Entry extends PullRequestSpeedActionEntr	...	@@ -90,7 +95,7 @@ export function PullRequestSpeedActions<Entry extends PullRequestSpeedActionEntr
90	<Button	95	<Button
91	variant={action === "close" ? "destructive-outline" : "outline"}	96	variant={action === "close" ? "destructive-outline" : "outline"}
92	size="xs"	97	size="xs"
93	disabled={busy \|\| (action === "merge" && entry.stack !== undefined)}	98	disabled={!canWrite \|\| busy \|\| (action === "merge" && entry.stack !== undefined)}
94	aria-label={`${label} #${entry.number}`}	99	aria-label={`${label} #${entry.number}`}
95	onClick={() => void perform(action)}	100	onClick={() => void perform(action)}
96	onPointerDown={(event) => {	101	onPointerDown={(event) => {

apps/web/src/components/pullRequest/PullRequestSummaryTab.tsx+1-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { useAtomCommand } from "~/state/use-atom-command";
1	import type {	2	import type {
2	EnvironmentId,	3	EnvironmentId,
3	PullRequestComment,	4	PullRequestComment,
...	@@ -16,7 +17,6 @@ import {	...	@@ -16,7 +17,6 @@ import {
16	} from "lucide-react";	17	} from "lucide-react";
17	import { useRef, useState, type ReactNode } from "react";	18	import { useRef, useState, type ReactNode } from "react";
18		19
19	import { useAtomCommand } from "~/state/use-atom-command";
20	import { pullRequestEnvironment } from "~/state/pullRequests";	20	import { pullRequestEnvironment } from "~/state/pullRequests";
21	import { cn } from "~/lib/utils";	21	import { cn } from "~/lib/utils";
22	import { useOpenLink } from "~/browser/useOpenLink";	22	import { useOpenLink } from "~/browser/useOpenLink";

apps/web/src/components/pullRequest/PullRequestTimelineTab.tsx+1-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import { useAtomCommand } from "~/state/use-atom-command";
1	import type {	2	import type {
2	EnvironmentId,	3	EnvironmentId,
3	PullRequestActor,	4	PullRequestActor,
...	@@ -18,7 +19,6 @@ import { useState, type ReactNode } from "react";	...	@@ -18,7 +19,6 @@ import { useState, type ReactNode } from "react";
18	import { cn } from "~/lib/utils";	19	import { cn } from "~/lib/utils";
19	import { readLocalApi } from "~/localApi";	20	import { readLocalApi } from "~/localApi";
20	import { pullRequestEnvironment } from "~/state/pullRequests";	21	import { pullRequestEnvironment } from "~/state/pullRequests";
21	import { useAtomCommand } from "~/state/use-atom-command";
22	import { formatRelativeTimeLabel } from "~/timestampFormat";	22	import { formatRelativeTimeLabel } from "~/timestampFormat";
23		23
24	import { Button } from "../ui/button";	24	import { Button } from "../ui/button";

apps/web/src/components/pullRequest/usePullRequestActions.ts+4-2

apps/web/src/components/settings/ConnectionsSettings.tsx+6

 @@ -31,6 +31,7 @@ import {
   AuthRelayReadScope,
   AuthRelayWriteScope,
   AuthReviewWriteScope,
+  AuthSourceControlWriteScope,
   AuthStandardClientScopes,
   AuthTerminalOperateScope,
   type AuthClientSession,
 @@ -259,6 +260,11 @@ const PAIRING_SCOPE_OPTIONS: ReadonlyArray<{
     title: "Use terminals",
     description: "Create terminals and send input to running shells.",
   },
+  {
+    scope: AuthSourceControlWriteScope,
+    title: "Change source control",
+    description: "Commit, push, manage branches and repositories, and change pull requests.",
+  },
   {
     scope: AuthReviewWriteScope,
     title: "Write reviews",

apps/web/src/components/threadActionMenu.logic.test.ts+52

...	@@ -7,6 +7,7 @@ import {	...	@@ -7,6 +7,7 @@ import {
7	} from "./threadActionMenu.logic";	7	} from "./threadActionMenu.logic";
8		8
9	const baseState: ThreadActionMenuState = {	9	const baseState: ThreadActionMenuState = {
		10	canOperate: true,
10	branch: null,	11	branch: null,
11	projectFilter: null,	12	projectFilter: null,
12	isPinned: false,	13	isPinned: false,
...	@@ -39,6 +40,57 @@ function allIds(state: ThreadActionMenuState): string[] {	...	@@ -39,6 +40,57 @@ function allIds(state: ThreadActionMenuState): string[] {
39	}	40	}
40		41
41	describe("buildThreadActionMenuItems", () => {	42	describe("buildThreadActionMenuItems", () => {
		43	it.each([false, true])(
		44	"disables both lifecycle directions without permission (reversed: %s)",
		45	(reversed) => {
		46	const items = buildThreadActionMenuItems({
		47	...baseState,
		48	canOperate: false,
		49	isPinned: reversed,
		50	isSettled: reversed,
		51	isSnoozed: reversed,
		52	});
		53	const expected = reversed
		54	? [
		55	"unpin",
		56	"unsettle",
		57	"unsnooze",
		58	"rename",
		59	"regenerate-title",
		60	"auto-settle",
		61	"archive",
		62	"delete",
		63	]
		64	: [
		65	"pin",
		66	"settle",
		67	"snooze",
		68	"rename",
		69	"regenerate-title",
		70	"auto-settle",
		71	"archive",
		72	"delete",
		73	];
		74	expect(items.filter((item) => item.disabled).map((item) => item.id)).toEqual(expected);
		75	expect(
		76	items.find((item) => item.id === "snooze")?.children?.every((child) => child.disabled) ??
		77	true,
		78	).toBe(true);
		79	},
		80	);
		81
		82	it("preserves local actions and restores mutations after a grant", () => {
		83	const denied = buildThreadActionMenuItems({ ...baseState, canOperate: false, branch: "main" });
		84	expect(denied.filter((item) => !item.disabled).map((item) => item.id)).toEqual([
		85	"new-thread-on-branch",
		86	"mark-unread",
		87	"copy",
		88	"project-settings",
		89	]);
		90	const allowed = buildThreadActionMenuItems({ ...baseState, canOperate: true });
		91	expect(allowed.every((item) => !item.disabled)).toBe(true);
		92	});
		93
42	it("hides lifecycle items when the environment lacks the capabilities", () => {	94	it("hides lifecycle items when the environment lacks the capabilities", () => {
43	expect(	95	expect(
44	ids({	96	ids({

apps/web/src/components/threadActionMenu.logic.ts+28-1

...	@@ -70,6 +70,7 @@ export function buildDraftActionMenuItems(options: {	...	@@ -70,6 +70,7 @@ export function buildDraftActionMenuItems(options: {
70	}	70	}
71		71
72	export interface ThreadActionMenuState {	72	export interface ThreadActionMenuState {
		73	readonly canOperate: boolean;
73	readonly branch: string \| null;	74	readonly branch: string \| null;
74	/**	75	/**
75	* Project scoping for the thread list. Null on surfaces with no scoped	76	* Project scoping for the thread list. Null on surfaces with no scoped
...	@@ -100,6 +101,19 @@ export interface ThreadActionMenuState {	...	@@ -100,6 +101,19 @@ export interface ThreadActionMenuState {
100	readonly snoozePresets: ReadonlyArray<SnoozePreset>;	101	readonly snoozePresets: ReadonlyArray<SnoozePreset>;
101	}	102	}
102		103
		104	/** Local navigation, read markers, and copying remain available to read-only clients. */
		105	export function threadActionRequiresOperate(action: ThreadActionMenuId): boolean {
		106	return ![
		107	"new-thread-on-branch",
		108	"project-settings",
		109	"mark-unread",
		110	"copy",
		111	"copy-path",
		112	"copy-branch",
		113	"copy-thread-id",
		114	].includes(action);
		115	}
		116
103	/**	117	/**
104	* Single source for the per-thread action menu: the sidebar row's right-click	118	* Single source for the per-thread action menu: the sidebar row's right-click
105	* menu and the chat header menu share labels, ordering, and capability gating.	119	* menu and the chat header menu share labels, ordering, and capability gating.
...	@@ -108,7 +122,7 @@ export interface ThreadActionMenuState {	...	@@ -108,7 +122,7 @@ export interface ThreadActionMenuState {
108	export function buildThreadActionMenuItems(	122	export function buildThreadActionMenuItems(
109	state: ThreadActionMenuState,	123	state: ThreadActionMenuState,
110	): ReadonlyArray<ContextMenuItem<ThreadActionMenuId>> {	124	): ReadonlyArray<ContextMenuItem<ThreadActionMenuId>> {
111	return [	125	const items: ReadonlyArray<ContextMenuItem<ThreadActionMenuId>> = [
112	...(state.branch	126	...(state.branch
113	? [	127	? [
114	{	128	{
...	@@ -235,4 +249,17 @@ export function buildThreadActionMenuItems(	...	@@ -235,4 +249,17 @@ export function buildThreadActionMenuItems(
235	icon: "trash",	249	icon: "trash",
236	},	250	},
237	];	251	];
		252	return state.canOperate
		253	? items
		254	: items.map((item) =>
		255	threadActionRequiresOperate(item.id)
		256	? {
		257	...item,
		258	disabled: true,
		259	...(item.children
		260	? { children: item.children.map((child) => ({ ...child, disabled: true })) }
		261	: {}),
		262	}
		263	: item,
		264	);
238	}	265	}

apps/web/src/hooks/useThreadActionMenu.test.ts created+221

...	@@ -0,0 +1,221 @@
1	import {
2	AuthOrchestrationOperateScope,
3	EnvironmentId,
4	ThreadId,
5	type ContextMenuItem,
6	} from "@t3tools/contracts";
7	import { AsyncResult } from "effect/reactivity";
8	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
9
10	import type { ThreadActionMenuId } from "../components/threadActionMenu.logic";
11
12	function deferred<T>() {
13	let resolve!: (value: T) => void;
14	const promise = new Promise<T>((complete) => {
15	resolve = complete;
16	});
17	return { promise, resolve };
18	}
19
20	const state = vi.hoisted(() => ({
21	granted: new Set<string>(),
22	effects: [] as string[],
23	completed: deferred<void>(),
24	show: vi.fn<
25	(
26	items: ReadonlyArray<ContextMenuItem<ThreadActionMenuId>>,
27	position: { x: number; y: number },
28	) => Promise<ThreadActionMenuId \| null>
29	>(),
30	}));
31
32	function recordEffect(action: string) {
33	state.effects.push(action);
34	state.completed.resolve();
35	}
36
37	vi.mock("../components/CustomSnoozeDialog", () => ({ requestCustomSnooze: vi.fn() }));
38	vi.mock("react", () => ({
39	useCallback: (callback: unknown) => callback,
40	useMemo: (factory: () => unknown) => factory(),
41	}));
42	vi.mock("@tanstack/react-router", () => ({
43	useRouter: () => ({ navigate: async () => recordEffect("project-settings") }),
44	}));
45	vi.mock("../state/session", () => ({
46	readEnvironmentScope: (environmentId: string, scope: string) =>
47	scope === AuthOrchestrationOperateScope && state.granted.has(environmentId),
48	}));
49	vi.mock("../state/entities", () => ({
50	readEnvironmentSupportsAutoSettleOptOut: () => true,
51	readEnvironmentSupportsPinning: () => true,
52	readEnvironmentSupportsSettlement: () => true,
53	readEnvironmentSupportsSnooze: () => true,
54	readEnvironmentSupportsTitleRegeneration: () => true,
55	readThreadShell: () => ({
56	id: "thread",
57	environmentId: "secondary",
58	projectId: "project",
59	title: "Thread",
60	branch: "main",
61	worktreePath: null,
62	runtime: null,
63	latestRun: null,
64	}),
65	useProjects: () => [{ id: "project", environmentId: "secondary" }],
66	}));
67	vi.mock("../state/environments", () => ({ usePrimaryEnvironmentId: () => "primary" }));
68	vi.mock("../state/threads", () => ({ threadEnvironment: { updateMetadata: "metadata" } }));
69	vi.mock("../state/use-atom-command", () => ({
70	useAtomCommand: () => async () => {
71	recordEffect("metadata");
72	return AsyncResult.success(undefined);
73	},
74	}));
75	vi.mock("../localApi", () => ({
76	readLocalApi: () => ({
77	contextMenu: { show: state.show, close: () => {} },
78	dialogs: {
79	confirm: async () => {
80	recordEffect("confirm");
81	return false;
82	},
83	},
84	}),
85	}));
86	vi.mock("../logicalProject", () => ({
87	deriveLogicalProjectKeyFromSettings: () => "project",
88	derivePhysicalProjectKey: () => "project",
89	selectProjectGroupingSettings: () => ({}),
90	}));
91	vi.mock("../sidebarProjectGrouping", () => ({
92	buildPhysicalToLogicalProjectKeyMap: () => new Map(),
93	}));
94	vi.mock("../uiStateStore", () => ({
95	useUiStateStore: (select: (store: unknown) => unknown) =>
96	select({
97	markThreadUnread: () => recordEffect("mark-unread"),
98	}),
99	}));
100	vi.mock("../components/ui/toast", () => ({
101	stackedThreadToast: (toast: unknown) => toast,
102	toastManager: { add: () => state.completed.resolve() },
103	}));
104	vi.mock("../components/Sidebar.snooze", () => ({
105	resolveSnoozePresets: () => [
106	{ id: "hour", label: "In 1 hour", whenLabel: "3 PM", snoozedUntil: "2099-01-01T00:00:00Z" },
107	],
108	snoozeWakeDescription: () => "later",
109	}));
110	vi.mock("./useCopyToClipboard", () => ({
111	useCopyToClipboard: () => ({ copyToClipboard: () => recordEffect("copy") }),
112	}));
113	vi.mock("./useHandleNewThread", () => ({
114	useNewThreadHandler: () => async () => recordEffect("draft"),
115	}));
116	vi.mock("./useSettings", () => ({
117	useClientSettings: (select: (settings: unknown) => unknown) =>
118	select({
119	confirmThreadDelete: true,
120	confirmThreadArchive: true,
121	timestampFormat: "12-hour",
122	}),
123	}));
124	vi.mock("./useThreadActions", () => ({
125	useThreadActions: () =>
126	Object.fromEntries(
127	[
128	"markThreadUnread",
129	"settleThread",
130	"unsettleThread",
131	"snoozeThread",
132	"unsnoozeThread",
133	"pinThread",
134	"confirmAndUnpinThread",
135	"archiveThread",
136	"deleteThread",
137	].map((action) => [
138	action,
139	async () => {
140	recordEffect(action === "markThreadUnread" ? "mark-unread" : action);
141	return AsyncResult.success(undefined);
142	},
143	]),
144	),
145	}));
146
147	import { useThreadActionMenu } from "./useThreadActionMenu";
148
149	const target = {
150	environmentId: EnvironmentId.make("secondary"),
151	threadId: ThreadId.make("thread"),
152	};
153	const position = { x: 10, y: 20 };
154	const createMenu = () =>
155	useThreadActionMenu({
156	threadRef: target,
157	projectCwd: "/project",
158	onStartRename: () => recordEffect("rename"),
159	});
160
161	beforeEach(() => {
162	state.granted = new Set(["primary"]);
163	state.effects = [];
164	state.completed = deferred<void>();
165	state.show.mockReset().mockResolvedValue(null);
166	});
167
168	describe("thread menu permissions", () => {
169	it("disables mutations for a denied secondary environment", () => {
170	createMenu().openMenu(position);
171	const items = state.show.mock.calls[0]![0];
172	expect(items.find((item) => item.id === "rename")?.disabled).toBe(true);
173	expect(items.find((item) => item.id === "delete")?.disabled).toBe(true);
174	expect(items.find((item) => item.id === "copy")?.disabled).not.toBe(true);
175	});
176
177	it("allows the target grant even when the primary environment is denied", () => {
178	state.granted = new Set(["secondary"]);
179	createMenu().openMenu(position);
180	expect(state.show.mock.calls[0]![0].find((item) => item.id === "rename")?.disabled).not.toBe(
181	true,
182	);
183	});
184
185	it("refreshes availability when a retained menu opener gains permission", () => {
186	const menu = createMenu();
187	menu.openMenu(position);
188	expect(state.show.mock.calls[0]![0].find((item) => item.id === "rename")?.disabled).toBe(true);
189	state.granted.add("secondary");
190	menu.openMenu(position);
191	expect(state.show.mock.calls[1]![0].find((item) => item.id === "rename")?.disabled).not.toBe(
192	true,
193	);
194	});
195
196	it.each(["rename", "regenerate-title", "delete", "pin", "settle", "archive"] as const)(
197	"%s rechecks after the native menu closes",
198	async (action) => {
199	state.granted.add("secondary");
200	const choice = deferred<ThreadActionMenuId \| null>();
201	state.show.mockReturnValue(choice.promise);
202	createMenu().openMenu(position);
203	state.granted.delete("secondary");
204	choice.resolve(action);
205	await state.completed.promise;
206	expect(state.effects).toEqual([]);
207	},
208	);
209
210	it.each([
211	["new-thread-on-branch", "draft"],
212	["copy-thread-id", "copy"],
213	["mark-unread", "mark-unread"],
214	["project-settings", "project-settings"],
215	] as const)("keeps %s available without task permission", async (action, effect) => {
216	state.show.mockResolvedValue(action);
217	createMenu().openMenu(position);
218	await state.completed.promise;
219	expect(state.effects).toEqual([effect]);
220	});
221	});

apps/web/src/hooks/useThreadActionMenu.ts+20-3

 @@ -7,18 +7,24 @@ import {
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
 import { canSnooze, effectiveSnoozed } from "@t3tools/client-runtime/state/thread-settled";
-import type { ScopedThreadRef, ThreadId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  type ScopedThreadRef,
+  type ThreadId,
+} from "@t3tools/contracts";
 import { useRouter } from "@tanstack/react-router";
 import { useCallback, useMemo } from "react";
 import { resolveSnoozePresets } from "../components/Sidebar.snooze";
 import {
   buildThreadActionMenuItems,
+  threadActionRequiresOperate,
   type ThreadActionMenuId,
 } from "../components/threadActionMenu.logic";
 import { stackedThreadToast, toastManager } from "../components/ui/toast";
 import { threadEnvironment } from "../state/threads";
-import { useAtomCommand } from "../state/use-atom-command";
+import { useOrchestrationCommand } from "../state/use-orchestration-command";
+import { readEnvironmentScope } from "../state/session";
 import {
   readEnvironmentSupportsAutoSettleOptOut,
   readEnvironmentSupportsPinning,
 @@ -94,7 +100,7 @@ export function useThreadActionMenu(input: {
     deleteThread,
     markThreadUnread,
   } = useThreadActions();
-  const updateThreadMetadata = useAtomCommand(threadEnvironment.updateMetadata, {
+  const updateThreadMetadata = useOrchestrationCommand(threadEnvironment.updateMetadata, {
     reportFailure: false,
   });
   const handleNewThread = useNewThreadHandler();
 @@ -142,6 +148,7 @@ export function useThreadActionMenu(input: {
         const isRegeneratingTitle = thread.titleRegeneration != null;
         const snoozePresets = resolveSnoozePresets(now, timestampFormat);
         const items = buildThreadActionMenuItems({
+          canOperate: readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope),
           branch: thread.branch ?? null,
           projectFilter: null,
           isPinned: thread.pinnedAt != null,
 @@ -157,6 +164,16 @@ export function useThreadActionMenu(input: {
         const clicked = await settlePromise(() => api.contextMenu.show(items, position));
         if (clicked._tag === "Failure" || clicked.value === null) return;
         const action: ThreadActionMenuId = clicked.value;
+        if (
+          threadActionRequiresOperate(action) &&
+          !readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope)
+        ) {
+          failureToast(
+            "Thread action unavailable",
+            new Error("This connection cannot change threads."),
+          );
+          return;
+        }
         if (action.startsWith("snooze:")) {
           const preset =
             action === "snooze:custom"

apps/web/src/hooks/useThreadActions.permissions.test.ts created+354

...	@@ -0,0 +1,354 @@
1	import {
2	AuthOrchestrationOperateScope,
3	AuthSourceControlWriteScope,
4	EnvironmentAuthorizationError,
5	EnvironmentId,
6	ProjectId,
7	ThreadId,
8	type ScopedThreadRef,
9	} from "@t3tools/contracts";
10	import * as Cause from "effect/Cause";
11	import { AsyncResult } from "effect/reactivity";
12	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
13
14	function deferred<T>() {
15	let resolve!: (value: T) => void;
16	const promise = new Promise<T>((complete) => {
17	resolve = complete;
18	});
19	return { promise, resolve };
20	}
21
22	const state = vi.hoisted(() => ({
23	scopes: new Map<string, Set<string>>(),
24	threads: [] as {
25	environmentId: EnvironmentId;
26	id: ThreadId;
27	projectId: ProjectId;
28	title: string;
29	worktreePath: string \| null;
30	session: { status: "ready" \| "stopped" } \| null;
31	latestTurn: null;
32	}[],
33	requests: [] as { action: string; environmentId: string; input: { threadId?: string } }[],
34	localEffects: [] as string[],
35	confirm: vi.fn<(message: string) => Promise<boolean>>(),
36	toasts: [] as string[],
37	afterRequest: undefined as ((action: string) => void) \| undefined,
38	sessionLookupFails: false,
39	}));
40
41	vi.mock("react", () => ({
42	useCallback: (callback: unknown) => callback,
43	useMemo: (factory: () => unknown) => factory(),
44	useRef: (current: unknown) => ({ current }),
45	}));
46	vi.mock("@tanstack/react-router", () => ({
47	useRouter: () => ({ state: { matches: [] }, navigate: async () => {} }),
48	}));
49	vi.mock("../state/session", () => ({
50	environmentSession: { sessionStateAtom: "session" },
51	readEnvironmentScope: (environmentId: string, scope: string) =>
52	state.scopes.get(environmentId)?.has(scope) === true,
53	}));
54	vi.mock("../state/use-atom-command", () => ({
55	useAtomCommand:
56	(action: string) =>
57	async (request: { environmentId: string; input: { threadId?: string } }) => {
58	state.requests.push({ action, ...request });
59	const scope =
60	action === "removeWorktree" ? AuthSourceControlWriteScope : AuthOrchestrationOperateScope;
61	if (!state.scopes.get(request.environmentId)?.has(scope)) {
62	return AsyncResult.failure(Cause.fail(new Error("Server denied the request")));
63	}
64	state.afterRequest?.(action);
65	return AsyncResult.success(undefined);
66	},
67	}));
68	vi.mock("../state/use-atom-query-runner", () => ({
69	useAtomQueryRunner: () => async (environmentId: string) =>
70	state.sessionLookupFails
71	? AsyncResult.failure(Cause.fail(new Error("Session lookup failed")))
72	: AsyncResult.success({
73	authenticated: true,
74	scopes: [...(state.scopes.get(environmentId) ?? [])],
75	}),
76	}));
77	vi.mock("../state/threads", () => ({
78	threadEnvironment: Object.fromEntries(
79	[
80	"archive",
81	"unarchive",
82	"delete",
83	"settle",
84	"unsettle",
85	"pin",
86	"unpin",
87	"reorderPin",
88	"snooze",
89	"unsnooze",
90	"stopSession",
91	].map((action) => [action, action]),
92	),
93	}));
94	vi.mock("../state/vcs", () => ({
95	vcsEnvironment: { removeWorktree: "removeWorktree", refreshStatus: "refreshStatus" },
96	}));
97	vi.mock("../state/entities", () => ({
98	readEnvironmentSupportsPinning: () => true,
99	readEnvironmentSupportsPinReorder: () => true,
100	readEnvironmentSupportsSettlement: () => true,
101	readEnvironmentSupportsSnooze: () => true,
102	readThreadShell: (ref: ScopedThreadRef) =>
103	state.threads.find(
104	(thread) => thread.environmentId === ref.environmentId && thread.id === ref.threadId,
105	) ?? null,
106	readThreadShells: () => state.threads,
107	readEnvironmentThreadRefs: (environmentId: EnvironmentId) =>
108	state.threads
109	.filter((thread) => thread.environmentId === environmentId)
110	.map((thread) => ({ environmentId, threadId: thread.id })),
111	readProject: () => ({ workspaceRoot: "/project" }),
112	}));
113	vi.mock("../components/Sidebar.logic", () => ({
114	getFallbackThreadIdAfterDelete: () => null,
115	pinOrderKeyBetween: () => "a",
116	}));
117	vi.mock("../composerDraftStore", () => ({
118	useComposerDraftStore: (select: (store: unknown) => unknown) =>
119	select({
120	clearDraftThread: () => state.localEffects.push("clear-draft"),
121	clearProjectDraftThreadById: () => state.localEffects.push("clear-project-draft"),
122	}),
123	}));
124	vi.mock("../terminalUiStateStore", () => ({
125	useTerminalUiStateStore: (select: (store: unknown) => unknown) =>
126	select({
127	clearTerminalUiState: () => state.localEffects.push("clear-terminal-ui"),
128	}),
129	}));
130	vi.mock("../uiStateStore", () => ({
131	useUiStateStore: (select: (store: unknown) => unknown) =>
132	select({
133	markThreadVisited: () => state.localEffects.push("mark-visited"),
134	}),
135	}));
136	vi.mock("../lib/archivedThreadsState", () => ({
137	refreshArchivedThreadsForEnvironment: () => state.localEffects.push("refresh-archive"),
138	}));
139	vi.mock("../lib/composerDraftUploads", () => ({
140	releaseComposerDraftUploads: () => state.localEffects.push("release-uploads"),
141	}));
142	vi.mock("../localApi", () => ({
143	readLocalApi: () => ({ dialogs: { confirm: state.confirm } }),
144	}));
145	vi.mock("../threadRoutes", () => ({
146	resolveThreadRouteRef: () => null,
147	buildThreadRouteParams: (ref: ScopedThreadRef) => ref,
148	}));
149	vi.mock("../components/ui/toast", () => ({
150	stackedThreadToast: (toast: unknown) => toast,
151	toastManager: {
152	add: (toast: { title?: string }) => {
153	if (toast.title) state.toasts.push(toast.title);
154	},
155	},
156	}));
157	vi.mock("./useHandleNewThread", () => ({ useNewThreadHandler: () => async () => {} }));
158	vi.mock("./useSettings", () => ({
159	useClientSettings: (select: (settings: unknown) => unknown) =>
160	select({
161	sidebarThreadSortOrder: "createdAt",
162	confirmThreadDelete: true,
163	confirmThreadUnpin: true,
164	}),
165	}));
166
167	import { useThreadActions } from "./useThreadActions";
168
169	const primary = EnvironmentId.make("primary");
170	const secondary = EnvironmentId.make("secondary");
171	const target = { environmentId: secondary, threadId: ThreadId.make("thread") };
172	type ThreadActions = ReturnType<typeof useThreadActions>;
173	const operations = [
174	{
175	name: "archive",
176	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.archiveThread(ref),
177	},
178	{
179	name: "unarchive",
180	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.unarchiveThread(ref),
181	},
182	{
183	name: "settle",
184	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.settleThread(ref),
185	},
186	{
187	name: "unsettle",
188	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.unsettleThread(ref),
189	},
190	{
191	name: "snooze",
192	run: (actions: ThreadActions, ref: ScopedThreadRef) =>
193	actions.snoozeThread(ref, "2099-01-01T00:00:00Z"),
194	},
195	{
196	name: "unsnooze",
197	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.unsnoozeThread(ref),
198	},
199	{ name: "pin", run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.pinThread(ref) },
200	{
201	name: "unpin",
202	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.unpinThread(ref),
203	},
204	{
205	name: "reorderPin",
206	run: (actions: ThreadActions, ref: ScopedThreadRef) => actions.reorderPinnedThread(ref, "b"),
207	},
208	] as const;
209
210	beforeEach(() => {
211	state.scopes = new Map([
212	[primary, new Set([AuthOrchestrationOperateScope])],
213	[secondary, new Set<string>()],
214	]);
215	state.threads = [
216	{
217	environmentId: secondary,
218	id: target.threadId,
219	projectId: ProjectId.make("project"),
220	title: "Thread",
221	worktreePath: null,
222	session: null,
223	latestTurn: null,
224	},
225	];
226	state.requests = [];
227	state.localEffects = [];
228	state.confirm.mockReset().mockResolvedValue(true);
229	state.toasts = [];
230	state.afterRequest = undefined;
231	state.sessionLookupFails = false;
232	});
233
234	describe("thread action permissions", () => {
235	it.each(operations)("$name requires the target environment's grant", async ({ run }) => {
236	const result = await run(useThreadActions(), target);
237	expect(result._tag).toBe("Failure");
238	expect(state.requests).toEqual([]);
239	expect(state.localEffects).toEqual([]);
240	});
241
242	it.each(operations)("$name rechecks a retained callback after revocation", async ({ run }) => {
243	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
244	const actions = useThreadActions();
245	state.scopes.get(secondary)!.clear();
246	await run(actions, target);
247	expect(state.requests).toEqual([]);
248	});
249
250	it.each(operations)(
251	"$name works after the target gains only task permission",
252	async ({ name, run }) => {
253	const actions = useThreadActions();
254	state.scopes.get(primary)!.clear();
255	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
256	expect((await run(actions, target))._tag).toBe("Success");
257	expect(state.requests).toEqual([
258	expect.objectContaining({ action: name, environmentId: secondary }),
259	]);
260	},
261	);
262
263	it.each(["confirmAndDeleteThread", "confirmAndUnpinThread"] as const)(
264	"%s blocks a forbidden confirmation",
265	async (action) => {
266	await useThreadActions()[action](target);
267	expect(state.confirm).not.toHaveBeenCalled();
268	expect(state.requests).toEqual([]);
269	},
270	);
271
272	it.each(["confirmAndDeleteThread", "confirmAndUnpinThread"] as const)(
273	"%s rechecks after the confirmation",
274	async (action) => {
275	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
276	const confirmation = deferred<boolean>();
277	state.confirm.mockReturnValue(confirmation.promise);
278	const result = useThreadActions()[action](target);
279	expect(state.confirm).toHaveBeenCalledOnce();
280	state.scopes.get(secondary)!.clear();
281	confirmation.resolve(true);
282	await result;
283	expect(state.requests).toEqual([]);
284	expect(state.localEffects).toEqual([]);
285	},
286	);
287
288	it("identifies the missing task scope when thread deletion is denied", async () => {
289	const result = await useThreadActions().deleteThread(target);
290
291	expect(result._tag).toBe("Failure");
292	if (result._tag !== "Failure") throw new Error("Expected permission denial");
293	const error = Cause.squash<unknown>(result.cause);
294	expect(error).toBeInstanceOf(EnvironmentAuthorizationError);
295	expect(error).toMatchObject({ requiredScope: AuthOrchestrationOperateScope });
296	expect(state.requests).toEqual([]);
297	expect(state.localEffects).toEqual([]);
298	});
299
300	it("deletes an archived thread only with its own environment's grant", async () => {
301	state.threads = [];
302	const actions = useThreadActions();
303	await actions.deleteThread(target);
304	expect(state.requests).toEqual([]);
305	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
306	expect((await actions.deleteThread(target))._tag).toBe("Success");
307	expect(state.requests).toEqual([
308	expect.objectContaining({ action: "delete", environmentId: secondary }),
309	]);
310	});
311
312	it("stops before delete and local cleanup when permission is revoked during session stop", async () => {
313	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
314	state.threads[0]!.session = { status: "ready" };
315	state.afterRequest = () => state.scopes.get(secondary)!.clear();
316	expect((await useThreadActions().deleteThread(target))._tag).toBe("Failure");
317	expect(state.requests.map((request) => request.action)).toEqual(["stopSession"]);
318	expect(state.localEffects).toEqual([]);
319	});
320
321	it.each([
322	{ reason: "without source-control permission", sessionLookupFails: false },
323	{ reason: "when the permission lookup fails", sessionLookupFails: true },
324	])("deletes a worktree thread and keeps its worktree $reason", async ({ sessionLookupFails }) => {
325	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
326	state.threads[0]!.worktreePath = "/worktrees/thread";
327	state.sessionLookupFails = sessionLookupFails;
328	expect((await useThreadActions().deleteThread(target))._tag).toBe("Success");
329	expect(state.confirm).not.toHaveBeenCalled();
330	expect(state.requests.map((request) => request.action)).toEqual(["stopSession", "delete"]);
331	expect(state.localEffects).toContain("clear-terminal-ui");
332	});
333
334	it("does not request worktree removal after its grant is revoked during delete", async () => {
335	state.scopes
336	.get(secondary)!
337	.add(AuthOrchestrationOperateScope)
338	.add(AuthSourceControlWriteScope);
339	state.threads[0]!.worktreePath = "/worktrees/thread";
340	state.afterRequest = () => state.scopes.get(secondary)!.delete(AuthSourceControlWriteScope);
341	const consoleError = vi.spyOn(console, "error").mockImplementation(() => {});
342	try {
343	// The thread is already gone, so cleanup reports itself in a toast
344	// instead of failing the deletion.
345	const result = await useThreadActions().deleteThread(target);
346	expect(result._tag).toBe("Success");
347	expect(state.requests.map((request) => request.action)).toEqual(["stopSession", "delete"]);
348	expect(state.toasts).toContain("Failed to delete worktree");
349	expect(state.localEffects).toContain("clear-terminal-ui");
350	} finally {
351	consoleError.mockRestore();
352	}
353	});
354	});

apps/web/src/hooks/useThreadActions.ts+81-34

 @@ -7,7 +7,14 @@ import {
 import { settlePromise, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { canSnooze, threadWokeAt } from "@t3tools/client-runtime/state/thread-settled";
 import { threadRuntimeCanArchive } from "@t3tools/client-runtime/state/models";
-import { EnvironmentId, type ScopedThreadRef, ThreadId } from "@t3tools/contracts";
+import {
+  AuthOrchestrationOperateScope,
+  AuthSourceControlWriteScope,
+  EnvironmentAuthorizationError,
+  EnvironmentId,
+  type ScopedThreadRef,
+  ThreadId,
+} from "@t3tools/contracts";
 import { resolveWorktreeCleanup } from "@t3tools/shared/projectSettings";
 import * as Cause from "effect/Cause";
 import * as Schema from "effect/Schema";
 @@ -17,6 +24,7 @@ import { useCallback, useMemo, useRef } from "react";
 import { getFallbackThreadIdAfterDelete, pinOrderKeyBetween } from "../components/Sidebar.logic";
 import { useComposerDraftStore } from "../composerDraftStore";
+import { environmentSession, readEnvironmentScope } from "../state/session";
 import { terminalEnvironment } from "../state/terminal";
 import { appAtomRegistry } from "../rpc/atomRegistry";
 import { environmentServerConfigsAtom } from "../state/server";
 @@ -49,6 +57,8 @@ import { useClientSettings } from "./useSettings";
 import * as ThreadUndo from "./threadUndo";
 import { showThreadUndoNotice } from "./showThreadUndoNotice";
 import { useAtomCommand } from "../state/use-atom-command";
+import { useOrchestrationCommand } from "../state/use-orchestration-command";
+import { useAtomQueryRunner } from "../state/use-atom-query-runner";
 export class ThreadArchiveBlockedError extends Schema.TaggedError<ThreadArchiveBlockedError>()(
   "ThreadArchiveBlockedError",
 @@ -243,49 +253,64 @@ export function useAcknowledgeThreadWoke() {
   );
 }
+function threadOperationFailure(target: ScopedThreadRef) {
+  return readEnvironmentScope(target.environmentId, AuthOrchestrationOperateScope)
+    ? null
+    : AsyncResult.failure(
+        Cause.fail(
+          new EnvironmentAuthorizationError({
+            message: "This connection cannot change threads.",
+            requiredScope: AuthOrchestrationOperateScope,
+          }),
+        ),
+      );
+}
 export function useThreadActions() {
-  const closeTerminal = useAtomCommand(terminalEnvironment.close);
+  const archiveThreadMutation = useOrchestrationCommand(threadEnvironment.archive, {
-  const archiveThreadMutation = useAtomCommand(threadEnvironment.archive, {
     reportFailure: false,
   });
-  const unarchiveThreadMutation = useAtomCommand(threadEnvironment.unarchive, {
+  const unarchiveThreadMutation = useOrchestrationCommand(threadEnvironment.unarchive, {
     reportFailure: false,
   });
-  const deleteThreadMutation = useAtomCommand(threadEnvironment.delete, {
+  const deleteThreadMutation = useOrchestrationCommand(threadEnvironment.delete, {
     reportFailure: false,
   });
-  const settleThreadMutation = useAtomCommand(threadEnvironment.settle, {
+  const settleThreadMutation = useOrchestrationCommand(threadEnvironment.settle, {
     reportFailure: false,
   });
-  const unsettleThreadMutation = useAtomCommand(threadEnvironment.unsettle, {
+  const unsettleThreadMutation = useOrchestrationCommand(threadEnvironment.unsettle, {
     reportFailure: false,
   });
-  const pinThreadMutation = useAtomCommand(threadEnvironment.pin, {
+  const pinThreadMutation = useOrchestrationCommand(threadEnvironment.pin, {
     reportFailure: false,
   });
-  const unpinThreadMutation = useAtomCommand(threadEnvironment.unpin, {
+  const unpinThreadMutation = useOrchestrationCommand(threadEnvironment.unpin, {
     reportFailure: false,
   });
-  const setThreadAutoSettleMutation = useAtomCommand(threadEnvironment.setAutoSettle, {
+  const setThreadAutoSettleMutation = useOrchestrationCommand(threadEnvironment.setAutoSettle, {
     reportFailure: false,
   });
-  const reorderPinnedThreadMutation = useAtomCommand(threadEnvironment.reorderPin, {
+  const reorderPinnedThreadMutation = useOrchestrationCommand(threadEnvironment.reorderPin, {
     reportFailure: false,
   });
-  const reorderActiveThreadMutation = useAtomCommand(threadEnvironment.reorderActive, {
+  const reorderActiveThreadMutation = useOrchestrationCommand(threadEnvironment.reorderActive, {
     reportFailure: false,
   });
-  const snoozeThreadMutation = useAtomCommand(threadEnvironment.snooze, {
+  const snoozeThreadMutation = useOrchestrationCommand(threadEnvironment.snooze, {
     reportFailure: false,
   });
-  const unsnoozeThreadMutation = useAtomCommand(threadEnvironment.unsnooze, {
+  const unsnoozeThreadMutation = useOrchestrationCommand(threadEnvironment.unsnooze, {
     reportFailure: false,
   });
   const markThreadUnread = useMarkThreadUnread();
-  const stopThreadSession = useAtomCommand(threadEnvironment.stopSession);
+  const stopThreadSession = useOrchestrationCommand(threadEnvironment.stopSession);
   const removeWorktree = useAtomCommand(vcsEnvironment.removeWorktree, {
     reportFailure: false,
   });
+  const loadSessionState = useAtomQueryRunner(environmentSession.sessionStateAtom, {
+    reportFailure: false,
+  });
   const refreshVcsStatus = useAtomCommand(vcsEnvironment.refreshStatus, {
     reportFailure: false,
   });
 @@ -412,6 +437,8 @@ export function useThreadActions() {
   const deleteThread = useCallback(
     async (target: ScopedThreadRef, opts: { deletedThreadKeys?: ReadonlySet<string> } = {}) => {
+      const permissionFailure = threadOperationFailure(target);
+      if (permissionFailure) return permissionFailure;
       const resolved = resolveThreadTarget(target);
       if (!resolved) {
         // Thread not in main store (e.g. archived thread) — dispatch delete directly.
 @@ -456,13 +483,22 @@ export function useThreadActions() {
       const environmentConfig = appAtomRegistry
         .get(environmentServerConfigsAtom)
         .get(threadRef.environmentId);
-      // A Scratch thread's folder is not a git worktree, and deleting the
+      const localApi = readLocalApi();
-      // thread keeps its files.
+      let canDeleteWorktree = false;
-      const canDeleteWorktree =
+      if (
         orphanedWorktreePath !== null &&
         threadProject !== null &&
-        !isScratchProject(threadProject, environmentConfig?.scratchWorkspaceRoot);
+        !isScratchProject(threadProject, environmentConfig?.scratchWorkspaceRoot) &&
-      const localApi = readLocalApi();
+        localApi
+      ) {
+        const sessionResult = await loadSessionState(threadRef.environmentId);
+        const permissionFailure = threadOperationFailure(threadRef);
+        if (permissionFailure) return permissionFailure;
+        canDeleteWorktree =
+          sessionResult._tag === "Success" &&
+          sessionResult.value.authenticated &&
+          sessionResult.value.scopes?.includes(AuthSourceControlWriteScope) === true;
+      }
       let shouldDeleteWorktree = false;
       const environmentSettings = environmentConfig?.settings;
       const automaticWorktreeCleanup = environmentSettings
 @@ -493,11 +529,6 @@ export function useThreadActions() {
         });
       }
-      await closeTerminal({
-        environmentId: threadRef.environmentId,
-        input: { threadId: threadRef.threadId, deleteHistory: true },
-      });
       const deletedThreadIds = deletedIds ?? new Set<ThreadId>();
       const currentRouteThreadRef = getCurrentRouteThreadRef();
       const shouldNavigateToFallback =
 @@ -546,14 +577,26 @@ export function useThreadActions() {
         return deleteResult;
       }
-      const removeResult = await removeWorktree({
+      const removeResult = readEnvironmentScope(
-        environmentId: threadRef.environmentId,
+        threadRef.environmentId,
-        input: {
+        AuthSourceControlWriteScope,
-          cwd: threadProject.workspaceRoot,
+      )
-          path: orphanedWorktreePath,
+        ? await removeWorktree({
-          force: true,
+            environmentId: threadRef.environmentId,
-        },
+            input: {
-      });
+              cwd: threadProject.workspaceRoot,
+              path: orphanedWorktreePath,
+              force: true,
+            },
+          })
+        : AsyncResult.failure(
+            Cause.fail(
+              new EnvironmentAuthorizationError({
+                message: "This connection can no longer remove worktrees.",
+                requiredScope: AuthSourceControlWriteScope,
+              }),
+            ),
+          );
       const refreshResult =
         removeResult._tag === "Success"
           ? await refreshVcsStatus({
 @@ -597,9 +640,9 @@ export function useThreadActions() {
       clearComposerDraftForThread,
       clearProjectDraftThreadById,
       clearTerminalUiState,
-      closeTerminal,
       deleteThreadMutation,
       getCurrentRouteThreadRef,
+      loadSessionState,
       refreshVcsStatus,
       removeWorktree,
       router,
 @@ -797,6 +840,8 @@ export function useThreadActions() {
   const confirmAndUnpinThread = useCallback(
     async (target: ScopedThreadRef) => {
+      const permissionFailure = threadOperationFailure(target);
+      if (permissionFailure) return permissionFailure;
       const localApi = readLocalApi();
       const resolved = resolveThreadTarget(target);
       const confirmationResult = await requestThreadUnpinConfirmation({
 @@ -930,6 +975,8 @@ export function useThreadActions() {
   const confirmAndDeleteThread = useCallback(
     async (target: ScopedThreadRef) => {
+      const permissionFailure = threadOperationFailure(target);
+      if (permissionFailure) return permissionFailure;
       const localApi = readLocalApi();
       const resolved = resolveThreadTarget(target);

apps/web/src/hooks/useThreadActions.undo.test.ts+5

 @@ -20,6 +20,11 @@ const router = vi.hoisted(() => ({
   navigate: vi.fn(async () => {}),
   state: { matches: [{ params: {} as Record<string, string> }] },
 }));
+vi.mock("../state/use-atom-query-runner", () => ({ useAtomQueryRunner: () => vi.fn() }));
+vi.mock("../state/session", async (original) => ({
+  ...(await original<typeof import("../state/session")>()),
+  readEnvironmentScope: () => true,
+}));
 vi.mock("react", async (original) => ({
   ...(await original<typeof import("react")>()),
   useCallback: (callback: unknown) => callback,

apps/web/src/state/sourceControlActions.test.ts created+209

...	@@ -0,0 +1,209 @@
1	import {
2	AuthOrchestrationOperateScope,
3	AuthSourceControlWriteScope,
4	EnvironmentId,
5	ThreadId,
6	} from "@t3tools/contracts";
7	import * as Cause from "effect/Cause";
8	import { AsyncResult } from "effect/reactivity";
9	import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
10
11	const state = vi.hoisted(() => ({
12	scopes: new Map<string, Set<string>>(),
13	requests: [] as { action: string; environmentId: string \| null }[],
14	}));
15
16	vi.mock("react", () => ({ useCallback: (callback: unknown) => callback }));
17	vi.mock("@effect/atom-react", () => ({
18	useAtomValue: () => ({ operation: null, error: null, isRunning: false }),
19	}));
20	vi.mock("../rpc/atomRegistry", () => ({ appAtomRegistry: {} }));
21	vi.mock("./session", () => ({
22	useEnvironmentScope: (environmentId: string, scope: string) =>
23	state.scopes.get(environmentId)?.has(scope) === true,
24	readEnvironmentScope: (environmentId: string, scope: string) =>
25	state.scopes.get(environmentId)?.has(scope) === true,
26	}));
27	vi.mock("./query", () => ({ useEnvironmentQuery: () => ({ refresh: () => {} }) }));
28	vi.mock("./use-atom-command", () => ({
29	useAtomCommand:
30	(command: { action: string; environmentId?: string }) =>
31	async (input: { environmentId?: string }) => {
32	state.requests.push({
33	action: command.action,
34	environmentId: input.environmentId ?? command.environmentId ?? null,
35	});
36	return AsyncResult.success({});
37	},
38	}));
39	vi.mock("./vcs", () => ({
40	vcsEnvironment: { init: { action: "init" }, pull: { action: "pull" }, status: () => "status" },
41	vcsActionManager: {
42	stateAtom: () => "state",
43	resetError: () => {},
44	track: (_registry: unknown, _target: unknown, _input: unknown, execute: () => unknown) =>
45	execute(),
46	runStackedAction: (scope: { environmentId: string }) => ({ action: "stack", ...scope }),
47	},
48	}));
49	vi.mock("./sourceControl", () => ({
50	sourceControlEnvironment: { publishRepository: { action: "publish" } },
51	}));
52	vi.mock("./git", () => ({
53	gitEnvironment: { preparePullRequestThread: { action: "prepare" } },
54	}));
55
56	import {
57	useGitStackedAction,
58	usePreparePullRequestThreadAction,
59	useSourceControlPublishRepositoryAction,
60	useVcsInitAction,
61	useVcsPullAction,
62	} from "./sourceControlActions";
63
64	const primary = EnvironmentId.make("primary");
65	const secondary = EnvironmentId.make("secondary");
66	const scope = { environmentId: secondary, cwd: "/repo" };
67	const threadId = ThreadId.make("thread");
68	const cases = [
69	{
70	name: "init",
71	create: () => {
72	const action = useVcsInitAction(scope);
73	return { isAllowed: action.isAllowed, run: () => action.run() };
74	},
75	},
76	{
77	name: "pull",
78	create: () => {
79	const action = useVcsPullAction(scope);
80	return { isAllowed: action.isAllowed, run: () => action.run() };
81	},
82	},
83	{
84	name: "stack",
85	create: () => {
86	const action = useGitStackedAction(scope);
87	return {
88	isAllowed: action.isAllowed,
89	run: () => action.run({ actionId: "action", action: "commit" }),
90	};
91	},
92	},
93	{
94	name: "publish",
95	create: () => {
96	const action = useSourceControlPublishRepositoryAction(scope);
97	return {
98	isAllowed: action.isAllowed,
99	run: () =>
100	action.run({
101	provider: "github",
102	repository: "owner/repo",
103	visibility: "private",
104	remoteName: "origin",
105	protocol: "ssh",
106	}),
107	};
108	},
109	},
110	{
111	name: "prepare",
112	create: () => {
113	const action = usePreparePullRequestThreadAction(scope);
114	return {
115	isAllowed: action.isAllowed,
116	run: () => action.run({ reference: "1", mode: "local" }),
117	};
118	},
119	},
120	] as const;
121
122	beforeEach(() => {
123	state.scopes = new Map([
124	[primary, new Set([AuthSourceControlWriteScope, AuthOrchestrationOperateScope])],
125	[secondary, new Set<string>()],
126	]);
127	state.requests = [];
128	});
129
130	describe("source control callback grants", () => {
131	it.each(cases)("$name uses the selected environment's permission", async ({ create }) => {
132	const action = create();
133	expect(action.isAllowed).toBe(false);
134	expect((await action.run())._tag).toBe("Failure");
135	expect(state.requests).toEqual([]);
136	});
137
138	it.each(cases)("$name rejects a retained callback after revocation", async ({ create }) => {
139	state.scopes.get(secondary)!.add(AuthSourceControlWriteScope);
140	const action = create();
141	expect(action.isAllowed).toBe(true);
142	state.scopes.get(secondary)!.clear();
143	expect((await action.run())._tag).toBe("Failure");
144	expect(state.requests).toEqual([]);
145	expect(create().isAllowed).toBe(false);
146	});
147
148	it.each(cases)("$name accepts a retained callback after a grant", async ({ name, create }) => {
149	const action = create();
150	expect(action.isAllowed).toBe(false);
151	state.scopes.get(primary)!.clear();
152	state.scopes.get(secondary)!.add(AuthSourceControlWriteScope);
153	expect((await action.run())._tag).toBe("Success");
154	expect(state.requests).toEqual([{ action: name, environmentId: secondary }]);
155	expect(create().isAllowed).toBe(true);
156	});
157	});
158
159	describe("pull request worktree attachment permission", () => {
160	it.each([
161	["local", threadId, false, true],
162	["worktree", undefined, false, true],
163	["worktree", threadId, false, false],
164	["worktree", threadId, true, true],
165	] as const)(
166	"mode %s / thread %s / task grant %s",
167	async (mode, attachedThreadId, operate, allowed) => {
168	state.scopes.get(secondary)!.add(AuthSourceControlWriteScope);
169	if (operate) state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
170	const result = await usePreparePullRequestThreadAction(scope).run({
171	reference: "1",
172	mode,
173	...(attachedThreadId !== undefined ? { threadId: attachedThreadId } : {}),
174	});
175	expect(result._tag).toBe(allowed ? "Success" : "Failure");
176	expect(state.requests).toHaveLength(allowed ? 1 : 0);
177	if (result._tag === "Failure") {
178	expect(Cause.squash(result.cause)).toMatchObject({
179	requiredScope: AuthOrchestrationOperateScope,
180	});
181	}
182	},
183	);
184
185	it.each([false, true])(
186	"reads the fresh task grant before attaching a worktree: %s",
187	async (allowed) => {
188	state.scopes.get(secondary)!.add(AuthSourceControlWriteScope);
189	if (!allowed) state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
190	const action = usePreparePullRequestThreadAction(scope);
191	if (allowed) state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
192	else state.scopes.get(secondary)!.delete(AuthOrchestrationOperateScope);
193	const result = await action.run({ reference: "1", mode: "worktree", threadId });
194	expect(result._tag).toBe(allowed ? "Success" : "Failure");
195	expect(state.requests).toHaveLength(allowed ? 1 : 0);
196	},
197	);
198
199	it("still requires source-control permission when the task grant is present", async () => {
200	state.scopes.get(secondary)!.add(AuthOrchestrationOperateScope);
201	const result = await usePreparePullRequestThreadAction(scope).run({
202	reference: "1",
203	mode: "worktree",
204	threadId,
205	});
206	expect(result._tag).toBe("Failure");
207	expect(state.requests).toEqual([]);
208	});
209	});

apps/web/src/state/sourceControlActions.ts+44-7

 @@ -9,12 +9,15 @@ import {
   type VcsActionOperation,
   type RunVcsStackedActionInput,
 } from "@t3tools/client-runtime/state/vcs";
-import type {
+import {
-  EnvironmentId,
+  AuthOrchestrationOperateScope,
-  GitResolvePullRequestResult,
+  AuthSourceControlWriteScope,
-  SourceControlCloneProtocol,
+  EnvironmentAuthorizationError,
-  SourceControlRepositoryVisibility,
+  type EnvironmentId,
-  ThreadId,
+  type GitResolvePullRequestResult,
+  type SourceControlCloneProtocol,
+  type SourceControlRepositoryVisibility,
+  type ThreadId,
 } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Option from "effect/Option";
 @@ -24,6 +27,7 @@ import { useCallback } from "react";
 import { appAtomRegistry } from "../rpc/atomRegistry";
 import { gitEnvironment } from "./git";
 import { useEnvironmentQuery } from "./query";
+import { readEnvironmentScope, useEnvironmentScope } from "./session";
 import { sourceControlEnvironment } from "./sourceControl";
 import { useAtomCommand } from "./use-atom-command";
 import { vcsActionManager, vcsEnvironment } from "./vcs";
 @@ -45,11 +49,15 @@ interface SourceControlActionState<
   R extends AtomCommandResult<unknown, unknown>,
 > {
   readonly isPending: boolean;
+  readonly isAllowed: boolean;
   readonly error: unknown;
   readonly run: (
     ...args: TArgs
   ) => Promise<
-    AtomCommandResult<AtomCommandSuccess<R>, AtomCommandFailure<R> | VcsActionUnavailableError>
+    AtomCommandResult<
+      AtomCommandSuccess<R>,
+      AtomCommandFailure<R> | VcsActionUnavailableError | EnvironmentAuthorizationError
+    >
   >;
   readonly resetError: () => void;
 }
 @@ -73,6 +81,7 @@ function useAction<
   readonly onSuccess?: () => void;
   readonly managedExternally?: boolean;
 }): SourceControlActionState<TArgs, R> {
+  const isAllowed = useEnvironmentScope(input.scope.environmentId, AuthSourceControlWriteScope);
   const operation = ACTION_OPERATION[input.kind];
   const state = useAtomValue(vcsActionManager.stateAtom(input.scope));
   const ownsState = state.operation === operation;
 @@ -83,6 +92,19 @@ function useAction<
   const run = useCallback(
     async (...args: TArgs) => {
+      if (
+        input.scope.environmentId === null ||
+        !readEnvironmentScope(input.scope.environmentId, AuthSourceControlWriteScope)
+      ) {
+        return AsyncResult.failure<never, EnvironmentAuthorizationError>(
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthSourceControlWriteScope,
+              message: "This connection cannot change source control.",
+            }),
+          ),
+        );
+      }
       const execute = async (): Promise<
         AtomCommandResult<AtomCommandSuccess<R>, AtomCommandFailure<R>>
       > => {
 @@ -108,6 +130,7 @@ function useAction<
   );
   return {
+    isAllowed,
     error: ownsState ? state.error : null,
     isPending: ownsState && state.isRunning,
     resetError,
 @@ -307,6 +330,20 @@ export function usePreparePullRequestThreadAction(scope: SourceControlActionScop
           ),
         );
       }
+      if (
+        input.mode === "worktree" &&
+        input.threadId !== undefined &&
+        !readEnvironmentScope(target.environmentId, AuthOrchestrationOperateScope)
+      ) {
+        return AsyncResult.failure<never, EnvironmentAuthorizationError>(
+          Cause.fail(
+            new EnvironmentAuthorizationError({
+              requiredScope: AuthOrchestrationOperateScope,
+              message: "This connection cannot change threads.",
+            }),
+          ),
+        );
+      }
       return preparePullRequestThread({
         environmentId: target.environmentId,
         input: {

docs/user/remote-access.md+6

...	@@ -281,6 +281,12 @@ Grouping checkouts does not combine their permissions. Shared project settings	...	@@ -281,6 +281,12 @@ Grouping checkouts does not combine their permissions. Shared project settings
281	require `orchestration:operate` on every member environment; actions on one	281	require `orchestration:operate` on every member environment; actions on one
282	checkout use that checkout's permissions.	282	checkout use that checkout's permissions.
283		283
		284	`source-control:write` covers direct Git and pull request changes made from the
		285	client: pushing, switching or creating branches, cloning, and removing
		286	worktrees. It does not restrict what a task does. Starting a task in a new
		287	worktree still creates that branch and worktree with `orchestration:operate`,
		288	and the agent it runs can use Git however the environment allows.
		289
284	Settings changes, provider management, and environment maintenance can be granted	290	Settings changes, provider management, and environment maintenance can be granted
285	separately from access administration. New standard pairings include these	291	separately from access administration. New standard pairings include these
286	permissions. Existing clients keep their original grants after an update; to	292	permissions. Existing clients keep their original grants after an update; to

packages/client-runtime/src/rpc/client.ts+1-1

...	@@ -203,7 +203,7 @@ export const requestGuarded = Effect.fn("EnvironmentRpc.request")(function* <	...	@@ -203,7 +203,7 @@ export const requestGuarded = Effect.fn("EnvironmentRpc.request")(function* <
203	return yield* method(input).pipe(Effect.ensuring(completeObservation));	203	return yield* method(input).pipe(Effect.ensuring(completeObservation));
204	});	204	});
205		205
206	function runStreamGuarded<TTag extends EnvironmentStreamCommandRpcTag>(	206	export function runStreamGuarded<TTag extends EnvironmentStreamCommandRpcTag>(
207	tag: TTag,	207	tag: TTag,
208	input: EnvironmentRpcInput<TTag>,	208	input: EnvironmentRpcInput<TTag>,
209	): Stream.Stream<	209	): Stream.Stream<

packages/client-runtime/src/state/commandPermissions.test.ts+43

...	@@ -2,6 +2,8 @@ import { describe, expect, it } from "@effect/vitest";	...	@@ -2,6 +2,8 @@ import { describe, expect, it } from "@effect/vitest";
2	import { vi } from "vite-plus/test";	2	import { vi } from "vite-plus/test";
3	import {	3	import {
4	AuthOrchestrationOperateScope,	4	AuthOrchestrationOperateScope,
		5	AuthSourceControlWriteScope,
		6	ThreadId,
5	EnvironmentId,	7	EnvironmentId,
6	ScheduledTaskId,	8	ScheduledTaskId,
7	WS_METHODS,	9	WS_METHODS,
...	@@ -150,3 +152,44 @@ describe("command permissions", () => {	...	@@ -150,3 +152,44 @@ describe("command permissions", () => {
150	}	152	}
151	});	153	});
152	});	154	});
		155
		156	it.effect(
		157	"requires source control alone for git, and both grants when attaching a worktree to a thread",
		158	() =>
		159	Effect.scoped(
		160	Effect.gen(function* () {
		161	const registry = yield* setup;
		162	registry.set(sessions(env), AsyncResult.success(grant(true)));
		163	const git = createCommandPermissions(runtime, WS_METHODS.vcsInit);
		164	expect((yield* git.authorize(registry, env).pipe(Effect.flip)).requiredScope).toBe(
		165	AuthSourceControlWriteScope,
		166	);
		167	registry.set(
		168	sessions(env),
		169	AsyncResult.success({ ...grant(false), scopes: [AuthSourceControlWriteScope] }),
		170	);
		171	yield* git.authorize(registry, env);
		172	const prepare = createCommandPermissions(runtime, WS_METHODS.gitPreparePullRequestThread);
		173	const input = {
		174	cwd: "/repo",
		175	reference: "123",
		176	mode: "worktree",
		177	threadId: ThreadId.make("thread"),
		178	};
		179	expect(registry.get(prepare.permissionAtom(env, input))).toBe(false);
		180	expect(
		181	(yield* prepare.authorize(registry, env, input).pipe(Effect.flip)).requiredScope,
		182	).toBe(AuthOrchestrationOperateScope);
		183	yield* prepare.authorize(registry, env, { ...input, threadId: undefined });
		184	registry.set(
		185	sessions(env),
		186	AsyncResult.success({
		187	...grant(true),
		188	scopes: [AuthSourceControlWriteScope, AuthOrchestrationOperateScope],
		189	}),
		190	);
		191	expect(registry.get(prepare.permissionAtom(env, input))).toBe(true);
		192	yield* prepare.authorize(registry, env, input);
		193	}),
		194	),
		195	);

packages/client-runtime/src/state/pullRequests.test.ts+91

...	@@ -1,9 +1,14 @@	...	@@ -1,9 +1,14 @@
		1	import { createCommandPermissions } from "./commandPermissions.ts";
		2	import { RpcPermissionGuard } from "../rpc/client.ts";
		3	import { vi } from "vite-plus/test";
1	import {	4	import {
2	EnvironmentId,	5	EnvironmentId,
		6	AuthSourceControlWriteScope,
3	ProjectId,	7	ProjectId,
4	PullRequestOperationError,	8	PullRequestOperationError,
5	WS_METHODS,	9	WS_METHODS,
6	type PullRequestStack,	10	type PullRequestStack,
		11	type AuthSessionState,
7	} from "@t3tools/contracts";	12	} from "@t3tools/contracts";
8	import { expect, it } from "@effect/vitest";	13	import { expect, it } from "@effect/vitest";
9	import * as Data from "effect/Data";	14	import * as Data from "effect/Data";
...	@@ -194,6 +199,7 @@ for (const scenario of [	...	@@ -194,6 +199,7 @@ for (const scenario of [
194	: route(WS_METHODS.pullRequestsRunAction, input)	199	: route(WS_METHODS.pullRequestsRunAction, input)
195	).pipe(	200	).pipe(
196	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	201	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
		202	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
197	Effect.provideService(GitHubRoutingPermissions, {	203	Effect.provideService(GitHubRoutingPermissions, {
198	...trustedRouting,	204	...trustedRouting,
199	get: () => Effect.succeed(trusted ? "read-write" : "off"),	205	get: () => Effect.succeed(trusted ? "read-write" : "off"),
...	@@ -301,6 +307,7 @@ it.effect("shares active read identity probes while keeping later reads and muta	...	@@ -301,6 +307,7 @@ it.effect("shares active read identity probes while keeping later reads and muta
301	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	307	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
302	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	308	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
303	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	309	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		310	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
304	);	311	);
305	}),	312	}),
306	),	313	),
...	@@ -554,6 +561,7 @@ it.effect.each(["github", "gitlab", "bitbucket", "azure-devops"] as const)(	...	@@ -554,6 +561,7 @@ it.effect.each(["github", "gitlab", "bitbucket", "azure-devops"] as const)(
554	}).pipe(	561	}).pipe(
555	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	562	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
556	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	563	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		564	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
557	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	565	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
558	);	566	);
559	const environment = provider === "github" ? "local" : "origin";	567	const environment = provider === "github" ? "local" : "origin";
...	@@ -720,10 +728,12 @@ it.effect.each(["default", "origin-off", "destination-off", "read-only"] as cons	...	@@ -720,10 +728,12 @@ it.effect.each(["default", "origin-off", "destination-off", "read-only"] as cons
720	}).pipe(	728	}).pipe(
721	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	729	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
722	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	730	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
		731	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
723	);	732	);
724	yield* permission === "default"	733	yield* permission === "default"
725	? request	734	? request
726	: request.pipe(	735	: request.pipe(
		736	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
727	Effect.provideService(GitHubRoutingPermissions, {	737	Effect.provideService(GitHubRoutingPermissions, {
728	...trustedRouting,	738	...trustedRouting,
729	get: (entry) =>	739	get: (entry) =>
...	@@ -842,6 +852,7 @@ it.effect.each(	...	@@ -842,6 +852,7 @@ it.effect.each(
842	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	852	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
843	// This also represents a user enabling the stale catalog entry after re-resolution.	853	// This also represents a user enabling the stale catalog entry after re-resolution.
844	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	854	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		855	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
845	);	856	);
846	yield* stored === "unavailable"	857	yield* stored === "unavailable"
847	? route	858	? route
...	@@ -897,6 +908,7 @@ it.live.each(["origin", "alternate"] as const)(	...	@@ -897,6 +908,7 @@ it.live.each(["origin", "alternate"] as const)(
897	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	908	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
898	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	909	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
899	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	910	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		911	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
900	Effect.flip,	912	Effect.flip,
901	);	913	);
902	expect(error._tag).toBe("PullRequestOperationError");	914	expect(error._tag).toBe("PullRequestOperationError");
...	@@ -958,6 +970,7 @@ it.effect.each(	...	@@ -958,6 +970,7 @@ it.effect.each(
958	}).pipe(	970	}).pipe(
959	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	971	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
960	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	972	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		973	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
961	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	974	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
962	);	975	);
963	const fiber = yield* request.pipe(Effect.forkChild);	976	const fiber = yield* request.pipe(Effect.forkChild);
...	@@ -1014,6 +1027,7 @@ it.live("keeps source workspace metadata when an alternate answers a detail read	...	@@ -1014,6 +1027,7 @@ it.live("keeps source workspace metadata when an alternate answers a detail read
1014	}).pipe(	1027	}).pipe(
1015	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	1028	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
1016	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	1029	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		1030	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
1017	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	1031	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
1018	);	1032	);
1019	expect(result).toEqual({	1033	expect(result).toEqual({
...	@@ -1101,6 +1115,7 @@ it.live(	...	@@ -1101,6 +1115,7 @@ it.live(
1101	}).pipe(	1115	}).pipe(
1102	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	1116	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
1103	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	1117	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		1118	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
1104	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	1119	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
1105	);	1120	);
1106	}),	1121	}),
...	@@ -1649,6 +1664,7 @@ it.effect.each([false, true])(	...	@@ -1649,6 +1664,7 @@ it.effect.each([false, true])(
1649	}).pipe(	1664	}).pipe(
1650	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),	1665	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, environmentRegistry),
1651	Effect.provideService(GitHubRoutingPermissions, trustedRouting),	1666	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		1667	Effect.provideService(RpcPermissionGuard, { authorize: () => Effect.void }),
1652	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),	1668	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
1653	);	1669	);
1654	expect(result).toEqual({ state: "open", checks: [] });	1670	expect(result).toEqual({ state: "open", checks: [] });
...	@@ -1980,3 +1996,78 @@ it.effect("refreshes stack state after reopening and head SHAs after a turn", ()	...	@@ -1980,3 +1996,78 @@ it.effect("refreshes stack state after reopening and head SHAs after a turn", ()
1980	}),	1996	}),
1981	),	1997	),
1982	);	1998	);
		1999
		2000	// Transport fixtures have a source-control-only session; authorization edge cases
		2001	// are exercised by commandPermissions.test.ts.
		2002	vi.mock("./session.ts", () => ({
		2003	createEnvironmentSessionAtoms: () => ({ sessionStateAtom: grantedSessions }),
		2004	}));
		2005	const grantedSessions = Atom.family((_id: EnvironmentId) =>
		2006	Atom.make<AsyncResult.AsyncResult<AuthSessionState>>(
		2007	AsyncResult.success({
		2008	authenticated: true,
		2009	auth: {
		2010	policy: "remote-reachable" as const,
		2011	bootstrapMethods: [],
		2012	sessionMethods: [],
		2013	sessionCookieName: "test",
		2014	},
		2015	scopes: [AuthSourceControlWriteScope],
		2016	}),
		2017	),
		2018	);
		2019
		2020	it.effect("denies a routed write when only the origin has source-control permission", () =>
		2021	Effect.scoped(
		2022	Effect.gen(function* () {
		2023	let writes = 0;
		2024	const identity = { host: "github.com", provider: "github", viewer: "test", accountId: "123" };
		2025	const client = {
		2026	[WS_METHODS.pullRequestsRouting]: () => Effect.succeed(identity),
		2027	[WS_METHODS.pullRequestsRoutingIdentity]: () => Effect.succeed(identity),
		2028	[WS_METHODS.pullRequestsRunAction]: () =>
		2029	Effect.sync(() => {
		2030	writes++;
		2031	}),
		2032	} as unknown as WsRpcProtocolClient;
		2033	const fixture = yield* makeTestRuntime(client, client);
		2034	const local = EnvironmentId.make("local-environment");
		2035	const stop = fixture.registry.mount(grantedSessions(local));
		2036	yield* Effect.addFinalizer(() => Effect.sync(stop));
		2037	fixture.registry.set(
		2038	grantedSessions(local),
		2039	AsyncResult.success({
		2040	authenticated: true,
		2041	scopes: [],
		2042	auth: {
		2043	policy: "remote-reachable" as const,
		2044	bootstrapMethods: [],
		2045	sessionMethods: [],
		2046	sessionCookieName: "test",
		2047	},
		2048	}),
		2049	);
		2050	const error = yield* createPullRequestRouter()(WS_METHODS.pullRequestsRunAction, {
		2051	projectId: ProjectId.make("project"),
		2052	repository: "acme/repo",
		2053	number: 1,
		2054	action: "merge",
		2055	}).pipe(
		2056	Effect.provideService(EnvironmentRegistry.EnvironmentRegistry, fixture.environmentRegistry),
		2057	Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, fixture.supervisor),
		2058	Effect.provideService(GitHubRoutingPermissions, trustedRouting),
		2059	Effect.provideService(RpcPermissionGuard, {
		2060	authorize: (id, method, input) =>
		2061	createCommandPermissions(fixture.runtime, method).authorize(
		2062	fixture.registry,
		2063	id,
		2064	input,
		2065	),
		2066	}),
		2067	Effect.flip,
		2068	);
		2069	expect(error._tag).toBe("EnvironmentAuthorizationError");
		2070	expect(writes).toBe(0);
		2071	}),
		2072	),
		2073	);

packages/client-runtime/src/state/pullRequests.ts+5-6

...	@@ -19,7 +19,6 @@ import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";	...	@@ -19,7 +19,6 @@ import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
19		19
20	import {	20	import {
21	createAtomCommandScheduler,	21	createAtomCommandScheduler,
22	createEnvironmentCommand,
23	createEnvironmentRpcCommand,	22	createEnvironmentRpcCommand,
24	createEnvironmentRpcQueryAtomFamily,	23	createEnvironmentRpcQueryAtomFamily,
25	createEnvironmentRpcSubscriptionAtomFamily,	24	createEnvironmentRpcSubscriptionAtomFamily,
...	@@ -320,7 +319,8 @@ export function createPullRequestEnvironmentAtoms<R, E>(	...	@@ -320,7 +319,8 @@ export function createPullRequestEnvironmentAtoms<R, E>(
320	JSON.stringify([environmentId, input.projectId, input.repository, input.number]),	319	JSON.stringify([environmentId, input.projectId, input.repository, input.number]),
321	},	320	},
322	}),	321	}),
323	runAction: createEnvironmentCommand(runtime, {	322	runAction: createEnvironmentRpcCommand(runtime, {
		323	tag: WS_METHODS.pullRequestsRunAction,
324	label: "environment-data:pull-requests:run-action",	324	label: "environment-data:pull-requests:run-action",
325	// Preparation belongs to the write's lane. Refreshable queries would restart it after	325	// Preparation belongs to the write's lane. Refreshable queries would restart it after
326	// every preceding action, and preparing outside the lane could reorder the clicks.	326	// every preceding action, and preparing outside the lane could reorder the clicks.
...	@@ -328,8 +328,6 @@ export function createPullRequestEnvironmentAtoms<R, E>(	...	@@ -328,8 +328,6 @@ export function createPullRequestEnvironmentAtoms<R, E>(
328	input: PullRequestActionInput & {	328	input: PullRequestActionInput & {
329	readonly resolveMergeMethod?: (detail: PullRequestDetail) => PullRequestMergeMethod;	329	readonly resolveMergeMethod?: (detail: PullRequestDetail) => PullRequestMergeMethod;
330	},	330	},
331	registry,
332	environmentId,
333	) =>	331	) =>
334	Effect.gen(function* () {	332	Effect.gen(function* () {
335	const { resolveMergeMethod, ...actionInput } = input;	333	const { resolveMergeMethod, ...actionInput } = input;
...	@@ -369,9 +367,10 @@ export function createPullRequestEnvironmentAtoms<R, E>(	...	@@ -369,9 +367,10 @@ export function createPullRequestEnvironmentAtoms<R, E>(
369	});	367	});
370	preparedInput = { ...actionInput, mergeMethod };	368	preparedInput = { ...actionInput, mergeMethod };
371	}	369	}
372	yield* routedRequest(WS_METHODS.pullRequestsRunAction, preparedInput);	370	return yield* routedRequest(WS_METHODS.pullRequestsRunAction, preparedInput);
373	registry.refresh(preview({ environmentId, input: actionInput }));
374	}),	371	}),
		372	onSuccess: ({ environmentId, input }, registry) =>
		373	Effect.sync(() => registry.refresh(preview({ environmentId, input }))),
375	scheduler: commandScheduler,	374	scheduler: commandScheduler,
376	concurrency: serialPerEnvironment,	375	concurrency: serialPerEnvironment,
377	}),	376	}),

packages/client-runtime/src/state/runtime.ts+12-7

 @@ -1,5 +1,5 @@
 import { createCommandPermissions } from "./commandPermissions.ts";
-import { runStreamInEnvironment, followStreamInEnvironment } from "./environmentStreams.ts";
+import { followStreamInEnvironment } from "./environmentStreams.ts";
 export { runStreamInEnvironment, followStreamInEnvironment } from "./environmentStreams.ts";
 import {
   type ClientGuardedRpcTag,
 @@ -717,13 +717,18 @@ export function createEnvironmentRpcSubscriptionAtomFamily<
   });
 }
-export function createEnvironmentRpcCommand<R, ER, TTag extends EnvironmentUnaryRpcTag>(
+export function createEnvironmentRpcCommand<
+  R,
+  ER,
+  TTag extends EnvironmentUnaryRpcTag,
+  Input extends EnvironmentRpcInput<TTag> = EnvironmentRpcInput<TTag>,
+>(
   runtime: Atom.AtomRuntime<EnvironmentRegistry.EnvironmentRegistry | R, ER>,
   options: {
     readonly label: string;
     readonly tag: TTag;
     readonly execute?: (
-      input: EnvironmentRpcInput<TTag>,
+      input: Input,
     ) => Effect.Effect<
       EnvironmentRpcSuccess<TTag>,
       EnvironmentRpcFailure<TTag> | EnvironmentRpcUnavailableError,
 @@ -732,19 +737,19 @@ export function createEnvironmentRpcCommand<R, ER, TTag extends EnvironmentUnary
     readonly scheduler?: AtomCommandScheduler;
     readonly concurrency?: AtomCommandConcurrency<{
       readonly environmentId: EnvironmentIdType;
-      readonly input: EnvironmentRpcInput<TTag>;
+      readonly input: NoInfer<Input>;
     }>;
     readonly onSuccess?: (
       target: {
         readonly environmentId: EnvironmentIdType;
-        readonly input: EnvironmentRpcInput<TTag>;
+        readonly input: NoInfer<Input>;
       },
       registry: AtomRegistry.AtomRegistry,
     ) => Effect.Effect<void, never, R>;
     readonly onSettled?: (
       target: {
         readonly environmentId: EnvironmentIdType;
-        readonly input: EnvironmentRpcInput<TTag>;
+        readonly input: NoInfer<Input>;
       },
       registry: AtomRegistry.AtomRegistry,
     ) => Effect.Effect<void, never, R>;
 @@ -755,7 +760,7 @@ export function createEnvironmentRpcCommand<R, ER, TTag extends EnvironmentUnary
     label: options.label,
     ...(options.scheduler === undefined ? {} : { scheduler: options.scheduler }),
     ...(options.concurrency === undefined ? {} : { concurrency: options.concurrency }),
-    execute: (input: EnvironmentRpcInput<TTag>, registry, environmentId) => {
+    execute: (input: Input, registry, environmentId) => {
       const target = {
         environmentId,
         input,

packages/client-runtime/src/state/sourceControl.test.ts+22

...	@@ -1,5 +1,7 @@	...	@@ -1,5 +1,7 @@
		1	import { vi } from "vite-plus/test";
1	import {	2	import {
2	EnvironmentId,	3	EnvironmentId,
		4	AuthSourceControlWriteScope,
3	WS_METHODS,	5	WS_METHODS,
4	type SourceControlPublishRepositoryResult,	6	type SourceControlPublishRepositoryResult,
5	} from "@t3tools/contracts";	7	} from "@t3tools/contracts";
...	@@ -168,3 +170,23 @@ describe("source control environment atoms", () => {	...	@@ -168,3 +170,23 @@ describe("source control environment atoms", () => {
168	),	170	),
169	);	171	);
170	});	172	});
		173
		174	// Transport fixtures have a source-control-only session; authorization edge cases
		175	// are exercised by commandPermissions.test.ts.
		176	vi.mock("./session.ts", () => ({
		177	createEnvironmentSessionAtoms: () => ({ sessionStateAtom: grantedSessions }),
		178	}));
		179	const grantedSessions = Atom.family((_id: EnvironmentId) =>
		180	Atom.make(
		181	AsyncResult.success({
		182	authenticated: true,
		183	auth: {
		184	policy: "remote-reachable",
		185	bootstrapMethods: [],
		186	sessionMethods: [],
		187	sessionCookieName: "test",
		188	},
		189	scopes: [AuthSourceControlWriteScope],
		190	}),
		191	),
		192	);

packages/client-runtime/src/state/vcs.test.ts+22

...	@@ -1,5 +1,7 @@	...	@@ -1,5 +1,7 @@
		1	import { vi } from "vite-plus/test";
1	import {	2	import {
2	EnvironmentId,	3	EnvironmentId,
		4	AuthSourceControlWriteScope,
3	WS_METHODS,	5	WS_METHODS,
4	type VcsListRefsInput,	6	type VcsListRefsInput,
5	type VcsListRefsResult,	7	type VcsListRefsResult,
...	@@ -643,3 +645,23 @@ describe("cached VCS refs", () => {	...	@@ -643,3 +645,23 @@ describe("cached VCS refs", () => {
643	),	645	),
644	);	646	);
645	});	647	});
		648
		649	// Transport fixtures have a source-control-only session; authorization edge cases
		650	// are exercised by commandPermissions.test.ts.
		651	vi.mock("./session.ts", () => ({
		652	createEnvironmentSessionAtoms: () => ({ sessionStateAtom: grantedSessions }),
		653	}));
		654	const grantedSessions = Atom.family((_id: EnvironmentId) =>
		655	Atom.make(
		656	AsyncResult.success({
		657	authenticated: true,
		658	auth: {
		659	policy: "remote-reachable",
		660	bootstrapMethods: [],
		661	sessionMethods: [],
		662	sessionCookieName: "test",
		663	},
		664	scopes: [AuthSourceControlWriteScope],
		665	}),
		666	),
		667	);

packages/client-runtime/src/state/vcsAction.test.ts+22

...	@@ -1,5 +1,7 @@	...	@@ -1,5 +1,7 @@
		1	import { vi } from "vite-plus/test";
1	import {	2	import {
2	EnvironmentId,	3	EnvironmentId,
		4	AuthSourceControlWriteScope,
3	ThreadId,	5	ThreadId,
4	ProjectId,	6	ProjectId,
5	WS_METHODS,	7	WS_METHODS,
...	@@ -718,3 +720,23 @@ describe("vcsActionState", () => {	...	@@ -718,3 +720,23 @@ describe("vcsActionState", () => {
718	),	720	),
719	);	721	);
720	});	722	});
		723
		724	// Transport fixtures have a source-control-only session; authorization edge cases
		725	// are exercised by commandPermissions.test.ts.
		726	vi.mock("./session.ts", () => ({
		727	createEnvironmentSessionAtoms: () => ({ sessionStateAtom: grantedSessions }),
		728	}));
		729	const grantedSessions = Atom.family((_id: EnvironmentId) =>
		730	Atom.make(
		731	AsyncResult.success({
		732	authenticated: true,
		733	auth: {
		734	policy: "remote-reachable",
		735	bootstrapMethods: [],
		736	sessionMethods: [],
		737	sessionCookieName: "test",
		738	},
		739	scopes: [AuthSourceControlWriteScope],
		740	}),
		741	),
		742	);

packages/client-runtime/src/state/vcsAction.ts+7-2

 @@ -19,13 +19,14 @@ import { AsyncResult, Atom, type AtomRegistry } from "effect/reactivity";
 import type { EnvironmentRegistry } from "../connection/registry.ts";
 import * as Persistence from "../platform/persistence.ts";
-import { runStream } from "../rpc/client.ts";
+import { runStreamGuarded, RpcPermissionGuard } from "../rpc/client.ts";
 import {
   createRuntimeCommand,
   runStreamInEnvironment,
   type AtomCommand,
   type AtomCommandResult,
 } from "./runtime.ts";
+import { createCommandPermissions } from "./commandPermissions.ts";
 import { vcsCommandScheduler } from "./vcsCommandScheduler.ts";
 import { invalidateCachedVcsRefs } from "./vcsRefInvalidation.ts";
 @@ -483,7 +484,7 @@ export function createVcsActionManager<R, E>(
         return consumeVcsActionProgress(
           runStreamInEnvironment(
             target.environmentId,
-            runStream(WS_METHODS.gitRunStackedAction, rpcInput),
+            runStreamGuarded(WS_METHODS.gitRunStackedAction, rpcInput),
           ),
           {
             target,
 @@ -507,6 +508,10 @@ export function createVcsActionManager<R, E>(
               }),
           },
         ).pipe(
+          Effect.provideService(RpcPermissionGuard, {
+            authorize: (id, method, payload) =>
+              createCommandPermissions(runtime, method).authorize(registry, id, payload),
+          }),
           Effect.ensuring(invalidateCachedVcsRefs(registry, target)),
           Effect.tap(() => clearOwnedState),
           Effect.tapError((error) =>

packages/contracts/src/auth.ts+3

...	@@ -84,6 +84,7 @@ export const AuthSettingsWriteScope = "settings:write" as const;	...	@@ -84,6 +84,7 @@ export const AuthSettingsWriteScope = "settings:write" as const;
84	export const AuthProvidersManageScope = "providers:manage" as const;	84	export const AuthProvidersManageScope = "providers:manage" as const;
85	export const AuthEnvironmentMaintainScope = "environment:maintain" as const;	85	export const AuthEnvironmentMaintainScope = "environment:maintain" as const;
86	export const AuthTerminalOperateScope = "terminal:operate" as const;	86	export const AuthTerminalOperateScope = "terminal:operate" as const;
		87	export const AuthSourceControlWriteScope = "source-control:write" as const;
87	export const AuthReviewWriteScope = "review:write" as const;	88	export const AuthReviewWriteScope = "review:write" as const;
88	export const AuthAccessReadScope = "access:read" as const;	89	export const AuthAccessReadScope = "access:read" as const;
89	export const AuthAccessWriteScope = "access:write" as const;	90	export const AuthAccessWriteScope = "access:write" as const;
...	@@ -97,6 +98,7 @@ export const AuthEnvironmentScope = Schema.Literals([	...	@@ -97,6 +98,7 @@ export const AuthEnvironmentScope = Schema.Literals([
97	AuthEnvironmentMaintainScope,	98	AuthEnvironmentMaintainScope,
98	AuthTerminalOperateScope,	99	AuthTerminalOperateScope,
99	AuthReviewWriteScope,	100	AuthReviewWriteScope,
		101	AuthSourceControlWriteScope,
100	AuthAccessReadScope,	102	AuthAccessReadScope,
101	AuthAccessWriteScope,	103	AuthAccessWriteScope,
102	AuthRelayReadScope,	104	AuthRelayReadScope,
...	@@ -114,6 +116,7 @@ export const AuthStandardClientScopes = [	...	@@ -114,6 +116,7 @@ export const AuthStandardClientScopes = [
114	AuthEnvironmentMaintainScope,	116	AuthEnvironmentMaintainScope,
115	AuthTerminalOperateScope,	117	AuthTerminalOperateScope,
116	AuthReviewWriteScope,	118	AuthReviewWriteScope,
		119	AuthSourceControlWriteScope,
117	AuthRelayReadScope,	120	AuthRelayReadScope,
118	] as const;	121	] as const;
119	export const AuthAdministrativeScopes = [	122	export const AuthAdministrativeScopes = [

packages/contracts/src/clientRpcPermissions.ts+40-2

...	@@ -1,8 +1,39 @@	...	@@ -1,8 +1,39 @@
1	import { AuthOrchestrationOperateScope, type AuthEnvironmentScope } from "./auth.ts";	1	import * as Schema from "effect/Schema";
		2	import { GitPreparePullRequestThreadInput } from "./git.ts";
		3	import {
		4	AuthOrchestrationOperateScope,
		5	AuthSourceControlWriteScope,
		6	type AuthEnvironmentScope,
		7	} from "./auth.ts";
2	import { WS_METHODS } from "./rpc.ts";	8	import { WS_METHODS } from "./rpc.ts";
3		9
4	/** Incremental client enforcement; the server still authorizes every request. */	10	/** Incremental client enforcement; the server still authorizes every request. */
5	export const CLIENT_GUARDED_RPC_SCOPES = {	11	export const CLIENT_GUARDED_RPC_SCOPES = {
		12	[WS_METHODS.pullRequestsRunAction]: AuthSourceControlWriteScope,
		13	[WS_METHODS.pullRequestsUpdate]: AuthSourceControlWriteScope,
		14	[WS_METHODS.pullRequestsComment]: AuthSourceControlWriteScope,
		15	[WS_METHODS.pullRequestsUpdateComment]: AuthSourceControlWriteScope,
		16	[WS_METHODS.pullRequestsSubmitReview]: AuthSourceControlWriteScope,
		17	[WS_METHODS.pullRequestsReplyToThread]: AuthSourceControlWriteScope,
		18	[WS_METHODS.pullRequestsSetThreadResolution]: AuthSourceControlWriteScope,
		19	[WS_METHODS.pullRequestsSetReaction]: AuthSourceControlWriteScope,
		20	[WS_METHODS.pullRequestsSetFilesViewed]: AuthSourceControlWriteScope,
		21	[WS_METHODS.pullRequestsRequestReviewers]: AuthSourceControlWriteScope,
		22	[WS_METHODS.pullRequestsSetLabels]: AuthSourceControlWriteScope,
		23	[WS_METHODS.sourceControlCloneRepository]: AuthSourceControlWriteScope,
		24	[WS_METHODS.sourceControlPublishRepository]: AuthSourceControlWriteScope,
		25	[WS_METHODS.projectCloneStart]: AuthSourceControlWriteScope,
		26	[WS_METHODS.projectCloneCancel]: AuthSourceControlWriteScope,
		27	[WS_METHODS.projectCloneRetry]: AuthSourceControlWriteScope,
		28	[WS_METHODS.vcsPull]: AuthSourceControlWriteScope,
		29	[WS_METHODS.gitRunStackedAction]: AuthSourceControlWriteScope,
		30	[WS_METHODS.gitPreparePullRequestThread]: AuthSourceControlWriteScope,
		31	[WS_METHODS.vcsCreateWorktree]: AuthSourceControlWriteScope,
		32	[WS_METHODS.vcsRemoveWorktree]: AuthSourceControlWriteScope,
		33	[WS_METHODS.vcsCreateRef]: AuthSourceControlWriteScope,
		34	[WS_METHODS.vcsSwitchRef]: AuthSourceControlWriteScope,
		35	[WS_METHODS.vcsInit]: AuthSourceControlWriteScope,
		36
6	[WS_METHODS.scheduledTasksUpsert]: AuthOrchestrationOperateScope,	37	[WS_METHODS.scheduledTasksUpsert]: AuthOrchestrationOperateScope,
7	[WS_METHODS.scheduledTasksSetEnabled]: AuthOrchestrationOperateScope,	38	[WS_METHODS.scheduledTasksSetEnabled]: AuthOrchestrationOperateScope,
8	[WS_METHODS.scheduledTasksDelete]: AuthOrchestrationOperateScope,	39	[WS_METHODS.scheduledTasksDelete]: AuthOrchestrationOperateScope,
...	@@ -11,10 +42,17 @@ export const CLIENT_GUARDED_RPC_SCOPES = {	...	@@ -11,10 +42,17 @@ export const CLIENT_GUARDED_RPC_SCOPES = {
11	} as const;	42	} as const;
12	export type ClientGuardedRpcTag = keyof typeof CLIENT_GUARDED_RPC_SCOPES;	43	export type ClientGuardedRpcTag = keyof typeof CLIENT_GUARDED_RPC_SCOPES;
13		44
		45	const decodePrepareThread = Schema.decodeUnknownSync(GitPreparePullRequestThreadInput);
		46
14	export function clientRpcRequiredScopes(	47	export function clientRpcRequiredScopes(
15	method: string,	48	method: string,
16	_input: unknown,	49	input: unknown,
17	): readonly AuthEnvironmentScope[] {	50	): readonly AuthEnvironmentScope[] {
		51	if (method === WS_METHODS.gitPreparePullRequestThread && input !== undefined) {
		52	const payload = decodePrepareThread(input);
		53	if (payload.mode === "worktree" && payload.threadId !== undefined)
		54	return [AuthSourceControlWriteScope, AuthOrchestrationOperateScope];
		55	}
18	return Object.hasOwn(CLIENT_GUARDED_RPC_SCOPES, method)	56	return Object.hasOwn(CLIENT_GUARDED_RPC_SCOPES, method)
19	? [CLIENT_GUARDED_RPC_SCOPES[method as ClientGuardedRpcTag]]	57	? [CLIENT_GUARDED_RPC_SCOPES[method as ClientGuardedRpcTag]]
20	: [];	58	: [];

author	Julius Marminge <julius0216@outlook.com> 2026-10-06 20:30:11-07:00
committer	GitHub <noreply@github.com> 2026-10-06 20:30:11-07:00
log	2eda8ac6a3151b70b8ee49b438bfb6fcd835802e
tree	18587141f57215c79ce868870a6c410bd8fa18dd
parent	28ce9d1c1751d70c869e3de3287b96d5e28fc845
signature	Signed by PGP key B5690EEEBB952194

feat(auth): separate source control write permissions (#9787)