@sigrun/warden 0.0.0-stage → 0.1.0

package/dist/escalate.js

@@ -0,0 +1,72 @@
+import { redact } from "pi-warden";
+/** The human-facing body of a raised hold: tool, redacted args, reasons. */
+export function escalationBody(call, reasons) {
+    const redactedArgs = redact(JSON.stringify(call.arguments));
+    const reasonLines = reasons.map((reason) => `- ${reason}`).join("\n");
+    return `The warden held \`${call.name}\` in a job run.\n\nArguments:\n\`\`\`json\n${redactedArgs}\n\`\`\`\n\n${reasonLines}`;
+}
+/** One boot-scoped warning when job holds have no inbox to land in. */
+let warnedNoProvider = false;
+/** Test hook: reset the once-per-process no-provider warning. */
+export function resetNoProviderWarning() {
+    warnedNoProvider = false;
+}
+/**
+ * Raise (or dedup) the hold as an escalation item. With no escalation
+ * provider the hold still surfaces: a notice to the job's owner keyed
+ * by the grant key (skipped when the job has no owner), plus one
+ * console.warn per process.
+ */
+export async function raiseEscalation(host, call, key, jobId, owner, reasons, conversationId) {
+    const body = escalationBody(call, reasons);
+    const result = (await host.publishedHooks.call("escalation.raise", {
+        key,
+        title: `Held: ${call.name}`,
+        body,
+        options: [
+            { id: "approve", label: "Approve and run once" },
+            { id: "decline", label: "Decline" },
+        ],
+        allowInstruction: false,
+        onAnswer: "next-run",
+        jobId,
+    }, { conversationId }));
+    if (result.status === "absent") {
+        if (!warnedNoProvider) {
+            warnedNoProvider = true;
+            console.warn("warden: no escalation provider; job holds have no inbox (surface via notices)");
+        }
+        if (owner !== undefined) {
+            await host.notices.post({
+                user: owner,
+                key,
+                title: `Held: ${call.name}`,
+                body,
+                tone: "warn",
+            });
+        }
+        return { status: "absent" };
+    }
+    const ok = result;
+    return { status: ok.status, id: ok.id, created: ok.created };
+}
+/** Claim an answered item for the calling conversation (or report none). */
+export async function takeGrant(host, key, jobId, conversationId) {
+    const result = (await host.publishedHooks.call("escalation.take", { key, jobId }, { conversationId }));
+    // A missing provider answers `absent`; that is NOT a grant in a
+    // non-approving state (the caller's `!== "none"` gate would read it as
+    // one and never reach the clearance path — the Task 16 e2e regression).
+    // Absence maps to `none`: no inbox, no grant, keep going.
+    if (result.status === "absent")
+        return { status: "none" };
+    return {
+        status: result.status,
+        ...(result.id === undefined ? {} : { id: result.id }),
+        ...(result.option === undefined ? {} : { option: result.option }),
+    };
+}
+/** Resolve a claimed item after carrying out its answer. */
+export async function resolveGrant(host, id, outcome, note, conversationId) {
+    const result = (await host.publishedHooks.call("escalation.resolve", { id, outcome, note }, { conversationId }));
+    return { status: result.status };
+}

package/dist/evidence.d.ts

@@ -0,0 +1,9 @@
+import type { RunInfo } from "./context.js";
+/** The default card-check evidence budget (one DecisionRequest's worth). */
+export declare const EVIDENCE_BUDGET_BYTES = 16384;
+/**
+ * This run's tool-result texts mentioning any target, redacted, newest
+ * first, trimmed to `budgetBytes` (an item that overflows the remaining
+ * budget is dropped whole — no partial lines).
+ */
+export declare function evidenceFor(run: RunInfo, targets: readonly string[], budgetBytes: number): string[];

package/dist/evidence.js

@@ -0,0 +1,54 @@
+/**
+ * Task 14 evidence collection: the redacted tool-result texts of THIS
+ * run that mention a target, newest first, within a byte budget.
+ */
+import { redact } from "pi-warden";
+/** The default card-check evidence budget (one DecisionRequest's worth). */
+export const EVIDENCE_BUDGET_BYTES = 16_384;
+/** The text blocks of one entry's toolResult messages, joined. */
+function toolResultText(entry) {
+    const parts = [];
+    for (const message of entry.model ?? []) {
+        if (message.role !== "toolResult")
+            continue;
+        const content = message.content;
+        if (typeof content === "string") {
+            parts.push(content);
+        }
+        else if (Array.isArray(content)) {
+            for (const block of content) {
+                if (typeof block === "object" &&
+                    block !== null &&
+                    block.type === "text" &&
+                    typeof block.text === "string") {
+                    parts.push(block.text);
+                }
+            }
+        }
+    }
+    return parts.join("\n");
+}
+/**
+ * This run's tool-result texts mentioning any target, redacted, newest
+ * first, trimmed to `budgetBytes` (an item that overflows the remaining
+ * budget is dropped whole — no partial lines).
+ */
+export function evidenceFor(run, targets, budgetBytes) {
+    const out = [];
+    let remaining = budgetBytes;
+    // run.entries are oldest first; evidence is newest first.
+    for (let i = run.entries.length - 1; i >= 0; i -= 1) {
+        const text = toolResultText(run.entries[i]);
+        if (text === "")
+            continue;
+        if (!targets.some((target) => text.includes(target)))
+            continue;
+        const redacted = redact(text);
+        const bytes = Buffer.byteLength(redacted, "utf8");
+        if (bytes > remaining)
+            continue;
+        remaining -= bytes;
+        out.push(redacted);
+    }
+    return out;
+}

package/dist/glob.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Anchored glob matching for warden rules. Globs support `*` ONLY: any
+ * run of characters except `/`. Every other character is literal —
+ * including `?` and `**` (two adjacent `*` wildcards, no cross-segment
+ * meaning). The match is ANCHORED at both ends: `torrents_*` does not
+ * match `x/torrents_list`, and `rm*` does not match `xrm`.
+ */
+export declare function globToRegExp(pattern: string): RegExp;
+/** First pattern that matches `value`, or `undefined`. */
+export declare function matchGlob(value: string, patterns: readonly string[]): string | undefined;

package/dist/glob.js

@@ -0,0 +1,23 @@
+/**
+ * Anchored glob matching for warden rules. Globs support `*` ONLY: any
+ * run of characters except `/`. Every other character is literal —
+ * including `?` and `**` (two adjacent `*` wildcards, no cross-segment
+ * meaning). The match is ANCHORED at both ends: `torrents_*` does not
+ * match `x/torrents_list`, and `rm*` does not match `xrm`.
+ */
+export function globToRegExp(pattern) {
+    let out = "";
+    for (let index = 0; index < pattern.length; index += 1) {
+        if (pattern[index] === "*") {
+            out += "[^/]*";
+        }
+        else {
+            out += pattern[index].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${out}$`);
+}
+/** First pattern that matches `value`, or `undefined`. */
+export function matchGlob(value, patterns) {
+    return patterns.find((pattern) => globToRegExp(pattern).test(value));
+}

package/dist/index.d.ts

@@ -0,0 +1,40 @@
+import type { SigrunExtensionResult, SigrunHost } from "@sigrun/sigrun/extension";
+/**
+ * The warden factory (arity one for the loader; test deps come second).
+ * Task 11 wires the ToolTask hook's beforeTool/afterTool for the
+ * NO-decision-model path: live conversations hold a call on an
+ * interaction question; job runs block + escalate (one-shot grants).
+ * The judge (Task 12) drives live calls; the clearance + card-check
+ * path (Task 14) drives cleared job calls.
+ */
+export default function createWarden(host: SigrunHost, deps?: Record<string, never>): SigrunExtensionResult;
+export { parseSettings, defaultSettings, resetWarnedKeys } from "./settings.js";
+export type { WardenSettings } from "./settings.js";
+export { classify, annotationFromHookResult } from "./classify.js";
+export type { AnnotationLookup, Classification, ClassifyDeps } from "./classify.js";
+export { HoldLog } from "./log.js";
+export type { HoldRecord } from "./log.js";
+export { globToRegExp, matchGlob } from "./glob.js";
+export { presenceOf, runInfo } from "./context.js";
+export type { Presence, RunInfo } from "./context.js";
+export { grantKey, StateStore } from "./state.js";
+export type { ConversationState } from "./state.js";
+export { confirmBody, holdForPerson, WARDEN_CONFIRM_KIND } from "./interaction.js";
+export { escalationBody, raiseEscalation, resolveGrant, takeGrant, } from "./escalate.js";
+export { resetPruneGuardForTests, resolveReservedGrant, routeOffline, startPruneOnce, } from "./route.js";
+export type { RouteInput } from "./route.js";
+export { afterToolGuard, resetAttemptWindowsForTests } from "./after.js";
+export type { AfterContext } from "./after.js";
+export { Cooldown, decisionsJudge } from "./judge.js";
+export { clearAskQuestion } from "./questions.js";
+export { evaluateLive, judgeBashUnknown } from "./live.js";
+export type { LiveInput, LiveOutcome } from "./live.js";
+export { skillTagsInText, skillsInRun } from "./skills.js";
+export type { SkillSeen, SkillTag } from "./skills.js";
+export { buildCard, CARD_MAX_BYTES, CARD_SYSTEM_PROMPT, CARD_TIMEOUT_MS, CardStore, resetInflightForTests, } from "./cards.js";
+export type { Card } from "./cards.js";
+export { createWardenCommands } from "./commands.js";
+export { targetsOf } from "./targets.js";
+export { EVIDENCE_BUDGET_BYTES, evidenceFor } from "./evidence.js";
+export { cardCheck } from "./card-check.js";
+export type { CardCheckInput, CardCheckResult } from "./card-check.js";

package/dist/index.js

@@ -0,0 +1,194 @@
+import { createHash } from "node:crypto";
+import { defineExtension, hook, ToolTask } from "@earendil-works/pi-durable";
+import { afterToolGuard } from "./after.js";
+import { annotationFromHookResult, classify } from "./classify.js";
+import { buildCard } from "./cards.js";
+import { createWardenCommands } from "./commands.js";
+import { presenceOf, runInfo } from "./context.js";
+import { Cooldown, decisionsJudge } from "./judge.js";
+import { HoldLog } from "./log.js";
+import { resolveReservedGrant, routeOffline, startPruneOnce, } from "./route.js";
+import { parseSettings } from "./settings.js";
+import { StateStore } from "./state.js";
+/**
+ * The warden factory (arity one for the loader; test deps come second).
+ * Task 11 wires the ToolTask hook's beforeTool/afterTool for the
+ * NO-decision-model path: live conversations hold a call on an
+ * interaction question; job runs block + escalate (one-shot grants).
+ * The judge (Task 12) drives live calls; the clearance + card-check
+ * path (Task 14) drives cleared job calls.
+ */
+export default function createWarden(host, deps = {}) {
+    void deps;
+    const log = new HoldLog(`${host.stores.paths.state}/holds.jsonl`, () => new Date());
+    const store = new StateStore(host.stores.paths.state);
+    // Instance-wide judge cooldown (in memory — a restart re-trusts the judge).
+    const cooldown = new Cooldown();
+    const beforeTool = async (call, api, context) => {
+        // The hook's contract: catch EVERYTHING and block — never let a
+        // call through on an exception.
+        try {
+            const raw = await host.stores.settings.get();
+            const settings = parseSettings(raw, (message) => console.warn(message));
+            startPruneOnce(log, settings.retentionDays);
+            const annotations = async (tool) => annotationFromHookResult(tool, (await host.publishedHooks.call("mcp.tool-annotations", { tool }, { conversationId: api.conversationId })));
+            const classification = await classify({ name: call.name, arguments: call.arguments }, { annotations, settings });
+            const presence = await presenceOf(host, api.conversationId);
+            const run = await runInfo(host, api.conversationId);
+            const judge = decisionsJudge(host, settings, cooldown);
+            return await routeOffline({
+                host,
+                call,
+                conversationId: api.conversationId,
+                classification,
+                presence,
+                run,
+                settings,
+                store,
+                log,
+                context,
+                judge,
+                cooldown,
+            });
+        }
+        catch (error) {
+            return { block: `warden error: ${errorMessage(error)}` };
+        }
+    };
+    const afterTool = async (call, result, api, _context) => {
+        // Task 13: a skill arriving in the run (a `load_skill` result or a
+        // `read` of a SKILL.md path) starts a BACKGROUND card build —
+        // single-flight per body hash; failures warn and never block.
+        const skill = skillFromToolResult(call, result);
+        if (skill !== undefined) {
+            void (async () => {
+                try {
+                    const raw = await host.stores.settings.get();
+                    const settings = parseSettings(raw, (message) => console.warn(message));
+                    const card = await buildCard(host, skill, settings);
+                    if (card === undefined) {
+                        console.warn(`warden: card build failed for ${skill.name}`);
+                    }
+                }
+                catch (error) {
+                    console.warn("warden: card build failed", error);
+                }
+            })();
+        }
+        // Task 11 slice: resolve grants.
+        try {
+            await resolveReservedGrant({
+                host,
+                call,
+                conversationId: api.conversationId,
+                result,
+                store,
+            });
+        }
+        catch (error) {
+            console.warn("warden: afterTool grant resolution failed", error);
+        }
+        // Task 15, LAST in the pipeline (skill collection and grant
+        // resolution above): masking → planted-instructions taint → stuck.
+        // A thrown guard must never drop the tool's result.
+        try {
+            const raw = await host.stores.settings.get();
+            const settings = parseSettings(raw, (message) => console.warn(message));
+            const run = await runInfo(host, api.conversationId);
+            return await afterToolGuard(call, result, {
+                host,
+                conversationId: api.conversationId,
+                run,
+                settings,
+                store,
+                log,
+                judge: decisionsJudge(host, settings, cooldown),
+                context: _context,
+            });
+        }
+        catch (error) {
+            console.warn("warden: afterTool guard failed", error);
+            return undefined;
+        }
+    };
+    return {
+        extension: defineExtension({
+            name: "sigrun.warden",
+            tools: [],
+            hooks: [hook(ToolTask, { beforeTool, afterTool })],
+        }),
+        interactionKinds: ["warden.confirm"],
+        commands: createWardenCommands(host),
+    };
+}
+/**
+ * The skill a tool result introduces into the run, when it does: a
+ * `load_skill` result (name from the call's args) or a `read` of a path
+ * ending SKILL.md (name = the parent directory's leaf). The body is the
+ * result's text.
+ */
+function skillFromToolResult(call, result) {
+    const text = toolResultText(result);
+    if (text === "" || result.isError === true)
+        return undefined;
+    const args = call.arguments;
+    if (call.name === "load_skill") {
+        const name = typeof args.skill === "string"
+            ? args.skill
+            : typeof args.name === "string"
+                ? args.name
+                : undefined;
+        if (name === undefined)
+            return undefined;
+        return { name, body: text, hash: bodyHash(text) };
+    }
+    if (call.name === "read" && typeof args.path === "string" && args.path.endsWith("SKILL.md")) {
+        const segments = args.path.split("/").filter((part) => part.length > 0);
+        const name = segments.length >= 2 ? segments[segments.length - 2] : segments[0];
+        return { name, location: args.path, body: text, hash: bodyHash(text) };
+    }
+    return undefined;
+}
+/** The concatenated text blocks of a tool result's output. */
+function toolResultText(result) {
+    const output = result.output;
+    if (typeof output === "string")
+        return output;
+    if (!Array.isArray(output))
+        return "";
+    const parts = [];
+    for (const block of output) {
+        if (typeof block === "object" &&
+            block !== null &&
+            block.type === "text" &&
+            typeof block.text === "string") {
+            parts.push(block.text);
+        }
+    }
+    return parts.join("\n");
+}
+function bodyHash(body) {
+    return createHash("sha256").update(body, "utf8").digest("hex");
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export { parseSettings, defaultSettings, resetWarnedKeys } from "./settings.js";
+export { classify, annotationFromHookResult } from "./classify.js";
+export { HoldLog } from "./log.js";
+export { globToRegExp, matchGlob } from "./glob.js";
+export { presenceOf, runInfo } from "./context.js";
+export { grantKey, StateStore } from "./state.js";
+export { confirmBody, holdForPerson, WARDEN_CONFIRM_KIND } from "./interaction.js";
+export { escalationBody, raiseEscalation, resolveGrant, takeGrant, } from "./escalate.js";
+export { resetPruneGuardForTests, resolveReservedGrant, routeOffline, startPruneOnce, } from "./route.js";
+export { afterToolGuard, resetAttemptWindowsForTests } from "./after.js";
+export { Cooldown, decisionsJudge } from "./judge.js";
+export { clearAskQuestion } from "./questions.js";
+export { evaluateLive, judgeBashUnknown } from "./live.js";
+export { skillTagsInText, skillsInRun } from "./skills.js";
+export { buildCard, CARD_MAX_BYTES, CARD_SYSTEM_PROMPT, CARD_TIMEOUT_MS, CardStore, resetInflightForTests, } from "./cards.js";
+export { createWardenCommands } from "./commands.js";
+export { targetsOf } from "./targets.js";
+export { EVIDENCE_BUDGET_BYTES, evidenceFor } from "./evidence.js";
+export { cardCheck } from "./card-check.js";

package/dist/interaction.d.ts

@@ -0,0 +1,28 @@
+import type { Context } from "@earendil-works/chord";
+import type { ToolHookCall } from "@earendil-works/pi-durable";
+import type { Tree } from "@sigrun/sigrun/blocks";
+import type { SigrunHost } from "@sigrun/sigrun/extension";
+import type { ConversationId } from "@earendil-works/pi-durable";
+/** The interaction kind the warden declares (loader-validated). */
+export declare const WARDEN_CONFIRM_KIND = "warden.confirm";
+/**
+ * The allow/deny gate body: markdown context naming the tool and its
+ * redacted arguments plus the reasons, then a Decision section with a
+ * `choice` (allow/deny) and a `longtext` reason. Mirrors the
+ * `gatingConfirmBody` example in core's docs/extending.md.
+ */
+export declare function confirmBody(call: Pick<ToolHookCall, "name" | "arguments">, reasons: readonly string[]): Tree;
+/**
+ * Seed the question and long-poll for the answer. The record callId is
+ * `"warden-" + fingerprint(16 hex)`; seeding is first-write-wins, so
+ * concurrent or repeated holds of identical calls share ONE card. The
+ * poll sleeps cancellation-safely so abort/close unwinds the held call.
+ * Consumption of an answered allow (exactly one call per reply) is a
+ * state concern, handled by the caller (route.ts).
+ *
+ * @returns the decision and the person's reason text ("" when absent).
+ */
+export declare function holdForPerson(host: SigrunHost, call: Pick<ToolHookCall, "name" | "arguments">, conversationId: ConversationId, fingerprint: string, reasons: readonly string[], context: Context): Promise<{
+    answer: "allow" | "deny";
+    reason: string;
+}>;

package/dist/interaction.js

@@ -0,0 +1,93 @@
+/**
+ * The live-presence hold: an interaction record (kind `warden.confirm`)
+ * seeded idempotently by CALL FINGERPRINT, so a crash re-entry or a
+ * retry with a new tool-call id waits on the same question — never a
+ * second card.
+ */
+import { awaitWithContext } from "@earendil-works/chord/context";
+import { redact } from "pi-warden";
+import { choice, form, longtext, markdown, section, tree, } from "@sigrun/sigrun/blocks";
+/** The interaction kind the warden declares (loader-validated). */
+export const WARDEN_CONFIRM_KIND = "warden.confirm";
+/** Poll cadence while a person decides (the fixture-gate shape). */
+const POLL_MS = 500;
+/**
+ * The allow/deny gate body: markdown context naming the tool and its
+ * redacted arguments plus the reasons, then a Decision section with a
+ * `choice` (allow/deny) and a `longtext` reason. Mirrors the
+ * `gatingConfirmBody` example in core's docs/extending.md.
+ */
+export function confirmBody(call, reasons) {
+    const redactedArgs = redact(JSON.stringify(call.arguments));
+    const reasonLines = reasons.map((reason) => `- ${reason}`).join("\n");
+    return tree(form({
+        id: "warden-confirm",
+        bind: "/values",
+        mode: "submit",
+        submitLabel: "Send",
+        children: [
+            section({
+                title: "Confirm",
+                children: [
+                    markdown({
+                        text: `The warden held \`${call.name}\` with arguments:\n\n\`\`\`json\n${redactedArgs}\n\`\`\`\n\n${reasonLines}`,
+                    }),
+                ],
+            }),
+            section({
+                title: "Decision",
+                children: [
+                    choice({
+                        name: "decision",
+                        label: "Allow this call?",
+                        options: [
+                            { id: "allow", label: "Allow", tone: "good" },
+                            { id: "deny", label: "Deny", tone: "bad" },
+                        ],
+                    }),
+                    longtext({
+                        name: "reason",
+                        label: "Why (optional)",
+                        placeholder: "Recorded with the hold.",
+                    }),
+                ],
+            }),
+        ],
+    }));
+}
+/**
+ * Seed the question and long-poll for the answer. The record callId is
+ * `"warden-" + fingerprint(16 hex)`; seeding is first-write-wins, so
+ * concurrent or repeated holds of identical calls share ONE card. The
+ * poll sleeps cancellation-safely so abort/close unwinds the held call.
+ * Consumption of an answered allow (exactly one call per reply) is a
+ * state concern, handled by the caller (route.ts).
+ *
+ * @returns the decision and the person's reason text ("" when absent).
+ */
+export async function holdForPerson(host, call, conversationId, fingerprint, reasons, context) {
+    const callId = `warden-${fingerprint}`;
+    await host.seedInteraction(conversationId, {
+        kind: WARDEN_CONFIRM_KIND,
+        callId,
+        status: "pending",
+        createdAt: Date.now(),
+        body: confirmBody(call, reasons),
+        details: {
+            toolName: call.name,
+            arguments: JSON.parse(redact(JSON.stringify(call.arguments))),
+        },
+    }, context);
+    for (;;) {
+        const record = await host.snapshotInteraction(conversationId, callId, context);
+        if (record?.status === "answered") {
+            const decision = record.answer?.values.decision;
+            const reason = record.answer?.values.reason;
+            return {
+                answer: decision === "allow" ? "allow" : "deny",
+                reason: typeof reason === "string" ? reason : "",
+            };
+        }
+        await awaitWithContext(new Promise((resolve) => setTimeout(resolve, POLL_MS)), context);
+    }
+}

package/dist/judge.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The decisions judge (warden spec §3.2): a pi-warden `Judge` over
+ * core's `host.decisions.evaluate`. Core NEVER throws (failures arrive
+ * as the `ok:false` half of DecisionResult); pi-warden's ask paths
+ * expect the pi-typesafe contract — the raw SystemOneResult on success
+ * and a THROW on failure — so this adapter converts the failure half
+ * into `Error("<code>: <error>")`.
+ *
+ * The `Cooldown` pauses a failing judge instance-wide (in memory): 3
+ * consecutive failures pause judgments for 5 minutes; a success resets
+ * the streak.
+ */
+import type { Judge } from "pi-typesafe";
+import type { SigrunHost } from "@sigrun/sigrun/extension";
+import type { WardenSettings } from "./settings.js";
+/**
+ * Session-scoped pause on a failing judge: three consecutive failures
+ * pause judgment calls for five minutes. Nothing is persisted; a new
+ * process starts with the judge trusted again.
+ */
+export declare class Cooldown {
+    #private;
+    /** The default reads Date.now on each call, so a test can mock the clock. */
+    constructor(now?: () => number);
+    /** Record one judge failure; the third consecutive one opens the window. */
+    failed(): void;
+    /** A successful judgment clears the streak and the window. */
+    succeeded(): void;
+    /** True while judgments are paused. */
+    get active(): boolean;
+}
+/**
+ * The judge for one settings snapshot: `undefined` when the judge is
+ * disabled or the cooldown is active. The evaluate implementation:
+ *
+ * - calls `host.decisions.evaluate(request, {model: settings.decisionModel, signal})`;
+ * - on `ok:true` returns the RAW Evaluation shape `{answers, usage, model, elapsedMs}`;
+ * - on `ok:false` throws `Error("<code>: <error>")` so pi-warden's and
+ *   our ask paths see a failure;
+ * - every outcome updates the cooldown (thrown transport errors count
+ *   as failures too).
+ */
+export declare function decisionsJudge(host: SigrunHost, settings: WardenSettings, cooldown: Cooldown): Judge | undefined;

package/dist/judge.js

@@ -0,0 +1,75 @@
+const FAILURE_LIMIT = 3;
+const COOLDOWN_MS = 5 * 60 * 1000;
+/**
+ * Session-scoped pause on a failing judge: three consecutive failures
+ * pause judgment calls for five minutes. Nothing is persisted; a new
+ * process starts with the judge trusted again.
+ */
+export class Cooldown {
+    #now;
+    #failures = 0;
+    #until = 0;
+    /** The default reads Date.now on each call, so a test can mock the clock. */
+    constructor(now = () => Date.now()) {
+        this.#now = now;
+    }
+    /** Record one judge failure; the third consecutive one opens the window. */
+    failed() {
+        this.#failures += 1;
+        if (this.#failures >= FAILURE_LIMIT) {
+            this.#until = this.#now() + COOLDOWN_MS;
+        }
+    }
+    /** A successful judgment clears the streak and the window. */
+    succeeded() {
+        this.#failures = 0;
+        this.#until = 0;
+    }
+    /** True while judgments are paused. */
+    get active() {
+        return this.#until > this.#now();
+    }
+}
+/**
+ * The judge for one settings snapshot: `undefined` when the judge is
+ * disabled or the cooldown is active. The evaluate implementation:
+ *
+ * - calls `host.decisions.evaluate(request, {model: settings.decisionModel, signal})`;
+ * - on `ok:true` returns the RAW Evaluation shape `{answers, usage, model, elapsedMs}`;
+ * - on `ok:false` throws `Error("<code>: <error>")` so pi-warden's and
+ *   our ask paths see a failure;
+ * - every outcome updates the cooldown (thrown transport errors count
+ *   as failures too).
+ */
+export function decisionsJudge(host, settings, cooldown) {
+    if (!settings.judge.enabled)
+        return undefined;
+    if (cooldown.active)
+        return undefined;
+    return {
+        evaluate: async (request, options) => {
+            let result;
+            try {
+                result = await host.decisions.evaluate(request, {
+                    model: settings.decisionModel,
+                    signal: options?.signal,
+                });
+            }
+            catch (error) {
+                cooldown.failed();
+                throw error;
+            }
+            if (result.ok) {
+                cooldown.succeeded();
+                return {
+                    answers: result.answers,
+                    usage: result.usage,
+                    model: result.model,
+                    elapsedMs: result.elapsedMs,
+                };
+            }
+            cooldown.failed();
+            throw new Error(`${result.code}: ${result.error}`);
+        },
+    };
+}