pi-warden 0.3.0 → 0.5.0

package/README.md

@@ -8,15 +8,15 @@ The verdicts above are real output from `npm run test:live`. Independent project
 
 ## Philosophy
 
-pi-warden is a harness for the agent, not a gate for the user. It watches every tool call, tool result, and reply, asks Jev small typed questions about them, and acts through the agent's own context — a held call, a steer message, a compressed output — rather than through dialogs. Jev decides; code applies the decision; the LLM is never asked to judge itself. Everything warden does is visible in the trace panel, and nothing is rewritten in your session file.
+pi-warden is a harness for the agent, not a gate for the user. It watches every tool call, tool result, and reply, asks Jev small typed questions about them, and acts through the agent's own context — a held call, a steer message, a compressed output — rather than through dialogs. Jev decides; code applies the decision; the LLM is never asked to judge itself. Guard decisions are visible in the trace panel. Existing session entries are never rewritten; output warnings and excerpts are applied before a new tool result enters the session.
 
 Three jobs, in order of maturity:
 
 | Pillar | What it means | Status |
 | --- | --- | --- |
-| **Security** | Irreversible or off-task actions are held with a reason the agent can act on; credential files, force pushes, destructive SQL, and remote-script execution are caught offline; secrets are redacted before anything leaves the machine. Next: injected instructions inside tool output (web pages, issues, files) flagged and quarantined; insecure patterns in written code steered. | built · extending |
-| **Deslopify** | Stubs, placeholders, filler, and restating comments in written code earn a scored nudge; the agent fixes them on the next turn. Next: per-symptom scores instead of one quality number, and wordy or AI-flavoured replies scored against an audience setting. | built for code · prose planned |
-| **Context saving** | Jev judges which tool outputs are worth keeping; code compresses them. Only at moments that cannot cost a prompt-cache miss: when an output arrives (before it enters the cache), when the cache is measurably cold, or when Pi compacts anyway. Works alongside prompt-cache optimizers because it never touches the system prompt or a warm prefix. | planned |
+| **Security** | Action holds and offline patterns protect risky operations. Tool-output checks flag possible injected instructions and credential shapes; insecure written code gets a targeted steer. Output notices are advisory, not a sandbox or a guarantee that an attack is contained. | built |
+| **Deslopify** | Written code is scored per symptom — stubs, restating comments, dead code, hedging — and the agent gets a nudge naming the symptom and its fix; repeats become a standing rule. Replies are scored for wordiness, assistant clichés, and jargon against an `audience` setting, and a trend across replies shapes the next one. | built |
+| **Context saving** | Jev selects a retention policy for large new tool results; code keeps deterministic excerpts and an exact local copy. Only tail compression is implemented. Cold-cache pruning and compaction integration remain planned. The system prompt and existing history are untouched. | tail MVP |
 
 ## Why a coding agent needs this
 
@@ -26,7 +26,7 @@ Agents are good at picking the next command and bad at noticing when that comman
 - **Scope drift gets flagged.** Poems in a bugfix, refactors nobody asked for, dependency installs unrelated to the task: warned to you at 0.6, held at 0.85 when Jev also calls the action `unrelated`.
 - **Loops get broken.** Three failures with the same strategy (same command with cosmetic changes, same error after each edit) earn the agent a steer: re-read the error, form a new hypothesis, or report the blocker. Exact repeats are caught offline; Jev tells "investigating between failures" from "flailing" — 0.32 vs 0.93 in the smoke run.
 - **"Done" gets checked.** When the final message reports completion after file changes and no test, build, or lint passed in that run, the agent is asked to verify before you read a false "all green". A claim that tests passed when none ran is called out as such. Once per prompt, so it cannot loop.
-- **Slop gets a note.** Stub functions, `TODO: implement later`, mocks returning fake data, filler comments: scored on the same request as the action guard (zero extra latency) and steered back to the agent after the write, never held.
+- **Slop gets a name.** Written code is scored per symptom on the same request as the action guard (zero extra latency): stubs and fake-data mocks, comments that restate the code, dead or duplicated code, hedging notes. The agent is told which symptom and how to fix it, never held; the third repeat in a session becomes a standing rule. Replies are scored too — wordy, clichéd, or too technical for the configured audience — and a trend across replies earns a nudge that shapes the next one without spending a turn.
 - **Nothing slows down the boring calls.** Read-only shell lines are skipped without a request; anything else costs one request of ~600 input tokens.
 - **It degrades gracefully.** Offline pattern checks and exact-repeat detection run with no account at all. On an API timeout or outage the call is allowed with a warning (configurable), and reasons never include your command text or upstream error bodies.
 
@@ -68,18 +68,40 @@ Keeps the last 12 tool results for the current prompt. When the latest result fa
 
 Tracks each run's evidence: code changes (`write`, `edit`) and check commands (`npm test`, `pytest`, `cargo test`, `tsc`, `eslint`, `go test`, `make test`, and similar, whether run through `bash` or `ctx_execute`) with pass/fail; context-mode's inline `Command exited with code N` counts as a failure. When a run ends with a normal assistant message after code changes and no passing check, one Jev request judges the message: `claims_done`, `claims_verified`, `verification_applies` (Noul), `outcome` (Choice: complete / partial / blocked / other). A completion claim ≥ 0.7 that is not a blocker or question, for a task where checks would mean something (≥ 0.5; prose and file housekeeping score ~0.05), is reported as unverified; a verification claim with no check run is reported as a false claim. With `nudge: true` (default) the agent receives one follow-up turn asking it to run the checks or say plainly that nothing was verified — once per user prompt.
 
-### Slop (`write`/`edit`, same request as the action guard)
+### Slop in code (`write`/`edit`, same request as the action guard)
 
 pi-warden cannot rewrite code — Jev only judges — so slop is handled as a feedback loop through the agent:
 
-1. When the agent calls `write` or `edit`, two questions ride on the action guard's request (no extra latency): `slop_quality`, a Score over three described levels — *focused* (does what the task needs, comments only where they add information) / *some filler* (comments restating the code, minor dead code, hedging) / *sloppy* (stub or placeholder code, TODO where a working implementation is needed, duplicated or commented-out logic, vague text) — and `slop_placeholder`, a Noul: does the content leave placeholder, stub, mock, or "implement later" code where `task` needs a working implementation? Jev sees the first 1500 characters of a `write` or the first three replacement texts of an `edit`, plus your request, so "needed" is judged against what you asked for.
-2. Quality ≥ 1.5 or placeholder ≥ 0.7 (config `slop`) trips the note. Below that, nothing happens.
-3. The write **goes through** — holding it would leave a half-written file. Instead the agent receives a steer message before its next LLM call: *"pi-warden: the content just written to `src/x.ts` reads as quality 1.90/2 (filler or sloppy) and placeholder or stub code 0.92. Replace stubs and placeholders with working code, remove comments that restate the code, and keep only what the request needs. If something is intentionally left unimplemented, say so in your reply instead of leaving it in the code."* The agent fixes the file on its next turn; you see a notification and `slop 1.9/2 · stub 0.92` in the widget.
+1. When the agent calls `write` or `edit`, four Noul questions ride on the action guard's request (no extra latency), one per symptom, each with concrete yes/no criteria: `slop_stub` (placeholder, mock, or "implement later" code where `task` needs a working implementation), `slop_comments` (explanatory comments that restate what the adjacent code shows), `slop_dead` (commented-out code, unused imports or variables, duplicated logic, unreachable branches), `slop_hedging` ("should work", "for now", TODOs without a plan). Jev sees a head/middle/tail sample of a `write` (1500 characters) or the first three replacement texts of an `edit`, plus your request.
+2. Any symptom ≥ `slop.threshold` (0.7) trips the note. The write **goes through** — holding it would leave a half-written file.
+3. The agent receives a steer message naming the symptoms and their fixes, e.g. *"pi-warden: the content just written to `src/x.ts` has stub or placeholder code where a working implementation is needed; hedging or vague notes. Fix it in your next edit: replace stubs, placeholders, and hard-coded fake data with the working implementation, or state in your reply exactly what is left unimplemented and why; replace \"should work\", \"for now\", and TODOs without a plan with a definite statement or a concrete follow-up."* The third time a symptom appears in a session, the note says so and asks the agent to treat it as a standing rule.
 
-From the live smoke: a `// TODO: implement later` stub scored quality 2.00 / placeholder 0.99, a mock returning fake user data 2.00 / 0.98, a focused implementation 0.00 / 0.02, and a function with only restating comments 0.87 / 0.02 — deliberately below the threshold, because the guard is for stubs and filler that change behaviour, not for style. Not covered: code written through bash heredocs, content past the excerpt limits, and the agent's prose replies.
+Per-symptom scoring is what makes this precise. From the tuning set (`scripts/slop-cases.mjs`, 16 code cases): a `// TODO: implement later` stub scores stub 0.99; restating comments score comments 0.97 while an explanatory why-comment scores 0.08; commented-out code scores dead 0.96 and comments 0.43; a mock inside a *test file* scores stub 0.51 (below threshold, correctly); a stub explicitly outside the task scores 0.24. Not covered: code written through shell heredocs and content past the sample limits.
+
+### Slop in replies (`agent_end`)
+
+The run's final reply (≥ 200 characters) is judged against `slop.prose.audience`: `wordy` (preamble, restating the request, closing summary, filler), `cliches` ("Great question", "I hope this helps", "it's worth noting", unrequested caveat lists, emoji headings), `jargon` (unexplained terms for the audience). `audience` is `technical` (default), `plain`, or any free-text description such as *"a founder without programming background"*. One long answer to a long question is not punished: a symptom must appear in `trend` (2) of the last 3 replies before the agent is nudged, the nudge is queued for the next user prompt so it shapes the next reply without spending a turn, and two replies pass before the same nudge can fire again. From the tuning set: a padded reply scores wordy 0.97 / clichés 0.99; a dense three-point summary 0.25 / 0.05; the same status update scores jargon 0.94 for a plain audience and 0.24 for a developer.
+
+### Steer messages
+
+Nudges from the stuck, done, slop, and prose guards are custom messages in the agent's context. By default they are **hidden from the transcript** (`steerVisible: false`) so the conversation stays yours; the notification tells you a nudge happened and the trace panel shows the exact text. Set `steerVisible: true` to see them inline.
 
 If TypeSafe cannot answer (timeout after 5 s, outage, budget), an action-guard call is allowed with a warning (`failOpen: true`; set it to `false` to hold instead), and the other guards simply skip. When the per-session request budget is spent, pi-warden says so once and continues with offline checks. Consent in headless runs comes from `PI_WARDEN_ENABLED=1`; `PI_WARDEN_MODE` overrides the mode.
 
+### Tool-output security and tail compression
+
+With consent, content-bearing tools (`read`, fetch/search tools and named MCP equivalents) are checked for instructions that redirect the assistant or request private data. Other tools, including shell/context-mode tools, are checked from 2048 characters. Jev receives a redacted 6000-character head/tail sample, so attacks in an unsampled middle can be missed. A score at or above `security.threshold` adds an untrusted-data notice around the text and a hidden steer. Local credential-shape checks work without network access and warn not to echo or commit possible secrets. Images, result details, error flags, and usage are preserved.
+
+Written code gets a `security_risk` question in the existing action request: hardcoded credentials, disabled TLS checks, unsafe shell/SQL interpolation, broad permissions, or bypassed verification. A threshold crossing warns and steers; it does not authorize an action or automatically block otherwise safe edits.
+
+For a single text block of at least `context.tailMinChars`, the same output request asks Jev to choose `all`, `errors_and_summary`, or `summary_only`. The full result stays when P(keep all) exceeds `1 - context.confidence` (default: keep when Jev gives `all` more than 0.2), when the probability is missing, or on any request error. Code—not Jev—keeps bounded diagnostic/head/tail excerpts. An exact copy is written to an owner-only temporary directory before replacement; the excerpt links to it. If storage fails, the original stays. Multiple text blocks keep their layout and are not compressed. Trace and widget show the actual bytes saved. No extra steer is persisted for compression alone.
+
+This MVP is always tail-only: set `context.enabled: false` to stop compression. It never prunes a warm prefix, changes the system prompt, or edits historical session entries. Full-output files can contain secrets; they remain in the OS temporary directory until you or the OS remove them. Excerpts can omit relevant evidence; read the linked file before making a decision that needs it.
+
+### Task continuity
+
+The action guard receives the latest user message plus up to eight previous user/assistant text messages, limited to 750 redacted characters each. This keeps follow-ups and side comments from replacing the task. New user instructions override earlier ones; assistant text supplies context, not permission. Approval of a held action still uses only the latest user message. `unclear` scope alone no longer triggers an off-task warning; irreversible-action checks are unchanged. Long handoffs outside that bounded context can still require the user to restate the task.
+
 ## Commands
 
 | Command | Effect |
@@ -103,13 +125,16 @@ Templates in `config.widget` control the text. Segments are separated by ` · `;
   "enabled": true,
   "placement": "aboveEditor",
   "shortcut": "ctrl+shift+w",
-  "action": "warden · {tool} · irreversible {irreversible} · off-task {offTask} · {scope} · slop {slopQuality} · stub {slopStub} · patterns: {patterns} · {flags} · {level}",
+  "action": "warden · {tool} · irreversible {irreversible} · off-task {offTask} · {scope} · slop: {slop} · patterns: {patterns} · {flags} · {level}",
   "stuck": "warden · stuck · {failures} failures · same strategy {sameStrategy} · change {approachChange} · progress {progress} · {flags} · {status}",
-  "done": "warden · done-check · {changes} changes · {checksPassed}/{checks} checks passed · claims done {claimsDone} · claims verified {claimsVerified} · checks apply {checksApply} · {outcome} · {status}"
+  "done": "warden · done-check · {changes} changes · {checksPassed}/{checks} checks passed · claims done {claimsDone} · claims verified {claimsVerified} · checks apply {checksApply} · {outcome} · {status}",
+  "prose": "warden · prose · wordy {wordy} · clichés {cliches} · jargon {jargon} · {flags} · {status}",
+  "security": "warden · security · {tool} · injection {injection} · exfiltration {exfiltration} · {status}",
+  "context": "warden · context · {tool} · {retention} · saved {bytesSaved} bytes"
 }
 ```
 
-Tokens — action: `tool level source irreversible offTask scope approved slopQuality slopStub patterns reasons path model ms flags time`; stuck: `failures sameStrategy approachChange progress status source reasons model ms flags time`; done: `changes checks checksPassed claimsDone claimsVerified checksApply outcome status reasons model ms flags time`. A minimal line: `"action": "⚔ {tool} {level} · {irreversible}/{offTask}"`. Set `"enabled": false` to hide the line (the trace and panel keep working); `"shortcut": ""` disables the keybinding.
+Tokens — action: `tool level source irreversible offTask scope approved slop slopStub slopComments slopDead slopHedging patterns reasons path model ms flags time`; prose: `wordy cliches jargon status reasons model ms flags time`; stuck: `failures sameStrategy approachChange progress status source reasons model ms flags time`; done: `changes checks checksPassed claimsDone claimsVerified checksApply outcome status reasons model ms flags time`. Security tokens: `tool injection exfiltration status`; context tokens: `tool retention bytesSaved`. A minimal line: `"action": "⚔ {tool} {level} · {irreversible}/{offTask}"`. Set `"enabled": false` to hide the line (the trace and panel keep working); `"shortcut": ""` disables the keybinding.
 
 ## Configuration
 
@@ -131,8 +156,15 @@ User file `~/.pi/agent/pi-warden/config.json` (owner-only). Missing keys use the
   },
   "stuck": { "enabled": true, "window": 12, "minFailures": 3, "cooldown": 3, "sameStrategy": 0.7, "nudge": true },
   "done": { "enabled": true, "claimsDone": 0.7, "nudge": true },
-  "slop": { "enabled": true, "quality": 1.5, "placeholder": 0.7 },
-  "widget": { "enabled": true, "placement": "aboveEditor", "shortcut": "ctrl+shift+w" }
+  "security": { "enabled": true, "threshold": 0.7 },
+  "context": { "enabled": true, "tailMinChars": 12000, "confidence": 0.8 },
+  "slop": {
+    "enabled": true,
+    "threshold": 0.7,
+    "prose": { "enabled": true, "audience": "technical", "threshold": 0.7, "trend": 2, "minChars": 200 }
+  },
+  "widget": { "enabled": true, "placement": "aboveEditor", "shortcut": "ctrl+shift+w" },
+  "steerVisible": false
 }
 ```
 
@@ -140,11 +172,15 @@ A project may add `.pi/pi-warden.json` with `enabled` and per-guard overrides (f
 
 ## Data handling
 
-- With consent, each guarded call sends to `https://api.typesafe.ai`: your latest prompt (truncated to 1500 characters), the tool name, the command (truncated to 2000 characters) or the file path (relative inside the project, `~`-shortened outside), whether the file exists, a 1500-character content excerpt for `write`, and the first three edit pairs (400 characters each) for `edit`. The stuck detector sends the last 12 tool calls (300 characters each) with 400-character output tails; the done-check sends the agent's final message (2000 characters) and the run's check commands. No other files, history, or telemetry.
+- With consent, each guarded call sends to `https://api.typesafe.ai`: your latest prompt (truncated to 1500 characters), the tool name, the command (truncated to 2000 characters) or the file path (relative inside the project, `~`-shortened outside), whether the file exists, a 1500-character head/middle/tail sample for `write`, and the first three edit pairs (400 characters each) for `edit`. The stuck detector sends the last 12 tool calls (300 characters each) with 400-character output tails; the done-check and the prose check send the agent's final message (2000 and 2500 characters) with the run's check commands and the audience description. Scope and retention requests also carry up to eight prior user/assistant text messages (750 redacted characters each). Output checks send a redacted head/tail sample up to 6000 characters plus size and tool name. No unrelated files or telemetry.
 - Obvious credentials in the action (`Authorization` headers, `TOKEN=`/`SECRET=` assignments, `sk-`, `ghp_`, `AKIA`, JWTs, URL passwords, PEM blocks) are replaced with `[redacted]` before sending. This is best-effort; do not rely on it for prompts that contain secrets.
 - Text returned or steered to the agent names the tool, the reasons, and the scores, not the command text. UI errors never include upstream response bodies or keys.
 - Judgments are model output. Thresholds are yours to tune; a hold is information for the agent and for you, not a verdict on either.
 
+### After updating the package
+
+Run `/reload` in each existing Pi session after an update. If an existing session still reports `Cannot read properties of undefined (reading 'enabled')` while a fresh session works, restart that session to replace loaded modules. Version labels alone do not prove that all in-memory modules match the files on disk. Current config loading merges missing legacy fields with defaults; regression tests cover malformed and pre-prose config files. A persistent crash after restart needs its new stack trace and a redacted config example.
+
 ## For extension authors
 
 The guard is a plain function you can call from your own extension or tests, with any object that has pi-typesafe's `evaluate` method as the judge:
@@ -170,8 +206,10 @@ Also exported: `matchPatterns`, `isReadOnlyCommand`, `describeAction`, `redact`,
 ```bash
 npm install
 npm run check        # typecheck, offline tests (mocked transport), build
-npm run test:live    # 28 billable synthetic judgments across all guards (key from .env or the stored login); pass action|slop|approval|stuck|done for one group
+npm run test:live    # 43 billable synthetic judgments across all guards (key from .env or the stored login); pass action|slop|approval|stuck|done|security for one group
+node scripts/security-cases.mjs [context]   # the 12-case output-security, task-continuity, and retention set on its own
 npm run dev:pi       # start Pi with this working tree plus an installed pi-typesafe
+node scripts/slop-cases.mjs   # 22 billable cases that tune the slop and prose questions
 npm run preview      # re-render docs/preview.png from the recorded live verdicts (needs a Chrome binary)
 ```
 

package/dist/config.d.ts

@@ -36,12 +36,34 @@ export interface DoneGuardConfig {
     /** Also send the agent a follow-up asking it to verify. Triggers one more LLM turn. */
     nudge: boolean;
 }
+export interface ProseConfig {
+    enabled: boolean;
+    /** Who reads the agent's replies: "technical", "plain", or a free-text description. Drives the jargon question. */
+    audience: string;
+    /** P(symptom) at or above this counts as a hit. */
+    threshold: number;
+    /** A symptom must hit in this many of the last three replies before the agent is nudged. */
+    trend: number;
+    /** Replies with fewer characters are not judged. */
+    minChars: number;
+}
 export interface SlopGuardConfig {
     enabled: boolean;
-    /** Score (0 focused … 2 sloppy) at or above this warns. */
-    quality: number;
-    /** P(placeholder or stub code) at or above this warns. */
-    placeholder: number;
+    /** P(symptom) at or above this is reported for written code: stub, comments, dead, hedging. */
+    threshold: number;
+    prose: ProseConfig;
+}
+export interface SecurityConfig {
+    enabled: boolean;
+    /** P(injection or exfiltration) at or above this adds an untrusted-output notice. */
+    threshold: number;
+}
+export interface ContextConfig {
+    enabled: boolean;
+    /** Only new tool output is compressed; warm history and system prompts are never changed. */
+    tailMinChars: number;
+    /** Minimum P(the full output is not needed), 1 - P(all), before code removes output. */
+    confidence: number;
 }
 export type WardenMode = "steer" | "confirm" | "advise";
 export interface WardenConfig {
@@ -63,8 +85,12 @@ export interface WardenConfig {
     stuck: StuckGuardConfig;
     done: DoneGuardConfig;
     slop: SlopGuardConfig;
+    security: SecurityConfig;
+    context: ContextConfig;
     /** The status line above the editor and the trace panel. */
     widget: WidgetConfig;
+    /** Show steer messages in the transcript. They are always visible in the trace panel. */
+    steerVisible: boolean;
 }
 export declare const PACKAGE_NAME = "pi-warden";
 export declare const PROJECT_CONFIG_FILE = "pi-warden.json";

package/dist/config.js

@@ -22,8 +22,11 @@ export function defaultConfig() {
         },
         stuck: { enabled: true, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 0.7, nudge: true },
         done: { enabled: true, claimsDone: 0.7, nudge: true },
-        slop: { enabled: true, quality: 1.5, placeholder: 0.7 },
+        slop: { enabled: true, threshold: 0.7, prose: { enabled: true, audience: "technical", threshold: 0.7, trend: 2, minChars: 200 } },
+        security: { enabled: true, threshold: 0.7 },
+        context: { enabled: true, tailMinChars: 12000, confidence: 0.8 },
         widget: defaultWidgetConfig(),
+        steerVisible: false,
     };
 }
 /** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */
@@ -68,9 +71,6 @@ function positiveInteger(value, fallback) {
 export function isMode(value) {
     return value === "steer" || value === "confirm" || value === "advise";
 }
-function score(value, fallback) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 2 ? value : fallback;
-}
 function applyAction(base, raw, timeoutMs) {
     const withTimeout = { ...base, timeoutMs };
     if (!isObject(raw))
@@ -103,10 +103,22 @@ function applyDone(base, raw) {
         return base;
     return { enabled: boolean(raw.enabled, base.enabled), claimsDone: probability(raw.claimsDone, base.claimsDone), nudge: boolean(raw.nudge, base.nudge) };
 }
+function applyProse(base, raw) {
+    if (!isObject(raw))
+        return base;
+    return {
+        enabled: boolean(raw.enabled, base.enabled),
+        audience: typeof raw.audience === "string" && raw.audience.trim() ? raw.audience.trim() : base.audience,
+        threshold: probability(raw.threshold, base.threshold),
+        trend: Math.min(3, positiveInteger(raw.trend, base.trend)),
+        minChars: positiveInteger(raw.minChars, base.minChars),
+    };
+}
 function applySlop(base, raw) {
     if (!isObject(raw))
         return base;
-    return { enabled: boolean(raw.enabled, base.enabled), quality: score(raw.quality, base.quality), placeholder: probability(raw.placeholder, base.placeholder) };
+    // 0.2.x used `placeholder` for the stub threshold; it still sets the shared threshold.
+    return { enabled: boolean(raw.enabled, base.enabled), threshold: probability(raw.threshold ?? raw.placeholder, base.threshold), prose: applyProse(base.prose, raw.prose) };
 }
 function applyWidget(base, raw) {
     if (!isObject(raw))
@@ -119,6 +131,9 @@ function applyWidget(base, raw) {
         action: template(raw.action, base.action),
         stuck: template(raw.stuck, base.stuck),
         done: template(raw.done, base.done),
+        prose: template(raw.prose, base.prose),
+        security: template(raw.security, base.security),
+        context: template(raw.context, base.context),
     };
 }
 /** Shared request settings; `action.timeoutMs`/`action.maxRequests` from 0.1.x files are still honoured. */
@@ -135,6 +150,15 @@ function applyGuards(base, raw, timeoutMs) {
         stuck: applyStuck(base.stuck, raw.stuck),
         done: applyDone(base.done, raw.done),
         slop: applySlop(base.slop, raw.slop),
+        security: isObject(raw.security) ? {
+            enabled: boolean(raw.security.enabled, base.security.enabled),
+            threshold: probability(raw.security.threshold, base.security.threshold),
+        } : base.security,
+        context: isObject(raw.context) ? {
+            enabled: boolean(raw.context.enabled, base.context.enabled),
+            tailMinChars: positiveInteger(raw.context.tailMinChars, base.context.tailMinChars),
+            confidence: probability(raw.context.confidence, base.context.confidence),
+        } : base.context,
     };
 }
 /** Unknown keys and invalid values fall back to the base; nothing throws on a malformed file. */
@@ -149,6 +173,7 @@ export function applyUserOverrides(base, raw) {
         ...shared,
         ...applyGuards(base, raw, shared.timeoutMs),
         widget: applyWidget(base.widget, raw.widget),
+        steerVisible: boolean(raw.steerVisible, base.steerVisible),
     };
 }
 /** Project files may tune the guards but cannot grant TypeSafe consent, change the mode, or raise budgets. */

package/dist/extension.d.ts

@@ -1,6 +1,8 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import type { Verdict } from "./guard.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; the last few tool calls and output tails when the agent keeps failing; and the agent's final message when it reports completion without running checks. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+import type { SlopSymptom, Verdict } from "./guard.js";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; and redacted tool-output samples for security and tail compression. Compression stores an exact, owner-only copy in a temporary file on this machine. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 export declare function confirmMessage(verdict: Verdict): string;
+/** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
+export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[], counts: Record<SlopSymptom, number>): string;
 /** Native Pi registration; importing the root library does not load this module. */
 export default function wardenExtension(pi: ExtensionAPI): void;

package/dist/extension.js

@@ -3,15 +3,18 @@ import { createTypeSafe, resolveApiKey } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
 import { applyUserOverrides, defaultConfig, isMode, loadConfig, PACKAGE_NAME, projectConfigPath, readUserConfig, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome } from "./done.js";
-import { evaluateAction, formatVerdict, steerReason, textApproves } from "./guard.js";
+import { evaluateAction, formatVerdict, SLOP_LABELS, steerReason, textApproves } from "./guard.js";
+import { evaluateProse, proseNudge, ProseTrend } from "./prose.js";
+import { compressOutput, evaluateOutput, saveOutput, securityNotice } from "./output.js";
+import { redact } from "./redact.js";
 import { AttemptWindow, evaluateStuck, formatStuck, makeAttempt, resultFailed, stuckNudge } from "./stuck.js";
 import { openTracePanel } from "./panel.js";
-import { actionDetails, doneDetails, stuckDetails, Trace } from "./trace.js";
-import { TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; the last few tool calls and output tails when the agent keeps failing; and the agent's final message when it reports completion without running checks. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+import { actionDetails, doneDetails, proseDetails, stuckDetails, Trace } from "./trace.js";
+import { proseTokens, renderTemplate, TOKEN_NAMES } from "./widget.js";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; and redacted tool-output samples for security and tail compression. Compression stores an exact, owner-only copy in a temporary file on this machine. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, slop: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, errors: 0 });
+const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, slop: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, errors: 0 });
 function latestUserPrompt(ctx) {
     const entries = ctx.sessionManager.getBranch();
     for (let index = entries.length - 1; index >= 0; index--) {
@@ -25,6 +28,28 @@ function latestUserPrompt(ctx) {
     }
     return undefined;
 }
+/** Scope context only: approval still comes from latestUserPrompt, never from this history. */
+function recentTaskContext(ctx) {
+    const entries = ctx.sessionManager.getBranch();
+    const messages = [];
+    let skippedLatestUser = false;
+    for (let index = entries.length - 1; index >= 0 && messages.length < 8; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "message")
+            continue;
+        if (entry.message.role !== "user" && entry.message.role !== "assistant")
+            continue;
+        const { role, content } = entry.message;
+        if (role === "user" && !skippedLatestUser) {
+            skippedLatestUser = true;
+            continue;
+        }
+        const text = typeof content === "string" ? content : content.filter(part => part.type === "text").map(part => part.text).join("\n");
+        if (text.trim())
+            messages.push({ role, text: redact(text).slice(0, 750) });
+    }
+    return messages.reverse();
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -49,6 +74,19 @@ export function confirmMessage(verdict) {
     return lines.join("\n");
 }
 const callKey = (tool, input) => `${tool}\0${JSON.stringify(input)}`;
+const SLOP_FIXES = {
+    stub: "replace stubs, placeholders, and hard-coded fake data with the working implementation, or state in your reply exactly what is left unimplemented and why",
+    comments: "delete comments that restate the code; keep only those that explain intent, constraints, or non-obvious behaviour",
+    dead: "remove commented-out code, unused imports and variables, duplicated logic, and unreachable branches",
+    hedging: "replace \"should work\", \"for now\", and TODOs without a plan with a definite statement or a concrete follow-up",
+};
+/** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
+export function slopSteer(where, symptoms, counts) {
+    const named = symptoms.map(symptom => `${SLOP_LABELS[symptom]}${counts[symptom] >= 3 ? ` (${counts[symptom]}th time this session)` : ""}`).join("; ");
+    const fixes = symptoms.map(symptom => SLOP_FIXES[symptom]).join("; ");
+    const standing = symptoms.some(symptom => counts[symptom] >= 3) ? " Treat this as a standing rule for the rest of the session." : "";
+    return `pi-warden: the content just written to ${where} has ${named}. Fix it in your next edit: ${fixes}.${standing}`;
+}
 /** Native Pi registration; importing the root library does not load this module. */
 export default function wardenExtension(pi) {
     let client;
@@ -63,6 +101,8 @@ export default function wardenExtension(pi) {
     let attempts = new AttemptWindow(defaultConfig().stuck.window);
     let evidence = emptyEvidence();
     let doneNudged = false;
+    const prose = new ProseTrend();
+    const slopCounts = { stub: 0, comments: 0, dead: 0, hedging: 0 };
     const configFor = (ctx) => loadConfig({ cwd: ctx.cwd, projectTrusted: ctx.isProjectTrusted() });
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
@@ -106,7 +146,7 @@ export default function wardenExtension(pi) {
         trace.push({ at: Date.now(), guard, line, details });
         paint(ctx, config);
     };
-    const steer = (content) => pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: true }, { deliverAs: "steer" });
+    const steer = (config, content, options = { deliverAs: "steer" }) => pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: config.steerVisible }, options);
     pi.on("session_start", async (_event, ctx) => {
         client = undefined;
         budgetExhausted = false;
@@ -117,6 +157,9 @@ export default function wardenExtension(pi) {
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
+        prose.reset();
+        for (const symptom of Object.keys(slopCounts))
+            slopCounts[symptom] = 0;
         if (ctx.hasUI)
             ctx.ui.setWidget(WIDGET, undefined);
     });
@@ -139,9 +182,12 @@ export default function wardenExtension(pi) {
         const heldAt = held.get(key);
         const retryAfterHold = held.has(key) && heldAt !== task;
         const judge = judgeFor(config);
-        const verdict = await evaluateAction({ tool: event.toolName, input: event.input, cwd: ctx.cwd, task }, { config: config.action, judge, signal: ctx.signal, slop: config.slop, retryAfterHold });
+        const verdict = await evaluateAction({ tool: event.toolName, input: event.input, cwd: ctx.cwd, task, context: recentTaskContext(ctx) }, { config: config.action, judge, signal: ctx.signal, slop: config.slop, security: config.security, retryAfterHold });
         if (verdict.source === "skipped")
             return;
+        if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
+            steer(config, "pi-warden: the proposed write may introduce a security weakness. Check for embedded credentials, disabled TLS, unsafe command/SQL interpolation, broad permissions, or bypassed verification; use a safe implementation instead.");
+        }
         if (verdict.judgment)
             stats.judged++;
         if (verdict.source === "error")
@@ -160,12 +206,14 @@ export default function wardenExtension(pi) {
         const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
         if (verdict.source !== "read-only")
             record(ctx, config, "action", formatVerdict(verdict, config.widget.action), actionDetails(verdict, { mode, ...(told ? { told } : {}) }));
-        if (verdict.slopReasons?.length) {
+        if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
+            for (const symptom of verdict.slopSymptoms)
+                slopCounts[symptom]++;
             const where = verdict.summary.path ?? event.toolName;
             if (ctx.hasUI)
                 ctx.ui.notify(`warden · slop · ${where}: ${verdict.slopReasons.join("; ")}`, "warning");
-            steer(`pi-warden: the content just written to ${where} reads as ${verdict.slopReasons.join(" and ")}. Replace stubs and placeholders with working code, remove comments that restate the code, and keep only what the request needs. If something is intentionally left unimplemented, say so in your reply instead of leaving it in the code.`);
+            steer(config, slopSteer(where, verdict.slopSymptoms, slopCounts));
         }
         if (verdict.level === "warn") {
             stats.warned++;
@@ -199,38 +247,111 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        const textBlocks = event.content.filter(part => part.type === "text");
+        const text = textBlocks.map(part => part.text).join("\n");
+        const output = await evaluateOutput(event.toolName, text, latestUserPrompt(ctx), {
+            security: config.security, context: config.context, judge: judgeFor(config), timeoutMs: config.timeoutMs,
+            signal: ctx.signal, compressible: textBlocks.length === 1, taskContext: recentTaskContext(ctx),
+        });
+        if (ctx.signal?.aborted)
+            return;
+        if (output.error)
+            noteError(ctx, output.error, output.errorCode);
+        let content = event.content;
+        const notice = securityNotice(output);
+        const excerpt = compressOutput(text, output.retention);
+        if (excerpt && !ctx.signal?.aborted) {
+            try {
+                const path = await saveOutput(text);
+                const replacement = `${excerpt}\n\nFull output: ${path}`;
+                const bytesSaved = Buffer.byteLength(text) - Buffer.byteLength(replacement) - (notice ? Buffer.byteLength(notice) * 2 + 4 : 0);
+                if (bytesSaved > 0) {
+                    content = content.map(part => part.type === "text" ? { ...part, text: replacement } : part);
+                    record(ctx, config, "context", renderTemplate(config.widget.context, { tool: event.toolName, retention: output.retention, bytesSaved: String(bytesSaved) }), [
+                        `retention: ${output.retention}; confidence ${output.confidence?.toFixed(2)}; ${output.model}; ${output.elapsedMs} ms`,
+                        `saved ${bytesSaved} bytes; full output: ${path}`,
+                    ]);
+                }
+            }
+            catch {
+                noteError(ctx, "Could not store full output; keeping it unchanged.", undefined);
+            }
+        }
+        if (notice && textBlocks.length) {
+            let index = 0;
+            content = content.map(part => {
+                if (part.type !== "text")
+                    return part;
+                index++;
+                return { ...part, text: `${index === 1 ? `${notice}\n\n` : ""}${part.text}${index === textBlocks.length ? `\n\n${notice}` : ""}` };
+            });
+            steer(config, notice);
+            record(ctx, config, "security", renderTemplate(config.widget.security, {
+                tool: event.toolName, injection: output.injection?.toFixed(2), exfiltration: output.exfiltration?.toFixed(2),
+                status: [output.suspicious && "untrusted instructions", output.secret && "possible credentials"].filter(Boolean).join(", "),
+            }), [
+                `jev: injection ${output.injection?.toFixed(2) ?? "not judged"}; exfiltration ${output.exfiltration?.toFixed(2) ?? "not judged"}`,
+                `output sample: ${redact(text).slice(0, 300)}`, `agent told: ${notice}`,
+            ]);
+        }
+        const patch = content === event.content ? undefined : { content };
+        // Checks and repeat detection use the original result, not the excerpts or security banner.
         const failed = resultFailed(event.isError, event.details, event.content);
         if (config.done.enabled)
             recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed), event.input, event.toolName);
         if (!config.stuck.enabled)
-            return;
+            return patch;
         attempts.push(makeAttempt(event.toolName, event.input, event.content, failed));
         if (!attempts.shouldJudge(config.stuck))
-            return;
+            return patch;
         stats.stuckChecks++;
         const verdict = await evaluateStuck(attempts, latestUserPrompt(ctx), { config: config.stuck, judge: judgeFor(config), timeoutMs: config.timeoutMs, signal: ctx.signal });
         if (verdict.error)
             noteError(ctx, verdict.error, undefined);
         if (verdict.source === "repeat" && !verdict.stuck)
-            return;
+            return patch;
         const nudge = verdict.stuck && config.stuck.nudge ? stuckNudge(verdict) : undefined;
         record(ctx, config, "stuck", formatStuck(verdict, config.widget.stuck), stuckDetails(verdict, attempts.attempts, nudge));
         if (!verdict.stuck)
-            return;
+            return patch;
         stats.stuck++;
         if (ctx.hasUI)
             ctx.ui.notify(`warden · stuck: ${verdict.reasons.join("; ")}${nudge ? " (agent nudged)" : ""}`, "warning");
         if (nudge)
-            steer(nudge);
+            steer(config, nudge);
+        return patch;
     });
     pi.on("agent_end", async (event, ctx) => {
         const config = configFor(ctx);
-        if (!config.enabled || !config.done.enabled || doneNudged || !needsDoneCheck(evidence))
+        if (!config.enabled)
             return;
         const finalMessage = finalAssistantText(event.messages);
         const judge = judgeFor(config);
         if (!finalMessage || !judge)
             return;
+        if (config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars) {
+            stats.proseChecks++;
+            const verdict = await evaluateProse(latestUserPrompt(ctx), finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal });
+            if (verdict.error)
+                noteError(ctx, verdict.error, undefined);
+            else
+                prose.record(verdict.flagged);
+            const due = verdict.error ? [] : prose.due(config.slop.prose.trend);
+            const nudge = due.length ? proseNudge(due, config.slop.prose.audience, prose.counts) : undefined;
+            if (nudge) {
+                verdict.nudged = true;
+                prose.markNudged();
+                stats.proseNudges++;
+            }
+            record(ctx, config, "prose", renderTemplate(config.widget.prose, proseTokens(verdict)), proseDetails(verdict, finalMessage, config.slop.prose.audience, nudge));
+            if (nudge) {
+                if (ctx.hasUI)
+                    ctx.ui.notify(`warden · prose: ${due.join(", ")} in ${config.slop.prose.trend} of the last 3 replies (agent nudged for the next reply)`, "warning");
+                steer(config, nudge, { deliverAs: "nextTurn" });
+            }
+        }
+        if (!config.done.enabled || doneNudged || !needsDoneCheck(evidence))
+            return;
         stats.doneChecks++;
         const verdict = await evaluateDone(latestUserPrompt(ctx), finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal });
         if (verdict.error)
@@ -244,7 +365,7 @@ export default function wardenExtension(pi) {
             ctx.ui.notify(`warden · done-check: ${verdict.reasons.join("; ")}${nudge ? " (agent asked to verify)" : ""}`, "warning");
         if (nudge) {
             doneNudged = true;
-            pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content: nudge, display: true }, { deliverAs: "followUp", triggerTurn: true });
+            steer(config, nudge, { deliverAs: "followUp", triggerTurn: true });
         }
     });
     // Shortcuts are registered once at load; a shape check keeps a typo in the config file from being registered.
@@ -277,11 +398,11 @@ export default function wardenExtension(pi) {
                     const key = resolveApiKey();
                     const source = consentSource(config);
                     const usage = client?.getUsage();
-                    const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop"].filter(Boolean).join(", ");
+                    const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.context.enabled && "context (tail-only)"].filter(Boolean).join(", ");
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `enabled via ${source}` : "disabled (run /warden enable)"}; key ${key ? key.source === "stored" ? "stored (shared with pi-typesafe)" : "from TYPESAFE_API_KEY" : "missing (run /warden enable)"}.`,
-                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.slop} slop notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests.`,
-                        `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / hold ${config.action.offTask.confirm}; stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop quality ${config.slop.quality}, stub ${config.slop.placeholder}; failOpen ${config.action.failOpen}.`,
+                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.slop} slop notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}.`,
+                        `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / hold ${config.action.offTask.confirm}; stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; failOpen ${config.action.failOpen}.`,
                         `Config: ${userConfigPath()}${ctx.isProjectTrusted() ? ` and ${projectConfigPath(ctx.cwd)}` : ""}.`,
                         widget.size ? `Last: ${[...widget.values()].join(" | ")}` : "No guarded activity yet this session.",
                         `Trace: ${trace.entries().length} events (/warden trace${shortcut ? `, ${shortcut}` : ""}, or click the status line in fullscreen mode). Widget templates in config.widget: action tokens ${TOKEN_NAMES.action.map(name => `{${name}}`).join(" ")}.`,