Module refusal 

The one place refusal copy is written (docs/design/refusal-copy.md).

Three producers used to write their own: the gated reason in main.rs, the --explain header, and the nudge. That is how “not on the allowlist” survived in some outputs after being removed from others. Everything routes through Refusal::render instead, so a wording change lands everywhere or nowhere.

The message is chosen by what safe-chains EMITS for this command on this harness, never by the harness’s name. A deny-harness we abstain on produces an ordinary prompt, so “blocked” would be a lie there. Deriving copy from the emission is what stops it drifting when a harness’s behaviour changes, as Cursor’s did when allow turned out to be ignored.

Structs

Refusal

A refusal to render. See the module docs.

Enums

Cause

Why safe-chains did not approve the command.

Outcome

What happens to the command after safe-chains answers.

Constants

AVOID

Words that characterise the COMMAND rather than describing what happened.

EXPLAIN_MANY

The same, for a chain where only some segments were refused.

EXPLAIN_SINGLE

The --explain header for a single command that did not auto-approve.