Prime Agent sessions do not receive Pylon browser tools

[rynfar]

Problem

Prime Agent sessions do not receive Pylon's per-thread MCP server, so they cannot use the built-in preview browser even when Settings → Integrations → Allow agent browser access is enabled and the user explicitly grants computer-use permission.

This was reproduced in a real Prime Agent session. Its tool inventory contained no preview_*, browser, or computer capability. Browser verification required an external Playwright installation and bridge instead.

Why this is an integration gap

Pylon already implements the full provider-neutral browser path:

• apps/server/src/mcp/toolkits/preview/tools.ts defines status, open, navigate, resize, appearance, snapshot, click, type, press, scroll, evaluate, wait, and recording tools.
• ProviderService.prepareMcpSession issues a thread/provider-scoped credential when agent browser access is enabled.
• Claude, Codex, Cursor, Grok, and OpenCode read McpProviderSession and attach the server to their native session.
• The desktop preview broker/host already supports local and remote client routing and session-scoped host pinning.

Prime's daemon and ACP adapters never read McpProviderSession. The parity ledger currently marks supportsAcpMcpServers, replaceAcpMcpServers, and releaseAcpMcpServers as deferred. As a result, the credential is minted but unusable by Prime.

The settings description is therefore too broad: it says browser tools are supplied to "agents" when Prime is silently excluded.

Expected behavior

A new Prime Agent session started while agent browser access is enabled receives the same scoped Pylon preview toolkit as other supported providers. Permission controls authorization; it should not require installing another Chromium or building a side-channel automation bridge.

Acceptance criteria

• Daemon mode attaches the Pylon-owned MCP server through Prime's public owner-scoped MCP replacement API when supported.
• ACP compatibility mode attaches it through the supported ACP session boundary, or reports a precise unavailable capability if the installed Prime release cannot accept it.
• Ownership is singular and explicit: attach, reconnect, resource reload, session restart, stop, and provider teardown cannot leak credentials or overwrite Prime-owned MCP configuration.
• The scoped token and native MCP configuration never cross to web/mobile clients or durable events.
• Browser access off means no credential and no browser tools; changing the setting affects newly prepared sessions as documented.
• Web/desktop and remote/relay/tunnel routing retain one stable preview host per provider session.
• Feature capabilities and Settings copy report Prime support truthfully for the installed runtime.
• Focused daemon, ACP, credential lifecycle, reconnect, and another-provider regression tests pass.
• A real Pylon desktop pass proves preview_open, preview_snapshot, interaction, screenshot, and recording from a Prime Agent turn.

Related audit findings

The current Prime parity ledger already documents other limitations. This issue is narrower: restore the existing Pylon browser capability to Prime without exposing a raw provider-shaped MCP tunnel.