feat(auth): separate browser preview control permissions

[juliusmarminge]

Browser preview control and desktop automation hosting currently share orchestration:operate, so clients cannot receive orchestration access without those permissions.

Add preview:operate for preview mutations and automation hosting, with matching pairing controls and desktop UI guards. Preview lists, events, and discovered-server reads retain orchestration:read. The new scope is included in newly issued standard grants; existing clients must pair again to receive it. Provider MCP preview permissions remain independent.

Tests added cover the RPC scope mapping and real WebSocket requests: the old orchestration grant cannot refresh a preview or connect an automation stream, the rejected refresh never reaches its handler, and the explicit preview grant allows both operations.

Pairing controls, captured from this layer’s base and head with the same viewport and default selection:

Before	After

The existing Markdown and workspace-image suites pass with explicit scope fixtures.

Model: GPT-6. Harness: Codex.

---

Note

Medium Risk
Changes authorization for preview RPCs and standard client grants; existing paired clients lack the new scope until they re-pair, and misconfigured grants could block preview while leaving orchestration working.

Overview
Introduces preview:operate so browser preview mutations and automation hosting are no longer tied to orchestration:operate. Preview read paths (previewList, preview event subscriptions, discovered local servers) stay on orchestration:read.

Server RPC scope mapping and a WebSocket integration test enforce the split: tokens with only orchestration scopes can list previews but get EnvironmentAuthorizationError on refresh and automation connect; adding preview:operate allows those calls.

The scope is registered in contracts, included in AuthStandardClientScopes for newly issued grants, and exposed in Connections pairing UI. The desktop/web client gates preview surfaces (Electron webviews, automation hosts, markdown/file links, sidebar port shortcuts, keyboard shortcuts, right panel) via useEnvironmentScope / readEnvironmentScope so read-only orchestration clients do not mount or invoke preview control.

^{Reviewed by Cursor Bugbot for commit 4d49a52. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.8 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.7 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	58.5 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.9 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 4d49a52 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes the authorization boundary for browser preview control and automation across server RPCs, default pairing grants, and many production UI entry points. Newly issued standard credentials gain a new permission while existing clients may lose control until re-pairing, making human review appropriate.

No code changes detected at 4d49a52. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit ccf9440. Configure here.}