pi-warden 0.23.0 → 0.26.0

package/CHANGELOG.md

@@ -4,6 +4,40 @@ Notable changes to pi-warden, newest first. Versions follow semver. The publishe
 
 How to keep this current: add the entry in the same pull request as the change, under `Unreleased`. The release commit renames `Unreleased` to the version it ships and adds its own notes. Entries before 0.10.0 are one-line summaries taken from the release commit headers; the detail for those is in `git log`.
 
+## Unreleased
+
+<!-- Empty. Next release starts here. -->
+
+## 0.26.0
+
+### Added
+
+- OpenRouter as a configurable judgment backend (`typesafeBackend` in user config). Set to `"openrouter"` to route Jev decisions through OpenRouter's decisions API instead of api.typesafe.ai. New `src/backend.ts` module; `OPENROUTER_API_KEY` env var; project overrides cannot redirect judgments.
+
+### Changed
+
+- Bumped pi-typesafe to ^0.6.0 (native `backend` option on `TypeSafeOptions`).
+- Deduplicated `resolveBackend` call in `shape.ts`.
+
+### Fixed
+
+- Host-TUI capability guard: the extension no longer crashes when the host's bundled `pi-tui` lacks the `MouseRegion` component (e.g. omp 18.2.5). A missing named import was a link-time error that silently killed every guard, the `/warden` command, and the shortcut. The import is now a namespace property read (`tuiModule.MouseRegion`), which degrades to `undefined` instead of failing. The status widget renders the same guard text without the clickable wrapper.
+
+## 0.25.0
+
+### Added
+
+- Smart hold learning system (src/learning.ts). Records full context (task, plan, conversation, agent reason) with each hold decision and predicts outcomes using historical patterns. SQLite database at ~/.pi/agent/pi-warden/holds.db. Query functions weight exact matches 5x, similar matches 2x, and same-reason matches 1x, with time decay. Never skips destructive patterns.
+
+## 0.24.0
+
+### Added
+
+- User-defined command rules (`action.commandRules`, `action.commandDenyRules`, `action.exemptRules`, user config only): your own patterns on the same data-text-stripped command the built-ins read, with `warn`/`confirm`/`deny` severity. `confirm` defaults to a user dialog in every mode; `deny` blocks with no dialog and no TypeSafe request; `exemptRules` silences built-ins, the `rm` classifier ids, `sensitive-path`, and your own rules by id. The `deny` verdict renders as a chip in the status line and the trace sidebar.
+- Overnight eval stability proof: 109 cycles, 13,952 cases, 100% pass rate, zero score drift ([docs/overnight-eval.md](docs/overnight-eval.md), [eval/reports/2026-09-18-overnight-stability/](eval/reports/2026-09-18-overnight-stability/)). Confirms that guard thresholds are deterministic against the TypeSafe API and the case set is a reliable regression gate.
+- User-defined path rules (`action.pathRules`, user config only): a path dimension for the pattern floor — `{ id, paths, access, tools, action, message?, onlyIfExists?, regex? }`. `access` names the side that flows (`"none"` holds any touch, `"read"` holds writes, `"write"` holds reads); file tools match the structured `path` field, the bash surface matches whole-text mentions and redirect/`tee` write sinks only — never arbitrary argv tokens. `action` maps to `note`/`warn`/`confirm` (dialog)/`block` (deny); `exemptRules` silences a path rule by id. A `read`-scoped rule needs `read` added to `action.tools` (read tools are not inspected by default).
+- User-defined arming rules (`action.armingRules`, user config only): session-scoped rules that correlate a preparation edit with a later command — `{ id, when: { edited, regex?, tools? }, arms: { command, for?, caseSensitive? }, action, message? }`. Editing a file matching a `when.edited` glob arms `arms.command` for `arms.for` (default 10 minutes); while armed, matching commands fire the rule's `action` (`confirm` dialog, `hold` steer, `block` deny). State lives for the rule's window within a session, is visible in `/warden status`, and never depends on Jev.
+
 ## 0.23.0
 
 ### Added

package/README.md

@@ -59,6 +59,8 @@ The clipping task shows the shape of the effect. Without the warden, 6 of 10 glm
 
 Run it on your own model: `npm run eval:ab -- --repeats 3 --model <model>` (it asks you to pick a model on purpose, because a full batch spends real tokens). Per-batch reports, including the runs where nothing changed, live in [eval/reports/](eval/reports/README.md).
 
+The guards are also stable over repeated invocations. A continuous overnight run (2026-09-18) evaluated every guard across **109 cycles, 13,952 cases, 100% pass rate, zero score drift**. The same synthetic input produces the same judgment within rounding noise across all runs. Full numbers: [docs/overnight-eval.md](docs/overnight-eval.md) and [eval/reports/2026-09-18-overnight-stability/](eval/reports/2026-09-18-overnight-stability/).
+
 ### Why a strong model does not make this pointless
 
 A guard like this is a smoke alarm. Most days it says nothing, and that is the design: it only pays off on the run where the model is tired, compacted, four hours in, or confident about a shortcut you would have caught in review. Four of its ten guards do not depend on the model being weak at all:
@@ -140,7 +142,7 @@ Every guarded call (`bash`, `write`, `edit`, and shell-like tools such as contex
 1. **Read-only? Skip.** `git status && ls` or a `read`: no request, no line in the trace.
 2. **Pattern list, offline.** Force push, `git reset --hard`, recursive `rm` outside the project, SQL `DROP`/`TRUNCATE`/`DELETE FROM`, `curl | sh`, publishing, infrastructure destroys: the call is held. Risky but recoverable things (`rm -rf` on a project path, `sudo`, `--no-verify`, `gh pr merge`, touching `.env`) warn. Text that is data, such as a commit message that mentions `git push --force`, is not a command.
 3. **Jev, with your consent.** One request carries your request, up to eight earlier messages, the agent's own words right before the call (its plan), and the call itself. Jev answers fixed questions with probabilities: irreversible, off task, does it change anything, how it relates to the task, does it contradict the plan, is the effect visible outside the working tree. On a write the slop and security questions ride along, and the rules check is a second request in parallel. About 0.3 s before the tool runs.
-4. **Act.** Only two things hold a call: a destructive pattern, or `irreversible` at 0.7 or above. Everything else (off task, plan mismatch, slop, a rule violation, a security smell) tells the agent and lets the call run.
+4. **Act.** Three things hold a call: a destructive pattern, a `deny` command rule (blocked outright, no dialog), or `irreversible` at 0.7 or above. Everything else (off task, plan mismatch, slop, a rule violation, a security smell) tells the agent and lets the call run.
 
 In the default `steer` mode a hold goes back to the agent as its tool result with two acceptable next moves: find a recoverable way, or explain the action to you in a sentence and wait. If your reply approves it, the retry goes through. `confirm` mode shows you a dialog instead; `advise` never holds.
 

package/dist/arming.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Session-scoped arming rules: a preparation (editing files matching globs) arms a
+ * command pattern for a window; while armed, matching commands fire the rule's action.
+ *
+ * The tracker is in-memory per session. State lives for the rule's window within a session;
+ * it is cleared when the session starts anew (session_start) and expires per `for`. It
+ * survives across agent runs within the same session (the Scenario B case: edit in one
+ * turn, reconcile in the next). No cross-session persistence.
+ *
+ * The armed check is deterministic: it fires whether or not Jev is available. If Jev
+ * is available, armed-rule names ride as context so the judge can weigh them, but the
+ * action never depends on Jev.
+ */
+import type { ArmingRule } from "./config.js";
+/** Ids of rules whose regex or duration could not be compiled; surfaced via the one-time notice channel. */
+export declare function unparseableArmingRules(rules: readonly ArmingRule[]): string[];
+export type NowFn = () => number;
+/**
+ * In-memory arming state for one session.
+ *
+ * `arm` is called on write/edit calls whose `input.path` matches a rule's `when.edited` globs.
+ * `checkArmed` is called on command calls to see if any armed rule's `arms.command` regex matches.
+ * `reset` clears all state (called on `agent_end`).
+ */
+export declare class ArmingTracker {
+    private readonly armed;
+    private compiled;
+    private now;
+    constructor(rules: readonly ArmingRule[], now?: NowFn);
+    /** Set the clock function (for testing with injectable time). */
+    setNow(now: NowFn): void;
+    /** Update the compiled rules from config; recompiles only when the reference changes. */
+    private lastRulesRef;
+    updateRules(rules: readonly ArmingRule[]): void;
+    /**
+     * Record a write/edit call. If the tool is in a rule's `when.tools` (default ["write","edit"])
+     * and the path matches a `when.edited` glob, arm (or refresh) that rule.
+     * Returns the ids of rules that were armed or refreshed by this call.
+     */
+    arm(tool: string, path: string | undefined, cwd: string, sinkTargets?: readonly string[]): string[];
+    /**
+     * Check whether any armed rule's command regex matches the given command.
+     * Returns the matching rules (with their compiled config) for the extension to act on.
+     * Expired rules are pruned first.
+     */
+    checkArmed(command: string): {
+        id: string;
+        action: ArmingRule["action"];
+        message?: string;
+        armedByPaths: string[];
+    }[];
+    /** Names of currently armed rules (for Jev context). */
+    armedRuleIds(): string[];
+    /** Human-readable status line for `/warden status`. */
+    statusLine(): string;
+    /** Clear all arming state (called on session_start). */
+    reset(): void;
+    /** Remove expired entries. */
+    private prune;
+}

package/dist/arming.js

@@ -0,0 +1,190 @@
+/**
+ * Session-scoped arming rules: a preparation (editing files matching globs) arms a
+ * command pattern for a window; while armed, matching commands fire the rule's action.
+ *
+ * The tracker is in-memory per session. State lives for the rule's window within a session;
+ * it is cleared when the session starts anew (session_start) and expires per `for`. It
+ * survives across agent runs within the same session (the Scenario B case: edit in one
+ * turn, reconcile in the next). No cross-session persistence.
+ *
+ * The armed check is deterministic: it fires whether or not Jev is available. If Jev
+ * is available, armed-rule names ride as context so the judge can weigh them, but the
+ * action never depends on Jev.
+ */
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { matchPathGlobs, stripDataText } from "./guard.js";
+/** Compile a rule, returning undefined if the regex is invalid. compileArmingRules returns the ids of rules that failed. */
+function compileArmingRule(rule) {
+    try {
+        const flags = rule.arms.caseSensitive ? "" : "i";
+        const duration = parseDuration(rule.arms.for);
+        return { rule, commandRegex: new RegExp(rule.arms.command, flags), durationMs: duration };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse a duration string like "10m", "30s", "2h" into milliseconds. Returns 600000 (10m) for undefined/invalid. */
+function parseDuration(forValue) {
+    if (forValue === undefined)
+        return 600_000;
+    if (typeof forValue === "number")
+        return forValue > 0 ? forValue : 600_000;
+    const match = /^(\d+)(ms|s|m|h)$/.exec(forValue);
+    if (!match)
+        return 600_000;
+    const value = parseInt(match[1], 10);
+    if (value <= 0)
+        return 600_000;
+    switch (match[2]) {
+        case "ms": return value;
+        case "s": return value * 1_000;
+        case "m": return value * 60_000;
+        case "h": return value * 3_600_000;
+        default: return 600_000;
+    }
+}
+/** Ids of rules whose regex or duration could not be compiled; surfaced via the one-time notice channel. */
+export function unparseableArmingRules(rules) {
+    const ids = [];
+    for (const rule of rules) {
+        try {
+            new RegExp(rule.arms.command, rule.arms.caseSensitive ? "" : "i");
+        }
+        catch {
+            ids.push(rule.id);
+        }
+    }
+    return ids;
+}
+/** Match a candidate path against a rule's edited globs/regexes (reuses the shared matcher from guard.ts). */
+function editedMatches(rule, candidate) {
+    return matchPathGlobs(rule.when.edited, rule.when.regex ?? false, candidate);
+}
+/**
+ * In-memory arming state for one session.
+ *
+ * `arm` is called on write/edit calls whose `input.path` matches a rule's `when.edited` globs.
+ * `checkArmed` is called on command calls to see if any armed rule's `arms.command` regex matches.
+ * `reset` clears all state (called on `agent_end`).
+ */
+export class ArmingTracker {
+    armed = new Map();
+    compiled;
+    now;
+    constructor(rules, now = Date.now) {
+        this.now = now;
+        this.compiled = rules.map(compileArmingRule).filter((r) => r !== undefined);
+    }
+    /** Set the clock function (for testing with injectable time). */
+    setNow(now) {
+        this.now = now;
+    }
+    /** Update the compiled rules from config; recompiles only when the reference changes. */
+    lastRulesRef;
+    updateRules(rules) {
+        if (rules === this.lastRulesRef)
+            return;
+        this.lastRulesRef = rules;
+        this.compiled = rules.map(compileArmingRule).filter((r) => r !== undefined);
+    }
+    /**
+     * Record a write/edit call. If the tool is in a rule's `when.tools` (default ["write","edit"])
+     * and the path matches a `when.edited` glob, arm (or refresh) that rule.
+     * Returns the ids of rules that were armed or refreshed by this call.
+     */
+    arm(tool, path, cwd, sinkTargets) {
+        if (!path && (!sinkTargets || sinkTargets.length === 0))
+            return [];
+        const now = this.now();
+        const armed = new Set();
+        const allCandidates = [path, ...(sinkTargets ?? [])].filter((p) => typeof p === "string" && p.length > 0);
+        for (const { rule, durationMs } of this.compiled) {
+            const tools = rule.when.tools ?? ["write", "edit"];
+            // The structured path is checked only when the tool matches when.tools (write/edit by default).
+            // Sink targets (redirect/tee) are checked regardless of tool: a bash redirect IS a write to that path,
+            // and the spec says bash edits that create the same condition via redirect arm when the glob matches.
+            const structuredMatch = tools.includes(tool) && allCandidates.some(candidate => {
+                const home = homedir();
+                const expanded = candidate === "~" || candidate.startsWith("~/") ? home + candidate.slice(1) : candidate;
+                const abs = resolve(cwd, expanded);
+                return editedMatches(rule, candidate) || editedMatches(rule, abs);
+            });
+            // When the tool is not in when.tools (e.g. bash), only sink targets are checked.
+            const sinkCandidates = tools.includes(tool) ? allCandidates : (sinkTargets ?? []).filter((p) => typeof p === "string" && p.length > 0);
+            const sinkMatch = sinkCandidates.some(candidate => {
+                const home = homedir();
+                const expanded = candidate === "~" || candidate.startsWith("~/") ? home + candidate.slice(1) : candidate;
+                const abs = resolve(cwd, expanded);
+                return editedMatches(rule, candidate) || editedMatches(rule, abs);
+            });
+            if (!structuredMatch && !sinkMatch)
+                continue;
+            const existing = this.armed.get(rule.id);
+            const paths = existing?.armedByPaths ?? [];
+            // Dedup the arming path.
+            const displayPath = path ?? allCandidates[0];
+            if (!paths.includes(displayPath))
+                paths.push(displayPath);
+            this.armed.set(rule.id, { expiresAt: now + durationMs, armedByPaths: paths });
+            armed.add(rule.id);
+        }
+        this.prune(now);
+        return [...armed];
+    }
+    /**
+     * Check whether any armed rule's command regex matches the given command.
+     * Returns the matching rules (with their compiled config) for the extension to act on.
+     * Expired rules are pruned first.
+     */
+    checkArmed(command) {
+        // Fix 5: avoid stripDataText (a non-trivial parse) when nothing is armed — the common case.
+        if (this.armed.size === 0)
+            return [];
+        const now = this.now();
+        this.prune(now);
+        if (this.armed.size === 0)
+            return []; // prune may have expired everything
+        const text = stripDataText(command).text;
+        const hits = [];
+        for (const { rule, commandRegex } of this.compiled) {
+            const entry = this.armed.get(rule.id);
+            if (!entry)
+                continue;
+            if (commandRegex.test(text)) {
+                hits.push({ id: rule.id, action: rule.action, ...(rule.message ? { message: rule.message } : {}), armedByPaths: entry.armedByPaths });
+            }
+        }
+        return hits;
+    }
+    /** Names of currently armed rules (for Jev context). */
+    armedRuleIds() {
+        this.prune(this.now());
+        return [...this.armed.keys()];
+    }
+    /** Human-readable status line for `/warden status`. */
+    statusLine() {
+        this.prune(this.now());
+        if (this.armed.size === 0)
+            return "";
+        const parts = [];
+        for (const [id, entry] of this.armed) {
+            const remaining = Math.max(0, entry.expiresAt - this.now());
+            const mins = Math.ceil(remaining / 60_000);
+            parts.push(`${id} (${mins}m left)`);
+        }
+        return `${this.armed.size} armed: ${parts.join(", ")}`;
+    }
+    /** Clear all arming state (called on session_start). */
+    reset() {
+        this.armed.clear();
+    }
+    /** Remove expired entries. */
+    prune(now) {
+        for (const [id, entry] of this.armed) {
+            if (entry.expiresAt <= now)
+                this.armed.delete(id);
+        }
+    }
+}

package/dist/backend.d.ts

@@ -0,0 +1,23 @@
+import type { TypeSafeOptions } from "pi-typesafe";
+/** The judgment backend that receives pi-warden's Jev requests. */
+export type JudgmentBackend = "typesafe" | "openrouter";
+/** The host the consent disclosure names as the destination. */
+export declare function backendHost(backend: JudgmentBackend): string;
+/** Adapt the consent text to the active backend by substituting the destination host. */
+export declare function disclosureFor(backend: JudgmentBackend, disclosure: string): string;
+/**
+ * Whether the right credential exists for the chosen backend.
+ * TypeSafe uses the pi-typesafe keystore; other backends use an environment variable.
+ */
+export declare function keyAvailable(backend: JudgmentBackend, env: Record<string, string | undefined>, keystoreUsable: () => boolean): boolean;
+/**
+ * Build the options forwarded to `createTypeSafe`.
+ * The caller must gate on `keyAvailable` before calling `createTypeSafe`.
+ */
+export declare function judgeOptions(config: {
+    maxRequests: number;
+    timeoutMs: number;
+    typesafeBackend: JudgmentBackend;
+}): TypeSafeOptions;
+/** Resolve the effective backend from a raw config value; invalid values fall back to "typesafe". */
+export declare function resolveBackend(raw: unknown): JudgmentBackend;

package/dist/backend.js

@@ -0,0 +1,36 @@
+import { authState } from "pi-typesafe";
+const BACKENDS = {
+    typesafe: { host: "api.typesafe.ai" },
+    openrouter: { host: "openrouter.ai", keyEnv: "OPENROUTER_API_KEY" },
+};
+/** The host the consent disclosure names as the destination. */
+export function backendHost(backend) {
+    return BACKENDS[backend].host;
+}
+/** Adapt the consent text to the active backend by substituting the destination host. */
+export function disclosureFor(backend, disclosure) {
+    return backend === "typesafe" ? disclosure : disclosure.replace(BACKENDS.typesafe.host, BACKENDS[backend].host);
+}
+/**
+ * Whether the right credential exists for the chosen backend.
+ * TypeSafe uses the pi-typesafe keystore; other backends use an environment variable.
+ */
+export function keyAvailable(backend, env, keystoreUsable) {
+    const keyEnv = BACKENDS[backend].keyEnv;
+    return keyEnv ? (env[keyEnv]?.trim() ?? "") !== "" : keystoreUsable();
+}
+/**
+ * Build the options forwarded to `createTypeSafe`.
+ * The caller must gate on `keyAvailable` before calling `createTypeSafe`.
+ */
+export function judgeOptions(config) {
+    return {
+        maxRequests: config.maxRequests,
+        timeoutMs: config.timeoutMs,
+        ...(config.typesafeBackend === "typesafe" ? {} : { backend: config.typesafeBackend }),
+    };
+}
+/** Resolve the effective backend from a raw config value; invalid values fall back to "typesafe". */
+export function resolveBackend(raw) {
+    return raw === "typesafe" || raw === "openrouter" ? raw : "typesafe";
+}

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import type { JudgmentBackend } from "./backend.js";
 import type { WidgetConfig } from "./widget.js";
 export interface Threshold {
     /** P(yes) at or above this shows a warning and continues. */
@@ -11,6 +12,21 @@ export interface OffTaskThreshold {
     /** P(off-task) at or above this, with scope unrelated on a call that can change something, also steers the agent back to the task. Never holds: on 17k recorded calls off-task holds caught nothing the user regretted. */
     steer: number;
 }
+/** A user-defined command rule, matched against the stripDataText-processed command. */
+export interface CommandRule {
+    /** Stable id; same namespace as built-in rule ids, so exemptRules can reference either. */
+    id: string;
+    /** Regex source string; compiled case-insensitively unless caseSensitive is true. */
+    pattern: string;
+    /** warn: notice to the agent; confirm: hold (action dialog steers); deny: block with no dialog. */
+    severity: "warn" | "confirm" | "deny";
+    /** When severity is confirm, dialog (default) prompts the user; hold uses steer semantics. */
+    action?: "dialog" | "hold";
+    /** Optional human label shown instead of the derived one. */
+    message?: string;
+    /** Match case-sensitively. */
+    caseSensitive?: boolean;
+}
 export interface ActionGuardConfig {
     enabled: boolean;
     /** Tool names inspected before execution. Read-only tools are skipped to keep latency low. */
@@ -27,6 +43,65 @@ export interface ActionGuardConfig {
     visibleMismatch: number;
     /** Write each judged call and what the user did next (approved, declined, re-planned, regretted) to an owner-only per-session file under the agent directory; redacted, never the command. */
     feedbackLog: boolean;
+    /** User-defined command rules (user file only; project files cannot set severity above warn). */
+    commandRules: CommandRule[];
+    /** User-defined deny rules, shorthand for commandRules with severity deny (user file only). */
+    commandDenyRules: CommandRule[];
+    /** Built-in or user rule ids to exempt (user file only). */
+    exemptRules: string[];
+    /** User-defined path rules with an access dimension (user file only; project files cannot act on them). */
+    pathRules: PathRule[];
+    /** User-defined arming rules: editing files matching globs arms a command pattern for a window (user file only). */
+    armingRules: ArmingRule[];
+}
+/** A user-defined path rule: which paths, which side of the access is held, which tools, what happens on a hit. */
+export interface PathRule {
+    /** Stable id; same namespace as rule ids, so exemptRules can silence a user path rule too. */
+    id: string;
+    /** Path globs (`**` any depth, `*` one segment, `?` one character, `~` expands) or regex sources with regex: true. */
+    paths: string[];
+    /** Regex instead of glob for shapes globs cannot express. */
+    regex?: boolean;
+    /** Which touches match: "none" any touch; "read" writes only (reads flow); "write" reads only (writes flow). */
+    access: "none" | "read" | "write";
+    /** Which surfaces check the rule: file tools by name ("write", "edit", "read"), or "*" to also match bash commands. */
+    tools: string[];
+    /** note: tell the agent after the fact (the default, today's sensitive-path behavior); warn: notice; confirm: dialog; block: deny. */
+    action: "note" | "warn" | "confirm" | "block";
+    /** Optional human label shown instead of the derived one. */
+    message?: string;
+    /** Skip when the path does not exist (default true): phantom paths do not fire. */
+    onlyIfExists?: boolean;
+}
+/** A user-defined arming rule: a preparation (editing files matching globs) arms a command pattern for a window.
+ * While armed, matching commands fire the rule's action. This is the fix for the class of incident where each
+ * individual call was harmless (edit a config, then run the reconciler that applies it) but the composition was
+ * destructive — no single-call rule can catch it. */
+export interface ArmingRule {
+    /** Stable id; same namespace as rule ids, so exemptRules can silence an arming rule too. */
+    id: string;
+    /** The preparation: editing files matching these globs arms the rule. */
+    when: {
+        /** Path globs (`**` any depth, `*` one segment, `?` one character, `~` expands) or regex sources with regex: true. */
+        edited: string[];
+        /** Regex instead of glob for shapes globs cannot express. */
+        regex?: boolean;
+        /** Which file tools arm: default ["write", "edit"]. */
+        tools?: string[];
+    };
+    /** The armed command: while armed, commands matching this regex fire the rule's action. */
+    arms: {
+        /** Regex source string; compiled case-insensitively unless caseSensitive is true. */
+        command: string;
+        /** How long the rule stays armed after the last matching edit; default "10m". */
+        for?: string | number;
+        /** Match the command case-sensitively. */
+        caseSensitive?: boolean;
+    };
+    /** confirm: dialog (user-invoked prompt); hold: steer hold; block: deny. */
+    action: "confirm" | "hold" | "block";
+    /** Optional human label shown in the dialog/status. */
+    message?: string;
 }
 export interface StuckGuardConfig {
     enabled: boolean;
@@ -143,6 +218,8 @@ export interface WardenConfig {
     enabled: boolean;
     /** Consent to send task and action summaries to api.typesafe.ai. Set by /warden enable; never by a project file. */
     typesafe: boolean;
+    /** The decisions service the judgments go to. User file only: a project must not redirect judgments to another vendor. */
+    typesafeBackend: JudgmentBackend;
     /**
      * steer (default): a confirm-level call is held and the agent receives the judgment as its tool result, so it re-plans or asks
      * the user in chat. confirm: open a dialog and let the user decide (falls back to steer without a UI). advise: never hold; report only.