pi-warden 0.47.0 → 0.60.0

package/CHANGELOG.md

@@ -8,6 +8,208 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.60.0
+
+### Changed
+
+- `git reset --hard` warns instead of holding when the working tree is clean: `git status --porcelain` in the call's directory prints nothing. The check runs once with a 2-second timeout; a failed or timed-out check holds.
+- `git push --force-with-lease` now holds by default. It warns only when every target branch is named in the command or is the current branch, no target is `main`, `master`, or the remote's HEAD branch, and the command has no plain `--force`/`-f`. A `+` or delete refspec, `--all`, `--mirror`, `--tags`, an unknown flag, a detached HEAD, or `push.default=matching` on a bare push keeps the hold.
+- Both relaxations read only a plain single `git reset` or `git push` command. A `cd`, `-C`, quote, variable, or second command keeps the hold.
+- The conscience no longer sends its `agent_end` reminder when the run ended with a final text reply. The agent has answered; a reminder then started a new turn to revisit a finished answer.
+
+### Fixed
+
+- `git reset --hard` with global options before `reset` (`git -C dir`, `--git-dir`, `--work-tree`, `-c key=value`) is held. Before, the pattern needed `reset` right after `git`, so `git -C dir reset --hard` was neither held nor warned.
+- `git push --force`, `-f`, and `--force-with-lease` with the same global options before `push` (`git -C dir push --force`) are held. The push patterns had the same gap.
+
+### Tests
+
+- A clean and a changed tree for `reset --hard`, and a failed status check. Lease pushes to a feature branch, to `main`, `master`, and the remote HEAD branch, with plain `--force`, with a bare push that tracks the default branch, and outside a repository. A conscience run that ended with a final reply sends no reminder. `reset --hard` with `-C`, `--git-dir`, `--work-tree`, and `-c` on a clean tree is held. `push --force`, `-f`, and `--force-with-lease` with those options are held.
+
+## 0.59.5
+
+### Fixed
+
+- Shell writes that gave neither a judged write nor a skip are now judged. `exec > f; echo x` judges the text the later commands print into `f`; a redirected `{ echo x; } > f` or `(echo x) > f` group judges the text its commands print, and a group that also runs a program is skipped with a reason; `env echo x > f` treats `env` as a wrapper; a target such as `/dev/../tmp/p/f` is normalized before the `/dev/` test; a partly quoted heredoc delimiter (`<<E"OF"`) ends at `EOF` and keeps the body literal, as in bash.
+- One bash command no longer starts one rules request per write. Writes to the same file are joined into one request (40 `>>` appends to one file are one request), and past five files a command writes, the rest are recorded in the trace as skipped. The action request lists each file once.
+- The done-check no longer counts `grep -rn screenshot src`, `idb list-targets`, or `flutter test test/unit/x_test.dart` as visual proof. A `done.visualTools.commandWords` word counts only after a `commands` head, `flutter test` counts only for an `integration_test/` or golden path (or `--update-goldens`), and `idb` only for its `screenshot` or `ui` subcommand. `chrome`, `chromium`, and `google-chrome` are now `commands` heads that count with a screenshot flag (`chrome --headless --screenshot=…`), so a headless-browser screenshot is proof and `chromium --version` is not.
+- The conscience now drops camelCase destructive tools (`deleteIssue`, `dropTable`, `mcp__db__truncateTable`) and tools whose name or leading description verb is `kill`, `force`, `uninstall`, `revoke`, `erase`, or `clear` (`kill_process`, `force_push`, `uninstall_package`).
+
+## 0.59.4
+
+### Fixed
+
+- A prompt no longer authorizes a recursive `rm` of `/`, `.`, `./`, `..`, `~`, `*`, or `$HOME`. Before, "Clean up build/ please." released the hold on `rm -rf /`: the target `/` was found in `build/`. The `rm-recursive-dangerous-target` hit is now never authorized by a prompt. A path the prompt authorizes must appear as a whole word (a space, quote, bracket, or punctuation before and after it), so `old/build` and `build.gradle` no longer authorize `rm -rf build`, and a root-like, home, variable, or one-character target is never matched.
+- `git grep` takes the read-only fast path only with listed flags. `--open=sh` (git accepts any abbreviation of `--open-files-in-pager`) and `-O` bundled after other flags (`-lOnode`) run a program on the matched files, and both skipped the judge.
+- The `/warden index` directory is a host path only when neither it nor a directory between it and Pi's agent directory is a symlink, and its real path is inside the agent directory. A symlinked index directory could make the home directory a host path, so an overwrite of a shell profile was not held.
+- The read-only fast path no longer takes commands that write a file named in their arguments: `sort -o`, `uniq` with an output file, `tree -o` and `tree -R`, and `xxd -r` or `xxd` with an output file.
+
+### Tests
+
+- Tests for each case above: the root-like `rm` prompts, the `git grep` pager forms and common safe flags, a symlinked index directory, and the writing forms of `sort`, `uniq`, `tree`, and `xxd`.
+
+## 0.59.3
+
+### Fixed
+
+- The conscience no longer recommends a tool that cannot run on this platform. `powershell`, `pwsh`, and `cmd` are dropped from the tool candidates when the platform is not Windows, and a tool whose description says Windows-only or macOS-only is dropped on the other platforms. Skills are not filtered. In a run on macOS the conscience recommended `tool:powershell` at P(useful) 0.91; its end-of-run reminder then made the agent spend a turn checking for `pwsh` and answer about PowerShell instead of the task. The reminder re-runs the same assessment, so it can no longer name such a tool either.
+- The conscience's end-of-run reminder now passes the same activation gate as the first recommendation. Before, a capability held with `no_policy` (question hash or answering model not in the policy) was still sent later as `Reminder: consider using …`, which bypassed the gate that should fail closed.
+
+## 0.59.2
+
+### Changed
+
+- The `large_output` score of a judged `bash` call is now recorded. The action trace entry shows it (`large-output 0.12` in the details, a `largeOutput` template token), and the holds database keeps it in `scores`. The hold signature still hashes only the irreversible score and the reasons, so hold matching is unchanged. Before, the question never steered in field use and nothing showed whether it scored low or was never asked.
+- The context saver traces the outputs it judged and kept whole. One `context` trace entry per output (per text block for a multi-block result) records the retention, confidence, format, and format confidence, so the `context.confidence` gate can be calibrated. Trace only: no notice, no steer, and the status line does not change.
+
+### Fixed
+
+- `/warden recommend` is offered in the command completions (`/warden rec` completes to it) and has a row in `docs/commands.md`.
+
+## 0.59.1
+
+### Fixed
+
+- A write or edit of a `/warden index` file is no longer held as "overwrites a file outside the project". `/warden index` asks the agent to write `global.json` and `projects/<hash>.json` in `pi-warden/index/` under Pi's agent directory, and in a hold-precision review 3 of the 4 approved outside-project overwrite holds were these files. That directory is now always a host path for the outside-project rule. The rest of the agent directory is still held: `auth.json`, `settings.json`, pi-warden's own `config.json`, and other extensions' data. Every other check still applies there.
+
+## 0.59.0
+
+### Added
+
+- Standing preferences. `/warden prefs` lists the corrections and preferences you repeated in two or more earlier sessions of this project ("never bump the version in a feature commit", "keep replies short"), each with its session count and last date, and suggests adding the ones worth keeping to `pi-warden.md` as rules. The scan reads only the messages you typed (not tool output, extension messages, pasted orders and reports, messages another agent relays for you, questions, or temporary holds such as "don't commit yet") in the session files of the project and of its other git worktrees, at most the 200 newest sessions of the last 30 days within a 250 ms budget. It groups clauses that share most of their words, or a subject word that is rare in your messages ("don't spawn subagents", "no subagents, review it yourself"), and keeps the 10 most repeated. It runs in code, once per session start, and never writes a file. New keys `prefs.enabled` (default `true`) and `prefs.inject` (default `false`): with `inject` on, the list goes to the agent as one context message at session start (at most 600 characters, not a steer, no steer budget spent).
+
+## 0.58.0
+
+### Changed
+
+- The conscience no longer recommends core tools the agent already uses. In a week of field use, 75 of 144 recommendations named `read`, `bash`, or `edit`, which tells the agent nothing new; one read "use bash instead of bash". New key `conscience.skipTools`, default `["read", "bash", "edit", "write", "grep", "find", "ls"]`, removes those tools from the candidate list before the judge is asked. Skills are never removed by this key; `skipTools: []` restores the earlier behaviour. The question wording is unchanged, so the beta policy hash still matches.
+- The conscience never recommends a destructive tool. A tool whose name has `delete`, `drop`, `destroy`, `remove`, `purge`, `wipe`, `reset`, or `truncate` as a whole word or `_`-separated part, or whose description starts with one of these words, is not a candidate. The field data had 4 recommendations of `delete_project`.
+- Fewer candidates make the conscience request smaller. On a catalog of 19 skills and 32 tools, one assessment now sends 45 questions in 2 requests instead of 54 questions in 3.
+
+## 0.57.0
+
+### Added
+
+- The done-check asks for a visual check after UI changes (`done.uiProof`, default on). When a run changes a file that matches `done.uiFiles` (stylesheets, markup, `.jsx`/`.tsx`/`.vue`/`.svelte`/`.astro` components, Flutter `.dart` files, `web/` and `public/` scripts; tests excluded), whether by `write`, `edit`, or a `bash` file write, passing tests and builds no longer prove a "done" reply. Only a successful `done.visualTools` call after the last UI change does: `agent-browser`, `playwright`, `flutter test`, `idb`, `xcrun simctl io`, a `screenshot` command, a browser MCP tool such as `take_screenshot` or `navigate_page`, or a `read` of an image. Without one, the final reply is judged with the existing questions, and the nudge names the file: "You changed `web/app.css` but did not look at the result. Open it in a browser or take a screenshot before calling it done, or say it is unverified." In a week of real sessions, 23 of 75 UI runs that ended with a "done" reply had no visual step after the last UI change; replayed, the rule nudges 20 of them and 7 of the other 52, 6 of which had no real visual step either. `uiProof: false` restores the previous rule. See `docs/guards.md` → Done-check.
+
+## 0.56.1
+
+### Tests
+
+- The two judge cooldown tests that wait for the window to end no longer depend on runner speed. They used a 40 ms window and a 60 ms sleep, so on a slow runner the window could end again before the next action, and the test failed with `the window is open again: 3 !== 2`. They now use a 60 s window and move a mocked `Date.now` forward instead of sleeping. The failed-probe test also checks that the probe after the window reaches the judge, so it can no longer pass when the window never ends. `JudgeCooldown` now reads `Date.now` on each call rather than keeping the function it saw at construction; the timing is unchanged.
+
+## 0.56.0
+
+### Added
+
+- The stuck guard catches a literal repeat on the 2nd call, in code, with no request. When the agent makes the same call (same tool and input) a second time and nothing that can change state ran between, it gets a short steer if the call failed with the same output ("you already ran `npm test`; it failed the same way: 1 failing. Change something before running it again.") or if a read (`read`, or a read-only shell command) returned the same output again ("you already have this output from `read src/config.ts` (3 calls ago); nothing changed since."). Every call that is not provably read-only resets the check: writes and edits, MCP tools, scripts, unknown tools, and shell commands that are not read-only; only `read`, `grep`, `find`, `ls`, and read-only shell commands do not. Polling and waiting (`sleep`, `watch`, `git status`, `gh run watch`, `gh pr checks`, `tail -f`, `ps`) never fire. It fires once per call per prompt, so a 3rd identical failure still reaches the regular stuck check; it counts against the per-run steer budget as `repeat`, and a stuck verdict on the same result takes its place. New key `stuck.repeatSteer` (default `true`) turns it off; it also follows `stuck.nudge`.
+
+## 0.55.0
+
+### Changed
+
+- With masking on, the credential banner in a tool result is sent only when a value was masked, and its text is unchanged. A credential-shaped value that was detected but not masked is recorded in the trace as `possible credentials, none masked (traced)` and is not announced to the agent. With `security.maskOutput: false` the value is in the agent's context, so the generic notice stays. In one week of sessions, 510 of 527 credential banners were the generic "Possible credentials in this output" text that pointed at no value, and agents disputed 49 of them. The prompt-injection notice is unchanged.
+- Masking now covers every value the offline credential check detects: URL passwords (`postgres://user:pass@host`), `Authorization` header and `Bearer` values, `ghu_`/`ghs_`/`ghr_` GitHub tokens, `xoxr-`/`xoxs-` Slack tokens, and `AIza` keys. Before, these were announced but left readable in the tool result.
+
+## 0.54.0
+
+### Changed
+
+- The action guard's read-only fast path, which skips the Jev judgment, now also accepts `sed -n` with one print command (`sed -n '10,20p' f`, `sed -n '/a/,/b/p' f`), `git worktree list`, `git stash list`, and `git merge-base`. For `sed`, the only accepted options are ones that cannot write or run anything: no `-i`, no `-f`, and no option after the first operand. The script must be literal, with no variable expansion and no `w`, `W`, `e`, or `r` command. In one week of real sessions, `sed -n` line ranges were almost all of the read-only commands that still went to Jev; about a third of them got a `warn`. The fast path now also rejects `<(...)` process substitution and git's `--output` and `-O`/`--open-files-in-pager`, which run a command, write a file, or open a pager program.
+- The read-only fast path accepts a leading variable assignment (`LC_ALL=C sort f`) only for `LANG`, `LC_*`, `TZ`, `NO_COLOR`, `TERM`, `COLUMNS`, and `FORCE_COLOR`. Any other assignment, such as `PATH`, `LD_*`, `DYLD_*`, `BASH_ENV`, `IFS`, `PAGER`, or `GIT_*`, can change what the command runs or loads, so the call goes to Jev.
+
+## 0.53.0
+
+### Added
+- Rules, slop, and security judge code that a `bash` command writes to a file, as if it were a `write`: heredocs into `cat` or `tee` (quoted or unquoted delimiter, `<<-`), here-strings, and `echo`/`printf` with `>` or `>>`. Each target in a chain is judged on its own, before the command runs, with the same `.gitignore` and outside-project skip as a `write`; an append judges only the appended text. An authoring form whose text cannot be read (`$VAR` or `$(...)` in the body, a pipe into `tee`) and `sed -i`, `patch`, and `git apply` are not judged, and the trace says why; a program's output sent to a file (`cmd > log`) is not judged and leaves no trace note. See `docs/guards.md` → Rules.
+
+## 0.52.2
+
+### Fixed
+
+- The context saver's trace now shows how many token-turns a saving spared. The ledger line of a compression or a dropped duplicate is written before the turn that carries it ends, so it nearly always read `~0 token-turns spared over 0 turns`. When a turn with a saving ends, its latest context entry in the trace gets a second line, `at turn end: Context saver: …`, with the counts that include that turn. Token-turns are the removed tokens (bytes / 4) times the turns the removal has been in effect, summed over the session; a new prompt does not reset them. A whole-file recall puts a stored output back into context, so from the next turn on its bytes no longer count toward token-turns; a scoped recall does not change the count. `/warden status` is unchanged.
+
+## 0.52.1
+
+### Fixed
+
+- Authorizing an rm target from the task text no longer drops an unrelated pattern hit. A hit leaves the level computation only when every per-target violation it produced is authorized; before this, violations and hits were matched by list position, so `rm -rf a b c` with a task naming `c` could drop another rule's hit. An rm-family hit with no readable target (`find . -name '*.log' | xargs rm -rf`, `find -delete`) now gets one violation without a path; only a task that contains that command segment verbatim (whitespace collapsed) authorizes it, so "clean up the log files" does not authorize `xargs rm -rf` of any list, and the hit stays in the level computation. rm targets are read with shell quoting (`rm -rf 'a b'` is one target), redirections such as `2>/dev/null` are no longer targets, and each rm-family hit is scoped only to the targets of the segments that produced it (`rm a; rm -rf b` scopes `rm-rf` to `b`).
+
+## 0.52.0
+
+### Changed
+
+- The compaction evidence appendix lists what already failed, so the agent does not retry it after compaction. `### Tried and failed` holds up to five distinct failed calls from the stuck guard's attempt window, oldest first, each with the last line of its output that names the error (runner tallies such as "Found 1 error." are skipped), at most 160 characters per entry. `### Verification` names the last passing check and says whether code was written or edited after it (`code changed since last passing check: yes/no`), or says that no check has passed yet when code was changed. The stuck section shows failures out of the attempt window instead of an always-empty same-strategy score and a bare tool name.
+- When the appendix is over its 2 000-character cap, lower-value sections shrink first: saved outputs to the three newest, then held actions, then the active task, stuck state, and older checks. The failed attempts and the verification line are kept whole.
+
+### Fixed
+
+- Saved full outputs in the compaction appendix show the tool that produced them and their real size. Before this, every entry read `unknown → path (0 bytes)`. `ContextLedger.record` takes an optional third argument, `{ tool, bytes }`, and the new `ContextLedger.storedOutputs()` returns it with each path. An output recorded without it is listed by path only.
+
+## 0.51.0
+
+### Changed
+
+- The rules guard applies its 31-question cap per write after path scoping, not when the rules file loads. Before this, rules past 31 in file order were never judged, even when most rules were scoped by `paths:` to other files. Each write now takes the rules that apply to its path, in file order, and asks the first 31. The trace entry records how many applicable rules were dropped and the first dropped rule id. The first write in a session with dropped rules shows one notice naming the rules file and that rule id.
+- `/warden status` shows the total rule count, and names only the unscoped rules that are past the cap for every file. `RuleSet.dropped` is replaced by `RuleSet.alwaysDropped` (unscoped rules past the cap); `RuleSet.rules` now holds every parsed rule.
+
+## 0.50.1
+
+### Changed
+
+- `/warden trace` sends the trace as text whenever `PI_WARDEN_TRACE_DIR` is set to an absolute path (the host asked for the trace file), whether or not the host built the sidebar. Before this, the text went out only when the sidebar component was never built, so a host without a terminal UI that builds components would get no trace.
+
+## 0.50.0
+
+### Added
+
+- Credentials in a tool result are masked before the model sees them, not only announced. High-confidence values in the text blocks (private key blocks, `sk-` keys including `sk-proj-`, `ghp_`, `gho_` and `github_pat_` tokens, `AKIA` keys, `xoxa-`/`xoxb-`/`xoxp-` Slack tokens, JWTs, and credential-key assignments whose value looks like a secret) become `[redacted]` before any other rewrite, so compressed excerpts, duplicate notes, and stored full output hold the masked text too. Fixture and documentation stand-ins stay readable. The banner says "N value(s) masked in this output as [redacted]" and tells the agent to check presence without printing the value. A value already announced this session is still masked, without a second banner. `security.maskOutput` (default `true`) turns it off; masking is local and still runs when `security.enabled` is `false`, which only switches off the banner and the security judgments.
+- Built-in pattern `printenv-secret` (destructive): `printenv NAME`, or `echo $NAME` / `echo "${NAME}"`, where the name contains `KEY`, `SECRET`, `TOKEN`, `PASSWORD`, or `PASSWD` in any case, including inside `ssh … "…"` and `fly ssh console -C "…"`. The label tells the agent to check that the variable is set without printing it (`test -n "$NAME" && echo set`, `printenv NAME | wc -c`); those checks, `${NAME:+set}`, `${#NAME}`, bare `printenv`, and `env` are not held. A double-quoted string that expands such a variable is no longer blanked as data text for the pattern rules. Like every built-in pattern, it holds on its own when no judge answers or with `action.floor: "level"`; in the default evidence mode it is evidence for Jev. Exemptable by id.
+
+### Fixed
+
+- Signed URLs no longer raise "Possible credentials". A value found only in the query signature of an `https://` URL that also carries an expiry (`X-Amz-Expires`, `X-Goog-Expires`, `Expires`, or `se=`) counts as a stand-in: the `X-Amz-Signature`, `X-Amz-Credential`, `X-Goog-Signature`, `X-Goog-Credential`, `Signature`, and `token` parameters of S3 and GCS presigned URLs and storage links. It is traced once, with no banner and no masking in the result; redaction of what leaves the machine is unchanged. A `token=` outside such a URL, or a value that also appears on its own, still counts. Before this, nearly every read of an issue tracker's API raised the notice, because its responses carry signed upload URLs. `partitionSecrets` takes the text as an optional second argument for this check.
+- A credential value containing `&` is redacted whole: `DB_PASSWORD=Tr0ub4dor&3xK9` no longer leaves `&3xK9` in what goes to Jev, the trace, or the masked result. `&` still ends a value before another `name=` (a URL query), before a second `&`, and before whitespace or the end.
+- `security.maskOutput` is read from the user file only: a repository's `.pi/pi-warden.json` cannot turn off masking of credentials in its own agent's output.
+- `X-Amz-Security-Token` counts as a signed-URL parameter, so an S3 presigned URL made with temporary credentials no longer raises "Possible credentials".
+
+## 0.49.0
+
+### Added
+
+- The action guard reads which database a `psql`, `mysql`, `mariadb`, or `supabase` command targets (`sqlTarget`): loopback, hosted, or unknown. A loopback `DELETE FROM … WHERE …` warns (`sql-delete-local`) instead of holding; `DROP`, `TRUNCATE`, and a `DELETE` with no `WHERE` or an always-true one (`WHERE true`, `WHERE 1=1`, `WHERE 'a'='a'`, `WHERE NOT false`) still hold on loopback. SQL in a heredoc fed to a database client is now checked for `DROP`, `TRUNCATE`, and `DELETE FROM` on every target, as `-c` SQL is; before, such a heredoc was treated as data and got no hit. A hosted target (Supabase, Neon, RDS, PlanetScale, or a supabase `--linked` or non-local `--target`) warns as elevated (`sql-hosted`), and a write statement against it holds (`sql-hosted-write`). A hosted Postgres command wrapped as `BEGIN READ ONLY; … ROLLBACK;` is quiet; a `COMMIT` anywhere voids that. A variable host such as `$DATABASE_URL`, and SQL from `-f` or a pipe, keep the plain SQL hits. See docs/guards.md.
+
+## 0.48.1
+
+### Fixed
+
+- The intent-mismatch question is asked only when the agent stated a plan for the call: the text of the assistant message that makes the call, or of the text-only message right before it with no tool call in between. Before this, a call with no text of its own was judged against the latest assistant text since the user's prompt, often written before several earlier calls. A shell command with a visible effect (a `git` commit, push, merge, tag, or reset, `gh pr`, `gh release`, or `npm publish` in any segment, decided in code before the request) is still judged against the latest assistant text since the prompt, because an unannounced commit or push after an older plan is the mismatch users object to. On the recorded sessions from 2026-09-21 to 2026-09-24, 151 of 163 intent-mismatch notices were judged against stale text; the question would now be asked for 63 of the 163 (8 against the call's own text, 55 visible actions against stale text). A skipped question is one fewer question in the action request.
+
+### Tooling
+
+- `tests/steer-delivery.test.ts` pins that a steer sent from `tool_call` or `tool_result` for the last call of a turn joins the request that carries the tool result and costs no extra model request, so the intent-mismatch notice stays a steer.
+- `scripts/intent-cases.mjs` reads Pi session logs and, for every intent-mismatch notice, classifies where the plan came from: the message that made the call, the text-only message right before it, or text from before earlier tool calls (stale). It also runs the built `assistantPlan` on each call's branch and counts the notices whose question would still be asked. Aggregate counts only; offline.
+
+### Docs
+
+- README leads with a new image of the self-correction loop and its numbers from the first nine days of use; the headline numbers are updated to match.
+
+## 0.48.0
+
+### Added
+
+- `PI_WARDEN_HOST_PATHS`: a `:`-separated list of absolute directories outside the project where the host lets its agent write. A `write` or `edit` in one of them, after `..` and symlinks are resolved, is not held or warned by the outside-project rule; command rules, path rules, deny rules, sensitive paths, secrets, and Jev still apply. Relative entries, empty entries, and `/` are ignored. Environment only; no config file can set it.
+
+## 0.47.1
+
+### Fixed
+
+- A done-check nudge no longer clears the evidence that caused it. A run that a warden follow-up starts (done-check nudge, runaway recovery, subagent wake) keeps the changes and checks of the run before it, so the agent must still show a passing check. A later "done" with no check in that run is judged and recorded as unverified; the one-nudge-per-prompt bound stays. A user prompt still starts with empty evidence.
+
+### Docs
+
+- Field usage report for 2026-09-21 to 2026-09-24 (`eval/reports/2026-09-24-field-usage/`) and `scripts/field-usage.mjs`, which reads Pi session logs and the holds database and prints aggregate counts only. README leads with the field numbers, names the task spine under Privacy, and notes the scratch-delete exemption and the judgments-off notice.
+
 ## 0.47.0
 
 ### Changed

package/README.md

@@ -6,7 +6,11 @@ pi-warden supervises Pi while it works, catching risky actions, ignored rules, s
 
 Instead of interrupting you for every problem, Warden usually feeds the issue back to the agent so it can correct itself and keep going.
 
-![Real verdicts from pi-warden: the same command gets a different verdict depending on what the user asked for](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/preview.png)
+**In nine days of real use: 743 sessions, 193 risky actions held before they ran, 1,292 notes sent to the agent. After a "done" with no test behind it, the agent ran one 78% of the time.**
+
+![pi-warden tells the agent what it got wrong and the agent fixes it: 65 untested "done" claims, 51 then ran the tests, 5 found a failure it had missed; after a hold the agent found a safer way 33 times](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/hero.png)
+
+<sub>Numbers from the first nine days of real use (2026-09-16 to 2026-09-24, 743 sessions). The quoted lines are verbatim. Counted with `scripts/field-usage.mjs`; the [field report](eval/reports/2026-09-24-field-usage/) has the method and what was noise.</sub>
 
 ## Install
 
@@ -31,7 +35,7 @@ Works without any key (offline guards: pattern list, runaway stop, sensitive-pat
 | **Rules** | every `write` and `edit` | Judges against project Markdown rules, quotes the broken rule |
 | **Slop** | code and replies | Names stubs, restating comments, dead code, hedging |
 | **Stuck** | tool results | Repeated failures using the same strategy |
-| **Done-check** | final message | "Done" claims with no test/build/lint behind them |
+| **Done-check** | final message | "Done" claims with no test/build/lint behind them, or UI changes nobody looked at |
 | **Security** | code and output | Hardcoded secrets, injection risks |
 | **Runaway** | reply stream | Stops replies that begin repeating themselves |
 | **Subagent triage** | async child reports | Keeps noisy background work from waking the parent |
@@ -39,8 +43,10 @@ Works without any key (offline guards: pattern list, runaway stop, sensitive-pat
 
 ## How intervention works
 
+![Real verdicts from pi-warden: the same command gets a different verdict depending on what the user asked for](https://raw.githubusercontent.com/DevMortimer/pi-warden/main/docs/preview.png)
+
 1. **Read-only? Skip.** `git status`, `ls`, `read` means no request and no trace entry.
-2. **Known-dangerous pattern? Catch it locally.** Force push, `git reset --hard`, recursive `rm`, SQL `DROP` held instantly.
+2. **Known-dangerous pattern? Catch it locally.** Force push, `git reset --hard`, recursive `rm`, SQL `DROP` held instantly. An agent deleting temp-directory scratch it created in the same session is not held (macOS and Windows).
 3. **Needs judgment?** Warden evaluates the action in context.
 4. **Steer or hold.** Most issues go back to the agent so it can correct itself. Irreversible actions can be stopped before they run.
 
@@ -52,6 +58,7 @@ In the default `steer` mode, Warden talks to the agent rather than interrupting
 - **Custom policies**: command, path, and arming rules for your own workflow.
 - **Context saver** trims oversized tool output while keeping the full result retrievable.
 - **Multiple judgment backends**: TypeSafe by default, with OpenRouter support.
+- **Honest about being off**: when judgments cannot run (no consent, no key, a rejected key, budget spent) Warden says so once, with the fix. A failing backend is paused after repeated errors instead of costing a timeout per action.
 - **Full traceability**: inspect what Warden saw, decided, and told the agent.
 - **Desktop alerts** for events that need you.
 
@@ -72,6 +79,19 @@ Jev judges every write and quotes violations back. Rules can be things no linter
 
 ## Does it actually help?
 
+### In daily use
+
+Four days of the maintainer's own work, 397 sessions ([report](eval/reports/2026-09-24-field-usage/), [raw numbers](eval/reports/2026-09-24-field-usage/usage.json), `scripts/field-usage.mjs` to run it on your own logs):
+
+- **Done-check:** 47 nudges; in 35 the agent then ran a test or build.
+- **Holds:** 143 of 19,695 actions. Of the 44 with a recorded outcome, the agent took a safer route 33 times.
+- **Rules:** 195 corrections naming a project rule, including a process wait with no timeout and a home path in a public test fixture.
+- **Context:** about 123,000 tokens of oversized output trimmed in the traced sessions, and no agent needed the full output back.
+
+The report also lists what was noise that week (scratch deletes, credential notices on source code, two over-broad rules) and what changed because of it.
+
+### In benchmarks
+
 In 150 paired agent runs, the control setup violated the tested project rule **6 times**. With Warden: **0**.
 
 An overnight stability run covered **13,952 guard cases across 109 cycles** with no score drift.
@@ -86,7 +106,7 @@ These are project-maintained benchmarks, not universal claims. Raw reports and r
 
 ## Privacy
 
-Depending on the configured judgment backend, Warden sends to your provider: a redacted summary of each guarded call, the agent's plan, up to eight redacted prior messages, and redacted tool-output samples. Secrets are stripped before anything leaves the machine. [Full details.](docs/data-handling.md) Security work — pentesting, incident response, CTF — has its own configuration recipe for keeping samples local and for the friction that credentials and lab setups cause: [Recipe: security work](docs/configuration.md#recipe-security-work).
+Depending on the configured judgment backend, Warden sends to your provider: a redacted summary of each guarded call, the agent's plan, up to eight redacted prior messages, the task spine (your first request in the thread and up to four earlier ones, capped at 1,200 characters), and redacted tool-output samples. Secrets are stripped before anything leaves the machine. [Full details.](docs/data-handling.md) Security work — pentesting, incident response, CTF — has its own configuration recipe for keeping samples local and for the friction that credentials and lab setups cause: [Recipe: security work](docs/configuration.md#recipe-security-work).
 
 ## Documentation
 

package/dist/action-guard.d.ts

@@ -36,6 +36,8 @@ export interface InspectOptions {
     previousActions?: readonly PreviousAction[] | undefined;
     /** Real paths the agent created under the temp directory in this session, forwarded to `evaluateAction`. */
     scratch?: ScratchRecords | undefined;
+    /** Real paths of host directories, forwarded to `evaluateAction`. */
+    hostPaths?: readonly string[] | undefined;
 }
 /**
  * The Action guard for one session. `evaluateAction` judges a single call; this module owns what spans calls:

package/dist/action-guard.js

@@ -20,7 +20,7 @@ export class ActionGuard {
         const { task } = conversation;
         // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
         const retryAfterHold = this.holdPending && this.lastHoldPrompt !== task;
-        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan, spine: conversation.spine }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, largeOutput: options.largeOutput, rules: options.rules, retryAfterHold, previousActions, scratch: options.scratch });
+        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan, spine: conversation.spine }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, largeOutput: options.largeOutput, rules: options.rules, retryAfterHold, previousActions, scratch: options.scratch, hostPaths: options.hostPaths });
         // A retry after a hold stays sequential because an approval consumed by one sibling changes the question for the next.
         if (options.judge && !retryAfterHold) {
             for (const sibling of conversation.siblings ?? []) {

package/dist/compact.d.ts

@@ -1,8 +1,18 @@
+/**
+ * Compaction evidence appendix. Deterministic, pure, no Jev request.
+ *
+ * After Pi fires `session_compact`, the extension builds a snapshot from session memory and passes it to
+ * `compactAppendix`. The returned text is sent as one custom message so the agent does not retry approaches that
+ * already failed, knows whether its last passing check still covers the code, and can prefer saved paths over
+ * re-running commands.
+ */
+import type { RunEvidence } from "./done.js";
 export interface SavedOutput {
-    tool: string;
+    /** Undefined when the recorder did not say; the appendix then prints only what it knows. */
+    tool: string | undefined;
     path: string;
     /** Uncompressed size in bytes. */
-    bytes: number;
+    bytes: number | undefined;
 }
 export interface CheckEntry {
     command: string;
@@ -16,10 +26,24 @@ export interface HeldEntry {
     preview: string;
     outcome: string;
 }
+export interface FailedAttempt {
+    /** Redacted call view. */
+    call: string;
+    /** Last meaningful line of the failed output; empty when the output had none. */
+    error: string;
+}
+/** Whether the code as it stands was covered by a passing check. */
+export type Verification = {
+    kind: "passed";
+    command: string;
+    changedSince: boolean;
+} | {
+    kind: "none-passed";
+};
 export interface StuckState {
     failures: number;
-    sameStrategyScore: number | undefined;
-    currentCallFamily: string | undefined;
+    /** Tool results in the attempt window the failures were counted in. */
+    window: number;
 }
 export interface CompactSnapshot {
     savedOutputs: readonly SavedOutput[];
@@ -27,20 +51,34 @@ export interface CompactSnapshot {
     checks: readonly CheckEntry[];
     /** Capped at 10 in the hook before this is called. */
     holds: readonly HeldEntry[];
+    /** Distinct failed calls, oldest first, at most 5. */
+    failedAttempts: readonly FailedAttempt[];
+    verification: Verification | undefined;
     stuck: StuckState | undefined;
     activeTask: string | undefined;
 }
 /** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
 export declare function compactAppendix(snapshot: CompactSnapshot): string;
+/** The line of a failed output most likely to name the error: the last specific error line, else the last line. */
+export declare function errorLine(output: string): string;
+/** Distinct failed calls, the latest occurrence of each, oldest first; at most `MAX_FAILED`. */
+export declare function distinctFailures(attempts: ReadonlyArray<{
+    key: string;
+    call: string;
+    failed: boolean;
+    output: string;
+}>): FailedAttempt[];
+/** Undefined when no check passed and no code changed: there is nothing to say. */
+export declare function verificationOf(evidence: Pick<RunEvidence, "mutations" | "checks" | "checksBeforeMutation">): Verification | undefined;
 /**
  * Build a `CompactSnapshot` from the extension's session-scoped state. All string values are redacted; saved-output
  * paths are local and allowed.
  */
 export declare function buildCompactSnapshot(options: {
     savedOutputs: Array<{
-        tool: string;
+        tool: string | undefined;
         path: string;
-        bytes: number;
+        bytes: number | undefined;
     }>;
     checks: Array<{
         command: string;
@@ -53,11 +91,14 @@ export declare function buildCompactSnapshot(options: {
         preview: string;
         outcome: string;
     }>;
-    stuck: {
-        failures: number;
-        sameStrategyScore: number | undefined;
-        currentCallFamily: string | undefined;
-    } | undefined;
+    /** The stuck guard's attempt window, oldest first. */
+    attempts?: ReadonlyArray<{
+        key: string;
+        call: string;
+        failed: boolean;
+        output: string;
+    }>;
+    evidence?: Pick<RunEvidence, "mutations" | "checks" | "checksBeforeMutation">;
     activeTask: string | undefined;
     runs: number;
 }): CompactSnapshot;

package/dist/compact.js

@@ -1,20 +1,30 @@
-/**
- * Compaction evidence appendix. Deterministic, pure, no Jev request.
- *
- * After Pi fires `session_compact`, the extension builds a snapshot from session memory and passes it to
- * `compactAppendix`. The returned text is sent as one custom message so the agent can prefer saved paths
- * over re-running commands.
- */
 import { redact } from "./redact.js";
 const MAX_CHARS = 2000;
-/** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
-export function compactAppendix(snapshot) {
+const MAX_FAILED = 5;
+const FAILED_ENTRY_CHARS = 160;
+const FAILED_CALL_CHARS = 70;
+const SAVED_KEEP_WHEN_OVER = 3;
+const TASK_CHARS_WHEN_OVER = 300;
+function clip(text, limit) {
+    return text.length <= limit ? text : `${text.slice(0, Math.max(0, limit - 1))}…`;
+}
+function render(snapshot) {
     const sections = [];
-    if (snapshot.savedOutputs.length) {
-        const items = snapshot.savedOutputs
-            .map(item => `- ${redact(item.tool)} → ${redact(item.path)} (${item.bytes} bytes)`)
-            .join("\n");
-        sections.push(`### Saved full outputs\n${items}`);
+    if (snapshot.failedAttempts.length) {
+        const items = snapshot.failedAttempts.map(attempt => {
+            const call = clip(redact(attempt.call), FAILED_CALL_CHARS);
+            const error = redact(attempt.error);
+            const entry = error ? `${call} → ${clip(error, FAILED_ENTRY_CHARS - call.length - 3)}` : call;
+            return `- ${entry}`;
+        }).join("\n");
+        sections.push(`### Tried and failed\nDo not retry these unchanged.\n${items}`);
+    }
+    if (snapshot.verification) {
+        const v = snapshot.verification;
+        const line = v.kind === "passed"
+            ? `- last passing check: ${redact(v.command)}; code changed since last passing check: ${v.changedSince ? "yes" : "no"}`
+            : "- no check has passed yet; code was changed";
+        sections.push(`### Verification\n${line}`);
     }
     if (snapshot.checks.length) {
         const items = snapshot.checks
@@ -22,36 +32,99 @@ export function compactAppendix(snapshot) {
             .join("\n");
         sections.push(`### Last checks\n${items}`);
     }
+    if (snapshot.stuck) {
+        sections.push(`### Stuck state\n- failures: ${snapshot.stuck.failures} of the last ${snapshot.stuck.window} tool results`);
+    }
     if (snapshot.holds.length) {
         const items = snapshot.holds
             .map(h => `- ${redact(h.tool)}: ${redact(h.outcome)}${h.preview ? ` (${redact(h.preview)})` : ""}`)
             .join("\n");
         sections.push(`### Held actions\n${items}`);
     }
-    if (snapshot.stuck) {
-        const s = snapshot.stuck;
-        const family = s.currentCallFamily ? `; family: ${redact(s.currentCallFamily)}` : "";
-        const score = s.sameStrategyScore !== undefined ? `; same-strategy: ${s.sameStrategyScore.toFixed(2)}` : "";
-        sections.push(`### Stuck state\n- failures: ${s.failures}${score}${family}`);
+    if (snapshot.savedOutputs.length) {
+        const items = snapshot.savedOutputs
+            .map(item => `- ${item.tool ? `${redact(item.tool)} → ` : ""}${redact(item.path)}${item.bytes === undefined ? "" : ` (${item.bytes} bytes)`}`)
+            .join("\n");
+        sections.push(`### Saved full outputs\n${items}`);
     }
     if (snapshot.activeTask) {
         sections.push(`### Active task\n${redact(snapshot.activeTask)}`);
     }
     if (sections.length === 0)
         return "";
-    const body = sections.join("\n\n");
-    const appendix = [
+    return [
         "=== PI-WARDEN COMPACT EVIDENCE ===",
         "Evidence warden kept across compaction. Prefer the saved-output paths below over re-running commands that produced them.",
         "",
-        body,
+        sections.join("\n\n"),
         "=== END PI-WARDEN COMPACT EVIDENCE ===",
     ].join("\n");
-    const marker = "\n… [truncated]";
+}
+/**
+ * Lower-value content goes first when the appendix is over the cap. Failed attempts and the verification line are
+ * never reduced here; they come first in the text, so the final cut reaches them last.
+ */
+const REDUCERS = [
+    s => ({ ...s, savedOutputs: s.savedOutputs.slice(-SAVED_KEEP_WHEN_OVER) }),
+    s => ({ ...s, holds: [] }),
+    s => ({ ...s, activeTask: s.activeTask && clip(s.activeTask, TASK_CHARS_WHEN_OVER) }),
+    s => ({ ...s, stuck: undefined }),
+    s => ({ ...s, checks: s.checks.slice(-2) }),
+    s => ({ ...s, savedOutputs: [] }),
+    s => ({ ...s, activeTask: undefined }),
+    s => ({ ...s, checks: [] }),
+];
+/** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
+export function compactAppendix(snapshot) {
+    let appendix = render(snapshot);
+    for (const reduce of REDUCERS) {
+        if (appendix.length <= MAX_CHARS)
+            return appendix;
+        snapshot = reduce(snapshot);
+        appendix = render(snapshot);
+    }
     if (appendix.length <= MAX_CHARS)
         return appendix;
+    const marker = "\n… [truncated]";
     return appendix.slice(0, MAX_CHARS - marker.length) + marker;
 }
+const ERROR_LINE = /\b(?:error|errors|fail(?:ed|ure|s)?|exception|cannot|can't|could not|not found|no such|denied|refused|invalid|unexpected|missing|undefined|timed? ?out|abort(?:ed)?|panic|fatal|traceback)\b|✗|✖|✘/i;
+/** Runner tallies ("Found 1 error.", "3 failing") say that something failed, not what; an earlier line says what. */
+const SUMMARY_LINE = /^(?:found \d+ errors?\b|\d+ (?:failing|failed|errors?)\b|tests?:\s|ℹ fail \d+|npm (?:err!|error) (?:code|errno|a complete log|command failed|lifecycle)|error: command failed|command failed with exit code)/i;
+/** The line of a failed output most likely to name the error: the last specific error line, else the last line. */
+export function errorLine(output) {
+    const lines = output
+        .replace(/^\[\d+ earlier chars\] …/, "")
+        .split("\n")
+        .map(line => line.trim())
+        .filter(line => line && !/^[-=─—*_~.`]+$/.test(line));
+    for (let index = lines.length - 1; index >= 0; index--) {
+        if (ERROR_LINE.test(lines[index]) && !SUMMARY_LINE.test(lines[index]))
+            return lines[index];
+    }
+    return lines.at(-1) ?? "";
+}
+/** Distinct failed calls, the latest occurrence of each, oldest first; at most `MAX_FAILED`. */
+export function distinctFailures(attempts) {
+    const latest = new Map();
+    for (const attempt of attempts) {
+        if (!attempt.failed)
+            continue;
+        latest.delete(attempt.key);
+        latest.set(attempt.key, { call: attempt.call, error: errorLine(attempt.output) });
+    }
+    return [...latest.values()].slice(-MAX_FAILED);
+}
+/** Undefined when no check passed and no code changed: there is nothing to say. */
+export function verificationOf(evidence) {
+    let lastPass = evidence.checks.length - 1;
+    while (lastPass >= 0 && !evidence.checks[lastPass].passed)
+        lastPass--;
+    if (lastPass >= 0) {
+        return { kind: "passed", command: evidence.checks[lastPass].call, changedSince: (evidence.checksBeforeMutation ?? -1) > lastPass };
+    }
+    return evidence.mutations > 0 ? { kind: "none-passed" } : undefined;
+}
 /**
  * Build a `CompactSnapshot` from the extension's session-scoped state. All string values are redacted; saved-output
  * paths are local and allowed.
@@ -74,11 +147,17 @@ export function buildCompactSnapshot(options) {
         preview: h.preview,
         outcome: h.outcome,
     }));
-    const stuck = options.stuck ? {
-        failures: options.stuck.failures,
-        sameStrategyScore: options.stuck.sameStrategyScore,
-        currentCallFamily: options.stuck.currentCallFamily,
-    } : undefined;
+    const attempts = options.attempts ?? [];
+    const failures = attempts.filter(attempt => attempt.failed).length;
+    const stuck = failures > 0 ? { failures, window: attempts.length } : undefined;
     const activeTask = options.activeTask ? redact(options.activeTask) : undefined;
-    return { savedOutputs, checks, holds, stuck, activeTask };
+    return {
+        savedOutputs,
+        checks,
+        holds,
+        failedAttempts: distinctFailures(attempts),
+        verification: options.evidence ? verificationOf(options.evidence) : undefined,
+        stuck,
+        activeTask,
+    };
 }