feat(auth): separate diagnostics and usage permissions

[juliusmarminge]

Workspace read access also exposed trace logs, host process details, resource history, and usage data. Add diagnostics:read so those diagnostics can be granted independently.

Web and mobile queries and subscriptions follow each selected environment's grant. Usage retains a known grant during revalidation, loads environments progressively, and retries only failed environments. Initial or failed permission lookups grant no diagnostics access. Provider limits retain their existing permissions; pricing-override edits separately recheck settings:write on the owning environment.

New Standard grants and the explicit Read only preset include diagnostics access, preserving the preset's previous behavior. Custom grants can omit it. Existing credentials keep their recorded scopes; older servers must be upgraded before they can issue the new scope, then the client needs a fresh grant.

Earlier focused suites passed for all seven protected RPC reads with allowed and denied credentials, scope-loading failures and retained grants, multi-environment Usage retries, and pricing-edit revocation. Scoped web and mobile typechecks passed during stack verification. The pairing captures below predate the final integration.

Earlier-revision pairing UI, captured before the final stack integration:

Before	After

Model: GPT 6 Astra. Harness: Codex.

Note

Add diagnostics-read scope and gate usage/diagnostics access on it

• Adds diagnostics-read to the scope schema in auth.ts and to the RPC_REQUIRED_SCOPES map in RpcAuthorization.ts for trace/process diagnostics, resource history, telemetry subscription, usage summary, and usage-rate RPCs
• Adds a shared resolveUsageAccess resolver in usageAccess.ts that converts connection state and session scopes into a diagnostics-access result, keeping cached grants usable while offline
• Web (UsagePage.tsx, usage.ts, resourceTelemetryState.ts, DiagnosticsSettings.tsx) and mobile (UsageRouteScreen.tsx, usage.ts) now skip RPCs for environments lacking diagnostics-read and show per-environment access or connection errors instead of usage data
• The connection-pairing UI in ConnectionsSettings.tsx can now delegate diagnostics-read independently, and it is included in the read-only pairing preset
• Risk: diagnostics-read is added to the standard client scope set; existing clients without this scope in their session will be denied usage and diagnostics RPCs until re-paired or re-authenticated

^{Macroscope summarized 11ff72c.}

---

Note

High Risk
Authorization boundary changes: clients with only orchestration:read lose usage and diagnostics until re-paired, and several RPCs move to a new required scope.

Overview
Introduces diagnostics:read so trace/process diagnostics, resource telemetry/history, and usage RPCs are no longer bundled with orchestration:read. Server RPC scope maps and serverRetryResourceTelemetry now require diagnostics:read (retry also still needs environment:maintain via dual-scope enforcement in ws.ts).

Clients use shared resolveUsageAccess to decide per-environment access from connection phase and session scopes. Web and mobile skip usage/diagnostics queries when the grant is missing, show per-environment error copy instead of charts, and disable refresh when nothing can read diagnostics; pairing UI can delegate the new scope (included in the read-only preset).

diagnostics:read is added to standard client scopes in contracts; existing tokens keep their old scopes until re-issued. New server tests cover diagnostics-only vs orchestration-only access.

^{Reviewed by Cursor Bugbot for commit 0fd319b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.5 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	8	—	21	✅
Claude	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.9 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 11ff72c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new diagnostics:read permission, changes server RPC authorization and telemetry retry requirements, and adds that permission to standard client defaults. Because it changes authentication boundaries and default grants across server, web, and mobile code, human review is warranted.

No code changes detected at 11ff72c. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 7772ff6. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.