pi-warden 0.40.2 → 0.48.1

package/dist/extension.js

@@ -6,13 +6,13 @@ import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
-import { backendHost, disclosureFor, judgeOptions, keyEnvFor, resolveBackend } from "./backend.js";
+import { backendHost, disclosureFor, judgeOptions, keyEnvFor, loginStoresKey, resolveBackend } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
 import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { createdScratch, evaluateAction, formatVerdictTokens, higher, hostPaths, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets, isVisibleCommand } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
@@ -31,39 +31,19 @@ import { assess } from "./conscience.js";
 import { loadSkillBody, buildLoadMessage, policyMatches, CONSCIENCE_BETA_POLICY, recordFileIdentity, clearFileIdentityCache } from "./load.js";
 import { buildIndexPrompt, readIndex, writeIndex, validateIndex, indexStats, indexPath, ensureIndexDir } from "./index-cmd.js";
 import { fileContentHash } from "./hashing.js";
-/** Classify a conscience assessment error into a safe category (spec §6: never exception bodies). */
-function classifyConscienceError(err) {
-    if (err && typeof err === "object" && "code" in err) {
-        const code = err.code;
-        if (code === "timeout")
-            return "timeout";
-        if (code === "http" || code === "connection" || code === "response")
-            return "network";
-        if (code === "configuration" || code === "validation")
-            return "configuration";
-        if (code === "budget" || code === "aborted")
-            return "other";
-    }
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/timeout|timed out/i.test(msg))
-        return "timeout";
-    if (/auth|key|credential|401|403/i.test(msg))
-        return "auth";
-    if (/network|fetch|connect|ECONNREFUSED|ENOTFOUND/i.test(msg))
-        return "network";
-    return "other";
-}
+import { classifyJudgeError, cooldownFailureKind, JudgeCooldown } from "./judge-cooldown.js";
 import { openConfigPanel, openTracePanel } from "./panel.js";
-import { completeConfig, shapeWarning } from "./shape.js";
+import { completeConfig, shapeWarning, taskSpine } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { buildCompactSnapshot, compactAppendix } from "./compact.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
+import { TraceFile, judgmentsState, traceDir, traceFilePath } from "./trace-file.js";
 import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
+const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, cooldownSkips: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
  * message count; the line says so instead of hiding it. Worst offender first: that is the number worth acting on.
@@ -133,12 +113,24 @@ export function siblingToolCalls(ctx) {
     }
     return [];
 }
+/** Whether the call is a shell command with a visible effect (commit, push, merge, tag, reset, pull request, release, publish). */
+export function isVisibleAction(tool, input) {
+    const view = commandOf(tool, input);
+    return view?.shell === true && isVisibleCommand(view.command);
+}
 /**
- * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
- * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ * The agent's own words for the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the text of the assistant message right before it with no tool call in between. Text from before an
+ * earlier tool call described that call, so it is no plan and the intent question is not asked. The exception is
+ * `visibleAction` (a commit, push, merge, tag, reset, pull request, release, or publish, by `isVisibleCommand`): such a
+ * call is still judged against the latest assistant text since the user's prompt, because an unannounced commit or push
+ * after an older plan is the mismatch users object to. Sent as `plan`; it explains the step and cannot approve it.
  */
-export function assistantPlan(ctx) {
+export function assistantPlan(ctx, visibleAction = false) {
     const entries = ctx.sessionManager.getBranch();
+    const plan = planForCall(entries);
+    if (plan !== undefined || !visibleAction)
+        return plan;
     for (let index = entries.length - 1; index >= 0; index--) {
         const entry = entries[index];
         if (entry?.type !== "message")
@@ -147,13 +139,61 @@ export function assistantPlan(ctx) {
             return undefined;
         if (entry.message.role !== "assistant")
             continue;
+        const text = assistantText(entry.message.content);
+        if (text)
+            return text;
+    }
+    return undefined;
+}
+function assistantText(content) {
+    return (typeof content === "string" ? content : content.filter((part) => part.type === "text").map(part => part.text).join("\n")).trim();
+}
+/** The text of the message that carries the call, or of the assistant message right before it with no tool call in between. */
+function planForCall(entries) {
+    let carrierSeen = false;
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "message")
+            continue;
+        const { role } = entry.message;
+        if (role === "user")
+            return undefined;
+        // A result after the carrier belongs to a sibling call; one before it means an earlier tool call ran.
+        if (role === "toolResult") {
+            if (carrierSeen)
+                return undefined;
+            continue;
+        }
+        if (role !== "assistant")
+            continue;
         const content = entry.message.content;
-        const text = typeof content === "string" ? content : content.filter((part) => part.type === "text").map(part => part.text).join("\n");
-        if (text.trim())
-            return text.trim();
+        const text = assistantText(content);
+        if (!carrierSeen) {
+            if (text)
+                return text;
+            carrierSeen = true;
+            continue;
+        }
+        if (typeof content !== "string" && content.some(part => part.type === "toolCall"))
+            return undefined;
+        return text || undefined;
     }
     return undefined;
 }
+/**
+ * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
+ * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
+ * names a key value or a path.
+ */
+export function judgmentsOffText(reason, backend, headless, rejectedEnv) {
+    switch (reason) {
+        case "no_consent": return `warden: Jev judgments are off (no consent). ${headless ? "Set PI_WARDEN_ENABLED=1." : "Run /warden enable."}`;
+        case "no_key": return `warden: Jev judgments are off (no key for ${backend}). Set ${keyEnvFor(backend)}${loginStoresKey(backend) ? " or run /typesafe login" : ""}.`;
+        case "key_rejected": return rejectedEnv
+            ? `warden: Jev judgments are off (the key in ${rejectedEnv} was rejected). Check the key, then run /warden status.`
+            : "warden: Jev judgments are off (the key saved by /typesafe login was rejected). Run /typesafe login.";
+    }
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -256,10 +296,19 @@ export default function wardenExtension(pi) {
     // fail-closes (no delivery) until the policy is re-measured.
     const consciencePolicy = CONSCIENCE_BETA_POLICY;
     let client;
+    const cooldown = new JudgeCooldown();
+    let judgeConfig;
+    /** Where cooldown notices go; unset headless, where a failure is already silent (see noteError). */
+    let noticeUi;
     let budgetExhausted = false;
     let stats = freshStats();
     const widget = new Map();
     const trace = new Trace();
+    // The trace file for a host without the terminal UI; set per session when PI_WARDEN_TRACE_DIR is an absolute path.
+    let traceFile;
+    let unsubscribeTraceFile;
+    // Directories outside the project the host lets its agent write; set per session from PI_WARDEN_HOST_PATHS.
+    let sessionHostPaths = [];
     let panel;
     let configPanel;
     let lastUi;
@@ -294,6 +343,8 @@ export default function wardenExtension(pi) {
     let fullOutputs = new Map();
     let evidence = emptyEvidence();
     let doneNudged = false;
+    /** True from a delivered warden follow-up that starts a turn until the next run starts: that run keeps the evidence. */
+    let wardenContinuation = false;
     let warnedFallback = false;
     let warnedMissingRules = false;
     /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
@@ -309,6 +360,13 @@ export default function wardenExtension(pi) {
     const secretsSeen = new Set();
     // Subagent report entries already triaged, by session entry id; the wake window outlives one scan.
     const subagentSeen = new Set();
+    // Command families already steered toward filtered output this session: one steer per family.
+    const largeOutputSteered = new Set();
+    // Real paths the agent created under the temp directory this session, with the identity each had when recorded.
+    // A recursive rm of only these is not destructive; a record whose path is gone or replaced is dropped after each call.
+    const sessionScratch = new Map();
+    // Per tool call id: when it started and the temp paths it may create that did not exist yet.
+    const scratchPending = new Map();
     const wakePolicy = new WakePolicy(0);
     const runaway = new RunawayMonitor();
     // Runs stopped by the runaway guard for the current user prompt; the first one gets a recovery turn, later ones wait for the user.
@@ -368,14 +426,79 @@ export default function wardenExtension(pi) {
         return config;
     };
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
+    /** Why no judge is available, or undefined when one is. The notice, the trace file, and the conscience all use it. */
+    const judgmentsOffReason = (config) => {
+        if (!consentGiven(config))
+            return "no_consent";
+        if (budgetExhausted)
+            return "budget";
+        const auth = authState({ backend: config.typesafeBackend });
+        if (auth.usable)
+            return undefined;
+        // No key in effect, or one whose last request came back 401 or 403.
+        return auth.source === undefined ? "no_key" : "key_rejected";
+    };
+    // Where the judgments-off notice goes: the session's UI, or a status message for a headless session.
+    let judgmentsNotify;
+    let judgmentsHeadless = false;
+    const judgmentsReported = new Set();
+    /** Say once per session and reason that judgments are off, and record the state in the trace file. */
+    const noteJudgments = (config, reason) => {
+        traceFile?.judgments(judgmentsState(reason));
+        // The budget has its own notice in noteError.
+        if (reason === undefined || reason === "budget" || judgmentsReported.has(reason))
+            return;
+        judgmentsReported.add(reason);
+        const auth = reason === "key_rejected" ? authState({ backend: config.typesafeBackend }) : undefined;
+        judgmentsNotify?.(judgmentsOffText(reason, config.typesafeBackend, judgmentsHeadless, auth?.kind === "environment" ? auth.keyName : undefined));
+    };
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
     /** A consent flag is not proof that judgments happen; check the key state for the chosen backend. */
     const judgeFor = (config) => {
-        if (!consentGiven(config) || budgetExhausted)
+        const off = judgmentsOffReason(config);
+        noteJudgments(config, off);
+        if (off)
             return undefined;
-        if (!authState({ backend: config.typesafeBackend }).usable)
+        judgeConfig = config;
+        // Absent, exactly as with no judge configured, so no guard needs to know a cooldown exists.
+        if (cooldown.active()) {
+            stats.cooldownSkips++;
             return undefined;
-        return client ??= createTypeSafe(judgeOptions(config));
+        }
+        return client ??= watched(createTypeSafe(judgeOptions(config)));
+    };
+    /** Every guard reaches the backend through `evaluate`, so this one seam sees each failure and each success. */
+    const watched = (typesafe) => new Proxy(typesafe, {
+        get(target, prop, receiver) {
+            if (prop !== "evaluate")
+                return Reflect.get(target, prop, receiver);
+            return async (...args) => {
+                try {
+                    const result = await target.evaluate(...args);
+                    tellCooldown(cooldown.success());
+                    return result;
+                }
+                catch (err) {
+                    const kind = cooldownFailureKind(err, args[1]?.signal);
+                    if (kind)
+                        tellCooldown(cooldown.failure(kind, judgeConfig?.judge ?? defaultConfig().judge));
+                    throw err;
+                }
+            };
+        },
+    });
+    const tellCooldown = (event) => {
+        if (!event || !noticeUi)
+            return;
+        if (event.type === "recovered") {
+            noticeUi.notify("warden: judgments resumed.", "info");
+            return;
+        }
+        const seconds = Math.round(event.ms / 1000);
+        const remedy = event.kind === "auth"
+            ? ` Set ${keyEnvFor(judgeConfig?.typesafeBackend ?? "typesafe")} or run /warden enable.`
+            : event.kind === "configuration" ? " /warden status shows the backend setup." : "";
+        noticeUi.notify(`warden: judgments paused for ${seconds}s after a ${event.kind} failure; pattern checks run alone until then.${remedy}`, "warning");
     };
     const noteError = (ctx, message, code) => {
         stats.errors++;
@@ -387,15 +510,22 @@ export default function wardenExtension(pi) {
     /** Click, shortcut, and /warden trace all toggle the same sidebar. */
     const togglePanel = (ui, config) => {
         if (!ui)
-            return;
+            return undefined;
         if (panel) {
             panel.close();
-            return;
+            return undefined;
         }
         const opened = openTracePanel(ui, trace, { width: config.widget.panelWidth });
         panel = opened;
         opened.closed.catch(() => undefined).finally(() => { if (panel === opened)
             panel = undefined; });
+        return opened;
+    };
+    /** The last 20 trace entries as text, newest last, for a host that cannot show the sidebar. */
+    const traceText = () => {
+        const entries = trace.entries();
+        const text = entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.";
+        return traceFile ? `${text}\nTrace file: ${traceFile.path}` : text;
     };
     /** The config overlay toggles the same way the sidebar does, so the hint in its header is true. */
     const toggleConfigPanel = (ui, config) => {
@@ -541,9 +671,10 @@ export default function wardenExtension(pi) {
             stats.steerGuards[name] = (stats.steerGuards[name] ?? 0) + 1;
         const critical = names.every(name => CRITICAL_STEER_GUARDS.has(name));
         // A notice delivered once is already in the agent's context. Sending the repeat again costs the accounting turn it
-        // forbids, so repeats are recorded only. The same goes for notices past the per-run steer budget: every delivered
-        // steer costs at least one LLM turn, and a closing run that collects six notices collects six restatements of the
-        // final status. A notice skipped for the budget keeps its fingerprint, so the same notice can deliver next run.
+        // forbids, so repeats are recorded only. The same goes for notices past the per-run steer budget: a steer sent during
+        // a tool call rides the request the tool result needs (tests/steer-delivery.test.ts), but one queued after the run
+        // ends starts a new model turn, and every steer asks the agent for a reply sentence; a closing run that collects six
+        // notices collects six restatements of the final status. A notice skipped for the budget keeps its fingerprint, so the same notice can deliver next run.
         // Critical guards (stuck, done, runaway recovery, subagent wake) always deliver: their message starts the turn.
         const overBudget = config.steerBudget > 0 && steersThisRun >= config.steerBudget;
         const deliver = critical || (!overBudget && !steerRepeats.seen(content));
@@ -555,6 +686,8 @@ export default function wardenExtension(pi) {
         steersThisRun++;
         const { display, ...delivery } = options ?? { deliverAs: "steer" };
         pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: display ?? config.steerVisible }, delivery);
+        if (delivery.triggerTurn)
+            wardenContinuation = true;
         return true;
     };
     /**
@@ -617,6 +750,8 @@ export default function wardenExtension(pi) {
     pi.on("session_start", async (_event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
+        cooldown.reset();
         if (_event.reason === "reload" || _event.reason === "new")
             conscienceGeneration++;
         client = undefined;
@@ -634,11 +769,33 @@ export default function wardenExtension(pi) {
         rulesGuard.reset();
         holds.reset();
         regretCandidates = [];
-        holdLog = new HoldLog(holdLogPath(typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid)));
+        const sessionId = typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid);
+        holdLog = new HoldLog(holdLogPath(sessionId));
+        unsubscribeTraceFile?.();
+        unsubscribeTraceFile = undefined;
+        traceFile = undefined;
+        judgmentsReported.clear();
+        judgmentsHeadless = !ctx.hasUI;
+        judgmentsNotify = text => { if (ctx.hasUI)
+            ctx.ui.notify(text, "warning");
+        else
+            pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+        sessionHostPaths = hostPaths();
+        const dir = traceDir();
+        if (dir) {
+            const warn = (text) => { if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+            const opening = loadConfig();
+            traceFile = new TraceFile(traceFilePath(dir, sessionId), dir, { sessionId, cwd: ctx.cwd, mode: opening.mode, judgments: judgmentsState(judgmentsOffReason(opening)) }, warn);
+            unsubscribeTraceFile = trace.subscribe(traceFile.listener);
+        }
         arming.reset();
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
+        wardenContinuation = false;
         prose.reset();
         // Clean up temp output dirs from the previous session.
         for (const dir of ledger.storedPaths()) {
@@ -653,6 +810,9 @@ export default function wardenExtension(pi) {
         compressionLearner.reset();
         secretsSeen.clear();
         subagentSeen.clear();
+        largeOutputSteered.clear();
+        sessionScratch.clear();
+        scratchPending.clear();
         wakePolicy.reset();
         steerRepeats.reset();
         steersThisRun = 0;
@@ -688,10 +848,12 @@ export default function wardenExtension(pi) {
     pi.on("before_agent_start", async (event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
         const config = configFor(ctx);
         attempts = new AttemptWindow(config.stuck.window);
         fullOutputs = new Map();
         doneNudged = false;
+        wardenContinuation = false;
         steersThisRun = 0;
         finals.reset();
         runaway.reset();
@@ -744,6 +906,7 @@ export default function wardenExtension(pi) {
                 const truncationRecorded = event.prompt.length > 2000 ? [`prompt truncated from ${event.prompt.length} to 2000 chars`] : [];
                 // Build recent context from session branch (up to 4 messages, 500 chars each)
                 const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                const spine = taskSpine(branch, event.prompt);
                 const recentMessages = [];
                 for (const entry of branch.slice(-6)) {
                     if (recentMessages.length >= 4)
@@ -804,7 +967,7 @@ export default function wardenExtension(pi) {
                     // it. Empty until the first evaluate call, and an empty model never matches a policy, so the gate fails closed.
                     let judgeModel = "";
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
-                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, judgmentsOff: judgmentsOffReason(config), config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     // Check generation after await
                     if (conscienceGeneration !== myGeneration) {
                         record(ctx, config, "conscience", "stale: generation changed during assessment", ["trigger: before_agent_start", `generation: ${myGeneration} → ${conscienceGeneration}`, `skipReason: stale`]);
@@ -889,7 +1052,7 @@ export default function wardenExtension(pi) {
                     }
                 }
                 catch (err) {
-                    const category = classifyConscienceError(err);
+                    const category = classifyJudgeError(err);
                     if (!warnedErrorCategories.has(category)) {
                         warnedErrorCategories.add(category);
                         console.warn(`pi-warden: conscience ${category}`);
@@ -925,7 +1088,10 @@ export default function wardenExtension(pi) {
                 const judge = judgeFor(config);
                 if (judge && cachedSkills.length > 0) {
                     const myGeneration = conscienceGeneration;
-                    const redactedText = redact(typeof event.message.content === "string" ? event.message.content : "").slice(0, 2000);
+                    const prompt = typeof event.message.content === "string" ? event.message.content : "";
+                    const redactedText = redact(prompt).slice(0, 2000);
+                    const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                    const spine = taskSpine(branch, prompt);
                     let toolInfos = [];
                     try {
                         toolInfos = pi.getAllTools().map((t) => ({ name: t.name, description: t.description }));
@@ -936,13 +1102,13 @@ export default function wardenExtension(pi) {
                     const activeSkills = cachedSkills.map(s => s.name);
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                     try {
-                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                         if (conscienceGeneration !== myGeneration)
                             return;
                         record(ctx, config, "conscience", `queued prompt assessed → ${result.selected ? `${result.selected.kind}:${result.selected.id}` : "none"} (${result.skipReason ?? "none"})`, ["trigger: message_start", `origin: queued`, `skipReason: ${result.skipReason ?? "none"}`]);
                     }
                     catch (err) {
-                        const cat = classifyConscienceError(err);
+                        const cat = classifyJudgeError(err);
                         if (!warnedErrorCategories.has(cat)) {
                             warnedErrorCategories.add(cat);
                             console.warn(`pi-warden: conscience ${cat}`);
@@ -980,9 +1146,12 @@ export default function wardenExtension(pi) {
         conscienceGeneration++;
         ctx.abort();
     });
-    // Each low-level run collects its own evidence of changes and checks.
+    // Each low-level run collects its own evidence of changes and checks. A run that a warden follow-up started continues
+    // the previous run's work, so it keeps that evidence: the changes behind a done-check nudge still need a passing check.
     pi.on("agent_start", async () => {
-        evidence = emptyEvidence();
+        if (!wardenContinuation)
+            evidence = emptyEvidence();
+        wardenContinuation = false;
     });
     // Every turn that runs after a compression is a turn that did not carry the removed text.
     pi.on("turn_end", async (_event, ctx) => {
@@ -1002,11 +1171,13 @@ export default function wardenExtension(pi) {
                 catch {
                     toolInfos = [];
                 }
-                const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+                const prompt = latestUserPrompt(ctx);
+                const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+                const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
                 const activeSkills = cachedSkills.map(s => s.name);
                 const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                 try {
-                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     if (conscienceGeneration !== myGeneration)
                         return;
                     assessmentsThisPrompt++;
@@ -1031,6 +1202,8 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        if (event.toolName === "bash" || event.toolName === "write")
+            scratchPending.set(event.toolCallId, { started: Date.now(), candidates: scratchCandidates(event.toolName, event.input, ctx.cwd) });
         // ── Conscience: track tool attempts on the selected capability ──
         if (config.conscience.enabled && selectedCapability && !triggerConsumed) {
             if (selectedCapability.kind === "tool" && event.toolName === selectedCapability.id) {
@@ -1106,7 +1279,7 @@ export default function wardenExtension(pi) {
             ? rulesGuard.inspect(call, siblings, { cwd: ctx.cwd, config: config.rules, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         rulesCheck?.catch(() => undefined);
-        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined });
+        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx, isVisibleAction(event.toolName, event.input)), spine: taskSpine(ctx.sessionManager.getBranch()) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, largeOutput: config.context.largeOutput, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined, scratch: sessionScratch, hostPaths: sessionHostPaths });
         if (verdict.source === "skipped")
             return;
         // Arming check: if any armed rule's command regex matches this call, inject a hit into the verdict.
@@ -1162,6 +1335,11 @@ export default function wardenExtension(pi) {
         // Notes for the agent about the content it just wrote: slop, rule violations, and sensitive paths arrive as one message.
         const notes = [];
         const noteGuards = new Set();
+        /** Slop and rule findings say "just written", so they wait until the call proceeds. A held, denied, or declined write
+         * never lands and drops them; an approved retry is judged again and brings its own. They go between the action notes
+         * and the sensitive-path notes, the order of the combined message. */
+        const contentNotes = [];
+        const pathNotes = [];
         /** Sensitive-path notes ride with the combined steer for this call; their trace waits for the delivery result. */
         const pathNoteTraces = [];
         if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
@@ -1226,15 +1404,24 @@ export default function wardenExtension(pi) {
             noteGuards.add("action");
             notes.push(shouldProceedMessage(verdict));
         }
+        const largeOutput = largeOutputNotice(verdict, largeOutputSteered);
+        if (largeOutput) {
+            noteGuards.add("action");
+            notes.push(largeOutput);
+        }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
-            noteGuards.add("action");
-            for (const symptom of verdict.slopSymptoms)
-                slopCounts[symptom]++;
+            const symptoms = verdict.slopSymptoms;
             const where = verdict.summary.path ?? event.toolName;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · slop · ${where}: ${verdict.slopReasons.join("; ")}`, "warning");
-            notes.push(slopSteer(where, verdict.slopSymptoms, slopCounts));
+            contentNotes.push(proceeds => {
+                if (!proceeds)
+                    return undefined;
+                for (const symptom of symptoms)
+                    slopCounts[symptom]++;
+                return { guard: "action", text: slopSteer(where, symptoms, slopCounts) };
+            });
         }
         if (rulesCheck) {
             const rules = await rulesCheck;
@@ -1242,16 +1429,23 @@ export default function wardenExtension(pi) {
                 stats.ruleChecks++;
                 if (rules.error)
                     noteError(ctx, rules.error, rules.errorCode);
-                const told = rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
-                record(ctx, config, "rules", formatRules(rules, config.widget.rules), rulesDetails(rules, told));
                 holds.recordRules({ source: rules.source, path: rules.path, findings: rules.findings.map(f => ({ name: f.name, violation: f.violation })), ...(rules.error ? { error: rules.error } : {}) });
-                if (told) {
+                if (rules.findings.length) {
                     stats.ruleViolations++;
-                    noteGuards.add("rules");
                     if (ctx.hasUI && config.notices)
                         ctx.ui.notify(`warden · rules · ${rules.path}: ${rules.findings.map(finding => `${finding.name} (${finding.violation.toFixed(2)})`).join("; ")}`, "warning");
-                    notes.push(told);
                 }
+                contentNotes.push(proceeds => {
+                    const told = proceeds && rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
+                    const details = rulesDetails(rules, told);
+                    if (!proceeds && rules.findings.length)
+                        details.push("agent not told: the write was held");
+                    record(ctx, config, "rules", formatRules(rules, config.widget.rules), details);
+                    return told ? { guard: "rules", text: told } : undefined;
+                });
+            }
+            else {
+                record(ctx, config, "rules", formatRules(rules, config.widget.rules), [`${rules.tool} ${rules.path}: ${rules.skippedReason}`]);
             }
             const hits = rulesGuard.notesFor(verdict.summary.location === "inside_project" ? verdict.summary.path : undefined, config.rules.sensitivePaths);
             if (hits.length && verdict.summary.path) {
@@ -1265,17 +1459,29 @@ export default function wardenExtension(pi) {
                         ctx.ui.notify(`warden · sensitive path · ${verdict.summary.path} (${hits.map(hit => hit.glob).join(", ")}); the agent was given the note`, "warning");
                 });
                 noteGuards.add("rules");
-                notes.push(told);
+                pathNotes.push(told);
             }
         }
-        if (notes.length) {
-            const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
-            for (const traceNote of pathNoteTraces)
-                traceNote(delivered);
-            pathNoteTraces.length = 0;
-        }
+        /** Sends the combined steer once the call's fate is known; `proceeds` is false when the call does not run. */
+        const deliverNotes = (proceeds) => {
+            for (const contentNote of contentNotes) {
+                const note = contentNote(proceeds);
+                if (!note)
+                    continue;
+                noteGuards.add(note.guard);
+                notes.push(note.text);
+            }
+            notes.push(...pathNotes);
+            if (notes.length) {
+                const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
+                for (const traceNote of pathNoteTraces)
+                    traceNote(delivered);
+                pathNoteTraces.length = 0;
+            }
+        };
         const warnSteer = (reasons) => reasons.length > 0 && steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
         if (verdict.level === "warn") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
@@ -1287,6 +1493,7 @@ export default function wardenExtension(pi) {
             return undefined;
         }
         if (verdict.level === "deny") {
+            deliverNotes(false);
             stats.held++;
             track(true, "declined", "deny");
             if (ctx.hasUI && config.notices)
@@ -1295,6 +1502,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
+            deliverNotes(true);
             track(false);
             return undefined;
         }
@@ -1307,6 +1515,7 @@ export default function wardenExtension(pi) {
         if (dialogRule && ctx.hasUI) {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1316,6 +1525,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         if (mode === "advise") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
@@ -1327,6 +1537,7 @@ export default function wardenExtension(pi) {
         if (mode === "confirm") {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1335,6 +1546,7 @@ export default function wardenExtension(pi) {
             track(true, "declined", "dialog");
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
+        deliverNotes(false);
         stats.held++;
         actionGuard.hold(task);
         track(true);
@@ -1349,6 +1561,13 @@ export default function wardenExtension(pi) {
             return;
         const textBlocks = event.content.filter(part => part.type === "text");
         const text = textBlocks.map(part => part.text).join("\n");
+        const scratch = scratchPending.get(event.toolCallId);
+        if (scratch) {
+            scratchPending.delete(event.toolCallId);
+            for (const [path, identity] of createdScratch(event.toolName, event.input, text, scratch.started, scratch.candidates))
+                sessionScratch.set(path, identity);
+        }
+        pruneScratch(sessionScratch);
         // Repeat detection uses the original result, so its request goes out together with the output check.
         const failed = resultFailed(event.isError, event.details, event.content);
         // ── Conscience: track tool_result for the pending capability ──
@@ -1471,7 +1690,9 @@ export default function wardenExtension(pi) {
         }
         if (config.context.enabled && !earlier && !recallRead && textBlocks.length === 1 && text.length >= config.context.tailMinChars)
             ledger.candidate();
-        if (multiBlock && !ctx.signal?.aborted) {
+        // Captured before the loop so the notice block below knows whether each block already carries its banner.
+        const bannersPlacedWithBlocks = multiBlock && !ctx.signal?.aborted;
+        if (bannersPlacedWithBlocks) {
             // Retention and banners per block; block order and non-text parts are never touched.
             content = [...content];
             let textIndex = 0;
@@ -1539,8 +1760,11 @@ export default function wardenExtension(pi) {
         }
         if (key && !earlier)
             ledger.remember(key, event.toolName, storedPath);
+        // The banner in the result already tells the agent, so the notice rides the result content alone and is not also
+        // steered. A steer sent here would join the request that carries this result and cost no extra turn
+        // (tests/steer-delivery.test.ts); it would only repeat the banner.
         if (notice && textBlocks.length) {
-            if (!multiBlock) {
+            if (!bannersPlacedWithBlocks) {
                 let index = 0;
                 content = content.map(part => {
                     if (part.type !== "text")
@@ -1549,13 +1773,12 @@ export default function wardenExtension(pi) {
                     return { ...part, text: `${index === 1 ? `${notice}\n\n` : ""}${part.text}${index === textBlocks.length ? `\n\n${notice}` : ""}` };
                 });
             }
-            const delivered = steer(config, "security", notice);
             record(ctx, config, "security", renderTemplate(config.widget.security, {
                 tool: event.toolName, injection: output.injection?.toFixed(2), exfiltration: output.exfiltration?.toFixed(2),
                 status: [output.suspicious && "untrusted instructions", output.secret && "possible credentials"].filter(Boolean).join(", "),
             }), [
                 `jev: injection ${output.injection?.toFixed(2) ?? "not judged"}; exfiltration ${output.exfiltration?.toFixed(2) ?? "not judged"}`,
-                `output sample: ${redact(text).slice(0, 300)}`, delivered ? `agent told: ${notice}` : `steer recorded, not delivered (a repeat or the per-run budget): ${notice}`,
+                `output sample: ${redact(text).slice(0, 300)}`, `agent told by the banner in the tool result: ${notice}`,
             ]);
         }
         // Stuck-loop diff: when the verdict is stuck on a failed result and a previous failed output
@@ -1745,11 +1968,13 @@ export default function wardenExtension(pi) {
             catch {
                 toolInfos = [];
             }
-            const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+            const prompt = latestUserPrompt(ctx);
+            const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+            const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
             const activeSkills = cachedSkills.map(s => s.name);
             const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
             try {
-                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                 if (conscienceGeneration !== myGeneration)
                     return;
                 assessmentsThisPrompt++;
@@ -1779,7 +2004,7 @@ export default function wardenExtension(pi) {
         const proseCheck = config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars
             ? evaluateProse(task, finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
-        const doneCheck = config.done.enabled && !doneNudged && needsDoneCheck(evidence)
+        const doneCheck = config.done.enabled && needsDoneCheck(evidence)
             ? evaluateDone(task, finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         if (proseCheck) {
@@ -1809,7 +2034,8 @@ export default function wardenExtension(pi) {
         const verdict = await doneCheck;
         if (verdict.error)
             noteError(ctx, verdict.error, verdict.errorCode);
-        const nudge = verdict.unverified && config.done.nudge ? doneNudge(verdict) : undefined;
+        // At most one nudge per user prompt; a later unverified claim is still judged and recorded.
+        const nudge = verdict.unverified && config.done.nudge && !doneNudged ? doneNudge(verdict) : undefined;
         record(ctx, config, "done", formatDone(verdict, config.widget.done), doneDetails(verdict, finalMessage, nudge));
         if (!verdict.unverified)
             return;
@@ -1863,7 +2089,7 @@ export default function wardenExtension(pi) {
                         : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
-                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
+                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors, ${stats.cooldownSkips} checks without Jev during a judge cooldown; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
                         formatSteers(stats),
                         `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / steer ${config.action.offTask.steer} (never holds); intent mismatch ${config.action.intentMismatch} (${config.action.visibleMismatch} on a visible action); stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
@@ -1881,11 +2107,16 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "trace") {
                     if (!ctx.hasUI) {
-                        const entries = trace.entries();
-                        report(entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.");
+                        report(traceText());
                         return;
                     }
-                    togglePanel(ctx.ui, config);
+                    const opened = togglePanel(ctx.ui, config);
+                    // RPC mode has a UI but settles custom() without building the component, so the sidebar never shows. hasUI
+                    // is true there; only the host not asking for the component tells the two apart. Not awaited: in the
+                    // terminal `closed` settles when the user closes the sidebar.
+                    const fallback = () => { if (opened && !opened.built())
+                        ctx.ui.notify(traceText(), "info"); };
+                    void opened?.closed.then(fallback, fallback);
                     return;
                 }
                 if (action === "recommend") {