From 6b5f10e287cfc53dd9edc9b3f3d477f2c5a3b97b Mon Sep 17 00:00:00 2001
From: ciregenz <ciregenz@berkeley.edu>
Date: Wed, 10 Jun 2026 23:13:02 -0700
Subject: [PATCH] [eric] bash defaults to always-allow like other actions
 (catastrophic/scheduling/sensitive-path guards still prompt); drop the
 working status dot

---
 backend/apps/agents/agent_manager.py           | 18 +++++++++---------
 frontend/src/app/pages/AgentChat/AgentChat.tsx |  5 ++---
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/backend/apps/agents/agent_manager.py b/backend/apps/agents/agent_manager.py
index 276478d2..92e706ad 100644
--- a/backend/apps/agents/agent_manager.py
+++ b/backend/apps/agents/agent_manager.py
@@ -429,15 +429,15 @@ class AgentManager:
         _builtin_perms = load_builtin_permissions()
 
         # Per-tool DEFAULT policy (overridden by anything the user has set
-        # explicitly in builtin_permissions.json). Bash defaults to "ask"
-        # because every other builtin is sandboxed by domain (Read/Write
-        # touch files but not the shell, browser tools touch a webview),
-        # whereas Bash is a full local shell, and the agent receives
-        # untrusted text from MCP tools (Gmail, WebFetch, browsing) that
-        # can carry prompt injection. Without this, a poisoned email
-        # could silently `rm -rf` the user. Users who want the old
-        # behavior can flip Bash back to always_allow in the UI.
-        _DEFAULTS = {"Bash": "ask"}
+        # explicitly in builtin_permissions.json). Bash defaults to
+        # always_allow like every other builtin, for a frictionless run.
+        # Three guards below STILL force a prompt even on always_allow:
+        # the catastrophic-pattern match (rm -rf and friends), OS-scheduling
+        # (cron/launchd persistence), and the sensitive-path gate. So the
+        # poisoned-email -> destructive-command case is still caught; what
+        # this trades away is the prompt on ordinary shell commands. Users
+        # who want a prompt on every command can flip Bash to "ask" in the UI.
+        _DEFAULTS: dict[str, str] = {}
 
         def _default_for(tool_name: str) -> str:
             return _DEFAULTS.get(tool_name, "always_allow")
diff --git a/frontend/src/app/pages/AgentChat/AgentChat.tsx b/frontend/src/app/pages/AgentChat/AgentChat.tsx
index 85830abb..5fc18742 100644
--- a/frontend/src/app/pages/AgentChat/AgentChat.tsx
+++ b/frontend/src/app/pages/AgentChat/AgentChat.tsx
@@ -966,9 +966,8 @@ const AgentChat: React.FC<AgentChatProps> = ({ sessionId: sessionIdProp, onClose
                 <Typography noWrap sx={{ color: c.text.primary, fontWeight: 600 }}>{session.name}</Typography>
                 {!isDraft && statusStyle && session.status !== 'completed' && session.status !== 'stopped' && (
                   // Status speaks only when it needs the user; finished work sits quiet.
-                  <Box sx={{ display: 'flex', alignItems: 'center', gap: 0.6, flexShrink: 0 }}>
-                    <Box sx={{ width: 6, height: 6, borderRadius: '50%', bgcolor: statusStyle.color, flexShrink: 0 }} />
-                    <Typography sx={{ fontSize: '0.75rem', fontWeight: 500, color: c.text.secondary, whiteSpace: 'nowrap' }}>
+                  <Box sx={{ display: 'flex', alignItems: 'center', flexShrink: 0 }}>
+                    <Typography sx={{ fontSize: '0.75rem', fontWeight: 500, color: c.text.tertiary, whiteSpace: 'nowrap' }}>
                       {friendlyStatusLabel(session.status)}
                     </Typography>
                   </Box>