feat(ui): add the scoped-permissions confirmation step to the install flow

[shin-core]

What

Adds the scoped-permissions confirmation step to the self-serve install flow — a new /install/permissions route that is the third step (“Confirm scoped permissions”) of the signup → install → confirm flow described in #4802. Before a customer finishes the GitHub install, this page shows exactly which repository permissions the LoopOver App requests, and why, so the grant on GitHub holds no surprises.

This is a scoped slice of #4802, continuing the /install entry surface (#7203) whose third step previously pointed only to a follow-up. That step now links here.

Details

• /install/permissions (install.permissions.tsx) lists the real permission set, grouped:
  • Baseline access (always requested): Metadata (read), Pull requests (read), Issues (write).
  • Opt-in write scopes (only when the matching setting is on): Checks (write), Pull requests (write), Contents (write), each with the setting that enables it.
  • Events it listens for: issues, issue_comment, pull_request, repository.
  • A “You stay in control” safety callout linking to privacy & security.
• The permission set mirrors the canonical REQUIRED_INSTALLATION_PERMISSIONS / OPTIONAL_CHECK_RUN_PERMISSION / OPTIONAL_PR_WRITE_PERMISSION / OPTIONAL_CONTENTS_WRITE_PERMISSION / REQUIRED_INSTALLATION_EVENTS constants in src/github/backfill.ts (the same source install-health checks against), so it stays accurate rather than fabricated.
• /install is split into a thin layout (install.tsx, renders an <Outlet />) plus its index page (install.index.tsx, the existing three-step surface, unchanged in content) so /install and /install/permissions render as sibling pages under the shared path — the same layout/index pattern app.tsx/app.index.tsx and docs.tsx already use. The regenerated routeTree.gen.ts reflects only these two new routes.
• The /install step-3 card now links to the new page (“Review the exact scopes →”).

Built on the shared design-system primitives (Section, Card, Callout, Eyebrow, design tokens) per the issue’s design-system boundary. Read-only informational surface: reads no secrets, changes no auth backend; the real grant still happens on GitHub.

Validation

• npm run ui:typecheck, npm run ui:lint — pass.
• Existing install.test.tsx updated for the moved InstallPage import and passing; full UI test suite green (one unrelated REES-analyzer test is a resource-contention timeout that passes in isolation).
• git diff --check clean; the diff is exactly the five install-flow files (no doc/openapi churn).

UI Evidence

Confirm scoped permissions (/install/permissions)	Mobile	Install entry, step-3 link

Closes #4802

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-20 05:46:45 UTC}

5 files · no blockers · CI green · unstable

⏸️ Suggested Action - Manual Review

• AI review already in progress for this PR head: Another LoopOver pass is already running the AI review for this exact PR head. This pass is skipping to avoid a duplicate LLM call.

Review summary
AI review is already running for this PR head in another LoopOver pass. LoopOver is holding this PR for manual review until that pass completes.

Nits — 2 non-blocking

• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.
• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.

Flagged checks (non-blocking)

• Contributor trust — Contributor flagged for review

Decision drivers

• ✅ Code review — No blockers (No AI review summary)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#4802
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 75 registered-repo PR(s), 48 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	shin-core; Gittensor profile; 75 PR(s), 0 issue(s).
Improvement	ℹ️ None detected	risk: low · value: none

Review context

• Author: shin-core
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, JavaScript, Solidity, Dart, Python, CSS, PHP, Rust
• Official Gittensor activity: 75 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/install	desktop	before /install	after /install	—
/install	mobile	before /install (mobile)	after /install (mobile)	—
/install/permissions	desktop	before /install/permissions	after /install/permissions	—
/install/permissions	mobile	before /install/permissions (mobile)	after /install/permissions (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

Scroll preview

Route	Before (production)	After (this PR's preview)
/install	before /install (scroll)	after /install (scroll)
/install/permissions	before /install/permissions (scroll)	after /install/permissions (scroll)

A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

This pull request changes UI/visual code but its screenshot evidence is incomplete. Every required viewport × theme combination needs its own before/after image pair in a labeled table row (e.g. "Desktop · Light | before | after"). Still missing: Desktop · Dark, Tablet · Dark, Mobile · Dark.

Please resubmit with the remaining rows filled in.

See https://github.com/JSONbored/loopover/blob/main/.claude/skills/contributing-to-loopover/SKILL.md for the exact format and examples. This is an automated maintenance action.