No way to rename an authorized client or pairing link after it's created #13054

What happened

i cant even rename the tokens i issued

The user created pairing links/authorized client sessions with labels (e.g. via the "Client label" field in the Create pairing link dialog, Settings → Connections → Authorized clients), but found no way to rename them afterward.

Diagnosis

Traced the full stack at commit 719a76ca (tag v0.0.42) — this isn't a hidden or broken button, the capability doesn't exist anywhere in the chain:

• UI (apps/web/src/components/settings/ConnectionsSettings.tsx): ConnectedClientListRow (the row for each already-paired client, ~line 968) renders only a Revoke button for a non-current session. A label can only be entered once, in the AuthorizedClientsHeaderAction dialog's "Client label (optional)" field, at creation time (createServerPairingCredential({ label, scopes })).
• Server service (apps/server/src/auth/EnvironmentAuth.ts, EnvironmentAuth["Service"] interface, ~line 440): the full method list is createPairingLink, issuePairingCredential, issueStartupPairingCredential, listPairingLinks, revokePairingLink, issueSession, listSessions, revokeSession, revokeOtherSessionsExcept, listClientSessions, revokeClientSession, revokeOtherClientSessions — no update/rename method.
• Persistence (apps/server/src/persistence/AuthSessions.ts): client_label is written once in the INSERT (createSessionRow, ~line 220-235). Every UPDATE auth_sessions statement in the file (setLastConnectedAtRow, setClientConnectionRow, revokeSessionRows, revokeOtherSessionRows, the replacement-session revoke) touches revoked_at, last_connected_at, client_surface, or client_app_version — none touch client_label. Same pattern in AuthPairingLinks.ts.

So a client label (and a pairing link's label) is write-once by design/omission: set at creation, never editable, with no path to change it short of revoking and re-creating the credential.

Checked upstream: closest related issue is #5623 (closed) about environment display names defaulting to hostname — a different feature (environments, not authorized clients/pairing links). No existing issue covers renaming an authorized client or pairing link. Not a duplicate.

Steps to reproduce

1. Settings → Connections → Authorized clients → Create link, giving it a label.
2. Once the client has paired and appears in the Authorized clients list, look for a way to edit its label.
3. Observe: only "Revoke" is available. No edit/rename action exists in the UI, and no backend method supports it either.

Version

0.0.42

Environment

Linux x64, Node v26.8.2

Related issues

None found to be a duplicate; #5623 is adjacent (environment naming) but distinct.

Fix applied or workaround

None. Revoking and re-issuing a new pairing link/session with the desired label is the only option, which also changes the credential.

Filed by

claude (sonnet-5) via t3 triage