feat(vscode): pair with pairing URL - #351
Merged
Merged
Conversation
Adds a "T3 Code: Pair with Server…" command that accepts a full pairing URL (http://host:port/pair#token=…) or a bare pairing token, exchanges it for a bearer access token via the OAuth token-exchange endpoint, and stores it in SecretStorage so ensureConnected picks it up as the bearer tier. Removes the need to hand-exchange tokens with curl before using the Set Server Bearer Token command. Co-Authored-By: Claude <noreply@anthropic.com> Ported to fork/dev from the external pull request #237, which was opened against the now-frozen fork/vscode overlay branch from a fork this repository cannot push to. Authorship is preserved on the commit; the trailer below keeps the credit attached through a squash merge, which is the only merge method fork/dev allows. Co-authored-by: bulgadev <me@bulgaaw.com> Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>
Review of #351 raised two problems with the pairing flow. The token is issued by the server named in the pairing URL, but the flow then called ensureConnected(), which walks the desktop and configured candidates and offers the bearer to each in turn. Pairing with server B therefore disclosed B's token to server A, whichever A happened to be first. Bearer tokens are now pinned to the endpoint that issued them. bearerTokenAppliesTo() gates every use, and the paired endpoint becomes the first connection candidate so pairing actually connects where the user pointed it. Pinning alone would have left the extension connecting to A without the token, which is a quieter kind of wrong. Tokens with no recorded endpoint stay unpinned: they predate this change or were entered by hand through Set Server Bearer Token, where the user chose the destination. Set and Clear both maintain the endpoint alongside the token, so a hand-entered token cannot inherit a previous pairing's scope. The token was also written to SecretStorage before the connection was proven, so a failed pairing destroyed a working credential. Exchange, connect to the issuing endpoint and wait for the shell first; store only once that succeeds. Nothing is written on failure, so there is no previous value to restore. Co-authored-by: bulgadev <me@bulgaaw.com> Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports #237 by
@bulgadev onto
fork/dev.The original targets the now-frozen
fork/vscodeoverlay branch and lives in a fork this repositorycannot push to, so it could not be rebased in place.
Attribution
The commit is authored by
bulgadev <me@bulgaaw.com>, not merely credited —git cherry-pickpreserved it and the amend kept it.
Co-authored-byis added on top as insurance:fork/devissquash-only, and a squash can rewrite the author while trailers survive in the body either way.
Please merge this rather than #237, and close #237 pointing here.
Content
Adds a T3 Code: Pair with Server… command accepting a full pairing URL
(
http://host:port/pair#token=…) or a bare pairing token, exchanges it for a bearer access token viathe OAuth token-exchange endpoint, and stores it in
SecretStoragesoensureConnectedpicks it upas the bearer tier. Removes the need to hand-exchange tokens with
curlbefore using Set ServerBearer Token.
Unchanged from the original — 5 files, cherry-picked cleanly onto
fork/devwith no conflicts.Validation
apps/vscodesuite: 13 files, 44 tests pass.Note on the other external PR
#238 is not ported, because it is already fixed on
fork/devby a different route and porting it would duplicate the behaviour:ResolvedKeybindingsConfigalready uses the genericForwardCompatibleArrayhelper, whose decodekeeps only elements that decode and encodes unchanged — identical semantics to the bespoke
filterKnownResolvedKeybindingRulesthe PR introduces.fork/dev's tests are strictly broader: unknown commands, unknownwhen-node types, andmalformed entries. fix(contracts): tolerate unknown keybinding commands on client decode #238 covers only the first.
filePicker.toggledecodes away asunknown, but that command has since shipped and is known.
Recommend closing #238 as already fixed, with credit to @bulgadev for reporting the class of bug.
Co-authored by @patroza, @bulgadev
opened by Patrick Roza in chat thread Discord · Discord · T3