PR #28580 - manaflow-ai/cmux

Leo, 2026-10-29: "What the hell is this? Why the f*** is this? Grant access, trust this. What is this bottom fing nonsense? Who the f? What did this? It's not fing good. What the f is this?"

What changed

The composer's permission-mode menu (the "Bypass permissions ⌄" chip) drew a Granted access section under its modes: a "Trusted " row and an "Allow for this chat" row, each with an ×. The section came from #20339 (fix(cx-gakp): make permission cards honest per harness), and #27579 later aligned its columns.

The mode menu now lists only the modes. The section, its CSS and its permission.grants string are gone.
Revoking still works, from a new place: both grants move to Session Info → Environment, as rows with Revoke. They use the same callbacks as before (trustAsk.undo for the folder's trust; chat.permission_chat.revoke, still guarded by ready === false, for the chat allowance). A subagent's Session Info doesn't list them, because they belong to the chat. The chat allowance also keeps its existing Revoke menu action (permissionRevoke).
A chat whose harness offers no modes no longer draws a lock-only Access chip just to hold a grant. It shows no mode chip, as it would with no grants.
access-grants-columns.test.ts (#27579) measured only the removed section's columns, so it goes. So does the LockIcon it leaves without a caller, and its gallery-coverage allowlist line.

Known gap, not changed here: Session Info sits behind Debug Settings agent.inspector, which is off by default. With default settings a grant is still revoked the way it was before it showed in this menu: the folder trust bar's Undo while it shows, and the Revoke menu action for a chat allowance. This PR doesn't change that default (the rulebook says never flip a default unasked). If Leo wants a default-visible home, Settings → Folder Trust is the natural one. It holds the trust rules but no per-folder answers today.

Spec: design/menus.md (this lane owns the mode-menu trust section) and design/session-info.md. After landing, menus.md gets the rule "the mode menu lists modes only; grants are revoked in Session Info".

Tests

test/access-chip-pending-warning.test.tsx: the access menu lists modes and draws no granted-access section and no "Granted access" text. This replaces the test that asserted the section.
test/chat-inspector-environment.test.tsx: new test. Environment lists both grants last, each with a Revoke button whose label names the grant, and each click calls its own revoke.
Galleries: ComposerPickers modes-only replaces access-grants; agent-pane.environment-save gains granted; bottomStack trustThenPermission now asserts the composer draws no Access menu for a grant.
bun run typecheck: no type errors in 3237 files, at 617a991, on Linux.
bun test access-chip, chat-inspector-environment, composer-row-layout, gallery-coverage and strings-build-output: 25 pass, 1 skip (browser lane). gallery-coverage.test.ts has 3 failures that are base reds: the same three tests fail at base 17368d28 with the same lists. The only difference is the component count (818 → 817, the removed LockIcon).

Screenshots

Before/after stills come from the gallery advisory run on this PR (Linux Chromium, synthetic fixtures, light and dark): agent-pane.composer-pickers modes-only (after) against base access-grants (before), and agent-pane.environment-save granted (revoke in Session Info). They're linked below once the run posts.

Viewed after image: pending (gallery run)
Visual verdict: pending (independent reviewer, after the gallery run)

Review

Independent review (Codex gpt-6-astra, high, fast) at 234f147: SHIP, no correctness findings. The stale comments and the unused string it noted are fixed in 617a991. A delta review at the final head follows.

🤖 Generated with Claude Code

Agent session: agent session

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Moves granted access out of the composer's permission-mode menu into Session Info's Environment section.

The permission-mode menu now lists only the modes; the "Granted access" section (Trusted folder, Allow for this chat rows with ×) is removed along with its CSS, the permission.grants string, and the LockIcon.
Folder trust and the chat-wide allowance appear in Session Info → Environment as rows with Revoke, using the same revoke callbacks. A subagent's Session Info doesn't list them.
Chats that offer no modes no longer draw a lock-only access chip just to hold a grant.
Removes access-grants-columns.test.ts, which measured only the removed section's columns.

Known gap

Session Info sits behind Debug Settings agent.inspector, off by default; with default settings, revocation still works as before (the folder trust bar's Undo and the Revoke menu action for the chat allowance).