Chat: a standard pairing grants T3 Code v0.1.0's scopes only, never access management or T3 Connect writes (Lazurio/t3code#97) - #583

Why

T3 Code v0.1.1 widens the default grant of t3 auth pairing create from 13 scopes to 16: access:read, access:write and relay:write join it (pingdotgg/t3code#20432). The Launchpad mints that standard pairing for every visitor of a public Environment, and wherever T3 Code offers no operator pairing, including after a failed t3 lazurio capabilities call. Once 0.1.1 is installed, a visitor of a public Environment could manage the Environment's access and its T3 Connect.

The T3 Code fork's rebuild onto v0.1.1 records this as a gate (Lazurio/t3code#97, gate "Párování a rozsahy sezení", decided under the Organization Admin's mandate): the Platform pairs with explicit scopes, never relay:write, and on a public Environment never access:write. The change must ship before 0.1.1 reaches a public Environment.

What changes

• The standard call names its own scopes: T3 Code v0.1.0's 13 standard client scopes (standardPairingScopes), one --scope each, which replaces T3's default set. On v0.1.0 that is exactly the default, so today's Environments get the same grant as before.
• --scope exists from T3 Code v0.1.0, so the standard call first asks t3 --version. An older T3 Code (Machines still installs 0.0.45 on a new Environment) pairs as before. With no version to read, nobody is paired (t3-pairing-failed), and the page opens T3 Code's plain origin, as after any failed pairing.
• The operator pairing (t3 lazurio pairing) is unchanged: the fork keeps its scopes and never grants relay:write.
• docs/launchpad-development.md ("Chat entry") says which scopes the standard pairing grants and why.

What does not change

• Which call is chosen (operator or standard), the label, the 60-second TTL, the route GET /.lazurio/chat/pairing, lazurio chat link and their admission.

Verification

• tests/launchpad-chat.test.ts (16) and tests/chat-link-cli.test.ts (5) pass, with the version call in every standard sequence and two new tests:
  • which versions take the scopes;
  • which scopes a public Environment's pairing passes for 0.1.1, 0.1.0 and the 0.1.0 preview, none for 0.0.45, and no pairing call for an unreadable, failed or timed-out version.
• Mutation checks: dropping the --scope flags fails 3 tests, and a version gate that always says yes fails 2.
• bun run lint, bun run typecheck and bun run check:public pass. The full bun test suite passes locally: 4517 pass, 9 skip, 0 fail across 308 files.
• Not yet verified on an Environment. It goes out with the next Platform release candidate, where Ring 0 checks that Chat pairs as Bob on admin-01 and as a visitor on the public try-01.

Rollout and risks

• This must be in the released Platform on every public Environment before T3 Code 0.1.1-lazurio.1 reaches it. Until then nothing changes, because every Environment runs T3 Code 0.1.0.
• A standard pairing makes one more short call (t3 --version).
• If t3 --version cannot be read, the standard pairing stops (fail-closed) instead of granting T3's default.

🤖 Generated with Claude Code