[markus41]

When global agent browser access is disabled but a project opts in, production startup can construct the shared ProviderSessionManager through scheduled cleanup before ProjectService is available. The manager captures the missing optional service and withholds the preview capability even for an existing, enabled project.

Provide ProjectService around the entire production assembly, including cleanup, and preserve it as an exported service. The regression uses the real production layer and observes the capabilities passed to MCP credential issuance.

Validation:

• Regression fails without the wiring change and passes with it.
• All 93 runtime-layer tests pass; four existing browser permission tests pass, including opt-out and missing-project denial.
• Changed-file format, lint, both knip passes, GraphQL consistency, and all three affected-package typechecks pass. On Windows, the check runner needed a process-local adapter to launch the installed vp JavaScript entry point; no repository tooling or machine configuration was changed.
• CodeRabbit CLI review completed with zero findings.
• Cognitive complexity: not applicable; no production function changed.

Installed desktop runtime and authenticated browser verification remain pending. This addresses T3 preview capability issuance, not Codex desktop computer-use host integration.

[macroscopeapp]

Approvability

Verdict: Approved at afff3cf

Macroscope's review found this PR approvable — Production startup now supplies project validation consistently to the shared session manager, allowing existing browser and device access settings to be honored. Access defaults and fail-closed safeguards remain unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: e34067e
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 24c05742-5e32-4032-a53f-bf72eb85813d

Commits

Reviewing files that changed from the base of the PR and between afff3cf and 613a912.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: d464631
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: f32c4189-c4b5-4f85-88d0-ee4426ae6072

Commits

Reviewing files that changed from the base of the PR and between d464631 and afff3cf.

Files selected for processing: 2

• apps/server/src/orchestration-v2/runtimeLayer.test.ts
• apps/server/src/orchestration-v2/runtimeLayer.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The production runtime layer now merges layerProjectService after the scheduled-task cleanup layer. A new production-layer test checks session opening when browser access is disabled globally but enabled for one project.

Changes: Production runtime wiring

Layer / File(s)	Summary
Project service wiring and browser capability test apps/server/src/orchestration-v2/runtimeLayer.ts, apps/server/src/orchestration-v2/runtimeLayer.test.ts	The production layer merges layerProjectService after the cleanup layer. The test checks that opening a session for a project with browser access enabled issues preview capability and reaches the provider adapter once.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related issues

• pingdotgg/t3code#23085 — Reports the same production-layer failure involving missing ProjectService and denied preview access when project browser overrides exist.

Suggested labels: bugfix, size:M

Suggested reviewers: juliusmarminge, t3dotgg

Merge Risk: Minimal · previous review afff3

Project browser access is preserved during production startup. No blocking risk was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the server fix that preserves project-level browser access during production startup.
Description check		The description clearly explains the problem, the wiring change, detailed verification results, and known pending checks. It does not include an explicit Scope and approval section or issue/approval r…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the problem, the wiring change, detailed verification results, and known pending checks. It does not include an explicit Scope and approval section or issue/approval reference, but the core required information is present for this focused fix.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Closing in favour of #23116, which makes the same change. Thanks for the work here!