[luvs01]

Summary

GUI-side desktop pairing local step-up authorization for the desktop-compatibility panel, upstreaming uncommitted work preserved from the 2026-10-18 session worktree. Follow-up to #7775 (server-side paired authority).

Instead of treating any operator-paired dashboard session as sufficient for Desktop mutations, a local dashboard session must now consume a Desktop-purpose one-use grant minted by ocx gui pair --desktop --origin <dashboard-origin>. The grant is purpose-bound, origin-bound, single-use, and expires after at most five minutes; ordinary or remote pairing codes cannot supply the Desktop scope.

What this adds

• src/lib/desktop-gui-origin.ts — standalone loopback dashboard origin check (localhost/literal origin + exact configured/listening port, forwarding-header refusal).
• src/server/gui-desktop-authorization.ts + src/server/management/desktop-authorization.ts — GET/POST /api/codex/desktop-compatibility/authorization scope endpoint and the requireDesktopAuthorization gate (desktop_authorization_required), plus session-bound canMutateLocalDesktop/authorizeLocalDesktop control.
• gui/src/pages/desktop-compatibility-authorization.tsx — grant-code authorization card in the compatibility panel; authorization state polls /authorization every 5 s, resets consent on transitions, and never replays a prior action.
• fetchDesktopSession — dedicated session fetch for sensitive Desktop operations: no renewal, no admin fallback, no POST replay; cross-target requests reject as desktop_target_changed. Routed on the machine plane to match the classify() mapping dev assigns to /api/codex/desktop-compatibility/.
• Tests: server grant/scope/expiry cases, panel grant-flow and machine-session-replacement cases.

Merge note

dev had meanwhile introduced a simpler gate (paired local dashboard + local_dashboard_confirmation_required). This PR intentionally keeps the preserved work's stronger step-up model and swaps that gate out; the dev-side helper management/desktop-compatibility-authorization.ts was removed after its last reference disappeared. Dev's newer panel layout (acc-desktop, InlineBanner, session-expiry handling) is kept and the authorization card is wired into it.

Validation

• bun x tsc --noEmit (root) and tsc -b (gui): clean.
• Server focused tests: management-desktop-compatibility-{routes,runtime-routes,settings} — 22/22 pass, including Desktop grant purpose/origin binding, scope revocation on role/listener change and logout, and expiry semantics.
• GUI tests: desktop-compatibility-panel, desktop-compatibility-api, api-auth-memory — 52/52 pass.
• gui-pair-{capability,client,delivery,http} and cli-management-auth: pass.
• tests/server/server-management-auth.test.ts: 31 failures identical on unmodified dev — SPEND_LEDGER_OWNER_HOME_CONFLICT because a live ocx service holds the ledger in this environment; unrelated to this change.

Provenance

The preserved work was committed as codex/desktop-gui-stepup-20261018 (34 files, +622/−52) from the dirty tree of desktop-local-stepup-20261018 (detached base 8640c2f30), then merged onto current dev (9e863b1816) with conflicts resolved toward the step-up model.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• UI screenshot required.

What to do

• Add a screenshot of the UI change to the PR description.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.