pi-warden 0.28.4 → 0.35.0

package/dist/extension.js

@@ -1,4 +1,6 @@
+import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
+import { join } from "node:path";
 import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
@@ -9,25 +11,28 @@ import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { evaluateAction, formatVerdict, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
-import { initSchema, recordHold, recordOutcome, toHoldRecord, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
+import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
 import { evaluateProse, proseNudge, ProseTrend, RESTATE_MIN_SENTENCES, RESTATE_SHARE, RestatementWindow, substantiveSentences } from "./prose.js";
 import { compressOutput, duplicateNote, evaluateOutput, mergeOutput, outputKey, saveOutput, securityNotice, CompressionLearner } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
 import { redact } from "./redact.js";
 import { formatRules, pathNoteSteer, RulesGuard, rulesSteer } from "./rules.js";
+import { checkPiWardenMissing } from "./rules-file.js";
+import { writeStarterRules, buildInitPrompt } from "./init.js";
+import { buildAuditPrompt, findProjects, snapshotReport, reportOutcome } from "./audit.js";
 import { detectNotifier, sendNotification } from "./notify.js";
 import { formatRunaway, RunawayMonitor, runawayNudge } from "./runaway.js";
-import { AttemptWindow, evaluateStuck, formatStuck, makeAttempt, resultFailed, stuckNudge } from "./stuck.js";
+import { AttemptWindow, evaluateStuck, formatStuck, makeAttempt, resultFailed, stuckDiff, stuckNudge } from "./stuck.js";
 import { openConfigPanel, openTracePanel } from "./panel.js";
 import { completeConfig, shapeWarning } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
-import { DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, reason) for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request, including calls where the rules guard is disabled; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
 const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
@@ -126,6 +131,28 @@ function activeMode(config, hasUI) {
     const mode = isMode(env) ? env : config.mode;
     return mode === "confirm" && !hasUI ? "steer" : mode;
 }
+/** Keep diagnostics intact while removing structured trace-only items at the agent boundary. */
+function agentDeliveryReasons(verdict) {
+    const indexes = [
+        verdict.offTaskTraceOnly ? verdict.offTaskTraceOnlyReasonIndex : undefined,
+        verdict.shouldProceedTraceOnly ? verdict.shouldProceedTraceOnlyReasonIndex : undefined,
+    ].filter((index) => index !== undefined && index >= 0 && index < verdict.reasons.length);
+    if (!indexes.length)
+        return verdict.reasons;
+    return verdict.reasons.filter((_reason, reasonIndex) => !indexes.includes(reasonIndex));
+}
+/** Keep the full judgment while suppressing trace-only reasons and steer flags. */
+function agentDeliveryVerdict(verdict) {
+    const reasons = agentDeliveryReasons(verdict);
+    if (reasons === verdict.reasons)
+        return verdict;
+    const deliveryVerdict = { ...verdict, reasons };
+    if (verdict.offTaskTraceOnly)
+        delete deliveryVerdict.offTaskSteer;
+    if (verdict.shouldProceedTraceOnly)
+        delete deliveryVerdict.shouldProceedSteer;
+    return deliveryVerdict;
+}
 function clip(text) {
     return text.length <= CONFIRM_TEXT_LIMIT ? text : `${text.slice(0, CONFIRM_TEXT_LIMIT)}…`;
 }
@@ -202,7 +229,7 @@ export default function wardenExtension(pi) {
     const rulesGuard = new RulesGuard();
     // Hold feedback: what the user did after each judged call, the trace entry each label lands on, and the per-session log.
     const holds = new HoldLedger();
-    const learningIds = new Map(); // holds.id -> learning.id
+    const learningIds = new Map(); // holds.id -> promise of learning.id
     // Prune learningIds when it grows large to prevent memory leaks
     function pruneLearningIds() {
         if (learningIds.size > 1000) {
@@ -223,9 +250,16 @@ export default function wardenExtension(pi) {
     // Allowed calls of the turn the user just replied to; the regret question about them rides the next action request.
     let regretCandidates = [];
     let attempts = new AttemptWindow(defaultConfig().stuck.window);
+    /** Full output text and saved path keyed by attempt call key, for stuck-loop diffs. */
+    let fullOutputs = new Map();
     let evidence = emptyEvidence();
     let doneNudged = false;
     let warnedFallback = false;
+    let warnedMissingRules = false;
+    /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
+    let initRunning = false;
+    /** True while /warden audit is sending a prompt and waiting for the agent to write the report. */
+    let auditRunning = false;
     const prose = new ProseTrend();
     const slopCounts = { stub: 0, comments: 0, dead: 0, hedging: 0 };
     const ledger = new ContextLedger();
@@ -343,7 +377,20 @@ export default function wardenExtension(pi) {
                     const color = LEVEL_COLOR[chip ?? ""] ?? "text";
                     const chipText = chip ? `${theme.bold(theme.fg(color, chip.toUpperCase()))}  ` : "";
                     const guardText = theme.fg("muted", lastEntry.guard + " ");
-                    const body = { render: (width) => [chipText + guardText + sentence], invalidate: () => { } };
+                    // Like widgetLines: the head width is tracked, the body wraps to what remains, and a line wider than
+                    // the pane trips pi's render-width guard, which aborts the session.
+                    const chipWidth = chip ? chip.length + 2 : 0;
+                    const headWidth = chipWidth + lastEntry.guard.length + 1;
+                    const head = chipText + guardText;
+                    const body = {
+                        render: (width) => {
+                            if (!width)
+                                return [head + sentence];
+                            const wrapped = tuiModule.wrapTextWithAnsi(sentence, Math.max(10, width - headWidth));
+                            return [head + (wrapped[0] ?? ""), ...wrapped.slice(1).map(rest => " ".repeat(headWidth) + rest)];
+                        },
+                        invalidate: () => { },
+                    };
                     return MouseRegion ? new MouseRegion(body, event => {
                         if (event.type !== "click" || event.button !== "left")
                             return undefined;
@@ -353,7 +400,7 @@ export default function wardenExtension(pi) {
                 }, { placement: config.widget.placement });
                 return;
             }
-            entries = [entries.at(-1)];
+            entries = [lastEntry ?? entries.at(-1)];
         }
         // A custom component so the lines wrap to the pane and a click (fullscreen mode) opens the trace panel.
         // When the host TUI lacks MouseRegion (e.g. omp 18.2.5), the extension still loads — the widget
@@ -370,6 +417,7 @@ export default function wardenExtension(pi) {
         }, { placement: config.widget.placement });
     };
     const record = (ctx, config, guard, line, details, tokens) => {
+        widget.delete(guard);
         widget.set(guard, line);
         const entry = { at: Date.now(), guard, line, details, tokens };
         trace.push(entry);
@@ -382,6 +430,10 @@ export default function wardenExtension(pi) {
             const entry = traceOf.get(item);
             if (entry)
                 trace.amend(entry, outcomeNote(item));
+            const idPromise = learningIds.get(item.id);
+            if (idPromise && item.outcome !== "pending") {
+                idPromise.then(id => recordOutcome(id, item.outcome)).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
+            }
         }
         if (config.action.feedbackLog && holds.records().length)
             void holdLog?.save(holds.records());
@@ -484,6 +536,8 @@ export default function wardenExtension(pi) {
         client = undefined;
         budgetExhausted = false;
         warnedFallback = false;
+        warnedMissingRules = false;
+        initRunning = false;
         await initSchema(loadConfig().learning.retentionDays);
         stats = freshStats();
         widget.clear();
@@ -543,6 +597,7 @@ export default function wardenExtension(pi) {
             lastUi = ctx.ui;
         const config = configFor(ctx);
         attempts = new AttemptWindow(config.stuck.window);
+        fullOutputs = new Map();
         doneNudged = false;
         steersThisRun = 0;
         finals.reset();
@@ -614,6 +669,17 @@ export default function wardenExtension(pi) {
         if (!config.action.enabled || !config.action.tools.includes(event.toolName))
             return;
         stats.inspected++;
+        // First-run warning: pi-warden.md missing, one time per session.
+        if (!warnedMissingRules && config.rules.enabled) {
+            const { missing, fallbackSource } = checkPiWardenMissing(ctx.cwd);
+            if (missing && ctx.hasUI) {
+                warnedMissingRules = true;
+                const msg = fallbackSource
+                    ? `No pi-warden.md detected. Using ${fallbackSource} as active fallback rules. Run /warden init to create project-specific rules.`
+                    : `No rules file detected (pi-warden.md, README.md, CLAUDE.md, or AGENTS.md). Run /warden init to create project-specific rules.`;
+                ctx.ui.notify(msg, "warning");
+            }
+        }
         // Arming: a write/edit to a protected path arms matching command patterns for a window. Bash redirect/tee
         // targets that match a when.edited glob also arm. This is session state, not a per-call verdict — it runs
         // before the action guard so the armed check on a later command sees the preparation.
@@ -683,6 +749,8 @@ export default function wardenExtension(pi) {
             if (verdict.source === "read-only")
                 verdict.source = "pattern";
         }
+        const deliveryVerdict = agentDeliveryVerdict(verdict);
+        const deliveryReasons = deliveryVerdict.reasons;
         if (regretCandidates.length && verdict.judgment?.regretted !== undefined) {
             settleRegret(config, { regretted: regretsAt(verdict.judgment.regretted), target: verdict.judgment.regretTarget, probability: verdict.judgment.regretted, via: "jev" });
         }
@@ -704,12 +772,9 @@ export default function wardenExtension(pi) {
             const released = holds.approved(event.toolName);
             if (released) {
                 noteOutcomes(config, [released]);
-                const learningId = learningIds.get(released.id);
-                if (learningId)
-                    recordOutcome(learningId, "approved").catch(err => console.warn("pi-warden: recordOutcome failed:", err));
             }
         }
-        const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
+        const told = verdict.level === "confirm" && mode === "steer" ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined;
         // SAFETY: verdict.source is a string union; the read-only → pattern rewrite above may have narrowed it in TS's view,
         // but the field is still one of the source values at runtime when no armed hits fired.
         const actionFmt = formatVerdictTokens(verdict, config.widget.action);
@@ -727,19 +792,17 @@ export default function wardenExtension(pi) {
             if (ctxSummary)
                 recordOpts.contextSummary = ctxSummary;
             if (held)
-                recordOpts.agentReason = steerReason(verdict, { canApprove: judge !== undefined });
+                recordOpts.agentReason = steerReason(deliveryVerdict, { canApprove: judge !== undefined });
             const item = holds.record(verdict, recordOpts);
             traceOf.set(item, entry);
+            // Record to SQLite for learning (held and judged-allowed calls).
+            // The promise and map entry must exist before noteOutcomes so that an outcome
+            // known at record time (e.g. dialog-approved) is not lost to the race.
+            const preview = redact(verdict.summary.command ?? verdict.summary.path ?? "");
+            const holdPromise = recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores, held }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: held ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined, preview })).catch(err => { console.warn("pi-warden: recordHold failed:", err); return -1; });
+            learningIds.set(item.id, holdPromise);
+            pruneLearningIds();
             noteOutcomes(config, outcome ? [item] : []);
-            // Record to SQLite for learning
-            if (held) {
-                recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: steerReason(verdict, { canApprove: judge !== undefined }) })).then(id => {
-                    learningIds.set(item.id, id);
-                    if (outcome)
-                        recordOutcome(id, outcome).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
-                }).catch(err => console.warn("pi-warden: recordHold failed:", err));
-                pruneLearningIds();
-            }
         };
         // The warn notice below names the mismatch to the user; the agent gets the steer with the other notes.
         if (verdict.intentMismatch) {
@@ -749,8 +812,14 @@ export default function wardenExtension(pi) {
         }
         if (verdict.offTaskSteer) {
             stats.offTask++;
+            if (!verdict.offTaskTraceOnly) {
+                noteGuards.add("action");
+                notes.push(offTaskSteer(verdict));
+            }
+        }
+        if (verdict.shouldProceedSteer && !verdict.shouldProceedTraceOnly) {
             noteGuards.add("action");
-            notes.push(offTaskSteer(verdict));
+            notes.push(shouldProceedMessage(verdict));
         }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
@@ -800,13 +869,15 @@ export default function wardenExtension(pi) {
                 traceNote(delivered);
             pathNoteTraces.length = 0;
         }
-        const warnSteer = (label) => steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${label}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
+        const warnSteer = (reasons) => reasons.length > 0 && steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
         if (verdict.level === "warn") {
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
-            else if (!ctx.hasUI)
-                warnSteer(verdict.reasons.join("; "));
+            else if (!ctx.hasUI) {
+                const otherReasons = deliveryReasons.filter(r => !r.startsWith("should-proceed "));
+                warnSteer(otherReasons);
+            }
             track(false);
             return undefined;
         }
@@ -816,13 +887,14 @@ export default function wardenExtension(pi) {
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · blocked ${event.toolName}: ${verdict.reasons.join("; ")}`, "error");
             notifyDesktop(ctx, config, `Blocked ${event.toolName}: ${verdict.reasons.join("; ")}. A deny rule matched; the call never ran.`);
-            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${verdict.reasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
+            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
             track(false);
             return undefined;
         }
         const reasons = verdict.reasons.join("; ");
+        const deliveredReasons = deliveryReasons.join("; ");
         // A user-defined confirm rule prompts the user in every mode, advise included: the operator wrote the rule to be
         // asked. Advise mode keeps Jev holds advisory; it does not soften a prompt the operator asked for by name.
         // The action defaults to dialog at parse time (the reason one writes such a rule); hold restores steer semantics.
@@ -836,14 +908,14 @@ export default function wardenExtension(pi) {
             }
             stats.held++;
             track(true, "declined", "dialog");
-            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
+            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         if (mode === "advise") {
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
             else if (!ctx.hasUI)
-                warnSteer(reasons);
+                warnSteer(deliveryReasons);
             track(false);
             return undefined;
         }
@@ -856,7 +928,7 @@ export default function wardenExtension(pi) {
             }
             stats.held++;
             track(true, "declined", "dialog");
-            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
+            return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         stats.held++;
         actionGuard.hold(task);
@@ -864,7 +936,7 @@ export default function wardenExtension(pi) {
         if (ctx.hasUI && config.notices)
             ctx.ui.notify(`warden · held ${event.toolName}: ${reasons}. The agent was told why and asked to re-plan or ask you.`, "warning");
         notifyDesktop(ctx, config, `Held ${event.toolName}: ${reasons}. The agent will re-plan or ask you in chat.`);
-        return { block: true, reason: told ?? steerReason(verdict, { canApprove: judge !== undefined }) };
+        return { block: true, reason: told ?? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) };
     });
     pi.on("tool_result", async (event, ctx) => {
         const config = configFor(ctx);
@@ -1060,11 +1132,53 @@ export default function wardenExtension(pi) {
                 `output sample: ${redact(text).slice(0, 300)}`, delivered ? `agent told: ${notice}` : `steer recorded, not delivered (a repeat or the per-run budget): ${notice}`,
             ]);
         }
+        // Stuck-loop diff: when the verdict is stuck on a failed result and a previous failed output
+        // for the same call is available, replace the tool result with a short diff note. Compute
+        // bytesSaved against the current content (after duplicate detection and compression), so the
+        // diff never grows the result.
+        const verdict = await stuckCheck;
+        if (verdict && verdict.stuck && failed && !verdict.successRepeat && !verdict.churn && text.length > 0) {
+            const currentKey = attempts.attempts.at(-1)?.key;
+            const prevEntry = currentKey ? fullOutputs.get(currentKey) : undefined;
+            if (currentKey && prevEntry && prevEntry.text !== text) {
+                // Differing outputs: save the current output and diff against the previous one.
+                try {
+                    const saved = await saveOutput(text);
+                    const diffNote = stuckDiff(prevEntry.text, text, { diffLimit: config.stuck.diffLimit, tailLimit: config.stuck.tailLimit, fullPath: saved });
+                    const currentLen = Buffer.byteLength(content.map(part => part.type === "text" ? part.text : "").join("\n"));
+                    if (Buffer.byteLength(diffNote) < currentLen) {
+                        content = [{ type: "text", text: diffNote }, ...content.filter(part => part.type !== "text")];
+                    }
+                    fullOutputs.set(currentKey, { text, path: saved });
+                }
+                catch {
+                    noteError(ctx, "Could not store full output for stuck diff; keeping it unchanged.", undefined);
+                    fullOutputs.set(currentKey, { text });
+                }
+            }
+            else if (currentKey && prevEntry && prevEntry.text === text && prevEntry.path) {
+                // Byte-identical outputs: one-line note reusing the existing saved path.
+                const diffNote = stuckDiff(text, text, { diffLimit: config.stuck.diffLimit, tailLimit: config.stuck.tailLimit, fullPath: prevEntry.path });
+                const currentLen = Buffer.byteLength(content.map(part => part.type === "text" ? part.text : "").join("\n"));
+                if (Buffer.byteLength(diffNote) < currentLen) {
+                    content = [{ type: "text", text: diffNote }, ...content.filter(part => part.type !== "text")];
+                }
+            }
+            else if (currentKey) {
+                // First failed output for this call, or no previous entry yet: store for future diffs.
+                fullOutputs.set(currentKey, { text });
+            }
+        }
+        else if (failed && text.length > 0) {
+            // Not stuck (or no verdict yet): store the output so a future repeat can diff against it.
+            const currentKey = attempts.attempts.at(-1)?.key;
+            if (currentKey)
+                fullOutputs.set(currentKey, { text });
+        }
         const patch = content === event.content ? undefined : { content };
         // Checks use the original result, not the excerpts or security banner.
         if (config.done.enabled)
             recordDoneOutcome(evidence, classifyToolResult(event.toolName, event.input, failed, text), event.input, event.toolName);
-        const verdict = await stuckCheck;
         if (!verdict)
             return patch;
         if (verdict.error)
@@ -1077,7 +1191,7 @@ export default function wardenExtension(pi) {
             return patch;
         stats.stuck++;
         if (ctx.hasUI && config.notices)
-            ctx.ui.notify(`warden · stuck: ${verdict.reasons.join("; ")}${nudge ? " (agent nudged)" : ""}`, "warning");
+            ctx.ui.notify(`warden \u00b7 stuck: ${verdict.reasons.join("; ")}${nudge ? " (agent nudged)" : ""}`, "warning");
         if (nudge)
             steer(config, "stuck", nudge);
         return patch;
@@ -1086,6 +1200,17 @@ export default function wardenExtension(pi) {
     pi.on("agent_settled", async (_event, ctx) => {
         await checkSubagentReports(ctx, configFor(ctx));
     });
+    // Block new user messages while /warden init or /warden audit is running.
+    pi.on("input", async (event, ctx) => {
+        if (initRunning) {
+            ctx.ui.notify("pi-warden is generating rules. Please wait...", "warning");
+            return { action: "handled" };
+        }
+        if (auditRunning) {
+            ctx.ui.notify("pi-warden is running an audit. Please wait...", "warning");
+            return { action: "handled" };
+        }
+    });
     pi.on("agent_end", async (event, ctx) => {
         const config = configFor(ctx);
         if (!config.enabled)
@@ -1182,7 +1307,7 @@ export default function wardenExtension(pi) {
                 togglePanel(ctx.ui, configFor(ctx)); },
         });
     }
-    const actions = ["status", "enable", "disable", "mode", "config", "test", "trace"];
+    const actions = ["status", "enable", "disable", "mode", "config", "test", "trace", "init", "audit"];
     pi.registerCommand("warden", {
         description: "pi-warden status, config (set/get/editor), TypeSafe consent, mode, trace panel, recommend, and a synthetic guard test",
         getArgumentCompletions(prefix) {
@@ -1204,6 +1329,10 @@ export default function wardenExtension(pi) {
                     const source = consentSource(config);
                     const usage = client?.getUsage();
                     const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.rules.enabled && "rules", config.context.enabled && "context", config.runaway.enabled && "runaway", config.subagent.enabled && "subagent triage", config.notify.enabled && "desktop notifications"].filter(Boolean).join(", ");
+                    const ls = await holdStats(ctx.cwd);
+                    const lifetimeLine = ls.labeled === 0
+                        ? `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, not yet measurable (${ls.allowed} allowed).`
+                        : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
                         `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
@@ -1212,6 +1341,7 @@ export default function wardenExtension(pi) {
                         formatLedger(ledger.snapshot()),
                         ...(config.learning.patternAnalysis ? [`Learning: ${(await generateRecommendations(ctx.cwd)).length} recommendations, steer effectiveness ${Math.round((await analyzeSteerEffectivenessReport(ctx.cwd)).overall * 100)}% (use /warden recommend for details)`] : []),
                         `${formatHolds(holds.snapshot(), config.action.feedbackLog ? holdLog?.path : undefined)}${holdLog?.lastFailure ? ` Log write failed: ${holdLog.lastFailure}.` : ""}`,
+                        lifetimeLine,
                         `Rules: ${config.rules.enabled ? `${rulesGuard.describe(ctx.cwd, config.rules)}${Object.keys(config.rules.sensitivePaths).length ? `; ${Object.keys(config.rules.sensitivePaths).length} sensitive path${Object.keys(config.rules.sensitivePaths).length === 1 ? "" : "s"}` : ""}` : "off"}.`,
                         ...(config.action.armingRules.length > 0 ? [`Arming: ${arming.statusLine() || "no rules armed"}.`] : []),
                         `Desktop notifications: ${config.notify.enabled ? `on (${config.notify.command.length ? `command ${config.notify.command[0]}` : (await (notifier ??= detectNotifier())) ?? "no notifier found on this machine"}; cooldown ${config.notify.cooldownMs} ms)` : "off (\"notify\": { \"enabled\": true } in the config turns them on)"}.`,
@@ -1339,14 +1469,107 @@ export default function wardenExtension(pi) {
                     openConfigPanel(lastUi, config, { width: config.widget.panelWidth });
                     return;
                 }
+                if (action === "init") {
+                    const targetPath = join(ctx.cwd, "pi-warden.md");
+                    const force = argument === "--force";
+                    if (existsSync(targetPath)) {
+                        if (ctx.hasUI && !force) {
+                            if (!await ctx.ui.confirm("pi-warden.md already exists. Overwrite with a fresh starter template?", `This replaces ${targetPath} with a generic starter. Your current rules will be lost.`)) {
+                                report("Cancelled. Existing pi-warden.md unchanged.");
+                                return;
+                            }
+                        }
+                        else if (!force) {
+                            report(`pi-warden.md already exists at ${targetPath}. Pass --force to overwrite.`, "warning");
+                            return;
+                        }
+                    }
+                    const prompt = buildInitPrompt(ctx.cwd);
+                    initRunning = true;
+                    if (ctx.hasUI)
+                        ctx.ui.notify("pi-warden: Generating rules file...", "info");
+                    try {
+                        // sendUserMessage throws when the agent is not idle. Brief wait so a
+                        // just-closing confirm dialog does not cause a race.
+                        for (let attempt = 0; attempt < 40; attempt++) {
+                            if (ctx.isIdle())
+                                break;
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                        }
+                        pi.sendUserMessage(prompt);
+                        await ctx.waitForIdle();
+                    }
+                    catch (err) {
+                        const detail = err instanceof Error ? err.message : String(err);
+                        report(`pi-warden init failed: ${detail}. Try creating pi-warden.md manually.`, "error");
+                    }
+                    finally {
+                        initRunning = false;
+                    }
+                    const wardenExists = existsSync(join(ctx.cwd, "pi-warden.md"));
+                    report(wardenExists ? "pi-warden.md created. Review the rules and edit as needed." : "Agent did not create pi-warden.md. Create it manually or try /warden init again.");
+                    return;
+                }
+                if (action === "audit") {
+                    if (!ctx.hasUI) {
+                        report("Audit needs an interactive session to run.", "warning");
+                        return;
+                    }
+                    if (!await ctx.ui.confirm("Run workspace audit?", `This runs an agent-driven audit of ${redact(ctx.cwd)}. It uses the session model, reads source code, and writes a report. It may take several minutes and use real tokens. Measured comparisons need the agent's TypeSafe tool, which is enabled per session with \`/typesafe enable\`; without it findings will be marked unmeasured.`))
+                        return;
+                    const projects = findProjects(ctx.cwd);
+                    const prompt = buildAuditPrompt(ctx.cwd, projects);
+                    const reportPath = join(ctx.cwd, ".pi-warden", "audit-report.html");
+                    const preSnapshot = snapshotReport(reportPath);
+                    auditRunning = true;
+                    if (ctx.hasUI)
+                        ctx.ui.notify("pi-warden: Running workspace audit...", "info");
+                    try {
+                        for (let attempt = 0; attempt < 40; attempt++) {
+                            if (ctx.isIdle())
+                                break;
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                        }
+                        pi.sendUserMessage(prompt);
+                        await ctx.waitForIdle();
+                    }
+                    catch (err) {
+                        const detail = err instanceof Error ? err.message : String(err);
+                        report(`pi-warden audit failed: ${detail}.`, "error");
+                    }
+                    finally {
+                        auditRunning = false;
+                    }
+                    const outcome = reportOutcome(preSnapshot, snapshotReport(reportPath));
+                    switch (outcome) {
+                        case "written":
+                            report(`Audit report written to ${reportPath}`);
+                            break;
+                        case "stale":
+                            report("Audit finished but the report file was not updated — the agent may have reported findings in chat instead.");
+                            break;
+                        case "missing":
+                            report("Agent did not write an audit report. The model may have reported findings in chat instead.");
+                            break;
+                    }
+                    return;
+                }
                 if (action === "test") {
                     const judge = judgeFor(config);
-                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Clean up the demo directory") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
+                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Prepare the demo environment") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
                         return;
-                    const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Clean up the demo directory" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge });
+                    const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Prepare the demo environment" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge });
+                    const deliveryVerdict = ctx.hasUI ? verdict : agentDeliveryVerdict(verdict);
+                    const deliveryReasons = deliveryVerdict.reasons;
                     const fmt = formatVerdictTokens(verdict, config.widget.action);
                     record(ctx, config, "action", fmt.line, actionDetails(verdict, { mode: activeMode(config, ctx.hasUI) }), fmt.tokens);
-                    report(`${formatVerdict(verdict)}${verdict.reasons.length ? ` — ${verdict.reasons.join("; ")}` : ""}${judge ? "" : " (pattern checks only: TypeSafe judgments are not enabled or no key is configured)"}${verdict.error ? ` — ${verdict.error}` : ""}`);
+                    const deliveryTokens = actionTokens(deliveryVerdict);
+                    if (!ctx.hasUI && verdict.offTaskTraceOnly) {
+                        // Redact only off-task presentation tokens; retain the judgment for other consumers.
+                        delete deliveryTokens.offTask;
+                        delete deliveryTokens.scope;
+                    }
+                    report(`${renderTemplate(DEFAULT_TEMPLATES.action, deliveryTokens)}${deliveryReasons.length ? ` — ${deliveryReasons.join("; ")}` : ""}${judge ? "" : " (pattern checks only: TypeSafe judgments are not enabled or no key is configured)"}${verdict.error ? ` — ${verdict.error}` : ""}`);
                     if (verdict.level === "confirm") {
                         const mode = activeMode(config, ctx.hasUI);
                         if (mode === "confirm" && ctx.hasUI) {
@@ -1354,7 +1577,7 @@ export default function wardenExtension(pi) {
                             report(allowed ? "Demo: you chose Yes, so a real call would have run." : "Demo: you chose No, so a real call would have been blocked and the agent told why.");
                         }
                         else {
-                            report(`In ${mode} mode a real call would ${mode === "advise" ? "run with this warning shown to you" : "be held and the agent would read"}: "${steerReason(verdict, { canApprove: judge !== undefined })}"`);
+                            report(`In ${mode} mode a real call would ${mode === "advise" ? "run with this warning shown to you" : "be held and the agent would read"}: "${steerReason(deliveryVerdict, { canApprove: judge !== undefined })}"`);
                         }
                     }
                     return;