enhancement(runtime): allow Auto mode to use tools currently restricted to Full Access on macOS

[YayoiNanoka]

Problem

On macOS, Auto mode currently cannot use several capabilities provided by Maka Desktop.

ToolRuntime rejects every tool classified as client_capability unless the Session execution boundary is bypass. However, Maka Desktop publishes the following features through the Client Capability protocol:

• Browser
• Computer Use
• Client settings
• MCP tools connected through the Desktop client

As a result, these tools cannot be used in Auto mode, even when their effects are already constrained by a client-side broker, macOS system permissions, visible-session ownership, confirmation dialogs, or tool-specific hard limits.

This makes Full Access act as a feature-unlock switch. A user must disable the Host filesystem and network sandbox to use client-side capabilities that do not require broader Host access.

The problem is especially visible for read-oriented operations such as browser_snapshot, Computer Use observation, and MakaClientSettingsGet: they still require Full Access solely because they travel through the Client Capability path.

This issue is limited to interactive macOS Desktop sessions and the Client Capabilities listed above. Windows sandbox support and Plan mode semantics are out of scope.

中文翻译

在 macOS 上，Auto 模式目前无法使用 Maka Desktop 提供的部分能力。

只要工具被分类为 client_capability，ToolRuntime 就会要求 Session 的执行边界必须是 bypass。但 Maka Desktop 正是通过 Client Capability 协议提供以下功能：

• Browser
• Computer Use
• 客户端设置
• Desktop 客户端连接的 MCP 工具

因此，即使这些工具已经受到客户端 broker、macOS 系统权限、可见 Session 所有权、确认弹窗或工具自身硬限制的保护，它们仍然不能在 Auto 模式下使用。

这导致完全权限实际上变成了一个“功能解锁开关”。用户为了使用不需要扩大 Host 权限的客户端能力，却必须同时关闭 Host 的文件系统和网络 sandbox。

这个问题在只读操作上尤其明显，例如 browser_snapshot、Computer Use 的观察操作和 MakaClientSettingsGet。它们仅仅因为走了 Client Capability 通道，就必须使用完全权限。

本 Issue 只处理交互式 macOS Desktop Session，以及上面列出的 Client Capability。Windows sandbox 和 Plan 模式语义不在本次范围内。

Desired outcome

In interactive managed Auto sessions:

• Allow the listed Client Capability calls without requiring a bypass boundary.
• When no matching Session Grant exists, ask the user whether to allow the requested capability + scope for the current Session.
• After approval, reuse the Grant for later calls with the same capability + scope in that Session without asking again.
• Bind Browser grants to a normalized Web Origin, Computer Use grants to a macOS application bundle ID, and Desktop MCP grants to serverId + toolName.
• Keep the existing Client Settings behavior: safe reads execute directly, while updates retain their current Desktop confirmation.
• Do not convert the Session to Full Access or weaken its Host filesystem or network sandbox.
• Keep all existing Browser, Computer Use, MCP, client broker, confirmation-dialog, visible-session, and macOS privacy-permission checks unchanged.
• Invalidate a Grant when its Session is deleted or the relevant provider, capability contract, schema, or MCP server configuration changes. Allow the user to revoke Grants.
• Keep Full Access as an explicit user-selected escape hatch, not a prerequisite for these Desktop capabilities.

中文翻译

在交互式 managed Auto Session 中：

• 允许调用上面列出的 Client Capability，不再直接要求 bypass。
• 不存在匹配的 Session Grant 时，询问用户是否允许在当前 Session 中使用这次请求对应的 capability + scope。
• 用户批准后，同一 Session 内后续相同 capability + scope 的调用直接复用 Grant，不再重复询问。
• Browser Grant 绑定标准化 Web Origin，Computer Use Grant 绑定 macOS 应用 bundle ID，Desktop MCP Grant 绑定 serverId + toolName。
• Client Settings 保持现有行为：安全读取直接执行，修改设置继续使用当前 Desktop 确认。
• 不把 Session 切换成完全权限，也不削弱 Host 的文件系统或网络 sandbox。
• 保留现有 Browser、Computer Use、MCP、客户端 broker、确认弹窗、可见 Session 和 macOS 隐私权限检查。
• Session 删除，或相关 Provider、Capability Contract、schema、MCP Server 配置变化时，使旧 Grant 失效；用户可以主动撤销 Grant。
• 完全权限仍然作为用户主动选择的逃生通道，但不应成为使用这些 Desktop 能力的前提。

Alternatives or workarounds

No response

[YayoiNanoka]

I’ll take this.