Granting an app a private destination in the terminal asks first: `g` names the app and destination, `y` grants #7966

In the terminal's Private egress screen, g now asks for confirmation before granting. Before, it granted the destination under the cursor as soon as the key was pressed. Revoking with x narrows the boundary, so it still takes one key.

What changed

• The confirm: src/tui/screens/egress.ts: on a row that is not yet granted, g opens confirmScreen with yesNo: true. Its title is "Let <owner>/<name> reach <destination>?" and its one body line is "The app's outbound traffic to it is allowed until you revoke it with x." y or the Grant button calls grantAppEgress and shows the usual "<destination> is granted." toast. n or esc grants nothing. On a row that is already granted, g does nothing and opens no confirm.
• Grants run through runAsync: grant, revoke and the first load now go through runAsync. The app then counts them as busy, so settleApp waits for the write and the reload. Before this, the grant could land after settleApp returned. That failed the test once, and the leftover grant then failed the later tests that share the database.
• Dialog width: src/tui/screens/common.ts: confirmScreen takes an optional width and passes it to dialog. The egress confirm uses 78 columns, because at the default 54 the body line was cut off mid-sentence.

Tests

• test/tui-egress.test.ts:

- The site admin test now checks that g opens the confirm and grants nothing, that y grants and shows the toast, and that g on the granted row opens no confirm. - A new test presses g then n, and g then esc. Both times it proves no grant and no event were written, and that egressView still shows the row not granted. Without the change, both admin tests fail. - The writer and repository-admin tests are unchanged.

• test/egress-admin.test.ts also covered the old one-key grant, so it now presses y after g. That test changed because the behaviour changed on purpose, not because it was wrong.

Checks run

• bun scripts/gate.ts and bun x tsc --noEmit both pass.
• bun test test/tui-egress.test.ts test/egress-admin.test.ts passes. I ran tui-egress three times in a row.
• I also ran the tests for the other screens that use confirmScreen (tui-widgets, tui-forks-take, tui-people-verify, tui-agents, tui-screens, tui-deploys-egress); their one failure was egress-admin, fixed by the y press above.
• scripts/fast.ts named 277 test files for this diff, well over its budget, so I chose the covering tests myself rather than run them all.

Not done: the web settings page's grant button is unchanged.

To try: as a site admin, open a repository whose forge.json asks for egress. Go to About, press e, then g. The dialog names the app and the destination. n leaves the row "asked for, not granted"; y grants it.

🤖 Generated with Claude Code

Closes #7961

In the terminal's Private egress screen, g now asks for confirmation before granting. Before, it granted the destination under the cursor as soon as the key was pressed. Revoking with x narrows the boundary, so it still takes one key.

What changed

• The confirm: src/tui/screens/egress.ts: on a row that is not yet granted, g opens confirmScreen with yesNo: true. Its title is "Let <owner>/<name> reach <destination>?" and its one body line is "The app's outbound traffic to it is allowed until you revoke it with x." y or the Grant button calls grantAppEgress and shows the usual "<destination> is granted." toast. n or esc grants nothing. On a row that is already granted, g does nothing and opens no confirm.
• Grants run through runAsync: grant, revoke and the first load now go through runAsync. The app then counts them as busy, so settleApp waits for the write and the reload. Before this, the grant could land after settleApp returned. That failed the test once, and the leftover grant then failed the later tests that share the database.
• Dialog width: src/tui/screens/common.ts: confirmScreen takes an optional width and passes it to dialog. The egress confirm uses 78 columns, because at the default 54 the body line was cut off mid-sentence.

Tests

• test/tui-egress.test.ts:

- The site admin test now checks that g opens the confirm and grants nothing, that y grants and shows the toast, and that g on the granted row opens no confirm. - A new test presses g then n, and g then esc. Both times it proves no grant and no event were written, and that egressView still shows the row not granted. Without the change, both admin tests fail. - The writer and repository-admin tests are unchanged.

• test/egress-admin.test.ts also covered the old one-key grant, so it now presses y after g. That test changed because the behaviour changed on purpose, not because it was wrong.

Checks run

• bun scripts/gate.ts and bun x tsc --noEmit both pass.
• bun test test/tui-egress.test.ts test/egress-admin.test.ts passes. I ran tui-egress three times in a row.
• I also ran the tests for the other screens that use confirmScreen (tui-widgets, tui-forks-take, tui-people-verify, tui-agents, tui-screens, tui-deploys-egress); their one failure was egress-admin, fixed by the y press above.
• scripts/fast.ts named 277 test files for this diff, well over its budget, so I chose the covering tests myself rather than run them all.

Not done: the web settings page's grant button is unchanged.

To try: as a site admin, open a repository whose forge.json asks for egress. Go to About, press e, then g. The dialog names the app and the destination. n leaves the row "asked for, not granted"; y grants it.

🤖 Generated with Claude Code