[maria-rcks]

Problem

Requesting full MCP access with a read-only pairing code consumes the code before rejecting its scopes. Retrying the same code with read-only access then fails.

Change

Validate all required MCP scopes inside atomic credential consumption, before spending a code. Keep OAuth's requested-scope overlap and intersection unchanged, retain single-use behavior, and explain that rejected codes remain usable.

Verification

• Regression checks first failed on current main: 25 passed, 2 failed. With the fix, all 33 tests in EnvironmentAuth, PairingGrantStore, and McpOAuth pass.
• GitHub CI passed build/typecheck, lint, all eight server test shards, the aggregate check, and Macroscope correctness. Platform-inapplicable checks skipped.
• Blacksmith vp run check:changed passed format, lint, knip, server GraphQL validation, affected typechecks, and adjacent tests.
• Real Chrome approval page: full-access rejection followed by the same code's read-only retry fails on main and reaches the OAuth callback after the fix. The actual browser callback code also exchanged successfully for an orchestration:read token and initialized the running MCP endpoint (HTTP 200).
• Two independent GPT-6.1-Sol reviews found no defects. CodeRabbit could not review because its organization review budget was rate-limited.
• Macroscope correctness found no issues. Its approvability check is neutral and requires human approval because this changes authentication and credential consumption.
• Unverified: installed provider clients, desktop/mobile builds, and remote/tunnel connections. The callback page in the recording is a local receiver; its returned code was exchanged against the running server and used to initialize MCP.

Before and after use the same client, scope, viewport, and access choices with fresh one-time credentials. Recordings are slowed 2x for readability.

Takeover

Replaces #18417, with thanks to @saphid for the original implementation.

Built with GPT-6.1-Sol in the Codex harness on T3 Code.

[coderabbitai]

Warning

Review limit reached

Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: maria/takeover-pr-18417
• File: .coderabbit.config.ts
• Commit: b7a70af
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: bd1bf9f5-b591-4e31-9da3-0e3cba3ee8f0

Commits

Reviewing files that changed from the base of the PR and between 3de45c6 and b7a70af.

Files selected for processing: 5

• apps/server/src/auth/EnvironmentAuth.test.ts
• apps/server/src/auth/EnvironmentAuth.ts
• apps/server/src/auth/McpOAuth.test.ts
• apps/server/src/auth/PairingGrantStore.ts
• apps/server/src/persistence/AuthPairingLinks.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This targeted fix changes production pairing-code consumption and scope authorization behavior, including atomic one-time credential handling. Because the affected files are in authentication and credential persistence code, the change requires human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	+7 B (+0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+7 B (+0.6%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	+24 B (+0.5%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+24 B (+2.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	+41 B (+0.2%)	29.3 KiB	✅
Claude	Live turn messages	1	2	+1 (+100.0%)	8	✅

Baseline: 3de45c6 · PR result: b7a70af · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified unchanged head b7a70afb78652bc982b968f441a22177d533371c on this linux boat vm. no code changes or pushes were needed.

• reproduced on github/main (49582b7b2a) in a separate worktree after vp i: full-access rejection spends a read-only pairing code, and a same-code read-only retry fails.
• installed the exact pr head with vp i and ran the real dev server with isolated .t3 state. only one dev server ran at a time. drove /usr/bin/google-chrome with the repository's playwright dependency.
• the pr preserves the rejected code and accepts a same-code read-only retry. also verified the installed codex client's actual oauth login and loopback callback, including a read-only code created in settings → connections → create link. codex reported successful login.
• created a project through the web app pointing at a real git repository, then ran real gpt-6.1-sol turns through the composer. one read README.md with a shell tool. another used the newly authenticated pairing_verify mcp connection to list projects and attempt a mutation. the read succeeded; the mutation was rejected with capability_denied.
• pairing-code reuse and oauth authorization-code replay remain rejected. oauth requesting read and operate scopes still narrows to orchestration:read when approved read only.
• blacksmith passed all 33 existing EnvironmentAuth, PairingGrantStore, and McpOAuth tests, including concurrent lower-access retry. vp run check:changed passed format, lint, knip, graphql validation, affected typechecks, and adjacent tests against the pr comparison base. pr ci shows 21 successful checks, 7 skipped, 1 neutral, and no failures.

main: full-access rejection -> 400; same-code read-only retry -> 400 unknown/expired/used
pr: full-access rejection -> 400; same-code read-only retry -> 200 oauth callback
POST /oauth/mcp/token -> 200, scope=orchestration:read
pairing-code replay -> 400 unknown/expired/used
authorization-code replay -> 400 invalid_grant
POST /mcp initialize -> 200
t3_project_list -> pairing-verification present
t3_project_create -> capability_denied: This tool changes the environment, and this MCP client was approved for read-only access.
real codex callback -> Authentication complete. You may close this window.

before and after show the same read-only-code/full-access rejection scenario. current main has unrelated newer styling. the 7-second recording uses the real codex client, with loading frames trimmed and unchanged playback speed. secrets are masked. uploaded playback and seeking were checked.

Not verified

native ios/android, the electron shell, macos/windows, remote/relay/tunnel connections, and other provider clients were not exercised on this linux vm. runtime verification used localhost web, the actual codex oauth client, and real codex provider turns. no mocks, replay provider, or demo data were used.