@gotgenes/pi-permission-system 25.3.0 → 26.0.0

package/src/authority/approval-escalator.ts

@@ -34,7 +34,9 @@ import {
 } from "#src/authority/permission-forwarding";
 import type { ServingLookup } from "#src/authority/serving-registry";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
+import { createPermissionRequestId } from "#src/permission-request-id";
 import { buildUiPrompt } from "#src/permission-ui-prompt";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type { DebugReviewLogger } from "#src/session-logger";
 import { toRecord } from "#src/value-guards";
 import type { TerminalAuthorizer } from "./authorizer";
@@ -67,7 +69,7 @@ function getContextSystemPrompt(ctx: ForwarderContext): string | undefined {
 
 /**
  * The facts a forwarded request relays unchanged from the child's ask: the
- * prompt message, the optional display projection, and the optional
+ * prompt payload, the optional display projection, and the optional
  * session-approval suggestion.
  *
  * Bundled into one object so the two-hop private chain
@@ -75,7 +77,14 @@ function getContextSystemPrompt(ctx: ForwarderContext): string | undefined {
  * relayed value instead of three positional optionals.
  */
 interface ForwardedRequestFacts {
-  message: string;
+  /**
+   * The requester's own permission request id, adopted as the forwarded
+   * request's id so one id runs from the child's gate to the serving node's
+   * decision instead of a third being minted here.
+   */
+  requestId: string;
+  /** The child's complete prompt payload, relayed for the serving node to render. */
+  payload: PromptPayload;
   display?: ForwardedPromptDisplay;
   sessionApproval?: ForwardedSessionApproval;
   /** The child-fixed access facts; the edge completes them into a `ForwardedAccessIntent`. */
@@ -111,6 +120,23 @@ function abandon(denialReason: string): PermissionPromptDecision {
   };
 }
 
+/** Ids this node is willing to use as a request/response filename. */
+const FILENAME_SAFE_REQUEST_ID = /^[A-Za-z0-9._-]+$/;
+
+/**
+ * The id to write on the forwarded request: the requester's own, or a fresh
+ * mint when that id could not safely name a file.
+ *
+ * At a relay hop the adopted id came from a request file on disk, which the
+ * tolerant reader validates only as a string — so this is the boundary that
+ * keeps an inbound id from choosing an outbound path.
+ */
+function forwardableRequestId(requesterRequestId: string): string {
+  return FILENAME_SAFE_REQUEST_ID.test(requesterRequestId)
+    ? requesterRequestId
+    : createPermissionRequestId();
+}
+
 /**
  * Authorizer for a subagent session: escalate the ask up the tree to the
  * parent's authority.
@@ -146,7 +172,8 @@ export class ParentAuthorizer implements TerminalAuthorizer {
   ): Promise<PermissionPromptDecision> {
     const uiPrompt = buildUiPrompt(details);
     return this.waitForForwardedApproval(this.ctx, {
-      message: details.message,
+      requestId: details.requestId,
+      payload: details.payload,
       display: {
         source: uiPrompt.source,
         surface: uiPrompt.surface,
@@ -250,7 +277,7 @@ export class ParentAuthorizer implements TerminalAuthorizer {
     requesterSessionId: string,
     targetSessionId: string,
   ): ForwardedPermissionRequest {
-    const requestId = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${process.pid}`;
+    const requestId = forwardableRequestId(facts.requestId);
     const requesterAgentName =
       getActiveAgentName(ctx) ??
       getActiveAgentNameFromSystemPrompt(getContextSystemPrompt(ctx)) ??
@@ -275,7 +302,7 @@ export class ParentAuthorizer implements TerminalAuthorizer {
       requesterSessionId,
       targetSessionId,
       requesterAgentName,
-      message: facts.message,
+      payload: facts.payload,
       ...(facts.display
         ? {
             source: facts.display.source,

package/src/authority/authorizer.ts

@@ -49,9 +49,9 @@ export interface Authorizer {
  * ADR 0007's terminal-cannot-defer invariant.
  *
  * One method, one responsibility. `DenyingAuthorizer` ignores `details`;
- * `LocalUserAuthorizer` reads `message`/`sessionLabel` and derives the UI
- * event from it; `ParentAuthorizer` reads `message` and derives the
- * forwarded display from it.
+ * `LocalUserAuthorizer` renders `payload` for the human and derives the UI
+ * event from the request facts; `ParentAuthorizer` ships `payload` over the
+ * wire so the serving node renders it under its own budget.
  */
 export interface TerminalAuthorizer {
   authorize(

package/src/authority/forwarded-request-server.ts

@@ -14,7 +14,6 @@ import {
 } from "#src/authority/permission-forwarding";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import { buildForwardedAskPayload } from "#src/presentation/forwarded-ask-payload";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { SessionApproval } from "#src/session-approval";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { DebugReviewLogger } from "#src/session-logger";
@@ -100,7 +99,6 @@ function buildForwardedAskDetails(
     requestId: request.id,
     source: request.source ?? "tool_call",
     agentName: request.requesterAgentName || null,
-    message: renderLegacyMessage(payload),
     payload,
     surface: request.surface ?? null,
     value: request.value ?? null,

package/src/authority/forwarding-io.ts

@@ -23,6 +23,7 @@ import {
   OWNER_ONLY_FILE_MODE,
 } from "#src/log-file-permissions";
 import type { PermissionUiPromptSource } from "#src/permission-events";
+import { asPromptPayload } from "#src/presentation/prompt-payload";
 import type { DebugReviewLogger } from "#src/session-logger";
 
 /** Valid `permissions:ui_prompt` source values, for tolerant request reads. */
@@ -396,8 +397,7 @@ export function readForwardedPermissionRequest(
       typeof parsed.createdAt !== "number" ||
       typeof parsed.requesterSessionId !== "string" ||
       typeof parsed.targetSessionId !== "string" ||
-      typeof parsed.requesterAgentName !== "string" ||
-      typeof parsed.message !== "string"
+      typeof parsed.requesterAgentName !== "string"
     ) {
       logPermissionForwardingWarning(
         logger,
@@ -412,9 +412,11 @@ export function readForwardedPermissionRequest(
       requesterSessionId: parsed.requesterSessionId,
       targetSessionId: parsed.targetSessionId,
       requesterAgentName: parsed.requesterAgentName,
-      message: parsed.message,
-      // Tolerant read: display fields are optional and may be absent (older
-      // child) or malformed; reconstruct only the well-formed ones.
+      // Tolerant read: the payload and display fields are optional and may be
+      // absent (older child) or malformed; reconstruct only the well-formed
+      // ones. An older child's `message` is deliberately not salvaged — a
+      // skewed ask renders from the fields it does carry (ADR 0011 §9).
+      payload: asPromptPayload(parsed.payload),
       source: asUiPromptSource(parsed.source),
       surface: asNullableDisplayString(parsed.surface),
       value: asNullableDisplayString(parsed.value),

package/src/authority/permission-forwarding.ts

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import type { PermissionUiPromptSource } from "#src/permission-events";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
 
@@ -53,9 +54,9 @@ const SESSION_FORWARDING_RESPONSES_DIRECTORY_NAME = "responses";
  * Display fields relayed from a forwarding child to the parent UI so the parent
  * can emit a non-degraded `permissions:ui_prompt` event.
  *
- * Carried separately from the prompt message because the parent reconstructs
+ * Carried separately from the prompt payload because the parent reconstructs
  * the original event from the escalated ask's details (`buildUiPrompt`), not
- * from the message text.
+ * from the payload's own facts.
  */
 export interface ForwardedPromptDisplay {
   source: PermissionUiPromptSource;
@@ -123,7 +124,15 @@ export type ForwardedPermissionRequest = {
   requesterSessionId: string;
   targetSessionId: string;
   requesterAgentName: string;
-  message: string;
+  /**
+   * The child's complete prompt payload (ADR 0011 §2), so the serving node
+   * renders the child's own facts under the *parent's* budget rather than
+   * relaying a sentence the child assembled under its own configuration.
+   *
+   * Optional for version-skew tolerance: an older child omits it, and the
+   * serving node renders from the display fields it does carry (ADR 0011 §9).
+   */
+  payload?: PromptPayload;
   /**
    * Original prompt display fields, persisted so the parent emits a
    * non-degraded event. Optional for version-skew tolerance: a parent on a

package/src/authority/permission-prompter.ts

@@ -4,6 +4,7 @@ import type {
   ForwardedSessionApproval,
 } from "#src/authority/permission-forwarding";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
 import type { ReviewLogger } from "#src/session-logger";
 import type { TerminalAuthorizer } from "./authorizer";
 
@@ -27,13 +28,13 @@ export interface PromptPermissionDetails {
   requestId: string;
   source: PermissionReviewSource;
   agentName: string | null;
-  message: string;
   /**
    * The complete structured description of this ask (ADR 0011 §2).
    *
    * Required: every ask carries one, and the type is what guarantees it rather
-   * than a convention each gate has to remember. `message` is a render over it
-   * for the duration of the transition, so the two cannot disagree.
+   * than a convention each gate has to remember. Every consumer — the dialog,
+   * the wire, the broadcast, the review log, the agent-facing denial text — is
+   * a render over it, so no two of them can disagree.
    */
   payload: PromptPayload;
   toolCallId?: string;
@@ -149,7 +150,7 @@ export class PermissionPrompter implements PermissionPrompterApi {
       requestId: details.requestId,
       source: details.source,
       agentName: details.agentName,
-      message: details.message,
+      ...renderReviewLogFacts(details.payload),
       toolCallId: details.toolCallId ?? null,
       toolName: details.toolName ?? null,
       skillName: details.skillName ?? null,

package/src/config-loader.ts

@@ -224,6 +224,7 @@ export function mergeUnifiedConfigs(
     "forwardingTimeoutMs",
     "promptMaxRows",
     "promptFieldMaxWidth",
+    "reviewLogFieldMaxWidth",
     "toolInputPreviewMaxLength",
     "toolTextSummaryMaxLength",
   ] as const) {
@@ -374,6 +375,9 @@ export function loadAndMergeConfigs(
   const bashFallbackIssue = detectPermissiveBashFallback(merged.permission);
   if (bashFallbackIssue) allIssues.push(bashFallbackIssue);
 
+  const deprecatedCapsIssue = detectDeprecatedPreviewCaps(merged);
+  if (deprecatedCapsIssue) allIssues.push(deprecatedCapsIssue);
+
   return {
     global: globalConfig,
     project: projectConfig,
@@ -414,6 +418,33 @@ export function detectPermissiveBashFallback(
   );
 }
 
+/**
+ * Detect a config still setting one of the two superseded tool-preview caps.
+ *
+ * `toolInputPreviewMaxLength` and `toolTextSummaryMaxLength` bounded one
+ * preview inside a prompt, never the prompt itself, which is why they never
+ * bounded it; `promptMaxRows` and `promptFieldMaxWidth` supersede them
+ * (ADR 0011 §5). Both stay valid in the schema so an existing config is not
+ * rejected fail-closed — they are simply no longer read.
+ *
+ * Pure, following `detectPermissiveBashFallback`: it takes the merged config
+ * and returns a message; the caller owns pushing it onto the issue list.
+ */
+export function detectDeprecatedPreviewCaps(
+  config: UnifiedPermissionConfig,
+): string | undefined {
+  const set = (
+    ["toolInputPreviewMaxLength", "toolTextSummaryMaxLength"] as const
+  ).filter((key) => config[key] !== undefined);
+  if (set.length === 0) return undefined;
+
+  return (
+    `Permission config sets ${set.map((key) => `'${key}'`).join(" and ")}, ` +
+    "which is deprecated and ignored. The prompt is bounded by " +
+    "'promptMaxRows' and 'promptFieldMaxWidth' instead; remove the setting."
+  );
+}
+
 /**
  * Load and normalize a unified config file.
  * Returns an empty config with no issues if the file does not exist.

package/src/config-schema.ts

@@ -208,17 +208,26 @@ export const unifiedConfigSchema = z
         "Maximum characters of any one field shown in a permission prompt.\n\nOmit to use the default (400). This is what bounds a single pathological field — a long here-string command, say — that would otherwise fill the prompt through wrapping. A shortened field is marked with an ellipsis, and `Ctrl+O` shows it in full.",
       default: 400,
     }),
+    reviewLogFieldMaxWidth: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum characters of any one value written to the permission review log. Omit to use the default (1000).",
+      markdownDescription:
+        "Maximum characters of any one value written to the permission review log.\n\nOmit to use the default (1000). Every string the review log writes is narrowed to this width and marked with an ellipsis, so the log's growth is a decision you make rather than a side effect of how long a command happened to be. Raise it to keep longer values \u2014 a bash command exceeding the width is stored shortened.\n\nThis is a length bound, not redaction: it never inspects a value to decide what to hide. Key-name masking is unchanged and applies independently.",
+      default: 1000,
+    }),
     toolInputPreviewMaxLength: z.number().int().min(1).optional().meta({
+      deprecated: true,
       description:
-        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",
+        "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one preview. Still accepted so an existing config is not rejected; remove it.",
       markdownDescription:
-        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts.\n\nOmit to use the default (200). Set to a large value (e.g. `10000`) to effectively disable truncation and see the full input.",
+        "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one preview inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
     }),
     toolTextSummaryMaxLength: z.number().int().min(1).optional().meta({
+      deprecated: true,
       description:
-        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) in permission prompts. Omit to use the default (80).",
+        "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one summary. Still accepted so an existing config is not rejected; remove it.",
       markdownDescription:
-        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) shown in permission prompts.\n\nOmit to use the default (80). Increase this when working with long regexes or deep paths that are being cut off.",
+        "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one summary inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
     }),
     piInfrastructureReadPaths: z.array(z.string().min(1)).optional().meta({
       description:

package/src/extension-config.ts

@@ -26,10 +26,8 @@ export interface PermissionSystemExtensionConfig {
   promptMaxRows?: number;
   /** Max characters of any one field shown in a permission prompt. Defaults to 400. */
   promptFieldMaxWidth?: number;
-  /** Max length of the inline-JSON input preview shown in permission prompts. Defaults to 200. */
-  toolInputPreviewMaxLength?: number;
-  /** Max length of inline pattern/path summaries (grep/find/ls) in permission prompts. Defaults to 80. */
-  toolTextSummaryMaxLength?: number;
+  /** Max characters of any one value written to the permission review log. Defaults to 1000. */
+  reviewLogFieldMaxWidth?: number;
   /** Non-bash tools that carry shell semantics, keyed by tool name. */
   shellTools?: ShellToolsConfig;
   /** Ordered names of registered live-authority chain links to consult before the terminal authorizer. */
@@ -86,12 +84,13 @@ export function normalizePermissionSystemConfig(
   if (raw.promptFieldMaxWidth !== undefined) {
     result.promptFieldMaxWidth = raw.promptFieldMaxWidth;
   }
-  if (raw.toolInputPreviewMaxLength !== undefined) {
-    result.toolInputPreviewMaxLength = raw.toolInputPreviewMaxLength;
-  }
-  if (raw.toolTextSummaryMaxLength !== undefined) {
-    result.toolTextSummaryMaxLength = raw.toolTextSummaryMaxLength;
+  if (raw.reviewLogFieldMaxWidth !== undefined) {
+    result.reviewLogFieldMaxWidth = raw.reviewLogFieldMaxWidth;
   }
+  // `toolInputPreviewMaxLength` / `toolTextSummaryMaxLength` are deliberately
+  // absent: the schema and the merge still accept them so the deprecation
+  // detector can see an operator's setting, but no runtime consumer may read
+  // one (ADR 0011 §5, #745).
   if (raw.shellTools !== undefined) {
     result.shellTools = raw.shellTools;
   }

package/src/handlers/gates/bash-external-directory.ts

@@ -1,6 +1,5 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -85,26 +84,17 @@ export function describeBashExternalDirectoryGate(
     toolName: tcc.toolName,
     matchedPattern: preCheck.matchedPattern,
   });
-  const bashExtMessage = renderLegacyMessage(payload);
 
   const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
 
   return {
     surface: "external_directory",
     input: {},
-    denialContext: {
-      kind: "bash_external_directory",
-      command,
-      externalPaths: disclosures,
-      cwd: tcc.cwd,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.multiple("external_directory", patterns),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: bashExtMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
@@ -117,7 +107,6 @@ export function describeBashExternalDirectoryGate(
       agentName: tcc.agentName,
       command,
       externalPaths: uncoveredPaths,
-      message: bashExtMessage,
     },
     decision: {
       surface: "external_directory",

package/src/handlers/gates/bash-path.ts

@@ -1,7 +1,6 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -120,23 +119,15 @@ export function describeBashPathGate(
     agentName: tcc.agentName,
     matchedPattern: worstCheck.matchedPattern,
   });
-  const askMessage = renderLegacyMessage(payload);
 
   return {
     surface: "path",
     input: { path: worstToken },
-    denialContext: {
-      kind: "bash_path",
-      command,
-      pathValue: worstToken,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("path", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: askMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,

package/src/handlers/gates/descriptor.ts

@@ -1,6 +1,6 @@
 import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
-import type { DenialContext } from "#src/denial-messages";
 import type { PermissionDecisionEvent } from "#src/permission-events";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type { SessionApproval } from "#src/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 
@@ -18,16 +18,27 @@ export interface GateDescriptor {
   surface: string;
   /** Input passed to checkPermission. */
   input: unknown;
-  /** Structured denial context — the runner formats messages from this. */
-  denialContext: DenialContext;
+  /**
+   * The complete structured description of this ask (ADR 0011 §2).
+   *
+   * The descriptor's one presentation fact: every render over it — the dialog,
+   * the agent-facing denial text, the review log — reads this and nothing
+   * else, so a gate states its facts once.
+   */
+  payload: PromptPayload;
   /**
    * Session-approval suggestion for the "for this session" option.
    * Wraps either a single pattern or multiple patterns behind a unified
    * interface — the runner never needs to know which case applies.
    */
   sessionApproval?: SessionApproval;
-  /** Details passed to the interactive permission prompt (requestId is added by the runner). */
-  promptDetails: Omit<PromptPermissionDetails, "requestId">;
+  /**
+   * Details passed to the interactive permission prompt.
+   *
+   * The runner stamps both `requestId` (which it mints) and `payload` (which
+   * the descriptor owns), so neither is a gate's to supply twice.
+   */
+  promptDetails: Omit<PromptPermissionDetails, "requestId" | "payload">;
   /** Extra context fields written to the review log alongside gate outcomes. */
   logContext: Record<string, unknown>;
   /** Surface and value for the decision event (may differ from the check surface). */
@@ -51,6 +62,15 @@ export interface GateDescriptor {
   preCheck?: PermissionCheckResult;
 }
 
+/**
+ * A decision event's facts, before the runner stamps the request id it minted.
+ *
+ * A gate knows what was decided but not which request it was deciding — the id
+ * is minted in `GateRunner.run`. Producing this type rather than the full event
+ * is what routes every emit through the runner's single stamping site.
+ */
+export type DecisionEventFacts = Omit<PermissionDecisionEvent, "requestId">;
+
 /**
  * Early allow result — gate has determined the action without needing the runner.
  *
@@ -62,7 +82,7 @@ export interface GateBypass {
   /** Optional review log entry to emit. */
   log?: { event: string; details: Record<string, unknown> };
   /** Optional decision event to emit. */
-  decision?: PermissionDecisionEvent;
+  decision?: DecisionEventFacts;
 }
 
 /** Union of possible gate function return values. */

package/src/handlers/gates/external-directory.ts

@@ -1,7 +1,6 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -87,26 +86,16 @@ export function describeExternalDirectoryGate(
     agentName: tcc.agentName,
     matchedPattern: preCheck.matchedPattern,
   });
-  const extDirMessage = renderLegacyMessage(payload);
 
   return {
     surface: "external_directory",
     input: {},
     preCheck,
-    denialContext: {
-      kind: "external_directory",
-      toolName: tcc.toolName,
-      pathValue: externalDirectoryPath,
-      resolvedPath: resolvedAlias,
-      cwd: tcc.cwd,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("external_directory", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: extDirMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: externalDirectoryPath,
@@ -118,7 +107,6 @@ export function describeExternalDirectoryGate(
       toolName: tcc.toolName,
       agentName: tcc.agentName,
       path: externalDirectoryPath,
-      message: extDirMessage,
     },
     decision: {
       surface: "external_directory",

package/src/handlers/gates/helpers.ts

@@ -1,11 +1,9 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import { classifyToolKind } from "#src/access-intent/tool-kind";
 import type { ForwardedAccessFacts } from "#src/authority/permission-forwarding";
-import type {
-  PermissionDecisionEvent,
-  PermissionDecisionResolution,
-} from "#src/permission-events";
+import type { PermissionDecisionResolution } from "#src/permission-events";
 import type { PermissionCheckResult } from "#src/types";
+import type { DecisionEventFacts } from "./descriptor";
 
 /**
  * Build the child-fixed access facts for a path-shaped gate from its
@@ -62,11 +60,12 @@ export function deriveDecisionValue(
 }
 
 /**
- * Build a `PermissionDecisionEvent` from the gate's inputs.
+ * Build a decision event's facts from the gate's inputs.
  *
  * Centralises the `origin / agentName / matchedPattern ?? null` normalization
  * that is otherwise duplicated across the session-hit path and the gate-result
- * path in `runGateCheck`.
+ * path in `runGateCheck`. The request id is stamped by the runner, which is
+ * where it was minted.
  */
 export function buildDecisionEvent(
   decision: { surface: string; value: string },
@@ -74,7 +73,7 @@ export function buildDecisionEvent(
   agentName: string | null,
   result: "allow" | "deny",
   resolution: PermissionDecisionResolution,
-): PermissionDecisionEvent {
+): DecisionEventFacts {
   return {
     surface: decision.surface,
     value: decision.value,

package/src/handlers/gates/path.ts

@@ -1,7 +1,6 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -59,18 +58,11 @@ export function describePathGate(
   const descriptor: GateDescriptor = {
     surface: "path",
     input: { path: filePath },
-    denialContext: {
-      kind: "path",
-      toolName: tcc.toolName,
-      pathValue: filePath,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("path", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: renderLegacyMessage(payload),
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: filePath,