[only21mil]

Problem

Web and mobile each carry the same 24-line mintPairingCodeOn wrapper (apps/web/src/state/peerPairingCode.ts and apps/mobile/src/state/peerPairingCode.ts). The two wrappers differ only in which atom registry they use, so any change to how a link pairing code is minted or how its failure reaches the caller has to be made twice and kept in step by hand.

Change

createPeerPairingCodeCommand in @t3tools/client-runtime/state/peerPairingCode becomes createPeerPairingCodeMinter(runtime, registry). It builds the same command and returns the (environmentId, access) => Promise<Result<string, unknown>> function both clients had. Each client's mintPairingCodeOn is now a single binding to its own runtime and registry, so the three callers (web and mobile LinkRequestCard, and web's linked environments settings) are untouched. Web's mintMcpApprovalCodeOn, added on main since, has no mobile copy and stays as it is.

The command label, mint timeout, scopes, error mapping and command concurrency are unchanged. The removed export had no other callers.

Scope and approval

Maintenance only, with no behavior change, so there is no issue or discussion to link. Net -13 lines across 3 files. The 15-second load-balancing freshness value repeated in apps/web and packages/client-runtime is a separate cleanup and is left out of this PR. Maintainers: please confirm a shared minter in client-runtime is the seam you want, rather than keeping a wrapper per client.

Verification

• vp run check:changed 1d626d02d9: format, lint, knip, typecheck (client-runtime, web, mobile, desktop and dependents) and react compiler all pass.
• After merging main at 0a9abddaee (merge commit 9f5a12a25c): vp run check:changed upstream/main passes (format, lint, knip, typecheck of 7 packages, react compiler). packages/client-runtime runtime.test.ts and environmentHttpAuth.test.ts (65 tests) and apps/web mcpApps.test.ts and mcpGate.test.ts (33 tests) pass.
• git grep createPeerPairingCodeCommand finds no remaining references.
• The callers' import paths and the type of mintPairingCodeOn are unchanged; the web and mobile typechecks cover them.

Not checked:

• No new test. The change moves wiring whose signature the types already guarantee, and no existing test covers this wrapper.
• No screen captures. Nothing on any screen changes: the same command runs with the same inputs and returns the same result. The before and after below are CLI output.
• I did not mint a real pairing code against a second live environment.

Before and after

Before, on main 0a9abddaee: web and mobile each define mintPairingCodeOn around createPeerPairingCodeCommand.

After, on the PR head 9f5a12a25c: both clients bind createPeerPairingCodeMinter, and the run-to-Result step lives once in client-runtime. Web's mintMcpApprovalCodeOn is unchanged. check:changed passes.

Prior PRs

No earlier PR made this change. #17129 by juliusmarminge introduced both wrappers along with the agent link flow.

Generated with Claude Opus 5.5 and GPT-6.1 Sol in T3 Code Nightly

[macroscopeapp]

Approvability

Verdict: Approved at e637a6a

Macroscope's review found this PR approvable — Consolidates the existing web and mobile pairing-code wrappers into a shared factory. Credential scopes, authenticated requests, per-call minting, and error handling remain unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The client runtime replaces the pairing-code command factory with a minter factory. The mobile and web state modules configure and export the minter. It runs the command through the supplied atom registry and returns a Result.

Changes: Pairing code minter

Layer / File(s)	Summary
Create and execute the minter packages/client-runtime/src/state/peerPairingCode.ts	createPeerPairingCodeMinter accepts a runtime and atom registry. Its returned function runs the pairing-code command and returns the code or a squashed failure as a Result.
Configure mobile and web apps/mobile/src/state/peerPairingCode.ts, apps/web/src/state/peerPairingCode.ts	Both modules export a minter configured with their connection runtime and app atom registry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Possibly related issues

• pingdotgg/t3code#30181: The issue concerns pairing codes used across environments. This PR refactors minter creation, and the reported cross-environment failure remains outside the change.

Suggested reviewers: juliusmarminge

Merge Risk: Minimal · up to 9f5a1

The pairing-code refactor appears mergeable after normal checks; no actionable behavior regression is established.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the shared pairing-code minter refactor across web and mobile.
Description check		The description includes the required Problem, Change, Scope and approval, and Verification sections. It explains the refactor, its scope, reported checks, and untested cases.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 0a9abdd
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: d324878a-750d-474a-9d29-f962da2ec9a8

Commits

Reviewing files that changed from the base of the PR and between a7355f6 and 9f5a12a.

Files selected for processing: 2

• apps/web/src/state/peerPairingCode.ts
• packages/client-runtime/src/state/peerPairingCode.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Update: merged current main

the pr conflicted with main after #31216 moved PeerPairingCodeError to Schema.TaggedError. merge commit a7355f6e8a resolves the one import conflict in packages/client-runtime/src/state/peerPairingCode.ts, keeping main's Schema error and this pr's EnvironmentId import. no other changes. vp run check:changed passed through blacksmith (format, lint, knip, 7-package typecheck, react compiler), and all ci checks are green on the new head. the earlier runtime verification below was done on e637a6a683 and was not repeated after the merge.

---

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified exact head e637a6a683d5e54eb7864713a0fc7ad3304f86d5 on linux with repository playwright and /usr/bin/google-chrome.

this is a behavior-preserving refactor, so there is no original user-visible bug to reproduce. on github/main (e925dd6819) i established the existing behavior first: enable linked environments in labs, connect a second environment, and link it through settings. automatic minting returned http 200 and the link became supervised and reachable.

on the pr, settings renewal also worked. a real codex gpt-6.1-sol turn created a link-request card. after forgetting the existing link, i selected the target and submitted a fresh supervised link through that card. the shared minter returned a fresh 12-character code, the card resolved to linked, and codex received and reported the successful outcome.

the supervised mint sent orchestration:read and orchestration:operate; read-only renewal sent only orchestration:read. both used the existing T3 Code link label. consecutive observed codes differed. forget and relink also worked. data was created through the app against a real git project; no mocks or fixtures. the isolated target ran packaged nightly 0.1.7-nightly.20261101.4048. only one development server ran at a time.

vp run check:changed 3fd2b855c5c6b9169cdfe3733b34011c1c5ed4b7 passed through blacksmith: format, lint, knip, seven-package typecheck, react compiler, and selected existing tests. no source changes or pushes were needed.

main baseline:

pr with matching settings data:

the uploaded recording was inspected, played to completion, and seeked in the t3 browser player. sanitized runtime transcript.

Not verified

native ios/android clients and electron shell were not exercised on this linux vm. relay/tunnel connections, permission-denied or unavailable mint fallback, concurrent overlapping mints, and one-use token replay rejection were not exercised. the successful web/provider path does not establish those cases.

[only21mil]

Note

🤖 Opus 5.5 replying on behalf of Victor.

Merged current main (0a9abddaee) to clear the conflict in merge commit 9f5a12a25c. Main had reworked packages/client-runtime/src/state/peerPairingCode.ts around a shared mintOnEnvironment and added the MCP approval minter. createPeerPairingCodeMinter now builds its command on main's mintOnEnvironment, with the same label, scopes and error mapping. Web's mintMcpApprovalCodeOn and createMcpApprovalCodeCommand stay exactly as on main. Nothing was dropped. vp run check:changed upstream/main passes. The description now has the new line count, a note on the MCP wrapper, and before and after CLI captures.