# Test takeover result

Target: [#18417](https://github.com/pingdotgg/t3code/pull/18417), head repository [saphid/t3code](https://github.com/saphid/t3code), branch `t3code/sweep/pairing-code-scope-check`, original head [5f7e8b8799](https://github.com/saphid/t3code/commit/5f7e8b8799355359348a259255963b062b831e76), base `main`. Cached metadata says maintainer edits are allowed.

Work was confined to `/home/ubuntu/wt/ssh-relay-remote-05`, branch `batch05/pairing-code-scope-check`, initial local merge commit `a63b4d742e0415f11c848d755ee0f305a09f18bb`. Main used for regression proof: [2bae2b14df](https://github.com/pingdotgg/t3code/commit/2bae2b14dfa9382b178c76183c2604339522c5c8).

Spec: reject insufficient MCP scopes without spending the pairing code; permit a lower-access retry exactly once, including concurrent retries; preserve OAuth requested-scope overlap/intersection behavior. The existing service/store/SQL architecture supports this behavior. This run performed step 1 only; no implementation rewrite, commits, pushes, GitHub API/CLI calls, browser/server launches, or delegation. T3 thread metadata was linked to the target PR as required by the harness.

## Changes and counts

| Existing suite | Before | After | Change |
| --- | ---: | ---: | --- |
| `apps/server/src/auth/EnvironmentAuth.test.ts` | 27 | 22 | Replace five scope permutations and the separate eight-way MCP race with one rejection followed by two concurrent read-only retries. Require one success and one `unknown_or_used` failure. |
| `apps/server/src/auth/PairingGrantStore.test.ts` | 10 | 10 | Unchanged; already proves atomic consumption, single use, and scope rejection preservation. |
| `apps/server/src/auth/McpOAuth.test.ts` | 8 | 8 | Retain the existing route test using the rejected read-only code for a successful retry, token exchange, and MCP authentication. Remove repeated full-access rejection and operator retry additions. |
| Total | 45 | 40 | PR-added test cases: 6 → 1; one existing HTTP case remains strengthened. |

Existing EnvironmentAuth tests continue to cover OAuth rejection without overlap and successful intersection when requested scopes contain both supported and unsupported permissions. There is no `AuthPairingLinks.test.ts` suite in this checkout. Its real SQLite implementation is exercised through the EnvironmentAuth and PairingGrantStore test layers; no one-off repository suite was added.

The retained concurrency check uses two executions of the same Effect with unbounded concurrency, without sleeps or polling. The existing store-level eight-way test is untouched. Test diff relative to main: EnvironmentAuth +29 lines; McpOAuth +1/−2 lines.

## Verification

All commands ran from `/home/ubuntu/wt/ssh-relay-remote-05` after:

```sh
export PATH="$HOME/.local/bin:$PATH"
```

Baseline before edits:

```sh
pnpm exec vp test run apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/McpOAuth.test.ts
```

Result: 3 suites, 45 tests passed. Log: `/tmp/ssh-relay-remote-05/18417-tests-before.log`. The first invocation automatically installed checkout dependencies; tracked configuration and lockfiles remained unchanged.

After reduction, and again after restoring production snapshots:

```sh
pnpm exec vp test run apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/McpOAuth.test.ts --reporter=verbose
```

First green: 3 suites, 40 tests passed. Log: `/tmp/ssh-relay-remote-05/18417-tests-green.log`.

Final green after restoring production: **3 suites, 40 tests passed**, exit 0. Log: `/tmp/ssh-relay-remote-05/18417-tests-restored-green.log`.

Red proof used byte snapshots saved under `/tmp/ssh-relay-remote-05/18417-snapshots/`, with SHA-256 values in `manifest.json`. A Python `try/finally` temporarily replaced exactly these production files using `git show 2bae2b14dfa9382b178c76183c2604339522c5c8:<file>`:

- `apps/server/src/auth/EnvironmentAuth.ts`
- `apps/server/src/auth/PairingGrantStore.ts`
- `apps/server/src/persistence/AuthPairingLinks.ts`

The same focused verbose test command exited 1: **38 passed, 2 failed**. The new EnvironmentAuth regression failed because neither lower-access retry succeeded (expected one success, received zero). The McpOAuth route regression failed because the lower-access retry returned HTTP 400 instead of 200. All unchanged OAuth overlap/intersection tests and PairingGrantStore tests passed. Log: `/tmp/ssh-relay-remote-05/18417-tests-red-main.log`.

The `finally` block restored all three production files from snapshots and asserted matching SHA-256 hashes. A separate hash check also passed. No production edits remain.

Static verification:

```sh
pnpm exec vp lint apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/McpOAuth.test.ts
pnpm exec vp fmt --check apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/McpOAuth.test.ts
pnpm --dir apps/server exec tsc-rs --noEmit
git diff --check
```

Lint, final formatting check, server typecheck, and diff whitespace check passed. The initial formatting check flagged wrapping of the test title; `pnpm exec vp fmt apps/server/src/auth/EnvironmentAuth.test.ts` corrected it. Typecheck exited 0 with existing Effect suggestions elsewhere, no errors. Logs: `/tmp/ssh-relay-remote-05/18417-tests-lint.log` and `/tmp/ssh-relay-remote-05/18417-tests-typecheck.log`.

## Exact checkout files modified

- `/home/ubuntu/wt/ssh-relay-remote-05/apps/server/src/auth/EnvironmentAuth.test.ts`
- `/home/ubuntu/wt/ssh-relay-remote-05/apps/server/src/auth/McpOAuth.test.ts`

Report and test logs/snapshots are outside the checkout under `/tmp/ssh-relay-remote-05/`.