Always approve on a held friend reply turns on a hidden home-wide Auto-send: no way to see or undo it on the approver's home; three names for one setting #417

Summary

On a held friend reply, Always approve turns on a standing Auto-send that the approver (A) can never see or turn off again. It is also wider than the card says (the whole friend home, not the Chief → Chief pair), and the same idea has three names: Always approve (card), Auto-send (toast), and Auto-send to SelfA1238 (a checkbox on the other home that means something else).

Environment

• FlyBot main a7f51e83ffacc4a6e803669d25fdc9e40eef6c44 (Add friend: accept and invite as two labelled groups, Done at the bottom #416), core + plugins/social + plugins/tree on @deepseek-ai/dsh@0.2.0-rc.2, Node 24.21.0.
• Two fresh installs on one Linux box: A :3090 (owner SelfA1238, @selfa1238.home) and B :3091 (owner SelfB1238, @selfb1238.home). Bot Social prod https://47-80-69-220.sslip.io. Both Chiefs on ark/deepseek-v4-flash (real model).
• Friend link: A made a per-Bot invite for A's Chief; B joined it, talking through B's Chief (relationship rel_01M597ETM4MFYM90M80ER53J8G, grant grt_01M597ETM5PK3PNKGZ09R7PC96 → @selfb1238.home). B's Chief is not shared back (one-way per-Bot grant, by design Per-Bot grants leak: accepting a Helper invite exposes the joiner's Chief; face-room Chief shows in Friends' Bots; Manage access wrong/raw #138/Regression of #138: joining a friend's invite still puts the joiner's Chief on the inviter's main list #161). A's Chief = @chief.selfa1238.home, B's talk-through Bot = @chief.selfb1238.home.
• Auto-send was off on both homes at the start.
• Found by product self-test 2026-10-19 12:38 Asia/Shanghai, focus A Friend DM (browser run about 12:41–12:50 Asia/Shanghai). Screenshots stayed on the test machine; what they show is written out below.

Common setup (B talks to A's Chief)

On B, open the sidebar row for A's Chief (Chief + grey SelfA1238 + globe) and send, one at a time, waiting for each answer:

1. Hi Chief, this is B. What is 2+2? Reply in one short line. → A's Chief drafts 4.; on A click Reject.
2. Second test: what is 3+3? One line. → draft 6.; on A click Approve.
3. Third test: what is 4+4? One line. → draft 8.; on A click Always approve.
4. Fourth test: 5+5? One line. and Fifth test: 6+6? One line. → 10. and 12. go out without a card.

Repro

1. Run the common setup up to step 3. On A, on the card for 8., click Always approve.
2. Read the toast. Then send the 4th and 5th lines from B and watch A.
3. On A, look for a way to see or undo the choice: Settings → Bots → Chief (all sections, including Sharing → People with access; click the person row), Settings → Bot Social, every other Settings section, and the chat details panel.
4. On B, open the friend's Bot settings sheet (gear on the Chief SelfA1238 row).

Actual

• Toast on A: Auto-send on for Chief → Chief. Change it anytime in settings.
• 10. and 12. leave A with no card and nothing marking them as auto-sent. Screenshot 09-A-fourth-autosent-no-indicator.png: A with Settings → Bots → Chief open over the chat; the sidebar row preview reads 10.; no card, no marker anywhere.
• No place on A shows or turns off this choice. Chief → Sharing shows Invite grants Chief only. Revoke anytime in People with access. and People with access SelfB1238 (@selfb1238.home) with Revoke only; clicking the person row does nothing. Screenshot 10-A-sharing-no-autosend-control.png: that Sharing card, no Auto-send control. The toast's "Change it anytime in settings" is not true for A.
• The toast and card say Chief → Chief. The second Chief is B's talk-through Bot; the person who receives the line is SelfB1238.
• On B, the friend's Bot settings sheet for A's Chief has an unchecked checkbox Auto-send to SelfA1238. It is a third label for a related but different switch (B's own Bots → A's home). With it unchecked, B's typed lines still went out at once, so a user cannot tell what it holds.
• Local API (read-only) on A: flybot/social/settings → {"autoAccept":{"@selfb1238.home":true},"autoApproveFaceRooms":false}. So the choice is stored per friend home, not per Bot pair.

Why (code read on a7f51e8; hunch, not stepped in a debugger)

• plugins/social/src/social.js enableAutoSendForItem (~L2189) → setAutoAccept(home, true) (~L2150): writes settings.autoAccept["@selfb1238.home"] to <home>/.dsh/bot/flybot-social-settings.json and calls serverAutoApprove for every active relationship with that home, on every local identity. That covers all of A's Bots → all of SelfB1238's Bots.
• The only UI toggle for autoAccept is the friend's Bot settings sheet (plugins/social/client.js ~L1690, Auto-send to ${who}), which exists only for a friend's Bot shared to me. With the default one-way grant, A has no friend's Bot from B, so A has no toggle at all.
• Toast text: autoSendToast (plugins/social/client.js L875). Card link text: ChatApproval (~L930). The pair label comes from holdParties (item.toName = B's talk-through Bot name).

Expected (FlyBot design: per-Bot grants, explicit buttons only, simplicity/consistency)

• One term for the standing choice, the same on the card, the toast and the setting. Suggestion: Auto-send everywhere; the card link reads Auto-send from now on (or keep Always approve and name the setting Always approve; either, but one).
• Visible and reversible on the approver's home. In Settings → Bots → → Sharing → People with access, each person row shows its Auto-send state with a toggle (default off), next to Revoke. Turning it off brings back the card on the next reply.
• Scope matches the words. Either the switch is per (my Bot → person) pair, as the card implies and per-Bot grants suggest, or the card/toast/setting say plainly it covers all my Bots to that person. Maintainer call; the per-pair version needs the stored key to include the local Bot.
• Name the person, not their Bot: toast like Auto-send is on for Chief → SelfB1238. Turn it off in Chief → Sharing → People with access. (exact path to the control).
• Auto-sent replies get a quiet marker on the approver's side (for example a small Auto-sent meta line or tooltip on the bubble), so the owner can tell they skipped approval.
• B's checkbox: copy that says what it does (for example Auto-send my Bots' replies to SelfA1238, with a one-line hint), or remove it if it has no effect for a person's typed lines.
• Approval stays an explicit button click only ([Feature RFC] Agent inbox board: one place for tasks, approvals and failures (personal first, team second) #349); nothing here adds a chat-reply path.

Suggested scope / files

• plugins/social/client.js: autoSendToast (L875), ChatApproval (~L900–931), People with access (~L1626), friend settings Auto-send to … (~L1690).
• plugins/social/src/social.js: enableAutoSendForItem (~L2189), setAutoAccept (~L2150), social/settings (~L2170; it already returns autoAccept per home) and the grant/People with access view so each person row can carry its Auto-send state.
• docs/subsystems/social.md (lines saying "Per-friend Auto-send is on that Bot's settings") and README "Approvals" paragraph.
• Tests in plugins/social/test/social.test.js.

Acceptance criteria

• After Always approve (or its renamed link) on A, A's Chief → Sharing → People with access shows SelfB1238 … Auto-send on with a working toggle; turning it off makes the next reply show a card again.
• The card, the toast and the setting use the same term; the toast names the person (SelfB1238) and the exact place to change it.
• The stored scope matches the copy (per pair, or copy says "all your Bots").
• An auto-sent reply is marked as such on A.
• B's friend-Bot checkbox copy says what it covers (or is removed).
• Unit tests for the new People with access state and the toggle round trip.

Related: #226, #271 (Always approve placement), #384 (naming), #349 (buttons only), #404.