# feat\(server\): work a linked environment starts stays within its link · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/574b1bee29b8d1837b226c07ccc2dabbe3079a03)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 574b1bee29b8d1837b226c07ccc2dabbe3079a03

Requested commit: 574b1bee29b8d1837b226c07ccc2dabbe3079a03

Commit: 574b1bee29b8d1837b226c07ccc2dabbe3079a03

Tree: 9a81fe3531e3676d82155879f702e3ede0ede88d

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
feat(server): work a linked environment starts stays within its link

A link's T3-Mode-Limit caps the modes of what it starts, but within those
modes it could still steer the user's own threads or change this
environment's projects and settings. Work a link starts is now fenced to
that link.

The linking side registers its OAuth client with the t3code-peer-link
software id; the receiving side signs that into the session's claims. Every
thread such a session launches carries an immutable linkOrigin, and so do
the subagents, forks and create_threads it derives. A client's own
thread.create cannot set one.

In the shared access declarations, a linked caller may change only threads
of the same link, and may not use writesEnvironment tools (projects,
settings), schedule tasks, or change scheduled tasks. Reads are not fenced.
Setup scripts are skipped for stamped threads in ProjectSetupScriptRunner,
which every path that runs them goes through.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

```

## Parents

- [655a0548ac9bce10c4089f39e3983e4707eca0c0](https://git.cafe/pingdotgg/t3code/commit/655a0548ac9bce10c4089f39e3983e4707eca0c0?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/574b1bee29b8d1837b226c07ccc2dabbe3079a03?format=markdown)