[tnaughts]

Description

Duplicating to a Workspace in another Project fails with 401 Unauthorized - Session does not match project host under the default dual login method.

Since sanity-io/sanity#12933 (v5.30.0), dual mode stores a project-scoped token after login and prefers it over the cookie. The plugin built its destination client with originClient.withConfig({projectId}), which carries the origin Project's token to the destination Project's host. Before that Studio change, dual-mode users usually stayed on cookie auth, which works across Projects, so the bug was hidden.

This PR adds a getDestinationClient helper:

• Same-Project destination: re-points the origin client, as before.
• Other-Project destination: uses the client from the destination Workspace's own auth.state.
• Not logged in to the destination Workspace: shows a message asking the user to log in, instead of failing with a 401.

What to review

• Is WorkspaceSummary.auth OK for a plugin to rely on? It's a typed public field on the summary returned by useWorkspaces().
• The helper resolves the first auth.state emission. In 6.x the first emission is a real probe result, not a placeholder.

Testing

• Unit tests for getDestinationClient: same Project, other Project (uses its own client and unsubscribes), not logged in.
• Manual testing on Studio 6.13.2 with two Workspaces in different Projects, both on loginMethod: 'dual'. It failed before this change with the error above, and succeeds after it in both directions.

Notes for release

Fixes duplicating to a Workspace in another Project failing with "Session does not match project host".

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how API credentials are chosen for cross-project writes and reads; wrong client selection could still cause auth failures or writes to the wrong dataset, though behavior is scoped to the duplicator plugin with unit tests.

Overview
Fixes cross-project duplication failing with "Session does not match project host" when Studio uses project-scoped tokens (e.g. dual login). The plugin no longer builds the destination API client by only re-pointing the origin client’s projectId/dataset, which carried the origin project’s credentials to another project’s host.

A new getDestinationClient helper keeps same-project behavior (originClient.withConfig to the target dataset) but, for another project, resolves the client from the destination workspace’s auth store and returns null if the user isn’t logged in there. Duplicator uses this for destination status checks and for handleDuplicate, and surfaces a clear critical message instead of a 401 when the destination workspace isn’t authenticated. Changing the destination clears stale messages. Vitest coverage covers same-project, cross-project, and not-logged-in cases.

^{Reviewed by Cursor Bugbot for commit f8c71cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
plugins-studio	Ready	Preview	Oct 26, 2026 8:47pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
plugins-e2e-test-studio	Ignored		Oct 26, 2026 8:47pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: f8c71cf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sanity/cross-dataset-duplicator	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

✅ E2E Tests

🟢 46 passed • view full report • view run

Studio: https://plugins-e2e-test-studio-afn5wluki.sanity.dev

Datasets: pr-2265-chromium-40398612674, pr-2265-firefox-40398612674

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	38.46%	7754 / 20159
🔵	Statements	38.42%	8342 / 21708
🔵	Functions	34.15%	2120 / 6207
🔵	Branches	30.63%	4495 / 14672

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
plugins/@sanity/cross-dataset-duplicator/src/components/Duplicator.tsx	0%	0%	0%	0%	67-1172
plugins/@sanity/cross-dataset-duplicator/src/helpers/getDestinationClient.ts	100%	100%	100%	100%

Generated in workflow #11391 for commit f8c71cf by the Vitest Coverage Report Action

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit bdd21bd. Configure here.}