Pair another device from an already-paired device

[guryanov-a]

Problem

I run T3 Code on several machines and use several devices (laptop, desktop, phone). Each device has to be paired with each machine separately: run t3 pair on the machine (or use Settings → Sharing & access → Create link in the app running there) and open the link or scan the QR code on the device. With 3 machines and 3 devices that is up to 9 pairings, and every new device means going back to every machine.

A device that is already paired with a machine cannot bring in a new device, even though the server would allow it:

• The server accepts it. A pairing grant delegates a set of scopes (the permissions the new session will get). A paired session gets the standard scopes, which include access:write (packages/contracts/src/auth.ts#L150-L167), and the pairing-credential endpoint lets a session with access:write and every scope it hands over create a new pairing link (apps/server/src/auth/http.ts#L443-L460; docs/internals/environment-auth.md line 15 says the same).
• The app does not offer it. Authorized clients → Create link only manages the primary environment, meaning the desktop app's own backend or the server a browser page was loaded from (ConnectionsSettings.tsx#L167, #L287). For a saved remote environment the section is not shown, and the mobile app has no Authorized clients screen at all.
• Linked environments do not cover it. When machine A is linked to machine B, the token for B belongs to A's server, so a device paired with A can see A's links but cannot reach B through them (apps/server/src/peer/PeerLinks.ts, apps/server/src/peer/PeerForwarding.ts).

Proposal

Add a Pair another device action for any connected environment, on web, desktop and mobile, shown when the session holds access:write:

1. The device asks that environment's server for a one-time pairing code, limited to scopes the device itself holds.
2. It shows the code as a link and a QR code, together with the machine's known addresses.
3. The new device scans or opens it and gets its own session.

Each device keeps its own session, bound to its own key (DPoP: the token only works together with a key that stays on the device), so one device can still be revoked under Authorized clients without affecting the others.

Alternatives considered

• Running t3 pair on each machine and pairing each device by hand: works today, but grows with machines × devices.
• Closed PR Let clients without a managed backend manage pairing #4496 ("Let clients without a managed backend manage pairing") proposed scoping Authorized clients to the administered server. It was closed unmerged, and its approach is not on main.
• feat(tailscale): your own devices find and connect to your boxes with no pairing code #26757 (Tailscale identity, open) would let your own devices connect without a code on a tailnet. That removes pairing for Tailscale users, but not for direct, LAN or relay connections.
• Discussion make add devices from t3 code mobile to desktop easier #7029 (closed) asked for QR pairing from a desktop host, which exists. This request is about pairing from a device that is itself a remote client.

Environment

Checked against main at d01b92c by reading the code; the flow was not run.