feat(auth): separate browser preview control permissions

[juliusmarminge]

Browser preview control and desktop automation hosting currently share orchestration:operate, so clients cannot receive orchestration access without those permissions.

Add preview:operate for preview mutations and automation hosting, with matching pairing controls and desktop UI guards. Preview lists, events, and discovered-server reads retain orchestration:read. The new scope is included in newly issued standard grants; existing clients must pair again to receive it. Provider MCP preview permissions remain independent.

Tests added cover the RPC scope mapping and real WebSocket requests: the old orchestration grant cannot refresh a preview or connect an automation stream, the rejected refresh never reaches its handler, and the explicit preview grant allows both operations.

Pairing controls, captured from this layer’s base and head with the same viewport and default selection:

Before	After

The existing Markdown and workspace-image suites pass with explicit scope fixtures.

Model: GPT-6. Harness: Codex.

---

Note

Medium Risk
Authorization and pairing changes affect a broad set of preview RPCs and UI entry points; misconfiguration or stale grants could block preview control for existing clients until re-pairing.

Overview
Introduces preview:operate so browser preview control and automation no longer ride on orchestration:operate. Preview mutations and automation RPCs (previewOpen, refresh/close, automation connect/respond, etc.) now require the new scope; listing previews, preview event subscriptions, and discovered local servers stay on orchestration:read. The scope is part of AuthStandardClientScopes for newly issued grants and appears as a “Control previews” pairing option in connections settings.

Server and client behavior enforce the split: integration tests assert tokens with only legacy orchestration scopes cannot refresh previews or open automation streams (handlers are not invoked), while tokens that include preview:operate succeed. The web/desktop UI gates preview webviews, automation hosts, panel toggles, markdown/file “open in browser”, terminal link handling, sidebar localhost shortcuts, and global preview keybindings on useEnvironmentScope / readEnvironmentScope, with clearer copy when preview control is missing.

Breaking change for existing pairings: clients that were granted orchestration operate but not re-paired will lose preview control until they receive preview:operate (they can still observe preview state where reads remain allowed).

^{Reviewed by Cursor Bugbot for commit 3010281. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Separate browser preview control into dedicated preview:operate scope

• Introduces preview:operate as a new authentication scope in auth.ts and adds it to AuthStandardClientScopes
• Moves preview open, navigation, resize, refresh, close, status, and automation RPCs from orchestration:operate to preview:operate in RpcAuthorization.ts; preview listing and subscriptions remain on orchestration:read
• Gates all client preview surfaces on the new scope: ChatView preview panel, ElectronBrowserHost webviews, PreviewAutomationHosts, PreviewPanel, sidebar discovered-port buttons, file preview browser action, terminal link opening, and chat shortcuts
• Adds a selectable "Control previews" pairing grant in ConnectionsSettings.tsx
• Fixes command palette to display browse-access errors separately from browse query errors in CommandPalette.tsx
• Behavioral Change: existing clients without preview:operate lose access to preview controls, automation, and in-app preview opening; they can still list previews and close an already open preview panel

^{Macroscope summarized 3010281.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.5 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	8	—	21	✅
Claude	Total thread wire	—	13.8 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.7 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	59.3 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 3010281 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes the authorization boundary for browser preview control and automation across server RPCs, default pairing grants, and many production UI entry points. Newly issued standard credentials gain a new permission while existing clients may lose control until re-pairing, making human review appropriate.

No code changes detected at 3010281. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit ccf9440. Configure here.}