pi-warden 0.40.1 → 0.47.0

package/CHANGELOG.md

@@ -8,6 +8,78 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.47.0
+
+### Changed
+
+- A recursive `rm` whose every target is scratch the agent created in this session under the OS temp directory (`mkdir`, `mktemp`, a `write`, or a temp directory a command printed and created) warns as `rm-session-scratch` instead of holding as destructive. Targets are resolved through `..` and symlinks first; a temp root, a wildcard, a variable, a substitution, `sudo` or another privilege prefix, content older than the directory it sits in, or any target that was not created this session (or was replaced since) keeps the hold. The created paths live in memory and reset on `session_start`.
+
+## 0.46.0
+
+### Added
+
+- When a guard would ask Jev but cannot, Warden says so once per session and reason, with the fix: `warden: Jev judgments are off (no consent). Run /warden enable.` (`Set PI_WARDEN_ENABLED=1.` headless), `(no key for <backend>). Set <key variable>.` (with ` or run /typesafe login` on the TypeSafe backend, the only one login stores a key for), or for a rejected key `(the key saved by /typesafe login was rejected). Run /typesafe login.` or `(the key in <key variable> was rejected). Check the key, then run /warden status.` A headless session gets a status message. A spent request budget keeps its own warning. Before this, judgments stopped silently.
+- Trace file: the `session` line has `judgments` (`on`, or `off:<reason>` with reason `no_consent`, `no_key`, `key_rejected`, or `budget`), and a `judgments` line records a later change.
+
+### Fixed
+
+- The conscience traces why no judge was available (`no_consent`, `no_key`, `key_rejected`, or `budget`). Before this, it traced `no_consent` whenever the judge was missing, also when consent was given and the saved key was rejected.
+
+## 0.45.0
+
+### Added
+
+- A judge cooldown. After three consecutive timeout, network, or other failures, or one auth or configuration failure, pi-warden stops asking Jev for a minute instead of paying a full request timeout on every guarded action. One warning names the failure kind, the duration, and for an auth failure the fix; one info notice says when judgments resume. Guards run as they do with no judge configured, nothing is sent during the window, and `/warden status` counts the checks that ran without Jev. Configure with `judge.failuresBeforeCooldown` and `judge.cooldownMs` (capped at 10 minutes); state is per session. A malformed request that pi-typesafe rejects locally does not count. A request that hits pi-warden's own `timeoutMs` reaches the SDK as an abort, so it is told apart from a user's cancel by the signal's reason and counted as a timeout.
+
+## 0.44.1
+
+### Fixed
+
+- The credential and untrusted-output notice rides the tool result: the banner in the result content and the trace record stay, and the separate steer message is gone, so a notice on the last tool result of a turn no longer costs an extra model turn.
+- Credential detection no longer fires on placeholder values (`<redacted>`, `<...>`, `***`, `REDACTED`, `xxxx`), plain numbers with `_` or `,` separators, or a key name whose value is only an identifier or expression in code (`findSecrets(text)`, `output.secretIds`).
+
+## 0.44.0
+
+### Added
+
+- `PI_WARDEN_TRACE_DIR`: with an absolute path, Warden appends its trace to `<path>/<session id>.jsonl`, one owner-only file per Pi session, so a host that runs Pi in RPC mode can read what the status line and the sidebar would show. Each line is a JSON object with `"v": 1` and a `kind`: `session` (session id, `~`-shortened working directory, Warden version, mode, time), `entry` (a numeric `id` unique in the file, time, and the trace entry as stored), or `amend` (the entry `id`, the added line, time). The 100-entry limit of the sidebar does not apply to the file. A write error is reported once and stops the file for the session; guards and tool calls do not change. Unset, empty, or relative: no file. `docs/configuration.md` lists the record format and `docs/data-handling.md` lists the file.
+- `/warden trace` in RPC mode sends the last 20 trace entries as one text notification, newest last, with the trace file path when the file is on. RPC mode settles the overlay request without building the sidebar, so before this the command did nothing there. The terminal sidebar does not change.
+
+## 0.43.0
+
+### Changed
+
+- The off-task judgment and the conscience recommendation both judge with a task spine in the request state: the thread's first user turn (the goal), the latest user turn, and up to four earlier user turns (newest first). The whole spine is capped at 1200 characters — `task_history` is clipped first, then `goal`; the latest turn is never clipped. A follow-up like "now the tests" is no longer judged without the goal it belongs to. Approval still comes from the latest user turn only; the spine is context, never authorization, and no threshold moved (the conscience beta policy's pinned questionHash still matches). The action approval question now names `spine` beside `context` as text that cannot grant approval. A thread with one user turn sends no spine, so the budget is not spent on a copy of the task. A queued prompt admitted at `message_start` is also assessed with the spine. Both request paths cap a spine they receive at four history entries and the same per-field lengths (goal 1200, each entry 750 characters), whoever built it. After a compaction the goal is still the thread's first user turn: the branch keeps the summarized entries, and a compaction summary never becomes the goal. `docs/data-handling.md` lists the spine for the action guard and the conscience.
+
+## 0.42.1
+
+### Fixed
+
+- A write the action guard holds, denies, or the user declines no longer gets a rules or slop steer. The steer said "the content just written" about content that was never written. A confirm-dialog write gets the steer after the user allows it. An approved retry of a held write is judged again and gets its own steer. The trace still records the rule findings of the held write, marked as not told.
+
+## 0.42.0
+
+### Added
+
+- A judged `bash` call now also asks whether the command will print far more output than the agent needs. At or above `context.largeOutput.threshold` (default `0.85`) the agent is told once per command family per session to redirect or filter it, for example to a file with `tail -40`. The call is never held. `context.largeOutput.enabled: false` removes the question. `scripts/context-cases.mjs` has eight labelled commands to calibrate it.
+
+### Fixed
+
+- The rules guard no longer judges writes to files outside the project root or paths ignored by the project's `.gitignore`. Those files are not project code and the rules in `pi-warden.md` do not apply to them.
+
+## 0.41.0
+
+### Added
+
+- The A/B eval (`npm run eval:ab`) now scores two more axes per run, shown side by side for the two cells in an "Outcome and waste" section of the report. Outcome: whether every check the task declares passes when the runner re-runs it, the diff violation count, and whether the final reply claimed tests/build success without the agent ever running that check. Waste, read from the saved session log (`eval/waste.mjs`): tool-call count, retries (same tool, same or near-same input, after a failure), reverts (a `git checkout`/`git restore` naming a path, or a `write` restoring a file to earlier content), total tokens, and wall seconds.
+
+## 0.40.2
+
+### Fixed
+
+- The first-run notice no longer names a fallback document when `rules.files` is what resolved. It was decided by whether `pi-warden.md` existed, so a project whose rules come from `rules.files` was told `AGENTS.md` was judging it while its own configured files were the ones in force — and the notice's remedy, creating a `pi-warden.md`, is the one thing that shadows those files. The notice now asks the rule store which tier answered and fires only when a fallback document really is in force, listing `rules.files` among the tiers it looked at.
+- The escalation request carries the rules the config resolves, not a document of the resolver's own choosing. It walked `pi-warden.md` and then `AGENTS.md` / `CLAUDE.md` / `README.md` while the rules guard was judging with `rules.files`, so a project with configured rules sent `AGENTS.md` prose as its rules, or no rules at all when it had no such file. It now takes every file in `rules.files`, in order, before the fallback names, and honors `rules.fallback: false`.
+
 ## 0.40.1
 
 ### Fixed

package/README.md

@@ -68,7 +68,7 @@ paths: src/**/*.ts
 Every exported function declares its return type.
 ```
 
-Jev judges every write and quotes violations back. Rules can be things no linter checks: "a TODO must name a ticket", "comments must not restate the code". Without `pi-warden.md`, the first of `README.md`/`CLAUDE.md`/`AGENTS.md` is judged instead. [Examples and config details.](docs/configuration.md)
+Jev judges every write and quotes violations back. Rules can be things no linter checks: "a TODO must name a ticket", "comments must not restate the code". Without `pi-warden.md`, the first of `AGENTS.md`/`CLAUDE.md`/`README.md` is judged instead. [Examples and config details.](docs/configuration.md)
 
 ## Does it actually help?
 

package/dist/action-guard.d.ts

@@ -1,5 +1,6 @@
-import type { ActionGuardConfig, RulesConfig, SecurityConfig, SlopGuardConfig } from "./config.js";
-import type { PreviousAction, TaskMessage, Verdict } from "./guard.js";
+import type { ActionGuardConfig, LargeOutputConfig, SecurityConfig, SlopGuardConfig } from "./config.js";
+import type { EvaluateOptions, PreviousAction, ScratchRecords, TaskMessage, Verdict } from "./guard.js";
+import type { TaskSpine } from "./shape.js";
 import type { Judge } from "pi-typesafe";
 /** One tool call as the agent proposed it. `id` is Pi's tool call id, stable across hooks and retries. */
 export interface ToolCallRef {
@@ -12,6 +13,8 @@ export interface Conversation {
     task: string | undefined;
     /** Scope context only: approval still comes from `task`, never from this history. */
     context?: readonly TaskMessage[] | undefined;
+    /** The task spine: the thread's goal and earlier user turns, so follow-ups are judged with the goal they belong to. Scope context only: it never authorizes; approval still comes from `task`. */
+    spine?: TaskSpine | undefined;
     /** Tool calls in the same assistant message, this one included; they are judged together. */
     siblings?: readonly ToolCallRef[] | undefined;
     /** The agent's own words in that message (or its latest text under this prompt); shared by the siblings. Explains, never authorizes. */
@@ -25,10 +28,14 @@ export interface InspectOptions {
     signal?: AbortSignal | undefined;
     slop?: SlopGuardConfig | undefined;
     security?: SecurityConfig | undefined;
-    /** The rules guard's switch; off keeps the rules file content out of the action request. Omitted, it is sent as before. */
-    rules?: Pick<RulesConfig, "enabled"> | undefined;
+    /** Adds the large-output question to bash requests. */
+    largeOutput?: LargeOutputConfig | undefined;
+    /** The rules guard's switch, forwarded to `evaluateAction`: off keeps the rules content out of the request. */
+    rules?: EvaluateOptions["rules"];
     /** Calls allowed in the previous turn; the regret question about them rides this call's request, never a sibling's. */
     previousActions?: readonly PreviousAction[] | undefined;
+    /** Real paths the agent created under the temp directory in this session, forwarded to `evaluateAction`. */
+    scratch?: ScratchRecords | undefined;
 }
 /**
  * The Action guard for one session. `evaluateAction` judges a single call; this module owns what spans calls:

package/dist/action-guard.js

@@ -20,7 +20,7 @@ export class ActionGuard {
         const { task } = conversation;
         // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
         const retryAfterHold = this.holdPending && this.lastHoldPrompt !== task;
-        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, rules: options.rules, retryAfterHold, previousActions });
+        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan, spine: conversation.spine }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, largeOutput: options.largeOutput, rules: options.rules, retryAfterHold, previousActions, scratch: options.scratch });
         // A retry after a hold stays sequential because an approval consumed by one sibling changes the question for the next.
         if (options.judge && !retryAfterHold) {
             for (const sibling of conversation.siblings ?? []) {

package/dist/backend.d.ts

@@ -1,10 +1,14 @@
 import type { TypeSafeOptions } from "pi-typesafe";
 /** The judgment backend that receives pi-warden's Jev requests. */
 export type JudgmentBackend = "typesafe" | "openrouter";
+/** Why no judge is available: consent not given, no key for the backend, a saved 401 or 403, or the request budget spent. */
+export type JudgmentsOffReason = "no_consent" | "no_key" | "key_rejected" | "budget";
 /** The host the consent disclosure names as the destination, without scheme: `api.typesafe.ai`, `openrouter.ai`. */
 export declare function backendHost(backend: JudgmentBackend): string;
 /** The environment variable that carries the backend's key, for messages that tell the user what to set. */
 export declare function keyEnvFor(backend: JudgmentBackend): string;
+/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; pi-typesafe's `usesTypesafeKey`, which its package does not export. */
+export declare function loginStoresKey(backend: JudgmentBackend): boolean;
 /** Adapt the consent text to the active backend by substituting the destination host. */
 export declare function disclosureFor(backend: JudgmentBackend, disclosure: string): string;
 /**

package/dist/backend.js

@@ -7,6 +7,10 @@ export function backendHost(backend) {
 export function keyEnvFor(backend) {
     return DECISIONS_BACKENDS[backend].keyEnv ?? DECISIONS_BACKENDS[DEFAULT_BACKEND].keyEnv ?? "TYPESAFE_API_KEY";
 }
+/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; pi-typesafe's `usesTypesafeKey`, which its package does not export. */
+export function loginStoresKey(backend) {
+    return keyEnvFor(backend) === keyEnvFor(DEFAULT_BACKEND);
+}
 /** Adapt the consent text to the active backend by substituting the destination host. */
 export function disclosureFor(backend, disclosure) {
     return backend === DEFAULT_BACKEND ? disclosure : disclosure.replace(backendHost(DEFAULT_BACKEND), backendHost(backend));

package/dist/config.d.ts

@@ -193,6 +193,13 @@ export interface ContextConfig {
     formatConfidence: number;
     /** Append a compact evidence appendix to the summary during compaction. */
     compactAppendix: boolean;
+    /** Prevention before the call: a bash action request asks whether the command will print far more than the agent needs. Never holds. */
+    largeOutput: LargeOutputConfig;
+}
+export interface LargeOutputConfig {
+    enabled: boolean;
+    /** P(the command prints far more than the agent needs) at or above which the agent is steered once per command family per session. */
+    threshold: number;
 }
 export interface RunawayConfig {
     enabled: boolean;
@@ -205,6 +212,12 @@ export interface RunawayConfig {
     /** After stopping, start one follow-up turn that names the repeat and asks for the one next step; once per user prompt. */
     recover: boolean;
 }
+export interface JudgeConfig {
+    /** Consecutive timeout, network, or other failures before judgments pause; one auth or configuration failure is enough. */
+    failuresBeforeCooldown: number;
+    /** How long a failing judge is left alone; guards run pattern-only until the next request after it. */
+    cooldownMs: number;
+}
 export interface NotifyConfig {
     /** Desktop notification when the agent needs you: a held call it will ask about, a confirm dialog, a stopped runaway. Off by default; opt in per user or project. */
     enabled: boolean;
@@ -304,6 +317,7 @@ export interface WardenConfig {
     context: ContextConfig;
     runaway: RunawayConfig;
     notify: NotifyConfig;
+    judge: JudgeConfig;
     /** Triage of async subagent reports: Jev separates what needs the agent awake from what is only context. */
     subagent: SubagentConfig;
     /** The status line above the editor and the trace panel. */

package/dist/config.js

@@ -44,9 +44,10 @@ export function defaultConfig() {
         slop: { enabled: true, threshold: 0.7, prose: { enabled: true, audience: "technical", threshold: 0.7, trend: 2, minChars: 200 } },
         security: { enabled: true, threshold: 0.7 },
         rules: { enabled: true, threshold: 0.7, files: [], fallback: true, maxChars: 8000, exclude: [], skip: [], sensitivePaths: {} },
-        context: { enabled: true, tailMinChars: 12000, confidence: 0.8, duplicateMinChars: 2000, recallTool: "auto", formatConfidence: 0.7, compactAppendix: true },
+        context: { enabled: true, tailMinChars: 12000, confidence: 0.8, duplicateMinChars: 2000, recallTool: "auto", formatConfidence: 0.7, compactAppendix: true, largeOutput: { enabled: true, threshold: 0.85 } },
         runaway: { enabled: true, repeats: 4, thinkingRepeats: 10, minChars: 400, recover: true },
         notify: { enabled: false, cooldownMs: 10000, command: [] },
+        judge: { cooldownMs: 60000, failuresBeforeCooldown: 3 },
         subagent: { enabled: true, wake: true, threshold: 0.8, cooldownMs: 120000 },
         widget: defaultWidgetConfig(),
         steerVisible: false,
@@ -322,6 +323,14 @@ function applyNotify(base, raw, allowCommand) {
         ? [...raw.command] : base.command;
     return { enabled: boolean(raw.enabled, base.enabled), cooldownMs: cooldown, command };
 }
+/** A project config cannot switch the judge off for longer than this by setting a huge cooldown. */
+const MAX_JUDGE_COOLDOWN_MS = 10 * 60 * 1000;
+function applyJudge(base, raw) {
+    if (!isObject(raw))
+        return base;
+    const cooldown = typeof raw.cooldownMs === "number" && Number.isSafeInteger(raw.cooldownMs) && raw.cooldownMs >= 0 ? Math.min(raw.cooldownMs, MAX_JUDGE_COOLDOWN_MS) : base.cooldownMs;
+    return { cooldownMs: cooldown, failuresBeforeCooldown: positiveInteger(raw.failuresBeforeCooldown, base.failuresBeforeCooldown) };
+}
 function applySubagent(base, raw) {
     if (!isObject(raw))
         return base;
@@ -407,6 +416,7 @@ function applyGuards(base, raw, timeoutMs, source) {
         subagent: applySubagent(base.subagent, raw.subagent),
         // A project file may switch notifications off or on, but never names a command to run.
         notify: applyNotify(base.notify, raw.notify, source === "user"),
+        judge: applyJudge(base.judge, raw.judge),
         action: applyAction(base.action, raw.action, timeoutMs, source),
         stuck: applyStuck(base.stuck, raw.stuck),
         done: applyDone(base.done, raw.done),
@@ -423,6 +433,10 @@ function applyGuards(base, raw, timeoutMs, source) {
             recallTool: isRecallTool(raw.context.recallTool) ? raw.context.recallTool : base.context.recallTool,
             formatConfidence: probability(raw.context.formatConfidence, base.context.formatConfidence),
             compactAppendix: boolean(raw.context.compactAppendix, base.context.compactAppendix),
+            largeOutput: isObject(raw.context.largeOutput) ? {
+                enabled: boolean(raw.context.largeOutput.enabled, base.context.largeOutput.enabled),
+                threshold: probability(raw.context.largeOutput.threshold, base.context.largeOutput.threshold),
+            } : base.context.largeOutput,
         } : base.context,
     };
 }

package/dist/conscience.d.ts

@@ -6,7 +6,9 @@
  */
 import type { Skill } from "@earendil-works/pi-coding-agent";
 import type { Questions } from "pi-typesafe";
+import type { JudgmentsOffReason } from "./backend.js";
 import type { ConscienceConfig } from "./config.js";
+import type { TaskSpine } from "./shape.js";
 export type Disposition = "advance" | "awaiting_user" | "no_gap" | "unclear";
 /** Capability roles the session model assigns to index entries. */
 export type CapabilityRole = "research" | "evidence" | "execution" | "delegation" | "review" | "conversation";
@@ -64,7 +66,7 @@ export interface AssessmentResult {
     /** Number of judge requests issued for this assessment. */
     requestCount: number;
 }
-export type SkipReason = "disabled" | "no_consent" | "no_match" | "already_supplied" | "awaiting_user" | "timeout" | "error" | "stale" | "catalog_unavailable" | "catalog_limit" | "metadata_unsafe" | "budget" | "explicit_skill" | "origin_unknown" | "below_threshold";
+export type SkipReason = "disabled" | "no_consent" | "no_key" | "key_rejected" | "no_match" | "already_supplied" | "awaiting_user" | "timeout" | "error" | "stale" | "catalog_unavailable" | "catalog_limit" | "metadata_unsafe" | "budget" | "explicit_skill" | "origin_unknown" | "below_threshold";
 /** Score levels for the usefulness question. Levels are ordered from least to most useful. */
 export declare const SCORE_LEVELS: readonly ["No useful contribution to the current request, or conflicts with the supplied constraints.", "Related to the subject, but already covered, premature, or unable to resolve the current need.", "Addresses a concrete unmet need at the current step without displacing the active workflow.", "Supplies a missing prerequisite or directly applicable documented method needed for the current step."];
 /** Strip absolute paths, URLs, and credentials from a description. */
@@ -91,11 +93,13 @@ export declare function buildBatchQuestions(batch: Array<{
 };
 /**
  * Build the full state object for the judge request (spec §3 state contract).
+ * `spine`, when given, carries the task spine — the thread's goal and earlier user turns — beside `task`;
+ * scope context only, it never authorizes anything and it is not part of any question.
  */
 export declare function buildState(task: string, recentContext: string, activeSkills: string[], suppliedSkills: string[], batch: Array<{
     opaqueId: string;
     candidate: Candidate;
-}>): Record<string, unknown>;
+}>, spine?: TaskSpine | undefined): Record<string, unknown>;
 /**
  * Compute a deterministic hash of the assessment questions for deduplication.
  * Recursively sorts all object keys for canonical form.
@@ -138,6 +142,8 @@ export interface Judge {
 }
 export interface ConscienceDeps {
     judge: Judge | undefined;
+    /** Why `judge` is undefined, as the extension computed it; the skip reason. `no_consent` when not given. */
+    judgmentsOff?: JudgmentsOffReason | undefined;
     config: ConscienceConfig;
     /** Shared timeout from WardenConfig. The effective deadline is min(conscience.timeoutMs, sharedTimeoutMs). */
     sharedTimeoutMs: number;
@@ -160,4 +166,4 @@ export interface ConscienceDeps {
 export declare function assess(prompt: string, recentContext: string, skills: Skill[], tools: {
     name: string;
     description: string;
-}[], activeSkills: string[], suppliedSkills: string[], deps: ConscienceDeps): Promise<AssessmentResult>;
+}[], activeSkills: string[], suppliedSkills: string[], deps: ConscienceDeps, spine?: TaskSpine | undefined): Promise<AssessmentResult>;

package/dist/conscience.js

@@ -1,6 +1,7 @@
 import { choice, noul, score } from "pi-typesafe";
 import { createHash } from "node:crypto";
 import { redact } from "./redact.js";
+import { SPINE_GOAL_LIMIT, SPINE_HISTORY_LIMIT, SPINE_HISTORY_TURNS } from "./shape.js";
 import { fileContentHash, toolSourceHash } from "./hashing.js";
 /** Score levels for the usefulness question. Levels are ordered from least to most useful. */
 export const SCORE_LEVELS = [
@@ -70,8 +71,10 @@ export function buildBatchQuestions(batch, task, recentContext, activeSkills, su
 }
 /**
  * Build the full state object for the judge request (spec §3 state contract).
+ * `spine`, when given, carries the task spine — the thread's goal and earlier user turns — beside `task`;
+ * scope context only, it never authorizes anything and it is not part of any question.
  */
-export function buildState(task, recentContext, activeSkills, suppliedSkills, batch) {
+export function buildState(task, recentContext, activeSkills, suppliedSkills, batch, spine) {
     const candidates = {};
     for (const { opaqueId, candidate } of batch) {
         const entry = candidate.indexEntry;
@@ -82,6 +85,12 @@ export function buildState(task, recentContext, activeSkills, suppliedSkills, ba
     return {
         task: sanitizeDescription(redact(task)),
         context: sanitizeDescription(redact(recentContext)),
+        // The spine's `task` is deliberately not repeated here: the `task` field above already carries it.
+        // Same per-field limits as the action request, for a spine built outside taskSpine.
+        ...(spine ? { spine: {
+                goal: sanitizeDescription(redact(spine.goal)).slice(0, SPINE_GOAL_LIMIT),
+                task_history: spine.history.slice(0, SPINE_HISTORY_TURNS).map(turn => sanitizeDescription(redact(turn)).slice(0, SPINE_HISTORY_LIMIT)),
+            } } : {}),
         active_skills: activeSkills,
         supplied_skills: suppliedSkills,
         candidates,
@@ -276,14 +285,14 @@ function parseScoreAnswer(answer) {
  * Pre-measurement: returns trace-only results. No steers, no auto-loading.
  * Issues concurrent requests (up to four in flight), skills first, shared deadline.
  */
-export async function assess(prompt, recentContext, skills, tools, activeSkills, suppliedSkills, deps) {
+export async function assess(prompt, recentContext, skills, tools, activeSkills, suppliedSkills, deps, spine) {
     const start = deps.now?.() ?? Date.now();
     const { config, judge, sharedTimeoutMs } = deps;
     if (!config.enabled) {
         return { disposition: "no_gap", selected: null, usefulness: 0, pAdvance: 0, questionHash: "", elapsedMs: 0, requestCount: 0, skipReason: "disabled" };
     }
     if (!judge) {
-        return { disposition: "no_gap", selected: null, usefulness: 0, pAdvance: 0, questionHash: "", elapsedMs: 0, requestCount: 0, skipReason: "no_consent" };
+        return { disposition: "no_gap", selected: null, usefulness: 0, pAdvance: 0, questionHash: "", elapsedMs: 0, requestCount: 0, skipReason: deps.judgmentsOff ?? "no_consent" };
     }
     const { candidates, skillOverflow, toolOverflow } = eligibleCandidates(skills, tools, config, activeSkills, suppliedSkills, deps.globalIndex, deps.projectIndex);
     if (candidates.length === 0) {
@@ -345,7 +354,7 @@ export async function assess(prompt, recentContext, skills, tools, activeSkills,
         const opaqueBatch = assignOpaqueIds(work.items.map(e => e.capped.candidate));
         const { questions, dispositionKey } = buildBatchQuestions(opaqueBatch, prompt, recentContext, activeSkills, suppliedSkills);
         state_.hash = questionHash(questions);
-        const state = buildState(prompt, recentContext, activeSkills, suppliedSkills, opaqueBatch);
+        const state = buildState(prompt, recentContext, activeSkills, suppliedSkills, opaqueBatch, spine);
         const remaining = deadline - (deps.now?.() ?? Date.now());
         if (remaining <= 0) {
             categoryFailed[work.category] = true;

package/dist/extension.d.ts

@@ -1,8 +1,9 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { JudgmentBackend, JudgmentsOffReason } from "./backend.js";
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /** Which guard spent the user's attention. The status line reports one count per guard. */
 export type SteerGuard = "action" | "rules" | "security" | "stuck" | "done" | "prose" | "runaway" | "subagent" | "conscience";
 /**
@@ -24,6 +25,12 @@ export declare function siblingToolCalls(ctx: ExtensionContext): ToolCallRef[];
  * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
  */
 export declare function assistantPlan(ctx: ExtensionContext): string | undefined;
+/**
+ * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
+ * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
+ * names a key value or a path.
+ */
+export declare function judgmentsOffText(reason: Exclude<JudgmentsOffReason, "budget">, backend: JudgmentBackend, headless: boolean, rejectedEnv?: string): string;
 export declare function confirmMessage(verdict: Verdict): string;
 /** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
 export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[], counts: Record<SlopSymptom, number>): string;