pi-warden 0.28.4 → 0.35.0

package/dist/conscience-policy.js

@@ -0,0 +1,28 @@
+import { createHash } from "node:crypto";
+export const SCORE_LEVELS = [
+    "No useful contribution to the current request, or conflicts with the supplied constraints.",
+    "Related to the subject, but already covered, premature, or unable to resolve the current need.",
+    "Addresses a concrete unmet need at the current step without displacing the active workflow.",
+    "Supplies a missing prerequisite or directly applicable documented method needed for the current step.",
+];
+export const SCORE_INSTRUCTIONS = "Assess next-step usefulness of the named candidate against task, recent context, observations, supplied capabilities and constraints. A supplied workflow must not be replaced; another skill must support a new unmet need. Conversation methods may be useful before asking the user a question. An appropriate ordinary tool does not exclude a complementary skill.";
+export const DISPOSITION = {
+    type: "choice",
+    instructions: "What is the current task disposition? An initial thinking request is not awaiting_user merely because clarification will be needed: its conversation method is an available next step. Awaiting_user requires an actual unanswered question from the assistant.",
+    criteria: {
+        advance: "A useful next step can be taken now.",
+        awaiting_user: "The assistant has already asked for information and must wait for the user.",
+        no_gap: "The request is satisfied with no useful missing step.",
+        unclear: "There is insufficient evidence to identify a useful next step.",
+    },
+};
+export const CONSCIENCE_MODEL = "jev-1.13";
+export const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+export const QUESTION_POLICY_HASH = digest({ levels: SCORE_LEVELS, instructions: SCORE_INSTRUCTIONS, disposition: DISPOSITION, stateVersion: 1 });
+// No shipping threshold exists until the frozen holdout and follow-through gates pass.
+export const measuredPolicy = undefined;
+export function validPolicy(policy, model) {
+    return !!policy && policy.questionHash === QUESTION_POLICY_HASH && policy.model === model && !!policy.evidence
+        && Number.isFinite(policy.recommendation) && policy.recommendation >= 0.5 && policy.recommendation <= 0.95
+        && Number.isFinite(policy.loading) && policy.loading >= policy.recommendation && policy.loading <= 0.95;
+}

package/dist/conscience-privacy.d.ts

@@ -0,0 +1,4 @@
+/** URLs are not local paths; protect them before scanning free text for filesystem spans. */
+export declare function safeConscienceText(text: string, disclosed?: string): string;
+export declare const safeCapabilityName: (name: string) => boolean;
+export declare const excludedCapability: (name: string, patterns: readonly string[]) => boolean;

package/dist/conscience-privacy.js

@@ -0,0 +1,11 @@
+import { redact } from "./redact.js";
+/** URLs are not local paths; protect them before scanning free text for filesystem spans. */
+export function safeConscienceText(text, disclosed = "") {
+    const urls = [];
+    const redacted = redact(text);
+    const masked = redacted.replace(/https?:\/\/[^\s<>"'`]+/gi, value => `\u0001${urls.push(value) - 1}\u0002`);
+    const clean = masked.replace(/(?:file:\/\/[^\s<>"'`]+|[A-Za-z]:[\\/][^\s<>"'`]+|\\\\[^\s<>"'`]+|~\/[^\s<>"'`]+|(?<![\w/:])\/(?:[^\s<>"'`]+))/g, path => disclosed.includes(path) ? path : "[local path]");
+    return clean.replace(/\u0001(\d+)\u0002/g, (_, index) => urls[Number(index)] ?? "[URL]");
+}
+export const safeCapabilityName = (name) => /^[A-Za-z0-9_.:\-]{1,128}$/.test(name) && redact(name) === name;
+export const excludedCapability = (name, patterns) => patterns.some(pattern => new RegExp(`^${pattern.split("*").map(part => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(name));

package/dist/discover.d.ts

@@ -0,0 +1,14 @@
+/** Directories to skip during source-file discovery. */
+export declare const SKIP_DIRS: Set<string>;
+export declare const SOURCE_RE: RegExp;
+/**
+ * Recursively walk `dir` and collect source-file paths (relative to `dir`).
+ * Skips directories in SKIP_DIRS and stops after `max` files.
+ */
+export declare function discoverSourceFiles(dir: string, max?: number): string[];
+/**
+ * Find project directories inside a workspace. A project is any directory
+ * containing a known manifest file. The workspace root itself counts if it
+ * has one.
+ */
+export declare function findProjects(cwd: string): string[];

package/dist/discover.js

@@ -0,0 +1,85 @@
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { redact } from "./redact.js";
+/** Directories to skip during source-file discovery. */
+export const SKIP_DIRS = new Set([
+    ".git", "node_modules", "dist", "build", ".next", ".output",
+    "coverage", ".cache", "__pycache__", ".pi-warden", "vendor",
+    ".turbo", ".vercel", ".netlify", ".svelte-kit",
+]);
+export const SOURCE_RE = /\.(ts|tsx|js|jsx|rs|py|go|vue|svelte|rb|php|java|kt|swift|cs|cpp|c|h)$/;
+/**
+ * Recursively walk `dir` and collect source-file paths (relative to `dir`).
+ * Skips directories in SKIP_DIRS and stops after `max` files.
+ */
+export function discoverSourceFiles(dir, max = 200) {
+    const files = [];
+    function walk(current) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch (err) {
+            console.warn(`audit: could not list ${redact(current)}: ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        for (const entry of entries) {
+            if (files.length >= max)
+                return;
+            if (entry.name.startsWith(".") && entry.name !== ".")
+                continue;
+            const fullPath = join(current, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                walk(fullPath);
+            }
+            else if (entry.isFile() && SOURCE_RE.test(entry.name)) {
+                files.push(fullPath.slice(dir.length + 1)); // relative path
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+/**
+ * Find project directories inside a workspace. A project is any directory
+ * containing a known manifest file. The workspace root itself counts if it
+ * has one.
+ */
+export function findProjects(cwd) {
+    const projects = [];
+    const manifests = ["package.json", "Cargo.toml", "pyproject.toml", "go.mod"];
+    for (const m of manifests) {
+        if (existsSync(join(cwd, m))) {
+            projects.push(cwd);
+            break;
+        }
+    }
+    let entries;
+    try {
+        entries = readdirSync(cwd);
+    }
+    catch (err) {
+        console.warn(`audit: could not read workspace ${redact(cwd)}: ${err instanceof Error ? err.message : err}`);
+        return projects;
+    }
+    for (const entry of entries) {
+        if (entry === "node_modules" || entry.startsWith("."))
+            continue;
+        const sub = join(cwd, entry);
+        try {
+            if (!existsSync(join(sub, "package.json")) && !existsSync(join(sub, "Cargo.toml")) && !existsSync(join(sub, "pyproject.toml")) && !existsSync(join(sub, "go.mod")))
+                continue;
+        }
+        catch (err) {
+            console.warn(`audit: could not check ${redact(sub)}: ${err instanceof Error ? err.message : err}`);
+            continue;
+        }
+        if (!projects.includes(sub))
+            projects.push(sub);
+    }
+    return projects;
+}

package/dist/extension.d.ts

@@ -2,7 +2,7 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, reason) for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request, including calls where the rules guard is disabled; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /** Which guard spent the user's attention. The status line reports one count per guard. */
 export type SteerGuard = "action" | "rules" | "security" | "stuck" | "done" | "prose" | "runaway" | "subagent";
 /**