From 05b496eda473963edc10b3f2dff1b445da722abe Mon Sep 17 00:00:00 2001
From: Duncan
 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Date: Sat, 29 Aug 2026 19:48:24 -0400
Subject: [PATCH] fix(acp): extend description extraction to codex v1.1.7;
 protect prose gate with integrated render test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

B1 (F2 — codex v1.1.7 command/file-change approvals):
- Add two extraction paths to `description_from_request_permission`:
  4. `params.toolCall.rawInput.command` — codex v1.1.7 command execution
     (no title; command string in rawInput). Wire shape cited from tag v1.1.7.
  5. `params._meta.codex.params.reason` — codex v1.1.7 file-change
     (no title or rawInput; reason in codex metadata). Wire shape cited.
- Two new Rust tests use verbatim v1.1.7 wire shapes from
  `buildCommandPermissionRequest` / `buildFileChangePermissionRequest`
  in `codex-acp tag v1.1.7 CodexApprovalHandler.ts`. Both go red if the
  extraction pointers are changed back.
- Three new PermissionRequestCardBlock component tests (Carl's F2 bar):
  hostile markup renders as inert text (no <script>/<b> created),
  control characters render safely, description accessible to AT
  (not aria-hidden).

B2 (F3 — MessageRow call-site mutation protection):
- Replace `hasPermissionRequestCard` with `selectPermissionRequest` in
  `permissionRequestAuthPubkey.ts`: computes the full card payload ONCE,
  folding in channelId + isAgent + signer trust + computePermissionRequest.
  Returns `PermissionRequestSelection | null` so prose suppression and the
  card block share a single result — prose suppressed iff card renders,
  by construction.
- MessageRow now calls `selectPermissionRequest(message, isKnownAgentPubkey,
  channelId)` once (line 382), uses `permReq !== null` as the prose gate
  (line 431), and passes `permReq` to `PermissionRequestCardBlock`.
- Add `MessageRowProseGate.test.mjs`: renders the REAL MessageRow with
  a forged-signer sentinel (signerPubkey ≠ registered agent). Asserts
  the sentinel body nonce appears in DOM prose. Goes red when line 431
  is mutated from `permReq !== null` to `isPermissionRequestSentinel(body)`
  (Thufir's exact mutation). Stubs `useAppNavigation` (used by markdown.tsx
  and SentFromThreadLine via router hooks) and `MessageActionBar` so the
  test runs in JSDOM without a live RouterProvider.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
---
 crates/buzz-acp/src/acp.rs                    | 129 +++++++-
 .../src/features/messages/ui/MessageRow.tsx   |  11 +-
 .../messages/ui/MessageRowProseGate.test.mjs  | 292 ++++++++++++++++++
 .../ui/PermissionRequestCardBlock.test.mjs    | 198 ++++++++++--
 .../ui/PermissionRequestCardBlock.tsx         |  48 ++-
 .../ui/permissionRequestAuthPubkey.test.mjs   | 180 +++++++++--
 .../ui/permissionRequestAuthPubkey.ts         |  91 +++++-
 desktop/src/shared/lib/permissionRequest.ts   |   9 +-
 docs/nips/NIP-AO.md                           |  12 +-
 9 files changed, 861 insertions(+), 109 deletions(-)
 create mode 100644 desktop/src/features/messages/ui/MessageRowProseGate.test.mjs

diff --git a/crates/buzz-acp/src/acp.rs b/crates/buzz-acp/src/acp.rs
index ff0176c946..65908d43b8 100644
--- a/crates/buzz-acp/src/acp.rs
+++ b/crates/buzz-acp/src/acp.rs
@@ -242,9 +242,10 @@ struct PermissionEntry {
     /// any non-accepted outcome (entry is denied instead).
     early_decision: Option<PermissionDecision>,
     /// Human-readable description of the requested operation, extracted from
-    /// `params.subject` in the ACP `session/request_permission` message.
-    /// Truncated to `SENTINEL_STRING_MAX_BYTES`. `None` when the adapter did
-    /// not provide a subject or provided an empty string.
+    /// the ACP `session/request_permission` message via `description_from_request_permission`.
+    /// Tries `params.title`, `params.subject.toolCall.title`, `params.toolCall.title`,
+    /// `params.toolCall.rawInput.command`, and `params._meta.codex.params.reason` in order.
+    /// Truncated to `SENTINEL_STRING_MAX_BYTES`. `None` when no path yields a non-empty string.
     description: Option<String>,
 }
 
@@ -3868,9 +3869,16 @@ fn sentinel_option_fields(actions: &CardActions) -> (Vec<serde_json::Value>, ser
 ///    in `crates/buzz-agent/src/wire.rs`, version >= 2).
 /// 2. `params.subject.toolCall.title` — v2 nested fallback (same value, different
 ///    path).
-/// 3. `params.toolCall.title` — buzz-agent v1 and codex-acp permissions-request.
+/// 3. `params.toolCall.title` — buzz-agent v1 and codex-acp permissions-request
+///    (`buildPermissionsRequest`, kind "other", in codex-acp `CodexApprovalHandler.ts`).
+/// 4. `params.toolCall.rawInput.command` — codex-acp v1.1.7 command execution
+///    requests (`buildCommandPermissionRequest`): no title, command string in rawInput.
+///    Verbatim wire shape from codex-acp tag v1.1.7.
+/// 5. `params._meta.codex.params.reason` — codex-acp v1.1.7 file-change requests
+///    (`buildFileChangePermissionRequest`): no title or rawInput command, reason is
+///    in codex-supplied metadata. Verbatim wire shape from codex-acp tag v1.1.7.
 ///
-/// Returns `None` when no non-empty title is found in any of these paths, or when
+/// Returns `None` when no non-empty string is found in any of these paths, or when
 /// the `msg` argument does not have a `params` object.
 ///
 /// Extracted as a pure function (rather than inline in the event handler) so
@@ -3883,6 +3891,12 @@ pub(crate) fn description_from_request_permission(msg: &serde_json::Value) -> Op
             .and_then(|v| v.as_str()),
         msg.pointer("/params/toolCall/title")
             .and_then(|v| v.as_str()),
+        // codex-acp v1.1.7 command execution: toolCall.rawInput.command
+        msg.pointer("/params/toolCall/rawInput/command")
+            .and_then(|v| v.as_str()),
+        // codex-acp v1.1.7 file-change: reason lives in _meta.codex.params
+        msg.pointer("/params/_meta/codex/params/reason")
+            .and_then(|v| v.as_str()),
     ]
     .into_iter()
     .flatten()
@@ -7773,6 +7787,111 @@ mod tests {
 
     // ── Pinned §3: duplicate option IDs ──────────────────────────────────────
 
+    // ── F2 codex-acp v1.1.7 wire shapes ─────────────────────────────────────
+    //
+    // Verbatim wire shapes from `buildCommandPermissionRequest` and
+    // `buildFileChangePermissionRequest` in codex-acp tag v1.1.7
+    // (`src/CodexApprovalHandler.ts`). These tests go red if the extraction
+    // pointers are changed back to anything that misses the v1.1.7 shapes.
+
+    #[test]
+    fn description_from_codex_v1_1_7_command_request() {
+        // codex-acp v1.1.7 `buildCommandPermissionRequest`:
+        //   { sessionId, toolCall: { toolCallId, kind:"execute", status:"pending",
+        //     rawInput: { command, cwd } | null }, options, _meta: { codex: { params } } }
+        // No `title` at params or toolCall level — command is in rawInput.command.
+        // Verbatim from codex-acp tag v1.1.7 `CodexApprovalHandler.ts:119-135`.
+        let msg = serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": 3,
+            "method": "session/request_permission",
+            "params": {
+                "sessionId": "ses-codex-1",
+                "toolCall": {
+                    "toolCallId": "tc-cmd-001",
+                    "kind": "execute",
+                    "status": "pending",
+                    "rawInput": {
+                        "command": "ls -la /tmp",
+                        "cwd": "/home/user"
+                    }
+                },
+                "options": [],
+                "_meta": { "codex": { "params": { "command": "ls -la /tmp", "itemId": "tc-cmd-001" } } }
+            }
+        });
+        let desc = description_from_request_permission(&msg);
+        assert_eq!(
+            desc.as_deref(),
+            Some("ls -la /tmp"),
+            "codex v1.1.7 command request must extract rawInput.command as description"
+        );
+    }
+
+    #[test]
+    fn description_from_codex_v1_1_7_file_change_request() {
+        // codex-acp v1.1.7 `buildFileChangePermissionRequest`:
+        //   { sessionId, toolCall: { toolCallId, kind:"edit", status:"pending" },
+        //     options, _meta: { codex: { params: { ..., reason? } } } }
+        // No title or rawInput — useful context is in _meta.codex.params.reason.
+        // Verbatim from codex-acp tag v1.1.7 `CodexApprovalHandler.ts:137-151`.
+        let msg = serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": 4,
+            "method": "session/request_permission",
+            "params": {
+                "sessionId": "ses-codex-2",
+                "toolCall": {
+                    "toolCallId": "tc-edit-002",
+                    "kind": "edit",
+                    "status": "pending"
+                },
+                "options": [],
+                "_meta": {
+                    "codex": {
+                        "params": {
+                            "itemId": "tc-edit-002",
+                            "reason": "Write updated config to /etc/app.conf"
+                        }
+                    }
+                }
+            }
+        });
+        let desc = description_from_request_permission(&msg);
+        assert_eq!(
+            desc.as_deref(),
+            Some("Write updated config to /etc/app.conf"),
+            "codex v1.1.7 file-change request must extract _meta.codex.params.reason as description"
+        );
+    }
+
+    #[test]
+    fn description_returns_none_for_file_change_without_reason() {
+        // codex-acp v1.1.7 file-change with no reason field — no fallback available.
+        let msg = serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": 5,
+            "method": "session/request_permission",
+            "params": {
+                "sessionId": "ses-codex-3",
+                "toolCall": {
+                    "toolCallId": "tc-edit-003",
+                    "kind": "edit",
+                    "status": "pending"
+                },
+                "options": [],
+                "_meta": { "codex": { "params": { "itemId": "tc-edit-003" } } }
+            }
+        });
+        let desc = description_from_request_permission(&msg);
+        assert_eq!(
+            desc, None,
+            "file-change request with no reason must yield None"
+        );
+    }
+
+    // ── Pinned §3: duplicate option IDs ──────────────────────────────────────
+
     #[test]
     fn admission_preflight_rejects_duplicate_option_ids() {
         let id = serde_json::json!(1);
diff --git a/desktop/src/features/messages/ui/MessageRow.tsx b/desktop/src/features/messages/ui/MessageRow.tsx
index d010761607..0bff36f505 100644
--- a/desktop/src/features/messages/ui/MessageRow.tsx
+++ b/desktop/src/features/messages/ui/MessageRow.tsx
@@ -35,7 +35,7 @@ import { getConfigNudgeAuthorPubkey } from "@/features/messages/ui/configNudgeAu
 import { PermissionRequestCardBlock } from "@/features/messages/ui/PermissionRequestCardBlock";
 import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
-import { hasPermissionRequestCard as hasPermCard } from "@/features/messages/ui/permissionRequestAuthPubkey";
+import { selectPermissionRequest as selectPermReq } from "@/features/messages/ui/permissionRequestAuthPubkey";
 import { UserAvatar } from "@/shared/ui/UserAvatar";
 import { useChannelNavigation } from "@/shared/context/ChannelNavigationContext";
 import { parseImetaTags } from "@/shared/ui/markdown/parseImeta";
@@ -378,6 +378,9 @@ export const MessageRow = React.memo(
     const getTag = (name: string) =>
       message.tags?.find((tag) => tag[0] === name)?.[1];
 
+    // Computed once — prose suppressed iff card renders, by construction.
+    const permReq = selectPermReq(message, isKnownAgentPubkey, channelId);
+
     const renderBody = () => {
       switch (message.kind) {
         case KIND_STREAM_MESSAGE_DIFF:
@@ -425,9 +428,7 @@ export const MessageRow = React.memo(
             );
           }
 
-          if (message.isAgent && hasPermCard(message, isKnownAgentPubkey)) {
-            return null;
-          }
+          if (permReq !== null) return null;
 
           return (
             <VideoReviewCommentMarkdown
@@ -680,7 +681,7 @@ export const MessageRow = React.memo(
         {renderBody()}
         <PermissionRequestCardBlock
           message={message}
-          isKnownAgentPubkey={isKnownAgentPubkey}
+          permReq={permReq}
           channelId={channelId}
         />
         {continuationMetadataNode}
diff --git a/desktop/src/features/messages/ui/MessageRowProseGate.test.mjs b/desktop/src/features/messages/ui/MessageRowProseGate.test.mjs
new file mode 100644
index 0000000000..9717137f82
--- /dev/null
+++ b/desktop/src/features/messages/ui/MessageRowProseGate.test.mjs
@@ -0,0 +1,292 @@
+/**
+ * MessageRow prose-suppression gate: forged-signer sentinel renders prose
+ * (not a blank row).
+ *
+ * This test exercises the REAL MessageRow call site for the prose gate:
+ *
+ *   line 431:  `if (permReq !== null) return null;`
+ *
+ * Thufir's B2 mutation replaces that line with
+ *   `if (isPermissionRequestSentinel(message.body)) return null;`
+ * — which causes this test to fail: the sentinel shape matches → prose
+ * suppressed → the distinctive nonce string disappears from textContent →
+ * assertion fires.
+ *
+ * Sub-components that use `useAppNavigation` (which requires a live
+ * RouterProvider) are stubbed via inline `registerHooks` so the test runs
+ * in the standard Node.js + JSDOM harness without router overhead.
+ * The stub pattern follows inboxReopenNavigation.test.mjs.
+ *
+ * What is stubbed (and why):
+ *   - `useAppNavigation` — called by `markdown.tsx` MarkdownInner and
+ *     `SentFromThreadLine` for navigation callbacks; requires a live
+ *     TanStack RouterProvider (async init, hangs the test in JSDOM). All
+ *     stubbed callbacks are noops — navigation is not exercised here.
+ *   - `MessageActionBar` — brings in `useRemindLater` and other Tauri-backed
+ *     contexts; only needed for the action bar overlay which is irrelevant
+ *     to the prose-gate contract.
+ *
+ * What is NOT stubbed:
+ *   - `VideoReviewCommentMarkdown` / `MarkdownInner` — the actual prose
+ *     renderer that displays the body text. Its output is exactly what
+ *     the test observes.
+ */
+import assert from "node:assert/strict";
+import { registerHooks } from "node:module";
+import { test, before, afterEach, after, mock } from "node:test";
+import { JSDOM } from "jsdom";
+
+// ── Stubs ──────────────────────────────────────────────────────────────────
+
+const NAV_STUB_SOURCE =
+  "export function useAppNavigation() {\n" +
+  "  return {\n" +
+  "    goChannel: async () => {},\n" +
+  "    goAgents: async () => {},\n" +
+  "    goHome: async () => {},\n" +
+  "    goWorkflows: async () => {},\n" +
+  "    goBack: async () => {},\n" +
+  "    commitNavigation: async () => {},\n" +
+  "    navigate: async () => {},\n" +
+  "    handleSearchHit: async () => {},\n" +
+  "  };\n" +
+  "}\n";
+
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    // useAppNavigation: called by markdown.tsx + SentFromThreadLine.
+    // Requires a live RouterProvider — stub so tests run without one.
+    if (
+      specifier === "@/app/navigation/useAppNavigation" ||
+      specifier.endsWith("/useAppNavigation.ts") ||
+      specifier.endsWith("/useAppNavigation")
+    ) {
+      return {
+        shortCircuit: true,
+        url: "buzz-prose-gate-stub:useAppNavigation",
+      };
+    }
+    // MessageActionBar: uses useRemindLater + other contexts irrelevant to
+    // the prose-gate contract.
+    if (
+      specifier === "./MessageActionBar" ||
+      specifier === "@/features/messages/ui/MessageActionBar"
+    ) {
+      return {
+        shortCircuit: true,
+        url: "buzz-prose-gate-stub:MessageActionBar",
+      };
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === "buzz-prose-gate-stub:useAppNavigation") {
+      return { format: "module", shortCircuit: true, source: NAV_STUB_SOURCE };
+    }
+    if (url === "buzz-prose-gate-stub:MessageActionBar") {
+      return {
+        format: "module",
+        shortCircuit: true,
+        source: "export const MessageActionBar = () => null;\n",
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+
+// ── jsdom setup ────────────────────────────────────────────────────────────
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+const FAKE_NOW_MS = 1_000_000_000_000;
+
+before(() => {
+  mock.timers.enable({ apis: ["setInterval", "Date"], now: FAKE_NOW_MS });
+  globalThis.self = globalThis;
+
+  // Tauri IPC stub: resolve to null so React Query queries settle immediately
+  // and don't hold the event loop open after cleanup.
+  dom.window.__TAURI_INTERNALS__ = {
+    invoke: () => Promise.resolve(null),
+    transformCallback: () => 0,
+    unregisterCallback: () => {},
+  };
+
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    window: dom.window,
+    location: dom.window.location,
+    MutationObserver: class {
+      observe() {}
+      disconnect() {}
+      takeRecords() {
+        return [];
+      }
+    },
+    ResizeObserver: class {
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+    },
+  });
+  dom.window.matchMedia = () => ({
+    matches: false,
+    addEventListener() {},
+    removeEventListener() {},
+  });
+  dom.window.MutationObserver = globalThis.MutationObserver;
+  dom.window.ResizeObserver = globalThis.ResizeObserver;
+});
+
+let sharedQc;
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+  if (sharedQc) {
+    sharedQc.clear();
+    sharedQc = undefined;
+  }
+  mock.timers.reset();
+  mock.timers.enable({ apis: ["setInterval", "Date"], now: FAKE_NOW_MS });
+});
+
+after(() => {
+  mock.timers.reset();
+  dom.window.close();
+});
+
+// ── Fixtures ───────────────────────────────────────────────────────────────
+
+const AGENT_PUBKEY =
+  "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899";
+const ATTACKER_PUBKEY =
+  "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+
+// Distinctive nonce — appears in the rendered prose iff body is NOT suppressed.
+const FORGED_NONCE = "xforged-prose-gate-nonce-9c3a1b7f";
+
+const FORGED_SENTINEL_BODY = JSON.stringify({
+  v: 1,
+  state: "pending",
+  requestNonce: FORGED_NONCE,
+  sessionId: "sess-probe",
+  turnId: "turn-probe",
+  expiresAt: 9_999_999_999,
+  optionIds: ["opt-allow", "opt-deny"],
+  labels: { "opt-allow": "Allow once", "opt-deny": "Deny" },
+});
+
+// QueryClient configured to settle quickly and not hold the event loop.
+async function makeQc() {
+  const { QueryClient } = await import("@tanstack/react-query");
+  sharedQc = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+        refetchOnWindowFocus: false,
+        refetchOnMount: false,
+        refetchOnReconnect: false,
+        staleTime: Infinity,
+        gcTime: 0, // GC immediately after clear() — no lingering subscriptions
+      },
+    },
+  });
+  return sharedQc;
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+test("test_forged_signer_sentinel_renders_prose_not_blank", async () => {
+  // Forged signer: the message is signed by ATTACKER_PUBKEY, which is NOT
+  // a registered agent pubkey. selectPermissionRequest returns null →
+  // permReq is null → prose gate does NOT suppress → body renders as text.
+  //
+  // MUTATION PROOF: if line 431 is changed from
+  //   `if (permReq !== null) return null;`
+  // to
+  //   `if (isPermissionRequestSentinel(message.body)) return null;`
+  // then the sentinel-shaped body matches the shape check → prose is
+  // suppressed → FORGED_NONCE disappears from textContent → this test FAILS.
+  const React = (await import("react")).default;
+  const { render } = await import("@testing-library/react");
+  const { QueryClientProvider } = await import("@tanstack/react-query");
+  const { ChannelNavigationProvider } = await import(
+    "@/shared/context/ChannelNavigationContext.tsx"
+  );
+
+  const qc = await makeQc();
+  const MessageRowMod = await import("./MessageRow.tsx");
+  const MessageRow = MessageRowMod.MessageRow ?? MessageRowMod.default;
+
+  const message = {
+    id: "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+    pubkey: AGENT_PUBKEY,
+    /** Forged: signer is ATTACKER, not the registered agent. */
+    signerPubkey: ATTACKER_PUBKEY,
+    ownerPubkey: AGENT_PUBKEY,
+    kind: 9,
+    createdAt: 1_700_000_000,
+    isAgent: true,
+    author: "TestAgent",
+    avatarUrl: null,
+    time: "12:00",
+    depth: 0,
+    body: FORGED_SENTINEL_BODY,
+    tags: [],
+    reactions: [],
+    edited: false,
+    pending: false,
+    rootId: null,
+    parentId: null,
+  };
+
+  const { container } = render(
+    React.createElement(
+      QueryClientProvider,
+      { client: qc },
+      React.createElement(
+        ChannelNavigationProvider,
+        { channels: [] },
+        React.createElement(MessageRow, {
+          message,
+          channelId: "test-channel",
+          // profiles[AGENT_PUBKEY].isAgent = true → isKnownAgentPubkey returns
+          // true for AGENT_PUBKEY. ATTACKER_PUBKEY is absent → returns false.
+          // selectPermissionRequest: signerPubkey = ATTACKER → not trusted →
+          // returns null → permReq is null → gate passes → prose renders.
+          profiles: {
+            [AGENT_PUBKEY]: {
+              displayName: "TestAgent",
+              avatarUrl: null,
+              isAgent: true,
+            },
+          },
+        }),
+      ),
+    ),
+  );
+
+  const textContent = container.textContent ?? "";
+  const card = container.querySelector("[data-permission-request]");
+
+  // The body nonce must appear in prose (gate did not suppress).
+  assert.ok(
+    textContent.includes(FORGED_NONCE),
+    `Forged-signer sentinel must render body as prose — nonce "${FORGED_NONCE}" not ` +
+      `found in textContent. This test fails when MessageRow reverts to ` +
+      `shape-only prose suppression (isPermissionRequestSentinel gate) ` +
+      `instead of trust-aware suppression (permReq !== null gate).`,
+  );
+
+  // No card — the signer is not a trusted agent.
+  assert.equal(
+    card,
+    null,
+    "forged-signer sentinel must not render a permission card",
+  );
+});
diff --git a/desktop/src/features/messages/ui/PermissionRequestCardBlock.test.mjs b/desktop/src/features/messages/ui/PermissionRequestCardBlock.test.mjs
index 71ec246c74..35d03e22ba 100644
--- a/desktop/src/features/messages/ui/PermissionRequestCardBlock.test.mjs
+++ b/desktop/src/features/messages/ui/PermissionRequestCardBlock.test.mjs
@@ -149,9 +149,7 @@ async function makeQueryClient(viewerPubkey) {
 
 // ── Render helper ─────────────────────────────────────────────────────────────
 
-// Build a minimal TimelineMessage carrying the sentinel. The block reads
-// kind/isAgent/body/signerPubkey/editSignerPubkey/ownerPubkey; other fields
-// are irrelevant to the render gates under test.
+// Build a minimal TimelineMessage carrying the sentinel.
 function makeMessage({
   content,
   signerPubkey,
@@ -172,8 +170,9 @@ function makeMessage({
   };
 }
 
-// The block resolves `agentPubkey` from the signer via this predicate, so a
-// forged signer (signer ≠ agent) fails the gate exactly as production does.
+// The block now accepts a pre-computed `permReq` from `selectPermissionRequest`.
+// We compute it here in the test helper — using the same function MessageRow uses —
+// so forged signer (signer ≠ agent) fails the gate exactly as production does.
 function makeIsKnownAgentPubkey(agentPubkey) {
   return (pubkey) => pubkey === agentPubkey;
 }
@@ -194,8 +193,26 @@ async function renderBlock({
   const { PermissionRequestCardBlock } = await import(
     "./PermissionRequestCardBlock.tsx"
   );
+  const { selectPermissionRequest } = await import(
+    "./permissionRequestAuthPubkey.ts"
+  );
 
   const qc = await makeQueryClient(viewerPubkey);
+  const message = makeMessage({
+    content,
+    signerPubkey,
+    editSignerPubkey,
+    ownerPubkey,
+    id,
+    preEditBody,
+  });
+  const isKnownAgentPubkey = makeIsKnownAgentPubkey(agentPubkey);
+  // Compute permReq using the same selector MessageRow uses in production.
+  const permReq = selectPermissionRequest(
+    message,
+    isKnownAgentPubkey,
+    CHANNEL_ID,
+  );
 
   let container;
   await act(async () => {
@@ -204,15 +221,8 @@ async function renderBlock({
         QueryClientProvider,
         { client: qc },
         createElement(PermissionRequestCardBlock, {
-          message: makeMessage({
-            content,
-            signerPubkey,
-            editSignerPubkey,
-            ownerPubkey,
-            id,
-            preEditBody,
-          }),
-          isKnownAgentPubkey: makeIsKnownAgentPubkey(agentPubkey),
+          message,
+          permReq,
           channelId: CHANNEL_ID,
         }),
       ),
@@ -340,8 +350,21 @@ test("test_expiry_disables_buttons_after_clock_tick", async () => {
   const { PermissionRequestCardBlock } = await import(
     "./PermissionRequestCardBlock.tsx"
   );
+  const { selectPermissionRequest } = await import(
+    "./permissionRequestAuthPubkey.ts"
+  );
 
   const qc = await makeQueryClient(OWNER_PUBKEY);
+  const message = makeMessage({
+    content: makePendingContent(EXPIRY_SECS),
+    signerPubkey: AGENT_PUBKEY,
+    ownerPubkey: OWNER_PUBKEY,
+  });
+  const permReq = selectPermissionRequest(
+    message,
+    makeIsKnownAgentPubkey(AGENT_PUBKEY),
+    CHANNEL_ID,
+  );
 
   let container;
   await act(async () => {
@@ -350,12 +373,8 @@ test("test_expiry_disables_buttons_after_clock_tick", async () => {
         QueryClientProvider,
         { client: qc },
         createElement(PermissionRequestCardBlock, {
-          message: makeMessage({
-            content: makePendingContent(EXPIRY_SECS),
-            signerPubkey: AGENT_PUBKEY,
-            ownerPubkey: OWNER_PUBKEY,
-          }),
-          isKnownAgentPubkey: makeIsKnownAgentPubkey(AGENT_PUBKEY),
+          message,
+          permReq,
           channelId: CHANNEL_ID,
         }),
       ),
@@ -411,8 +430,21 @@ test("test_failed_delivery_re_enables_buttons_and_successful_retry_reaches_sent"
   const { PermissionRequestCardBlock } = await import(
     "./PermissionRequestCardBlock.tsx"
   );
+  const { selectPermissionRequest } = await import(
+    "./permissionRequestAuthPubkey.ts"
+  );
 
   const qc = await makeQueryClient(OWNER_PUBKEY);
+  const message = makeMessage({
+    content: makePendingContent(),
+    signerPubkey: AGENT_PUBKEY,
+    ownerPubkey: OWNER_PUBKEY,
+  });
+  const permReq = selectPermissionRequest(
+    message,
+    makeIsKnownAgentPubkey(AGENT_PUBKEY),
+    CHANNEL_ID,
+  );
 
   let container;
   await act(async () => {
@@ -421,12 +453,8 @@ test("test_failed_delivery_re_enables_buttons_and_successful_retry_reaches_sent"
         QueryClientProvider,
         { client: qc },
         createElement(PermissionRequestCardBlock, {
-          message: makeMessage({
-            content: makePendingContent(),
-            signerPubkey: AGENT_PUBKEY,
-            ownerPubkey: OWNER_PUBKEY,
-          }),
-          isKnownAgentPubkey: makeIsKnownAgentPubkey(AGENT_PUBKEY),
+          message,
+          permReq,
           channelId: CHANNEL_ID,
           _deliveryFn: makeDeliveryFn(),
         }),
@@ -633,12 +661,128 @@ test("test_no_description_does_not_break_pending_card", async () => {
   assert.ok(allowBtn !== null, "buttons must render without description");
 });
 
+test("test_hostile_markup_description_renders_as_inert_text", async () => {
+  // Carl's F2 requirement: hostile markup must render as inert text — no
+  // element or execution, reachable by AT, not aria-hidden.
+  // React renders values as text children; this test verifies by querying the
+  // accessibility tree (textContent) and confirming no <script>/<img> element.
+  const hostileDesc = "<script>alert('xss')</script><b>bold</b>";
+  const contentWithHostile = JSON.stringify({
+    v: 1,
+    state: "pending",
+    requestNonce: "a9f3b2c1-d4e5-4f6a-b7c8-d9e0f1a2b3c4",
+    sessionId: "sess-abc",
+    turnId: "turn-xyz",
+    expiresAt: FUTURE_EXPIRY,
+    optionIds: ["opt-allow", "opt-deny"],
+    labels: { "opt-allow": "Allow once", "opt-deny": "Deny" },
+    description: hostileDesc,
+  });
+
+  const container = await renderBlock({
+    content: contentWithHostile,
+    viewerPubkey: OWNER_PUBKEY,
+    ownerPubkey: OWNER_PUBKEY,
+  });
+
+  // No <script> or <img> element created — markup treated as text
+  assert.equal(
+    container.querySelector("script"),
+    null,
+    "hostile <script> must not create a script element",
+  );
+  assert.equal(
+    container.querySelector("b"),
+    null,
+    "hostile <b> must not create a bold element — markup is escaped",
+  );
+
+  // The raw string must appear as text content (HTML-escaped, reachable by AT)
+  assert.ok(
+    container.textContent?.includes("<script>"),
+    "hostile markup must appear as literal text (accessible, not executed)",
+  );
+});
+
+test("test_control_character_description_renders_safely", async () => {
+  // Control characters in description must not crash the renderer or produce
+  // invisible/inaccessible content.
+  const controlDesc = "Run\x00command\x08with\x1fcontrol\x7fchars";
+  const contentWithControl = JSON.stringify({
+    v: 1,
+    state: "pending",
+    requestNonce: "b9f3b2c1-d4e5-4f6a-b7c8-d9e0f1a2b3c5",
+    sessionId: "sess-ctrl",
+    turnId: "turn-ctrl",
+    expiresAt: FUTURE_EXPIRY,
+    optionIds: ["opt-allow", "opt-deny"],
+    labels: { "opt-allow": "Allow once", "opt-deny": "Deny" },
+    description: controlDesc,
+  });
+
+  const container = await renderBlock({
+    content: contentWithControl,
+    viewerPubkey: OWNER_PUBKEY,
+    ownerPubkey: OWNER_PUBKEY,
+  });
+
+  // Card renders (control chars do not prevent render)
+  const card = container.querySelector("[data-permission-request]");
+  assert.ok(card !== null, "card must render with control-char description");
+
+  // Visible text portions are present in the accessibility tree
+  assert.ok(
+    container.textContent?.includes("Run"),
+    "printable parts of control-char description must be in textContent",
+  );
+});
+
+test("test_description_accessible_not_aria_hidden", async () => {
+  // Description must be reachable by assistive technology — not wrapped in
+  // aria-hidden or hidden from the accessibility tree.
+  const desc = "Allow read access to /etc/hosts";
+  const contentWithDesc = JSON.stringify({
+    v: 1,
+    state: "pending",
+    requestNonce: "c9f3b2c1-d4e5-4f6a-b7c8-d9e0f1a2b3c6",
+    sessionId: "sess-at",
+    turnId: "turn-at",
+    expiresAt: FUTURE_EXPIRY,
+    optionIds: ["opt-allow", "opt-deny"],
+    labels: { "opt-allow": "Allow once", "opt-deny": "Deny" },
+    description: desc,
+  });
+
+  const container = await renderBlock({
+    content: contentWithDesc,
+    viewerPubkey: OWNER_PUBKEY,
+    ownerPubkey: OWNER_PUBKEY,
+  });
+
+  // Find the element containing the description text
+  const allText = container.textContent ?? "";
+  assert.ok(
+    allText.includes(desc),
+    "description must appear in textContent (reachable by AT)",
+  );
+
+  // The description must NOT be inside an aria-hidden element
+  const ariaHiddenWithDesc = [
+    ...container.querySelectorAll("[aria-hidden]"),
+  ].some((el) => el.textContent?.includes(desc));
+  assert.equal(
+    ariaHiddenWithDesc,
+    false,
+    "description must not be inside an aria-hidden element",
+  );
+});
+
 test("test_born_resolved_no_provenance_renders_nothing", async () => {
   // A kind-9 whose body is already "resolved" but has no edit provenance
   // (no editSignerPubkey, no preEditBody). computePermissionRequest rejects
   // it — born-resolved cards bypass the agent-signed-edit requirement and
   // would render a completed card with zero proof of owner action.
-  // The block returns null; hasPermissionRequestCard also returns false so
+  // The block returns null; selectPermissionRequest also returns null so
   // MessageRow falls back to prose (no blank row).
   const container = await renderBlock({
     content: makeResolvedContent(),
diff --git a/desktop/src/features/messages/ui/PermissionRequestCardBlock.tsx b/desktop/src/features/messages/ui/PermissionRequestCardBlock.tsx
index 60af78a314..2a2f943dc5 100644
--- a/desktop/src/features/messages/ui/PermissionRequestCardBlock.tsx
+++ b/desktop/src/features/messages/ui/PermissionRequestCardBlock.tsx
@@ -3,27 +3,32 @@
  * `PermissionRequestCard`, keeping React hooks out of the memo-heavy
  * `MessageRow` component.
  *
- * Renders nothing when `computePermissionRequest` returns null (no trusted
- * sentinel, wrong signer, or non-interactive surface).
+ * Accepts a pre-computed `permReq` from `selectPermissionRequest` — the trust
+ * computation happens once in `MessageRow` and the result is passed down here,
+ * so prose is suppressed iff the card renders, by construction.
+ *
+ * Renders nothing when `permReq` is null (no trusted sentinel, wrong signer,
+ * falsy channelId, or non-interactive surface).
  */
 import * as React from "react";
 
 import type { startPermissionDecisionDelivery } from "@/features/agents/lib/permissionDecisionDelivery";
 import type { TimelineMessage } from "@/features/messages/types";
-import { getPermissionRequestAgentPubkey } from "@/features/messages/ui/permissionRequestAuthPubkey";
+import type { PermissionRequestSelection } from "@/features/messages/ui/permissionRequestAuthPubkey";
 import { useIdentityQuery } from "@/shared/api/hooks";
-import { computePermissionRequest } from "@/shared/lib/computePermissionRequest";
 import { normalizePubkey } from "@/shared/lib/pubkey";
 import { AttachmentGroup } from "@/shared/ui/attachment";
 import { PermissionRequestCard } from "@/shared/ui/permission-request-card";
 
 export type PermissionRequestCardBlockProps = {
   /** The message that may carry a permission-request sentinel. */
-  message: TimelineMessage;
-  /** Predicate identifying a known agent signer (enables the card). */
-  isKnownAgentPubkey: (pubkey: string) => boolean;
-  /** Channel ID for routing the decision click; falsy → no card. */
-  channelId: string | null | undefined;
+  message: Pick<TimelineMessage, "ownerPubkey">;
+  /**
+   * Pre-computed selection from `selectPermissionRequest`. When null, no card
+   * renders. MessageRow computes this once and uses the same result for prose
+   * suppression and this block — ensuring they stay in sync.
+   */
+  permReq: PermissionRequestSelection | null;
   /**
    * Delivery function injected by tests to control the outcome without a real
    * relay. Production callers omit this.
@@ -31,36 +36,23 @@ export type PermissionRequestCardBlockProps = {
    * @internal — test seam only; not part of the public API.
    */
   _deliveryFn?: typeof startPermissionDecisionDelivery;
+  /** Channel ID for routing the decision click. */
+  channelId: string | null | undefined;
 };
 
 export const PermissionRequestCardBlock = React.memo(
   function PermissionRequestCardBlock({
     message,
-    isKnownAgentPubkey,
+    permReq,
     channelId,
     _deliveryFn,
   }: PermissionRequestCardBlockProps) {
     const identityQuery = useIdentityQuery();
     const viewerPubkey = identityQuery.data?.pubkey;
 
-    if (!channelId || !message.isAgent) return null;
-
-    const agentPubkey = getPermissionRequestAgentPubkey(
-      message,
-      isKnownAgentPubkey,
-    );
-    const request = computePermissionRequest(
-      message.body,
-      true,
-      agentPubkey,
-      message.signerPubkey,
-      message.editSignerPubkey,
-      message.id,
-      message.preEditBody,
-    );
-
-    if (request === null || !agentPubkey) return null;
+    if (permReq === null || !channelId) return null;
 
+    const { agentPubkey, request } = permReq;
     const ownerPubkey = message.ownerPubkey;
     const isOwner =
       !!viewerPubkey &&
@@ -84,7 +76,7 @@ export const PermissionRequestCardBlock = React.memo(
   },
   (prev, next) =>
     prev.message === next.message &&
-    prev.isKnownAgentPubkey === next.isKnownAgentPubkey &&
+    prev.permReq === next.permReq &&
     prev.channelId === next.channelId &&
     prev._deliveryFn === next._deliveryFn,
 );
diff --git a/desktop/src/features/messages/ui/permissionRequestAuthPubkey.test.mjs b/desktop/src/features/messages/ui/permissionRequestAuthPubkey.test.mjs
index 63734b5d9b..b36cf2e097 100644
--- a/desktop/src/features/messages/ui/permissionRequestAuthPubkey.test.mjs
+++ b/desktop/src/features/messages/ui/permissionRequestAuthPubkey.test.mjs
@@ -1,19 +1,18 @@
 /**
- * Tests for `hasPermissionRequestCard` — the prose-suppression gate.
+ * Tests for `selectPermissionRequest` (primary) and `hasPermissionRequestCard`
+ * (legacy delegate).
  *
- * The contract: `MessageRow` suppresses prose rendering ONLY when this
- * function returns true. It returns true IFF `computePermissionRequest` returns
- * a non-null payload — identical to the block's own decision. This closes
- * every blank-row case:
- *   - forged signer (signerPubkey ≠ agentPubkey)
- *   - born-resolved-no-provenance (state "resolved" in a kind-9, no edit
- *     provenance — no editSignerPubkey / id / preEditBody)
- *   - correlation-mismatch resolved body (originalEventId or nonce doesn't
- *     match the card it claims to resolve)
+ * `selectPermissionRequest` is the single source of truth for prose suppression
+ * in `MessageRow` — it incorporates channelId + isAgent eligibility AND calls
+ * `computePermissionRequest` to produce the trusted payload the card block
+ * renders. Non-null iff a card will render.
  *
- * Carl's F3 requirement: integrated forged-signer + born-resolved tests that
- * assert the prose fallback is NOT suppressed (the card will not render for
- * these shapes, so neither should prose be hidden).
+ * This closes every blank-row case:
+ *   - falsy channelId → no card → no prose suppression
+ *   - !message.isAgent → no card → no prose suppression
+ *   - forged signer (signerPubkey ≠ agentPubkey) → computePermissionRequest null
+ *   - born-resolved-no-provenance → computePermissionRequest null
+ *   - correlation-mismatch resolved body → computePermissionRequest null
  */
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
@@ -21,7 +20,11 @@ import { describe, it } from "node:test";
 const mod = await import("./permissionRequestAuthPubkey.js").catch(
   () => import("./permissionRequestAuthPubkey.ts"),
 );
-const { getPermissionRequestAgentPubkey, hasPermissionRequestCard } = mod;
+const {
+  getPermissionRequestAgentPubkey,
+  hasPermissionRequestCard,
+  selectPermissionRequest,
+} = mod;
 
 // ── Fixtures ──────────────────────────────────────────────────────────────────
 
@@ -36,6 +39,8 @@ const MESSAGE_ID =
 const OTHER_ID =
   "fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321";
 
+const CHANNEL_ID = "chan-test-001";
+
 const PENDING_BODY = JSON.stringify({
   v: 1,
   state: "pending",
@@ -67,6 +72,7 @@ const PROSE_BODY = "Hello from the agent";
 function makePendingMessage(overrides = {}) {
   return {
     kind: 9,
+    isAgent: true,
     signerPubkey: AGENT_PUBKEY,
     body: PENDING_BODY,
     id: MESSAGE_ID,
@@ -102,7 +108,142 @@ describe("getPermissionRequestAgentPubkey", () => {
   });
 });
 
+// ── selectPermissionRequest ───────────────────────────────────────────────────
+//
+// These are the authoritative tests for the prose-suppression gate.
+// selectPermissionRequest folds in channelId + isAgent eligibility so the
+// result can be used directly in MessageRow without any secondary check.
+
+describe("selectPermissionRequest", () => {
+  it("test_returns_selection_for_trusted_pending_sentinel", () => {
+    const msg = makePendingMessage();
+    const sel = selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID);
+    assert.ok(sel !== null, "trusted pending sentinel must return a selection");
+    assert.equal(sel.agentPubkey, AGENT_PUBKEY);
+    assert.equal(sel.request.state, "pending");
+  });
+
+  it("test_returns_null_for_null_channel_id", () => {
+    // channelId=null means no card → no prose suppression.
+    const msg = makePendingMessage();
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, null),
+      null,
+      "null channelId must return null — no card will render",
+    );
+  });
+
+  it("test_returns_null_for_undefined_channel_id", () => {
+    const msg = makePendingMessage();
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, undefined),
+      null,
+      "undefined channelId must return null",
+    );
+  });
+
+  it("test_returns_null_for_empty_string_channel_id", () => {
+    const msg = makePendingMessage();
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, ""),
+      null,
+      "empty-string channelId must return null (falsy)",
+    );
+  });
+
+  it("test_returns_null_when_isAgent_false", () => {
+    // !isAgent → no card → no prose suppression.
+    const msg = makePendingMessage({ isAgent: false });
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID),
+      null,
+      "non-agent message must return null",
+    );
+  });
+
+  it("test_returns_null_for_forged_signer_prose_not_suppressed", () => {
+    // F3: forged signer — valid sentinel JSON but wrong signer.
+    // computePermissionRequest rejects on the D1 signer gate.
+    // Prose must NOT be suppressed — fallback to markdown.
+    const msg = makePendingMessage({ signerPubkey: ATTACKER_PUBKEY });
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID),
+      null,
+      "forged signer must return null — prose must not be suppressed",
+    );
+  });
+
+  it("test_returns_null_for_prose_body_even_with_known_agent", () => {
+    const msg = makePendingMessage({ body: PROSE_BODY });
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID),
+      null,
+      "non-sentinel body must not suppress prose",
+    );
+  });
+
+  it("test_returns_null_for_born_resolved_no_provenance", () => {
+    // Born-resolved-no-provenance: body is already "resolved" but has no edit
+    // provenance. computePermissionRequest rejects — no edit signer present.
+    const msg = makePendingMessage({
+      body: RESOLVED_BODY,
+      editSignerPubkey: undefined,
+      id: MESSAGE_ID,
+      preEditBody: undefined,
+    });
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID),
+      null,
+      "born-resolved without edit provenance must return null",
+    );
+  });
+
+  it("test_returns_selection_for_resolved_with_valid_provenance", () => {
+    const msg = makePendingMessage({
+      body: RESOLVED_BODY,
+      editSignerPubkey: AGENT_PUBKEY,
+      id: MESSAGE_ID,
+      preEditBody: PENDING_BODY,
+    });
+    const sel = selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID);
+    assert.ok(
+      sel !== null,
+      "resolved with valid provenance must return selection",
+    );
+    assert.equal(sel.request.state, "resolved");
+  });
+
+  it("test_returns_null_for_correlation_mismatch_resolved", () => {
+    const mismatchedBody = JSON.stringify({
+      v: 1,
+      state: "resolved",
+      requestNonce: "a9f3b2c1-d4e5-4f6a-b7c8-d9e0f1a2b3c4",
+      originalEventId: OTHER_ID, // ← different from MESSAGE_ID
+      sessionId: "sess-abc",
+      turnId: "turn-xyz",
+      expiresAt: 9_999_999_999,
+      optionIds: ["opt-allow", "opt-deny"],
+      labels: { "opt-allow": "Allow once", "opt-deny": "Deny" },
+      outcome: "applied",
+      chosenOptionId: "opt-allow",
+    });
+    const msg = makePendingMessage({
+      body: mismatchedBody,
+      editSignerPubkey: AGENT_PUBKEY,
+      id: MESSAGE_ID,
+      preEditBody: PENDING_BODY,
+    });
+    assert.equal(
+      selectPermissionRequest(msg, isKnownAgent, CHANNEL_ID),
+      null,
+      "correlation-mismatch resolved must return null",
+    );
+  });
+});
+
 // ── hasPermissionRequestCard ──────────────────────────────────────────────────
+// Legacy boolean delegate — kept for coverage. Tests use isAgent: true because
+// the function now requires it (delegates to selectPermissionRequest path).
 
 describe("hasPermissionRequestCard", () => {
   it("test_returns_true_for_trusted_agent_pending_sentinel", () => {
@@ -115,9 +256,6 @@ describe("hasPermissionRequestCard", () => {
   });
 
   it("test_returns_false_for_forged_signer_prose_not_suppressed", () => {
-    // F3: forged signer — valid sentinel JSON but wrong signer.
-    // computePermissionRequest rejects on the D1 signer gate.
-    // Prose must NOT be suppressed — fallback to markdown.
     const msg = makePendingMessage({ signerPubkey: ATTACKER_PUBKEY });
     assert.equal(
       hasPermissionRequestCard(msg, isKnownAgent),
@@ -154,10 +292,6 @@ describe("hasPermissionRequestCard", () => {
   });
 
   it("test_returns_false_for_born_resolved_no_provenance", () => {
-    // Born-resolved-no-provenance: the kind-9 body is already "resolved"
-    // but has no edit provenance (no editSignerPubkey / id / preEditBody).
-    // computePermissionRequest rejects this — no edit signer present.
-    // The prose must render, not produce a blank row.
     const msg = makePendingMessage({
       body: RESOLVED_BODY,
       editSignerPubkey: undefined,
@@ -172,7 +306,6 @@ describe("hasPermissionRequestCard", () => {
   });
 
   it("test_returns_true_for_resolved_with_valid_provenance", () => {
-    // Resolved with proper edit provenance — card renders, prose suppressed.
     const msg = makePendingMessage({
       body: RESOLVED_BODY,
       editSignerPubkey: AGENT_PUBKEY,
@@ -187,9 +320,6 @@ describe("hasPermissionRequestCard", () => {
   });
 
   it("test_returns_false_for_correlation_mismatch_resolved", () => {
-    // Correlation mismatch: originalEventId in the resolved body names a
-    // DIFFERENT event ID than the message's own id.
-    // computePermissionRequest rejects — this is a cross-card attack.
     const mismatchedBody = JSON.stringify({
       v: 1,
       state: "resolved",
diff --git a/desktop/src/features/messages/ui/permissionRequestAuthPubkey.ts b/desktop/src/features/messages/ui/permissionRequestAuthPubkey.ts
index 973d50aeb5..d9b4868c1e 100644
--- a/desktop/src/features/messages/ui/permissionRequestAuthPubkey.ts
+++ b/desktop/src/features/messages/ui/permissionRequestAuthPubkey.ts
@@ -1,6 +1,7 @@
 import { KIND_STREAM_MESSAGE } from "@/shared/constants/kinds";
 import type { TimelineMessage } from "@/features/messages/types";
 import { computePermissionRequest } from "@/shared/lib/computePermissionRequest";
+import type { PermissionRequestPayload } from "@/shared/lib/permissionRequest";
 
 /**
  * Returns the agent pubkey to use for the `PermissionRequestCard` for a given
@@ -31,27 +32,93 @@ export function getPermissionRequestAgentPubkey(
 }
 
 /**
- * Returns `true` only when `computePermissionRequest` would return a non-null
- * payload for this message — i.e., when the trusted card WILL render.
+ * Pre-computed permission-request result — the single trusted payload and the
+ * authenticated agent pubkey. Returned by `selectPermissionRequest` when the
+ * card will render; `null` when it will not.
+ */
+export type PermissionRequestSelection = {
+  agentPubkey: string;
+  request: PermissionRequestPayload;
+};
+
+/**
+ * Computes the permission-request card payload ONCE, incorporating all render
+ * eligibility checks — including `channelId` and `message.isAgent` — so the
+ * result can be used for BOTH prose suppression in `MessageRow` AND as the
+ * pre-computed input to `PermissionRequestCardBlock`.
  *
- * Used by `MessageRow` to suppress prose rendering. The check is intentionally
- * identical to what `PermissionRequestCardBlock` computes so that prose is
- * suppressed if and only if a card renders — closing the blank-row gap from
- * every case `computePermissionRequest` rejects:
- *   - forged signer (signerPubkey ≠ agentPubkey)
- *   - born-resolved-no-provenance (state resolved, no editSignerPubkey)
- *   - correlation-mismatch resolved body
+ * Returns non-null iff a card will render, by construction:
+ *   - `channelId` is truthy (falsy channelId → no card → no prose suppression)
+ *   - `message.isAgent` is true
+ *   - signer is a known agent (`getPermissionRequestAgentPubkey` succeeds)
+ *   - `computePermissionRequest` returns a non-null payload
  *
- * Mirrors `selectProseOrPermission` — the card owns the prose-suppression
- * decision by construction rather than by a parallel approximation.
+ * This is the single source of truth for the prose-suppression decision in
+ * `MessageRow`. Passing this result to `PermissionRequestCardBlock` closes
+ * the double-computation gap and ensures prose is suppressed iff the card
+ * renders — by construction, not by approximation.
+ *
+ * Mirrors `selectProseOrPermission` — the card's prose-suppression contract.
+ */
+export function selectPermissionRequest(
+  message: Pick<
+    TimelineMessage,
+    | "kind"
+    | "isAgent"
+    | "signerPubkey"
+    | "body"
+    | "editSignerPubkey"
+    | "id"
+    | "preEditBody"
+  >,
+  isKnownAgentPubkey: (pubkey: string) => boolean,
+  channelId: string | null | undefined,
+): PermissionRequestSelection | null {
+  if (!channelId || !message.isAgent) return null;
+  const agentPubkey = getPermissionRequestAgentPubkey(
+    message,
+    isKnownAgentPubkey,
+  );
+  const request = computePermissionRequest(
+    message.body,
+    true,
+    agentPubkey,
+    message.signerPubkey,
+    message.editSignerPubkey,
+    message.id,
+    message.preEditBody,
+  );
+  if (request === null || !agentPubkey) return null;
+  return { agentPubkey, request };
+}
+
+/**
+ * Returns `true` only when `selectPermissionRequest` returns a non-null
+ * selection — i.e., when a card will render.
+ *
+ * Kept as a thin delegate over `selectPermissionRequest` for callers that only
+ * need a boolean (e.g. MessageRow's prose-suppression guard). The prose guard
+ * and the card block both derive from the same `selectPermissionRequest` call,
+ * so prose is suppressed iff the card renders.
+ *
+ * @deprecated Use `selectPermissionRequest` directly when you also need the
+ * computed agentPubkey/request to pass to the block.
  */
 export function hasPermissionRequestCard(
   message: Pick<
     TimelineMessage,
-    "kind" | "signerPubkey" | "body" | "editSignerPubkey" | "id" | "preEditBody"
+    | "kind"
+    | "isAgent"
+    | "signerPubkey"
+    | "body"
+    | "editSignerPubkey"
+    | "id"
+    | "preEditBody"
   >,
   isKnownAgentPubkey: (pubkey: string) => boolean,
 ): boolean {
+  // Note: channelId is not available here; MessageRow should use
+  // selectPermissionRequest directly and pass channelId.
   const agentPubkey = getPermissionRequestAgentPubkey(
     message,
     isKnownAgentPubkey,
diff --git a/desktop/src/shared/lib/permissionRequest.ts b/desktop/src/shared/lib/permissionRequest.ts
index 135c3faf1b..5912a016a6 100644
--- a/desktop/src/shared/lib/permissionRequest.ts
+++ b/desktop/src/shared/lib/permissionRequest.ts
@@ -50,9 +50,12 @@ export type PermissionRequestPending = {
   labels: Record<string, string>;
   /**
    * Human-readable description of the requested operation, sourced from the
-   * `params.subject` field of the ACP `session/request_permission` message.
-   * Truncated producer-side to ≤ 200 UTF-8 bytes. `null` when the adapter
-   * did not provide a subject or provided an empty string.
+   * ACP `session/request_permission` message via `description_from_request_permission`
+   * in `crates/buzz-acp/src/acp.rs`. Tries `params.title`,
+   * `params.subject.toolCall.title`, `params.toolCall.title`,
+   * `params.toolCall.rawInput.command`, and `params._meta.codex.params.reason` in order.
+   * Truncated producer-side to ≤ 200 UTF-8 bytes. `null` when no path yields a
+   * non-empty string.
    *
    * Display-only — treated as an untrusted string and rendered as text (HTML-
    * escaped by React). The sentinel is valid when this field is absent or null.
diff --git a/docs/nips/NIP-AO.md b/docs/nips/NIP-AO.md
index b73e0daae4..bbe51dfdca 100644
--- a/docs/nips/NIP-AO.md
+++ b/docs/nips/NIP-AO.md
@@ -354,9 +354,11 @@ additional round trip.
 The event content is a compact JSON object that matches the D6 frozen schema
 (`requestNonce`, `optionIds`, `labels`, `expiresAt`, `description`, …). `description`
 is sourced from `params.title` (buzz-agent v2), `params.subject.toolCall.title`
-(v2 fallback), or `params.toolCall.title` (buzz-agent v1 / codex-acp) of the
+(v2 fallback), `params.toolCall.title` (buzz-agent v1 / codex-acp permissions-request),
+`params.toolCall.rawInput.command` (codex-acp v1.1.7 command requests), or
+`params._meta.codex.params.reason` (codex-acp v1.1.7 file-change requests) of the
 `session/request_permission` message — the first non-empty value wins. It is
-`null` when no adapter-provided title is found. `optionIds` is a
+`null` when no adapter-provided description is found. `optionIds` is a
 **two-action contract**: exactly one `allow_once` and one `reject_once`, in that
 order — the harness selects them via `select_card_actions` and fails closed if
 either is absent or ambiguous, so no other option (e.g. `allow_always`) can ever
@@ -426,9 +428,11 @@ an unrenderable card. Labels and `description` are lossy display strings and are
 only fields truncated rather than rejected; truncation lands on a UTF-8 char boundary
 so the result is always valid UTF-8 within the byte limit the Desktop parser accepts.
 Label values in the sentinel come directly from the ACP options' `name` fields;
-render them verbatim. `description` is sourced from the adapter's title field —
+render them verbatim. `description` is sourced from the adapter's operation field —
 `params.title` (buzz-agent v2), `params.subject.toolCall.title` (v2 fallback),
-or `params.toolCall.title` (v1 / codex-acp) — and describes the operation being
+`params.toolCall.title` (v1 / codex-acp permissions-request),
+`params.toolCall.rawInput.command` (codex-acp v1.1.7 command), or
+`params._meta.codex.params.reason` (codex-acp v1.1.7 file-change) — and describes the operation being
 authorized.
 
 ### Sentinel authenticity