fix(permissions): user settings tier follows $CLAWCODEX_CONFIG_DIR; say what the approval menu changes

[agentforce314]

Two findings from tracing why a desktop session still asked for approval after Full Access became the default in #819.

The prompt itself was not a bug: Full Access is a floor, and a persisted permissions.defaultMode outranks it by design. The affected machine had {"permissions":{"defaultMode":"default"}} in ~/.clawcodex/settings.json, written by selecting a level in the desktop's approval-mode (⚡) menu.

user_settings_path() ignored the config-dir override

It hardcoded ~/.clawcodex/settings.json, so a config dir relocated with $CLAWCODEX_CONFIG_DIR kept answering permission, hook, trust-boundary, startup-gate and config-health questions from the default home — while that profile's sessions, transcripts and config lived somewhere else. It now resolves through get_user_config_dir() like everything else.

The project tier deliberately does not move: it is scoped to the workspace, and relocating the config home must not start reading a repo's rules from elsewhere. There's a test for that.

The ⚡ menu changed clawcodex everywhere, silently

Selecting a level writes permissions.defaultMode into that same user tier — the one the CLI and TUI read. So one click in a toolbar dropdown became the default for every future session, in every directory, on every surface, with nothing on screen saying so.

Persisting is worth keeping. The backend comment is right that someone who deliberately steps down to "ask every time" should not be silently returned to Full Access next launch — making the menu transient would reintroduce that. The problem is disclosure, not persistence: /permissions in the TUI makes this obvious by being something you deliberately type; a dropdown next to the model chip does not. So the menu now states its scope.

I checked that nothing writes on its own: the renderer's mount effect only calls config.get, the backend never persists a mode at startup (set_settings_default_mode is reached only when persist is set), and the sole writer is the menu's onValueChange.

Testing

• New tests/test_permission_settings_paths.py — override honored, ~ expanded, home default, project tier unmoved. It binds the real function at import time because conftest.py has an autouse fixture that monkeypatches this path.
• New menu test asserting the scope note renders.
• Full Python suite: 9905 passed, 15 skipped. (One unrelated flake, test_bg_bash_completion_notifies_the_model, passes standalone and with its whole file — it is ordering-sensitive in the full run and untouched by this change.)
• tsc --noEmit clean; locale strings added for en/zh/zh-hant/ja (ar omits this block and falls back).

🤖 Generated with Claude Code