[immakermatty]

Problem

On a Lazurio Environment only the Launchpad's Chat click pairs a browser with T3: it mints a 60 s token and sends the browser to /pair#token=…. Every other way into Chat ends on T3's "Pair with this environment" card, outside the app layout, with no way back:

• a bookmark;
• the shell's switch in Automate;
• the Dashboard;
• another Environment's Chat in the picker.

That token also carries only the standard scopes, so Settings → Connections hides "Authorized clients". A person can't create a pairing link for T3 Desktop or mobile there. Browsers paired on 0.0.45 keep legacy scopes on 0.1.0 (no terminal, files, Git, settings or Environment browser tab holds) until they come through the Launchpad again.

Change

The Organization Admin decided on 2026-10-17 that the Environment pairs its own browser. This replaces the 2026-09-21 rule that a direct visit shows T3's pairing page and the fork stays untouched.

• The auth gate's third credential source (apps/web/src/environments/primary/auth.ts, two calls; the code is in apps/web/src/lazurio/environmentPairing.ts).
  • Without a link's or the desktop app's credential, the page asks its own origin: GET /.lazurio/chat/pairing.
  • The Lazurio gateway forwards that to the Environment's Launchpad after admission (the Lazurio account sign-in).
  • The credential is exchanged like any bootstrap credential, before any route runs. A deep link keeps its place and no token appears in a URL.
  • A session with legacy scopes asks too; when that fails, it keeps its session.
  • Anything but the exact JSON answer leaves upstream's pairing page: T3's own index.html outside Lazurio or with an older Platform, a non-200, a redirect, an error, or a 5 s timeout.
  • It never asks in the desktop app or over plain HTTP.
• t3 lazurio pairing (overlay CLI).
  • It mints upstream's one-time pairing grant, the way t3 auth pairing create does, with the operator's scopes: AuthStandardClientScopes + access:read + access:write.
  • It never mints relay:write: T3 Connect would be a public way in around the gateway and the tailnet.
  • It prints the same JSON as t3 auth pairing create --json.
  • t3 lazurio capabilities gains operatorPairing: true. That is additive: Machines and the Platform check only their own keys.
• CI, tests, docs. The allowlist entry for auth.ts, contract-test pins, overlay row 19 with its runbook section, the overlay spec and the public README.

Scope and approval

Decided by the Organization Admin in the thread of #70 on 2026-10-17:

• the Environment pairs the browser;
• operator scopes, Team Environments included;
• public shared Environments keep the standard scopes, a choice the Launchpad makes;
• desktop and mobile pair through device tokens from Connections, only on tailnet Environments.

The Launchpad route is Lazurio/LazurioPlatform#486. Either side can ship first: without the route, this fork behaves as today. The Platform calls t3 lazurio pairing without --json, because this command always prints JSON and the CLI refuses unknown flags.

Verification

• node --test scripts/lazurio-release-contract.test.mjs: 34/34.
• Web: environmentPairing.test.ts 11/11 together with upstream's auth bootstrap tests, 28 in all. It covers answer parsing and refusals, request options, the timeout, the origin, the plain-HTTP and desktop guards, and the decision table through upstream's real auth gate against a fake server.
• Server: cli.test.ts 10/10.
  • Pairing output equals upstream's command with the same scopes.
  • relay:write is absent.
  • The token works once and is not legacy.
  • Capabilities output is byte for byte.
• Web and server typecheck pass, and fmt and lint are clean on the changed files.
• Not yet in a browser. That needs the Platform route (Settings UI 'Codex binary path' has no effect pingdotgg/t3code#486) and a preview from main. It is checked on Ring 0 with both, before the stable.

Model and harness: Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

Note

Add Environment-owned browser pairing to Lazurio web authentication

• Direct HTTPS visits with no session now fetch a one-time pairing credential from the page's own Environment origin and exchange it without navigation; URL and desktop credentials keep precedence in auth.ts
• Sessions with legacy scopes automatically re-pair with the Environment; if re-pairing fails, the existing session is kept
• Adds t3 lazurio pairing CLI command in cli.ts that issues operator-scoped credentials (client scopes plus access-read/write, no relay-write or admin) with upstream-compatible JSON output; capabilities now reports the operator-pairing capability
• Pairing requests are strict: same-origin only, reject redirects, JSON content-type check, 5-second abort timeout, exact response-shape validation in environmentPairing.ts
• Adds unit, contract, and release-contract tests covering pairing flow, CLI output, and static seams; documents the overlay spec and release runbook
• Risk: behavioral change — the web auth gate in auth.ts is now an upstream-modified file (allowlisted in lazurio-fork-ci.yml); legacy sessions make a new pairing request on load, and failure to re-pair silently retains the old session

^{Macroscope summarized 1b6dd39.}

[agentrozjedemeai]

@immakermatty Exact-head QA: APPROVED for 6cb80ae. I traced the web bootstrap and legacy-session re-pairing, strict same-origin response validation, one-time operator grant scopes (without relay:write), and the Platform pingdotgg#486 contract. In an isolated clone I ran the release contract (34/34), focused web/server tests (21/21), and both typechecks; the exact-head CI is green and review threads are clear. Joint browser smoke on Ring 0 remains a release qualification, not evidence claimed by this review.

[agentrozjedemeai]

@immakermatty Exact-head re-review: APPROVED for 1b6dd39 on main cd211fa. Range-diff against the previously approved head shows both patches identical after the conflict-free rebase. The combined CI allowlist retains SidebarChrome.tsx, leaves AppSidebarLayout.tsx intentionally absent/unchanged as #82 specified, and adds environments/primary/auth.ts for #84. The release contract and runbook preserve the #82 column-header/wordmark behavior and #84 browser pairing and operator scopes. Four required fork CI jobs passed on this head; both Macroscope checks were skipped. In an isolated checkout, targeted contract checks passed (4/4) and git diff --check passed. A local full contract invocation lacked installed workspace dependencies (33/34, module not found in an unrelated test); CI installed dependencies and passed its full contract check. Zero review threads; live head/base and reviewer lane rechecked immediately before this review. Browser smoke on Ring 0 remains release qualification, not evidence claimed here.