Restrict default Seatbelt PTY access to workload terminals

[Elliot (theelliotm)]

📖 Description

• Require macOS PTY authorization for dynamically allocated terminals; grant exact paths for assigned and inherited terminals.
• Remove GUI mode's blanket terminal-device grant.
• Add disposable same-user PTY regressions to the Seatbelt CI suite and update backend documentation.

Explicit filesystem grants and profileOverride can still widen access. Coverage verifies device opens and terminal controls, not host command execution or cross-terminal byte transfer.

🔗 References

🔍 Validation

Local macOS 27.0.1 validation. Commands below run from src/:

Command	Result
cargo fmt --all -- --check	Passed
cargo clippy --locked -p mxc-sdk --lib --tests -- -D warnings	Passed
cargo test --locked -p mxc-sdk --lib backend_modules::seatbelt::common --quiet	133 passed
cargo test --locked -p mxc-sdk --lib mxc_pty --quiet	46 passed
cargo test --locked -p mxc-sdk --test streaming --quiet	22 passed
cargo build --locked -p mxc_darwin --quiet	Passed

From the repository root:

• MXC_EXEC_MAC="$PWD/src/target/debug/mxc-exec-mac" bash tests/scripts/run_seatbelt_tty_test.sh — all 8 cases passed.
• bash -n tests/scripts/run_seatbelt_tty_test.sh tests/scripts/run_seatbelt_all_tests.sh — passed.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

---

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

The kernel-enforced security boundary warrants human review across supported macOS versions, with reported runtime validation limited to macOS 27.0.1.

No open issues 🎉

What changed in this PR

Tightens Seatbelt terminal access to workload-assigned, inherited, and sandbox-authorized PTYs rather than unrelated host terminals.

Changes:

• Replaces blanket terminal grants with scoped authorization, including GUI mode.
• Adds terminal-isolation regressions and integrates them into the Seatbelt suite.
• Documents terminal access behavior and explicit overrides.

File	Description
tests/​scripts/​run_seatbelt_tty_test.sh	Adds disposable same-user PTY isolation checks.
tests/​scripts/​run_seatbelt_all_tests.sh	Runs the terminal-isolation suite.
src/​mxc-sdk/​src/​core/​mxc_pty/​mod.rs	Records the assigned macOS terminal path.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​seatbelt_runner.rs	Binds terminal paths into profiles and adds regression tests.
src/​mxc-sdk/​src/​backends/​seatbelt/​common/​profile_builder.rs	Restricts PTY grants to authorized terminals.
docs/​backends/​seatbelt/​seatbelt-backend.md	Explains scoped access and override behavior.

_{Review effort: Balanced}