feat(ui): add the scoped-permissions confirmation step to the install flow

[shin-core]

What

Adds the scoped-permissions confirmation step to the self-serve install flow — a new /install/permissions route that is the third step (“Confirm scoped permissions”) of the signup → install → confirm flow described in #4802. Before a customer finishes the GitHub install, this page shows exactly which repository permissions the LoopOver App requests, and why, so the grant on GitHub holds no surprises.

This is a scoped slice of #4802, continuing the /install entry surface (#7203) whose third step previously pointed only to a follow-up. That step now links here.

Details

• /install/permissions (install.permissions.tsx) lists the real permission set, grouped:
  • Baseline access (always requested): Metadata (read), Pull requests (read), Issues (write).
  • Opt-in write scopes (only when the matching setting is on): Checks (write), Pull requests (write), Contents (write), each with the setting that enables it.
  • Events it listens for: issues, issue_comment, pull_request, repository.
  • A “You stay in control” safety callout linking to privacy & security.
• The permission set mirrors the canonical REQUIRED_INSTALLATION_PERMISSIONS / OPTIONAL_CHECK_RUN_PERMISSION / OPTIONAL_PR_WRITE_PERMISSION / OPTIONAL_CONTENTS_WRITE_PERMISSION / REQUIRED_INSTALLATION_EVENTS constants in src/github/backfill.ts (the same source install-health checks against), so it stays accurate rather than fabricated.
• /install is split into a thin layout (install.tsx, renders an <Outlet />) plus its index page (install.index.tsx, the existing three-step surface, unchanged in content) so /install and /install/permissions render as sibling pages under the shared path — the same layout/index pattern app.tsx/app.index.tsx and docs.tsx already use. The regenerated routeTree.gen.ts reflects only these two new routes.
• The /install step-3 card now links to the new page (“Review the exact scopes →”).

Built on the shared design-system primitives (Section, Card, Callout, Eyebrow, design tokens) per the issue’s design-system boundary. Read-only informational surface: reads no secrets, changes no auth backend; the real grant still happens on GitHub.

Validation

• npm run ui:typecheck, npm run ui:lint — pass.
• Existing install.test.tsx updated for the moved InstallPage import and passing; full UI test suite green.
• git diff --check clean; the diff is exactly the five install-flow files (no doc/openapi churn).

UI Evidence

/install/permissions is a new route, so before is the app’s Not-Found state at that path and after is the new page. loopover-ui is a dark-mode-only build (theme-toggle.tsx — the toggle was removed and there is no light theme to force), so Dark is the only theme dimension; each viewport is shown below.

Viewport	Before (Not Found)	After (/install/permissions)
Desktop · Dark (1280×800)
Tablet · Dark (768×1024)
Mobile · Dark (375×812)

Closes #4802

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-20 06:46:05 UTC}

6 files · 1 AI reviewer · no blockers · CI green · unstable

⏸️ Suggested Action - Manual Review

Review summary
This is a clean, well-scoped UI addition: it splits `/install` into a layout + index (mirroring the existing `app.tsx`/`app.index.tsx` pattern) and adds a new `/install/permissions` route whose content mirrors the canonical permission/event constants in `src/github/backfill.ts`. The routeTree.gen.ts diff is consistent with adding two child routes under `/install`, and the moved `InstallPage` export is correctly re-imported in install.test.tsx. The only real gap is that the new install.permissions.tsx page (97 lines, multiple data tables) ships with no test file, while the pre-existing install.test.tsx was only patched for the import path change.

Nits — 5 non-blocking

• apps/loopover-ui/src/routes/install.permissions.tsx has no dedicated test file (only install.index.tsx's existing test was updated), so the new page's rendering of REQUIRED_SCOPES/OPTIONAL_SCOPES/EVENTS is unverified by tests — the AI-branded 'LoopOver Orb Review Agent' wording in the Checks scope summary (line ~92) is also a specific claim worth double-checking against current product naming.
• apps/loopover-ui/src/routeTree.gen.ts uses `as any` casts (pre-existing pattern for generated route files, not introduced logic, but worth confirming this file is truly fully regenerated rather than hand-edited).
• apps/loopover-ui/src/routes/install.index.tsx:56 and install.permissions.tsx:122 — both page components are large single-function components (~84–97 lines); consider extracting the STEPS/REQUIRED_SCOPES/OPTIONAL_SCOPES render blocks into small subcomponents for readability, though this matches the existing site-page style so it's optional.
• The permission summaries (e.g., Issues:Write enabling PR comments/labels) are asserted to mirror `src/github/backfill.ts` constants but that file isn't shown in this diff — worth a maintainer double-check that the six scopes/four events listed are exhaustive and currently accurate.
• Add a minimal render test for InstallPermissionsPage (e.g., asserting the three baseline scopes, three optional scopes, and four event badges render) alongside the updated install.index.test.tsx, given this page is pure content with no dynamic data — cheap to cover and guards against future drift from backfill.ts.

Flagged checks (non-blocking)

• Contributor trust — Contributor flagged for review

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#4802
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 75 registered-repo PR(s), 48 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	shin-core; Gittensor profile; 75 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Review context

• Author: shin-core
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, JavaScript, Solidity, Dart, Python, CSS, PHP, Rust
• Official Gittensor activity: 75 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/install	desktop	before /install	after /install	—
/install	mobile	before /install (mobile)	after /install (mobile)	—
/install/permissions/test	desktop	before /install/permissions/test	after /install/permissions/test	—
/install/permissions/test	mobile	before /install/permissions/test (mobile)	after /install/permissions/test (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

Scroll preview

Route	Before (production)	After (this PR's preview)
/install	before /install (scroll)	after /install (scroll)
/install/permissions/test	before /install/permissions/test (scroll)	after /install/permissions/test (scroll)

A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.