pi-warden 0.48.1 → 0.64.1

package/CHANGELOG.md

@@ -8,6 +8,222 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.64.1
+
+### Fixed
+
+- A recursive `rm` of recorded session scratch now keeps its hold when the same command also moves, links, copies, extracts, or mounts data: `mv`, `ln`, `cp`, `tar` (also `g`- or `bsd`-prefixed), `rsync`, `mount`, `hdiutil`, `bindfs`, or `git … clone`, anywhere in the command and also quoted or escaped (`\mv`, `"ln"`, `l''n`). The scratch tree walk runs before the command, so it could not see data the command itself put into the scratch path before its `rm`. A plain `rm -rf` of recorded scratch is still released.
+
+## 0.64.0
+
+### Added
+
+- Open loops. New agent tool `warden_loops` keeps what the agent promised to do later in this session: `add` (at most 160 characters, with an optional `when` condition such as "after CI passes"), `done`, `drop` with a reason, and `list`; its description tells the agent to add a loop whenever it promises something for later. The open loops (at most 8 and 600 characters) appear in the compaction appendix, in one end-of-run notice for the next turn (counted against the steer budget as `loops`, never twice for the same unchanged list), and in one message on resume. Loops are stored per session and project in pi-warden's data folder, so they survive compaction and resume and never reach another session or project. `/warden loops` lists them for the user.
+- New agent tool `warden_recall`: the failed attempts of this session with their error lines, the last passing check with whether the code changed since, and the saved-output paths. It prints the same sections the compaction appendix builds, from the same session state. Read-only.
+- Both run in code, with no TypeSafe request.
+
+## 0.63.0
+
+### Changed
+
+- An intent mismatch on a call with no visible effect is trace-only: the trace, the warn notice, and the status line (`N off plan (M trace-only)`) record it, and the agent gets no steer. A commit, push, merge, tag, reset, pull request, release, or publish still steers (decided in code by `isVisibleCommand`), and so does any call Jev judges `visible` at 0.8 or more, such as an install, a launched program, or a message sent from a script. The steer reaches the agent only after the call ran: on 275 recorded intent-mismatch steers over 7 days, 275 arrived after the call, and a strict course change (the agent asked the user, reverted, or changed approach) followed 8% of them. New `action.intentTraceOnly` sets which mismatches are trace-only: `"invisible"` (default), `"all"`, or `"none"` (every mismatch steers, as before).
+
+## 0.62.0
+
+### Changed
+
+- `prefs.inject` is on by default, and strict: a wrong memory is worse than none. A standing preference reaches the agent only when you typed it, in a standing form (no question and no temporary word; `now`, `until`, `this PR`, `this branch`, and `for this` join `yet`, `for now`, `today`, and `this time`), not bound to one task (a pronoun-only object such as "don't commit it", a ticket, branch, PR number, or hash), in 3 or more sessions on 2 or more days, last within 30 days, not lifted by a later message of the opposite polarity ("do use subagents here"), and not weakening a check (skipping tests, checks, reviews, or confirmations, turning warden off, or pushing, deploying, or deleting without asking; the markers are in `WEAKENS_CHECK`). At most 5 items and 400 characters, each quoted as said with its session count, ending with "If the current request says otherwise, follow the current request." Still one message per session, not a steer, and not repeated on resume.
+- `/warden prefs` shows each item as injected or the rule that kept it out ("not injected: seen in 2 sessions", "not injected: weakens a check"). `/warden prefs forget <n>` drops an item for the project for good, rewordings included; the key is kept in pi-warden's data folder.
+- New agent tool `warden_remember`: after a user correction, or a stuck, repeat, or done-check steer, within the last 5 assistant turns of the run, the agent can record one standing lesson (at most 160 characters) for the project. The same rules apply; a lesson that repeats a stored lesson or a listed preference confirms it instead of adding one. A lesson is injected only once confirmed (recorded again in a later session, or said by the user), after your preferences, marked `(agent lesson)`, and expires after 30 days without a confirmation. Lessons are stored with the date and session id under pi-warden's data folder, never in a rules file or a session file. Preference and lesson text goes to the session model only, never to TypeSafe.
+
+## 0.61.0
+
+### Added
+
+- The context saver cuts repeated runs. In a new tool result, a run of at least 20 lines and 1500 characters that exactly matches text already in context on the current branch becomes one pointer line naming where the earlier copy is and the file that holds the full text. The last 2000 characters and images are never changed. The ledger counts the removed bytes and their token-turns; `/warden status` shows the repeats cut. `context.dedupeRuns` (default `true`) turns it off. `context.dedupeMessages` (default `false`) applies the same cut to new user and custom messages; it is off by default because a repeat the user sends can itself carry meaning.
+
+### Tests
+
+- A repeated report in a new tool result, and with `context.dedupeMessages` in a custom or user message, is cut to one pointer line; messages stay whole by default; one changed line breaks the match; the tail stays; the stored copy holds the full text and reading it back is a recall; `context.dedupeRuns: false` leaves everything whole.
+
+## 0.60.1
+
+### Fixed
+
+- Message text in a command is no longer read as a command. The quoted values of `--body`, `-b`, `--title`, `-t`, and `--notes` on `gh pr|issue|release create|edit|comment`, and of `-m` and `--message` on `git commit` and `git tag`, are blanked before the patterns run, also in `=` form and as `$'…'`. A body that held `;`, `&&`, or new lines was cut into segments before, so a PR body that quoted `rm -rf /` was held as destructive. A value with `$(`, backticks, or an unclosed quote is still read, because the shell runs it.
+- A recursive `rm` right after a backtick (`` `rm -rf ~` ``) is now classified like one after `$(`.
+
+## 0.60.0
+
+### Changed
+
+- `git reset --hard` warns instead of holding when the working tree is clean: `git status --porcelain` in the call's directory prints nothing. The check runs once with a 2-second timeout; a failed or timed-out check holds.
+- `git push --force-with-lease` now holds by default. It warns only when every target branch is named in the command or is the current branch, no target is `main`, `master`, or the remote's HEAD branch, and the command has no plain `--force`/`-f`. A `+` or delete refspec, `--all`, `--mirror`, `--tags`, an unknown flag, a detached HEAD, or `push.default=matching` on a bare push keeps the hold.
+- Both relaxations read only a plain single `git reset` or `git push` command. A `cd`, `-C`, quote, variable, or second command keeps the hold.
+- The conscience no longer sends its `agent_end` reminder when the run ended with a final text reply. The agent has answered; a reminder then started a new turn to revisit a finished answer.
+
+### Fixed
+
+- `git reset --hard` with global options before `reset` (`git -C dir`, `--git-dir`, `--work-tree`, `-c key=value`) is held. Before, the pattern needed `reset` right after `git`, so `git -C dir reset --hard` was neither held nor warned.
+- `git push --force`, `-f`, and `--force-with-lease` with the same global options before `push` (`git -C dir push --force`) are held. The push patterns had the same gap.
+
+### Tests
+
+- A clean and a changed tree for `reset --hard`, and a failed status check. Lease pushes to a feature branch, to `main`, `master`, and the remote HEAD branch, with plain `--force`, with a bare push that tracks the default branch, and outside a repository. A conscience run that ended with a final reply sends no reminder. `reset --hard` with `-C`, `--git-dir`, `--work-tree`, and `-c` on a clean tree is held. `push --force`, `-f`, and `--force-with-lease` with those options are held.
+
+## 0.59.5
+
+### Fixed
+
+- Shell writes that gave neither a judged write nor a skip are now judged. `exec > f; echo x` judges the text the later commands print into `f`; a redirected `{ echo x; } > f` or `(echo x) > f` group judges the text its commands print, and a group that also runs a program is skipped with a reason; `env echo x > f` treats `env` as a wrapper; a target such as `/dev/../tmp/p/f` is normalized before the `/dev/` test; a partly quoted heredoc delimiter (`<<E"OF"`) ends at `EOF` and keeps the body literal, as in bash.
+- One bash command no longer starts one rules request per write. Writes to the same file are joined into one request (40 `>>` appends to one file are one request), and past five files a command writes, the rest are recorded in the trace as skipped. The action request lists each file once.
+- The done-check no longer counts `grep -rn screenshot src`, `idb list-targets`, or `flutter test test/unit/x_test.dart` as visual proof. A `done.visualTools.commandWords` word counts only after a `commands` head, `flutter test` counts only for an `integration_test/` or golden path (or `--update-goldens`), and `idb` only for its `screenshot` or `ui` subcommand. `chrome`, `chromium`, and `google-chrome` are now `commands` heads that count with a screenshot flag (`chrome --headless --screenshot=…`), so a headless-browser screenshot is proof and `chromium --version` is not.
+- The conscience now drops camelCase destructive tools (`deleteIssue`, `dropTable`, `mcp__db__truncateTable`) and tools whose name or leading description verb is `kill`, `force`, `uninstall`, `revoke`, `erase`, or `clear` (`kill_process`, `force_push`, `uninstall_package`).
+
+## 0.59.4
+
+### Fixed
+
+- A prompt no longer authorizes a recursive `rm` of `/`, `.`, `./`, `..`, `~`, `*`, or `$HOME`. Before, "Clean up build/ please." released the hold on `rm -rf /`: the target `/` was found in `build/`. The `rm-recursive-dangerous-target` hit is now never authorized by a prompt. A path the prompt authorizes must appear as a whole word (a space, quote, bracket, or punctuation before and after it), so `old/build` and `build.gradle` no longer authorize `rm -rf build`, and a root-like, home, variable, or one-character target is never matched.
+- `git grep` takes the read-only fast path only with listed flags. `--open=sh` (git accepts any abbreviation of `--open-files-in-pager`) and `-O` bundled after other flags (`-lOnode`) run a program on the matched files, and both skipped the judge.
+- The `/warden index` directory is a host path only when neither it nor a directory between it and Pi's agent directory is a symlink, and its real path is inside the agent directory. A symlinked index directory could make the home directory a host path, so an overwrite of a shell profile was not held.
+- The read-only fast path no longer takes commands that write a file named in their arguments: `sort -o`, `uniq` with an output file, `tree -o` and `tree -R`, and `xxd -r` or `xxd` with an output file.
+
+### Tests
+
+- Tests for each case above: the root-like `rm` prompts, the `git grep` pager forms and common safe flags, a symlinked index directory, and the writing forms of `sort`, `uniq`, `tree`, and `xxd`.
+
+## 0.59.3
+
+### Fixed
+
+- The conscience no longer recommends a tool that cannot run on this platform. `powershell`, `pwsh`, and `cmd` are dropped from the tool candidates when the platform is not Windows, and a tool whose description says Windows-only or macOS-only is dropped on the other platforms. Skills are not filtered. In a run on macOS the conscience recommended `tool:powershell` at P(useful) 0.91; its end-of-run reminder then made the agent spend a turn checking for `pwsh` and answer about PowerShell instead of the task. The reminder re-runs the same assessment, so it can no longer name such a tool either.
+- The conscience's end-of-run reminder now passes the same activation gate as the first recommendation. Before, a capability held with `no_policy` (question hash or answering model not in the policy) was still sent later as `Reminder: consider using …`, which bypassed the gate that should fail closed.
+
+## 0.59.2
+
+### Changed
+
+- The `large_output` score of a judged `bash` call is now recorded. The action trace entry shows it (`large-output 0.12` in the details, a `largeOutput` template token), and the holds database keeps it in `scores`. The hold signature still hashes only the irreversible score and the reasons, so hold matching is unchanged. Before, the question never steered in field use and nothing showed whether it scored low or was never asked.
+- The context saver traces the outputs it judged and kept whole. One `context` trace entry per output (per text block for a multi-block result) records the retention, confidence, format, and format confidence, so the `context.confidence` gate can be calibrated. Trace only: no notice, no steer, and the status line does not change.
+
+### Fixed
+
+- `/warden recommend` is offered in the command completions (`/warden rec` completes to it) and has a row in `docs/commands.md`.
+
+## 0.59.1
+
+### Fixed
+
+- A write or edit of a `/warden index` file is no longer held as "overwrites a file outside the project". `/warden index` asks the agent to write `global.json` and `projects/<hash>.json` in `pi-warden/index/` under Pi's agent directory, and in a hold-precision review 3 of the 4 approved outside-project overwrite holds were these files. That directory is now always a host path for the outside-project rule. The rest of the agent directory is still held: `auth.json`, `settings.json`, pi-warden's own `config.json`, and other extensions' data. Every other check still applies there.
+
+## 0.59.0
+
+### Added
+
+- Standing preferences. `/warden prefs` lists the corrections and preferences you repeated in two or more earlier sessions of this project ("never bump the version in a feature commit", "keep replies short"), each with its session count and last date, and suggests adding the ones worth keeping to `pi-warden.md` as rules. The scan reads only the messages you typed (not tool output, extension messages, pasted orders and reports, messages another agent relays for you, questions, or temporary holds such as "don't commit yet") in the session files of the project and of its other git worktrees, at most the 200 newest sessions of the last 30 days within a 250 ms budget. It groups clauses that share most of their words, or a subject word that is rare in your messages ("don't spawn subagents", "no subagents, review it yourself"), and keeps the 10 most repeated. It runs in code, once per session start, and never writes a file. New keys `prefs.enabled` (default `true`) and `prefs.inject` (default `false`): with `inject` on, the list goes to the agent as one context message at session start (at most 600 characters, not a steer, no steer budget spent).
+
+## 0.58.0
+
+### Changed
+
+- The conscience no longer recommends core tools the agent already uses. In a week of field use, 75 of 144 recommendations named `read`, `bash`, or `edit`, which tells the agent nothing new; one read "use bash instead of bash". New key `conscience.skipTools`, default `["read", "bash", "edit", "write", "grep", "find", "ls"]`, removes those tools from the candidate list before the judge is asked. Skills are never removed by this key; `skipTools: []` restores the earlier behaviour. The question wording is unchanged, so the beta policy hash still matches.
+- The conscience never recommends a destructive tool. A tool whose name has `delete`, `drop`, `destroy`, `remove`, `purge`, `wipe`, `reset`, or `truncate` as a whole word or `_`-separated part, or whose description starts with one of these words, is not a candidate. The field data had 4 recommendations of `delete_project`.
+- Fewer candidates make the conscience request smaller. On a catalog of 19 skills and 32 tools, one assessment now sends 45 questions in 2 requests instead of 54 questions in 3.
+
+## 0.57.0
+
+### Added
+
+- The done-check asks for a visual check after UI changes (`done.uiProof`, default on). When a run changes a file that matches `done.uiFiles` (stylesheets, markup, `.jsx`/`.tsx`/`.vue`/`.svelte`/`.astro` components, Flutter `.dart` files, `web/` and `public/` scripts; tests excluded), whether by `write`, `edit`, or a `bash` file write, passing tests and builds no longer prove a "done" reply. Only a successful `done.visualTools` call after the last UI change does: `agent-browser`, `playwright`, `flutter test`, `idb`, `xcrun simctl io`, a `screenshot` command, a browser MCP tool such as `take_screenshot` or `navigate_page`, or a `read` of an image. Without one, the final reply is judged with the existing questions, and the nudge names the file: "You changed `web/app.css` but did not look at the result. Open it in a browser or take a screenshot before calling it done, or say it is unverified." In a week of real sessions, 23 of 75 UI runs that ended with a "done" reply had no visual step after the last UI change; replayed, the rule nudges 20 of them and 7 of the other 52, 6 of which had no real visual step either. `uiProof: false` restores the previous rule. See `docs/guards.md` → Done-check.
+
+## 0.56.1
+
+### Tests
+
+- The two judge cooldown tests that wait for the window to end no longer depend on runner speed. They used a 40 ms window and a 60 ms sleep, so on a slow runner the window could end again before the next action, and the test failed with `the window is open again: 3 !== 2`. They now use a 60 s window and move a mocked `Date.now` forward instead of sleeping. The failed-probe test also checks that the probe after the window reaches the judge, so it can no longer pass when the window never ends. `JudgeCooldown` now reads `Date.now` on each call rather than keeping the function it saw at construction; the timing is unchanged.
+
+## 0.56.0
+
+### Added
+
+- The stuck guard catches a literal repeat on the 2nd call, in code, with no request. When the agent makes the same call (same tool and input) a second time and nothing that can change state ran between, it gets a short steer if the call failed with the same output ("you already ran `npm test`; it failed the same way: 1 failing. Change something before running it again.") or if a read (`read`, or a read-only shell command) returned the same output again ("you already have this output from `read src/config.ts` (3 calls ago); nothing changed since."). Every call that is not provably read-only resets the check: writes and edits, MCP tools, scripts, unknown tools, and shell commands that are not read-only; only `read`, `grep`, `find`, `ls`, and read-only shell commands do not. Polling and waiting (`sleep`, `watch`, `git status`, `gh run watch`, `gh pr checks`, `tail -f`, `ps`) never fire. It fires once per call per prompt, so a 3rd identical failure still reaches the regular stuck check; it counts against the per-run steer budget as `repeat`, and a stuck verdict on the same result takes its place. New key `stuck.repeatSteer` (default `true`) turns it off; it also follows `stuck.nudge`.
+
+## 0.55.0
+
+### Changed
+
+- With masking on, the credential banner in a tool result is sent only when a value was masked, and its text is unchanged. A credential-shaped value that was detected but not masked is recorded in the trace as `possible credentials, none masked (traced)` and is not announced to the agent. With `security.maskOutput: false` the value is in the agent's context, so the generic notice stays. In one week of sessions, 510 of 527 credential banners were the generic "Possible credentials in this output" text that pointed at no value, and agents disputed 49 of them. The prompt-injection notice is unchanged.
+- Masking now covers every value the offline credential check detects: URL passwords (`postgres://user:pass@host`), `Authorization` header and `Bearer` values, `ghu_`/`ghs_`/`ghr_` GitHub tokens, `xoxr-`/`xoxs-` Slack tokens, and `AIza` keys. Before, these were announced but left readable in the tool result.
+
+## 0.54.0
+
+### Changed
+
+- The action guard's read-only fast path, which skips the Jev judgment, now also accepts `sed -n` with one print command (`sed -n '10,20p' f`, `sed -n '/a/,/b/p' f`), `git worktree list`, `git stash list`, and `git merge-base`. For `sed`, the only accepted options are ones that cannot write or run anything: no `-i`, no `-f`, and no option after the first operand. The script must be literal, with no variable expansion and no `w`, `W`, `e`, or `r` command. In one week of real sessions, `sed -n` line ranges were almost all of the read-only commands that still went to Jev; about a third of them got a `warn`. The fast path now also rejects `<(...)` process substitution and git's `--output` and `-O`/`--open-files-in-pager`, which run a command, write a file, or open a pager program.
+- The read-only fast path accepts a leading variable assignment (`LC_ALL=C sort f`) only for `LANG`, `LC_*`, `TZ`, `NO_COLOR`, `TERM`, `COLUMNS`, and `FORCE_COLOR`. Any other assignment, such as `PATH`, `LD_*`, `DYLD_*`, `BASH_ENV`, `IFS`, `PAGER`, or `GIT_*`, can change what the command runs or loads, so the call goes to Jev.
+
+## 0.53.0
+
+### Added
+- Rules, slop, and security judge code that a `bash` command writes to a file, as if it were a `write`: heredocs into `cat` or `tee` (quoted or unquoted delimiter, `<<-`), here-strings, and `echo`/`printf` with `>` or `>>`. Each target in a chain is judged on its own, before the command runs, with the same `.gitignore` and outside-project skip as a `write`; an append judges only the appended text. An authoring form whose text cannot be read (`$VAR` or `$(...)` in the body, a pipe into `tee`) and `sed -i`, `patch`, and `git apply` are not judged, and the trace says why; a program's output sent to a file (`cmd > log`) is not judged and leaves no trace note. See `docs/guards.md` → Rules.
+
+## 0.52.2
+
+### Fixed
+
+- The context saver's trace now shows how many token-turns a saving spared. The ledger line of a compression or a dropped duplicate is written before the turn that carries it ends, so it nearly always read `~0 token-turns spared over 0 turns`. When a turn with a saving ends, its latest context entry in the trace gets a second line, `at turn end: Context saver: …`, with the counts that include that turn. Token-turns are the removed tokens (bytes / 4) times the turns the removal has been in effect, summed over the session; a new prompt does not reset them. A whole-file recall puts a stored output back into context, so from the next turn on its bytes no longer count toward token-turns; a scoped recall does not change the count. `/warden status` is unchanged.
+
+## 0.52.1
+
+### Fixed
+
+- Authorizing an rm target from the task text no longer drops an unrelated pattern hit. A hit leaves the level computation only when every per-target violation it produced is authorized; before this, violations and hits were matched by list position, so `rm -rf a b c` with a task naming `c` could drop another rule's hit. An rm-family hit with no readable target (`find . -name '*.log' | xargs rm -rf`, `find -delete`) now gets one violation without a path; only a task that contains that command segment verbatim (whitespace collapsed) authorizes it, so "clean up the log files" does not authorize `xargs rm -rf` of any list, and the hit stays in the level computation. rm targets are read with shell quoting (`rm -rf 'a b'` is one target), redirections such as `2>/dev/null` are no longer targets, and each rm-family hit is scoped only to the targets of the segments that produced it (`rm a; rm -rf b` scopes `rm-rf` to `b`).
+
+## 0.52.0
+
+### Changed
+
+- The compaction evidence appendix lists what already failed, so the agent does not retry it after compaction. `### Tried and failed` holds up to five distinct failed calls from the stuck guard's attempt window, oldest first, each with the last line of its output that names the error (runner tallies such as "Found 1 error." are skipped), at most 160 characters per entry. `### Verification` names the last passing check and says whether code was written or edited after it (`code changed since last passing check: yes/no`), or says that no check has passed yet when code was changed. The stuck section shows failures out of the attempt window instead of an always-empty same-strategy score and a bare tool name.
+- When the appendix is over its 2 000-character cap, lower-value sections shrink first: saved outputs to the three newest, then held actions, then the active task, stuck state, and older checks. The failed attempts and the verification line are kept whole.
+
+### Fixed
+
+- Saved full outputs in the compaction appendix show the tool that produced them and their real size. Before this, every entry read `unknown → path (0 bytes)`. `ContextLedger.record` takes an optional third argument, `{ tool, bytes }`, and the new `ContextLedger.storedOutputs()` returns it with each path. An output recorded without it is listed by path only.
+
+## 0.51.0
+
+### Changed
+
+- The rules guard applies its 31-question cap per write after path scoping, not when the rules file loads. Before this, rules past 31 in file order were never judged, even when most rules were scoped by `paths:` to other files. Each write now takes the rules that apply to its path, in file order, and asks the first 31. The trace entry records how many applicable rules were dropped and the first dropped rule id. The first write in a session with dropped rules shows one notice naming the rules file and that rule id.
+- `/warden status` shows the total rule count, and names only the unscoped rules that are past the cap for every file. `RuleSet.dropped` is replaced by `RuleSet.alwaysDropped` (unscoped rules past the cap); `RuleSet.rules` now holds every parsed rule.
+
+## 0.50.1
+
+### Changed
+
+- `/warden trace` sends the trace as text whenever `PI_WARDEN_TRACE_DIR` is set to an absolute path (the host asked for the trace file), whether or not the host built the sidebar. Before this, the text went out only when the sidebar component was never built, so a host without a terminal UI that builds components would get no trace.
+
+## 0.50.0
+
+### Added
+
+- Credentials in a tool result are masked before the model sees them, not only announced. High-confidence values in the text blocks (private key blocks, `sk-` keys including `sk-proj-`, `ghp_`, `gho_` and `github_pat_` tokens, `AKIA` keys, `xoxa-`/`xoxb-`/`xoxp-` Slack tokens, JWTs, and credential-key assignments whose value looks like a secret) become `[redacted]` before any other rewrite, so compressed excerpts, duplicate notes, and stored full output hold the masked text too. Fixture and documentation stand-ins stay readable. The banner says "N value(s) masked in this output as [redacted]" and tells the agent to check presence without printing the value. A value already announced this session is still masked, without a second banner. `security.maskOutput` (default `true`) turns it off; masking is local and still runs when `security.enabled` is `false`, which only switches off the banner and the security judgments.
+- Built-in pattern `printenv-secret` (destructive): `printenv NAME`, or `echo $NAME` / `echo "${NAME}"`, where the name contains `KEY`, `SECRET`, `TOKEN`, `PASSWORD`, or `PASSWD` in any case, including inside `ssh … "…"` and `fly ssh console -C "…"`. The label tells the agent to check that the variable is set without printing it (`test -n "$NAME" && echo set`, `printenv NAME | wc -c`); those checks, `${NAME:+set}`, `${#NAME}`, bare `printenv`, and `env` are not held. A double-quoted string that expands such a variable is no longer blanked as data text for the pattern rules. Like every built-in pattern, it holds on its own when no judge answers or with `action.floor: "level"`; in the default evidence mode it is evidence for Jev. Exemptable by id.
+
+### Fixed
+
+- Signed URLs no longer raise "Possible credentials". A value found only in the query signature of an `https://` URL that also carries an expiry (`X-Amz-Expires`, `X-Goog-Expires`, `Expires`, or `se=`) counts as a stand-in: the `X-Amz-Signature`, `X-Amz-Credential`, `X-Goog-Signature`, `X-Goog-Credential`, `Signature`, and `token` parameters of S3 and GCS presigned URLs and storage links. It is traced once, with no banner and no masking in the result; redaction of what leaves the machine is unchanged. A `token=` outside such a URL, or a value that also appears on its own, still counts. Before this, nearly every read of an issue tracker's API raised the notice, because its responses carry signed upload URLs. `partitionSecrets` takes the text as an optional second argument for this check.
+- A credential value containing `&` is redacted whole: `DB_PASSWORD=Tr0ub4dor&3xK9` no longer leaves `&3xK9` in what goes to Jev, the trace, or the masked result. `&` still ends a value before another `name=` (a URL query), before a second `&`, and before whitespace or the end.
+- `security.maskOutput` is read from the user file only: a repository's `.pi/pi-warden.json` cannot turn off masking of credentials in its own agent's output.
+- `X-Amz-Security-Token` counts as a signed-URL parameter, so an S3 presigned URL made with temporary credentials no longer raises "Possible credentials".
+
+## 0.49.0
+
+### Added
+
+- The action guard reads which database a `psql`, `mysql`, `mariadb`, or `supabase` command targets (`sqlTarget`): loopback, hosted, or unknown. A loopback `DELETE FROM … WHERE …` warns (`sql-delete-local`) instead of holding; `DROP`, `TRUNCATE`, and a `DELETE` with no `WHERE` or an always-true one (`WHERE true`, `WHERE 1=1`, `WHERE 'a'='a'`, `WHERE NOT false`) still hold on loopback. SQL in a heredoc fed to a database client is now checked for `DROP`, `TRUNCATE`, and `DELETE FROM` on every target, as `-c` SQL is; before, such a heredoc was treated as data and got no hit. A hosted target (Supabase, Neon, RDS, PlanetScale, or a supabase `--linked` or non-local `--target`) warns as elevated (`sql-hosted`), and a write statement against it holds (`sql-hosted-write`). A hosted Postgres command wrapped as `BEGIN READ ONLY; … ROLLBACK;` is quiet; a `COMMIT` anywhere voids that. A variable host such as `$DATABASE_URL`, and SQL from `-f` or a pipe, keep the plain SQL hits. See docs/guards.md.
+
 ## 0.48.1
 
 ### Fixed

package/README.md

@@ -35,7 +35,7 @@ Works without any key (offline guards: pattern list, runaway stop, sensitive-pat
 | **Rules** | every `write` and `edit` | Judges against project Markdown rules, quotes the broken rule |
 | **Slop** | code and replies | Names stubs, restating comments, dead code, hedging |
 | **Stuck** | tool results | Repeated failures using the same strategy |
-| **Done-check** | final message | "Done" claims with no test/build/lint behind them |
+| **Done-check** | final message | "Done" claims with no test/build/lint behind them, or UI changes nobody looked at |
 | **Security** | code and output | Hardcoded secrets, injection risks |
 | **Runaway** | reply stream | Stops replies that begin repeating themselves |
 | **Subagent triage** | async child reports | Keeps noisy background work from waking the parent |

package/dist/compact.d.ts

@@ -1,8 +1,18 @@
+/**
+ * Compaction evidence appendix. Deterministic, pure, no Jev request.
+ *
+ * After Pi fires `session_compact`, the extension builds a snapshot from session memory and passes it to
+ * `compactAppendix`. The returned text is sent as one custom message so the agent does not retry approaches that
+ * already failed, knows whether its last passing check still covers the code, and can prefer saved paths over
+ * re-running commands.
+ */
+import type { RunEvidence } from "./done.js";
 export interface SavedOutput {
-    tool: string;
+    /** Undefined when the recorder did not say; the appendix then prints only what it knows. */
+    tool: string | undefined;
     path: string;
     /** Uncompressed size in bytes. */
-    bytes: number;
+    bytes: number | undefined;
 }
 export interface CheckEntry {
     command: string;
@@ -16,10 +26,24 @@ export interface HeldEntry {
     preview: string;
     outcome: string;
 }
+export interface FailedAttempt {
+    /** Redacted call view. */
+    call: string;
+    /** Last meaningful line of the failed output; empty when the output had none. */
+    error: string;
+}
+/** Whether the code as it stands was covered by a passing check. */
+export type Verification = {
+    kind: "passed";
+    command: string;
+    changedSince: boolean;
+} | {
+    kind: "none-passed";
+};
 export interface StuckState {
     failures: number;
-    sameStrategyScore: number | undefined;
-    currentCallFamily: string | undefined;
+    /** Tool results in the attempt window the failures were counted in. */
+    window: number;
 }
 export interface CompactSnapshot {
     savedOutputs: readonly SavedOutput[];
@@ -27,20 +51,42 @@ export interface CompactSnapshot {
     checks: readonly CheckEntry[];
     /** Capped at 10 in the hook before this is called. */
     holds: readonly HeldEntry[];
+    /** Distinct failed calls, oldest first, at most 5. */
+    failedAttempts: readonly FailedAttempt[];
+    verification: Verification | undefined;
     stuck: StuckState | undefined;
     activeTask: string | undefined;
+    /** The session's open loops, already formatted and capped by `formatOpenLoops`; absent or empty when none is open. */
+    openLoops?: string;
 }
 /** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
 export declare function compactAppendix(snapshot: CompactSnapshot): string;
+/**
+ * `warden_recall`: what was already tried in this session, from the same snapshot and the same section text as the
+ * compaction appendix: the failed attempts with their error lines, the last passing check with whether the code
+ * changed since, and the saved-output paths. Capped like the appendix.
+ */
+export declare function recallText(snapshot: CompactSnapshot): string;
+/** The line of a failed output most likely to name the error: the last specific error line, else the last line. */
+export declare function errorLine(output: string): string;
+/** Distinct failed calls, the latest occurrence of each, oldest first; at most `MAX_FAILED`. */
+export declare function distinctFailures(attempts: ReadonlyArray<{
+    key: string;
+    call: string;
+    failed: boolean;
+    output: string;
+}>): FailedAttempt[];
+/** Undefined when no check passed and no code changed: there is nothing to say. */
+export declare function verificationOf(evidence: Pick<RunEvidence, "mutations" | "checks" | "checksBeforeMutation">): Verification | undefined;
 /**
  * Build a `CompactSnapshot` from the extension's session-scoped state. All string values are redacted; saved-output
  * paths are local and allowed.
  */
 export declare function buildCompactSnapshot(options: {
     savedOutputs: Array<{
-        tool: string;
+        tool: string | undefined;
         path: string;
-        bytes: number;
+        bytes: number | undefined;
     }>;
     checks: Array<{
         command: string;
@@ -53,11 +99,15 @@ export declare function buildCompactSnapshot(options: {
         preview: string;
         outcome: string;
     }>;
-    stuck: {
-        failures: number;
-        sameStrategyScore: number | undefined;
-        currentCallFamily: string | undefined;
-    } | undefined;
+    /** The stuck guard's attempt window, oldest first. */
+    attempts?: ReadonlyArray<{
+        key: string;
+        call: string;
+        failed: boolean;
+        output: string;
+    }>;
+    evidence?: Pick<RunEvidence, "mutations" | "checks" | "checksBeforeMutation">;
     activeTask: string | undefined;
     runs: number;
+    openLoops?: string;
 }): CompactSnapshot;

package/dist/compact.js

@@ -1,57 +1,153 @@
-/**
- * Compaction evidence appendix. Deterministic, pure, no Jev request.
- *
- * After Pi fires `session_compact`, the extension builds a snapshot from session memory and passes it to
- * `compactAppendix`. The returned text is sent as one custom message so the agent can prefer saved paths
- * over re-running commands.
- */
 import { redact } from "./redact.js";
 const MAX_CHARS = 2000;
-/** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
-export function compactAppendix(snapshot) {
+const MAX_FAILED = 5;
+const FAILED_ENTRY_CHARS = 160;
+const FAILED_CALL_CHARS = 70;
+const SAVED_KEEP_WHEN_OVER = 3;
+const TASK_CHARS_WHEN_OVER = 300;
+function clip(text, limit) {
+    return text.length <= limit ? text : `${text.slice(0, Math.max(0, limit - 1))}…`;
+}
+/** Every section in appendix order; `warden_recall` prints some of the same strings, so the two never disagree. */
+function renderSections(snapshot) {
     const sections = [];
-    if (snapshot.savedOutputs.length) {
-        const items = snapshot.savedOutputs
-            .map(item => `- ${redact(item.tool)} → ${redact(item.path)} (${item.bytes} bytes)`)
-            .join("\n");
-        sections.push(`### Saved full outputs\n${items}`);
+    const push = (name, text) => sections.push([name, text]);
+    if (snapshot.failedAttempts.length) {
+        const items = snapshot.failedAttempts.map(attempt => {
+            const call = clip(redact(attempt.call), FAILED_CALL_CHARS);
+            const error = redact(attempt.error);
+            const entry = error ? `${call} → ${clip(error, FAILED_ENTRY_CHARS - call.length - 3)}` : call;
+            return `- ${entry}`;
+        }).join("\n");
+        push("failed", `### Tried and failed\nDo not retry these unchanged.\n${items}`);
+    }
+    if (snapshot.verification) {
+        const v = snapshot.verification;
+        const line = v.kind === "passed"
+            ? `- last passing check: ${redact(v.command)}; code changed since last passing check: ${v.changedSince ? "yes" : "no"}`
+            : "- no check has passed yet; code was changed";
+        push("verification", `### Verification\n${line}`);
+    }
+    if (snapshot.openLoops) {
+        push("loops", `### Open loops\nPromised earlier in this session and not done yet; close each with warden_loops done or drop.\n${snapshot.openLoops}`);
     }
     if (snapshot.checks.length) {
         const items = snapshot.checks
             .map(c => `- ${c.passed ? "✓" : "✗"} ${c.when}: ${redact(c.command)}`)
             .join("\n");
-        sections.push(`### Last checks\n${items}`);
+        push("checks", `### Last checks\n${items}`);
+    }
+    if (snapshot.stuck) {
+        push("stuck", `### Stuck state\n- failures: ${snapshot.stuck.failures} of the last ${snapshot.stuck.window} tool results`);
     }
     if (snapshot.holds.length) {
         const items = snapshot.holds
             .map(h => `- ${redact(h.tool)}: ${redact(h.outcome)}${h.preview ? ` (${redact(h.preview)})` : ""}`)
             .join("\n");
-        sections.push(`### Held actions\n${items}`);
+        push("holds", `### Held actions\n${items}`);
     }
-    if (snapshot.stuck) {
-        const s = snapshot.stuck;
-        const family = s.currentCallFamily ? `; family: ${redact(s.currentCallFamily)}` : "";
-        const score = s.sameStrategyScore !== undefined ? `; same-strategy: ${s.sameStrategyScore.toFixed(2)}` : "";
-        sections.push(`### Stuck state\n- failures: ${s.failures}${score}${family}`);
+    if (snapshot.savedOutputs.length) {
+        const items = snapshot.savedOutputs
+            .map(item => `- ${item.tool ? `${redact(item.tool)} → ` : ""}${redact(item.path)}${item.bytes === undefined ? "" : ` (${item.bytes} bytes)`}`)
+            .join("\n");
+        push("saved", `### Saved full outputs\n${items}`);
     }
     if (snapshot.activeTask) {
-        sections.push(`### Active task\n${redact(snapshot.activeTask)}`);
+        push("task", `### Active task\n${redact(snapshot.activeTask)}`);
     }
+    return sections;
+}
+function render(snapshot) {
+    const sections = renderSections(snapshot).map(([, text]) => text);
     if (sections.length === 0)
         return "";
-    const body = sections.join("\n\n");
-    const appendix = [
+    return [
         "=== PI-WARDEN COMPACT EVIDENCE ===",
         "Evidence warden kept across compaction. Prefer the saved-output paths below over re-running commands that produced them.",
         "",
-        body,
+        sections.join("\n\n"),
         "=== END PI-WARDEN COMPACT EVIDENCE ===",
     ].join("\n");
-    const marker = "\n… [truncated]";
+}
+/**
+ * Lower-value content goes first when the appendix is over the cap. Failed attempts, the verification line, and the
+ * open loops (at most 600 characters) are never reduced here; they come first in the text, so the final cut reaches
+ * them last.
+ */
+const REDUCERS = [
+    s => ({ ...s, savedOutputs: s.savedOutputs.slice(-SAVED_KEEP_WHEN_OVER) }),
+    s => ({ ...s, holds: [] }),
+    s => ({ ...s, activeTask: s.activeTask && clip(s.activeTask, TASK_CHARS_WHEN_OVER) }),
+    s => ({ ...s, stuck: undefined }),
+    s => ({ ...s, checks: s.checks.slice(-2) }),
+    s => ({ ...s, savedOutputs: [] }),
+    s => ({ ...s, activeTask: undefined }),
+    s => ({ ...s, checks: [] }),
+];
+/** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
+export function compactAppendix(snapshot) {
+    let appendix = render(snapshot);
+    for (const reduce of REDUCERS) {
+        if (appendix.length <= MAX_CHARS)
+            return appendix;
+        snapshot = reduce(snapshot);
+        appendix = render(snapshot);
+    }
     if (appendix.length <= MAX_CHARS)
         return appendix;
+    const marker = "\n… [truncated]";
     return appendix.slice(0, MAX_CHARS - marker.length) + marker;
 }
+/**
+ * `warden_recall`: what was already tried in this session, from the same snapshot and the same section text as the
+ * compaction appendix: the failed attempts with their error lines, the last passing check with whether the code
+ * changed since, and the saved-output paths. Capped like the appendix.
+ */
+export function recallText(snapshot) {
+    const kept = renderSections(snapshot).filter(([name]) => name === "failed" || name === "verification" || name === "saved").map(([, text]) => text);
+    const text = kept.length ? kept.join("\n\n") : "Nothing recorded yet in this session: no failed attempt, no check, and no saved output.";
+    if (text.length <= MAX_CHARS)
+        return text;
+    const marker = "\n… [truncated]";
+    return text.slice(0, MAX_CHARS - marker.length) + marker;
+}
+const ERROR_LINE = /\b(?:error|errors|fail(?:ed|ure|s)?|exception|cannot|can't|could not|not found|no such|denied|refused|invalid|unexpected|missing|undefined|timed? ?out|abort(?:ed)?|panic|fatal|traceback)\b|✗|✖|✘/i;
+/** Runner tallies ("Found 1 error.", "3 failing") say that something failed, not what; an earlier line says what. */
+const SUMMARY_LINE = /^(?:found \d+ errors?\b|\d+ (?:failing|failed|errors?)\b|tests?:\s|ℹ fail \d+|npm (?:err!|error) (?:code|errno|a complete log|command failed|lifecycle)|error: command failed|command failed with exit code)/i;
+/** The line of a failed output most likely to name the error: the last specific error line, else the last line. */
+export function errorLine(output) {
+    const lines = output
+        .replace(/^\[\d+ earlier chars\] …/, "")
+        .split("\n")
+        .map(line => line.trim())
+        .filter(line => line && !/^[-=─—*_~.`]+$/.test(line));
+    for (let index = lines.length - 1; index >= 0; index--) {
+        if (ERROR_LINE.test(lines[index]) && !SUMMARY_LINE.test(lines[index]))
+            return lines[index];
+    }
+    return lines.at(-1) ?? "";
+}
+/** Distinct failed calls, the latest occurrence of each, oldest first; at most `MAX_FAILED`. */
+export function distinctFailures(attempts) {
+    const latest = new Map();
+    for (const attempt of attempts) {
+        if (!attempt.failed)
+            continue;
+        latest.delete(attempt.key);
+        latest.set(attempt.key, { call: attempt.call, error: errorLine(attempt.output) });
+    }
+    return [...latest.values()].slice(-MAX_FAILED);
+}
+/** Undefined when no check passed and no code changed: there is nothing to say. */
+export function verificationOf(evidence) {
+    let lastPass = evidence.checks.length - 1;
+    while (lastPass >= 0 && !evidence.checks[lastPass].passed)
+        lastPass--;
+    if (lastPass >= 0) {
+        return { kind: "passed", command: evidence.checks[lastPass].call, changedSince: (evidence.checksBeforeMutation ?? -1) > lastPass };
+    }
+    return evidence.mutations > 0 ? { kind: "none-passed" } : undefined;
+}
 /**
  * Build a `CompactSnapshot` from the extension's session-scoped state. All string values are redacted; saved-output
  * paths are local and allowed.
@@ -74,11 +170,18 @@ export function buildCompactSnapshot(options) {
         preview: h.preview,
         outcome: h.outcome,
     }));
-    const stuck = options.stuck ? {
-        failures: options.stuck.failures,
-        sameStrategyScore: options.stuck.sameStrategyScore,
-        currentCallFamily: options.stuck.currentCallFamily,
-    } : undefined;
+    const attempts = options.attempts ?? [];
+    const failures = attempts.filter(attempt => attempt.failed).length;
+    const stuck = failures > 0 ? { failures, window: attempts.length } : undefined;
     const activeTask = options.activeTask ? redact(options.activeTask) : undefined;
-    return { savedOutputs, checks, holds, stuck, activeTask };
+    return {
+        savedOutputs,
+        checks,
+        holds,
+        failedAttempts: distinctFailures(attempts),
+        verification: options.evidence ? verificationOf(options.evidence) : undefined,
+        stuck,
+        activeTask,
+        ...(options.openLoops ? { openLoops: options.openLoops } : {}),
+    };
 }