feat(auth): separate diagnostics and usage permissions

[juliusmarminge]

orchestration:read exposed trace logs, host process details, resource history and usage data along with workspace activity. Clients could not receive workspace read access without those diagnostics.

Adds diagnostics:read for trace and process diagnostics, process/resource history, live resource telemetry, usage summaries and pricing refreshes. Web and mobile query and subscribe only when that environment grants access. Usage remains visible during revalidation of a known grant; initial or failed permission lookups grant nothing. Provider limits remain available under their existing permissions.

New Standard grants include the scope. The explicit Read only pairing preset includes it to preserve that preset's previous diagnostics access; custom grants can omit it. Existing clients must pair again to receive the scope. Existing grants are never expanded automatically.

RPC tests cover all seven protected reads with allowed and denied credentials, including denial of unrelated operations to a diagnostics-only client. Targeted formatting and diff checks passed.

Pairing controls with the default selection:

Before	After

Eight focused access-state tests cover connected checks, unavailable environments, retained grants, and session failures. Web and mobile typechecks pass.

Model: GPT-6. Harness: Codex.

Note

Separate diagnostics:read scope from orchestration-read for diagnostics and usage RPCs

• Adds a new diagnostics:read environment scope in auth.ts and reassigns trace diagnostics, process diagnostics, resource history, usage-summary, and usage-rate refresh RPCs to require it in RpcAuthorization.ts
• Introduces a shared resolveUsageAccess utility in usageAccess.ts that maps connection phase and session scopes into a deterministic access state (canReadDiagnostics, isPending, error message)
• Web and mobile usage screens (UsagePage.tsx, UsageRouteScreen.tsx) and their state atoms now skip usage-summary queries and show per-environment errors when diagnostics:read is absent
• Diagnostics settings panel (DiagnosticsSettings.tsx) and resource telemetry hooks (resourceTelemetryState.ts) gate queries and retry on diagnostics:read; telemetry retry additionally requires environment:maintain at the handler in ws.ts
• Pairing UI in ConnectionsSettings.tsx exposes a new "View diagnostics and usage" permission and includes it in the Read-only preset
• Behavioral Change: existing clients with only orchestration-read lose access to diagnostics reads, usage summaries, and resource telemetry; the Read only pairing preset now grants diagnostics:read when delegatable

^{Macroscope summarized 83294bf.}

---

Note

High Risk
This is an authorization boundary change: existing orchestration:read clients lose diagnostics/usage unless re-paired with diagnostics:read, and RPC enforcement affects sensitive host/process data.

Overview
Introduces a dedicated diagnostics:read scope so trace/process diagnostics, resource telemetry, and usage RPCs are no longer bundled with orchestration:read. Server RPC authorization maps those methods to the new scope; serverRetryResourceTelemetry now requires both environment:maintain and diagnostics:read.

Clients use shared resolveUsageAccess to decide whether to call usage/diagnostics APIs. Web and mobile usage state skips usageSummary when access is missing, while still allowing cached totals when a known grant is revalidated. Usage and diagnostics UIs show per-environment denial messages, disable refresh when appropriate, and surface environment.error in coverage notices. Pairing settings add View diagnostics and usage and include it in the Read only preset.

Server tests assert diagnostics-only vs orchestration-only token behavior and the dual-scope requirement for telemetry retry.

^{Reviewed by Cursor Bugbot for commit 83294bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.8 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.7 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	58.5 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.9 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 83294bf · Source CI: cancelled

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new diagnostics permission and changes authorization requirements for existing diagnostics, usage, and telemetry RPCs, with corresponding web and mobile access gating. Because it modifies authentication and authorization behavior across the contract, server, and clients, the access policy and compatibility impact require human review.

No code changes detected at 83294bf. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 344da99. Configure here.}