You'll notice
Permission deny/ask messages now show the exact rule text that triggered the block
What
When a tool call is denied or requires confirmation ('ask') because it matched a specific permission rule, the message shown to the user now appends that rule's own associated hint text, including in cases where the match happened on a nested subcommand.
Why
This makes it clear which permission rule caused a block or prompt, and shows any custom message attached to that rule, instead of leaving the user to guess which rule fired.