pi-warden 0.40.2 → 0.47.0

package/dist/extension.js

@@ -6,13 +6,13 @@ import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
-import { backendHost, disclosureFor, judgeOptions, keyEnvFor, resolveBackend } from "./backend.js";
+import { backendHost, disclosureFor, judgeOptions, keyEnvFor, loginStoresKey, resolveBackend } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
 import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { createdScratch, evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
@@ -31,39 +31,19 @@ import { assess } from "./conscience.js";
 import { loadSkillBody, buildLoadMessage, policyMatches, CONSCIENCE_BETA_POLICY, recordFileIdentity, clearFileIdentityCache } from "./load.js";
 import { buildIndexPrompt, readIndex, writeIndex, validateIndex, indexStats, indexPath, ensureIndexDir } from "./index-cmd.js";
 import { fileContentHash } from "./hashing.js";
-/** Classify a conscience assessment error into a safe category (spec §6: never exception bodies). */
-function classifyConscienceError(err) {
-    if (err && typeof err === "object" && "code" in err) {
-        const code = err.code;
-        if (code === "timeout")
-            return "timeout";
-        if (code === "http" || code === "connection" || code === "response")
-            return "network";
-        if (code === "configuration" || code === "validation")
-            return "configuration";
-        if (code === "budget" || code === "aborted")
-            return "other";
-    }
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/timeout|timed out/i.test(msg))
-        return "timeout";
-    if (/auth|key|credential|401|403/i.test(msg))
-        return "auth";
-    if (/network|fetch|connect|ECONNREFUSED|ENOTFOUND/i.test(msg))
-        return "network";
-    return "other";
-}
+import { classifyJudgeError, cooldownFailureKind, JudgeCooldown } from "./judge-cooldown.js";
 import { openConfigPanel, openTracePanel } from "./panel.js";
-import { completeConfig, shapeWarning } from "./shape.js";
+import { completeConfig, shapeWarning, taskSpine } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { buildCompactSnapshot, compactAppendix } from "./compact.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
+import { TraceFile, judgmentsState, traceDir, traceFilePath } from "./trace-file.js";
 import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
+const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, cooldownSkips: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
  * message count; the line says so instead of hiding it. Worst offender first: that is the number worth acting on.
@@ -154,6 +134,20 @@ export function assistantPlan(ctx) {
     }
     return undefined;
 }
+/**
+ * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
+ * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
+ * names a key value or a path.
+ */
+export function judgmentsOffText(reason, backend, headless, rejectedEnv) {
+    switch (reason) {
+        case "no_consent": return `warden: Jev judgments are off (no consent). ${headless ? "Set PI_WARDEN_ENABLED=1." : "Run /warden enable."}`;
+        case "no_key": return `warden: Jev judgments are off (no key for ${backend}). Set ${keyEnvFor(backend)}${loginStoresKey(backend) ? " or run /typesafe login" : ""}.`;
+        case "key_rejected": return rejectedEnv
+            ? `warden: Jev judgments are off (the key in ${rejectedEnv} was rejected). Check the key, then run /warden status.`
+            : "warden: Jev judgments are off (the key saved by /typesafe login was rejected). Run /typesafe login.";
+    }
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -256,10 +250,17 @@ export default function wardenExtension(pi) {
     // fail-closes (no delivery) until the policy is re-measured.
     const consciencePolicy = CONSCIENCE_BETA_POLICY;
     let client;
+    const cooldown = new JudgeCooldown();
+    let judgeConfig;
+    /** Where cooldown notices go; unset headless, where a failure is already silent (see noteError). */
+    let noticeUi;
     let budgetExhausted = false;
     let stats = freshStats();
     const widget = new Map();
     const trace = new Trace();
+    // The trace file for a host without the terminal UI; set per session when PI_WARDEN_TRACE_DIR is an absolute path.
+    let traceFile;
+    let unsubscribeTraceFile;
     let panel;
     let configPanel;
     let lastUi;
@@ -309,6 +310,13 @@ export default function wardenExtension(pi) {
     const secretsSeen = new Set();
     // Subagent report entries already triaged, by session entry id; the wake window outlives one scan.
     const subagentSeen = new Set();
+    // Command families already steered toward filtered output this session: one steer per family.
+    const largeOutputSteered = new Set();
+    // Real paths the agent created under the temp directory this session, with the identity each had when recorded.
+    // A recursive rm of only these is not destructive; a record whose path is gone or replaced is dropped after each call.
+    const sessionScratch = new Map();
+    // Per tool call id: when it started and the temp paths it may create that did not exist yet.
+    const scratchPending = new Map();
     const wakePolicy = new WakePolicy(0);
     const runaway = new RunawayMonitor();
     // Runs stopped by the runaway guard for the current user prompt; the first one gets a recovery turn, later ones wait for the user.
@@ -368,14 +376,79 @@ export default function wardenExtension(pi) {
         return config;
     };
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
+    /** Why no judge is available, or undefined when one is. The notice, the trace file, and the conscience all use it. */
+    const judgmentsOffReason = (config) => {
+        if (!consentGiven(config))
+            return "no_consent";
+        if (budgetExhausted)
+            return "budget";
+        const auth = authState({ backend: config.typesafeBackend });
+        if (auth.usable)
+            return undefined;
+        // No key in effect, or one whose last request came back 401 or 403.
+        return auth.source === undefined ? "no_key" : "key_rejected";
+    };
+    // Where the judgments-off notice goes: the session's UI, or a status message for a headless session.
+    let judgmentsNotify;
+    let judgmentsHeadless = false;
+    const judgmentsReported = new Set();
+    /** Say once per session and reason that judgments are off, and record the state in the trace file. */
+    const noteJudgments = (config, reason) => {
+        traceFile?.judgments(judgmentsState(reason));
+        // The budget has its own notice in noteError.
+        if (reason === undefined || reason === "budget" || judgmentsReported.has(reason))
+            return;
+        judgmentsReported.add(reason);
+        const auth = reason === "key_rejected" ? authState({ backend: config.typesafeBackend }) : undefined;
+        judgmentsNotify?.(judgmentsOffText(reason, config.typesafeBackend, judgmentsHeadless, auth?.kind === "environment" ? auth.keyName : undefined));
+    };
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
     /** A consent flag is not proof that judgments happen; check the key state for the chosen backend. */
     const judgeFor = (config) => {
-        if (!consentGiven(config) || budgetExhausted)
+        const off = judgmentsOffReason(config);
+        noteJudgments(config, off);
+        if (off)
             return undefined;
-        if (!authState({ backend: config.typesafeBackend }).usable)
+        judgeConfig = config;
+        // Absent, exactly as with no judge configured, so no guard needs to know a cooldown exists.
+        if (cooldown.active()) {
+            stats.cooldownSkips++;
             return undefined;
-        return client ??= createTypeSafe(judgeOptions(config));
+        }
+        return client ??= watched(createTypeSafe(judgeOptions(config)));
+    };
+    /** Every guard reaches the backend through `evaluate`, so this one seam sees each failure and each success. */
+    const watched = (typesafe) => new Proxy(typesafe, {
+        get(target, prop, receiver) {
+            if (prop !== "evaluate")
+                return Reflect.get(target, prop, receiver);
+            return async (...args) => {
+                try {
+                    const result = await target.evaluate(...args);
+                    tellCooldown(cooldown.success());
+                    return result;
+                }
+                catch (err) {
+                    const kind = cooldownFailureKind(err, args[1]?.signal);
+                    if (kind)
+                        tellCooldown(cooldown.failure(kind, judgeConfig?.judge ?? defaultConfig().judge));
+                    throw err;
+                }
+            };
+        },
+    });
+    const tellCooldown = (event) => {
+        if (!event || !noticeUi)
+            return;
+        if (event.type === "recovered") {
+            noticeUi.notify("warden: judgments resumed.", "info");
+            return;
+        }
+        const seconds = Math.round(event.ms / 1000);
+        const remedy = event.kind === "auth"
+            ? ` Set ${keyEnvFor(judgeConfig?.typesafeBackend ?? "typesafe")} or run /warden enable.`
+            : event.kind === "configuration" ? " /warden status shows the backend setup." : "";
+        noticeUi.notify(`warden: judgments paused for ${seconds}s after a ${event.kind} failure; pattern checks run alone until then.${remedy}`, "warning");
     };
     const noteError = (ctx, message, code) => {
         stats.errors++;
@@ -387,15 +460,22 @@ export default function wardenExtension(pi) {
     /** Click, shortcut, and /warden trace all toggle the same sidebar. */
     const togglePanel = (ui, config) => {
         if (!ui)
-            return;
+            return undefined;
         if (panel) {
             panel.close();
-            return;
+            return undefined;
         }
         const opened = openTracePanel(ui, trace, { width: config.widget.panelWidth });
         panel = opened;
         opened.closed.catch(() => undefined).finally(() => { if (panel === opened)
             panel = undefined; });
+        return opened;
+    };
+    /** The last 20 trace entries as text, newest last, for a host that cannot show the sidebar. */
+    const traceText = () => {
+        const entries = trace.entries();
+        const text = entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.";
+        return traceFile ? `${text}\nTrace file: ${traceFile.path}` : text;
     };
     /** The config overlay toggles the same way the sidebar does, so the hint in its header is true. */
     const toggleConfigPanel = (ui, config) => {
@@ -617,6 +697,8 @@ export default function wardenExtension(pi) {
     pi.on("session_start", async (_event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
+        cooldown.reset();
         if (_event.reason === "reload" || _event.reason === "new")
             conscienceGeneration++;
         client = undefined;
@@ -634,7 +716,27 @@ export default function wardenExtension(pi) {
         rulesGuard.reset();
         holds.reset();
         regretCandidates = [];
-        holdLog = new HoldLog(holdLogPath(typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid)));
+        const sessionId = typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid);
+        holdLog = new HoldLog(holdLogPath(sessionId));
+        unsubscribeTraceFile?.();
+        unsubscribeTraceFile = undefined;
+        traceFile = undefined;
+        judgmentsReported.clear();
+        judgmentsHeadless = !ctx.hasUI;
+        judgmentsNotify = text => { if (ctx.hasUI)
+            ctx.ui.notify(text, "warning");
+        else
+            pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+        const dir = traceDir();
+        if (dir) {
+            const warn = (text) => { if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+            const opening = loadConfig();
+            traceFile = new TraceFile(traceFilePath(dir, sessionId), dir, { sessionId, cwd: ctx.cwd, mode: opening.mode, judgments: judgmentsState(judgmentsOffReason(opening)) }, warn);
+            unsubscribeTraceFile = trace.subscribe(traceFile.listener);
+        }
         arming.reset();
         attempts.reset();
         evidence = emptyEvidence();
@@ -653,6 +755,9 @@ export default function wardenExtension(pi) {
         compressionLearner.reset();
         secretsSeen.clear();
         subagentSeen.clear();
+        largeOutputSteered.clear();
+        sessionScratch.clear();
+        scratchPending.clear();
         wakePolicy.reset();
         steerRepeats.reset();
         steersThisRun = 0;
@@ -688,6 +793,7 @@ export default function wardenExtension(pi) {
     pi.on("before_agent_start", async (event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
         const config = configFor(ctx);
         attempts = new AttemptWindow(config.stuck.window);
         fullOutputs = new Map();
@@ -744,6 +850,7 @@ export default function wardenExtension(pi) {
                 const truncationRecorded = event.prompt.length > 2000 ? [`prompt truncated from ${event.prompt.length} to 2000 chars`] : [];
                 // Build recent context from session branch (up to 4 messages, 500 chars each)
                 const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                const spine = taskSpine(branch, event.prompt);
                 const recentMessages = [];
                 for (const entry of branch.slice(-6)) {
                     if (recentMessages.length >= 4)
@@ -804,7 +911,7 @@ export default function wardenExtension(pi) {
                     // it. Empty until the first evaluate call, and an empty model never matches a policy, so the gate fails closed.
                     let judgeModel = "";
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
-                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, judgmentsOff: judgmentsOffReason(config), config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     // Check generation after await
                     if (conscienceGeneration !== myGeneration) {
                         record(ctx, config, "conscience", "stale: generation changed during assessment", ["trigger: before_agent_start", `generation: ${myGeneration} → ${conscienceGeneration}`, `skipReason: stale`]);
@@ -889,7 +996,7 @@ export default function wardenExtension(pi) {
                     }
                 }
                 catch (err) {
-                    const category = classifyConscienceError(err);
+                    const category = classifyJudgeError(err);
                     if (!warnedErrorCategories.has(category)) {
                         warnedErrorCategories.add(category);
                         console.warn(`pi-warden: conscience ${category}`);
@@ -925,7 +1032,10 @@ export default function wardenExtension(pi) {
                 const judge = judgeFor(config);
                 if (judge && cachedSkills.length > 0) {
                     const myGeneration = conscienceGeneration;
-                    const redactedText = redact(typeof event.message.content === "string" ? event.message.content : "").slice(0, 2000);
+                    const prompt = typeof event.message.content === "string" ? event.message.content : "";
+                    const redactedText = redact(prompt).slice(0, 2000);
+                    const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                    const spine = taskSpine(branch, prompt);
                     let toolInfos = [];
                     try {
                         toolInfos = pi.getAllTools().map((t) => ({ name: t.name, description: t.description }));
@@ -936,13 +1046,13 @@ export default function wardenExtension(pi) {
                     const activeSkills = cachedSkills.map(s => s.name);
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                     try {
-                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                         if (conscienceGeneration !== myGeneration)
                             return;
                         record(ctx, config, "conscience", `queued prompt assessed → ${result.selected ? `${result.selected.kind}:${result.selected.id}` : "none"} (${result.skipReason ?? "none"})`, ["trigger: message_start", `origin: queued`, `skipReason: ${result.skipReason ?? "none"}`]);
                     }
                     catch (err) {
-                        const cat = classifyConscienceError(err);
+                        const cat = classifyJudgeError(err);
                         if (!warnedErrorCategories.has(cat)) {
                             warnedErrorCategories.add(cat);
                             console.warn(`pi-warden: conscience ${cat}`);
@@ -1002,11 +1112,13 @@ export default function wardenExtension(pi) {
                 catch {
                     toolInfos = [];
                 }
-                const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+                const prompt = latestUserPrompt(ctx);
+                const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+                const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
                 const activeSkills = cachedSkills.map(s => s.name);
                 const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                 try {
-                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     if (conscienceGeneration !== myGeneration)
                         return;
                     assessmentsThisPrompt++;
@@ -1031,6 +1143,8 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        if (event.toolName === "bash" || event.toolName === "write")
+            scratchPending.set(event.toolCallId, { started: Date.now(), candidates: scratchCandidates(event.toolName, event.input, ctx.cwd) });
         // ── Conscience: track tool attempts on the selected capability ──
         if (config.conscience.enabled && selectedCapability && !triggerConsumed) {
             if (selectedCapability.kind === "tool" && event.toolName === selectedCapability.id) {
@@ -1106,7 +1220,7 @@ export default function wardenExtension(pi) {
             ? rulesGuard.inspect(call, siblings, { cwd: ctx.cwd, config: config.rules, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         rulesCheck?.catch(() => undefined);
-        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined });
+        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx), spine: taskSpine(ctx.sessionManager.getBranch()) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, largeOutput: config.context.largeOutput, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined, scratch: sessionScratch });
         if (verdict.source === "skipped")
             return;
         // Arming check: if any armed rule's command regex matches this call, inject a hit into the verdict.
@@ -1162,6 +1276,11 @@ export default function wardenExtension(pi) {
         // Notes for the agent about the content it just wrote: slop, rule violations, and sensitive paths arrive as one message.
         const notes = [];
         const noteGuards = new Set();
+        /** Slop and rule findings say "just written", so they wait until the call proceeds. A held, denied, or declined write
+         * never lands and drops them; an approved retry is judged again and brings its own. They go between the action notes
+         * and the sensitive-path notes, the order of the combined message. */
+        const contentNotes = [];
+        const pathNotes = [];
         /** Sensitive-path notes ride with the combined steer for this call; their trace waits for the delivery result. */
         const pathNoteTraces = [];
         if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
@@ -1226,15 +1345,24 @@ export default function wardenExtension(pi) {
             noteGuards.add("action");
             notes.push(shouldProceedMessage(verdict));
         }
+        const largeOutput = largeOutputNotice(verdict, largeOutputSteered);
+        if (largeOutput) {
+            noteGuards.add("action");
+            notes.push(largeOutput);
+        }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
-            noteGuards.add("action");
-            for (const symptom of verdict.slopSymptoms)
-                slopCounts[symptom]++;
+            const symptoms = verdict.slopSymptoms;
             const where = verdict.summary.path ?? event.toolName;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · slop · ${where}: ${verdict.slopReasons.join("; ")}`, "warning");
-            notes.push(slopSteer(where, verdict.slopSymptoms, slopCounts));
+            contentNotes.push(proceeds => {
+                if (!proceeds)
+                    return undefined;
+                for (const symptom of symptoms)
+                    slopCounts[symptom]++;
+                return { guard: "action", text: slopSteer(where, symptoms, slopCounts) };
+            });
         }
         if (rulesCheck) {
             const rules = await rulesCheck;
@@ -1242,16 +1370,23 @@ export default function wardenExtension(pi) {
                 stats.ruleChecks++;
                 if (rules.error)
                     noteError(ctx, rules.error, rules.errorCode);
-                const told = rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
-                record(ctx, config, "rules", formatRules(rules, config.widget.rules), rulesDetails(rules, told));
                 holds.recordRules({ source: rules.source, path: rules.path, findings: rules.findings.map(f => ({ name: f.name, violation: f.violation })), ...(rules.error ? { error: rules.error } : {}) });
-                if (told) {
+                if (rules.findings.length) {
                     stats.ruleViolations++;
-                    noteGuards.add("rules");
                     if (ctx.hasUI && config.notices)
                         ctx.ui.notify(`warden · rules · ${rules.path}: ${rules.findings.map(finding => `${finding.name} (${finding.violation.toFixed(2)})`).join("; ")}`, "warning");
-                    notes.push(told);
                 }
+                contentNotes.push(proceeds => {
+                    const told = proceeds && rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
+                    const details = rulesDetails(rules, told);
+                    if (!proceeds && rules.findings.length)
+                        details.push("agent not told: the write was held");
+                    record(ctx, config, "rules", formatRules(rules, config.widget.rules), details);
+                    return told ? { guard: "rules", text: told } : undefined;
+                });
+            }
+            else {
+                record(ctx, config, "rules", formatRules(rules, config.widget.rules), [`${rules.tool} ${rules.path}: ${rules.skippedReason}`]);
             }
             const hits = rulesGuard.notesFor(verdict.summary.location === "inside_project" ? verdict.summary.path : undefined, config.rules.sensitivePaths);
             if (hits.length && verdict.summary.path) {
@@ -1265,17 +1400,29 @@ export default function wardenExtension(pi) {
                         ctx.ui.notify(`warden · sensitive path · ${verdict.summary.path} (${hits.map(hit => hit.glob).join(", ")}); the agent was given the note`, "warning");
                 });
                 noteGuards.add("rules");
-                notes.push(told);
+                pathNotes.push(told);
             }
         }
-        if (notes.length) {
-            const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
-            for (const traceNote of pathNoteTraces)
-                traceNote(delivered);
-            pathNoteTraces.length = 0;
-        }
+        /** Sends the combined steer once the call's fate is known; `proceeds` is false when the call does not run. */
+        const deliverNotes = (proceeds) => {
+            for (const contentNote of contentNotes) {
+                const note = contentNote(proceeds);
+                if (!note)
+                    continue;
+                noteGuards.add(note.guard);
+                notes.push(note.text);
+            }
+            notes.push(...pathNotes);
+            if (notes.length) {
+                const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
+                for (const traceNote of pathNoteTraces)
+                    traceNote(delivered);
+                pathNoteTraces.length = 0;
+            }
+        };
         const warnSteer = (reasons) => reasons.length > 0 && steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
         if (verdict.level === "warn") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
@@ -1287,6 +1434,7 @@ export default function wardenExtension(pi) {
             return undefined;
         }
         if (verdict.level === "deny") {
+            deliverNotes(false);
             stats.held++;
             track(true, "declined", "deny");
             if (ctx.hasUI && config.notices)
@@ -1295,6 +1443,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
+            deliverNotes(true);
             track(false);
             return undefined;
         }
@@ -1307,6 +1456,7 @@ export default function wardenExtension(pi) {
         if (dialogRule && ctx.hasUI) {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1316,6 +1466,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         if (mode === "advise") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
@@ -1327,6 +1478,7 @@ export default function wardenExtension(pi) {
         if (mode === "confirm") {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1335,6 +1487,7 @@ export default function wardenExtension(pi) {
             track(true, "declined", "dialog");
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
+        deliverNotes(false);
         stats.held++;
         actionGuard.hold(task);
         track(true);
@@ -1349,6 +1502,13 @@ export default function wardenExtension(pi) {
             return;
         const textBlocks = event.content.filter(part => part.type === "text");
         const text = textBlocks.map(part => part.text).join("\n");
+        const scratch = scratchPending.get(event.toolCallId);
+        if (scratch) {
+            scratchPending.delete(event.toolCallId);
+            for (const [path, identity] of createdScratch(event.toolName, event.input, text, scratch.started, scratch.candidates))
+                sessionScratch.set(path, identity);
+        }
+        pruneScratch(sessionScratch);
         // Repeat detection uses the original result, so its request goes out together with the output check.
         const failed = resultFailed(event.isError, event.details, event.content);
         // ── Conscience: track tool_result for the pending capability ──
@@ -1471,7 +1631,9 @@ export default function wardenExtension(pi) {
         }
         if (config.context.enabled && !earlier && !recallRead && textBlocks.length === 1 && text.length >= config.context.tailMinChars)
             ledger.candidate();
-        if (multiBlock && !ctx.signal?.aborted) {
+        // Captured before the loop so the notice block below knows whether each block already carries its banner.
+        const bannersPlacedWithBlocks = multiBlock && !ctx.signal?.aborted;
+        if (bannersPlacedWithBlocks) {
             // Retention and banners per block; block order and non-text parts are never touched.
             content = [...content];
             let textIndex = 0;
@@ -1539,8 +1701,11 @@ export default function wardenExtension(pi) {
         }
         if (key && !earlier)
             ledger.remember(key, event.toolName, storedPath);
+        // The banner in the result already tells the agent. A steer custom message sent here arrives after the turn ends
+        // when this result closes the turn and starts a new turn to answer a message that asks for nothing, so the notice
+        // rides the result content alone and is never steered.
         if (notice && textBlocks.length) {
-            if (!multiBlock) {
+            if (!bannersPlacedWithBlocks) {
                 let index = 0;
                 content = content.map(part => {
                     if (part.type !== "text")
@@ -1549,13 +1714,12 @@ export default function wardenExtension(pi) {
                     return { ...part, text: `${index === 1 ? `${notice}\n\n` : ""}${part.text}${index === textBlocks.length ? `\n\n${notice}` : ""}` };
                 });
             }
-            const delivered = steer(config, "security", notice);
             record(ctx, config, "security", renderTemplate(config.widget.security, {
                 tool: event.toolName, injection: output.injection?.toFixed(2), exfiltration: output.exfiltration?.toFixed(2),
                 status: [output.suspicious && "untrusted instructions", output.secret && "possible credentials"].filter(Boolean).join(", "),
             }), [
                 `jev: injection ${output.injection?.toFixed(2) ?? "not judged"}; exfiltration ${output.exfiltration?.toFixed(2) ?? "not judged"}`,
-                `output sample: ${redact(text).slice(0, 300)}`, delivered ? `agent told: ${notice}` : `steer recorded, not delivered (a repeat or the per-run budget): ${notice}`,
+                `output sample: ${redact(text).slice(0, 300)}`, `agent told by the banner in the tool result: ${notice}`,
             ]);
         }
         // Stuck-loop diff: when the verdict is stuck on a failed result and a previous failed output
@@ -1745,11 +1909,13 @@ export default function wardenExtension(pi) {
             catch {
                 toolInfos = [];
             }
-            const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+            const prompt = latestUserPrompt(ctx);
+            const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+            const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
             const activeSkills = cachedSkills.map(s => s.name);
             const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
             try {
-                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                 if (conscienceGeneration !== myGeneration)
                     return;
                 assessmentsThisPrompt++;
@@ -1863,7 +2029,7 @@ export default function wardenExtension(pi) {
                         : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
-                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
+                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors, ${stats.cooldownSkips} checks without Jev during a judge cooldown; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
                         formatSteers(stats),
                         `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / steer ${config.action.offTask.steer} (never holds); intent mismatch ${config.action.intentMismatch} (${config.action.visibleMismatch} on a visible action); stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
@@ -1881,11 +2047,16 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "trace") {
                     if (!ctx.hasUI) {
-                        const entries = trace.entries();
-                        report(entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.");
+                        report(traceText());
                         return;
                     }
-                    togglePanel(ctx.ui, config);
+                    const opened = togglePanel(ctx.ui, config);
+                    // RPC mode has a UI but settles custom() without building the component, so the sidebar never shows. hasUI
+                    // is true there; only the host not asking for the component tells the two apart. Not awaited: in the
+                    // terminal `closed` settles when the user closes the sidebar.
+                    const fallback = () => { if (opened && !opened.built())
+                        ctx.ui.notify(traceText(), "info"); };
+                    void opened?.closed.then(fallback, fallback);
                     return;
                 }
                 if (action === "recommend") {