pi-warden 0.28.4 → 0.34.1

package/dist/conscience-privacy.js

@@ -0,0 +1,11 @@
+import { redact } from "./redact.js";
+/** URLs are not local paths; protect them before scanning free text for filesystem spans. */
+export function safeConscienceText(text, disclosed = "") {
+    const urls = [];
+    const redacted = redact(text);
+    const masked = redacted.replace(/https?:\/\/[^\s<>"'`]+/gi, value => `\u0001${urls.push(value) - 1}\u0002`);
+    const clean = masked.replace(/(?:file:\/\/[^\s<>"'`]+|[A-Za-z]:[\\/][^\s<>"'`]+|\\\\[^\s<>"'`]+|~\/[^\s<>"'`]+|(?<![\w/:])\/(?:[^\s<>"'`]+))/g, path => disclosed.includes(path) ? path : "[local path]");
+    return clean.replace(/\u0001(\d+)\u0002/g, (_, index) => urls[Number(index)] ?? "[URL]");
+}
+export const safeCapabilityName = (name) => /^[A-Za-z0-9_.:\-]{1,128}$/.test(name) && redact(name) === name;
+export const excludedCapability = (name, patterns) => patterns.some(pattern => new RegExp(`^${pattern.split("*").map(part => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(name));

package/dist/discover.d.ts

@@ -0,0 +1,14 @@
+/** Directories to skip during source-file discovery. */
+export declare const SKIP_DIRS: Set<string>;
+export declare const SOURCE_RE: RegExp;
+/**
+ * Recursively walk `dir` and collect source-file paths (relative to `dir`).
+ * Skips directories in SKIP_DIRS and stops after `max` files.
+ */
+export declare function discoverSourceFiles(dir: string, max?: number): string[];
+/**
+ * Find project directories inside a workspace. A project is any directory
+ * containing a known manifest file. The workspace root itself counts if it
+ * has one.
+ */
+export declare function findProjects(cwd: string): string[];

package/dist/discover.js

@@ -0,0 +1,85 @@
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { redact } from "./redact.js";
+/** Directories to skip during source-file discovery. */
+export const SKIP_DIRS = new Set([
+    ".git", "node_modules", "dist", "build", ".next", ".output",
+    "coverage", ".cache", "__pycache__", ".pi-warden", "vendor",
+    ".turbo", ".vercel", ".netlify", ".svelte-kit",
+]);
+export const SOURCE_RE = /\.(ts|tsx|js|jsx|rs|py|go|vue|svelte|rb|php|java|kt|swift|cs|cpp|c|h)$/;
+/**
+ * Recursively walk `dir` and collect source-file paths (relative to `dir`).
+ * Skips directories in SKIP_DIRS and stops after `max` files.
+ */
+export function discoverSourceFiles(dir, max = 200) {
+    const files = [];
+    function walk(current) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch (err) {
+            console.warn(`audit: could not list ${redact(current)}: ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        for (const entry of entries) {
+            if (files.length >= max)
+                return;
+            if (entry.name.startsWith(".") && entry.name !== ".")
+                continue;
+            const fullPath = join(current, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                walk(fullPath);
+            }
+            else if (entry.isFile() && SOURCE_RE.test(entry.name)) {
+                files.push(fullPath.slice(dir.length + 1)); // relative path
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+/**
+ * Find project directories inside a workspace. A project is any directory
+ * containing a known manifest file. The workspace root itself counts if it
+ * has one.
+ */
+export function findProjects(cwd) {
+    const projects = [];
+    const manifests = ["package.json", "Cargo.toml", "pyproject.toml", "go.mod"];
+    for (const m of manifests) {
+        if (existsSync(join(cwd, m))) {
+            projects.push(cwd);
+            break;
+        }
+    }
+    let entries;
+    try {
+        entries = readdirSync(cwd);
+    }
+    catch (err) {
+        console.warn(`audit: could not read workspace ${redact(cwd)}: ${err instanceof Error ? err.message : err}`);
+        return projects;
+    }
+    for (const entry of entries) {
+        if (entry === "node_modules" || entry.startsWith("."))
+            continue;
+        const sub = join(cwd, entry);
+        try {
+            if (!existsSync(join(sub, "package.json")) && !existsSync(join(sub, "Cargo.toml")) && !existsSync(join(sub, "pyproject.toml")) && !existsSync(join(sub, "go.mod")))
+                continue;
+        }
+        catch (err) {
+            console.warn(`audit: could not check ${redact(sub)}: ${err instanceof Error ? err.message : err}`);
+            continue;
+        }
+        if (!projects.includes(sub))
+            projects.push(sub);
+    }
+    return projects;
+}

package/dist/extension.d.ts

@@ -2,7 +2,7 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, reason) for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request, including calls where the rules guard is disabled; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /** Which guard spent the user's attention. The status line reports one count per guard. */
 export type SteerGuard = "action" | "rules" | "security" | "stuck" | "done" | "prose" | "runaway" | "subagent";
 /**

package/dist/extension.js

@@ -1,4 +1,6 @@
+import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
+import { join } from "node:path";
 import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
@@ -9,15 +11,18 @@ import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { evaluateAction, formatVerdict, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
-import { initSchema, recordHold, recordOutcome, toHoldRecord, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
+import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
 import { evaluateProse, proseNudge, ProseTrend, RESTATE_MIN_SENTENCES, RESTATE_SHARE, RestatementWindow, substantiveSentences } from "./prose.js";
 import { compressOutput, duplicateNote, evaluateOutput, mergeOutput, outputKey, saveOutput, securityNotice, CompressionLearner } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
 import { redact } from "./redact.js";
 import { formatRules, pathNoteSteer, RulesGuard, rulesSteer } from "./rules.js";
+import { checkPiWardenMissing } from "./rules-file.js";
+import { writeStarterRules, buildInitPrompt } from "./init.js";
+import { buildAuditPrompt, findProjects, snapshotReport, reportOutcome } from "./audit.js";
 import { detectNotifier, sendNotification } from "./notify.js";
 import { formatRunaway, RunawayMonitor, runawayNudge } from "./runaway.js";
 import { AttemptWindow, evaluateStuck, formatStuck, makeAttempt, resultFailed, stuckNudge } from "./stuck.js";
@@ -26,8 +31,8 @@ import { completeConfig, shapeWarning } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
-import { DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, reason) for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request, including calls where the rules guard is disabled; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
 const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
@@ -126,6 +131,28 @@ function activeMode(config, hasUI) {
     const mode = isMode(env) ? env : config.mode;
     return mode === "confirm" && !hasUI ? "steer" : mode;
 }
+/** Keep diagnostics intact while removing structured trace-only items at the agent boundary. */
+function agentDeliveryReasons(verdict) {
+    const indexes = [
+        verdict.offTaskTraceOnly ? verdict.offTaskTraceOnlyReasonIndex : undefined,
+        verdict.shouldProceedTraceOnly ? verdict.shouldProceedTraceOnlyReasonIndex : undefined,
+    ].filter((index) => index !== undefined && index >= 0 && index < verdict.reasons.length);
+    if (!indexes.length)
+        return verdict.reasons;
+    return verdict.reasons.filter((_reason, reasonIndex) => !indexes.includes(reasonIndex));
+}
+/** Keep the full judgment while suppressing trace-only reasons and steer flags. */
+function agentDeliveryVerdict(verdict) {
+    const reasons = agentDeliveryReasons(verdict);
+    if (reasons === verdict.reasons)
+        return verdict;
+    const deliveryVerdict = { ...verdict, reasons };
+    if (verdict.offTaskTraceOnly)
+        delete deliveryVerdict.offTaskSteer;
+    if (verdict.shouldProceedTraceOnly)
+        delete deliveryVerdict.shouldProceedSteer;
+    return deliveryVerdict;
+}
 function clip(text) {
     return text.length <= CONFIRM_TEXT_LIMIT ? text : `${text.slice(0, CONFIRM_TEXT_LIMIT)}…`;
 }
@@ -202,7 +229,7 @@ export default function wardenExtension(pi) {
     const rulesGuard = new RulesGuard();
     // Hold feedback: what the user did after each judged call, the trace entry each label lands on, and the per-session log.
     const holds = new HoldLedger();
-    const learningIds = new Map(); // holds.id -> learning.id
+    const learningIds = new Map(); // holds.id -> promise of learning.id
     // Prune learningIds when it grows large to prevent memory leaks
     function pruneLearningIds() {
         if (learningIds.size > 1000) {
@@ -226,6 +253,11 @@ export default function wardenExtension(pi) {
     let evidence = emptyEvidence();
     let doneNudged = false;
     let warnedFallback = false;
+    let warnedMissingRules = false;
+    /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
+    let initRunning = false;
+    /** True while /warden audit is sending a prompt and waiting for the agent to write the report. */
+    let auditRunning = false;
     const prose = new ProseTrend();
     const slopCounts = { stub: 0, comments: 0, dead: 0, hedging: 0 };
     const ledger = new ContextLedger();
@@ -343,7 +375,20 @@ export default function wardenExtension(pi) {
                     const color = LEVEL_COLOR[chip ?? ""] ?? "text";
                     const chipText = chip ? `${theme.bold(theme.fg(color, chip.toUpperCase()))}  ` : "";
                     const guardText = theme.fg("muted", lastEntry.guard + " ");
-                    const body = { render: (width) => [chipText + guardText + sentence], invalidate: () => { } };
+                    // Like widgetLines: the head width is tracked, the body wraps to what remains, and a line wider than
+                    // the pane trips pi's render-width guard, which aborts the session.
+                    const chipWidth = chip ? chip.length + 2 : 0;
+                    const headWidth = chipWidth + lastEntry.guard.length + 1;
+                    const head = chipText + guardText;
+                    const body = {
+                        render: (width) => {
+                            if (!width)
+                                return [head + sentence];
+                            const wrapped = tuiModule.wrapTextWithAnsi(sentence, Math.max(10, width - headWidth));
+                            return [head + (wrapped[0] ?? ""), ...wrapped.slice(1).map(rest => " ".repeat(headWidth) + rest)];
+                        },
+                        invalidate: () => { },
+                    };
                     return MouseRegion ? new MouseRegion(body, event => {
                         if (event.type !== "click" || event.button !== "left")
                             return undefined;
@@ -353,7 +398,7 @@ export default function wardenExtension(pi) {
                 }, { placement: config.widget.placement });
                 return;
             }
-            entries = [entries.at(-1)];
+            entries = [lastEntry ?? entries.at(-1)];
         }
         // A custom component so the lines wrap to the pane and a click (fullscreen mode) opens the trace panel.
         // When the host TUI lacks MouseRegion (e.g. omp 18.2.5), the extension still loads — the widget
@@ -370,6 +415,7 @@ export default function wardenExtension(pi) {
         }, { placement: config.widget.placement });
     };
     const record = (ctx, config, guard, line, details, tokens) => {
+        widget.delete(guard);
         widget.set(guard, line);
         const entry = { at: Date.now(), guard, line, details, tokens };
         trace.push(entry);
@@ -382,6 +428,10 @@ export default function wardenExtension(pi) {
             const entry = traceOf.get(item);
             if (entry)
                 trace.amend(entry, outcomeNote(item));
+            const idPromise = learningIds.get(item.id);
+            if (idPromise && item.outcome !== "pending") {
+                idPromise.then(id => recordOutcome(id, item.outcome)).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
+            }
         }
         if (config.action.feedbackLog && holds.records().length)
             void holdLog?.save(holds.records());
@@ -484,6 +534,8 @@ export default function wardenExtension(pi) {
         client = undefined;
         budgetExhausted = false;
         warnedFallback = false;
+        warnedMissingRules = false;
+        initRunning = false;
         await initSchema(loadConfig().learning.retentionDays);
         stats = freshStats();
         widget.clear();
@@ -614,6 +666,17 @@ export default function wardenExtension(pi) {
         if (!config.action.enabled || !config.action.tools.includes(event.toolName))
             return;
         stats.inspected++;
+        // First-run warning: pi-warden.md missing, one time per session.
+        if (!warnedMissingRules && config.rules.enabled) {
+            const { missing, fallbackSource } = checkPiWardenMissing(ctx.cwd);
+            if (missing && ctx.hasUI) {
+                warnedMissingRules = true;
+                const msg = fallbackSource
+                    ? `No pi-warden.md detected. Using ${fallbackSource} as active fallback rules. Run /warden init to create project-specific rules.`
+                    : `No rules file detected (pi-warden.md, README.md, CLAUDE.md, or AGENTS.md). Run /warden init to create project-specific rules.`;
+                ctx.ui.notify(msg, "warning");
+            }
+        }
         // Arming: a write/edit to a protected path arms matching command patterns for a window. Bash redirect/tee
         // targets that match a when.edited glob also arm. This is session state, not a per-call verdict — it runs
         // before the action guard so the armed check on a later command sees the preparation.
@@ -683,6 +746,8 @@ export default function wardenExtension(pi) {
             if (verdict.source === "read-only")
                 verdict.source = "pattern";
         }
+        const deliveryVerdict = agentDeliveryVerdict(verdict);
+        const deliveryReasons = deliveryVerdict.reasons;
         if (regretCandidates.length && verdict.judgment?.regretted !== undefined) {
             settleRegret(config, { regretted: regretsAt(verdict.judgment.regretted), target: verdict.judgment.regretTarget, probability: verdict.judgment.regretted, via: "jev" });
         }
@@ -704,12 +769,9 @@ export default function wardenExtension(pi) {
             const released = holds.approved(event.toolName);
             if (released) {
                 noteOutcomes(config, [released]);
-                const learningId = learningIds.get(released.id);
-                if (learningId)
-                    recordOutcome(learningId, "approved").catch(err => console.warn("pi-warden: recordOutcome failed:", err));
             }
         }
-        const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
+        const told = verdict.level === "confirm" && mode === "steer" ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined;
         // SAFETY: verdict.source is a string union; the read-only → pattern rewrite above may have narrowed it in TS's view,
         // but the field is still one of the source values at runtime when no armed hits fired.
         const actionFmt = formatVerdictTokens(verdict, config.widget.action);
@@ -727,19 +789,17 @@ export default function wardenExtension(pi) {
             if (ctxSummary)
                 recordOpts.contextSummary = ctxSummary;
             if (held)
-                recordOpts.agentReason = steerReason(verdict, { canApprove: judge !== undefined });
+                recordOpts.agentReason = steerReason(deliveryVerdict, { canApprove: judge !== undefined });
             const item = holds.record(verdict, recordOpts);
             traceOf.set(item, entry);
+            // Record to SQLite for learning (held and judged-allowed calls).
+            // The promise and map entry must exist before noteOutcomes so that an outcome
+            // known at record time (e.g. dialog-approved) is not lost to the race.
+            const preview = redact(verdict.summary.command ?? verdict.summary.path ?? "");
+            const holdPromise = recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores, held }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: held ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined, preview })).catch(err => { console.warn("pi-warden: recordHold failed:", err); return -1; });
+            learningIds.set(item.id, holdPromise);
+            pruneLearningIds();
             noteOutcomes(config, outcome ? [item] : []);
-            // Record to SQLite for learning
-            if (held) {
-                recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: steerReason(verdict, { canApprove: judge !== undefined }) })).then(id => {
-                    learningIds.set(item.id, id);
-                    if (outcome)
-                        recordOutcome(id, outcome).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
-                }).catch(err => console.warn("pi-warden: recordHold failed:", err));
-                pruneLearningIds();
-            }
         };
         // The warn notice below names the mismatch to the user; the agent gets the steer with the other notes.
         if (verdict.intentMismatch) {
@@ -749,8 +809,14 @@ export default function wardenExtension(pi) {
         }
         if (verdict.offTaskSteer) {
             stats.offTask++;
+            if (!verdict.offTaskTraceOnly) {
+                noteGuards.add("action");
+                notes.push(offTaskSteer(verdict));
+            }
+        }
+        if (verdict.shouldProceedSteer && !verdict.shouldProceedTraceOnly) {
             noteGuards.add("action");
-            notes.push(offTaskSteer(verdict));
+            notes.push(shouldProceedMessage(verdict));
         }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
@@ -800,13 +866,15 @@ export default function wardenExtension(pi) {
                 traceNote(delivered);
             pathNoteTraces.length = 0;
         }
-        const warnSteer = (label) => steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${label}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
+        const warnSteer = (reasons) => reasons.length > 0 && steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
         if (verdict.level === "warn") {
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
-            else if (!ctx.hasUI)
-                warnSteer(verdict.reasons.join("; "));
+            else if (!ctx.hasUI) {
+                const otherReasons = deliveryReasons.filter(r => !r.startsWith("should-proceed "));
+                warnSteer(otherReasons);
+            }
             track(false);
             return undefined;
         }
@@ -816,13 +884,14 @@ export default function wardenExtension(pi) {
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · blocked ${event.toolName}: ${verdict.reasons.join("; ")}`, "error");
             notifyDesktop(ctx, config, `Blocked ${event.toolName}: ${verdict.reasons.join("; ")}. A deny rule matched; the call never ran.`);
-            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${verdict.reasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
+            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
             track(false);
             return undefined;
         }
         const reasons = verdict.reasons.join("; ");
+        const deliveredReasons = deliveryReasons.join("; ");
         // A user-defined confirm rule prompts the user in every mode, advise included: the operator wrote the rule to be
         // asked. Advise mode keeps Jev holds advisory; it does not soften a prompt the operator asked for by name.
         // The action defaults to dialog at parse time (the reason one writes such a rule); hold restores steer semantics.
@@ -836,14 +905,14 @@ export default function wardenExtension(pi) {
             }
             stats.held++;
             track(true, "declined", "dialog");
-            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
+            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         if (mode === "advise") {
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
             else if (!ctx.hasUI)
-                warnSteer(reasons);
+                warnSteer(deliveryReasons);
             track(false);
             return undefined;
         }
@@ -856,7 +925,7 @@ export default function wardenExtension(pi) {
             }
             stats.held++;
             track(true, "declined", "dialog");
-            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
+            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         stats.held++;
         actionGuard.hold(task);
@@ -864,7 +933,7 @@ export default function wardenExtension(pi) {
         if (ctx.hasUI && config.notices)
             ctx.ui.notify(`warden · held ${event.toolName}: ${reasons}. The agent was told why and asked to re-plan or ask you.`, "warning");
         notifyDesktop(ctx, config, `Held ${event.toolName}: ${reasons}. The agent will re-plan or ask you in chat.`);
-        return { block: true, reason: told ?? steerReason(verdict, { canApprove: judge !== undefined }) };
+        return { block: true, reason: told ?? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) };
     });
     pi.on("tool_result", async (event, ctx) => {
         const config = configFor(ctx);
@@ -1086,6 +1155,17 @@ export default function wardenExtension(pi) {
     pi.on("agent_settled", async (_event, ctx) => {
         await checkSubagentReports(ctx, configFor(ctx));
     });
+    // Block new user messages while /warden init or /warden audit is running.
+    pi.on("input", async (event, ctx) => {
+        if (initRunning) {
+            ctx.ui.notify("pi-warden is generating rules. Please wait...", "warning");
+            return { action: "handled" };
+        }
+        if (auditRunning) {
+            ctx.ui.notify("pi-warden is running an audit. Please wait...", "warning");
+            return { action: "handled" };
+        }
+    });
     pi.on("agent_end", async (event, ctx) => {
         const config = configFor(ctx);
         if (!config.enabled)
@@ -1182,7 +1262,7 @@ export default function wardenExtension(pi) {
                 togglePanel(ctx.ui, configFor(ctx)); },
         });
     }
-    const actions = ["status", "enable", "disable", "mode", "config", "test", "trace"];
+    const actions = ["status", "enable", "disable", "mode", "config", "test", "trace", "init", "audit"];
     pi.registerCommand("warden", {
         description: "pi-warden status, config (set/get/editor), TypeSafe consent, mode, trace panel, recommend, and a synthetic guard test",
         getArgumentCompletions(prefix) {
@@ -1204,6 +1284,10 @@ export default function wardenExtension(pi) {
                     const source = consentSource(config);
                     const usage = client?.getUsage();
                     const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.rules.enabled && "rules", config.context.enabled && "context", config.runaway.enabled && "runaway", config.subagent.enabled && "subagent triage", config.notify.enabled && "desktop notifications"].filter(Boolean).join(", ");
+                    const ls = await holdStats(ctx.cwd);
+                    const lifetimeLine = ls.labeled === 0
+                        ? `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, not yet measurable (${ls.allowed} allowed).`
+                        : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
                         `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
@@ -1212,6 +1296,7 @@ export default function wardenExtension(pi) {
                         formatLedger(ledger.snapshot()),
                         ...(config.learning.patternAnalysis ? [`Learning: ${(await generateRecommendations(ctx.cwd)).length} recommendations, steer effectiveness ${Math.round((await analyzeSteerEffectivenessReport(ctx.cwd)).overall * 100)}% (use /warden recommend for details)`] : []),
                         `${formatHolds(holds.snapshot(), config.action.feedbackLog ? holdLog?.path : undefined)}${holdLog?.lastFailure ? ` Log write failed: ${holdLog.lastFailure}.` : ""}`,
+                        lifetimeLine,
                         `Rules: ${config.rules.enabled ? `${rulesGuard.describe(ctx.cwd, config.rules)}${Object.keys(config.rules.sensitivePaths).length ? `; ${Object.keys(config.rules.sensitivePaths).length} sensitive path${Object.keys(config.rules.sensitivePaths).length === 1 ? "" : "s"}` : ""}` : "off"}.`,
                         ...(config.action.armingRules.length > 0 ? [`Arming: ${arming.statusLine() || "no rules armed"}.`] : []),
                         `Desktop notifications: ${config.notify.enabled ? `on (${config.notify.command.length ? `command ${config.notify.command[0]}` : (await (notifier ??= detectNotifier())) ?? "no notifier found on this machine"}; cooldown ${config.notify.cooldownMs} ms)` : "off (\"notify\": { \"enabled\": true } in the config turns them on)"}.`,
@@ -1339,14 +1424,107 @@ export default function wardenExtension(pi) {
                     openConfigPanel(lastUi, config, { width: config.widget.panelWidth });
                     return;
                 }
+                if (action === "init") {
+                    const targetPath = join(ctx.cwd, "pi-warden.md");
+                    const force = argument === "--force";
+                    if (existsSync(targetPath)) {
+                        if (ctx.hasUI && !force) {
+                            if (!await ctx.ui.confirm("pi-warden.md already exists. Overwrite with a fresh starter template?", `This replaces ${targetPath} with a generic starter. Your current rules will be lost.`)) {
+                                report("Cancelled. Existing pi-warden.md unchanged.");
+                                return;
+                            }
+                        }
+                        else if (!force) {
+                            report(`pi-warden.md already exists at ${targetPath}. Pass --force to overwrite.`, "warning");
+                            return;
+                        }
+                    }
+                    const prompt = buildInitPrompt(ctx.cwd);
+                    initRunning = true;
+                    if (ctx.hasUI)
+                        ctx.ui.notify("pi-warden: Generating rules file...", "info");
+                    try {
+                        // sendUserMessage throws when the agent is not idle. Brief wait so a
+                        // just-closing confirm dialog does not cause a race.
+                        for (let attempt = 0; attempt < 40; attempt++) {
+                            if (ctx.isIdle())
+                                break;
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                        }
+                        pi.sendUserMessage(prompt);
+                        await ctx.waitForIdle();
+                    }
+                    catch (err) {
+                        const detail = err instanceof Error ? err.message : String(err);
+                        report(`pi-warden init failed: ${detail}. Try creating pi-warden.md manually.`, "error");
+                    }
+                    finally {
+                        initRunning = false;
+                    }
+                    const wardenExists = existsSync(join(ctx.cwd, "pi-warden.md"));
+                    report(wardenExists ? "pi-warden.md created. Review the rules and edit as needed." : "Agent did not create pi-warden.md. Create it manually or try /warden init again.");
+                    return;
+                }
+                if (action === "audit") {
+                    if (!ctx.hasUI) {
+                        report("Audit needs an interactive session to run.", "warning");
+                        return;
+                    }
+                    if (!await ctx.ui.confirm("Run workspace audit?", `This runs an agent-driven audit of ${redact(ctx.cwd)}. It uses the session model, reads source code, and writes a report. It may take several minutes and use real tokens. Measured comparisons need the agent's TypeSafe tool, which is enabled per session with \`/typesafe enable\`; without it findings will be marked unmeasured.`))
+                        return;
+                    const projects = findProjects(ctx.cwd);
+                    const prompt = buildAuditPrompt(ctx.cwd, projects);
+                    const reportPath = join(ctx.cwd, ".pi-warden", "audit-report.html");
+                    const preSnapshot = snapshotReport(reportPath);
+                    auditRunning = true;
+                    if (ctx.hasUI)
+                        ctx.ui.notify("pi-warden: Running workspace audit...", "info");
+                    try {
+                        for (let attempt = 0; attempt < 40; attempt++) {
+                            if (ctx.isIdle())
+                                break;
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                        }
+                        pi.sendUserMessage(prompt);
+                        await ctx.waitForIdle();
+                    }
+                    catch (err) {
+                        const detail = err instanceof Error ? err.message : String(err);
+                        report(`pi-warden audit failed: ${detail}.`, "error");
+                    }
+                    finally {
+                        auditRunning = false;
+                    }
+                    const outcome = reportOutcome(preSnapshot, snapshotReport(reportPath));
+                    switch (outcome) {
+                        case "written":
+                            report(`Audit report written to ${reportPath}`);
+                            break;
+                        case "stale":
+                            report("Audit finished but the report file was not updated — the agent may have reported findings in chat instead.");
+                            break;
+                        case "missing":
+                            report("Agent did not write an audit report. The model may have reported findings in chat instead.");
+                            break;
+                    }
+                    return;
+                }
                 if (action === "test") {
                     const judge = judgeFor(config);
-                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Clean up the demo directory") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
+                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Prepare the demo environment") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
                         return;
-                    const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Clean up the demo directory" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge });
+                    const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Prepare the demo environment" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge });
+                    const deliveryVerdict = ctx.hasUI ? verdict : agentDeliveryVerdict(verdict);
+                    const deliveryReasons = deliveryVerdict.reasons;
                     const fmt = formatVerdictTokens(verdict, config.widget.action);
                     record(ctx, config, "action", fmt.line, actionDetails(verdict, { mode: activeMode(config, ctx.hasUI) }), fmt.tokens);
-                    report(`${formatVerdict(verdict)}${verdict.reasons.length ? ` — ${verdict.reasons.join("; ")}` : ""}${judge ? "" : " (pattern checks only: TypeSafe judgments are not enabled or no key is configured)"}${verdict.error ? ` — ${verdict.error}` : ""}`);
+                    const deliveryTokens = actionTokens(deliveryVerdict);
+                    if (!ctx.hasUI && verdict.offTaskTraceOnly) {
+                        // Redact only off-task presentation tokens; retain the judgment for other consumers.
+                        delete deliveryTokens.offTask;
+                        delete deliveryTokens.scope;
+                    }
+                    report(`${renderTemplate(DEFAULT_TEMPLATES.action, deliveryTokens)}${deliveryReasons.length ? ` — ${deliveryReasons.join("; ")}` : ""}${judge ? "" : " (pattern checks only: TypeSafe judgments are not enabled or no key is configured)"}${verdict.error ? ` — ${verdict.error}` : ""}`);
                     if (verdict.level === "confirm") {
                         const mode = activeMode(config, ctx.hasUI);
                         if (mode === "confirm" && ctx.hasUI) {
@@ -1354,7 +1532,7 @@ export default function wardenExtension(pi) {
                             report(allowed ? "Demo: you chose Yes, so a real call would have run." : "Demo: you chose No, so a real call would have been blocked and the agent told why.");
                         }
                         else {
-                            report(`In ${mode} mode a real call would ${mode === "advise" ? "run with this warning shown to you" : "be held and the agent would read"}: "${steerReason(verdict, { canApprove: judge !== undefined })}"`);
+                            report(`In ${mode} mode a real call would ${mode === "advise" ? "run with this warning shown to you" : "be held and the agent would read"}: "${steerReason(deliveryVerdict, { canApprove: judge !== undefined })}"`);
                         }
                     }
                     return;