nvrsion: Add re-sync from dev for VERSION and adjust Appcast releases; fix permission flow by removing the “allow always” button from approval views and docs; fix build script error by removing obsolete sh dependency from Makefile.

Nucleic-Promote: 1 Co-authored-by: Nucleic <[email protected]>
2026-07-03 18:57:19 -07:00
parent b0284f1da1
commit 6a268abbb9
1 changed files with 4 additions and 1 deletions
@@ -76,7 +76,10 @@ struct ApprovalCardView: View {
                .disabled(!allowEnabled)
            }

-            if !store.capabilities.allowAlwaysScopes.isEmpty {
+            // A destructive action (rm, force-push, reset --hard, …) offers no remembered
+            // allow: every one must be a deliberate, one-off approval, never granted in a
+            // way that lets the next one through unseen. Mirrors the Mac.
+            if approval.risk != .destructive, !store.capabilities.allowAlwaysScopes.isEmpty {
                Menu("Allow always…") {
                    ForEach(store.capabilities.allowAlwaysScopes, id: \.self) { scope in
                        Button(alwaysLabel(scope)) {