fix(client-runtime): typecheck device hub ticket request on main

[juliusmarminge]

Main's Check job fails typecheck in `packages/client-runtime` (run). #10677 and #11029 merged back-to-back with no textual conflict, but #11029 changed `executeAuthenticatedEnvironmentHttpRequest` to require a `group` and hand the callback a group-scoped client, while #10677's new `deviceHubAccess.ts` still called the full-API client (`client.auth.webSocketTicket`).

Pass `group: "auth"` and call `client.webSocketTicket` on the group client, matching the other callers. Typecheck for client-runtime, web, and mobile passes locally.

Claude Fable 5 via Claude Code in T3 Code.

🤖 Generated with Claude Code

---

Summary by CodeRabbit

• Bug Fixes
  • WebSocket connections now request tickets with the correct authentication group, improving access reliability.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This small fix selects the correct auth-group client for the existing device-hub websocket-ticket request, while leaving cookie-session behavior unchanged. Because the modified path handles authentication credentials and ticket issuance, it warrants focused human review despite its limited scope.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 67897329-7b8e-4965-88c7-af79f75bea9d

📥 Commits

Reviewing files that changed from the base of the PR and between e1c94f7 and 0975377.

📒 Files selected for processing (1)

• packages/client-runtime/src/state/deviceHubAccess.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The authenticated WebSocket ticket request now uses client.webSocketTicket and includes the "auth" group. The method, endpoint, timeout, and headers remain unchanged.

Changes

WebSocket ticket request

Layer / File(s)	Summary
Update authenticated ticket request packages/client-runtime/src/state/deviceHubAccess.ts	The request adds the "auth" group and switches from client.auth.webSocketTicket to client.webSocketTicket. Other request parameters remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 09753

The WebSocket ticket request uses the correct scoped API and auth group, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the typecheck failure, the cause, the code change, and the local validation results. It does not use the template headings or include the checklist, but the required t…
Title check	✅ Passed	The title is concise and accurately identifies the client-runtime typecheck fix for the device hub ticket request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/device-hub-ticket-group-client

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+43 B (+0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+45 B (+0.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+88 B (+0.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.5 KiB	−12 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−14 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 7bd7f99 · PR result: 0975377 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.