feat(session): add secure, scoped one-time link sharing for collaboration

[sittiponghaus]

Before submitting

✅ I searched existing issues and did not find a duplicate.
✅ I am describing a concrete problem or use case, not just a vague idea.

Why

Sharing ongoing development sessions with non-technical stakeholders (such as business users) currently requires manual intervention, sharing global access passcodes, and exposing multiple active sessions. This introduces security risks, friction in collaboration, and accidental interference with other ongoing tasks.

Scenario

Our development environment consists of polyglot microservices (Go, TypeScript, Python) dependent on roughly 8 infrastructure components, routed via ingress and secured by Oathkeeper. Due to the complexity of running this locally, we deployed a Proof of Concept (PoC) of t3code on a shared virtual machine within a Wireguard network.

Currently, when business users want to review a repository or prompt an AI agent, we spin up a session and share the internal intranet link along with a global passcode. However, this approach has critical limitations:

• Manual Overhead: Restarting the web daemon is required to retrieve passcodes.
• Security & Isolation Risks: Passcodes persist indefinitely in the browser, and users can access, modify, or disrupt other active sessions using global filters.

Requested Scope

Implement a secure, isolated session-sharing mechanism within t3code that allows developers to generate scoped access links for external collaborators without exposing global server passcodes or other user sessions.

Suggested UX

1. Share Action: Add a clear "Share Session" button within the active t3code interface.
2. One-Time Link Generation: Clicking the button generates a secure, unique, single-use URL tied exclusively to that specific browser session.
3. Restricted View: When the business user opens the link, they access only the designated session interface without visibility into other active sessions, global server controls, or admin passcodes.
4. Session Control: The original creator maintains administrative rights to terminate or revoke the shared session at any time.

Suggested Acceptance Criteria

• Developers can generate a direct, scoped share link for a specific session with a single click.
• Shared links do not require restarting the web daemon or sharing global passcodes.
• External users accessing the link are restricted solely to the designated session and cannot view or interact with other active sessions.
• Session access tokens are scoped appropriately and do not persist indefinitely in an insecure manner.
• The session creator has the ability to terminate the shared session instantly from their interface.

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Thanks for the detailed write-up! This overlaps with #12283 (Multi-user self-hosted environments with isolated execution), which covers several people sharing one self-hosted T3 server while keeping each person's sessions isolated, including colleagues opening the same thread and collaborating on it. Closing this as a duplicate so the conversation stays in one place. Please add your scenario there, especially the single-thread, revocable share link and the "no global passcode, no visibility into other sessions" requirements, since that's a useful, narrower first step for that request. Sharing a read-only thread snapshot is tracked separately in #6914.

[sittiponghaus]

Thank you and so sorry that my I can't find it with my search keywords