[teamleaderleo]

Leo, 2026-10-29: "What the hell is this? Why the f*** is this? Grant access, trust this. What is this bottom fing nonsense? Who the f? What did this? It's not fing good. What the f is this?"

What changed

The composer's permission-mode menu (the "Bypass permissions ⌄" chip) drew a Granted access section under its modes: a "Trusted " row and an "Allow for this chat" row, each with an ×. The section came from #20339 (fix(cx-gakp): make permission cards honest per harness), and #27579 later aligned its columns.

• The mode menu now lists only the modes. The section, its CSS and its permission.grants string are gone.
• Revoking still works, from a new place: both grants move to Session Info → Environment, as rows with Revoke. They use the same callbacks as before (trustAsk.undo for the folder's trust; chat.permission_chat.revoke, still guarded by ready === false, for the chat allowance). A subagent's Session Info doesn't list them, because they belong to the chat. The chat allowance also keeps its existing Revoke menu action (permissionRevoke).
• A chat whose harness offers no modes no longer draws a lock-only Access chip just to hold a grant. It shows no mode chip, as it would with no grants.
• access-grants-columns.test.ts (fix(composer): Access menu's allowed rules sit on the mode rows' columns, and only their × lights #27579) measured only the removed section's columns, so it goes. So does the LockIcon it leaves without a caller, and its gallery-coverage allowlist line.

Known gap, not changed here: Session Info sits behind Debug Settings agent.inspector, which is off by default. With default settings a grant is still revoked the way it was before it showed in this menu: the folder trust bar's Undo while it shows, and the Revoke menu action for a chat allowance. This PR doesn't change that default (the rulebook says never flip a default unasked). If Leo wants a default-visible home, Settings → Folder Trust is the natural one. It holds the trust rules but no per-folder answers today.

Spec: design/menus.md (this lane owns the mode-menu trust section) and design/session-info.md. After landing, menus.md gets the rule "the mode menu lists modes only; grants are revoked in Session Info".

Tests

• test/access-chip-pending-warning.test.tsx: the access menu lists modes and draws no granted-access section and no "Granted access" text. This replaces the test that asserted the section.
• test/chat-inspector-environment.test.tsx: new test. Environment lists both grants last, each with a Revoke button whose label names the grant, and each click calls its own revoke.
• Galleries: ComposerPickers modes-only replaces access-grants; agent-pane.environment-save gains granted; bottomStack trustThenPermission now asserts the composer draws no Access menu for a grant.
• bun run typecheck: no type errors in 3237 files, at 617a991, on Linux.
• bun test access-chip, chat-inspector-environment, composer-row-layout, gallery-coverage and strings-build-output: 25 pass, 1 skip (browser lane). gallery-coverage.test.ts has 3 failures that are base reds: the same three tests fail at base 17368d2 with the same lists. The only difference is the component count (818 → 817, the removed LockIcon).

Screenshots

Before/after stills come from the gallery advisory run on this PR (Linux Chromium, synthetic fixtures, light and dark): agent-pane.composer-pickers modes-only (after) against base access-grants (before), and agent-pane.environment-save granted (revoke in Session Info). They're linked below once the run posts.

Viewed after image: pending (gallery run)
Visual verdict: pending (independent reviewer, after the gallery run)

Review

Independent review (Codex gpt-6-astra, high, fast) at 234f147: SHIP, no correctness findings. The stale comments and the unused string it noted are fixed in 617a991. A delta review at the final head follows.

🤖 Generated with Claude Code

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Moves granted access out of the composer's permission-mode menu into Session Info's Environment section.

• The permission-mode menu now lists only the modes; the "Granted access" section (Trusted folder, Allow for this chat rows with ×) is removed along with its CSS, the permission.grants string, and the LockIcon.
• Folder trust and the chat-wide allowance appear in Session Info → Environment as rows with Revoke, using the same revoke callbacks. A subagent's Session Info doesn't list them.
• Chats that offer no modes no longer draw a lock-only access chip just to hold a grant.
• Removes access-grants-columns.test.ts, which measured only the removed section's columns.

Known gap

• Session Info sits behind Debug Settings agent.inspector, off by default; with default settings, revocation still works as before (the folder trust bar's Undo and the Revoke menu action for the chat allowance).

^{Written for commit 617a991. Summary will update on new commits.}

[blacksmith-sh]

Found 26 test failures on Blacksmith runners:

Failures

Test	View Logs
---/---	View Logs
---/---	View Logs
---/---	View Logs
---/---	View Logs
---/---	View Logs
---/---	View Logs
src/agent-session/acpmux/conversation/MessageGroupRow.test.tsx/MessageGroupRow.test.tsx	View Logs
src/agent-session/acpmux/conversation/MessageGroupRow.test.tsx/MessageGroupRow.test.tsx	View Logs
src/agent-session/acpmux/conversation/MessageGroupRow.test.tsx/MessageGroupRow.test.tsx	View Logs
test/browser/gallery-control-surfaces.test.ts/gallery-control-surfaces.test	View Logs

...and 16 more test failures. View all on Blacksmith: run 41143320907, run 41143320987

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Probably yours: effect-interval-cleanup.test.ts fails here but not on main's latest full suite. Seen on other PRs too (likely flaky): MessageGroupRow.test.tsx, gallery-control-surfaces.test.ts, harnesses-page.test.tsx and 3 more.

CI failed on 617a991f10 (run 41143320907 attempt 1): 1 code, 1 unknown.

Job	Verdict	Why
web / react-apps-check (1)	code	a web test failed
web / react-apps-check	unknown	no known signature; failed step: Check webview test shards

Failures:

• seen on other PRs MessageGroupRow.test.tsx a run with a message going out starts open, names its target and ticks only while it goes: failed (job)
• seen on other PRs gallery-control-surfaces.test.ts every web gallery entry keeps trailing surfaces clear and hover inside its control: failed (job)
• new in this PR effect-interval-cleanup.test.ts removing the existing cleanup from real direct and nested interval effects fails: failed (job)
• seen on other PRs harnesses-page.test.tsx a failed sign-in retries its saved login after health refresh marks the row ready: failed (job)
• seen on other PRs subtle-elevation.test.ts one subtle elevation scale > no drop shadow blurs except through the scale: failed (job)
• seen on other PRs subtle-elevation.test.ts one subtle elevation scale > every drop shadow a surface casts resolves to the scale: failed (job)
• seen on other PRs workflow-tasks.test.tsx a running workflow keeps its elapsed clock live before agent records arrive: failed (job)

Matched log lines

web / react-apps-check (1): (fail) a run with a message going out starts open, names its target and ticks only while it goes [48.48ms]

Not re-run automatically: web / react-apps-check (1), web / react-apps-check are not machine failures.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: web / Web status; a job it gathers is red on this change (its line here); do not merge until green; see lane-rules
red: web / react-apps-check; a job it gathers is red on this change (its line here); do not merge until green; see lane-rules
red: web / react-apps-check (1); NEW: green on the base c4ad9e3; do not merge until green; see lane-rules

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): BLOCK at 617a991

• [P2] webviews/src/agent-session/acpmux/inspector/ChatInspector.tsx:487 — Folder-trust revocation becomes inaccessible with default settings. Grants now live exclusively in the inspector, but useChatInspector returns no panel when agent.inspector is disabled (line 447). The fallback trust-bar Undo disappears after the next prompt, and reopening an already trusted folder produces no trust question. Removing the composer’s revoke control therefore removes the persistent revocation path for ordinary users. Preserve a default-accessible folder-trust revoke action before removing this one; the chat-allowance Revoke action does not revoke folder trust.

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): BLOCK at 2350d33

• Blocking — webviews/src/agent-session/acpmux/inspector/ChatInspector.tsx:487: Folder-trust revocation now lives exclusively in Session Info, which is unavailable when agent.inspector is disabled. The stated Undo fallback disappears after the next prompt (useFolderTrustAsk.ts:421–428) and is absent when reopening a trusted folder. Removing the existing menu action therefore makes persistent trust unrevocable through normal UI without enabling a debug feature. Preserve a reachable revocation action outside that gate.

[teamleaderleo]

Orphaned: no activity for 13 h, and no lane holds a lease on it. The orphan sweep could not merge feat-cmux-next in: conflicts in webviews/src/agent-session/acpmux/App.tsx, webviews/src/agent-session/acpmux/Composer.tsx, webviews/src/agent-session/acpmux/composerLocation.css, webviews/src/agent-session/acpmux/inspector/ChatInspector.tsx. Listed for a lane to resolve.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Superseded by #28617, the open carry of this change (the permission-mode menu lists only the modes; grants are revoked in Session Info), which has a live owner. Closing as part of the open-PR sweep.