pi-warden 0.47.0 → 0.48.1

package/CHANGELOG.md

@@ -8,6 +8,37 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.48.1
+
+### Fixed
+
+- The intent-mismatch question is asked only when the agent stated a plan for the call: the text of the assistant message that makes the call, or of the text-only message right before it with no tool call in between. Before this, a call with no text of its own was judged against the latest assistant text since the user's prompt, often written before several earlier calls. A shell command with a visible effect (a `git` commit, push, merge, tag, or reset, `gh pr`, `gh release`, or `npm publish` in any segment, decided in code before the request) is still judged against the latest assistant text since the prompt, because an unannounced commit or push after an older plan is the mismatch users object to. On the recorded sessions from 2026-09-21 to 2026-09-24, 151 of 163 intent-mismatch notices were judged against stale text; the question would now be asked for 63 of the 163 (8 against the call's own text, 55 visible actions against stale text). A skipped question is one fewer question in the action request.
+
+### Tooling
+
+- `tests/steer-delivery.test.ts` pins that a steer sent from `tool_call` or `tool_result` for the last call of a turn joins the request that carries the tool result and costs no extra model request, so the intent-mismatch notice stays a steer.
+- `scripts/intent-cases.mjs` reads Pi session logs and, for every intent-mismatch notice, classifies where the plan came from: the message that made the call, the text-only message right before it, or text from before earlier tool calls (stale). It also runs the built `assistantPlan` on each call's branch and counts the notices whose question would still be asked. Aggregate counts only; offline.
+
+### Docs
+
+- README leads with a new image of the self-correction loop and its numbers from the first nine days of use; the headline numbers are updated to match.
+
+## 0.48.0
+
+### Added
+
+- `PI_WARDEN_HOST_PATHS`: a `:`-separated list of absolute directories outside the project where the host lets its agent write. A `write` or `edit` in one of them, after `..` and symlinks are resolved, is not held or warned by the outside-project rule; command rules, path rules, deny rules, sensitive paths, secrets, and Jev still apply. Relative entries, empty entries, and `/` are ignored. Environment only; no config file can set it.
+
+## 0.47.1
+
+### Fixed
+
+- A done-check nudge no longer clears the evidence that caused it. A run that a warden follow-up starts (done-check nudge, runaway recovery, subagent wake) keeps the changes and checks of the run before it, so the agent must still show a passing check. A later "done" with no check in that run is judged and recorded as unverified; the one-nudge-per-prompt bound stays. A user prompt still starts with empty evidence.
+
+### Docs
+
+- Field usage report for 2026-09-21 to 2026-09-24 (`eval/reports/2026-09-24-field-usage/`) and `scripts/field-usage.mjs`, which reads Pi session logs and the holds database and prints aggregate counts only. README leads with the field numbers, names the task spine under Privacy, and notes the scratch-delete exemption and the judgments-off notice.
+
 ## 0.47.0
 
 ### Changed

package/README.md

@@ -6,7 +6,11 @@ pi-warden supervises Pi while it works, catching risky actions, ignored rules, s
 
 Instead of interrupting you for every problem, Warden usually feeds the issue back to the agent so it can correct itself and keep going.
 
-![Real verdicts from pi-warden: the same command gets a different verdict depending on what the user asked for](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/preview.png)
+**In nine days of real use: 743 sessions, 193 risky actions held before they ran, 1,292 notes sent to the agent. After a "done" with no test behind it, the agent ran one 78% of the time.**
+
+![pi-warden tells the agent what it got wrong and the agent fixes it: 65 untested "done" claims, 51 then ran the tests, 5 found a failure it had missed; after a hold the agent found a safer way 33 times](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/hero.png)
+
+<sub>Numbers from the first nine days of real use (2026-09-16 to 2026-09-24, 743 sessions). The quoted lines are verbatim. Counted with `scripts/field-usage.mjs`; the [field report](eval/reports/2026-09-24-field-usage/) has the method and what was noise.</sub>
 
 ## Install
 
@@ -39,8 +43,10 @@ Works without any key (offline guards: pattern list, runaway stop, sensitive-pat
 
 ## How intervention works
 
+![Real verdicts from pi-warden: the same command gets a different verdict depending on what the user asked for](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/preview.png)
+
 1. **Read-only? Skip.** `git status`, `ls`, `read` means no request and no trace entry.
-2. **Known-dangerous pattern? Catch it locally.** Force push, `git reset --hard`, recursive `rm`, SQL `DROP` held instantly.
+2. **Known-dangerous pattern? Catch it locally.** Force push, `git reset --hard`, recursive `rm`, SQL `DROP` held instantly. An agent deleting temp-directory scratch it created in the same session is not held (macOS and Windows).
 3. **Needs judgment?** Warden evaluates the action in context.
 4. **Steer or hold.** Most issues go back to the agent so it can correct itself. Irreversible actions can be stopped before they run.
 
@@ -52,6 +58,7 @@ In the default `steer` mode, Warden talks to the agent rather than interrupting
 - **Custom policies**: command, path, and arming rules for your own workflow.
 - **Context saver** trims oversized tool output while keeping the full result retrievable.
 - **Multiple judgment backends**: TypeSafe by default, with OpenRouter support.
+- **Honest about being off**: when judgments cannot run (no consent, no key, a rejected key, budget spent) Warden says so once, with the fix. A failing backend is paused after repeated errors instead of costing a timeout per action.
 - **Full traceability**: inspect what Warden saw, decided, and told the agent.
 - **Desktop alerts** for events that need you.
 
@@ -72,6 +79,19 @@ Jev judges every write and quotes violations back. Rules can be things no linter
 
 ## Does it actually help?
 
+### In daily use
+
+Four days of the maintainer's own work, 397 sessions ([report](eval/reports/2026-09-24-field-usage/), [raw numbers](eval/reports/2026-09-24-field-usage/usage.json), `scripts/field-usage.mjs` to run it on your own logs):
+
+- **Done-check:** 47 nudges; in 35 the agent then ran a test or build.
+- **Holds:** 143 of 19,695 actions. Of the 44 with a recorded outcome, the agent took a safer route 33 times.
+- **Rules:** 195 corrections naming a project rule, including a process wait with no timeout and a home path in a public test fixture.
+- **Context:** about 123,000 tokens of oversized output trimmed in the traced sessions, and no agent needed the full output back.
+
+The report also lists what was noise that week (scratch deletes, credential notices on source code, two over-broad rules) and what changed because of it.
+
+### In benchmarks
+
 In 150 paired agent runs, the control setup violated the tested project rule **6 times**. With Warden: **0**.
 
 An overnight stability run covered **13,952 guard cases across 109 cycles** with no score drift.
@@ -86,7 +106,7 @@ These are project-maintained benchmarks, not universal claims. Raw reports and r
 
 ## Privacy
 
-Depending on the configured judgment backend, Warden sends to your provider: a redacted summary of each guarded call, the agent's plan, up to eight redacted prior messages, and redacted tool-output samples. Secrets are stripped before anything leaves the machine. [Full details.](docs/data-handling.md) Security work — pentesting, incident response, CTF — has its own configuration recipe for keeping samples local and for the friction that credentials and lab setups cause: [Recipe: security work](docs/configuration.md#recipe-security-work).
+Depending on the configured judgment backend, Warden sends to your provider: a redacted summary of each guarded call, the agent's plan, up to eight redacted prior messages, the task spine (your first request in the thread and up to four earlier ones, capped at 1,200 characters), and redacted tool-output samples. Secrets are stripped before anything leaves the machine. [Full details.](docs/data-handling.md) Security work — pentesting, incident response, CTF — has its own configuration recipe for keeping samples local and for the friction that credentials and lab setups cause: [Recipe: security work](docs/configuration.md#recipe-security-work).
 
 ## Documentation
 

package/dist/action-guard.d.ts

@@ -36,6 +36,8 @@ export interface InspectOptions {
     previousActions?: readonly PreviousAction[] | undefined;
     /** Real paths the agent created under the temp directory in this session, forwarded to `evaluateAction`. */
     scratch?: ScratchRecords | undefined;
+    /** Real paths of host directories, forwarded to `evaluateAction`. */
+    hostPaths?: readonly string[] | undefined;
 }
 /**
  * The Action guard for one session. `evaluateAction` judges a single call; this module owns what spans calls:

package/dist/action-guard.js

@@ -20,7 +20,7 @@ export class ActionGuard {
         const { task } = conversation;
         // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
         const retryAfterHold = this.holdPending && this.lastHoldPrompt !== task;
-        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan, spine: conversation.spine }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, largeOutput: options.largeOutput, rules: options.rules, retryAfterHold, previousActions, scratch: options.scratch });
+        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan, spine: conversation.spine }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, largeOutput: options.largeOutput, rules: options.rules, retryAfterHold, previousActions, scratch: options.scratch, hostPaths: options.hostPaths });
         // A retry after a hold stays sequential because an approval consumed by one sibling changes the question for the next.
         if (options.judge && !retryAfterHold) {
             for (const sibling of conversation.siblings ?? []) {

package/dist/extension.d.ts

@@ -20,11 +20,17 @@ export declare function formatSteers(stats: {
  * so judging them one request at a time costs one round trip per call; judging them together costs one round trip.
  */
 export declare function siblingToolCalls(ctx: ExtensionContext): ToolCallRef[];
+/** Whether the call is a shell command with a visible effect (commit, push, merge, tag, reset, pull request, release, publish). */
+export declare function isVisibleAction(tool: string, input: Record<string, unknown>): boolean;
 /**
- * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
- * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ * The agent's own words for the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the text of the assistant message right before it with no tool call in between. Text from before an
+ * earlier tool call described that call, so it is no plan and the intent question is not asked. The exception is
+ * `visibleAction` (a commit, push, merge, tag, reset, pull request, release, or publish, by `isVisibleCommand`): such a
+ * call is still judged against the latest assistant text since the user's prompt, because an unannounced commit or push
+ * after an older plan is the mismatch users object to. Sent as `plan`; it explains the step and cannot approve it.
  */
-export declare function assistantPlan(ctx: ExtensionContext): string | undefined;
+export declare function assistantPlan(ctx: ExtensionContext, visibleAction?: boolean): string | undefined;
 /**
  * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
  * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never

package/dist/extension.js

@@ -12,7 +12,7 @@ import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { createdScratch, evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { createdScratch, evaluateAction, formatVerdictTokens, higher, hostPaths, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets, isVisibleCommand } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
@@ -113,12 +113,24 @@ export function siblingToolCalls(ctx) {
     }
     return [];
 }
+/** Whether the call is a shell command with a visible effect (commit, push, merge, tag, reset, pull request, release, publish). */
+export function isVisibleAction(tool, input) {
+    const view = commandOf(tool, input);
+    return view?.shell === true && isVisibleCommand(view.command);
+}
 /**
- * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
- * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ * The agent's own words for the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the text of the assistant message right before it with no tool call in between. Text from before an
+ * earlier tool call described that call, so it is no plan and the intent question is not asked. The exception is
+ * `visibleAction` (a commit, push, merge, tag, reset, pull request, release, or publish, by `isVisibleCommand`): such a
+ * call is still judged against the latest assistant text since the user's prompt, because an unannounced commit or push
+ * after an older plan is the mismatch users object to. Sent as `plan`; it explains the step and cannot approve it.
  */
-export function assistantPlan(ctx) {
+export function assistantPlan(ctx, visibleAction = false) {
     const entries = ctx.sessionManager.getBranch();
+    const plan = planForCall(entries);
+    if (plan !== undefined || !visibleAction)
+        return plan;
     for (let index = entries.length - 1; index >= 0; index--) {
         const entry = entries[index];
         if (entry?.type !== "message")
@@ -127,10 +139,44 @@ export function assistantPlan(ctx) {
             return undefined;
         if (entry.message.role !== "assistant")
             continue;
+        const text = assistantText(entry.message.content);
+        if (text)
+            return text;
+    }
+    return undefined;
+}
+function assistantText(content) {
+    return (typeof content === "string" ? content : content.filter((part) => part.type === "text").map(part => part.text).join("\n")).trim();
+}
+/** The text of the message that carries the call, or of the assistant message right before it with no tool call in between. */
+function planForCall(entries) {
+    let carrierSeen = false;
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "message")
+            continue;
+        const { role } = entry.message;
+        if (role === "user")
+            return undefined;
+        // A result after the carrier belongs to a sibling call; one before it means an earlier tool call ran.
+        if (role === "toolResult") {
+            if (carrierSeen)
+                return undefined;
+            continue;
+        }
+        if (role !== "assistant")
+            continue;
         const content = entry.message.content;
-        const text = typeof content === "string" ? content : content.filter((part) => part.type === "text").map(part => part.text).join("\n");
-        if (text.trim())
-            return text.trim();
+        const text = assistantText(content);
+        if (!carrierSeen) {
+            if (text)
+                return text;
+            carrierSeen = true;
+            continue;
+        }
+        if (typeof content !== "string" && content.some(part => part.type === "toolCall"))
+            return undefined;
+        return text || undefined;
     }
     return undefined;
 }
@@ -261,6 +307,8 @@ export default function wardenExtension(pi) {
     // The trace file for a host without the terminal UI; set per session when PI_WARDEN_TRACE_DIR is an absolute path.
     let traceFile;
     let unsubscribeTraceFile;
+    // Directories outside the project the host lets its agent write; set per session from PI_WARDEN_HOST_PATHS.
+    let sessionHostPaths = [];
     let panel;
     let configPanel;
     let lastUi;
@@ -295,6 +343,8 @@ export default function wardenExtension(pi) {
     let fullOutputs = new Map();
     let evidence = emptyEvidence();
     let doneNudged = false;
+    /** True from a delivered warden follow-up that starts a turn until the next run starts: that run keeps the evidence. */
+    let wardenContinuation = false;
     let warnedFallback = false;
     let warnedMissingRules = false;
     /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
@@ -621,9 +671,10 @@ export default function wardenExtension(pi) {
             stats.steerGuards[name] = (stats.steerGuards[name] ?? 0) + 1;
         const critical = names.every(name => CRITICAL_STEER_GUARDS.has(name));
         // A notice delivered once is already in the agent's context. Sending the repeat again costs the accounting turn it
-        // forbids, so repeats are recorded only. The same goes for notices past the per-run steer budget: every delivered
-        // steer costs at least one LLM turn, and a closing run that collects six notices collects six restatements of the
-        // final status. A notice skipped for the budget keeps its fingerprint, so the same notice can deliver next run.
+        // forbids, so repeats are recorded only. The same goes for notices past the per-run steer budget: a steer sent during
+        // a tool call rides the request the tool result needs (tests/steer-delivery.test.ts), but one queued after the run
+        // ends starts a new model turn, and every steer asks the agent for a reply sentence; a closing run that collects six
+        // notices collects six restatements of the final status. A notice skipped for the budget keeps its fingerprint, so the same notice can deliver next run.
         // Critical guards (stuck, done, runaway recovery, subagent wake) always deliver: their message starts the turn.
         const overBudget = config.steerBudget > 0 && steersThisRun >= config.steerBudget;
         const deliver = critical || (!overBudget && !steerRepeats.seen(content));
@@ -635,6 +686,8 @@ export default function wardenExtension(pi) {
         steersThisRun++;
         const { display, ...delivery } = options ?? { deliverAs: "steer" };
         pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: display ?? config.steerVisible }, delivery);
+        if (delivery.triggerTurn)
+            wardenContinuation = true;
         return true;
     };
     /**
@@ -727,6 +780,7 @@ export default function wardenExtension(pi) {
             ctx.ui.notify(text, "warning");
         else
             pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+        sessionHostPaths = hostPaths();
         const dir = traceDir();
         if (dir) {
             const warn = (text) => { if (ctx.hasUI)
@@ -741,6 +795,7 @@ export default function wardenExtension(pi) {
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
+        wardenContinuation = false;
         prose.reset();
         // Clean up temp output dirs from the previous session.
         for (const dir of ledger.storedPaths()) {
@@ -798,6 +853,7 @@ export default function wardenExtension(pi) {
         attempts = new AttemptWindow(config.stuck.window);
         fullOutputs = new Map();
         doneNudged = false;
+        wardenContinuation = false;
         steersThisRun = 0;
         finals.reset();
         runaway.reset();
@@ -1090,9 +1146,12 @@ export default function wardenExtension(pi) {
         conscienceGeneration++;
         ctx.abort();
     });
-    // Each low-level run collects its own evidence of changes and checks.
+    // Each low-level run collects its own evidence of changes and checks. A run that a warden follow-up started continues
+    // the previous run's work, so it keeps that evidence: the changes behind a done-check nudge still need a passing check.
     pi.on("agent_start", async () => {
-        evidence = emptyEvidence();
+        if (!wardenContinuation)
+            evidence = emptyEvidence();
+        wardenContinuation = false;
     });
     // Every turn that runs after a compression is a turn that did not carry the removed text.
     pi.on("turn_end", async (_event, ctx) => {
@@ -1220,7 +1279,7 @@ export default function wardenExtension(pi) {
             ? rulesGuard.inspect(call, siblings, { cwd: ctx.cwd, config: config.rules, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         rulesCheck?.catch(() => undefined);
-        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx), spine: taskSpine(ctx.sessionManager.getBranch()) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, largeOutput: config.context.largeOutput, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined, scratch: sessionScratch });
+        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx, isVisibleAction(event.toolName, event.input)), spine: taskSpine(ctx.sessionManager.getBranch()) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, largeOutput: config.context.largeOutput, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined, scratch: sessionScratch, hostPaths: sessionHostPaths });
         if (verdict.source === "skipped")
             return;
         // Arming check: if any armed rule's command regex matches this call, inject a hit into the verdict.
@@ -1701,9 +1760,9 @@ export default function wardenExtension(pi) {
         }
         if (key && !earlier)
             ledger.remember(key, event.toolName, storedPath);
-        // The banner in the result already tells the agent. A steer custom message sent here arrives after the turn ends
-        // when this result closes the turn and starts a new turn to answer a message that asks for nothing, so the notice
-        // rides the result content alone and is never steered.
+        // The banner in the result already tells the agent, so the notice rides the result content alone and is not also
+        // steered. A steer sent here would join the request that carries this result and cost no extra turn
+        // (tests/steer-delivery.test.ts); it would only repeat the banner.
         if (notice && textBlocks.length) {
             if (!bannersPlacedWithBlocks) {
                 let index = 0;
@@ -1945,7 +2004,7 @@ export default function wardenExtension(pi) {
         const proseCheck = config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars
             ? evaluateProse(task, finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
-        const doneCheck = config.done.enabled && !doneNudged && needsDoneCheck(evidence)
+        const doneCheck = config.done.enabled && needsDoneCheck(evidence)
             ? evaluateDone(task, finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         if (proseCheck) {
@@ -1975,7 +2034,8 @@ export default function wardenExtension(pi) {
         const verdict = await doneCheck;
         if (verdict.error)
             noteError(ctx, verdict.error, verdict.errorCode);
-        const nudge = verdict.unverified && config.done.nudge ? doneNudge(verdict) : undefined;
+        // At most one nudge per user prompt; a later unverified claim is still judged and recorded.
+        const nudge = verdict.unverified && config.done.nudge && !doneNudged ? doneNudge(verdict) : undefined;
         record(ctx, config, "done", formatDone(verdict, config.widget.done), doneDetails(verdict, finalMessage, nudge));
         if (!verdict.unverified)
             return;

package/dist/extension.js.bak

@@ -6,13 +6,13 @@ import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
 import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
-import { backendHost, disclosureFor, judgeOptions, keyEnvFor, resolveBackend } from "./backend.js";
+import { backendHost, disclosureFor, judgeOptions, keyEnvFor, loginStoresKey, resolveBackend } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
 import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome as recordDoneOutcome } from "./done.js";
-import { evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, offTaskSteer, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
+import { createdScratch, evaluateAction, formatVerdictTokens, higher, hostPaths, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, writeSinkTargets } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 import { initSchema, recordHold, recordOutcome, toHoldRecord, holdStats, generateRecommendations, analyzeSteerEffectivenessReport } from "./learning.js";
@@ -20,7 +20,7 @@ import { evaluateProse, proseNudge, ProseTrend, RESTATE_MIN_SENTENCES, RESTATE_S
 import { compressOutput, duplicateNote, evaluateOutput, mergeOutput, outputKey, saveOutput, securityNotice, CompressionLearner } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
 import { redact } from "./redact.js";
-import { formatRules, pathNoteSteer, RulesGuard, rulesSteer } from "./rules.js";
+import { formatRules, pathNoteSteer, RulesGuard, rulesSteer, RULES_FILE, FALLBACK_FILES } from "./rules.js";
 import { checkPiWardenMissing } from "./rules-file.js";
 import { writeStarterRules, buildInitPrompt } from "./init.js";
 import { buildAuditPrompt, findProjects, snapshotReport, reportOutcome } from "./audit.js";
@@ -31,39 +31,19 @@ import { assess } from "./conscience.js";
 import { loadSkillBody, buildLoadMessage, policyMatches, CONSCIENCE_BETA_POLICY, recordFileIdentity, clearFileIdentityCache } from "./load.js";
 import { buildIndexPrompt, readIndex, writeIndex, validateIndex, indexStats, indexPath, ensureIndexDir } from "./index-cmd.js";
 import { fileContentHash } from "./hashing.js";
-/** Classify a conscience assessment error into a safe category (spec §6: never exception bodies). */
-function classifyConscienceError(err) {
-    if (err && typeof err === "object" && "code" in err) {
-        const code = err.code;
-        if (code === "timeout")
-            return "timeout";
-        if (code === "http" || code === "connection" || code === "response")
-            return "network";
-        if (code === "configuration" || code === "validation")
-            return "configuration";
-        if (code === "budget" || code === "aborted")
-            return "other";
-    }
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/timeout|timed out/i.test(msg))
-        return "timeout";
-    if (/auth|key|credential|401|403/i.test(msg))
-        return "auth";
-    if (/network|fetch|connect|ECONNREFUSED|ENOTFOUND/i.test(msg))
-        return "network";
-    return "other";
-}
+import { classifyJudgeError, cooldownFailureKind, JudgeCooldown } from "./judge-cooldown.js";
 import { openConfigPanel, openTracePanel } from "./panel.js";
-import { completeConfig, shapeWarning } from "./shape.js";
+import { completeConfig, shapeWarning, taskSpine } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { buildCompactSnapshot, compactAppendix } from "./compact.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
+import { TraceFile, judgmentsState, traceDir, traceFilePath } from "./trace-file.js";
 import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
+const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, cooldownSkips: 0, steers: 0, steersSkipped: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
  * message count; the line says so instead of hiding it. Worst offender first: that is the number worth acting on.
@@ -154,6 +134,20 @@ export function assistantPlan(ctx) {
     }
     return undefined;
 }
+/**
+ * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
+ * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
+ * names a key value or a path.
+ */
+export function judgmentsOffText(reason, backend, headless, rejectedEnv) {
+    switch (reason) {
+        case "no_consent": return `warden: Jev judgments are off (no consent). ${headless ? "Set PI_WARDEN_ENABLED=1." : "Run /warden enable."}`;
+        case "no_key": return `warden: Jev judgments are off (no key for ${backend}). Set ${keyEnvFor(backend)}${loginStoresKey(backend) ? " or run /typesafe login" : ""}.`;
+        case "key_rejected": return rejectedEnv
+            ? `warden: Jev judgments are off (the key in ${rejectedEnv} was rejected). Check the key, then run /warden status.`
+            : "warden: Jev judgments are off (the key saved by /typesafe login was rejected). Run /typesafe login.";
+    }
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -256,10 +250,19 @@ export default function wardenExtension(pi) {
     // fail-closes (no delivery) until the policy is re-measured.
     const consciencePolicy = CONSCIENCE_BETA_POLICY;
     let client;
+    const cooldown = new JudgeCooldown();
+    let judgeConfig;
+    /** Where cooldown notices go; unset headless, where a failure is already silent (see noteError). */
+    let noticeUi;
     let budgetExhausted = false;
     let stats = freshStats();
     const widget = new Map();
     const trace = new Trace();
+    // The trace file for a host without the terminal UI; set per session when PI_WARDEN_TRACE_DIR is an absolute path.
+    let traceFile;
+    let unsubscribeTraceFile;
+    // Directories outside the project the host lets its agent write; set per session from PI_WARDEN_HOST_PATHS.
+    let sessionHostPaths = [];
     let panel;
     let configPanel;
     let lastUi;
@@ -294,6 +297,8 @@ export default function wardenExtension(pi) {
     let fullOutputs = new Map();
     let evidence = emptyEvidence();
     let doneNudged = false;
+    /** True from a delivered warden follow-up that starts a turn until the next run starts: that run keeps the evidence. */
+    let wardenContinuation = false;
     let warnedFallback = false;
     let warnedMissingRules = false;
     /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
@@ -309,6 +314,13 @@ export default function wardenExtension(pi) {
     const secretsSeen = new Set();
     // Subagent report entries already triaged, by session entry id; the wake window outlives one scan.
     const subagentSeen = new Set();
+    // Command families already steered toward filtered output this session: one steer per family.
+    const largeOutputSteered = new Set();
+    // Real paths the agent created under the temp directory this session, with the identity each had when recorded.
+    // A recursive rm of only these is not destructive; a record whose path is gone or replaced is dropped after each call.
+    const sessionScratch = new Map();
+    // Per tool call id: when it started and the temp paths it may create that did not exist yet.
+    const scratchPending = new Map();
     const wakePolicy = new WakePolicy(0);
     const runaway = new RunawayMonitor();
     // Runs stopped by the runaway guard for the current user prompt; the first one gets a recovery turn, later ones wait for the user.
@@ -368,14 +380,79 @@ export default function wardenExtension(pi) {
         return config;
     };
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
+    /** Why no judge is available, or undefined when one is. The notice, the trace file, and the conscience all use it. */
+    const judgmentsOffReason = (config) => {
+        if (!consentGiven(config))
+            return "no_consent";
+        if (budgetExhausted)
+            return "budget";
+        const auth = authState({ backend: config.typesafeBackend });
+        if (auth.usable)
+            return undefined;
+        // No key in effect, or one whose last request came back 401 or 403.
+        return auth.source === undefined ? "no_key" : "key_rejected";
+    };
+    // Where the judgments-off notice goes: the session's UI, or a status message for a headless session.
+    let judgmentsNotify;
+    let judgmentsHeadless = false;
+    const judgmentsReported = new Set();
+    /** Say once per session and reason that judgments are off, and record the state in the trace file. */
+    const noteJudgments = (config, reason) => {
+        traceFile?.judgments(judgmentsState(reason));
+        // The budget has its own notice in noteError.
+        if (reason === undefined || reason === "budget" || judgmentsReported.has(reason))
+            return;
+        judgmentsReported.add(reason);
+        const auth = reason === "key_rejected" ? authState({ backend: config.typesafeBackend }) : undefined;
+        judgmentsNotify?.(judgmentsOffText(reason, config.typesafeBackend, judgmentsHeadless, auth?.kind === "environment" ? auth.keyName : undefined));
+    };
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
     /** A consent flag is not proof that judgments happen; check the key state for the chosen backend. */
     const judgeFor = (config) => {
-        if (!consentGiven(config) || budgetExhausted)
+        const off = judgmentsOffReason(config);
+        noteJudgments(config, off);
+        if (off)
             return undefined;
-        if (!authState({ backend: config.typesafeBackend }).usable)
+        judgeConfig = config;
+        // Absent, exactly as with no judge configured, so no guard needs to know a cooldown exists.
+        if (cooldown.active()) {
+            stats.cooldownSkips++;
             return undefined;
-        return client ??= createTypeSafe(judgeOptions(config));
+        }
+        return client ??= watched(createTypeSafe(judgeOptions(config)));
+    };
+    /** Every guard reaches the backend through `evaluate`, so this one seam sees each failure and each success. */
+    const watched = (typesafe) => new Proxy(typesafe, {
+        get(target, prop, receiver) {
+            if (prop !== "evaluate")
+                return Reflect.get(target, prop, receiver);
+            return async (...args) => {
+                try {
+                    const result = await target.evaluate(...args);
+                    tellCooldown(cooldown.success());
+                    return result;
+                }
+                catch (err) {
+                    const kind = cooldownFailureKind(err, args[1]?.signal);
+                    if (kind)
+                        tellCooldown(cooldown.failure(kind, judgeConfig?.judge ?? defaultConfig().judge));
+                    throw err;
+                }
+            };
+        },
+    });
+    const tellCooldown = (event) => {
+        if (!event || !noticeUi)
+            return;
+        if (event.type === "recovered") {
+            noticeUi.notify("warden: judgments resumed.", "info");
+            return;
+        }
+        const seconds = Math.round(event.ms / 1000);
+        const remedy = event.kind === "auth"
+            ? ` Set ${keyEnvFor(judgeConfig?.typesafeBackend ?? "typesafe")} or run /warden enable.`
+            : event.kind === "configuration" ? " /warden status shows the backend setup." : "";
+        noticeUi.notify(`warden: judgments paused for ${seconds}s after a ${event.kind} failure; pattern checks run alone until then.${remedy}`, "warning");
     };
     const noteError = (ctx, message, code) => {
         stats.errors++;
@@ -387,15 +464,22 @@ export default function wardenExtension(pi) {
     /** Click, shortcut, and /warden trace all toggle the same sidebar. */
     const togglePanel = (ui, config) => {
         if (!ui)
-            return;
+            return undefined;
         if (panel) {
             panel.close();
-            return;
+            return undefined;
         }
         const opened = openTracePanel(ui, trace, { width: config.widget.panelWidth });
         panel = opened;
         opened.closed.catch(() => undefined).finally(() => { if (panel === opened)
             panel = undefined; });
+        return opened;
+    };
+    /** The last 20 trace entries as text, newest last, for a host that cannot show the sidebar. */
+    const traceText = () => {
+        const entries = trace.entries();
+        const text = entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.";
+        return traceFile ? `${text}\nTrace file: ${traceFile.path}` : text;
     };
     /** The config overlay toggles the same way the sidebar does, so the hint in its header is true. */
     const toggleConfigPanel = (ui, config) => {
@@ -555,6 +639,8 @@ export default function wardenExtension(pi) {
         steersThisRun++;
         const { display, ...delivery } = options ?? { deliverAs: "steer" };
         pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: display ?? config.steerVisible }, delivery);
+        if (delivery.triggerTurn)
+            wardenContinuation = true;
         return true;
     };
     /**
@@ -617,6 +703,8 @@ export default function wardenExtension(pi) {
     pi.on("session_start", async (_event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
+        cooldown.reset();
         if (_event.reason === "reload" || _event.reason === "new")
             conscienceGeneration++;
         client = undefined;
@@ -634,11 +722,33 @@ export default function wardenExtension(pi) {
         rulesGuard.reset();
         holds.reset();
         regretCandidates = [];
-        holdLog = new HoldLog(holdLogPath(typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid)));
+        const sessionId = typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid);
+        holdLog = new HoldLog(holdLogPath(sessionId));
+        unsubscribeTraceFile?.();
+        unsubscribeTraceFile = undefined;
+        traceFile = undefined;
+        judgmentsReported.clear();
+        judgmentsHeadless = !ctx.hasUI;
+        judgmentsNotify = text => { if (ctx.hasUI)
+            ctx.ui.notify(text, "warning");
+        else
+            pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+        sessionHostPaths = hostPaths();
+        const dir = traceDir();
+        if (dir) {
+            const warn = (text) => { if (ctx.hasUI)
+                ctx.ui.notify(text, "warning");
+            else
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
+            const opening = loadConfig();
+            traceFile = new TraceFile(traceFilePath(dir, sessionId), dir, { sessionId, cwd: ctx.cwd, mode: opening.mode, judgments: judgmentsState(judgmentsOffReason(opening)) }, warn);
+            unsubscribeTraceFile = trace.subscribe(traceFile.listener);
+        }
         arming.reset();
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
+        wardenContinuation = false;
         prose.reset();
         // Clean up temp output dirs from the previous session.
         for (const dir of ledger.storedPaths()) {
@@ -653,6 +763,9 @@ export default function wardenExtension(pi) {
         compressionLearner.reset();
         secretsSeen.clear();
         subagentSeen.clear();
+        largeOutputSteered.clear();
+        sessionScratch.clear();
+        scratchPending.clear();
         wakePolicy.reset();
         steerRepeats.reset();
         steersThisRun = 0;
@@ -688,10 +801,12 @@ export default function wardenExtension(pi) {
     pi.on("before_agent_start", async (event, ctx) => {
         if (ctx.hasUI)
             lastUi = ctx.ui;
+        noticeUi = ctx.hasUI ? ctx.ui : undefined;
         const config = configFor(ctx);
         attempts = new AttemptWindow(config.stuck.window);
         fullOutputs = new Map();
         doneNudged = false;
+        wardenContinuation = false;
         steersThisRun = 0;
         finals.reset();
         runaway.reset();
@@ -744,6 +859,7 @@ export default function wardenExtension(pi) {
                 const truncationRecorded = event.prompt.length > 2000 ? [`prompt truncated from ${event.prompt.length} to 2000 chars`] : [];
                 // Build recent context from session branch (up to 4 messages, 500 chars each)
                 const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                const spine = taskSpine(branch, event.prompt);
                 const recentMessages = [];
                 for (const entry of branch.slice(-6)) {
                     if (recentMessages.length >= 4)
@@ -804,7 +920,7 @@ export default function wardenExtension(pi) {
                     // it. Empty until the first evaluate call, and an empty model never matches a policy, so the gate fails closed.
                     let judgeModel = "";
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
-                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, judgmentsOff: judgmentsOffReason(config), config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     // Check generation after await
                     if (conscienceGeneration !== myGeneration) {
                         record(ctx, config, "conscience", "stale: generation changed during assessment", ["trigger: before_agent_start", `generation: ${myGeneration} → ${conscienceGeneration}`, `skipReason: stale`]);
@@ -889,7 +1005,7 @@ export default function wardenExtension(pi) {
                     }
                 }
                 catch (err) {
-                    const category = classifyConscienceError(err);
+                    const category = classifyJudgeError(err);
                     if (!warnedErrorCategories.has(category)) {
                         warnedErrorCategories.add(category);
                         console.warn(`pi-warden: conscience ${category}`);
@@ -925,7 +1041,10 @@ export default function wardenExtension(pi) {
                 const judge = judgeFor(config);
                 if (judge && cachedSkills.length > 0) {
                     const myGeneration = conscienceGeneration;
-                    const redactedText = redact(typeof event.message.content === "string" ? event.message.content : "").slice(0, 2000);
+                    const prompt = typeof event.message.content === "string" ? event.message.content : "";
+                    const redactedText = redact(prompt).slice(0, 2000);
+                    const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
+                    const spine = taskSpine(branch, prompt);
                     let toolInfos = [];
                     try {
                         toolInfos = pi.getAllTools().map((t) => ({ name: t.name, description: t.description }));
@@ -936,13 +1055,13 @@ export default function wardenExtension(pi) {
                     const activeSkills = cachedSkills.map(s => s.name);
                     const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                     try {
-                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                        const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                         if (conscienceGeneration !== myGeneration)
                             return;
                         record(ctx, config, "conscience", `queued prompt assessed → ${result.selected ? `${result.selected.kind}:${result.selected.id}` : "none"} (${result.skipReason ?? "none"})`, ["trigger: message_start", `origin: queued`, `skipReason: ${result.skipReason ?? "none"}`]);
                     }
                     catch (err) {
-                        const cat = classifyConscienceError(err);
+                        const cat = classifyJudgeError(err);
                         if (!warnedErrorCategories.has(cat)) {
                             warnedErrorCategories.add(cat);
                             console.warn(`pi-warden: conscience ${cat}`);
@@ -980,9 +1099,12 @@ export default function wardenExtension(pi) {
         conscienceGeneration++;
         ctx.abort();
     });
-    // Each low-level run collects its own evidence of changes and checks.
+    // Each low-level run collects its own evidence of changes and checks. A run that a warden follow-up started continues
+    // the previous run's work, so it keeps that evidence: the changes behind a done-check nudge still need a passing check.
     pi.on("agent_start", async () => {
-        evidence = emptyEvidence();
+        if (!wardenContinuation)
+            evidence = emptyEvidence();
+        wardenContinuation = false;
     });
     // Every turn that runs after a compression is a turn that did not carry the removed text.
     pi.on("turn_end", async (_event, ctx) => {
@@ -1002,11 +1124,13 @@ export default function wardenExtension(pi) {
                 catch {
                     toolInfos = [];
                 }
-                const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+                const prompt = latestUserPrompt(ctx);
+                const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+                const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
                 const activeSkills = cachedSkills.map(s => s.name);
                 const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                 try {
-                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                    const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     if (conscienceGeneration !== myGeneration)
                         return;
                     assessmentsThisPrompt++;
@@ -1031,6 +1155,8 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        if (event.toolName === "bash" || event.toolName === "write")
+            scratchPending.set(event.toolCallId, { started: Date.now(), candidates: scratchCandidates(event.toolName, event.input, ctx.cwd) });
         // ── Conscience: track tool attempts on the selected capability ──
         if (config.conscience.enabled && selectedCapability && !triggerConsumed) {
             if (selectedCapability.kind === "tool" && event.toolName === selectedCapability.id) {
@@ -1060,14 +1186,17 @@ export default function wardenExtension(pi) {
         if (!config.action.enabled || !config.action.tools.includes(event.toolName))
             return;
         stats.inspected++;
-        // First-run warning: pi-warden.md missing, one time per session.
+        // First-run warning: no project rules file resolved, one time per session.
         if (!warnedMissingRules && config.rules.enabled) {
-            const { missing, fallbackSource } = checkPiWardenMissing(ctx.cwd);
+            const { missing, fallbackSource } = checkPiWardenMissing(ctx.cwd, config.rules);
             if (missing && ctx.hasUI) {
                 warnedMissingRules = true;
+                // The tiers still in play, in resolution order: naming README/CLAUDE/AGENTS to someone who
+                // turned the fallback off would send them to a document pi-warden will not read.
+                const tiers = [RULES_FILE, "rules.files", ...(config.rules.fallback ? FALLBACK_FILES : [])].join(", ");
                 const msg = fallbackSource
-                    ? `No pi-warden.md detected. Using ${fallbackSource} as active fallback rules. Run /warden init to create project-specific rules.`
-                    : `No rules file detected (pi-warden.md, README.md, CLAUDE.md, or AGENTS.md). Run /warden init to create project-specific rules.`;
+                    ? `No pi-warden.md or rules.files entry here. Using ${fallbackSource} as active fallback rules. Run /warden init to create project-specific rules.`
+                    : `No rules file detected (${tiers}). Run /warden init to create project-specific rules.`;
                 ctx.ui.notify(msg, "warning");
             }
         }
@@ -1103,7 +1232,7 @@ export default function wardenExtension(pi) {
             ? rulesGuard.inspect(call, siblings, { cwd: ctx.cwd, config: config.rules, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         rulesCheck?.catch(() => undefined);
-        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined });
+        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx), spine: taskSpine(ctx.sessionManager.getBranch()) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, largeOutput: config.context.largeOutput, rules: config.rules, previousActions: regretCandidates.length ? regretCandidates : undefined, scratch: sessionScratch, hostPaths: sessionHostPaths });
         if (verdict.source === "skipped")
             return;
         // Arming check: if any armed rule's command regex matches this call, inject a hit into the verdict.
@@ -1159,6 +1288,11 @@ export default function wardenExtension(pi) {
         // Notes for the agent about the content it just wrote: slop, rule violations, and sensitive paths arrive as one message.
         const notes = [];
         const noteGuards = new Set();
+        /** Slop and rule findings say "just written", so they wait until the call proceeds. A held, denied, or declined write
+         * never lands and drops them; an approved retry is judged again and brings its own. They go between the action notes
+         * and the sensitive-path notes, the order of the combined message. */
+        const contentNotes = [];
+        const pathNotes = [];
         /** Sensitive-path notes ride with the combined steer for this call; their trace waits for the delivery result. */
         const pathNoteTraces = [];
         if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
@@ -1223,15 +1357,24 @@ export default function wardenExtension(pi) {
             noteGuards.add("action");
             notes.push(shouldProceedMessage(verdict));
         }
+        const largeOutput = largeOutputNotice(verdict, largeOutputSteered);
+        if (largeOutput) {
+            noteGuards.add("action");
+            notes.push(largeOutput);
+        }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
-            noteGuards.add("action");
-            for (const symptom of verdict.slopSymptoms)
-                slopCounts[symptom]++;
+            const symptoms = verdict.slopSymptoms;
             const where = verdict.summary.path ?? event.toolName;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · slop · ${where}: ${verdict.slopReasons.join("; ")}`, "warning");
-            notes.push(slopSteer(where, verdict.slopSymptoms, slopCounts));
+            contentNotes.push(proceeds => {
+                if (!proceeds)
+                    return undefined;
+                for (const symptom of symptoms)
+                    slopCounts[symptom]++;
+                return { guard: "action", text: slopSteer(where, symptoms, slopCounts) };
+            });
         }
         if (rulesCheck) {
             const rules = await rulesCheck;
@@ -1239,16 +1382,23 @@ export default function wardenExtension(pi) {
                 stats.ruleChecks++;
                 if (rules.error)
                     noteError(ctx, rules.error, rules.errorCode);
-                const told = rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
-                record(ctx, config, "rules", formatRules(rules, config.widget.rules), rulesDetails(rules, told));
                 holds.recordRules({ source: rules.source, path: rules.path, findings: rules.findings.map(f => ({ name: f.name, violation: f.violation })), ...(rules.error ? { error: rules.error } : {}) });
-                if (told) {
+                if (rules.findings.length) {
                     stats.ruleViolations++;
-                    noteGuards.add("rules");
                     if (ctx.hasUI && config.notices)
                         ctx.ui.notify(`warden · rules · ${rules.path}: ${rules.findings.map(finding => `${finding.name} (${finding.violation.toFixed(2)})`).join("; ")}`, "warning");
-                    notes.push(told);
                 }
+                contentNotes.push(proceeds => {
+                    const told = proceeds && rules.findings.length ? rulesSteer(rules, rulesGuard.count(rules)) : undefined;
+                    const details = rulesDetails(rules, told);
+                    if (!proceeds && rules.findings.length)
+                        details.push("agent not told: the write was held");
+                    record(ctx, config, "rules", formatRules(rules, config.widget.rules), details);
+                    return told ? { guard: "rules", text: told } : undefined;
+                });
+            }
+            else {
+                record(ctx, config, "rules", formatRules(rules, config.widget.rules), [`${rules.tool} ${rules.path}: ${rules.skippedReason}`]);
             }
             const hits = rulesGuard.notesFor(verdict.summary.location === "inside_project" ? verdict.summary.path : undefined, config.rules.sensitivePaths);
             if (hits.length && verdict.summary.path) {
@@ -1262,17 +1412,29 @@ export default function wardenExtension(pi) {
                         ctx.ui.notify(`warden · sensitive path · ${verdict.summary.path} (${hits.map(hit => hit.glob).join(", ")}); the agent was given the note`, "warning");
                 });
                 noteGuards.add("rules");
-                notes.push(told);
+                pathNotes.push(told);
             }
         }
-        if (notes.length) {
-            const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
-            for (const traceNote of pathNoteTraces)
-                traceNote(delivered);
-            pathNoteTraces.length = 0;
-        }
+        /** Sends the combined steer once the call's fate is known; `proceeds` is false when the call does not run. */
+        const deliverNotes = (proceeds) => {
+            for (const contentNote of contentNotes) {
+                const note = contentNote(proceeds);
+                if (!note)
+                    continue;
+                noteGuards.add(note.guard);
+                notes.push(note.text);
+            }
+            notes.push(...pathNotes);
+            if (notes.length) {
+                const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
+                for (const traceNote of pathNoteTraces)
+                    traceNote(delivered);
+                pathNoteTraces.length = 0;
+            }
+        };
         const warnSteer = (reasons) => reasons.length > 0 && steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
         if (verdict.level === "warn") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
@@ -1284,6 +1446,7 @@ export default function wardenExtension(pi) {
             return undefined;
         }
         if (verdict.level === "deny") {
+            deliverNotes(false);
             stats.held++;
             track(true, "declined", "deny");
             if (ctx.hasUI && config.notices)
@@ -1292,6 +1455,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
+            deliverNotes(true);
             track(false);
             return undefined;
         }
@@ -1304,6 +1468,7 @@ export default function wardenExtension(pi) {
         if (dialogRule && ctx.hasUI) {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1313,6 +1478,7 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         if (mode === "advise") {
+            deliverNotes(true);
             stats.warned++;
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
@@ -1324,6 +1490,7 @@ export default function wardenExtension(pi) {
         if (mode === "confirm") {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
+            deliverNotes(allowed);
             if (allowed) {
                 track(true, "approved", "dialog");
                 return undefined;
@@ -1332,6 +1499,7 @@ export default function wardenExtension(pi) {
             track(true, "declined", "dialog");
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${deliveredReasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
+        deliverNotes(false);
         stats.held++;
         actionGuard.hold(task);
         track(true);
@@ -1346,6 +1514,13 @@ export default function wardenExtension(pi) {
             return;
         const textBlocks = event.content.filter(part => part.type === "text");
         const text = textBlocks.map(part => part.text).join("\n");
+        const scratch = scratchPending.get(event.toolCallId);
+        if (scratch) {
+            scratchPending.delete(event.toolCallId);
+            for (const [path, identity] of createdScratch(event.toolName, event.input, text, scratch.started, scratch.candidates))
+                sessionScratch.set(path, identity);
+        }
+        pruneScratch(sessionScratch);
         // Repeat detection uses the original result, so its request goes out together with the output check.
         const failed = resultFailed(event.isError, event.details, event.content);
         // ── Conscience: track tool_result for the pending capability ──
@@ -1468,7 +1643,9 @@ export default function wardenExtension(pi) {
         }
         if (config.context.enabled && !earlier && !recallRead && textBlocks.length === 1 && text.length >= config.context.tailMinChars)
             ledger.candidate();
-        if (multiBlock && !ctx.signal?.aborted) {
+        // Captured before the loop so the notice block below knows whether each block already carries its banner.
+        const bannersPlacedWithBlocks = multiBlock && !ctx.signal?.aborted;
+        if (bannersPlacedWithBlocks) {
             // Retention and banners per block; block order and non-text parts are never touched.
             content = [...content];
             let textIndex = 0;
@@ -1536,8 +1713,11 @@ export default function wardenExtension(pi) {
         }
         if (key && !earlier)
             ledger.remember(key, event.toolName, storedPath);
+        // The banner in the result already tells the agent. A steer custom message sent here arrives after the turn ends
+        // when this result closes the turn and starts a new turn to answer a message that asks for nothing, so the notice
+        // rides the result content alone and is never steered.
         if (notice && textBlocks.length) {
-            if (!multiBlock) {
+            if (!bannersPlacedWithBlocks) {
                 let index = 0;
                 content = content.map(part => {
                     if (part.type !== "text")
@@ -1546,13 +1726,12 @@ export default function wardenExtension(pi) {
                     return { ...part, text: `${index === 1 ? `${notice}\n\n` : ""}${part.text}${index === textBlocks.length ? `\n\n${notice}` : ""}` };
                 });
             }
-            const delivered = steer(config, "security", notice);
             record(ctx, config, "security", renderTemplate(config.widget.security, {
                 tool: event.toolName, injection: output.injection?.toFixed(2), exfiltration: output.exfiltration?.toFixed(2),
                 status: [output.suspicious && "untrusted instructions", output.secret && "possible credentials"].filter(Boolean).join(", "),
             }), [
                 `jev: injection ${output.injection?.toFixed(2) ?? "not judged"}; exfiltration ${output.exfiltration?.toFixed(2) ?? "not judged"}`,
-                `output sample: ${redact(text).slice(0, 300)}`, delivered ? `agent told: ${notice}` : `steer recorded, not delivered (a repeat or the per-run budget): ${notice}`,
+                `output sample: ${redact(text).slice(0, 300)}`, `agent told by the banner in the tool result: ${notice}`,
             ]);
         }
         // Stuck-loop diff: when the verdict is stuck on a failed result and a previous failed output
@@ -1742,11 +1921,13 @@ export default function wardenExtension(pi) {
             catch {
                 toolInfos = [];
             }
-            const redactedPrompt = redact(latestUserPrompt(ctx) ?? "").slice(0, 2000);
+            const prompt = latestUserPrompt(ctx);
+            const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
+            const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
             const activeSkills = cachedSkills.map(s => s.name);
             const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
             try {
-                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile });
+                const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                 if (conscienceGeneration !== myGeneration)
                     return;
                 assessmentsThisPrompt++;
@@ -1776,7 +1957,7 @@ export default function wardenExtension(pi) {
         const proseCheck = config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars
             ? evaluateProse(task, finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
-        const doneCheck = config.done.enabled && !doneNudged && needsDoneCheck(evidence)
+        const doneCheck = config.done.enabled && needsDoneCheck(evidence)
             ? evaluateDone(task, finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         if (proseCheck) {
@@ -1806,7 +1987,8 @@ export default function wardenExtension(pi) {
         const verdict = await doneCheck;
         if (verdict.error)
             noteError(ctx, verdict.error, verdict.errorCode);
-        const nudge = verdict.unverified && config.done.nudge ? doneNudge(verdict) : undefined;
+        // At most one nudge per user prompt; a later unverified claim is still judged and recorded.
+        const nudge = verdict.unverified && config.done.nudge && !doneNudged ? doneNudge(verdict) : undefined;
         record(ctx, config, "done", formatDone(verdict, config.widget.done), doneDetails(verdict, finalMessage, nudge));
         if (!verdict.unverified)
             return;
@@ -1860,7 +2042,7 @@ export default function wardenExtension(pi) {
                         : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
-                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
+                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors, ${stats.cooldownSkips} checks without Jev during a judge cooldown; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
                         formatSteers(stats),
                         `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / steer ${config.action.offTask.steer} (never holds); intent mismatch ${config.action.intentMismatch} (${config.action.visibleMismatch} on a visible action); stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
@@ -1878,11 +2060,16 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "trace") {
                     if (!ctx.hasUI) {
-                        const entries = trace.entries();
-                        report(entries.length ? entries.slice(-20).map(entry => `${new Date(entry.at).toTimeString().slice(0, 8)} ${entry.guard}: ${entry.line}${entry.details.length ? `\n  ${entry.details.join("\n  ")}` : ""}`).join("\n") : "No guarded activity yet this session.");
+                        report(traceText());
                         return;
                     }
-                    togglePanel(ctx.ui, config);
+                    const opened = togglePanel(ctx.ui, config);
+                    // RPC mode has a UI but settles custom() without building the component, so the sidebar never shows. hasUI
+                    // is true there; only the host not asking for the component tells the two apart. Not awaited: in the
+                    // terminal `closed` settles when the user closes the sidebar.
+                    const fallback = () => { if (opened && !opened.built())
+                        ctx.ui.notify(traceText(), "info"); };
+                    void opened?.closed.then(fallback, fallback);
                     return;
                 }
                 if (action === "recommend") {

package/dist/guard.d.ts

@@ -199,6 +199,11 @@ export interface EvaluateOptions {
     questions?: Questions | undefined;
     /** Real paths the agent created under the temp directory in this session (`PatternOptions.scratch`). */
     scratch?: ScratchRecords | undefined;
+    /**
+     * Real paths of host directories (`hostPaths()`). A write or edit in one is not held by the outside-project rule;
+     * every other check still applies.
+     */
+    hostPaths?: readonly string[] | undefined;
 }
 export declare const higher: (a: Level, b: Level) => Level;
 interface Rule {
@@ -213,6 +218,11 @@ export declare const SHELL_RULES: Rule[];
  * subcommand for tools that have one (`git log`, `npm test`, `npm run build`). Undefined when no head can be read.
  */
 export declare function commandFamily(command: string): string | undefined;
+/**
+ * Whether a shell command has a segment whose effect is visible outside the working tree, decided in code before any
+ * request. Quoted data such as a commit message is blanked first, so a message that mentions `git push` is not a push.
+ */
+export declare function isVisibleCommand(command: string): boolean;
 export interface ScannedCommand {
     /** The command with data text blanked; what the pattern rules read. */
     text: string;
@@ -249,6 +259,13 @@ export declare function tempRoots(): string[];
  * a component exists but cannot be resolved (a dangling symlink, a loop, no permission).
  */
 export declare function realTarget(path: string): string | undefined;
+/**
+ * Host paths: directories outside the project where the host lets its agent write, from `PI_WARDEN_HOST_PATHS` only (a
+ * `:`-separated list). Relative entries, empty entries, and a filesystem root are ignored. Each entry is kept as its real
+ * path, so a target is compared after `..` and symlinks are resolved on both sides.
+ */
+export declare const HOST_PATHS_ENV = "PI_WARDEN_HOST_PATHS";
+export declare function hostPaths(env?: NodeJS.ProcessEnv): string[];
 /** The temp root a real path lies strictly under; a temp root itself has none. */
 export declare function tempRootOf(real: string, roots?: string[]): string | undefined;
 /** How much of the target trees one rm segment may walk: entries seen, and the clock time it must finish by. */

package/dist/guard.js

@@ -100,6 +100,38 @@ export function commandFamily(command) {
         return head;
     return rest[0] === "run" && word(rest[1]) ? `${head} run ${rest[1]}` : `${head} ${rest[0]}`;
 }
+/** Subcommands whose effect others see: history or remote state changes, a pull request, a release, a published package. */
+const VISIBLE_SUBCOMMANDS = {
+    git: new Set(["push", "commit", "merge", "tag", "reset"]),
+    gh: new Set(["pr", "release"]),
+    npm: new Set(["publish"]),
+};
+/**
+ * Whether a shell command has a segment whose effect is visible outside the working tree, decided in code before any
+ * request. Quoted data such as a commit message is blanked first, so a message that mentions `git push` is not a push.
+ */
+export function isVisibleCommand(command) {
+    // A substitution or subshell runs its command too: `out=$(git push …)`, `(cd repo && git push)`.
+    return splitShell(stripDataText(command).text).flatMap(segment => segment.split(/\$\(|`|\(/)).some(segment => {
+        const head = headOf(segment);
+        const subcommands = head ? VISIBLE_SUBCOMMANDS[head] : undefined;
+        if (!head || !subcommands)
+            return false;
+        const tokens = segment.trim().split(/\s+/);
+        // `git -C dir push`, `git -c key=value commit`: the option value is not the subcommand.
+        for (let index = tokens.findIndex(token => token.replace(/^.*\//, "") === head) + 1; index < tokens.length; index++) {
+            const token = tokens[index];
+            if (token === "-C" || token === "-c" || token === "-R" || token === "--repo") {
+                index++;
+                continue;
+            }
+            if (token.startsWith("-"))
+                continue;
+            return subcommands.has(token.replace(/[)`]+$/, ""));
+        }
+        return false;
+    });
+}
 /**
  * Quoted strings replaced by a placeholder; escapes inside double quotes are honoured, single quotes take everything.
  * A double-quoted string that substitutes a command (`"$(...)"`, backticks) executes it, so that string stays visible.
@@ -303,6 +335,30 @@ export function realTarget(path) {
         }
     }
 }
+/**
+ * Host paths: directories outside the project where the host lets its agent write, from `PI_WARDEN_HOST_PATHS` only (a
+ * `:`-separated list). Relative entries, empty entries, and a filesystem root are ignored. Each entry is kept as its real
+ * path, so a target is compared after `..` and symlinks are resolved on both sides.
+ */
+export const HOST_PATHS_ENV = "PI_WARDEN_HOST_PATHS";
+export function hostPaths(env = process.env) {
+    const roots = new Set();
+    for (const entry of (env[HOST_PATHS_ENV] ?? "").split(":")) {
+        if (!entry || !isAbsolute(entry))
+            continue;
+        const real = realTarget(entry);
+        if (real && dirname(real) !== real)
+            roots.add(real);
+    }
+    return [...roots];
+}
+/** Whether a target lies in a host path, after `..` and symlinks are resolved. An unresolvable target is not in one. */
+function inHostPath(target, roots) {
+    if (!roots.length)
+        return false;
+    const real = realTarget(target);
+    return real !== undefined && roots.some(root => real === root || real.startsWith(root + sep));
+}
 /** The temp root a real path lies strictly under; a temp root itself has none. */
 export function tempRootOf(real, roots = tempRoots()) {
     return roots.find(root => real !== root && real.startsWith(root.endsWith(sep) ? root : root + sep));
@@ -1153,7 +1209,9 @@ export async function evaluateAction(action, options) {
             reasons.push(`${hit.severity}: ${hit.label}`);
         }
     }
-    if (summary.location === "outside_project") {
+    const inHost = summary.location === "outside_project" && typeof action.input.path === "string"
+        && inHostPath(resolve(action.cwd, action.input.path), options.hostPaths ?? []);
+    if (summary.location === "outside_project" && !inHost) {
         if (evidenceMode) {
             const pathNote = action.tool === "write" && summary.exists
                 ? `overwrites an existing file outside the project ${summary.path ?? ""}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "0.47.0",
+  "version": "0.48.1",
   "description": "Makes the Pi agent follow your project's rules. Jev judges every write against your pi-warden.md and quotes the broken rule back to the agent, names slop, breaks stuck loops, calls out unverified done claims, compresses large tool output, and holds the rare destructive command. Built on pi-typesafe.",
   "type": "module",
   "license": "MIT",