fix(server): isolate remote web session cookies

[leoisadev1]

Problem

Remote akeru serve instances on the same hostname all used t3_session. Browsers do not scope cookies by port, so one server could overwrite another server session.

Fix

Remote production web cookies now use the persisted environment ID. The name survives state-directory moves and stays distinct for separate environments that share the same host.

Valid legacy t3_session cookies still migrate, but only when the legacy cookie authenticated the request. Current cookies and Bearer tokens take precedence.

Environment identity persistence is separate from the full server descriptor. akeru auth and akeru pair can load the saved ID without checking launcher IPC. The running server still performs launcher checks for launcher-dependent capabilities.

Desktop and development cookie behavior stays unchanged.

Adaptation

Reviewed port of pingdotgg/t3code#8085. Akeru has no hosted account path, so remote production no longer keeps a shared cookie name. DPoP credential selection was not added; Akeru's request auth remains cookie, bearer, then legacy cookie.

Scope

This PR is only remote cookie isolation and environment-identity persistence. SSH runner ownership, LAN vs Tailscale pairing, Zed remote open, media assets, and preview recordings are separate PRs.

Verification

• vp test run on utils, EnvironmentAuthPolicy, SessionStore, EnvironmentAuth, EnvironmentAuthAdmin, ServerEnvironment, server, bin, and pair tests: 171 passed.
• vp run --filter akeru-bot typecheck exited 0.
• Targeted lint on the changed files reported no new errors.

This is a server cookie and identity change. No live bot/group UI surface changed. Two-environment browser pairing remains for later remote-connection PRs.

Limitations

• Windows native cookie behavior was not exercised here.
• Hosted relay / DPoP / push services were not ported.

Implemented with Grok 4.6 High in Grok Build via Orca.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
akeru-bot-landing	Building	Preview	Sep 10, 2026 5:27pm UTC

[greptile-apps]

Greptile Summary

This PR isolates remote production browser sessions by deriving cookie names from a persisted environment identity while retaining authenticated migration from the former shared cookie.

• Separates lightweight environment identity loading from launcher-dependent environment descriptor construction.
• Preserves existing desktop and development cookie naming behavior.
• Gives current cookies and bearer tokens precedence over legacy cookies.
• Adds coverage for concurrency, persistence, credential precedence, migration, and server integration.

Confidence Score: 5/5

No confirmed issues require changes before merging.

There are no outstanding prior findings, confirmed new behavioral issues, or repository-rule violations.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/remote-sess..." | Re-trigger Greptile}