pi-warden 0.5.3 → 0.5.4

package/dist/done.d.ts

@@ -5,7 +5,12 @@ export type ToolOutcome = "read" | "mutation" | "check-pass" | "check-fail" | "u
  * What a finished tool call contributes to the run's evidence. Only write/edit count as code changes: shell side effects
  * (deleting a temp dir, installing a package) are too varied to demand a test run for. Custom tools are unknown.
  */
-export declare function classifyToolResult(tool: string, input: Record<string, unknown>, failed: boolean): ToolOutcome;
+export declare function classifyToolResult(tool: string, input: Record<string, unknown>, failed: boolean, output?: string): ToolOutcome;
+/**
+ * Recognise a test/type-check runner's own summary in tool output: node:test, jest/vitest, pytest, cargo, go test,
+ * tsc. Returns the outcome the summary reports, or undefined when no runner summary is present.
+ */
+export declare function checkSummary(output: string): "pass" | "fail" | undefined;
 export interface RunEvidence {
     mutations: number;
     checks: Array<{

package/dist/done.js

@@ -9,7 +9,7 @@ const CHECK_COMMAND = /\b(?:(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|lin
  * What a finished tool call contributes to the run's evidence. Only write/edit count as code changes: shell side effects
  * (deleting a temp dir, installing a package) are too varied to demand a test run for. Custom tools are unknown.
  */
-export function classifyToolResult(tool, input, failed) {
+export function classifyToolResult(tool, input, failed, output) {
     if (tool === "write" || tool === "edit")
         return "mutation";
     if (tool === "read" || tool === "grep" || tool === "find" || tool === "ls")
@@ -19,8 +19,35 @@ export function classifyToolResult(tool, input, failed) {
         return "unknown";
     if (CHECK_COMMAND.test(view.command))
         return failed ? "check-fail" : "check-pass";
+    // A test runner launched from inside a script (ctx_execute JavaScript, a Python wrapper) leaves no runner name in the
+    // command text, but its output still carries the runner's summary. Judge that summary instead.
+    const summary = output === undefined ? undefined : checkSummary(output);
+    if (summary)
+        return summary === "fail" || failed ? "check-fail" : "check-pass";
     return view.shell && isReadOnlyCommand(view.command) ? "read" : "unknown";
 }
+/**
+ * Recognise a test/type-check runner's own summary in tool output: node:test, jest/vitest, pytest, cargo, go test,
+ * tsc. Returns the outcome the summary reports, or undefined when no runner summary is present.
+ */
+export function checkSummary(output) {
+    const tail = output.slice(-6000);
+    const nodeTest = /\u2139 (?:tests|pass|fail) \d+/.test(tail) && /\u2139 fail (\d+)/.exec(tail);
+    if (nodeTest)
+        return Number(nodeTest[1]) > 0 ? "fail" : "pass";
+    const jest = /^Tests:\s+(?:(\d+) failed, )?.*?\d+ total/m.exec(tail);
+    if (jest)
+        return jest[1] && Number(jest[1]) > 0 ? "fail" : "pass";
+    const pytest = /^=+ .*?(?:(\d+) failed|(\d+) error).*?in [\d.]+s/m.exec(tail) ?? /^=+ (\d+) passed.*? in [\d.]+s =+$/m.exec(tail);
+    if (pytest)
+        return /\d+ (?:failed|error)/.test(pytest[0]) ? "fail" : "pass";
+    const cargoOrGo = /^test result: (ok|FAILED)\./m.exec(tail) ?? /^(ok|FAIL)\s+\S+\s+[\d.]+s$/m.exec(tail);
+    if (cargoOrGo)
+        return cargoOrGo[1] === "ok" ? "pass" : "fail";
+    if (/\berror TS\d{4}:/.test(tail))
+        return "fail";
+    return undefined;
+}
 export function emptyEvidence() {
     return { mutations: 0, checks: [] };
 }

package/dist/extension.js

@@ -76,7 +76,6 @@ export function confirmMessage(verdict) {
     lines.push("Judgments are model output, not authorization. Yes runs the tool; No blocks it and tells the agent.");
     return lines.join("\n");
 }
-const callKey = (tool, input) => `${tool}\0${JSON.stringify(input)}`;
 const SLOP_FIXES = {
     stub: "replace stubs, placeholders, and hard-coded fake data with the working implementation, or state in your reply exactly what is left unimplemented and why",
     comments: "delete comments that restate the code; keep only those that explain intent, constraints, or non-obvious behaviour",
@@ -99,8 +98,13 @@ export default function wardenExtension(pi) {
     const trace = new Trace();
     let panel;
     let lastUi;
-    /** Calls held in steer mode, with the user prompt current at that time; a retry after the user replies asks Jev about approval. */
-    const held = new Map();
+    /**
+     * Steer-mode hold state. After a hold, the next guarded call that runs under a *new* user prompt asks Jev whether that
+     * prompt approves it. The retry rarely repeats the held string byte for byte (a `command -v` dropped, a different
+     * timeout), so approval is judged against the action itself, not matched against the earlier command text.
+     */
+    let lastHoldPrompt;
+    let holdPending = false;
     let attempts = new AttemptWindow(defaultConfig().stuck.window);
     let evidence = emptyEvidence();
     let doneNudged = false;
@@ -179,7 +183,8 @@ export default function wardenExtension(pi) {
         widget.clear();
         trace.clear();
         panel?.close();
-        held.clear();
+        lastHoldPrompt = undefined;
+        holdPending = false;
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
@@ -215,9 +220,8 @@ export default function wardenExtension(pi) {
             return;
         stats.inspected++;
         const task = latestUserPrompt(ctx);
-        const key = callKey(event.toolName, event.input);
-        const heldAt = held.get(key);
-        const retryAfterHold = held.has(key) && heldAt !== task;
+        // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
+        const retryAfterHold = holdPending && lastHoldPrompt !== task;
         const judge = judgeFor(config);
         const verdict = await evaluateAction({ tool: event.toolName, input: event.input, cwd: ctx.cwd, task, context: recentTaskContext(ctx) }, { config: config.action, judge, signal: ctx.signal, slop: config.slop, security: config.security, retryAfterHold });
         if (verdict.source === "skipped")
@@ -237,7 +241,7 @@ export default function wardenExtension(pi) {
         }
         if (verdict.approvedByUser) {
             stats.approved++;
-            held.delete(key);
+            holdPending = false;
         }
         const mode = activeMode(config, ctx.hasUI);
         const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
@@ -275,7 +279,10 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         stats.held++;
-        held.set(key, task);
+        // A re-hold under the user's reply keeps the original reference prompt; otherwise the reply could never approve anything.
+        if (!holdPending)
+            lastHoldPrompt = task;
+        holdPending = true;
         if (ctx.hasUI)
             ctx.ui.notify(`warden · held ${event.toolName}: ${reasons}. The agent was told why and asked to re-plan or ask you.`, "warning");
         return { block: true, reason: told ?? steerReason(verdict, { canApprove: judge !== undefined }) };
@@ -339,7 +346,7 @@ export default function wardenExtension(pi) {
         // Checks and repeat detection use the original result, not the excerpts or security banner.
         const failed = resultFailed(event.isError, event.details, event.content);
         if (config.done.enabled)
-            recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed), event.input, event.toolName);
+            recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed, text), event.input, event.toolName);
         if (!config.stuck.enabled)
             return patch;
         attempts.push(makeAttempt(event.toolName, event.input, event.content, failed));

package/dist/guard.js

@@ -287,7 +287,12 @@ export async function evaluateAction(action, options) {
     const patterns = matchPatterns(action.tool, action.input, action.cwd);
     const reasons = [];
     let level = "allow";
+    // A shell command that merely mentions a secrets file (grep for key names, cat .env.example) is decided after Jev
+    // says whether it can write; write/edit on such a path, and offline runs, keep the immediate warning.
+    const deferSensitive = judge !== undefined && (action.tool !== "write" && action.tool !== "edit");
     for (const hit of patterns) {
+        if (hit.severity === "sensitive" && deferSensitive)
+            continue;
         level = higher(level, hit.severity === "destructive" ? "confirm" : "warn");
         reasons.push(`${hit.severity}: ${hit.label}`);
     }
@@ -323,6 +328,18 @@ export async function evaluateAction(action, options) {
             judgment.approved = answers.approved.noul;
         if (typeof answers.mutates?.noul === "number")
             judgment.mutates = answers.mutates.noul;
+        if (deferSensitive) {
+            for (const hit of patterns) {
+                if (hit.severity !== "sensitive")
+                    continue;
+                if ((judgment.mutates ?? 1) >= 0.5) {
+                    level = higher(level, "warn");
+                    reasons.push(`${hit.severity}: ${hit.label}`);
+                }
+                else
+                    reasons.push(`${hit.label} (read-only, not warned)`);
+            }
+        }
         // write/edit always change something; a command that Jev judges read-only is warned about, never held, for scope alone.
         const canChange = summary.tool === "write" || summary.tool === "edit" || (judgment.mutates ?? 1) >= 0.5;
         if (judgment.irreversible >= config.irreversible.confirm) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Guardrails for Pi built on pi-typesafe that steer the agent instead of interrupting you: Jev judges irreversible and off-task tool calls before they run, detects stuck loops, checks unverified done claims, and flags slop.",
   "type": "module",
   "license": "MIT",