@jwilger/pi-development-system 0.3.0 → 0.3.2

package/extensions/development-system.ts

@@ -31,14 +31,15 @@ export function createDevelopmentSystem(pi: ExtensionAPI) {
 
   const rebuild = (ctx: ExtensionContext) => {
     lastCtx = ctx;
-    const probe = jevHolder.probe(ctx);
-    jevModel = probe.model;
-    state.update((s) => (s.jev === probe.availability ? s : { ...s, jev: probe.availability }));
     const entries = ctx.sessionManager
       .getBranch()
       .flatMap((e) => (e.type === "custom" ? [{ customType: e.customType, data: e.data }] : []));
+    // Restore persisted state first: updating before it would append an empty state entry that wins.
     state.rebuildFrom(entries);
     approvals.rebuildFrom(entries);
+    const probe = jevHolder.probe(ctx);
+    jevModel = probe.model;
+    state.update((s) => (s.jev === probe.availability ? s : { ...s, jev: probe.availability }));
     refreshStatus();
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/src/core/test-paths.ts

@@ -1,7 +1,10 @@
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
 export type TestPathProfile = { readonly testGlobs?: readonly string[] };
 
 const PATTERNS: readonly RegExp[] = [
-  /(^|\/)(test|tests|__tests__|spec|specs|e2e)\//,
+  /(^|\/)(test|tests|__tests__|spec|specs|e2e)(\/|$)/,
   /\.(test|spec|cy)\.[cm]?[jt]sx?$/,
   /_test\.(go|rb|py|exs?|rs)$/,
   /(^|\/)test_[^/]+\.py$/,
@@ -25,3 +28,15 @@ export function isTestPath(path: string, profile?: TestPathProfile): boolean {
   if (PATTERNS.some((p) => p.test(normalized))) return true;
   return (profile?.testGlobs ?? []).some((g) => globToRegExp(g).test(normalized));
 }
+
+/**
+ * Repo-relative form of a path exactly as pi would resolve it: a leading `@` is dropped, `~` expands
+ * to the home directory and `file://` URLs are decoded, so guards see the file that is really touched.
+ */
+export function normalizeRepoPath(cwd: string, input: string, home: string): string {
+  let path = input.startsWith("@") ? input.slice(1) : input;
+  if (path === "~") path = home;
+  else if (path.startsWith("~/")) path = join(home, path.slice(2));
+  else if (/^file:\/\//.test(path)) path = fileURLToPath(path);
+  return isAbsolute(path) ? relative(cwd, path) : relative(cwd, resolve(cwd, path)) || ".";
+}

package/src/core/test-weakening.ts

@@ -1,24 +1,59 @@
+import { posix } from "node:path";
 import { parse } from "shell-quote";
 
-export type WeakeningSignals = { addsSkip: boolean; emptied: boolean };
+export type WeakeningSignals = { addsSkip: boolean; emptied: boolean; commentedOut: boolean };
 
 const SKIP_MARKERS: readonly RegExp[] = [
-  /\b(?:it|test|describe|context)\.(?:skip|todo)\b/,
+  /\b(?:it|test|describe|context)\.(?:skip|todo|only)\b/,
+  /\bf(?:it|describe)\(/,
   /\bx(?:it|describe|test)\(/,
   /#\[ignore\b/,
-  /@pytest\.mark\.skip|@unittest\.skip|\bpytest\.skip\(/,
+  /@pytest\.mark\.(?:skip|skipif|xfail)|@unittest\.skip|\bpytest\.skip\(/,
   /\bt\.Skip(?:Now|f)?\(/,
   /@Disabled\b|@Ignore\b/,
+  /\bprocess\.exit\(/,
 ];
 
 const countSkips = (text: string): number =>
   SKIP_MARKERS.reduce((n, re) => n + (text.match(new RegExp(re.source, "g"))?.length ?? 0), 0);
 
+/** Lines that are neither blank, inside a C-style block comment, nor a line comment. */
+function codeLineCount(text: string): number {
+  let inBlock = false;
+  let count = 0;
+  for (const raw of text.split("\n")) {
+    let line = raw.trim();
+    let code = false;
+    while (line !== "") {
+      if (inBlock) {
+        const end = line.indexOf("*/");
+        if (end < 0) break;
+        inBlock = false;
+        line = line.slice(end + 2).trim();
+      } else if (line.startsWith("//") || line.startsWith("#")) {
+        break;
+      } else if (line.startsWith("/*")) {
+        inBlock = true;
+        line = line.slice(2);
+      } else {
+        code = true;
+        const start = line.indexOf("/*");
+        if (start < 0) break;
+        inBlock = true;
+        line = line.slice(start + 2);
+      }
+    }
+    if (code) count++;
+  }
+  return count;
+}
+
 /** Deterministic weakening signals between two versions of a test file. */
 export function weakeningSignals(before: string, after: string): WeakeningSignals {
   return {
     addsSkip: countSkips(after) > countSkips(before),
     emptied: before.trim() !== "" && after.trim() === "",
+    commentedOut: codeLineCount(after) < codeLineCount(before) && isPureAddition(before, after),
   };
 }
 
@@ -45,24 +80,223 @@ export function isPureAddition(before: string, after: string): boolean {
   return true;
 }
 
-const DELETERS = new Set(["rm", "unlink", "trash", "rmdir"]);
+/** Lines of `after` not matched by a line of `before` (multiset difference, order preserved). */
+export function addedLines(before: string, after: string): string[] {
+  const remaining = new Map<string, number>();
+  for (const line of before.split("\n")) remaining.set(line, (remaining.get(line) ?? 0) + 1);
+  return after.split("\n").filter((line) => {
+    const left = remaining.get(line) ?? 0;
+    if (left === 0) return true;
+    remaining.set(line, left - 1);
+    return false;
+  });
+}
+
+type Segment = { words: string[]; truncates: string[] };
+type Token = { kind: "word"; value: string } | { kind: "op"; op: string };
+
+/** Turns unquoted newlines into `;` (and joins backslash continuations) so shell-quote sees every command. */
+function splitLines(command: string): string {
+  let out = "";
+  let quote: "'" | '"' | undefined;
+  for (let i = 0; i < command.length; i++) {
+    const c = command.charAt(i);
+    if (quote === undefined && c === "\\" && command.charAt(i + 1) === "\n") {
+      out += " ";
+      i++;
+    } else if (quote === undefined && c === "\\") {
+      out += c + command.charAt(i + 1);
+      i++;
+    } else if (quote === undefined && (c === "'" || c === '"')) {
+      quote = c;
+      out += c;
+    } else if (quote === c) {
+      quote = undefined;
+      out += c;
+    } else if (quote === undefined && c === "\n") {
+      out += ";";
+    } else out += c;
+  }
+  return out;
+}
+
+/** Boundary decode of shell-quote's output into domain tokens; globs count as words. */
+function tokenize(command: string): Token[] {
+  return parse(splitLines(command)).flatMap((entry): Token[] => {
+    if (typeof entry === "string") return [{ kind: "word", value: entry }];
+    if ("pattern" in entry) return [{ kind: "word", value: entry.pattern }];
+    if ("op" in entry) return [{ kind: "op", op: entry.op }];
+    return [];
+  });
+}
+
+const TRUNCATING = new Set([">", ">|", "&>"]);
+const NON_TRUNCATING_REDIRECTS = new Set([">>", "&>>", "<", ">&", "<&"]);
 
-/** Paths a bash command removes via rm / unlink / `git rm` (best effort, per simple command). */
-export function bashDeletedPaths(command: string): string[] {
-  const paths: string[] = [];
-  let current: string[] = [];
+/** Splits a shell line into simple commands; `>` targets are kept apart from arguments. */
+function segments(command: string): Segment[] {
+  const out: Segment[] = [];
+  let words: string[] = [];
+  let truncates: string[] = [];
+  let redirect: "none" | "truncate" | "other" = "none";
   const flush = () => {
-    const head = current[0] === "git" && current[1] === "rm" ? "rm" : current[0];
-    const args = current[0] === "git" ? current.slice(2) : current.slice(1);
-    if (head !== undefined && DELETERS.has(head)) {
-      paths.push(...args.filter((a) => !a.startsWith("-")));
-    }
-    current = [];
+    if (words.length > 0 || truncates.length > 0) out.push({ words, truncates });
+    words = [];
+    truncates = [];
+    redirect = "none";
   };
-  for (const token of parse(command)) {
-    if (typeof token === "string") current.push(token);
+  for (const token of tokenize(command)) {
+    if (token.kind === "word") {
+      if (redirect === "truncate") truncates.push(token.value);
+      else if (redirect === "none") words.push(token.value);
+      redirect = "none";
+    } else if (TRUNCATING.has(token.op)) redirect = "truncate";
+    else if (NON_TRUNCATING_REDIRECTS.has(token.op)) redirect = "other";
     else flush();
   }
   flush();
-  return paths;
+  return out;
+}
+
+const WRAPPERS = new Set(["sudo", "env", "command", "nohup", "nice", "time", "exec", "doas"]);
+const SHELLS = new Set(["bash", "sh", "zsh", "dash"]);
+const KNOWN = new Set([
+  ...WRAPPERS,
+  ...SHELLS,
+  "rm",
+  "unlink",
+  "trash",
+  "rmdir",
+  "mv",
+  "git",
+  "truncate",
+  "find",
+  "sed",
+  "tee",
+  "cp",
+  "dd",
+  "cd",
+  "eval",
+]);
+
+const base = (word: string): string => word.slice(word.lastIndexOf("/") + 1);
+const operands = (words: readonly string[]): string[] => words.filter((w) => !w.startsWith("-"));
+
+const KEYWORDS = new Set(["then", "do", "else", "elif", "if", "while", "until", "{", "!"]);
+
+/** Strips env assignments, shell keywords and wrappers so the real command is first. */
+function realCommand(words: readonly string[]): string[] {
+  let rest = [...words];
+  for (;;) {
+    const head = rest[0];
+    if (head === undefined) return rest;
+    if (/^\w+=/.test(head) || KEYWORDS.has(head)) rest = rest.slice(1);
+    else if (base(head) === "timeout") {
+      const at = rest.findIndex((w, i) => i > 0 && /^\d+[smhd]?$/.test(w));
+      rest = at < 0 ? [] : rest.slice(at + 1);
+    } else if (WRAPPERS.has(base(head))) {
+      const next = rest.findIndex((w, i) => i > 0 && KNOWN.has(base(w)) && !WRAPPERS.has(base(w)));
+      const nextWrapper = rest.findIndex((w, i) => i > 0 && WRAPPERS.has(base(w)));
+      if (nextWrapper > 0 && (next < 0 || nextWrapper < next)) rest = rest.slice(nextWrapper);
+      else return next > 0 ? rest.slice(next) : [];
+    } else return rest;
+  }
+}
+
+function findTargets(args: readonly string[]): string[] {
+  const deletes =
+    args.includes("-delete") || (args.includes("-exec") && args.some((a) => base(a) === "rm"));
+  if (!deletes) return [];
+  const starts: string[] = [];
+  for (const a of args) {
+    if (a.startsWith("-") || a === "(" || a === "!") break;
+    starts.push(a);
+  }
+  const patterns = args.flatMap((a, i) =>
+    ["-name", "-iname", "-path", "-ipath", "-regex"].includes(a) && args[i + 1] !== undefined
+      ? [args[i + 1] ?? ""]
+      : [],
+  );
+  return [...starts, ...patterns];
+}
+
+const removers = (args: readonly string[]): string[] => operands(args);
+
+const gitTargets = (args: readonly string[]): string[] => {
+  let i = 0;
+  while (args[i]?.startsWith("-")) i += args[i] === "-C" || args[i] === "-c" ? 2 : 1;
+  const sub = args[i];
+  return sub === "rm" || sub === "mv" ? operands(args.slice(i + 1)) : [];
+};
+
+const sedTargets = (args: readonly string[]): string[] =>
+  args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a)) ? operands(args) : [];
+
+/** The destination operand is overwritten, whatever the source is. */
+const cpTargets = (args: readonly string[]): string[] => operands(args).slice(-1);
+
+const ddTargets = (args: readonly string[]): string[] =>
+  args.flatMap((a) => (a.startsWith("of=") ? [a.slice(3)] : []));
+
+const truncateTargets = (args: readonly string[]): string[] =>
+  operands(args).filter((a) => !/^[+\-<>/%]?\d+$/.test(a));
+
+const TARGETS: Readonly<Record<string, (args: readonly string[]) => string[]>> = {
+  rm: removers,
+  unlink: removers,
+  trash: removers,
+  rmdir: removers,
+  mv: removers,
+  tee: removers,
+  truncate: truncateTargets,
+  find: findTargets,
+  sed: sedTargets,
+  cp: cpTargets,
+  dd: ddTargets,
+  git: gitTargets,
+};
+
+function commandTargets(words: readonly string[]): string[] {
+  const [head, ...args] = words;
+  if (head === undefined) return [];
+  const targets = Object.hasOwn(TARGETS, base(head)) ? TARGETS[base(head)] : undefined;
+  return targets === undefined ? [] : targets(args);
+}
+
+const joinCwd = (cwd: string, path: string): string =>
+  cwd === "" || path.startsWith("/") ? path : posix.join(cwd, path);
+
+function collect(command: string, startCwd: string, depth: number): string[] {
+  const found: string[] = [];
+  let cwd = startCwd;
+  for (const seg of segments(command)) {
+    const words = realCommand(seg.words);
+    const head = words[0] === undefined ? "" : base(words[0]);
+    if (head === "cd") {
+      cwd = joinCwd(cwd, operands(words.slice(1))[0] ?? "~");
+      continue;
+    }
+    if (head === "eval" && depth < 3) {
+      found.push(...collect(words.slice(1).join(" "), cwd, depth + 1));
+      continue;
+    }
+    if (SHELLS.has(head) && depth < 3) {
+      const at = words.findIndex((w, i) => i > 0 && /^-[A-Za-z]*c$/.test(w));
+      const script = at < 0 ? undefined : words[at + 1];
+      if (script !== undefined) found.push(...collect(script, cwd, depth + 1));
+      continue;
+    }
+    found.push(...commandTargets(words).map((p) => joinCwd(cwd, p)));
+    found.push(...seg.truncates.flatMap((p) => (p === "/dev/null" ? [] : [joinCwd(cwd, p)])));
+  }
+  return found;
+}
+
+/**
+ * Paths a bash command removes, moves away, truncates or overwrites (best effort): rm/unlink/mv,
+ * `git rm|mv`, `find -delete`, truncate, `sed -i`, tee and `>` redirects; sees through wrappers,
+ * `bash -c`, `cd` and glob arguments.
+ */
+export function bashMutatedPaths(command: string): string[] {
+  return collect(command, "", 0);
 }

package/src/gates/approvals.ts

@@ -65,6 +65,8 @@ export type HardStopRequest = {
   command: string;
   why: string;
   toolCallId: string;
+  /** What goes wrong if the approved action is a mistake; defaults to the irreversible-git wording. */
+  costIfWrong?: string;
   now?: () => Date;
 };
 
@@ -89,7 +91,7 @@ export async function requestHardStop(req: HardStopRequest): Promise<HardStopOut
     default: lookupGate(req.gate)?.default ?? "hard stop",
     chosen: redactSecrets(req.command),
     why: redactSecrets(req.why),
-    costIfWrong: "an irreversible git operation is performed",
+    costIfWrong: redactSecrets(req.costIfWrong ?? "an irreversible git operation is performed"),
     approver: "user",
     scope: { kind: "once", toolCallId: req.toolCallId },
     recordedAt: at.toISOString().replace(/\.\d{3}Z$/, "Z"),

package/src/gates/test-guard.ts

@@ -1,15 +1,19 @@
-import { readFileSync } from "node:fs";
-import { isAbsolute, join, relative } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import {
   type ExtensionAPI,
   type ExtensionContext,
   isToolCallEventType,
+  type ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
-import { isTestPath } from "../core/test-paths.ts";
+import { isTestPath, normalizeRepoPath } from "../core/test-paths.ts";
 import {
+  addedLines,
   applyEdits,
-  bashDeletedPaths,
+  bashMutatedPaths,
   isPureAddition,
+  type WeakeningSignals,
   weakeningSignals,
 } from "../core/test-weakening.ts";
 import { type GateId, isParseError, parseGateId } from "../core/types.ts";
@@ -35,13 +39,11 @@ type Verdict =
 
 const GATE_ID = "tests.weaken";
 
-const describeSignals = (
-  deleted: boolean,
-  signals: { addsSkip: boolean; emptied: boolean },
-): string | undefined => {
+const describeSignals = (deleted: boolean, signals: WeakeningSignals): string | undefined => {
   if (deleted) return "deletes the test file";
   if (signals.addsSkip) return "skips tests";
   if (signals.emptied) return "empties the test file";
+  if (signals.commentedOut) return "comments out test code";
   return undefined;
 };
 
@@ -53,8 +55,12 @@ const readIfExists = (file: string): string | undefined => {
   }
 };
 
-const repoPath = (cwd: string, path: string): string =>
-  isAbsolute(path) ? relative(cwd, path) : path;
+const repoPath = (cwd: string, path: string): string => normalizeRepoPath(cwd, path, homedir());
+
+/** Added lines that can disable tests without matching a skip marker (block comments, early exits). */
+const RISKY_ADDITION = /\/\*|<!--|=begin\b|"""|'''|\breturn\b|\bthrow\b|\bexit\b|\bpanic\(/;
+
+const GLOB = /[*?[\]{]/;
 
 /**
  * Soft gate `tests.weaken`: deleting, skipping, emptying or loosening tests needs a recorded
@@ -88,89 +94,123 @@ export function registerTestGuard(deps: TestGuardDeps): void {
 
   const judge = async (change: Change, ctx: ExtensionContext): Promise<Verdict> => {
     const deleted = change.after === undefined;
-    if (!deleted && isPureAddition(change.before, change.after ?? "")) return { kind: "allow" };
     const signals = deleted
-      ? { addsSkip: false, emptied: false }
+      ? { addsSkip: false, emptied: false, commentedOut: false }
       : weakeningSignals(change.before, change.after ?? "");
+    // Adding lines never weakens a test unless the added line itself is a skip marker.
+    const after = change.after ?? "";
+    if (
+      !deleted &&
+      !signals.addsSkip &&
+      !signals.commentedOut &&
+      isPureAddition(change.before, after) &&
+      !addedLines(change.before, after).some((line) => RISKY_ADDITION.test(line))
+    ) {
+      return { kind: "allow" };
+    }
     const deterministic = describeSignals(deleted, signals);
     const judged = await judgeTestChange(deps.jev(ctx), {
       path: change.path,
       before: change.before,
       ...(change.after !== undefined ? { after: change.after } : {}),
     });
-    if (judged.ok && judged.value.weakens >= WEAKENS_THRESHOLD) {
-      return judged.value.motive === "gate-gaming"
-        ? {
-            kind: "hard-stop",
-            why: "Jev reads this change as weakening a check to get a green result",
-          }
-        : {
-            kind: "require-departure",
-            why: `Jev reads this change as weakening the tests (motive: ${judged.value.motive})`,
-          };
+    if (judged.ok) {
+      const { weakens, motive } = judged.value;
+      const weakening = weakens >= WEAKENS_THRESHOLD || deterministic !== undefined;
+      if (weakening && motive === "gate-gaming") {
+        return {
+          kind: "hard-stop",
+          why: "Jev reads this change as weakening a check to get a green result",
+        };
+      }
+      if (weakens >= WEAKENS_THRESHOLD) {
+        return {
+          kind: "require-departure",
+          why: `Jev reads this change as weakening the tests (motive: ${motive})`,
+        };
+      }
     }
     return deterministic !== undefined
       ? { kind: "require-departure", why: `this change ${deterministic}` }
       : { kind: "allow" };
   };
 
-  deps.pi.on("tool_call", async (event, ctx) => {
-    const changes: Change[] = [];
+  const collectChanges = (event: ToolCallEvent, ctx: ExtensionContext): Change[] => {
     if (isToolCallEventType("bash", event)) {
-      for (const raw of bashDeletedPaths(event.input.command)) {
+      return bashMutatedPaths(event.input.command).flatMap((raw) => {
         const path = repoPath(ctx.cwd, raw);
-        if (!isTestPath(path)) continue;
-        changes.push({ path, before: readIfExists(join(ctx.cwd, path)) ?? "", after: undefined });
-      }
-    } else if (isToolCallEventType("write", event) || isToolCallEventType("edit", event)) {
-      const path = repoPath(ctx.cwd, event.input.path);
-      if (!isTestPath(path)) return undefined;
-      const before = readIfExists(join(ctx.cwd, path));
-      if (before === undefined) return undefined;
-      const after = isToolCallEventType("write", event)
-        ? event.input.content
-        : applyEdits(before, event.input.edits);
-      changes.push({ path, before, after });
-    } else {
-      return undefined;
+        // Missing plain paths have nothing to weaken; globs and directories may still hide tests.
+        const touched = GLOB.test(path) || existsSync(join(ctx.cwd, path));
+        return isTestPath(path) && touched
+          ? [{ path, before: readIfExists(join(ctx.cwd, path)) ?? "", after: undefined }]
+          : [];
+      });
     }
+    if (!isToolCallEventType("write", event) && !isToolCallEventType("edit", event)) return [];
+    const path = repoPath(ctx.cwd, event.input.path);
+    const before = isTestPath(path) ? readIfExists(join(ctx.cwd, path)) : undefined;
+    if (before === undefined) return [];
+    const after = isToolCallEventType("write", event)
+      ? event.input.content
+      : applyEdits(before, event.input.edits);
+    return [{ path, before, after }];
+  };
 
-    for (const change of changes) {
-      const verdict = await judge(change, ctx);
-      if (verdict.kind === "allow") continue;
-      if (verdict.kind === "require-departure") {
-        if (hasOpenDeparture()) {
-          consumeOpenDeparture();
-          continue;
-        }
-        return {
-          block: true,
-          reason:
-            `${GATE_ID}: ${verdict.why} (${change.path}). Tests are the oracle; weakening them needs a ` +
-            `recorded decision. If this is deliberate, call devsys_record_departure with gate "${GATE_ID}", ` +
-            "what you are doing instead, why, and the cost if wrong; then retry. Otherwise fix the code, not the test.",
-        };
-      }
-      const command = `${isToolCallEventType("bash", event) ? "delete" : "change"} ${change.path}`;
-      if (deps.approvals.consume(gate, command)) continue;
-      const outcome = await requestHardStop({
-        pi: deps.pi,
-        ctx,
-        gate,
-        command,
-        why: verdict.why,
-        toolCallId: event.toolCallId,
-        ...(deps.now !== undefined ? { now: deps.now } : {}),
-      });
-      if (outcome.kind === "approved") continue;
-      return {
-        block: true,
-        reason:
-          outcome.kind === "unavailable"
-            ? `hard stop ${GATE_ID}: ${verdict.why} (${change.path}); requires user approval; run interactively`
-            : `hard stop ${GATE_ID}: the user declined this change to ${change.path}. Fix the code instead of weakening the test.`,
-      };
+  const hardStop = async (
+    event: ToolCallEvent,
+    ctx: ExtensionContext,
+    change: Change,
+    why: string,
+  ): Promise<{ block: true; reason: string } | undefined> => {
+    const command = `${isToolCallEventType("bash", event) ? "delete" : "change"} ${change.path}`;
+    if (deps.approvals.consume(gate, command)) return undefined;
+    const outcome = await requestHardStop({
+      pi: deps.pi,
+      ctx,
+      gate,
+      command,
+      why,
+      costIfWrong: "the tests verify less behaviour, so regressions can ship undetected",
+      toolCallId: event.toolCallId,
+      ...(deps.now !== undefined ? { now: deps.now } : {}),
+    });
+    if (outcome.kind === "approved") return undefined;
+    return {
+      block: true,
+      reason:
+        outcome.kind === "unavailable"
+          ? `hard stop ${GATE_ID}: ${why} (${change.path}); requires user approval; run interactively`
+          : `hard stop ${GATE_ID}: the user declined this change to ${change.path}. Fix the code instead of weakening the test.`,
+    };
+  };
+
+  deps.pi.on("tool_call", async (event, ctx) => {
+    const verdicts: Array<{ change: Change; verdict: Verdict }> = [];
+    for (const change of collectChanges(event, ctx)) {
+      verdicts.push({ change, verdict: await judge(change, ctx) });
     }
-    return undefined;
+    for (const { change, verdict } of verdicts) {
+      if (verdict.kind !== "hard-stop") continue;
+      const blocked = await hardStop(event, ctx, change, verdict.why);
+      if (blocked !== undefined) return blocked;
+    }
+    const needing = verdicts.flatMap(({ change, verdict }) =>
+      verdict.kind === "require-departure" ? [{ change, why: verdict.why }] : [],
+    );
+    const first = needing[0];
+    if (first === undefined) return undefined;
+    if (hasOpenDeparture()) {
+      // One departure covers every path in this single tool call.
+      consumeOpenDeparture();
+      return undefined;
+    }
+    return {
+      block: true,
+      reason:
+        `${GATE_ID}: ${first.why} (${needing.map((n) => n.change.path).join(", ")}). Tests are the oracle; ` +
+        `weakening them needs a recorded decision. If this is deliberate, call devsys_record_departure ` +
+        `with gate "${GATE_ID}", what you are doing instead, why, and the cost if wrong; then retry. ` +
+        "Otherwise fix the code, not the test.",
+    };
   });
 }

package/src/jev/client.ts

@@ -23,8 +23,7 @@ type Classifier = ClassifierModel<ClassifierApi>;
 /** The slice of pi's `ctx.modelRegistry` that Jev needs; tests pass a fake. */
 export interface ClassifierRegistry {
   findOfType(type: "classifier", provider: string, modelId: string): Classifier | undefined;
-  // biome-ignore lint/suspicious/noExplicitAny: structural bridge to the host's Model<Api> parameter
-  hasConfiguredAuth(model: any): boolean;
+  hasConfiguredAuth(model: unknown): boolean;
   classify(
     model: Classifier,
     context: ClassifierContext,

package/src/jev/questions/shell-intent.ts

@@ -1,5 +1,6 @@
 import type { ClassifierChoiceQuestion } from "@earendil-works/pi-ai";
 import type { GitIntent } from "../../core/git-intent.ts";
+import { redactSecrets } from "../../core/redact.ts";
 import { err, ok, type Result } from "../../core/result.ts";
 import type { Jev, JevError } from "../client.ts";
 
@@ -43,7 +44,10 @@ export async function judgeShellIntent(
   jev: Jev,
   command: string,
 ): Promise<Result<{ intent: GitIntent; confidence: number }, JevError>> {
-  const asked = await jev.ask({ command }, { intent: SHELL_INTENT_QUESTION });
+  const asked = await jev.ask(
+    { command: redactSecrets(command) },
+    { intent: SHELL_INTENT_QUESTION },
+  );
   if (!asked.ok) return asked;
   const answer = asked.value.intent;
   if (answer?.type !== "choice")

package/src/jev/questions/test-change.ts

@@ -1,4 +1,5 @@
 import type { ClassifierBoolQuestion, ClassifierChoiceQuestion } from "@earendil-works/pi-ai";
+import { redactSecrets } from "../../core/redact.ts";
 import { err, ok, type Result } from "../../core/result.ts";
 import type { Jev, JevError } from "../client.ts";
 
@@ -53,7 +54,7 @@ export async function judgeTestChange(
   jev: Jev,
   input: TestChangeInput,
 ): Promise<Result<{ weakens: number; motive: TestChangeMotive; confidence: number }, JevError>> {
-  const clip = (text: string | undefined): string => (text ?? "").slice(0, 6000);
+  const clip = (text: string | undefined): string => redactSecrets(text ?? "").slice(0, 6000);
   const state = {
     path: input.path,
     before: clip(input.before),