pi-warden 0.23.0 → 0.26.0

package/dist/config.js

@@ -1,6 +1,7 @@
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { resolveBackend } from "./backend.js";
 import { COMMAND_TOOLS } from "./tools.js";
 import { defaultWidgetConfig } from "./widget.js";
 const RECALL_TOOLS = ["auto", "rg", "ag", "ugrep", "git-grep", "grep", "select-string", "findstr", "none"];
@@ -15,6 +16,7 @@ export function defaultConfig() {
     return {
         enabled: true,
         typesafe: false,
+        typesafeBackend: "typesafe",
         mode: "steer",
         timeoutMs: 5000,
         maxRequests: 500,
@@ -28,6 +30,11 @@ export function defaultConfig() {
             intentMismatch: 0.9,
             visibleMismatch: 0.8,
             feedbackLog: true,
+            commandRules: [],
+            commandDenyRules: [],
+            exemptRules: [],
+            pathRules: [],
+            armingRules: [],
         },
         stuck: { enabled: true, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 0.7, churnThreshold: 5, nudge: true },
         done: { enabled: true, claimsDone: 0.7, nudge: true },
@@ -94,7 +101,142 @@ function positiveInteger(value, fallback) {
 export function isMode(value) {
     return value === "steer" || value === "confirm" || value === "advise";
 }
-function applyAction(base, raw, timeoutMs) {
+function parseCommandRule(raw, defaultSeverity) {
+    if (!isObject(raw))
+        return undefined;
+    const id = typeof raw.id === "string" && raw.id.trim() ? raw.id.trim() : undefined;
+    const pattern = typeof raw.pattern === "string" && raw.pattern.trim() ? raw.pattern : undefined;
+    if (!id || !pattern)
+        return undefined;
+    const severity = raw.severity === "warn" || raw.severity === "confirm" || raw.severity === "deny" ? raw.severity : defaultSeverity;
+    // Dialog is the default for a confirm rule (the reason one writes such a rule); hold restores steer semantics.
+    // A deny or warn rule cannot carry an action: there is nothing to prompt and nothing to steer differently, and a
+    // stray action on one would misreport in traces as a dialog rule.
+    const action = raw.action === "dialog" || raw.action === "hold" ? (severity === "confirm" ? raw.action : undefined) : severity === "confirm" ? "dialog" : undefined;
+    const message = typeof raw.message === "string" && raw.message.trim() ? raw.message.trim() : undefined;
+    const caseSensitive = typeof raw.caseSensitive === "boolean" ? raw.caseSensitive : false;
+    return { id, pattern, severity, ...(action ? { action } : {}), ...(message ? { message } : {}), ...(caseSensitive ? { caseSensitive } : {}) };
+}
+function parseCommandRules(raw, defaultSeverity) {
+    if (!Array.isArray(raw))
+        return [];
+    const ids = new Set();
+    const rules = [];
+    for (const item of raw) {
+        const rule = parseCommandRule(item, defaultSeverity);
+        if (!rule || ids.has(rule.id))
+            continue;
+        ids.add(rule.id);
+        rules.push(rule);
+    }
+    return rules;
+}
+function parseExemptRules(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const ids = new Set();
+    for (const item of raw) {
+        if (typeof item === "string" && item.trim())
+            ids.add(item.trim());
+    }
+    return [...ids];
+}
+const PATH_TOOL_NAMES = new Set(["read", "write", "edit", "bash", "powershell", "ctx_execute", "ctx_batch_execute", "ctx_execute_file"]);
+function parsePathRule(raw) {
+    if (!isObject(raw))
+        return undefined;
+    const id = typeof raw.id === "string" && raw.id.trim() ? raw.id.trim() : undefined;
+    const paths = globList(raw.paths, []);
+    if (!id || paths.length === 0)
+        return undefined;
+    // "*" widens the rule to the bash surface; other entries name the structured file-tool surfaces.
+    const requested = Array.isArray(raw.tools) ? raw.tools.filter((tool) => typeof tool === "string" && tool.trim().length > 0).map(tool => tool.trim()) : ["*"];
+    const tools = requested.length > 0 ? requested : ["*"];
+    const access = raw.access === "none" || raw.access === "read" || raw.access === "write" ? raw.access : "none";
+    const action = raw.action === "warn" || raw.action === "confirm" || raw.action === "block" ? raw.action : "note";
+    const message = typeof raw.message === "string" && raw.message.trim() ? raw.message.trim() : undefined;
+    const onlyIfExists = raw.onlyIfExists === false ? false : true;
+    return { id, paths, ...(raw.regex === true ? { regex: true } : {}), access, tools, action, ...(message ? { message } : {}), ...(onlyIfExists === false ? { onlyIfExists: false } : {}) };
+}
+function parsePathRules(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const ids = new Set();
+    const rules = [];
+    for (const item of raw) {
+        const rule = parsePathRule(item);
+        // A tool name that is neither a structured surface nor "*" is inert on every surface; keep it only when it means something.
+        if (!rule || ids.has(rule.id) || !rule.tools.some(tool => tool === "*" || PATH_TOOL_NAMES.has(tool)))
+            continue;
+        ids.add(rule.id);
+        rules.push(rule);
+    }
+    return rules;
+}
+/** Parse a duration string ("10m", "30s", "2h") or number (ms) into milliseconds. */
+function parseDuration(raw, fallback) {
+    if (typeof raw === "number" && Number.isFinite(raw) && raw > 0)
+        return raw;
+    if (typeof raw !== "string")
+        return fallback;
+    const match = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h)?$/.exec(raw.trim());
+    if (!match)
+        return fallback;
+    const value = parseFloat(match[1]);
+    const unit = match[2] ?? "m";
+    return value * (unit === "ms" ? 1 : unit === "s" ? 1000 : unit === "m" ? 60_000 : 3_600_000);
+}
+const DEFAULT_ARMING_DURATION = 600_000; // 10 minutes
+const ARMING_TOOLS = new Set(["write", "edit"]);
+function parseArmingRule(raw) {
+    if (!isObject(raw))
+        return undefined;
+    const id = typeof raw.id === "string" && raw.id.trim() ? raw.id.trim() : undefined;
+    const whenRaw = isObject(raw.when) ? raw.when : undefined;
+    const edited = globList(whenRaw?.edited, []);
+    if (!id || edited.length === 0)
+        return undefined;
+    const armsRaw = isObject(raw.arms) ? raw.arms : {};
+    const command = typeof armsRaw.command === "string" && armsRaw.command.trim() ? armsRaw.command : undefined;
+    if (!command)
+        return undefined;
+    const action = raw.action === "confirm" || raw.action === "hold" || raw.action === "block" ? raw.action : undefined;
+    if (!action)
+        return undefined;
+    const toolsProvided = Array.isArray(whenRaw?.tools) && whenRaw.tools.length > 0;
+    const tools = toolsProvided
+        ? whenRaw.tools.filter((t) => typeof t === "string" && ARMING_TOOLS.has(t))
+        : ["write", "edit"];
+    // A when.tools that filters to nothing (e.g. ["bash"]) is inert: no tool would ever arm it.
+    if (toolsProvided && tools.length === 0)
+        return undefined;
+    const forMs = parseDuration(armsRaw.for, DEFAULT_ARMING_DURATION);
+    const caseSensitive = typeof armsRaw.caseSensitive === "boolean" ? armsRaw.caseSensitive : false;
+    const message = typeof raw.message === "string" && raw.message.trim() ? raw.message.trim() : undefined;
+    const regex = whenRaw?.regex === true;
+    return {
+        id,
+        when: { edited, ...(regex ? { regex: true } : {}), ...(toolsProvided && tools.length > 0 ? { tools } : {}) },
+        arms: { command, for: forMs, ...(caseSensitive ? { caseSensitive } : {}) },
+        action,
+        ...(message ? { message } : {}),
+    };
+}
+function parseArmingRules(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const ids = new Set();
+    const rules = [];
+    for (const item of raw) {
+        const rule = parseArmingRule(item);
+        if (!rule || ids.has(rule.id))
+            continue;
+        ids.add(rule.id);
+        rules.push(rule);
+    }
+    return rules;
+}
+function applyAction(base, raw, timeoutMs, source) {
     const withTimeout = { ...base, timeoutMs };
     if (!isObject(raw))
         return withTimeout;
@@ -109,6 +251,15 @@ function applyAction(base, raw, timeoutMs) {
         intentMismatch: probability(raw.intentMismatch, base.intentMismatch),
         visibleMismatch: Math.min(probability(raw.visibleMismatch, base.visibleMismatch), probability(raw.intentMismatch, base.intentMismatch)),
         feedbackLog: boolean(raw.feedbackLog, base.feedbackLog),
+        // Only the user file declares these; a project file cannot add, edit, or remove them. The base (already the
+        // user's rules when a project file layers on top) is carried through, so a project "action" block cannot wipe them.
+        commandRules: source === "user" ? parseCommandRules(raw.commandRules, "warn") : base.commandRules,
+        commandDenyRules: source === "user" ? parseCommandRules(raw.commandDenyRules, "deny") : base.commandDenyRules,
+        exemptRules: source === "user" ? parseExemptRules(raw.exemptRules) : base.exemptRules,
+        // Path rules are user-declared security policy: a project file cannot add, edit, or remove them either.
+        pathRules: source === "user" ? parsePathRules(raw.pathRules) : base.pathRules,
+        // Arming rules are user-declared security policy: same gate.
+        armingRules: source === "user" ? parseArmingRules(raw.armingRules) : base.armingRules,
     };
 }
 function applyStuck(base, raw) {
@@ -229,7 +380,7 @@ function applyGuards(base, raw, timeoutMs, source) {
         subagent: applySubagent(base.subagent, raw.subagent),
         // A project file may switch notifications off or on, but never names a command to run.
         notify: applyNotify(base.notify, raw.notify, source === "user"),
-        action: applyAction(base.action, raw.action, timeoutMs),
+        action: applyAction(base.action, raw.action, timeoutMs, source),
         stuck: applyStuck(base.stuck, raw.stuck),
         done: applyDone(base.done, raw.done),
         slop: applySlop(base.slop, raw.slop),
@@ -255,6 +406,7 @@ export function applyUserOverrides(base, raw) {
     return {
         enabled: boolean(raw.enabled, base.enabled),
         typesafe: boolean(raw.typesafe, base.typesafe),
+        typesafeBackend: resolveBackend(raw.typesafeBackend),
         mode: isMode(raw.mode) ? raw.mode : base.mode,
         ...shared,
         ...applyGuards(base, raw, shared.timeoutMs, "user"),

package/dist/extension.js

@@ -1,12 +1,17 @@
-import { MouseRegion } from "@earendil-works/pi-tui";
+import * as tuiModule from "@earendil-works/pi-tui";
+const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
+import { backendHost, disclosureFor, judgeOptions, keyAvailable, resolveBackend } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
+import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, isMode, loadConfig, PACKAGE_NAME, projectConfigPath, readUserConfig, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
-import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome } from "./done.js";
-import { evaluateAction, formatVerdict, intentSteer, offTaskSteer, SLOP_LABELS, SteerRepeatWindow, steerReason } from "./guard.js";
+import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
+import { evaluateAction, formatVerdict, higher, inertPathRules, intentSteer, offTaskSteer, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
+import { initSchema, recordHold, recordOutcome, toHoldRecord } from "./learning.js";
 import { evaluateProse, proseNudge, ProseTrend, RESTATE_MIN_SENTENCES, RESTATE_SHARE, RestatementWindow, substantiveSentences } from "./prose.js";
 import { compressOutput, duplicateNote, evaluateOutput, mergeOutput, outputKey, saveOutput, securityNotice } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
@@ -191,9 +196,28 @@ export default function wardenExtension(pi) {
     let panel;
     let lastUi;
     const actionGuard = new ActionGuard();
+    // Arming rules: session-scoped state that correlates preparation edits with later commands.
+    const arming = new ArmingTracker([]);
     const rulesGuard = new RulesGuard();
     // Hold feedback: what the user did after each judged call, the trace entry each label lands on, and the per-session log.
     const holds = new HoldLedger();
+    initSchema();
+    const learningIds = new Map(); // holds.id -> learning.id
+    // Prune learningIds when it grows large to prevent memory leaks
+    function pruneLearningIds() {
+        if (learningIds.size > 1000) {
+            const entries = [...learningIds.entries()];
+            learningIds.clear();
+            // Keep only the most recent 500
+            for (const [k, v] of entries.slice(-500))
+                learningIds.set(k, v);
+        }
+    }
+    function summarizeContext(context) {
+        if (!context?.length)
+            return undefined;
+        return context.slice(-8).map(m => m.role + ": " + redact(m.text.slice(0, 200))).join("\n");
+    }
     const traceOf = new WeakMap();
     let holdLog;
     // Allowed calls of the turn the user just replied to; the regret question about them rides the next action request.
@@ -220,6 +244,10 @@ export default function wardenExtension(pi) {
     let lastNotifiedAt = 0;
     // A partially updated module graph can hand this build a config without the sections it expects; see shape.ts.
     let shapeReported = false;
+    // An exemptRules id that names neither a built-in nor one of the user's own rules is inert; said once, not per call.
+    let exemptReported = false;
+    let inertReported = false;
+    let unparseableReported = false;
     const configFor = (ctx) => {
         const { config, missing } = guardCurrentSections(completeConfig(loadConfig({ cwd: ctx.cwd, projectTrusted: ctx.isProjectTrusted() })));
         if (missing.length && !shapeReported) {
@@ -231,15 +259,46 @@ export default function wardenExtension(pi) {
             else
                 pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true });
         }
+        const unknownExempt = unknownExemptIds(config.action.exemptRules, config.action.commandRules, config.action.commandDenyRules, config.action.pathRules, config.action.armingRules);
+        if (unknownExempt.length && !exemptReported) {
+            exemptReported = true;
+            const text = `warden: exemptRules names ${unknownExempt.join(", ")}, which match no built-in or user rule; those entries are inert`;
+            if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true });
+        }
+        const inert = inertPathRules(config.action.pathRules, config.action.tools);
+        if (inert.length && !inertReported) {
+            inertReported = true;
+            const text = `warden: path rules ${inert.join(", ")} can never fire with the current access/tools combination; check access polarity or add the tool to action.tools`;
+            if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true });
+        }
+        const unparseable = unparseableArmingRules(config.action.armingRules);
+        if (unparseable.length && !unparseableReported) {
+            // Separate flag so an operator with both an inert path rule and a bad arming regex sees both warnings.
+            unparseableReported = true;
+            const text = `warden: arming rules ${unparseable.join(", ")} have an invalid command regex; the rules will never fire`;
+            if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true });
+        }
+        arming.updateRules(config.action.armingRules);
         return config;
     };
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
-    /** A consent flag is not proof that judgments happen; ask pi-typesafe for the real key state. */
+    /** A consent flag is not proof that judgments happen; check the key state for the chosen backend. */
     const judgeFor = (config) => {
-        if (!consentGiven(config) || budgetExhausted || !authState().usable)
+        if (!consentGiven(config) || budgetExhausted)
             return undefined;
-        return client ??= createTypeSafe({ maxRequests: config.maxRequests, timeoutMs: config.timeoutMs });
+        if (!keyAvailable(config.typesafeBackend, process.env, () => authState().usable))
+            return undefined;
+        return client ??= createTypeSafe(judgeOptions(config));
     };
     const noteError = (ctx, message, code) => {
         stats.errors++;
@@ -271,12 +330,18 @@ export default function wardenExtension(pi) {
         }
         const entries = [...widget].map(([guard, line]) => ({ guard, line }));
         // A custom component so the lines wrap to the pane and a click (fullscreen mode) opens the trace panel.
-        ctx.ui.setWidget(WIDGET, (_tui, theme) => new MouseRegion(statusWidget(entries, theme), event => {
-            if (event.type !== "click" || event.button !== "left")
-                return undefined;
-            togglePanel(lastUi, config);
-            return { handled: true };
-        }), { placement: config.widget.placement });
+        // When the host TUI lacks MouseRegion (e.g. omp 18.2.5), the extension still loads — the widget
+        // renders the same text, but a click does nothing. A missing named import is a link-time error
+        // that kills the entire extension silently; a missing namespace property is undefined.
+        ctx.ui.setWidget(WIDGET, (_tui, theme) => {
+            const body = statusWidget(entries, theme);
+            return MouseRegion ? new MouseRegion(body, event => {
+                if (event.type !== "click" || event.button !== "left")
+                    return undefined;
+                togglePanel(lastUi, config);
+                return { handled: true };
+            }) : body;
+        }, { placement: config.widget.placement });
     };
     const record = (ctx, config, guard, line, details) => {
         widget.set(guard, line);
@@ -399,6 +464,7 @@ export default function wardenExtension(pi) {
         holds.reset();
         regretCandidates = [];
         holdLog = new HoldLog(holdLogPath(typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid)));
+        arming.reset();
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
@@ -495,6 +561,18 @@ export default function wardenExtension(pi) {
         if (!config.action.enabled || !config.action.tools.includes(event.toolName))
             return;
         stats.inspected++;
+        // Arming: a write/edit to a protected path arms matching command patterns for a window. Bash redirect/tee
+        // targets that match a when.edited glob also arm. This is session state, not a per-call verdict — it runs
+        // before the action guard so the armed check on a later command sees the preparation.
+        if (config.action.armingRules.length > 0) {
+            const inputPath = typeof event.input.path === "string" ? event.input.path : undefined;
+            const armCmd = commandOf(event.toolName, event.input)?.command;
+            // Parity with checkArmed: strip data text before extracting write-sink targets so a redirect
+            // mentioned inside a data heredoc (no shell sink) does not arm, but a real redirect in an executed
+            // heredoc or plain command does.
+            const sinks = armCmd ? writeSinkTargets(stripDataText(armCmd).text) : undefined;
+            arming.arm(event.toolName, inputPath, ctx.cwd, sinks);
+        }
         const task = latestUserPrompt(ctx);
         const judge = judgeFor(config);
         const siblings = siblingToolCalls(ctx);
@@ -507,6 +585,51 @@ export default function wardenExtension(pi) {
         const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, previousActions: regretCandidates.length ? regretCandidates : undefined });
         if (verdict.source === "skipped")
             return;
+        // Arming check: if any armed rule's command regex matches this call, inject a hit into the verdict.
+        // The hit is deterministic — it fires regardless of Jev. But to avoid spending a judge request on a call whose
+        // outcome is already decided by the armed hit, the armed check runs before the action guard when armed rules
+        // exist, and if it produces a deny/confirm/hold verdict, the judge is skipped entirely (fix 11).
+        const cmd = commandOf(event.toolName, event.input)?.command;
+        const armedHits = cmd && config.action.armingRules.length > 0 ? arming.checkArmed(cmd) : [];
+        // Fix 3: exemptRules can silence an armed rule by raw id (the injected id is `armed:<id>`, but the user wrote <id>).
+        const visibleArmedHits = armedHits.filter(hit => !config.action.exemptRules.includes(hit.id));
+        if (visibleArmedHits.length > 0) {
+            // Build the verdict from patterns alone — no judge request (fix 11). The deny/confirm/hold plumbing handles it.
+            const armedPatterns = [];
+            const armedReasons = [];
+            let armedLevel = "allow";
+            for (const hit of visibleArmedHits) {
+                const action = hit.action;
+                // Fix 1: hold → destructive severity + action:"hold" (steer-mode hold semantics, same as commandRules action:"hold");
+                // confirm → destructive + action:"dialog"; block → deny. The old code mapped hold to risky→warn, a no-op.
+                const severity = action === "block" ? "deny" : "destructive";
+                const patternHit = {
+                    id: `armed:${hit.id}`,
+                    severity,
+                    label: hit.message ?? `armed rule ${hit.id}`,
+                    ...(action === "confirm" ? { action: "dialog" } : action === "hold" ? { action: "hold" } : {}),
+                    ...(hit.message ? { message: hit.message } : {}),
+                };
+                armedPatterns.push(patternHit);
+                // Fix 8: armed confirm dialog names the files that armed it.
+                const armedBy = hit.armedByPaths.length > 0 ? ` (armed by: ${hit.armedByPaths.join(", ")})` : "";
+                if (severity === "deny") {
+                    armedLevel = "deny";
+                    armedReasons.push(`${hit.message ?? `armed rule ${hit.id}`}${armedBy}`);
+                }
+                else if (severity === "destructive") {
+                    armedLevel = higher(armedLevel, "confirm");
+                    armedReasons.push(`armed: ${hit.message ?? hit.id}${armedBy}`);
+                }
+            }
+            // Merge the armed patterns into the existing verdict (the action guard may have produced one too).
+            verdict.patterns.push(...armedPatterns);
+            verdict.level = higher(verdict.level, armedLevel);
+            verdict.reasons.push(...armedReasons);
+            // Fix 6: armed hits on read-only commands still record a trace line (bypass the read-only source gate).
+            if (verdict.source === "read-only")
+                verdict.source = "pattern";
+        }
         if (regretCandidates.length && verdict.judgment?.regretted !== undefined) {
             settleRegret(config, { regretted: regretsAt(verdict.judgment.regretted), target: verdict.judgment.regretTarget, probability: verdict.judgment.regretted, via: "jev" });
         }
@@ -526,18 +649,42 @@ export default function wardenExtension(pi) {
         if (verdict.approvedByUser) {
             stats.approved++;
             const released = holds.approved(event.toolName);
-            if (released)
+            if (released) {
                 noteOutcomes(config, [released]);
+                const learningId = learningIds.get(released.id);
+                if (learningId)
+                    recordOutcome(learningId, "approved");
+            }
         }
         const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
+        // SAFETY: verdict.source is a string union; the read-only → pattern rewrite above may have narrowed it in TS's view,
+        // but the field is still one of the source values at runtime when no armed hits fired.
         const entry = verdict.source !== "read-only" ? record(ctx, config, "action", formatVerdict(verdict, config.widget.action), actionDetails(verdict, { mode, ...(told ? { told } : {}) })) : undefined;
         // What happens to this call is the label for its scores; a decision made in the dialog lands at once, a steer-mode hold waits for the user.
         const track = (held, outcome, via) => {
             if (!entry)
                 return;
-            const item = holds.record(verdict, { held, mode, outcome, via });
+            const recordOpts = { held, mode, outcome, via };
+            if (task)
+                recordOpts.task = task;
+            if (verdict.plan)
+                recordOpts.plan = verdict.plan;
+            const ctxSummary = summarizeContext(recentTaskContext(ctx));
+            if (ctxSummary)
+                recordOpts.contextSummary = ctxSummary;
+            if (held)
+                recordOpts.agentReason = steerReason(verdict, { canApprove: judge !== undefined });
+            const item = holds.record(verdict, recordOpts);
             traceOf.set(item, entry);
             noteOutcomes(config, outcome ? [item] : []);
+            // Record to SQLite for learning
+            if (held) {
+                const id = recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores }, ctx.cwd, { task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: steerReason(verdict, { canApprove: judge !== undefined }) }));
+                learningIds.set(item.id, id);
+                if (outcome)
+                    recordOutcome(id, outcome);
+                pruneLearningIds();
+            }
         };
         // The warn notice below names the mismatch to the user; the agent gets the steer with the other notes.
         if (verdict.intentMismatch) {
@@ -608,11 +755,34 @@ export default function wardenExtension(pi) {
             track(false);
             return undefined;
         }
+        if (verdict.level === "deny") {
+            stats.held++;
+            track(true, "declined", "deny");
+            if (ctx.hasUI && config.notices)
+                ctx.ui.notify(`warden · blocked ${event.toolName}: ${verdict.reasons.join("; ")}`, "error");
+            notifyDesktop(ctx, config, `Blocked ${event.toolName}: ${verdict.reasons.join("; ")}. A deny rule matched; the call never ran.`);
+            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${verdict.reasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
+        }
         if (verdict.level !== "confirm") {
             track(false);
             return undefined;
         }
         const reasons = verdict.reasons.join("; ");
+        // A user-defined confirm rule prompts the user in every mode, advise included: the operator wrote the rule to be
+        // asked. Advise mode keeps Jev holds advisory; it does not soften a prompt the operator asked for by name.
+        // The action defaults to dialog at parse time (the reason one writes such a rule); hold restores steer semantics.
+        const dialogRule = verdict.patterns.some(hit => hit.action === "dialog");
+        if (dialogRule && ctx.hasUI) {
+            notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
+            const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            if (allowed) {
+                track(true, "approved", "dialog");
+                return undefined;
+            }
+            stats.held++;
+            track(true, "declined", "dialog");
+            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
+        }
         if (mode === "advise") {
             stats.warned++;
             if (ctx.hasUI && config.notices)
@@ -836,7 +1006,7 @@ export default function wardenExtension(pi) {
         const patch = content === event.content ? undefined : { content };
         // Checks use the original result, not the excerpts or security banner.
         if (config.done.enabled)
-            recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed, text), event.input, event.toolName);
+            recordDoneOutcome(evidence, classifyToolResult(event.toolName, event.input, failed, text), event.input, event.toolName);
         const verdict = await stuckCheck;
         if (!verdict)
             return patch;
@@ -863,6 +1033,8 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        // Arming state survives across runs within a session (the Scenario B case: edit in one turn,
+        // reconcile in the next). It is cleared on session_start and bounded by the rule's `for` window.
         // No guarded call carried the regret question this run (the agent only replied): the offline heuristic reads the prompt.
         if (regretCandidates.length)
             settleRegret(config, { regretted: textRegrets(latestUserPrompt(ctx)), via: "text" });
@@ -976,13 +1148,14 @@ export default function wardenExtension(pi) {
                     const usage = client?.getUsage();
                     const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.rules.enabled && "rules", config.context.enabled && "context", config.runaway.enabled && "runaway", config.subagent.enabled && "subagent triage", config.notify.enabled && "desktop notifications"].filter(Boolean).join(", ");
                     report([
-                        `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}; ${auth.text}`,
+                        `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
                         `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
                         formatSteers(stats),
                         `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / steer ${config.action.offTask.steer} (never holds); intent mismatch ${config.action.intentMismatch} (${config.action.visibleMismatch} on a visible action); stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
                         `${formatHolds(holds.snapshot(), config.action.feedbackLog ? holdLog?.path : undefined)}${holdLog?.lastFailure ? ` Log write failed: ${holdLog.lastFailure}.` : ""}`,
                         `Rules: ${config.rules.enabled ? `${rulesGuard.describe(ctx.cwd, config.rules)}${Object.keys(config.rules.sensitivePaths).length ? `; ${Object.keys(config.rules.sensitivePaths).length} sensitive path${Object.keys(config.rules.sensitivePaths).length === 1 ? "" : "s"}` : ""}` : "off"}.`,
+                        ...(config.action.armingRules.length > 0 ? [`Arming: ${arming.statusLine() || "no rules armed"}.`] : []),
                         `Desktop notifications: ${config.notify.enabled ? `on (${config.notify.command.length ? `command ${config.notify.command[0]}` : (await (notifier ??= detectNotifier())) ?? "no notifier found on this machine"}; cooldown ${config.notify.cooldownMs} ms)` : "off (\"notify\": { \"enabled\": true } in the config turns them on)"}.`,
                         `Config: ${userConfigPath()}${ctx.isProjectTrusted() ? ` and ${projectConfigPath(ctx.cwd)}` : ""}.`,
                         widget.size ? `Last: ${[...widget.values()].join(" | ")}` : "No guarded activity yet this session.",
@@ -1062,7 +1235,7 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "test") {
                     const judge = judgeFor(config);
-                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Clean up the demo directory") goes to api.typesafe.ai and may incur charges. ${disclosure}`))
+                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Clean up the demo directory") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
                         return;
                     const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Clean up the demo directory" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge });
                     record(ctx, config, "action", formatVerdict(verdict, config.widget.action), actionDetails(verdict, { mode: activeMode(config, ctx.hasUI) }));