fix(web): close P3 chat re-review findings

apps/web/src/spa/chat/commands-panel.tsx

@@ -1,14 +1,16 @@
 import { useState, type ReactElement } from 'react';
 import type { PendingApproval } from './use-chat-connection';
-import { asString } from './runtime-guards';
+import { asNonEmptyString, asString } from './runtime-guards';
 import type {
   CommandManifest,
   SlashCommandApprovalResultPayload,
   SlashCommandResultPayload,
 } from '@/lib/chat-contract';
 
-/** Stable client copy shown for a failed command — never the raw server
- * detail, which could leak internal error text to the user. */
+/** Stable fallback copy shown for a failed command only when the server's
+ * own guarded, non-empty `message` (e.g. "Unknown model") is absent or
+ * malformed — the structured contract reason itself is otherwise shown
+ * directly, never a raw thrown exception, stack trace, or object value. */
 const COMMAND_FAILURE_COPY = 'Command failed.';
 
 interface CommandsPanelProps {
@@ -104,11 +106,17 @@ export function CommandsPanel({
 
       {approval ? (
         <div role={approval.success ? 'status' : 'alert'} className="flex items-center gap-2">
-          {/* Stable client copy only — never the server-controlled
-              approval.message or echoed approval.command as the primary
-              confirmation. The frozen local pendingApproval below (not this
-              line) is the sole authoritative statement of what will run. */}
-          <span>{approval.success ? 'Approved.' : 'Denied.'}</span>
+          {/* A successful approval shows stable client copy only — never
+              the server-controlled approval.message or echoed
+              approval.command as the primary confirmation. The frozen local
+              pendingApproval below (not this line) is the sole authoritative
+              statement of what will run. A denial, by contrast, is not an
+              execution authority and safely surfaces the guarded structured
+              reason the server gave (e.g. "Not authorized"), falling back to
+              a stable copy only when absent/malformed. */}
+          <span>
+            {approval.success ? 'Approved.' : asNonEmptyString(approval.message, 'Denied.')}
+          </span>
           {canRunApproved && pendingApproval ? (
             <>
               {/* Authoritative frozen local command+args — what the click below
@@ -135,7 +143,7 @@ export function CommandsPanel({
                 ? typeof result.message === 'string' && result.message
                   ? ` — ${result.message}`
                   : ''
-                : ` — ${COMMAND_FAILURE_COPY}`}
+                : ` — ${asNonEmptyString(result.message, COMMAND_FAILURE_COPY)}`}
             </li>
           ))}
         </ul>