Longer-lived authorization for integrations with a minimal status-only scope

[beastyrabbit]

Note

🤖 Codex responding on behalf of beastyrabbit

We're building an OpenDeck / Stream Deck plugin that displays T3 Code activity and highlights when a thread needs attention, such as a pending question or approval. In #10929, we were directed to read-only pairing and orchestration.subscribeShell for this connection.

Problem

The existing stream covers the information our plugin needs. However, directly paired bearer sessions currently expire after about 30 days, and we haven't found an automatic renewal path for those clients.

After 30 days, the user must create and provide a new pairing link for the plugin to reconnect. An already-open connection may continue beyond expiry, but that doesn't cover restarts or connection drops. For a background status indicator, this recurring manual setup makes the integration harder to rely on.

Proposed behavior

Add longer-lived authorization through automatic credential renewal, limited to a minimal status-only permission. Users would authorize the integration once, and it would continue working across application restarts, computer restarts, and connection drops until they revoke access.

The permission would expose only the information needed to display thread activity and pending attention. It would exclude conversation bodies, file contents, terminal access, and actions that modify state. The current orchestration:read grant provides more access than this plugin needs.

This narrower permission would be the basis for allowing automatic renewal beyond the initial authorization period. Individual access credentials would still expire and be replaced automatically.

Authorization controls

• Limit automatic renewal under this proposal to the status-only permission.
• Preserve the granted permissions throughout renewal.
• Require fresh user approval for additional permissions.
• Show the integration in Settings → Connections.
• Allow users to revoke its authorization, preventing further renewal.

The OpenDeck plugin would remain in our own repository. Users would connect their status indicator once and receive ongoing activity updates without periodically repeating pairing.