feat(auth): separate source control write permissions

[juliusmarminge]

Task-operation access currently also permits cloning, pushing, changing branches, and mutating pull requests. Add source-control:write for these direct source-control actions, with matching controls in web, desktop, and mobile. Repository reads and PR resolution remain available with orchestration:read.

The new scope is included in default grants and can be selected independently when pairing. Existing grants are not widened; clients need to pair again to receive it.

WebSocket coverage checks denied clone, streamed push, and PR-comment requests for task-only grants, successful clone and push with the new scope, and readable PR resolution in both cases. Client guards preserve View PR, existing-worktree selection, and thread deletion without worktree removal.

Pairing controls, captured from this layer’s base and head with the same viewport and default selection:

Before	After

Model: GPT-6. Harness: Codex.

---

Note

High Risk
This is an authorization breaking change: clients with only orchestration:operate lose git and PR mutation access until re-paired with source-control:write, across server RPC enforcement and all major UI entry points.

Overview
Introduces source-control:write as its own environment scope and moves clone, push/pull, branch/worktree mutations, stacked git actions, and pull-request writes off orchestration:operate on the server. gitResolvePullRequest stays readable under orchestration:read.

Web, mobile, and shared action hooks now use useEnvironmentScope to disable clone/add-project flows, git menus and sheets, PR editing/checkout handoffs, and branch pickers when the connection lacks the scope, with short “cannot change source control” messaging. Changing a thread’s branch or worktree still needs orchestration:operate in addition to source-control write; ordinary commits/pushes on the current branch can remain available with source-control write alone.

Pairing/OAuth and connections settings expose the new permission; default client scopes include it but existing paired tokens are not upgraded. Server and mobile tests cover denied vs allowed mutations.

^{Reviewed by Cursor Bugbot for commit 9c21ca5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add AuthSourceControlWriteScope and gate source-control writes across web, mobile, and server

• Introduces AuthSourceControlWriteScope in auth.ts as a new environment authorization scope for standard clients and OAuth pairing.
• Reassigns source-control and pull-request mutation RPCs in RpcAuthorization.ts from AuthOrchestrationOperateScope to AuthSourceControlWriteScope; gitResolvePullRequest moves to AuthOrchestrationReadScope.
• Gates web UI git actions, branch selection, PR detail panel editing, clone flow, and thread deletion worktree cleanup behind the new scope, with disabled states and early returns in handlers.
• Gates mobile git sheets (overview, branches, commit, confirmation) and branch picker behind the scope via use-selected-thread-git-actions.ts, which also rechecks permissions at action time.
• Adds server integration tests in server.test.ts and a mobile permission test suite in use-selected-thread-git-actions.test.ts.
• Risk: environments previously granted only AuthOrchestrationOperateScope will lose source-control write access; clients and existing tokens may need the new scope to perform clone, push, commit, branch, and pull-request mutation operations.

^{Macroscope summarized 9c21ca5.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 9c21ca5.

This comment will update automatically after the next completed run.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new source-control authorization boundary across server RPCs and web/mobile workflows, while also adding that permission to default client scopes. The security-sensitive auth changes and altered product defaults require human review.

No code changes detected at 9c21ca5. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 976c793. Configure here.}