From 475785f0931003387a1949d98105a0e23ed0d7a7 Mon Sep 17 00:00:00 2001
From: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Date: Sun, 18 Oct 2026 17:14:59 +0200
Subject: [PATCH] fix(web): disclose diagnostic backup access before consent

---
 .changeset/diagnostic-access-consent.md | 5 +++++
 web/index.html                          | 2 +-
 web/settings/tabs/access.js             | 2 +-
 web/settings/tabs/access.test.mjs       | 7 +++++++
 4 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/diagnostic-access-consent.md

diff --git a/.changeset/diagnostic-access-consent.md b/.changeset/diagnostic-access-consent.md
new file mode 100644
index 000000000..9e01e5035
--- /dev/null
+++ b/.changeset/diagnostic-access-consent.md
@@ -0,0 +1,5 @@
+---
+"ftw": patch
+---
+
+The Access page states that technical diagnostics include source, logs and full backups, which can contain saved credentials, before the owner grants access.
diff --git a/web/index.html b/web/index.html
index aba81f627..0b459f479 100644
--- a/web/index.html
+++ b/web/index.html
@@ -1004,7 +1004,7 @@ <h3>Price bars (top of the chart)</h3>
   <script src="/settings/tabs/planner.js?v=cvxpy1"></script>
   <script src="/settings/tabs/ha.js?v=modbusproxy2"></script>
   <script src="/settings/tabs/app.js?v=terms2"></script>
-  <script src="/settings/tabs/access.js?v=access2"></script>
+  <script src="/settings/tabs/access.js?v=access3"></script>
   <script src="/settings/tabs/fleet.js?v=terms2"></script>
   <script src="/settings/tabs/notifications.js?v=tabsplit2"></script>
   <script src="/settings/tabs/ev.js?v=tabsplit2"></script>
diff --git a/web/settings/tabs/access.js b/web/settings/tabs/access.js
index d4738d5a9..1b0fa458e 100644
--- a/web/settings/tabs/access.js
+++ b/web/settings/tabs/access.js
@@ -33,7 +33,7 @@
     "ftw.events.read": "See alerts and events",
     "ftw.logs.read": "Read the box's logs, with names and secrets taken out",
     "ftw.config.read": "Read the settings, with names and secrets taken out",
-    "ftw.diag.run": "Run checks that change nothing",
+    "ftw.diag.run": "Read full technical diagnostics, source, logs and backups; backups can contain saved credentials",
     "ftw.dispatch.hold": "Act at once, for a few minutes at a time, within these limits",
     "ftw.goals.request": "Ask for lasting changes, each waiting for your yes here",
   };
diff --git a/web/settings/tabs/access.test.mjs b/web/settings/tabs/access.test.mjs
index 64027e71d..b9e15d372 100644
--- a/web/settings/tabs/access.test.mjs
+++ b/web/settings/tabs/access.test.mjs
@@ -61,6 +61,13 @@ describe("the page's words follow the registry", () => {
     for (const scope of Object.keys(P.SCOPE_WORDS)) assert.ok(agentScopes.includes(scope), scope);
   });
 
+  it("warns that diagnostic access reads full backups that can contain saved credentials", () => {
+    const words = P.SCOPE_WORDS["ftw.diag.run"];
+    assert.match(words, /full technical diagnostics, source, logs and backups/);
+    assert.match(words, /backups can contain saved credentials/);
+    assert.doesNotMatch(words, /checks that change nothing/);
+  });
+
   it("has words for every op an assistant may name", () => {
     assert.ok(agentOps.length >= 5);
     for (const op of agentOps) assert.ok(P.OP_WORDS[op], op);