fix(tui): replace permission_request double-unwrap with pattern match

Closes the concrete Phase 4 'permissions hardening' defect flagged by
the audit at app.rs:5806-5812.

`handle_permission_key` bound `pr = self.permission_request.as_mut()`
once at the top of the function, then re-borrowed `.as_mut().unwrap()`
twice more inside the Up and Down arms. The audit called this out as
high-severity because:
  * the dialog can be cleared between key events (e.g. a tool result
    resolves the request from the model side), and
  * the inner unwrap would panic the TUI on what should be a no-op
    Up/Down keystroke against a dialog that just went away.

Both arms now pattern-match via `if let Some(pr) = self.permission_request.as_mut()`
per AGENTS.md's rule "No `.unwrap()` / `.expect()` on fallible operations
in production paths — propagate via Result or pattern-match." The Up
and Down handlers silently no-op when no dialog is active, which is
the correct behaviour: there is nothing to navigate.

Two regression tests added in claurst-tui:
  * arrow_keys_do_not_panic_without_permission_dialog — handles the
    audit scenario directly: a stray Up/Down with no active dialog.
    Before this fix that would have panicked the second unwrap.
  * arrow_keys_navigate_permission_dialog_selection — pins the
    bound-saturation behaviour with a real PermissionRequest, walking
    past index 0 and the last index in both directions.

All four verification gates clean at v0.0.14:
  cargo fmt --all -- --check  ✅
  cargo check --workspace      ✅
  cargo clippy -- -D warnings  ✅
  cargo test --workspace       ✅ 1549 passing, 0 failing
                                  (+2 net new tests)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: BunsDev

src-rust/crates/tui/src/app.rs

@@ -5880,15 +5880,21 @@ impl App {
                 self.permission_request = None;
             }
             KeyCode::Up => {
-                let pr = self.permission_request.as_mut().unwrap();
-                if pr.selected_option > 0 {
-                    pr.selected_option -= 1;
+                // Pattern-match instead of `.as_mut().unwrap()`: the
+                // permission_request can be cleared between key events
+                // (e.g. by a model-side cancellation), so we must not
+                // panic when the dialog has gone away.
+                if let Some(pr) = self.permission_request.as_mut() {
+                    if pr.selected_option > 0 {
+                        pr.selected_option -= 1;
+                    }
                 }
             }
             KeyCode::Down => {
-                let pr = self.permission_request.as_mut().unwrap();
-                if pr.selected_option + 1 < pr.options.len() {
-                    pr.selected_option += 1;
+                if let Some(pr) = self.permission_request.as_mut() {
+                    if pr.selected_option + 1 < pr.options.len() {
+                        pr.selected_option += 1;
+                    }
                 }
             }
             KeyCode::Esc => {

src-rust/crates/tui/src/lib.rs

@@ -1575,4 +1575,54 @@ mod tests {
         assert_eq!(pr.options[2].key, 'p');
         assert_eq!(pr.options[3].key, 'n');
     }
+
+    /// Regression: the audit flagged a double-unwrap in
+    /// `handle_permission_key`'s Up/Down arms. If the dialog was cleared
+    /// between the outer `as_mut()` bind and the inner `.as_mut().unwrap()`
+    /// (e.g. a tool result resolved the request), the second unwrap would
+    /// panic the TUI. Now those branches pattern-match and silently no-op.
+    /// This test pins the no-panic contract by handling Up/Down with no
+    /// active permission dialog.
+    #[test]
+    fn arrow_keys_do_not_panic_without_permission_dialog() {
+        let mut app = make_app();
+        assert!(app.permission_request.is_none());
+        // Either branch could have panicked before the fix.
+        app.handle_key_event(key(KeyCode::Up));
+        app.handle_key_event(key(KeyCode::Down));
+        // No assertion needed — surviving these calls is the assertion.
+    }
+
+    /// Up/Down with an active dialog adjusts `selected_option` correctly
+    /// and saturates at the bounds.
+    #[test]
+    fn arrow_keys_navigate_permission_dialog_selection() {
+        let mut app = make_app();
+        let mut pr = PermissionRequest::standard(
+            "tu_test".to_string(),
+            "Bash".to_string(),
+            "Run a command".to_string(),
+        );
+        pr.selected_option = 0;
+        app.permission_request = Some(pr);
+
+        app.handle_key_event(key(KeyCode::Down));
+        assert_eq!(app.permission_request.as_ref().unwrap().selected_option, 1);
+        app.handle_key_event(key(KeyCode::Down));
+        assert_eq!(app.permission_request.as_ref().unwrap().selected_option, 2);
+        app.handle_key_event(key(KeyCode::Up));
+        assert_eq!(app.permission_request.as_ref().unwrap().selected_option, 1);
+
+        // Saturation: walking past index 0 should stay at 0.
+        app.handle_key_event(key(KeyCode::Up));
+        app.handle_key_event(key(KeyCode::Up));
+        app.handle_key_event(key(KeyCode::Up));
+        assert_eq!(app.permission_request.as_ref().unwrap().selected_option, 0);
+
+        // Saturation at the end too — 4 options, max index 3.
+        for _ in 0..10 {
+            app.handle_key_event(key(KeyCode::Down));
+        }
+        assert_eq!(app.permission_request.as_ref().unwrap().selected_option, 3);
+    }
 }