@gotgenes/pi-permission-system 25.2.2 → 25.3.0

package/src/config-schema.ts

@@ -194,6 +194,20 @@ export const unifiedConfigSchema = z
         "How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds.\n\nOmit to use the default (`600000`, ten minutes). A child whose in-process parent is not draining its inbox at all gives up in a couple of seconds regardless of this value, so lower it only to bound how long you are willing to leave an *unanswered* prompt pending.",
       default: 600000,
     }),
+    promptMaxRows: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",
+      markdownDescription:
+        "Maximum rows a permission prompt renders before eliding its evidence.\n\nOmit to use the default (24). The request's own facts — the requesting agent, the tool, the matched rule, the decision-relevant value — are never elided by this budget; what gives way is the supporting evidence, and `Ctrl+O` expands the prompt to the complete request.",
+      default: 24,
+    }),
+    promptFieldMaxWidth: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum characters of any one field shown in a permission prompt. Omit to use the default (400).",
+      markdownDescription:
+        "Maximum characters of any one field shown in a permission prompt.\n\nOmit to use the default (400). This is what bounds a single pathological field — a long here-string command, say — that would otherwise fill the prompt through wrapping. A shortened field is marked with an ellipsis, and `Ctrl+O` shows it in full.",
+      default: 400,
+    }),
     toolInputPreviewMaxLength: z.number().int().min(1).optional().meta({
       description:
         "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",

package/src/extension-config.ts

@@ -22,6 +22,10 @@ export interface PermissionSystemExtensionConfig {
   piInfrastructureReadPaths?: string[];
   /** How long a subagent waits for the parent's answer to a forwarded ask, in ms. Defaults to 600000. */
   forwardingTimeoutMs?: number;
+  /** Max rows a permission prompt renders before eliding its evidence. Defaults to 24. */
+  promptMaxRows?: number;
+  /** Max characters of any one field shown in a permission prompt. Defaults to 400. */
+  promptFieldMaxWidth?: number;
   /** Max length of the inline-JSON input preview shown in permission prompts. Defaults to 200. */
   toolInputPreviewMaxLength?: number;
   /** Max length of inline pattern/path summaries (grep/find/ls) in permission prompts. Defaults to 80. */
@@ -76,6 +80,12 @@ export function normalizePermissionSystemConfig(
   if (raw.forwardingTimeoutMs !== undefined) {
     result.forwardingTimeoutMs = raw.forwardingTimeoutMs;
   }
+  if (raw.promptMaxRows !== undefined) {
+    result.promptMaxRows = raw.promptMaxRows;
+  }
+  if (raw.promptFieldMaxWidth !== undefined) {
+    result.promptFieldMaxWidth = raw.promptFieldMaxWidth;
+  }
   if (raw.toolInputPreviewMaxLength !== undefined) {
     result.toolInputPreviewMaxLength = raw.toolInputPreviewMaxLength;
   }

package/src/handlers/gates/bash-command.ts

@@ -83,7 +83,7 @@ export function resolveBashCommandCheck(
       input: { command: cmd.text },
       agentName,
     });
-    const result =
+    const floored =
       cmd.wrapperKind && base.state === "allow"
         ? {
             ...base,
@@ -91,7 +91,12 @@ export function resolveBashCommandCheck(
             matchedPattern: WRAPPER_SENTINEL[cmd.wrapperKind],
           }
         : base;
-    return cmd.context ? { ...result, commandContext: cmd.context } : result;
+    const result = cmd.context
+      ? { ...floored, commandContext: cmd.context }
+      : floored;
+    return cmd.executedUnit === undefined
+      ? result
+      : { ...result, executedUnit: cmd.executedUnit };
   });
   return (
     pickMostRestrictive(results) ??

package/src/handlers/gates/bash-external-directory.ts

@@ -1,9 +1,10 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { GateResult } from "./descriptor";
-import { formatBashExternalDirectoryAskPrompt } from "./external-directory-messages";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
@@ -76,12 +77,15 @@ export function describeBashExternalDirectoryGate(
     resolvedPath: path.resolvedAlias(),
   }));
 
-  const bashExtMessage = formatBashExternalDirectoryAskPrompt(
+  const payload = buildBashExternalDirectoryAskPayload({
     command,
-    disclosures,
-    tcc.cwd,
-    tcc.agentName ?? undefined,
-  );
+    externalPaths: disclosures,
+    cwd: tcc.cwd,
+    agentName: tcc.agentName,
+    toolName: tcc.toolName,
+    matchedPattern: preCheck.matchedPattern,
+  });
+  const bashExtMessage = renderLegacyMessage(payload);
 
   const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
 
@@ -100,6 +104,7 @@ export function describeBashExternalDirectoryGate(
       source: "tool_call",
       agentName: tcc.agentName,
       message: bashExtMessage,
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,

package/src/handlers/gates/bash-path.ts

@@ -1,13 +1,14 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";
-import { formatPathAskPrompt } from "./path";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -113,11 +114,13 @@ export function describeBashPathGate(
   // path), so it matches the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
   const pattern = deriveApprovalPattern(worstEntry.path.value());
-  const askMessage = formatPathAskPrompt(
-    tcc.toolName,
-    worstToken,
-    tcc.agentName ?? undefined,
-  );
+  const payload = buildPathAskPayload({
+    toolName: tcc.toolName,
+    pathValue: worstToken,
+    agentName: tcc.agentName,
+    matchedPattern: worstCheck.matchedPattern,
+  });
+  const askMessage = renderLegacyMessage(payload);
 
   return {
     surface: "path",
@@ -133,6 +136,7 @@ export function describeBashPathGate(
       source: "tool_call",
       agentName: tcc.agentName,
       message: askMessage,
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,

package/src/handlers/gates/external-directory.ts

@@ -1,11 +1,12 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
-import { formatExternalDirectoryAskPrompt } from "./external-directory-messages";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
@@ -69,13 +70,6 @@ export function describeExternalDirectoryGate(
 
   // ── Build descriptor for permission check ───────────────────────────────
   const resolvedAlias = accessPath.resolvedAlias();
-  const extDirMessage = formatExternalDirectoryAskPrompt(
-    tcc.toolName,
-    externalDirectoryPath,
-    resolvedAlias,
-    tcc.cwd,
-    tcc.agentName ?? undefined,
-  );
 
   // The runner consumes this preCheck and skips its own resolve.
   const preCheck = resolveExternalDirectoryPolicy(
@@ -85,6 +79,16 @@ export function describeExternalDirectoryGate(
   );
   const pattern = deriveApprovalPattern(accessPath.value());
 
+  const payload = buildExternalDirectoryAskPayload({
+    toolName: tcc.toolName,
+    pathValue: externalDirectoryPath,
+    resolvedPath: resolvedAlias,
+    cwd: tcc.cwd,
+    agentName: tcc.agentName,
+    matchedPattern: preCheck.matchedPattern,
+  });
+  const extDirMessage = renderLegacyMessage(payload);
+
   return {
     surface: "external_directory",
     input: {},
@@ -102,6 +106,7 @@ export function describeExternalDirectoryGate(
       source: "tool_call",
       agentName: tcc.agentName,
       message: extDirMessage,
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: externalDirectoryPath,

package/src/handlers/gates/path.ts

@@ -1,6 +1,8 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
@@ -47,6 +49,13 @@ export function describePathGate(
   // the policy values a later call produces.
   const pattern = deriveApprovalPattern(accessPath.value());
 
+  const payload = buildPathAskPayload({
+    toolName: tcc.toolName,
+    pathValue: filePath,
+    agentName: tcc.agentName,
+    matchedPattern: check.matchedPattern,
+  });
+
   const descriptor: GateDescriptor = {
     surface: "path",
     input: { path: filePath },
@@ -60,11 +69,8 @@ export function describePathGate(
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: formatPathAskPrompt(
-        tcc.toolName,
-        filePath,
-        tcc.agentName ?? undefined,
-      ),
+      message: renderLegacyMessage(payload),
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: filePath,
@@ -86,12 +92,3 @@ export function describePathGate(
 
   return descriptor;
 }
-
-export function formatPathAskPrompt(
-  toolName: string,
-  pathValue: string,
-  agentName?: string,
-): string {
-  const subject = agentName ? `Agent '${agentName}'` : "Current agent";
-  return `${subject} requested tool '${toolName}' for path '${pathValue}'. Allow this path access?`;
-}

package/src/handlers/gates/skill-input.ts

@@ -1,4 +1,5 @@
-import { formatSkillAskPrompt } from "#src/permission-prompts";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildSkillAskPayload } from "#src/presentation/skill-ask-payload";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
 import { accessFactsFromValue } from "./helpers";
@@ -15,7 +16,8 @@ export function describeSkillInputGate(
   agentName: string | null,
   preCheck: PermissionCheckResult,
 ): GateDescriptor {
-  const message = formatSkillAskPrompt(skillName, agentName ?? undefined);
+  const payload = buildSkillAskPayload(skillName, agentName);
+  const message = renderLegacyMessage(payload);
   return {
     surface: "skill",
     input: { name: skillName },
@@ -29,6 +31,7 @@ export function describeSkillInputGate(
       source: "skill_input",
       agentName,
       message,
+      payload,
       skillName,
       accessIntent: accessFactsFromValue("skill", skillName),
     },

package/src/handlers/gates/skill-read.ts

@@ -1,5 +1,6 @@
 import type { PathNormalizer } from "#src/path-normalizer";
-import { formatSkillPathAskPrompt } from "#src/permission-prompts";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildSkillPathAskPayload } from "#src/presentation/skill-ask-payload";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
 import { toRecord } from "#src/value-guards";
@@ -42,11 +43,8 @@ export function describeSkillReadGate(
     return null;
   }
 
-  const skillReadMessage = formatSkillPathAskPrompt(
-    matchedSkill,
-    path,
-    tcc.agentName ?? undefined,
-  );
+  const payload = buildSkillPathAskPayload(matchedSkill, path, tcc.agentName);
+  const skillReadMessage = renderLegacyMessage(payload);
 
   return {
     surface: "skill",
@@ -61,6 +59,7 @@ export function describeSkillReadGate(
       source: "skill_read",
       agentName: tcc.agentName,
       message: skillReadMessage,
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       skillName: matchedSkill.name,

package/src/handlers/gates/tool.ts

@@ -6,7 +6,8 @@ import {
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
 import { suggestSessionPattern } from "#src/pattern-suggest";
-import { formatAskPrompt } from "#src/permission-prompts";
+import { renderLegacyMessage } from "#src/presentation/legacy-message";
+import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
@@ -72,12 +73,15 @@ export function describeToolGate(
     deriveSuggestionValue(gateSurface, check, accessPath),
   );
 
-  const askMessage = formatAskPrompt(
+  const payload = buildToolAskPayload({
     check,
-    tcc.agentName ?? undefined,
-    tcc.input,
+    agentName: tcc.agentName,
+    surface: gateSurface,
+    invokedToolName: tcc.toolName,
+    input: tcc.input,
     formatter,
-  );
+  });
+  const askMessage = renderLegacyMessage(payload);
 
   const decisionValue = deriveDecisionValue(
     gateSurface,
@@ -108,6 +112,7 @@ export function describeToolGate(
       source: "tool_call",
       agentName: tcc.agentName,
       message: askMessage,
+      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       sessionLabel: suggestion.label,

package/src/index.ts

@@ -38,6 +38,7 @@ import { PermissionManager } from "./permission-manager";
 import { PermissionResolver } from "./permission-resolver";
 import { PermissionSession } from "./permission-session";
 import { LocalPermissionsService } from "./permissions-service";
+import { resolveRenderBudget } from "./presentation/dialog-renderer";
 import { PermissionServiceLifecycle } from "./service-lifecycle";
 import { PermissionSessionLogger } from "./session-logger";
 import { SessionRules } from "./session-rules";
@@ -115,6 +116,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     events: pi.events,
     getPromptPreferences: () => ({
       doublePressToConfirm: configStore.current().doublePressToConfirm,
+      budget: resolveRenderBudget(configStore.current()),
     }),
     requestPermissionDecision,
     forwardingDir: paths.forwardingDir,

package/src/permission-prompts.ts

@@ -1,13 +1,8 @@
-import { classifyToolKind, isMcpCheck } from "./access-intent/tool-kind";
-import { matchQualifier } from "./denial-messages";
-import type { SkillPromptEntry } from "./skill-prompt-sanitizer";
-import type { ToolPreviewFormatter } from "./tool-preview-formatter";
-import type { PermissionCheckResult } from "./types";
-import { getNonEmptyString, toRecord } from "./value-guards";
+import { classifyToolKind } from "./access-intent/tool-kind";
 
-// NOTE: formatDenyReason, formatUserDeniedReason, and
-// formatPermissionHardStopHint have been moved to denial-messages.ts.
-// This module retains only pre-check messages and user-facing ask prompts.
+// NOTE: the ask prompts are now payload builders under src/presentation/;
+// denial text lives in denial-messages.ts. This module retains only the
+// pre-check reasons, which are agent-facing rather than user-facing.
 
 export function formatMissingToolNameReason(): string {
   return "Tool call was blocked because no tool name was provided. Use a registered tool name from pi.getAllTools().";
@@ -29,66 +24,3 @@ export function formatUnknownToolReason(
 
   return `Tool '${toolName}' is not registered in this runtime and was blocked before permission checks.${mcpHint} Registered tools: ${availableList}.`;
 }
-
-export function formatAskPrompt(
-  result: PermissionCheckResult,
-  agentName?: string,
-  input?: unknown,
-  formatter?: ToolPreviewFormatter,
-): string {
-  const subject = agentName ? `Agent '${agentName}'` : "Current agent";
-
-  if (classifyToolKind(result.toolName) === "bash") {
-    const subCommand = result.command ?? "";
-    const qualifier = matchQualifier(
-      result.matchedPattern,
-      result.commandContext,
-    );
-    const qualifierInfo = qualifier ? ` ${qualifier}` : "";
-    const fullCommand = getNonEmptyString(toRecord(input).command);
-    const fullCommandInfo =
-      fullCommand && fullCommand !== subCommand
-        ? ` (full command: '${fullCommand}')`
-        : "";
-    return `${subject} requested bash command '${subCommand}'${qualifierInfo}${fullCommandInfo}. Allow this command?`;
-  }
-
-  if (isMcpCheck(result) && result.target) {
-    const patternInfo = result.matchedPattern
-      ? ` (matched '${result.matchedPattern}')`
-      : "";
-    const mcpPreview = formatter
-      ? formatter.formatToolInputForPrompt("mcp", input)
-      : "";
-    const previewSuffix = mcpPreview ? ` ${mcpPreview}` : "";
-    return `${subject} requested MCP target '${result.target}'${patternInfo}${previewSuffix}. Allow this call?`;
-  }
-
-  const patternInfo = result.matchedPattern
-    ? ` (matched '${result.matchedPattern}')`
-    : "";
-  const inputPreview = formatter
-    ? formatter.formatToolInputForPrompt(result.toolName, input)
-    : "";
-  const inputSuffix = inputPreview ? ` ${inputPreview}` : "";
-  return `${subject} requested tool '${result.toolName}'${patternInfo}${inputSuffix}. Allow this call?`;
-}
-
-export function formatSkillAskPrompt(
-  skillName: string,
-  agentName?: string,
-): string {
-  const subject = agentName ? `Agent '${agentName}'` : "Current agent";
-  return `${subject} requested skill '${skillName}'. Allow loading this skill?`;
-}
-
-export function formatSkillPathAskPrompt(
-  skill: SkillPromptEntry,
-  readPath: string,
-  agentName?: string,
-): string {
-  const subject = agentName ? `Agent '${agentName}'` : "Current agent";
-  return `${subject} requested access to skill '${skill.name}' via '${readPath}'. Allow this read?`;
-}
-
-// formatSkillPathDenyReason has been moved to denial-messages.ts.