fix(pairing): backport upstream mobile pairing and tailscale endpoint fixes

.agents/skills/test-t3-mobile/SKILL.md

@@ -66,7 +66,7 @@ Use these client origins:
 - Android Emulator: `http://10.0.2.2:<server-port>`
 - Physical device: bind the backend to `0.0.0.0` and use the host's reachable LAN origin
 
-Always enter the complete `http://` origin; the mobile host field otherwise assumes HTTPS. When testing web and mobile together, run `vp run dev --home-dir <base-dir> --host 127.0.0.1` instead and do not launch a second backend over the same base directory.
+Enter the complete `http://` origin to make the test transport explicit. Bare IP addresses default to HTTP, while bare hostnames default to HTTPS. When testing web and mobile together, run `vp run dev --home-dir <base-dir> --host 127.0.0.1` instead and do not launch a second backend over the same base directory.
 
 ## Start or reuse Metro safely
 

apps/desktop/src/backend/DesktopServerExposure.test.ts

@@ -324,6 +324,84 @@ describe("DesktopServerExposure", () => {
     ),
   );
 
+  it.effect("re-resolves the advertised LAN host after the machine changes networks", () => {
+    // `read` hands back this same object every call, so reassigning `en0` models the
+    // machine roaming to another network while the app stays open.
+    const roamingNetworkInterfaces: Record<
+      string,
+      DesktopNetworkInterfaces.DesktopNetworkInterfaceInfo[]
+    > = {
+      en0: [{ address: "192.168.2.37", family: "IPv4", internal: false }],
+    };
+
+    return withHarness(
+      roamingNetworkInterfaces,
+      Effect.gen(function* () {
+        const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+        yield* serverExposure.configureFromSettings({ port: 3773 });
+        const change = yield* serverExposure.setMode("network-accessible");
+        assert.equal(change.state.endpointUrl, "http://192.168.2.37:3773");
+
+        roamingNetworkInterfaces.en0 = [
+          { address: "192.168.1.21", family: "IPv4", internal: false },
+        ];
+
+        const state = yield* serverExposure.getState;
+        assert.equal(state.mode, "network-accessible");
+        assert.equal(state.advertisedHost, "192.168.1.21");
+        assert.equal(state.endpointUrl, "http://192.168.1.21:3773");
+
+        const endpoints = yield* serverExposure.getAdvertisedEndpoints;
+        assert.deepEqual(
+          endpoints.map((endpoint) => endpoint.httpBaseUrl),
+          ["http://127.0.0.1:3773/", "http://192.168.1.21:3773/"],
+        );
+
+        // The backend is already bound to every interface, so the new address needs
+        // no relaunch — binding and loopback URL must stay put.
+        const backendConfig = yield* serverExposure.backendConfig;
+        assert.equal(backendConfig.bindHost, "0.0.0.0");
+        assert.equal(backendConfig.httpBaseUrl.href, "http://127.0.0.1:3773/");
+      }),
+    );
+  });
+
+  it.effect("keeps a local-only fallback unadvertised when a LAN address appears later", () => {
+    const lateNetworkInterfaces: Record<
+      string,
+      DesktopNetworkInterfaces.DesktopNetworkInterfaceInfo[]
+    > = {};
+
+    return withHarness(
+      lateNetworkInterfaces,
+      Effect.gen(function* () {
+        const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+        const settings = yield* DesktopAppSettings.DesktopAppSettings;
+
+        yield* settings.setServerExposureMode("network-accessible");
+        const state = yield* serverExposure.configureFromSettings({ port: 3773 });
+        assert.equal(state.mode, "local-only");
+
+        lateNetworkInterfaces.en0 = [{ address: "192.168.1.21", family: "IPv4", internal: false }];
+
+        // The fallback bound loopback only, so advertising the address that showed up
+        // afterwards would point clients at a socket this process never listens on.
+        const refreshed = yield* serverExposure.getState;
+        assert.equal(refreshed.mode, "local-only");
+        assert.equal(refreshed.advertisedHost, null);
+        assert.equal(refreshed.endpointUrl, null);
+
+        const endpoints = yield* serverExposure.getAdvertisedEndpoints;
+        assert.deepEqual(
+          endpoints.map((endpoint) => endpoint.httpBaseUrl),
+          ["http://127.0.0.1:3773/"],
+        );
+      }),
+      {},
+      dieOnSpawnLayer(),
+    );
+  });
+
   it.effect("does not spawn the tailscale CLI while server exposure is local-only", () =>
     withHarness(
       lanNetworkInterfaces,

apps/desktop/src/backend/DesktopServerExposure.ts

@@ -399,6 +399,44 @@ function resolveRuntimeState(input: {
   };
 }
 
+/**
+ * Recompute the advertised LAN host from the current interfaces.
+ *
+ * The LAN address is resolved once while starting up, but laptops move between
+ * networks (and DHCP leases rotate) while the app stays open for days. The
+ * backend is bound to `0.0.0.0`, so the new address already serves traffic —
+ * only the advertised host goes stale, and a stale host sends pairing links and
+ * QR codes to an IP nobody answers on. Rebinding is never needed here, so this
+ * refresh deliberately leaves `bindHost`/`localHttpUrl`/`port` untouched.
+ */
+const withRefreshedAdvertisedHost = (input: {
+  readonly state: RuntimeState;
+  readonly networkInterfaces: DesktopNetworkInterfaces.NetworkInterfaces;
+  readonly advertisedHostOverride: Option.Option<string>;
+}): RuntimeState => {
+  // Only network-accessible runs bind the LAN interface; a local-only run (including
+  // one that fell back for want of an address) has nothing reachable to advertise.
+  if (input.state.mode !== "network-accessible") {
+    return input.state;
+  }
+
+  const advertisedHost = resolveLanAdvertisedHost(
+    input.networkInterfaces,
+    Option.getOrUndefined(input.advertisedHostOverride),
+  );
+  if (advertisedHost === Option.getOrNull(input.state.advertisedHost)) {
+    return input.state;
+  }
+
+  return {
+    ...input.state,
+    endpointUrl: Option.fromNullishOr(
+      advertisedHost === null ? null : `http://${advertisedHost}:${input.state.port}`,
+    ),
+    advertisedHost: Option.fromNullishOr(advertisedHost),
+  };
+};
+
 const requiresBackendRelaunch = (previous: RuntimeState, next: RuntimeState): boolean =>
   previous.port !== next.port ||
   previous.bindHost !== next.bindHost ||
@@ -426,7 +464,18 @@ export const make = Effect.gen(function* () {
 
   const readNetworkInterfaces = networkInterfaces.read;
 
-  const getState = Ref.get(stateRef).pipe(Effect.map(toContractState));
+  const refreshAdvertisedHost = Effect.gen(function* () {
+    const currentNetworkInterfaces = yield* readNetworkInterfaces;
+    return yield* Ref.updateAndGet(stateRef, (state) =>
+      withRefreshedAdvertisedHost({
+        state,
+        networkInterfaces: currentNetworkInterfaces,
+        advertisedHostOverride: config.desktopLanHostOverride,
+      }),
+    );
+  });
+
+  const getState = refreshAdvertisedHost.pipe(Effect.map(toContractState));
   const backendConfig = Ref.get(stateRef).pipe(Effect.map(toBackendConfig));
 
   const configureFromSettings = Effect.fn("desktop.serverExposure.configureFromSettings")(
@@ -522,8 +571,14 @@ export const make = Effect.gen(function* () {
   );
 
   const getAdvertisedEndpoints = Effect.gen(function* () {
-    const state = yield* Ref.get(stateRef);
     const currentNetworkInterfaces = yield* readNetworkInterfaces;
+    const state = yield* Ref.updateAndGet(stateRef, (current) =>
+      withRefreshedAdvertisedHost({
+        state: current,
+        networkInterfaces: currentNetworkInterfaces,
+        advertisedHostOverride: config.desktopLanHostOverride,
+      }),
+    );
     const coreEndpoints = resolveDesktopCoreAdvertisedEndpoints({
       port: state.port,
       exposure: toResolvedExposure(state),

apps/desktop/src/settings/DesktopClientSettings.test.ts

@@ -18,6 +18,7 @@ const clientSettings: ClientSettings = {
   confirmThreadDelete: false,
   dismissedProviderUpdateNotificationKeys: [],
   diffIgnoreWhitespace: true,
+  diffTheme: "pierre-dark",
   environmentIdentificationMode: "artwork",
   favorites: [],
   glassOpacity: 80,
@@ -32,6 +33,7 @@ const clientSettings: ClientSettings = {
   sidebarThreadPreviewCount: 6,
   sidebarV2Enabled: false,
   sidebarV2ConfiguredByUser: false,
+  sidebarV2GroupByProject: false,
   timestampFormat: "24-hour",
   wordWrap: true,
 };

apps/mobile/src/features/archive/archivedThreadList.test.ts

@@ -14,6 +14,9 @@ function makeProject(
     workspaceRoot: `/workspaces/${input.id}`,
     repositoryIdentity: null,
     defaultModelSelection: null,
+    gitHubAccount: null,
+    worktreeBranchPrefix: null,
+    defaultWorktreeBranch: null,
     scripts: [],
     createdAt: "2026-06-01T00:00:00.000Z",
     updatedAt: "2026-06-01T00:00:00.000Z",

apps/mobile/src/features/connection/ConnectionsNewRouteScreen.tsx

@@ -3,7 +3,7 @@ import { NativeHeaderToolbar, NativeStackScreenOptions } from "../../native/Stac
 import { StackActions, useNavigation, type StaticScreenProps } from "@react-navigation/native";
 import { AsyncResult } from "effect/unstable/reactivity";
 import { useCallback, useEffect, useState } from "react";
-import { Alert, Platform, ScrollView, View } from "react-native";
+import { Alert, Linking, Platform, ScrollView, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { useThemeColor } from "../../lib/useThemeColor";
 
@@ -76,9 +76,21 @@ export function ConnectionsNewRouteScreen({
       return;
     }
 
+    if (permission.canAskAgain) {
+      Alert.alert(
+        "Camera access needed",
+        "Allow camera access to scan an environment pairing QR code.",
+      );
+      return;
+    }
+
     Alert.alert(
       "Camera access needed",
-      "Allow camera access to scan an environment pairing QR code.",
+      "Camera access was denied for this app. Open Settings to enable it.",
+      [
+        { text: "Cancel", style: "cancel" },
+        { text: "Open Settings", onPress: () => void Linking.openSettings() },
+      ],
     );
   }, [cameraPermission?.granted, requestCameraPermission]);
 

apps/mobile/src/features/connection/environmentSections.test.ts

@@ -2,7 +2,7 @@ import { EnvironmentId } from "@t3tools/contracts";
 import type { RelayClientEnvironmentRecord } from "@t3tools/contracts/relay";
 import { describe, expect, it } from "vite-plus/test";
 import type { ConnectedEnvironmentSummary } from "../../state/remote-runtime-types";
-import { splitEnvironmentSections } from "./environmentSections";
+import { relayManagedEnvironmentIds, splitEnvironmentSections } from "./environmentSections";
 
 function connectedEnvironment(
   input: Omit<Partial<ConnectedEnvironmentSummary>, "environmentId"> & {
@@ -34,6 +34,17 @@ function cloudEnvironment(environmentId: string): RelayClientEnvironmentRecord {
   };
 }
 
+describe("relayManagedEnvironmentIds", () => {
+  it("leaves out a backend that was saved directly", () => {
+    const ids = relayManagedEnvironmentIds([
+      connectedEnvironment({ environmentId: "environment-local", isRelayManaged: false }),
+      connectedEnvironment({ environmentId: "environment-cloud", isRelayManaged: true }),
+    ]);
+
+    expect([...ids]).toEqual([EnvironmentId.make("environment-cloud")]);
+  });
+});
+
 describe("mobile environment settings sections", () => {
   it("keeps saved relay-managed connections under T3 Connect", () => {
     const local = connectedEnvironment({
@@ -111,6 +122,24 @@ describe("mobile environment settings sections", () => {
     expect(sections.availableCloudEnvironments).toEqual([]);
   });
 
+  it("still offers a cloud environment saved directly as a local backend", () => {
+    const local = connectedEnvironment({
+      environmentId: "environment-cloud",
+      isRelayManaged: false,
+    });
+
+    const sections = splitEnvironmentSections({
+      connectedEnvironments: [local],
+      cloudEnvironments: [cloudEnvironment("environment-cloud")],
+    });
+
+    expect(sections.localEnvironments).toEqual([local]);
+    expect(sections.connectedCloudEnvironments).toEqual([]);
+    expect(
+      sections.availableCloudEnvironments.map((environment) => environment.environmentId),
+    ).toEqual([EnvironmentId.make("environment-cloud")]);
+  });
+
   it("keeps failed relay environments in the local connection row", () => {
     const cloud = connectedEnvironment({
       environmentId: "environment-cloud",

apps/mobile/src/features/connection/environmentSections.ts

@@ -1,3 +1,4 @@
+import type { EnvironmentId } from "@t3tools/contracts";
 import type { RelayClientEnvironmentRecord } from "@t3tools/contracts/relay";
 import type { ConnectedEnvironmentSummary } from "../../state/remote-runtime-types";
 
@@ -12,10 +13,25 @@ export interface EnvironmentSections {
   readonly availableCloudEnvironments: ReadonlyArray<RelayClientEnvironmentRecord>;
 }
 
-export function splitEnvironmentSections(input: EnvironmentSectionsInput): EnvironmentSections {
-  const savedEnvironmentIds = new Set(
-    input.connectedEnvironments.map((environment) => environment.environmentId),
+/**
+ * Ids of the environments that already occupy a T3 Connect slot. A backend saved directly is
+ * not one of them, so it must not suppress the cloud environment that happens to share its id.
+ */
+export function relayManagedEnvironmentIds(
+  environments: ReadonlyArray<{
+    readonly environmentId: EnvironmentId;
+    readonly isRelayManaged: boolean;
+  }>,
+): ReadonlySet<EnvironmentId> {
+  return new Set(
+    environments
+      .filter((environment) => environment.isRelayManaged)
+      .map((environment) => environment.environmentId),
   );
+}
+
+export function splitEnvironmentSections(input: EnvironmentSectionsInput): EnvironmentSections {
+  const savedEnvironmentIds = relayManagedEnvironmentIds(input.connectedEnvironments);
 
   return {
     localEnvironments: input.connectedEnvironments.filter(

apps/mobile/src/features/connection/pairing.test.ts

@@ -1,11 +1,32 @@
 import { describe, expect, it } from "vite-plus/test";
 
 import {
+  buildPairingUrl,
   extractPairingUrlFromQrPayload,
   PairingQrPayloadEmptyError,
   parsePairingUrl,
 } from "./pairing";
 
+describe("buildPairingUrl", () => {
+  it("uses HTTP for a schemeless IP address", () => {
+    expect(buildPairingUrl("192.168.1.100:3773", "pairing-token")).toBe(
+      "http://192.168.1.100:3773/#token=pairing-token",
+    );
+  });
+
+  it("keeps HTTPS as the default for a schemeless hostname", () => {
+    expect(buildPairingUrl("remote.example.com", "pairing-token")).toBe(
+      "https://remote.example.com/#token=pairing-token",
+    );
+  });
+
+  it("preserves an explicit scheme for an IP address", () => {
+    expect(buildPairingUrl("https://192.168.1.100:3773", "pairing-token")).toBe(
+      "https://192.168.1.100:3773/#token=pairing-token",
+    );
+  });
+});
+
 describe("extractPairingUrlFromQrPayload", () => {
   it("trims raw pairing urls from qr payloads", () => {
     expect(

apps/mobile/src/features/connection/pairing.ts

@@ -3,6 +3,21 @@ import * as Schema from "effect/Schema";
 
 const MOBILE_PAIRING_URL_PARAM = "pairingUrl";
 
+function isIpLiteral(host: string): boolean {
+  try {
+    const hostname = new URL(`http://${host}`).hostname.replace(/^\[|\]$/g, "");
+    if (hostname.includes(":")) return true;
+
+    const octets = hostname.split(".");
+    return (
+      octets.length === 4 &&
+      octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255)
+    );
+  } catch {
+    return false;
+  }
+}
+
 export class PairingQrPayloadEmptyError extends Schema.TaggedErrorClass<PairingQrPayloadEmptyError>()(
   "PairingQrPayloadEmptyError",
   {},
@@ -19,7 +34,7 @@ export function buildPairingUrl(host: string, code: string): string {
   if (!c) return h;
 
   try {
-    const url = new URL(h.includes("://") ? h : `https://${h}`);
+    const url = new URL(h.includes("://") ? h : `${isIpLiteral(h) ? "http" : "https"}://${h}`);
     url.hash = new URLSearchParams([["token", c]]).toString();
     return url.toString();
   } catch {

apps/mobile/src/features/connection/useConnectionController.ts

@@ -20,6 +20,7 @@ import { useEnvironments } from "../../state/environments";
 import { relayEnvironmentDiscovery } from "../../state/relay";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { projectWorkspaceEnvironment, type WorkspaceEnvironment } from "../../state/workspaceModel";
+import { relayManagedEnvironmentIds } from "./environmentSections";
 
 export interface RelayEnvironmentView {
   readonly environment: RelayClientEnvironmentRecord;
@@ -49,7 +50,7 @@ export function useConnectionController() {
     [environments],
   );
   const registeredIds = useMemo(
-    () => new Set(connectedEnvironments.map((environment) => environment.environmentId)),
+    () => relayManagedEnvironmentIds(connectedEnvironments),
     [connectedEnvironments],
   );
   const relayEnvironments = useMemo<ReadonlyArray<RelayEnvironmentView>>(