[only21mil]

Problem

Web and mobile each carry their own byte-identical copy of sessionHasScope, the check that decides whether an environment's session grants a scope. A future change to what counts as granted would have to land twice, and the two clients could drift apart.

Change

The predicate now lives once in @t3tools/client-runtime/state/session, next to createEnvironmentSessionAtoms, which builds the session state it reads. apps/web/src/state/session.ts and apps/mobile/src/state/session.ts import it for their hooks and re-export it, so existing callers and the tests that stub ./session stay as they are. The body is unchanged: a failed or missing session is never granted, and any other result defers to sessionGrantsScope.

The mobile session test mocked the whole client-runtime session module, so it now spreads the real module (as assets.test.ts does) to keep the shared predicate.

No selector, hook, denial path or auth policy changes, so nothing a screen shows changes and there are no screenshots.

Scope and approval

This is a behavior-preserving cleanup with no new behavior or defaults, so it needs no prior issue or discussion. Maintainers, please confirm you want the predicate shared here rather than kept per client.

Verification

• The new shared body is byte-identical to both removed copies (same sha256).
• A scratch script, not committed, compared the original body with the new export over 10 session states and 4 scopes (40 cases): initial, initial while waiting, missing session, granted, denied, legacy scopes, unauthenticated, failure, failure with a stale granted value, and success while refreshing. All 40 matched; failure with stale data stays not granted.
• vp run check:changed 3fd2b855c5: format, lint, knip, typecheck (7 packages), tests and React compiler all pass.
• vp test run on the 20 web, mobile and client-runtime unit test files that import or mock these session modules: 207 passed.
• vp test run on fileSaveSessions, ThreadTerminalDrawer and ChatMarkdown.permissions browser tests: 7 passed.

Not checked: the other web browser test files that reach these modules, which CI runs, and a manual pass in each client, since no rendered output changes.

Prior PRs

No earlier PR made this change. Two open PRs sit next to it:

• fix(mobile): stop showing "cannot control this task" while permissions load or after a network blip #28708 by torztomasz adds sessionDeniesScope to the same client-runtime module and edits the same import blocks. The two changes are independent, and whichever lands second needs a small import-block rebase.
• fix(client): a resume no longer re-renders every home row five times #27404 by ahalekelly changes the useEnvironmentScope hook bodies, not the predicate.

Generated with Claude Opus 5.5 and GPT-6.1 Terra and GPT-6.1 Sol in T3 Code Nightly

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 3fd2b85
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: db2c7687-3ea2-4af0-b6b9-690737485dea

Commits

Reviewing files that changed from the base of the PR and between 3fd2b85 and bf10908.

Files selected for processing: 4

• apps/mobile/src/state/session.test.ts
• apps/mobile/src/state/session.ts
• apps/web/src/state/session.ts
• packages/client-runtime/src/state/session.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Walkthrough

The client runtime now exports sessionHasScope. The web and mobile session modules re-export this shared helper instead of defining local implementations. The mobile session test mock retains the original module exports.

Changes: Session scope predicate

Layer / File(s)	Summary
Client runtime predicate packages/client-runtime/src/state/session.ts	The client runtime exports sessionHasScope. It returns false for failed results or missing sessions, and otherwise delegates the scope check to sessionGrantsScope.
Web and mobile exports apps/web/src/state/session.ts, apps/mobile/src/state/session.ts, apps/mobile/src/state/session.test.ts	The web and mobile modules re-export the client runtime helper. The mobile test mock retains the original module exports.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Possibly related PRs

• pingdotgg/t3code#24445: Both PRs change the implementation of sessionHasScope across the web, mobile, and client runtime modules.
• pingdotgg/t3code#25678: This PR makes the mobile predicate public; the current PR preserves its export through the shared implementation.
• pingdotgg/t3code#26205: Both PRs concern the mobile sessionHasScope predicate and its boolean API.

Suggested reviewers: juliusmarminge

Merge Risk: Minimal · up to bf109

The refactor has no identified merge-blocking correctness or test-workflow risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: sharing one session scope check between web and mobile.
Description check		The description includes all required sections. It explains the problem, the implementation, scope and approval rationale, verification results, and untested areas.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts