fix(auth): keep pairing credentials out of access read models

[t3dotgg]

Access views currently return pairing credentials. Return metadata only from HTTP lists, WebSocket snapshots, and live updates. Keep the credential in the authorized creation response.

Settings keeps newly created credentials in memory so the creating client can still share them. Existing links remain visible and can be revoked. Leaving or reloading Connections requires a new link to share.

Validation: 54 focused tests pass, including raw HTTP and WebSocket checks and one-time pairing. Server, web, desktop, mobile, contracts, and client-runtime typechecks pass. Targeted lint has only existing warnings. Verified creation, Copy code, and metadata-only links in an isolated browser with synthetic data.

Before: the existing link still has Copy code after a reload.

After: the existing link shows metadata and Revoke. A link created on this page still has Copy code.

Thanks to @Sefyu64 on X for reporting this issue.

Created with GPT-6 Astra (preview) in Codex.

---

Note

High Risk
This changes auth contract and API payloads for pairing links; clients must not rely on credentials from lists or streams, and the web UX behavior for existing links changes materially.

Overview
Stops leaking pairing secrets through access read paths. AuthPairingLink and server list/stream payloads are metadata only (id, scopes, label, timestamps); the raw token still comes back from the authorized create pairing response.

Server:PairingGrantStore omits credential from listActive, upsert events, and downstream HTTP/WebSocket access views. Tests cover admin lists, CLI formatting, bearer access:read on /api/auth/pairing-links, raw response bodies, WebSocket snapshots/updates, and one-time token exchange behavior.

Web: Connections keeps a per-session in-memory map of credentials for links this client just created so copy/QR still works; listed links without a stored credential show metadata and prompt creating a new link to share.

Docs: Internal and user remote-access docs describe metadata-only lists and ephemeral shareability on the creating client.

^{Reviewed by Cursor Bugbot for commit 3b960dd. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Remove credentials from pairing-link read models in PairingGrantStore

• PairingGrantStore.listActive and pairing-link upsert events no longer include the raw credential; only creation (AuthPairingCredentialResult) returns it
• The AuthPairingLink schema in auth.ts drops the required credential field, and auth.ts stops copying credentials into client-side listing records
• The web Connections page (ConnectionsSettings.tsx) retains newly created credentials in memory so those links stay shareable during the page lifetime; existing rows without a retained credential show metadata only and direct the user to create a new link
• Risk: PairingLinkListRow rows without an in-memory credential can no longer show share URLs, QR codes, or copy-code controls; reloads of the Connections page lose access to previously created credentials

^{Macroscope summarized 3b960dd.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+20 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−6 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+26 B (+0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−27 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	0 B (0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−27 B (−0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.9 KiB	57.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 9c9ae3d · PR result: 3b960dd · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes authentication contracts and production HTTP/WebSocket access models so pairing credentials are returned only at creation time, while the web client changes how existing links can be shared. Because the affected code handles authentication credentials and security-sensitive access behavior, the change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}