pi-warden 0.47.0 → 0.60.0

package/dist/config.d.ts

@@ -127,6 +127,8 @@ export interface StuckGuardConfig {
     churnThreshold: number;
     /** Also steer the agent with a short message, not only the user. */
     nudge: boolean;
+    /** Steer on the 2nd identical call when nothing changed between and it failed the same way or re-read the same output. Code only. */
+    repeatSteer: boolean;
     /** Maximum characters of the unified line diff in a stuck-loop diff note. */
     diffLimit: number;
     /** Characters of the current output tail shown after the diff in a stuck-loop diff note. */
@@ -138,7 +140,25 @@ export interface DoneGuardConfig {
     claimsDone: number;
     /** Also send the agent a follow-up asking it to verify. Triggers one more LLM turn. */
     nudge: boolean;
+    /** After a change to a `uiFiles` path, only a `visualTools` call counts as proof; passing tests do not. */
+    uiProof: boolean;
+    /** Globs for files whose change shows on screen. `{a,b}` alternatives are allowed; a `!` glob excludes. */
+    uiFiles: string[];
+    visualTools: VisualToolsConfig;
 }
+/** Tool calls that show the rendered UI. Matching is case-insensitive. */
+export interface VisualToolsConfig {
+    /** Heads of a shell command segment: `agent-browser`, `npx playwright`. */
+    commands: string[];
+    /** Words that make a shell command visual when one stands alone as an argument or flag: `idb screenshot`, `--screenshot`. */
+    commandWords: string[];
+    /** Text in a tool name, or in the `tool` an MCP proxy calls: `take_screenshot`, `navigate_page`. */
+    tools: string[];
+    /** Image extensions whose `read` counts as looking at the result. */
+    images: string[];
+}
+export declare const DEFAULT_UI_FILES: string[];
+export declare function defaultVisualTools(): VisualToolsConfig;
 export interface ProseConfig {
     enabled: boolean;
     /** Who reads the agent's replies: "technical", "plain", or a free-text description. Drives the jargon question. */
@@ -160,6 +180,8 @@ export interface SecurityConfig {
     enabled: boolean;
     /** P(injection or exfiltration) at or above this adds an untrusted-output notice. */
     threshold: number;
+    /** Replace high-confidence credential values in tool results with `[redacted]` before the model sees them. */
+    maskOutput: boolean;
 }
 export interface RulesConfig {
     /** Judge each write and edit against the project's Markdown rules on its own Jev request; steer, never hold. */
@@ -242,6 +264,12 @@ export interface SubagentConfig {
 export type RecallTool = "auto" | "rg" | "ag" | "ugrep" | "git-grep" | "grep" | "select-string" | "findstr" | "none";
 export declare function isRecallTool(value: unknown): value is RecallTool;
 export type WardenMode = "steer" | "confirm" | "advise";
+export interface PrefsConfig {
+    /** Read this project's earlier session files for preferences the user repeated (`/warden prefs`). Local, code only. */
+    enabled: boolean;
+    /** At session start, send the standing preferences to the agent as one context message. Off by default. */
+    inject: boolean;
+}
 export interface LearningConfig {
     /** Enable adaptive thresholds based on learning data. */
     adaptiveThresholds: boolean;
@@ -274,6 +302,8 @@ export interface ConscienceConfig {
     skills: ConscienceSkillConfig;
     /** Tool suggestion settings. */
     tools: ConscienceToolConfig;
+    /** Exact tool names never recommended: core tools the agent already uses. Skills are never skipped by this list. */
+    skipTools: string[];
     /** Total wall-clock deadline for one assessment (ms). Effective deadline is min(this, shared timeoutMs). */
     timeoutMs: number;
     /** Max assessments per admitted operator prompt, including the initial. */
@@ -334,10 +364,12 @@ export interface WardenConfig {
     learning: LearningConfig;
     /** Broad-consideration coach: recommends or loads skills and tools before the agent acts. */
     conscience: ConscienceConfig;
+    /** Standing preferences: corrections the user repeated in earlier sessions of this project. */
+    prefs: PrefsConfig;
 }
 export declare const PACKAGE_NAME = "pi-warden";
 /** Bumped when WardenConfig gains a section; extension.ts checks it so a half-updated module graph is reported, not crashed on. */
-export declare const CONFIG_SCHEMA = 7;
+export declare const CONFIG_SCHEMA = 8;
 export declare const PROJECT_CONFIG_FILE = "pi-warden.json";
 export declare function defaultConfig(): WardenConfig;
 /** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */

package/dist/config.js

@@ -4,13 +4,26 @@ import { dirname, join } from "node:path";
 import { resolveBackend } from "./backend.js";
 import { COMMAND_TOOLS } from "./tools.js";
 import { defaultWidgetConfig } from "./widget.js";
+// Tests of UI code are proven by running them, not by looking at them.
+export const DEFAULT_UI_FILES = [
+    "**/*.{css,scss,sass,less,html,htm,vue,svelte,jsx,tsx,astro,dart}", "**/web/**/*.js", "**/public/**/*.js",
+    "!**/*.{test,spec}.*", "!**/*_test.dart", "!**/{test,tests,__tests__}/**",
+];
+export function defaultVisualTools() {
+    return {
+        commands: ["agent-browser", "playwright", "npx playwright", "flutter test", "fvm flutter test", "idb", "xcrun simctl io", "chrome", "chromium", "google-chrome"],
+        commandWords: ["screenshot"],
+        tools: ["screenshot", "take_snapshot", "navigate"],
+        images: ["png", "jpg", "jpeg", "webp"],
+    };
+}
 const RECALL_TOOLS = ["auto", "rg", "ag", "ugrep", "git-grep", "grep", "select-string", "findstr", "none"];
 export function isRecallTool(value) {
     return typeof value === "string" && RECALL_TOOLS.includes(value);
 }
 export const PACKAGE_NAME = "pi-warden";
 /** Bumped when WardenConfig gains a section; extension.ts checks it so a half-updated module graph is reported, not crashed on. */
-export const CONFIG_SCHEMA = 7;
+export const CONFIG_SCHEMA = 8;
 export const PROJECT_CONFIG_FILE = `${PACKAGE_NAME}.json`;
 export function defaultConfig() {
     return {
@@ -39,10 +52,10 @@ export function defaultConfig() {
             escalationThreshold: 0.85,
             floor: "evidence",
         },
-        stuck: { enabled: true, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 0.7, churnThreshold: 5, nudge: true, diffLimit: 3000, tailLimit: 1000 },
-        done: { enabled: true, claimsDone: 0.7, nudge: true },
+        stuck: { enabled: true, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 0.7, churnThreshold: 5, nudge: true, repeatSteer: true, diffLimit: 3000, tailLimit: 1000 },
+        done: { enabled: true, claimsDone: 0.7, nudge: true, uiProof: true, uiFiles: [...DEFAULT_UI_FILES], visualTools: defaultVisualTools() },
         slop: { enabled: true, threshold: 0.7, prose: { enabled: true, audience: "technical", threshold: 0.7, trend: 2, minChars: 200 } },
-        security: { enabled: true, threshold: 0.7 },
+        security: { enabled: true, threshold: 0.7, maskOutput: true },
         rules: { enabled: true, threshold: 0.7, files: [], fallback: true, maxChars: 8000, exclude: [], skip: [], sensitivePaths: {} },
         context: { enabled: true, tailMinChars: 12000, confidence: 0.8, duplicateMinChars: 2000, recallTool: "auto", formatConfidence: 0.7, compactAppendix: true, largeOutput: { enabled: true, threshold: 0.85 } },
         runaway: { enabled: true, repeats: 4, thinkingRepeats: 10, minChars: 400, recover: true },
@@ -58,6 +71,7 @@ export function defaultConfig() {
             enabled: false,
             skills: { mode: "recommend", exclude: [] },
             tools: { enabled: true, exclude: [] },
+            skipTools: ["read", "bash", "edit", "write", "grep", "find", "ls"],
             timeoutMs: 3000,
             maxAssessments: 3,
             maxNudges: 2,
@@ -68,6 +82,7 @@ export function defaultConfig() {
             advanceThreshold: 0.70,
             loadThreshold: 1.0,
         },
+        prefs: { enabled: true, inject: false },
     };
 }
 /** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */
@@ -299,6 +314,7 @@ function applyStuck(base, raw) {
         sameStrategy: probability(raw.sameStrategy, base.sameStrategy),
         churnThreshold: Math.min(window, positiveInteger(raw.churnThreshold, base.churnThreshold)),
         nudge: boolean(raw.nudge, base.nudge),
+        repeatSteer: boolean(raw.repeatSteer, base.repeatSteer),
         diffLimit: positiveInteger(raw.diffLimit, base.diffLimit),
         tailLimit: positiveInteger(raw.tailLimit, base.tailLimit),
     };
@@ -340,7 +356,20 @@ function applySubagent(base, raw) {
 function applyDone(base, raw) {
     if (!isObject(raw))
         return base;
-    return { enabled: boolean(raw.enabled, base.enabled), claimsDone: probability(raw.claimsDone, base.claimsDone), nudge: boolean(raw.nudge, base.nudge) };
+    const visual = isObject(raw.visualTools) ? raw.visualTools : {};
+    return {
+        enabled: boolean(raw.enabled, base.enabled),
+        claimsDone: probability(raw.claimsDone, base.claimsDone),
+        nudge: boolean(raw.nudge, base.nudge),
+        uiProof: boolean(raw.uiProof, base.uiProof),
+        uiFiles: globList(raw.uiFiles, base.uiFiles),
+        visualTools: {
+            commands: globList(visual.commands, base.visualTools.commands),
+            commandWords: globList(visual.commandWords, base.visualTools.commandWords),
+            tools: globList(visual.tools, base.visualTools.tools),
+            images: globList(visual.images, base.visualTools.images).map(extension => extension.replace(/^\./, "")),
+        },
+    };
 }
 function applyProse(base, raw) {
     if (!isObject(raw))
@@ -424,6 +453,8 @@ function applyGuards(base, raw, timeoutMs, source) {
         security: isObject(raw.security) ? {
             enabled: boolean(raw.security.enabled, base.security.enabled),
             threshold: probability(raw.security.threshold, base.security.threshold),
+            // Only the user file can turn masking off: a repository must not unmask credentials in its own agent's output.
+            maskOutput: source === "user" ? boolean(raw.security.maskOutput, base.security.maskOutput) : base.security.maskOutput,
         } : base.security,
         context: isObject(raw.context) ? {
             enabled: boolean(raw.context.enabled, base.context.enabled),
@@ -458,8 +489,14 @@ export function applyUserOverrides(base, raw) {
         steerBudget: typeof raw.steerBudget === "number" && Number.isInteger(raw.steerBudget) && raw.steerBudget >= 0 ? raw.steerBudget : base.steerBudget,
         learning: applyLearning(base.learning, raw.learning),
         conscience: applyConscience(base.conscience, raw.conscience),
+        prefs: applyPrefs(base.prefs, raw.prefs),
     };
 }
+function applyPrefs(base, raw) {
+    if (!isObject(raw))
+        return base;
+    return { enabled: boolean(raw.enabled, base.enabled), inject: boolean(raw.inject, base.inject) };
+}
 function applyLearning(base, raw) {
     if (!isObject(raw))
         return base;
@@ -487,6 +524,7 @@ function applyConscience(base, raw) {
             enabled: boolean(toolsRaw?.enabled, base.tools.enabled),
             exclude: Array.isArray(toolsRaw?.exclude) ? toolsRaw.exclude.filter((x) => typeof x === "string") : base.tools.exclude,
         },
+        skipTools: Array.isArray(raw.skipTools) ? raw.skipTools.filter((x) => typeof x === "string") : base.skipTools,
         timeoutMs: Math.max(100, Math.min(10000, typeof raw.timeoutMs === "number" ? raw.timeoutMs : base.timeoutMs)),
         maxAssessments: Math.max(1, Math.min(10, typeof raw.maxAssessments === "number" ? raw.maxAssessments : base.maxAssessments)),
         maxNudges: Math.max(1, Math.min(5, typeof raw.maxNudges === "number" ? raw.maxNudges : base.maxNudges)),
@@ -501,7 +539,7 @@ function applyConscience(base, raw) {
 export function applyProjectOverrides(base, raw) {
     if (!isObject(raw))
         return base;
-    return { ...base, enabled: boolean(raw.enabled, base.enabled), ...applyGuards(base, raw, base.timeoutMs, "project") };
+    return { ...base, enabled: boolean(raw.enabled, base.enabled), ...applyGuards(base, raw, base.timeoutMs, "project"), prefs: applyPrefs(base.prefs, raw.prefs) };
 }
 export function loadConfig(options = {}) {
     let config = applyUserOverrides(defaultConfig(), readJson(userConfigPath()));

package/dist/conscience.d.ts

@@ -117,6 +117,19 @@ export declare function buildState(task: string, recentContext: string, activeSk
  * batches happened to serialize identically — an accident of batch order, not a guarantee.
  */
 export declare function questionHash(questions: Questions): string;
+/**
+ * True when a marker is a whole word or `_`-separated part of the name, or the first word of the description.
+ * Only the leading verb of a description counts: a description that mentions removal in passing
+ * ("edit files; remove text") does not make a tool destructive.
+ */
+export declare function isDestructiveTool(name: string, ...descriptions: Array<string | undefined>): boolean;
+/**
+ * Tools that only run on one platform. A recommendation to use one elsewhere costs the agent a turn to find out
+ * it is missing, and it then answers about the tool instead of the task.
+ */
+export declare const PLATFORM_BOUND_TOOLS: Readonly<Record<string, NodeJS.Platform>>;
+/** True when the tool name or a description binds the tool to a platform other than `platform`. */
+export declare function isPlatformIneligibleTool(name: string, platform: NodeJS.Platform, ...descriptions: Array<string | undefined>): boolean;
 /** Filter candidates by eligibility rules, capped at MAX_ELIGIBLE per category. Attaches index entries when available. */
 export declare function eligibleCandidates(skills: Skill[], tools: {
     name: string;
@@ -125,7 +138,7 @@ export declare function eligibleCandidates(skills: Skill[], tools: {
     entries: IndexEntry[];
 } | undefined, projectIndex?: {
     entries: IndexEntry[];
-} | undefined): {
+} | undefined, platform?: NodeJS.Platform): {
     candidates: Candidate[];
     skillOverflow: boolean;
     toolOverflow: boolean;
@@ -157,6 +170,8 @@ export interface ConscienceDeps {
     projectIndex?: {
         entries: IndexEntry[];
     } | undefined;
+    /** Platform the agent's tools run on. Injected for testability; defaults to `process.platform`. */
+    platform?: NodeJS.Platform;
 }
 /**
  * Run assessment for the given prompt revision.

package/dist/conscience.js

@@ -141,8 +141,47 @@ function isExcluded(id, exclude) {
     }
     return false;
 }
+/**
+ * Name parts that mark a tool as destructive. A recommendation to run such a tool is never worth the risk
+ * of the agent calling it on a prompt that only mentioned the subject.
+ */
+const DESTRUCTIVE_MARKERS = new Set(["delete", "drop", "destroy", "remove", "purge", "wipe", "reset", "truncate", "kill", "force", "uninstall", "revoke", "erase", "clear"]);
+/** camelCase is split before lowercasing, so `deleteIssue` and `mcp__db__truncateTable` show their verb. */
+function words(text) {
+    return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+}
+/**
+ * True when a marker is a whole word or `_`-separated part of the name, or the first word of the description.
+ * Only the leading verb of a description counts: a description that mentions removal in passing
+ * ("edit files; remove text") does not make a tool destructive.
+ */
+export function isDestructiveTool(name, ...descriptions) {
+    if (words(name).some(w => DESTRUCTIVE_MARKERS.has(w)))
+        return true;
+    return descriptions.some(d => d !== undefined && DESTRUCTIVE_MARKERS.has(words(d)[0] ?? ""));
+}
+/**
+ * Tools that only run on one platform. A recommendation to use one elsewhere costs the agent a turn to find out
+ * it is missing, and it then answers about the tool instead of the task.
+ */
+export const PLATFORM_BOUND_TOOLS = {
+    powershell: "win32",
+    pwsh: "win32",
+    cmd: "win32",
+};
+const PLATFORM_ONLY_DESCRIPTIONS = [
+    { platform: "win32", pattern: /\bwindows[- ]only\b|\bonly (?:on|for) windows\b/i },
+    { platform: "darwin", pattern: /\b(?:macos|mac os|os x)[- ]only\b|\bonly (?:on|for) (?:macos|mac os|os x)\b/i },
+];
+/** True when the tool name or a description binds the tool to a platform other than `platform`. */
+export function isPlatformIneligibleTool(name, platform, ...descriptions) {
+    const bound = PLATFORM_BOUND_TOOLS[name.toLowerCase()];
+    if (bound !== undefined && bound !== platform)
+        return true;
+    return PLATFORM_ONLY_DESCRIPTIONS.some(({ platform: only, pattern }) => only !== platform && descriptions.some(d => d !== undefined && pattern.test(d)));
+}
 /** Filter candidates by eligibility rules, capped at MAX_ELIGIBLE per category. Attaches index entries when available. */
-export function eligibleCandidates(skills, tools, config, activeSkills, suppliedSkills, globalIndex, projectIndex) {
+export function eligibleCandidates(skills, tools, config, activeSkills, suppliedSkills, globalIndex, projectIndex, platform = process.platform) {
     const candidates = [];
     let skillOverflow = false;
     let toolOverflow = false;
@@ -186,12 +225,19 @@ export function eligibleCandidates(skills, tools, config, activeSkills, supplied
         for (const tool of tools) {
             if (isExcluded(tool.name, config.tools.exclude))
                 continue;
+            // Core tools the agent uses on nearly every turn: a recommendation to use one tells it nothing new.
+            if (config.skipTools.includes(tool.name))
+                continue;
+            const sourceHash = toolSourceHash(tool.name, tool.description);
+            const entry = findEntry(tool.name, sourceHash);
+            if (isDestructiveTool(tool.name, tool.description, entry?.lead))
+                continue;
+            if (isPlatformIneligibleTool(tool.name, platform, tool.description, entry?.lead))
+                continue;
             if (count >= MAX_ELIGIBLE) {
                 toolOverflow = true;
                 break;
             }
-            const sourceHash = toolSourceHash(tool.name, tool.description);
-            const entry = findEntry(tool.name, sourceHash);
             candidates.push({
                 kind: "tool",
                 id: tool.name,
@@ -294,7 +340,7 @@ export async function assess(prompt, recentContext, skills, tools, activeSkills,
     if (!judge) {
         return { disposition: "no_gap", selected: null, usefulness: 0, pAdvance: 0, questionHash: "", elapsedMs: 0, requestCount: 0, skipReason: deps.judgmentsOff ?? "no_consent" };
     }
-    const { candidates, skillOverflow, toolOverflow } = eligibleCandidates(skills, tools, config, activeSkills, suppliedSkills, deps.globalIndex, deps.projectIndex);
+    const { candidates, skillOverflow, toolOverflow } = eligibleCandidates(skills, tools, config, activeSkills, suppliedSkills, deps.globalIndex, deps.projectIndex, deps.platform);
     if (candidates.length === 0) {
         return { disposition: "no_gap", selected: null, usefulness: 0, pAdvance: 0, questionHash: "", elapsedMs: 0, requestCount: 0, skipReason: "no_match" };
     }

package/dist/done.d.ts

@@ -1,5 +1,5 @@
 import type { IntegrationErrorCode, Judge } from "pi-typesafe";
-import type { DoneGuardConfig } from "./config.js";
+import type { DoneGuardConfig, VisualToolsConfig } from "./config.js";
 export type ToolOutcome = "read" | "mutation" | "check-pass" | "check-fail" | "unknown";
 /**
  * What a finished tool call contributes to the run's evidence. Only write/edit count as code changes: shell side effects
@@ -18,9 +18,20 @@ export interface RunEvidence {
         passed: boolean;
     }>;
     checksBeforeMutation?: number;
+    /** The last UI file changed with no visual check after it. Tests and builds do not show what a page looks like. */
+    unseenUi?: string;
 }
 export declare function emptyEvidence(): RunEvidence;
 export declare function recordOutcome(evidence: RunEvidence, outcome: ToolOutcome, input: Record<string, unknown>, tool?: string): void;
+/** A path matches when some glob matches it and no `!` glob does. */
+export declare function isUiFile(path: string, globs: readonly string[]): boolean;
+/**
+ * Whether a successful tool call showed the rendered UI: a browser or device command, a screenshot, a browser MCP tool, or
+ * reading an image. A test run proves the code runs; only this proves what the user will see.
+ */
+export declare function isVisualCheck(tool: string, input: Record<string, unknown>, failed: boolean, visual: VisualToolsConfig): boolean;
+/** Paths a successful call changed that match the UI globs: `write`/`edit` paths, plus files a shell command writes. */
+export declare function recordUi(evidence: RunEvidence, changed: readonly string[], visual: boolean, globs: readonly string[]): void;
 interface MessageLike {
     role: string;
     content?: unknown;
@@ -58,6 +69,8 @@ export interface DoneVerdict {
     reasons: string[];
     evidence: RunEvidence;
     judgment?: DoneJudgment;
+    /** Set when the claim follows a UI change that nothing showed on screen. */
+    unseenUi?: string;
     error?: string;
     errorCode?: IntegrationErrorCode;
 }

package/dist/done.js

@@ -1,6 +1,7 @@
 import { ask, choice, noul } from "pi-typesafe";
-import { isReadOnlyCommand } from "./guard.js";
+import { isReadOnlyCommand, stripDataText } from "./guard.js";
 import { redact } from "./redact.js";
+import { matchGlob } from "./rules.js";
 import { commandOf } from "./tools.js";
 import { DEFAULT_TEMPLATES, doneTokens, renderTemplate } from "./widget.js";
 /** Commands whose success is evidence that the work was verified. */
@@ -62,6 +63,77 @@ export function recordOutcome(evidence, outcome, input, tool = "bash") {
         evidence.checks.push({ call, passed: outcome === "check-pass" });
     }
 }
+// `{a,b}` alternatives, which the rules glob matcher does not read, as in the default `*.{css,html,…}` UI glob.
+function expandBraces(pattern) {
+    const match = /\{([^{}]*)\}/.exec(pattern);
+    if (!match)
+        return [pattern];
+    return match[1].split(",").flatMap(option => expandBraces(pattern.slice(0, match.index) + option + pattern.slice(match.index + match[0].length)));
+}
+/** A path matches when some glob matches it and no `!` glob does. */
+export function isUiFile(path, globs) {
+    const normalised = path.replace(/\\/g, "/");
+    const include = globs.filter(glob => !glob.startsWith("!")).flatMap(expandBraces);
+    const exclude = globs.filter(glob => glob.startsWith("!")).map(glob => glob.slice(1)).flatMap(expandBraces);
+    return matchGlob(normalised, include) !== undefined && matchGlob(normalised, exclude) === undefined;
+}
+function shellSegments(command) {
+    return command.split(/\n|;|&&|\|\||\||&/).map(part => part.trim().replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)+/, "")).filter(Boolean);
+}
+const BROWSER_HEADS = new Set(["chrome", "chromium", "google-chrome"]);
+/**
+ * Heads that also run work the user never sees. `flutter test` shows the UI only for integration or golden tests, and
+ * `idb` only through its `screenshot` and `ui` subcommands; `idb list-targets` or a unit test proves nothing on screen.
+ * A browser binary shows the page only when a command word asks for it (`chrome --headless --screenshot`), not for `--version`.
+ */
+function headShows(head, args) {
+    if (/(?:^|\s)flutter test$/.test(head))
+        return args.some(arg => /(?:^|\/)integration_test(?:\/|$)/.test(arg) || arg.includes("golden"));
+    if (head === "idb")
+        return args.some(arg => arg === "screenshot" || arg === "ui");
+    if (BROWSER_HEADS.has(head))
+        return false;
+    return true;
+}
+/**
+ * Whether a successful tool call showed the rendered UI: a browser or device command, a screenshot, a browser MCP tool, or
+ * reading an image. A test run proves the code runs; only this proves what the user will see.
+ */
+export function isVisualCheck(tool, input, failed, visual) {
+    if (failed)
+        return false;
+    if (tool === "read") {
+        const path = typeof input.path === "string" ? input.path.toLowerCase() : "";
+        return visual.images.some(extension => path.endsWith(`.${extension.toLowerCase()}`));
+    }
+    const view = commandOf(tool, input);
+    if (view) {
+        if (!view.shell)
+            return false;
+        // A PR body, commit message, or heredoc note that mentions a screenshot is not one; nor is a `screenshots/` path.
+        const segments = shellSegments(stripDataText(view.command).text.toLowerCase());
+        const heads = visual.commands.map(command => command.toLowerCase());
+        const words = new Set(visual.commandWords.map(word => word.toLowerCase()));
+        // A command word counts only after a visual head: `grep -rn screenshot src` searches for the word.
+        return segments.some(segment => heads.some(head => {
+            if (segment !== head && !segment.startsWith(`${head} `))
+                return false;
+            const args = segment.slice(head.length).split(/\s+/).filter(Boolean);
+            return headShows(head, args) || args.some(arg => words.has(arg.replace(/^-+/, "").replace(/=.*$/, "")));
+        }));
+    }
+    // An MCP proxy (`mcp`, `mcp__chrome_devtools`) names the real tool in its input.
+    const names = [tool, /^mcp(?:__|$)/.test(tool) && typeof input.tool === "string" ? input.tool : ""].map(name => name.toLowerCase());
+    return names.some(name => name && visual.tools.some(word => name.includes(word.toLowerCase())));
+}
+/** Paths a successful call changed that match the UI globs: `write`/`edit` paths, plus files a shell command writes. */
+export function recordUi(evidence, changed, visual, globs) {
+    const ui = changed.filter(path => isUiFile(path, globs));
+    if (ui.length)
+        evidence.unseenUi = ui[ui.length - 1];
+    else if (visual)
+        delete evidence.unseenUi;
+}
 /** Text of the run's final assistant message, when it ended normally with text (not a tool call, error, or abort). */
 export function finalAssistantText(messages) {
     for (let index = messages.length - 1; index >= 0; index--) {
@@ -84,7 +156,7 @@ export function freshChecks(evidence) {
 }
 /** The check only makes sense when something changed and nothing proved that change works. */
 export function needsDoneCheck(evidence) {
-    return evidence.mutations > 0 && !freshChecks(evidence).some(check => check.passed);
+    return (evidence.mutations > 0 && !freshChecks(evidence).some(check => check.passed)) || evidence.unseenUi !== undefined;
 }
 export const doneQuestions = {
     claims_done: noul("Does `final_message` present the requested work as finished or working?", {
@@ -126,24 +198,34 @@ export async function evaluateDone(task, finalMessage, evidence, options) {
         model: result.model,
         elapsedMs: result.elapsedMs,
     };
-    const unverified = judgment.claimsDone >= options.config.claimsDone && judgment.outcome !== "blocked" && judgment.verificationApplies >= APPLIES_THRESHOLD;
+    const claimed = judgment.claimsDone >= options.config.claimsDone && judgment.outcome !== "blocked";
     const checks = freshChecks(evidence);
+    const codeUnverified = claimed && evidence.mutations > 0 && !checks.some(check => check.passed) && judgment.verificationApplies >= APPLIES_THRESHOLD;
+    // The file type already says a visual check applies, so `verification_applies` (about tests and builds) does not gate it.
+    const unseenUi = claimed ? evidence.unseenUi : undefined;
+    const unverified = codeUnverified || unseenUi !== undefined;
     // Total checks, not fresh: a false claim is nothing ever run in the run; a stale check is unverified, not a lie.
     const falseClaim = unverified && judgment.claimsVerified >= 0.7 && evidence.checks.length === 0;
     const reasons = [];
-    if (unverified) {
+    if (codeUnverified) {
         const failed = checks.filter(check => !check.passed).length;
         reasons.push(`reports completion (${judgment.claimsDone.toFixed(2)}) after ${evidence.mutations} file change${evidence.mutations === 1 ? "" : "s"} with ${failed ? `${failed} failed check${failed === 1 ? "" : "s"} and no passing one` : "no test, build, or lint run since the last change"}`);
     }
+    if (unseenUi !== undefined)
+        reasons.push(codeUnverified ? "no browser, screenshot, or device check since the last UI change" : `reports completion (${judgment.claimsDone.toFixed(2)}) after a UI change with no browser, screenshot, or device check since`);
     if (falseClaim)
         reasons.push(`claims checks passed (${judgment.claimsVerified.toFixed(2)}) but none ran`);
-    return { unverified, falseClaim, reasons, evidence, judgment };
+    return { unverified, falseClaim, reasons, evidence, judgment, ...(unseenUi !== undefined ? { unseenUi } : {}) };
 }
 /** Follow-up for the agent: verify or say plainly that nothing was verified. */
 export function doneNudge(verdict) {
     const failed = freshChecks(verdict.evidence).filter(check => !check.passed);
+    const codeUnverified = verdict.unseenUi === undefined
+        || (verdict.evidence.mutations > 0 && !freshChecks(verdict.evidence).some(check => check.passed) && (verdict.judgment?.verificationApplies ?? 1) >= APPLIES_THRESHOLD);
     const detail = failed.length ? `The last check that ran failed: ${failed.at(-1).call}. Fix that first.` : "Run the project's tests, build, or lint (whatever exists) on what you changed.";
-    return `pi-warden: ${verdict.reasons.join("; ")}. ${detail} Then report the actual result. If no check exists or can run, say so explicitly instead of presenting the work as done.`;
+    const code = codeUnverified ? ` ${detail} Then report the actual result. If no check exists or can run, say so explicitly instead of presenting the work as done.` : "";
+    const ui = verdict.unseenUi !== undefined ? ` You changed \`${redact(verdict.unseenUi)}\` but did not look at the result. Open it in a browser or take a screenshot before calling it done, or say it is unverified.` : "";
+    return `pi-warden: ${verdict.reasons.join("; ")}.${code}${ui}`;
 }
 export function formatDone(verdict, template = DEFAULT_TEMPLATES.done) {
     return renderTemplate(template, doneTokens(verdict));

package/dist/extension.d.ts

@@ -3,9 +3,9 @@ import type { JudgmentBackend, JudgmentsOffReason } from "./backend.js";
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit (or a bash command that writes a file with its content in the command) in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /** Which guard spent the user's attention. The status line reports one count per guard. */
-export type SteerGuard = "action" | "rules" | "security" | "stuck" | "done" | "prose" | "runaway" | "subagent" | "conscience";
+export type SteerGuard = "action" | "rules" | "security" | "stuck" | "repeat" | "done" | "prose" | "runaway" | "subagent" | "conscience";
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
  * message count; the line says so instead of hiding it. Worst offender first: that is the number worth acting on.
@@ -20,11 +20,17 @@ export declare function formatSteers(stats: {
  * so judging them one request at a time costs one round trip per call; judging them together costs one round trip.
  */
 export declare function siblingToolCalls(ctx: ExtensionContext): ToolCallRef[];
+/** Whether the call is a shell command with a visible effect (commit, push, merge, tag, reset, pull request, release, publish). */
+export declare function isVisibleAction(tool: string, input: Record<string, unknown>): boolean;
 /**
- * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
- * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ * The agent's own words for the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the text of the assistant message right before it with no tool call in between. Text from before an
+ * earlier tool call described that call, so it is no plan and the intent question is not asked. The exception is
+ * `visibleAction` (a commit, push, merge, tag, reset, pull request, release, or publish, by `isVisibleCommand`): such a
+ * call is still judged against the latest assistant text since the user's prompt, because an unannounced commit or push
+ * after an older plan is the mismatch users object to. Sent as `plan`; it explains the step and cannot approve it.
  */
-export declare function assistantPlan(ctx: ExtensionContext): string | undefined;
+export declare function assistantPlan(ctx: ExtensionContext, visibleAction?: boolean): string | undefined;
 /**
  * The once-per-session notice: why Jev judgments are off and what turns them on. `rejectedEnv` is the environment
  * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never