The terminal lists, grants and revokes an app's private destinations, through the same actions as the page #3882

The egress screen, its grant and revoke keys, and its wiring in the repository's About screen (e) already existed from #3543. What was missing was the gate on the screen itself and the test, and this pull adds both. I ran bun test on test/tui-egress.test.ts, plus test/app-egress-grants.test.ts and the About screen's test. All pass. I could not run bun x tsc --noEmit, because bun can't write its tempdir in this sandbox, so the forge's check is the first type check of this change.

• Gate: src/tui/screens/egress.ts now takes canChange from egressView, the action's own check, instead of deciding anything itself. A viewer for whom it is false gets an empty list and no g/x keys, and a press does nothing. Before this, a repository admin who wasn't a site admin could see the list and the keys. Grant and revoke still call grantAppEgress and revokeAppEgress, which are the actions the settings page uses. The issue calls them grantDestination and revokeDestination, but those names don't exist in the code.
• Test: test/tui-egress.test.ts drives the real terminal app through the palette to the repository's About screen.

- Site admin: sees the e egress hint and the list of destinations forge.json asks for. Grant shows granted by ada and writes an app.egress.granted event. Revoke removes the grant and writes an app.egress.revoked event. - Writer (through an org team): has no e key, and pressing e, g or x opens nothing and grants nothing.

• Not covered: the writer test doesn't exercise the new canChange gate, because e is already hidden from non-admins in About and the screen is never reached. A repository admin who isn't a site admin is the case the gate protects, and no test drives it.
• Not done: no new web or API surface, and no change to the e key's own isAdmin check in About.

To try it, sign in over the terminal as a site admin, open a repository whose forge.json lists egress, press I, then e, and use g to grant and x to revoke.

Closes #3618

The egress screen, its grant and revoke keys, and its wiring in the repository's About screen (e) already existed from #3543. What was missing was the gate on the screen itself and the test, and this pull adds both. I ran bun test on test/tui-egress.test.ts, plus test/app-egress-grants.test.ts and the About screen's test. All pass. I could not run bun x tsc --noEmit, because bun can't write its tempdir in this sandbox, so the forge's check is the first type check of this change.

• Gate: src/tui/screens/egress.ts now takes canChange from egressView, the action's own check, instead of deciding anything itself. A viewer for whom it is false gets an empty list and no g/x keys, and a press does nothing. Before this, a repository admin who wasn't a site admin could see the list and the keys. Grant and revoke still call grantAppEgress and revokeAppEgress, which are the actions the settings page uses. The issue calls them grantDestination and revokeDestination, but those names don't exist in the code.
• Test: test/tui-egress.test.ts drives the real terminal app through the palette to the repository's About screen.

- Site admin: sees the e egress hint and the list of destinations forge.json asks for. Grant shows granted by ada and writes an app.egress.granted event. Revoke removes the grant and writes an app.egress.revoked event. - Writer (through an org team): has no e key, and pressing e, g or x opens nothing and grants nothing.

• Not covered: the writer test doesn't exercise the new canChange gate, because e is already hidden from non-admins in About and the screen is never reached. A repository admin who isn't a site admin is the case the gate protects, and no test drives it.
• Not done: no new web or API surface, and no change to the e key's own isAdmin check in About.

To try it, sign in over the terminal as a site admin, open a repository whose forge.json lists egress, press I, then e, and use g to grant and x to revoke.

The egress screen now hides its list and grant/revoke keys from anyone who isn't a site admin, and a test checks that. The action decides who is a site admin (canChange from egressView); the screen doesn't judge it. #3543 already built the screen, the e key in About and the grant and revoke through grantAppEgress and revokeAppEgress. This pull adds the gate and its tests.

I ran test/tui-egress.test.ts: 3 pass. I could not run bun x tsc --noEmit here, because bun can't write its tempdir in this sandbox, so the forge's check is the first type check.

• Gate test: test/tui-egress.test.ts mounts egressScreen(session, ctx, repo) directly as erin, who administers the repository through an org team and is no site admin. egressView still returns erin both destinations, so only the gate stands between erin and the list. The test asserts four things:

- No destination text is on screen. - keys has no g or x. - Pressing g and x leaves listEgressGrants empty. - No new app.egress.* event is written.

I checked it against the base egress.ts and it fails there. With the gate in, it passes.

• Other tests: the writer test only shows About hides e, so it doesn't cover the gate. The site admin test covers list, grant and revoke.
• Terminal differs from the web page on purpose: the web settings page shows a repository admin the list read-only. The terminal shows it to site admins only, as #3618 asks. A comment in egress.ts says so.
• Cleanup: the rows line is now view.ok && view.value.canChange ? view.value.rows : [].
• Not done: I did not run a live preview check of a terminal grant reaching web viewers. The tests check the database and the events only.

The full gate on land was red and named no test; the pull is open again.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again

This pull's terminal egress screen takes its gate from the action. I couldn't reproduce the red gate, so I changed nothing for it. This round adds only the docs line @juniper asked for.

The full gate's log named no test, so I ran what I could here, and all of it passes:

• scripts/gate.ts passes.
• tsc --noEmit is clean.
• The egress tests pass: tui-egress, egress-grants and app-egress-grants, 27 tests.
• The wider test/tui and test/docs run passes: 404 tests.

If the gate is still red on this push, its log should name the failing step.

What changed

• Docs: docs/APPS.md now says the terminal is stricter than the page on purpose. A repository admin who is no site admin sees the list read-only on the page, and nothing on the terminal screen (no rows, no g/x). This answers @juniper's line comment on src/tui/screens/egress.ts.

What I left out

• Terminal/page agreement: I did not make the terminal show the list to repository admins. #3618 asks for the terminal as a site admin's door, so I documented the difference instead.
• Live-reach test: I did not add a test that a grant made in the terminal reaches a web viewer live. That is a separate change.

Try it: As a site admin, open the repository's About (I), then e. g grants and x revokes the destination under the cursor. Both go through grantAppEgress and revokeAppEgress, as the page does.

🤖 Generated with Claude Code

The pull now touches only the egress screen, its test, docs/APPS.md and .gitignore. The earlier commit had added the sandbox's .tmpx/ scratch directory (1531 files), and it is no longer in the tree.

• Removed: I ran git rm -r --cached .tmpx and added /.tmpx/ to .gitignore so it can't come back.
• Not done: I did not rebuild the branch from main. Force pushes are refused here, so the binaries still sit in the branch's earlier commits. Squashing the pull on merge would keep them out of main.
• The change itself: it is the same as before.

- egressScreen takes canChange from egressView. With it false, the screen shows no rows and has no g/x keys. - Grant and revoke go through grantAppEgress and revokeAppEgress, the same actions the page uses. - docs/APPS.md says the terminal is stricter than the page, on purpose.

• Tests: bun test test/tui-egress.test.ts passes (3 tests). That includes the direct-mount test as erin, a repository admin who is no site admin, which fails without the gate. I did not run the full check; the forge runs it on this push.
• Check failure: the check was parked as failing in the place it ran, not in the change. I can't tell whether it was caused by the .tmpx/ files; the push will show.

To try it, open the app's terminal with FORGE_APP_SSH and go to the egress screen as a repository writer and as an admin.