#23890 cmux NEXT agent pane: an approval only the cmux app may give says so plainly

Only the person at the cmux app may allow a permission (hub/person.rs). acpmux refuses an allow from any other connection with data.reason permission.person_required and English for its CLI: "approve this on the Mac app: allowing a permission is accepted only from the cmux app, never from the CLI, a script or an agent". The agent pane showed that English as is, in the permission panel's error line and in notices.

The pane now reads that reason the way it already reads full_access_off: as a refusal with its own sentence, in the pane's language.

Only the cmux app can approve this. Approve it in cmux on the Mac that runs this chat.

DAEMON_REASON_CODE maps the reason to transport.person_required, which TRANSPORT_TEXT words, so errorMessage returns the sentence and isHostRefusal counts it (a refused pick reports it). The permission groups panel's error line (PermissionGroupClient.markFailure) now goes through errorMessage instead of the raw message. acpmux's wire message doesn't change.

With #23888, the question card shows this sentence alone when it is the reason an answer was refused.

Risk: normal. Error-text mapping in the agent pane; the refusal itself is unchanged.

Changelog

• Fixed: An approval only the cmux app may give now says so in plain words in the agent pane, instead of acpmux's command-line message.

Test

webviews/test/transport-errors-person-required.test.ts (bun:test, no DOM): errorMessage and isHostRefusal on the refusal as direct.ts builds it, and a PermissionGroupClient whose group allow acpmux refuses.

• Red on b6f22f3398ef15e11312f1d1a81c2771267fab1f (test + string, before the fix): fleet step 6a493e5d7e2c914617b19a8f, both tests failed (received "approve this on the Mac app: allowing a permission ...").
• Green on 1b626275093bdd3993fb8241ebce23d0727d55a4 (fix): fleet step e811d675f6edaa15b2b381b2, passed (also ran transport-errors-full-access-off.test.ts and permission-groups-switch-keeps-last.test.ts).

Observed / Not run

Observed: the two fleet steps above; scripts/cmux-next/prepush-gate.py reported no new violations; vp fmt left the changed files unchanged.
Not run: the full webviews suite, bun run check and a live person-required refusal in the app. The 20 non-English translations are new and marked needs_review.

No capture: the sentence renders in the existing error line and notice row.

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

The agent pane now shows its own translated sentence — "Only the cmux app can approve this. Approve it in cmux on the Mac that runs this chat." — when acpmux refuses an allow that only the person at the cmux app may grant, instead of acpmux's English CLI message.

• Maps permission.person_required to the pane's string the same way full_access_off is handled, so errorMessage returns the sentence and isHostRefusal recognizes it.
• Routes the permission groups panel's error line through errorMessage so it shows the same sentence instead of the raw message.
• Adds tests for both errorMessage/isHostRefusal and a refused group allow. The 20 non-English translations are new and marked needs_review.