[eric] bash defaults to always-allow like other actions (catastrophic/scheduling/sensitive-path guards still prompt); drop the working status dot

backend/apps/agents/agent_manager.py

@@ -429,15 +429,15 @@ class AgentManager:
         _builtin_perms = load_builtin_permissions()
 
         # Per-tool DEFAULT policy (overridden by anything the user has set
-        # explicitly in builtin_permissions.json). Bash defaults to "ask"
-        # because every other builtin is sandboxed by domain (Read/Write
-        # touch files but not the shell, browser tools touch a webview),
-        # whereas Bash is a full local shell, and the agent receives
-        # untrusted text from MCP tools (Gmail, WebFetch, browsing) that
-        # can carry prompt injection. Without this, a poisoned email
-        # could silently `rm -rf` the user. Users who want the old
-        # behavior can flip Bash back to always_allow in the UI.
-        _DEFAULTS = {"Bash": "ask"}
+        # explicitly in builtin_permissions.json). Bash defaults to
+        # always_allow like every other builtin, for a frictionless run.
+        # Three guards below STILL force a prompt even on always_allow:
+        # the catastrophic-pattern match (rm -rf and friends), OS-scheduling
+        # (cron/launchd persistence), and the sensitive-path gate. So the
+        # poisoned-email -> destructive-command case is still caught; what
+        # this trades away is the prompt on ordinary shell commands. Users
+        # who want a prompt on every command can flip Bash to "ask" in the UI.
+        _DEFAULTS: dict[str, str] = {}
 
         def _default_for(tool_name: str) -> str:
             return _DEFAULTS.get(tool_name, "always_allow")

frontend/src/app/pages/AgentChat/AgentChat.tsx

@@ -966,9 +966,8 @@ const AgentChat: React.FC<AgentChatProps> = ({ sessionId: sessionIdProp, onClose
                 <Typography noWrap sx={{ color: c.text.primary, fontWeight: 600 }}>{session.name}</Typography>
                 {!isDraft && statusStyle && session.status !== 'completed' && session.status !== 'stopped' && (
                   // Status speaks only when it needs the user; finished work sits quiet.
-                  <Box sx={{ display: 'flex', alignItems: 'center', gap: 0.6, flexShrink: 0 }}>
-                    <Box sx={{ width: 6, height: 6, borderRadius: '50%', bgcolor: statusStyle.color, flexShrink: 0 }} />
-                    <Typography sx={{ fontSize: '0.75rem', fontWeight: 500, color: c.text.secondary, whiteSpace: 'nowrap' }}>
+                  <Box sx={{ display: 'flex', alignItems: 'center', flexShrink: 0 }}>
+                    <Typography sx={{ fontSize: '0.75rem', fontWeight: 500, color: c.text.tertiary, whiteSpace: 'nowrap' }}>
                       {friendlyStatusLabel(session.status)}
                     </Typography>
                   </Box>