[brebernjak]

TL;DR

Request assistant_access in Pup's default OAuth login scopes as a prerequisite for packaging Bits CLI with Pup and letting Bits CLI reuse Pup's authentication.

Motivation

The planned integration packages Bits CLI with Pup and reuses the user's Pup login to authenticate Bits CLI requests to the Assistant API. That API requires assistant_access. Including it in the default grant means users can authenticate through pup auth login without needing to know about or manually add --extra-scopes assistant_access.

This PR supplies the required scope; packaging, launching Bits CLI, and the authentication handoff will be handled separately.

Behavior

Adds assistant_access under a Bits CLI section in the existing default scope list, between BITS and Cases. Normal login passes this list through the existing OAuth authorization flow. Existing users must log in again to grant the added scope; refreshing an existing token does not expand its grant.

Read-only defaults remain unchanged. Explicit --scopes and configured scope lists retain their existing precedence, and --extra-scopes continues to append and deduplicate scopes. This change only requests the permission; it does not add a Bits launcher or change command routing, credential storage, or refresh behavior.

Validation

• cargo fmt --check: passed.
• cargo clippy --locked --all-targets -- -D warnings: passed.
• cargo test --locked -- --test-threads=1: 2,517 tests passed, zero failures. Used DD_TOKEN_STORAGE=file and a temporary PUP_CONFIG_DIR to isolate tests from macOS Keychain credentials. Debug symbols and incremental compilation were disabled to reduce local disk use.
• Three independent reviewers and an end-to-end source review found no actionable issues in scope resolution, OAuth compatibility, or existing test coverage.
• Live login with --extra-scopes assistant_access and Assistant API requests previously succeeded for the tested site/org. A fresh live login with this build and cross-site compatibility were not tested.
• cargo audit: reports 15 vulnerabilities and 19 warnings in the existing upstream dependency set. Cargo.toml and Cargo.lock are identical to the base branch; this PR introduces no dependency changes.

Documentation and tests

No documentation files are changed, per the requested minimal scope. The operational requirement is to log in again to receive the new grant. Existing tests exercise default and read-only scope selection, explicit overrides, extra-scope deduplication, and subset invariants; no new command or error path is introduced.

LoC breakdown

Counts are added/deleted lines.

Semantic group	Production code	Tests	Total
Default OAuth permissions	+2 / −0	+0 / −0	+2 / −0
Total	+2 / −0	+0 / −0	+2 / −0

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T17:41:07.601616Z	efcfc5a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: efcfc5a6f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-prod-us1]

More details

The added assistant_access scope follows the existing OAuth flow while preserving read-only defaults and explicit overrides. Existing users must log in again to receive the new grant.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit efcfc5a}