Pre-approve apps for computer-use MCP so unattended sessions are possible (refiling #46907, locked)

Problem

request_access (computer-use MCP) must be answered live, every session. There is no way to pre-approve apps in config, so any workflow where the human is not at the keyboard is blocked outright — scheduled agents, remote control, or simply "kick off the validation run and go do something else".

This has been asked before and never answered: #46907 proposed exactly this (computerUse.preApprovedApps), was auto-flagged as a duplicate of three unrelated issues, was refuted point by point by the reporter, and was then auto-closed for inactivity and locked with no maintainer response. #43172 shows the obvious workaround does not exist either: "defaultMode": "bypassPermissions" plus mcp__* in the allow list still blocks when the session loses focus, and a contributor traced it to two PermissionManager instances reading different state, the MCP-bridge one hardcoded to skipPermissions: false. Also auto-closed stale.

Filing fresh because both are locked.

What makes this worth fixing rather than working around

The grants themselves are not the friction — I measured it. On a one-hour desktop-app validation pass (Electron app: record the screen, kill a capture helper mid-recording, drive the editor, run an export, answer a native save dialog), once the grants were in place I ran roughly forty computer-use actions without a single further prompt.

So the entire cost of unattended operation is the handful of request_access dialogs, and when they happen to fire. That is a very small surface to close.

The documented mitigation — batching every app into one request_access at session start, which is what #46907's reporter also landed on — helps, but only converts "four unpredictable interruptions" into "one interruption at t=0". A human must still be physically present at the start, so scheduled and remote runs remain impossible.

Proposal

A config surface that pre-answers request_access for an explicit list, e.g. in settings.json:

{
  "computerUse": {
    "preApprovedApps": ["Openscreen", "Explorateur de fichiers", "systemsettings.exe"]
  }
}

Deliberately narrow, to keep the security property that the current dialog provides:

• allowlist only — an app not named still raises the dialog, so this is not --dangerously-skip-permissions for the desktop;
• editing settings.json is itself an act of consent, and is auditable and revertible in a way that clicking a transient dialog is not;
• the existing per-app tier system (read / click / full) could be carried in the config, so a pre-approval can be narrower than what the dialog grants.

Use case

Validating a desktop application release. The manual end-to-end pass is the only thing that reaches real screen capture, the system tray, and the native compositor — no unit or browser test can. It takes about an hour of continuous computer-use, and it has to run on the release candidate before it ships. Today that hour requires a human sitting next to the machine for the first thirty seconds, purely to click Allow.