@gotgenes/pi-permission-system 25.4.0 → 26.0.0

package/src/authority/forwarding-io.ts

@@ -23,6 +23,7 @@ import {
   OWNER_ONLY_FILE_MODE,
 } from "#src/log-file-permissions";
 import type { PermissionUiPromptSource } from "#src/permission-events";
+import { asPromptPayload } from "#src/presentation/prompt-payload";
 import type { DebugReviewLogger } from "#src/session-logger";
 
 /** Valid `permissions:ui_prompt` source values, for tolerant request reads. */
@@ -396,8 +397,7 @@ export function readForwardedPermissionRequest(
       typeof parsed.createdAt !== "number" ||
       typeof parsed.requesterSessionId !== "string" ||
       typeof parsed.targetSessionId !== "string" ||
-      typeof parsed.requesterAgentName !== "string" ||
-      typeof parsed.message !== "string"
+      typeof parsed.requesterAgentName !== "string"
     ) {
       logPermissionForwardingWarning(
         logger,
@@ -412,9 +412,11 @@ export function readForwardedPermissionRequest(
       requesterSessionId: parsed.requesterSessionId,
       targetSessionId: parsed.targetSessionId,
       requesterAgentName: parsed.requesterAgentName,
-      message: parsed.message,
-      // Tolerant read: display fields are optional and may be absent (older
-      // child) or malformed; reconstruct only the well-formed ones.
+      // Tolerant read: the payload and display fields are optional and may be
+      // absent (older child) or malformed; reconstruct only the well-formed
+      // ones. An older child's `message` is deliberately not salvaged — a
+      // skewed ask renders from the fields it does carry (ADR 0011 §9).
+      payload: asPromptPayload(parsed.payload),
       source: asUiPromptSource(parsed.source),
       surface: asNullableDisplayString(parsed.surface),
       value: asNullableDisplayString(parsed.value),

package/src/authority/permission-forwarding.ts

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import type { PermissionUiPromptSource } from "#src/permission-events";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
 
@@ -53,9 +54,9 @@ const SESSION_FORWARDING_RESPONSES_DIRECTORY_NAME = "responses";
  * Display fields relayed from a forwarding child to the parent UI so the parent
  * can emit a non-degraded `permissions:ui_prompt` event.
  *
- * Carried separately from the prompt message because the parent reconstructs
+ * Carried separately from the prompt payload because the parent reconstructs
  * the original event from the escalated ask's details (`buildUiPrompt`), not
- * from the message text.
+ * from the payload's own facts.
  */
 export interface ForwardedPromptDisplay {
   source: PermissionUiPromptSource;
@@ -123,7 +124,15 @@ export type ForwardedPermissionRequest = {
   requesterSessionId: string;
   targetSessionId: string;
   requesterAgentName: string;
-  message: string;
+  /**
+   * The child's complete prompt payload (ADR 0011 §2), so the serving node
+   * renders the child's own facts under the *parent's* budget rather than
+   * relaying a sentence the child assembled under its own configuration.
+   *
+   * Optional for version-skew tolerance: an older child omits it, and the
+   * serving node renders from the display fields it does carry (ADR 0011 §9).
+   */
+  payload?: PromptPayload;
   /**
    * Original prompt display fields, persisted so the parent emits a
    * non-degraded event. Optional for version-skew tolerance: a parent on a

package/src/authority/permission-prompter.ts

@@ -4,6 +4,7 @@ import type {
   ForwardedSessionApproval,
 } from "#src/authority/permission-forwarding";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
 import type { ReviewLogger } from "#src/session-logger";
 import type { TerminalAuthorizer } from "./authorizer";
 
@@ -27,13 +28,13 @@ export interface PromptPermissionDetails {
   requestId: string;
   source: PermissionReviewSource;
   agentName: string | null;
-  message: string;
   /**
    * The complete structured description of this ask (ADR 0011 §2).
    *
    * Required: every ask carries one, and the type is what guarantees it rather
-   * than a convention each gate has to remember. `message` is a render over it
-   * for the duration of the transition, so the two cannot disagree.
+   * than a convention each gate has to remember. Every consumer — the dialog,
+   * the wire, the broadcast, the review log, the agent-facing denial text — is
+   * a render over it, so no two of them can disagree.
    */
   payload: PromptPayload;
   toolCallId?: string;
@@ -149,7 +150,7 @@ export class PermissionPrompter implements PermissionPrompterApi {
       requestId: details.requestId,
       source: details.source,
       agentName: details.agentName,
-      message: details.message,
+      ...renderReviewLogFacts(details.payload),
       toolCallId: details.toolCallId ?? null,
       toolName: details.toolName ?? null,
       skillName: details.skillName ?? null,

package/src/config-loader.ts

@@ -224,6 +224,7 @@ export function mergeUnifiedConfigs(
     "forwardingTimeoutMs",
     "promptMaxRows",
     "promptFieldMaxWidth",
+    "reviewLogFieldMaxWidth",
     "toolInputPreviewMaxLength",
     "toolTextSummaryMaxLength",
   ] as const) {
@@ -374,6 +375,9 @@ export function loadAndMergeConfigs(
   const bashFallbackIssue = detectPermissiveBashFallback(merged.permission);
   if (bashFallbackIssue) allIssues.push(bashFallbackIssue);
 
+  const deprecatedCapsIssue = detectDeprecatedPreviewCaps(merged);
+  if (deprecatedCapsIssue) allIssues.push(deprecatedCapsIssue);
+
   return {
     global: globalConfig,
     project: projectConfig,
@@ -414,6 +418,33 @@ export function detectPermissiveBashFallback(
   );
 }
 
+/**
+ * Detect a config still setting one of the two superseded tool-preview caps.
+ *
+ * `toolInputPreviewMaxLength` and `toolTextSummaryMaxLength` bounded one
+ * preview inside a prompt, never the prompt itself, which is why they never
+ * bounded it; `promptMaxRows` and `promptFieldMaxWidth` supersede them
+ * (ADR 0011 §5). Both stay valid in the schema so an existing config is not
+ * rejected fail-closed — they are simply no longer read.
+ *
+ * Pure, following `detectPermissiveBashFallback`: it takes the merged config
+ * and returns a message; the caller owns pushing it onto the issue list.
+ */
+export function detectDeprecatedPreviewCaps(
+  config: UnifiedPermissionConfig,
+): string | undefined {
+  const set = (
+    ["toolInputPreviewMaxLength", "toolTextSummaryMaxLength"] as const
+  ).filter((key) => config[key] !== undefined);
+  if (set.length === 0) return undefined;
+
+  return (
+    `Permission config sets ${set.map((key) => `'${key}'`).join(" and ")}, ` +
+    "which is deprecated and ignored. The prompt is bounded by " +
+    "'promptMaxRows' and 'promptFieldMaxWidth' instead; remove the setting."
+  );
+}
+
 /**
  * Load and normalize a unified config file.
  * Returns an empty config with no issues if the file does not exist.

package/src/config-schema.ts

@@ -208,17 +208,26 @@ export const unifiedConfigSchema = z
         "Maximum characters of any one field shown in a permission prompt.\n\nOmit to use the default (400). This is what bounds a single pathological field — a long here-string command, say — that would otherwise fill the prompt through wrapping. A shortened field is marked with an ellipsis, and `Ctrl+O` shows it in full.",
       default: 400,
     }),
+    reviewLogFieldMaxWidth: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum characters of any one value written to the permission review log. Omit to use the default (1000).",
+      markdownDescription:
+        "Maximum characters of any one value written to the permission review log.\n\nOmit to use the default (1000). Every string the review log writes is narrowed to this width and marked with an ellipsis, so the log's growth is a decision you make rather than a side effect of how long a command happened to be. Raise it to keep longer values \u2014 a bash command exceeding the width is stored shortened.\n\nThis is a length bound, not redaction: it never inspects a value to decide what to hide. Key-name masking is unchanged and applies independently.",
+      default: 1000,
+    }),
     toolInputPreviewMaxLength: z.number().int().min(1).optional().meta({
+      deprecated: true,
       description:
-        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",
+        "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one preview. Still accepted so an existing config is not rejected; remove it.",
       markdownDescription:
-        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts.\n\nOmit to use the default (200). Set to a large value (e.g. `10000`) to effectively disable truncation and see the full input.",
+        "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one preview inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
     }),
     toolTextSummaryMaxLength: z.number().int().min(1).optional().meta({
+      deprecated: true,
       description:
-        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) in permission prompts. Omit to use the default (80).",
+        "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one summary. Still accepted so an existing config is not rejected; remove it.",
       markdownDescription:
-        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) shown in permission prompts.\n\nOmit to use the default (80). Increase this when working with long regexes or deep paths that are being cut off.",
+        "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one summary inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
     }),
     piInfrastructureReadPaths: z.array(z.string().min(1)).optional().meta({
       description:

package/src/extension-config.ts

@@ -26,10 +26,8 @@ export interface PermissionSystemExtensionConfig {
   promptMaxRows?: number;
   /** Max characters of any one field shown in a permission prompt. Defaults to 400. */
   promptFieldMaxWidth?: number;
-  /** Max length of the inline-JSON input preview shown in permission prompts. Defaults to 200. */
-  toolInputPreviewMaxLength?: number;
-  /** Max length of inline pattern/path summaries (grep/find/ls) in permission prompts. Defaults to 80. */
-  toolTextSummaryMaxLength?: number;
+  /** Max characters of any one value written to the permission review log. Defaults to 1000. */
+  reviewLogFieldMaxWidth?: number;
   /** Non-bash tools that carry shell semantics, keyed by tool name. */
   shellTools?: ShellToolsConfig;
   /** Ordered names of registered live-authority chain links to consult before the terminal authorizer. */
@@ -86,12 +84,13 @@ export function normalizePermissionSystemConfig(
   if (raw.promptFieldMaxWidth !== undefined) {
     result.promptFieldMaxWidth = raw.promptFieldMaxWidth;
   }
-  if (raw.toolInputPreviewMaxLength !== undefined) {
-    result.toolInputPreviewMaxLength = raw.toolInputPreviewMaxLength;
-  }
-  if (raw.toolTextSummaryMaxLength !== undefined) {
-    result.toolTextSummaryMaxLength = raw.toolTextSummaryMaxLength;
+  if (raw.reviewLogFieldMaxWidth !== undefined) {
+    result.reviewLogFieldMaxWidth = raw.reviewLogFieldMaxWidth;
   }
+  // `toolInputPreviewMaxLength` / `toolTextSummaryMaxLength` are deliberately
+  // absent: the schema and the merge still accept them so the deprecation
+  // detector can see an operator's setting, but no runtime consumer may read
+  // one (ADR 0011 §5, #745).
   if (raw.shellTools !== undefined) {
     result.shellTools = raw.shellTools;
   }

package/src/handlers/gates/bash-external-directory.ts

@@ -1,6 +1,5 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -85,26 +84,17 @@ export function describeBashExternalDirectoryGate(
     toolName: tcc.toolName,
     matchedPattern: preCheck.matchedPattern,
   });
-  const bashExtMessage = renderLegacyMessage(payload);
 
   const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
 
   return {
     surface: "external_directory",
     input: {},
-    denialContext: {
-      kind: "bash_external_directory",
-      command,
-      externalPaths: disclosures,
-      cwd: tcc.cwd,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.multiple("external_directory", patterns),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: bashExtMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
@@ -117,7 +107,6 @@ export function describeBashExternalDirectoryGate(
       agentName: tcc.agentName,
       command,
       externalPaths: uncoveredPaths,
-      message: bashExtMessage,
     },
     decision: {
       surface: "external_directory",

package/src/handlers/gates/bash-path.ts

@@ -1,7 +1,6 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -120,23 +119,15 @@ export function describeBashPathGate(
     agentName: tcc.agentName,
     matchedPattern: worstCheck.matchedPattern,
   });
-  const askMessage = renderLegacyMessage(payload);
 
   return {
     surface: "path",
     input: { path: worstToken },
-    denialContext: {
-      kind: "bash_path",
-      command,
-      pathValue: worstToken,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("path", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: askMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,

package/src/handlers/gates/descriptor.ts

@@ -1,6 +1,6 @@
 import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
-import type { DenialContext } from "#src/denial-messages";
 import type { PermissionDecisionEvent } from "#src/permission-events";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type { SessionApproval } from "#src/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 
@@ -18,16 +18,27 @@ export interface GateDescriptor {
   surface: string;
   /** Input passed to checkPermission. */
   input: unknown;
-  /** Structured denial context — the runner formats messages from this. */
-  denialContext: DenialContext;
+  /**
+   * The complete structured description of this ask (ADR 0011 §2).
+   *
+   * The descriptor's one presentation fact: every render over it — the dialog,
+   * the agent-facing denial text, the review log — reads this and nothing
+   * else, so a gate states its facts once.
+   */
+  payload: PromptPayload;
   /**
    * Session-approval suggestion for the "for this session" option.
    * Wraps either a single pattern or multiple patterns behind a unified
    * interface — the runner never needs to know which case applies.
    */
   sessionApproval?: SessionApproval;
-  /** Details passed to the interactive permission prompt (requestId is added by the runner). */
-  promptDetails: Omit<PromptPermissionDetails, "requestId">;
+  /**
+   * Details passed to the interactive permission prompt.
+   *
+   * The runner stamps both `requestId` (which it mints) and `payload` (which
+   * the descriptor owns), so neither is a gate's to supply twice.
+   */
+  promptDetails: Omit<PromptPermissionDetails, "requestId" | "payload">;
   /** Extra context fields written to the review log alongside gate outcomes. */
   logContext: Record<string, unknown>;
   /** Surface and value for the decision event (may differ from the check surface). */

package/src/handlers/gates/external-directory.ts

@@ -1,7 +1,6 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -87,26 +86,16 @@ export function describeExternalDirectoryGate(
     agentName: tcc.agentName,
     matchedPattern: preCheck.matchedPattern,
   });
-  const extDirMessage = renderLegacyMessage(payload);
 
   return {
     surface: "external_directory",
     input: {},
     preCheck,
-    denialContext: {
-      kind: "external_directory",
-      toolName: tcc.toolName,
-      pathValue: externalDirectoryPath,
-      resolvedPath: resolvedAlias,
-      cwd: tcc.cwd,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("external_directory", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: extDirMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: externalDirectoryPath,
@@ -118,7 +107,6 @@ export function describeExternalDirectoryGate(
       toolName: tcc.toolName,
       agentName: tcc.agentName,
       path: externalDirectoryPath,
-      message: extDirMessage,
     },
     decision: {
       surface: "external_directory",

package/src/handlers/gates/path.ts

@@ -1,7 +1,6 @@
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -59,18 +58,11 @@ export function describePathGate(
   const descriptor: GateDescriptor = {
     surface: "path",
     input: { path: filePath },
-    denialContext: {
-      kind: "path",
-      toolName: tcc.toolName,
-      pathValue: filePath,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     sessionApproval: SessionApproval.single("path", pattern),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: renderLegacyMessage(payload),
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: filePath,

package/src/handlers/gates/runner.ts

@@ -1,14 +1,15 @@
 import type { AskEscalator } from "#src/authority/authorizer-selection";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type { DecisionReporter } from "#src/decision-reporter";
-import {
-  formatDenyReason,
-  formatUnavailableReason,
-  formatUserDeniedReason,
-} from "#src/denial-messages";
 import { applyPermissionGate } from "#src/permission-gate";
 import { createPermissionRequestId } from "#src/permission-request-id";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import {
+  renderPolicyDenial,
+  renderUnavailableDenial,
+  renderUserDenial,
+} from "#src/presentation/agent-renderer";
+import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
 import type {
@@ -111,8 +112,16 @@ export class GateRunner {
     }
 
     // The fields every review-log write for this gate shares, whatever the
-    // resolution — built once so a field added here reaches all of them.
-    const logContext = { ...descriptor.logContext, agentName, requestId };
+    // resolution — built once so a field added here reaches all of them. The
+    // payload's request facts are stamped here rather than by each gate, for
+    // the same reason `requestId` is: a gate cannot forget what it never
+    // supplies (ADR 0011 §6).
+    const logContext = {
+      ...descriptor.logContext,
+      ...renderReviewLogFacts(descriptor.payload),
+      agentName,
+      requestId,
+    };
 
     // 2. Session-hit fast path
     if (check.source === "session") {
@@ -160,16 +169,16 @@ export class GateRunner {
     // 3. Apply the deny/ask/allow gate — always escalate on ask; the selected
     // Authorizer answers (the DenyingAuthorizer by denying with a marker).
 
-    // Construct messages from the centralized formatter.
+    // The agent-facing renders of this ask. The rule reason is the operator's
+    // deny-with-reason text, which lives on the resolved check rather than the
+    // payload: no human render wants it, because a deny never prompts.
+    const { payload } = descriptor;
     const messages = {
-      denyReason: formatDenyReason(descriptor.denialContext),
+      denyReason: renderPolicyDenial(payload, check.reason ?? null),
       unavailableReason: (decision: PermissionPromptDecision) =>
-        formatUnavailableReason(
-          descriptor.denialContext,
-          decision.denialReason,
-        ),
+        renderUnavailableDenial(payload, decision.denialReason ?? null),
       userDeniedReason: (decision: PermissionPromptDecision) =>
-        formatUserDeniedReason(descriptor.denialContext, decision.denialReason),
+        renderUserDenial(payload, decision.denialReason ?? null),
     };
 
     let autoApproved = false;
@@ -180,6 +189,7 @@ export class GateRunner {
       promptForApproval: async () => {
         const decision = await this.prompter.escalate({
           requestId,
+          payload,
           ...descriptor.promptDetails,
           ...(descriptor.sessionApproval
             ? { sessionApproval: descriptor.sessionApproval.toForwardedData() }

package/src/handlers/gates/skill-input-gate-pipeline.ts

@@ -80,8 +80,8 @@ export class SkillInputGatePipeline {
  * Format the deny warning shown in the UI when a skill is blocked.
  *
  * Intentionally untagged (no `[pi-permission-system]` prefix) — this is a
- * UI notify distinct from the gate deny reasons the runner routes through
- * `formatDenyReason`.
+ * UI notify distinct from the agent-facing deny reasons the runner routes
+ * through `renderPolicyDenial`.
  */
 export function formatSkillDenyNotice(
   skillName: string,

package/src/handlers/gates/skill-input.ts

@@ -1,4 +1,3 @@
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildSkillAskPayload } from "#src/presentation/skill-ask-payload";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
@@ -17,21 +16,14 @@ export function describeSkillInputGate(
   preCheck: PermissionCheckResult,
 ): GateDescriptor {
   const payload = buildSkillAskPayload(skillName, agentName);
-  const message = renderLegacyMessage(payload);
   return {
     surface: "skill",
     input: { name: skillName },
     preCheck,
-    denialContext: {
-      kind: "skill_input",
-      skillName,
-      agentName: agentName ?? undefined,
-    },
+    payload,
     promptDetails: {
       source: "skill_input",
       agentName,
-      message,
-      payload,
       skillName,
       accessIntent: accessFactsFromValue("skill", skillName),
     },
@@ -39,7 +31,6 @@ export function describeSkillInputGate(
       source: "skill_input",
       skillName,
       agentName,
-      message,
     },
     decision: {
       surface: "skill",

package/src/handlers/gates/skill-read.ts

@@ -1,5 +1,4 @@
 import type { PathNormalizer } from "#src/path-normalizer";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildSkillPathAskPayload } from "#src/presentation/skill-ask-payload";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
@@ -44,22 +43,14 @@ export function describeSkillReadGate(
   }
 
   const payload = buildSkillPathAskPayload(matchedSkill, path, tcc.agentName);
-  const skillReadMessage = renderLegacyMessage(payload);
 
   return {
     surface: "skill",
     input: { name: matchedSkill.name },
-    denialContext: {
-      kind: "skill_read",
-      skillName: matchedSkill.name,
-      readPath: path,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     promptDetails: {
       source: "skill_read",
       agentName: tcc.agentName,
-      message: skillReadMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       skillName: matchedSkill.name,
@@ -72,7 +63,6 @@ export function describeSkillReadGate(
       skillName: matchedSkill.name,
       agentName: tcc.agentName,
       path,
-      message: skillReadMessage,
     },
     decision: {
       surface: "skill",

package/src/handlers/gates/tool.ts

@@ -6,7 +6,6 @@ import {
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
 import { suggestSessionPattern } from "#src/pattern-suggest";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
@@ -81,7 +80,6 @@ export function describeToolGate(
     input: tcc.input,
     formatter,
   });
-  const askMessage = renderLegacyMessage(payload);
 
   const decisionValue = deriveDecisionValue(
     gateSurface,
@@ -98,12 +96,7 @@ export function describeToolGate(
   return {
     surface: gateSurface,
     input: tcc.input,
-    denialContext: {
-      kind: "tool",
-      check,
-      agentName: tcc.agentName ?? undefined,
-      input: tcc.input,
-    },
+    payload,
     sessionApproval: SessionApproval.single(
       suggestion.surface,
       suggestion.pattern,
@@ -111,8 +104,6 @@ export function describeToolGate(
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: askMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       sessionLabel: suggestion.label,
@@ -123,7 +114,6 @@ export function describeToolGate(
       source: "tool_call",
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
-      message: askMessage,
       ...permissionLogContext,
     },
     decision: {