pi-warden 0.5.3 → 0.5.5

package/dist/done.d.ts

@@ -5,7 +5,12 @@ export type ToolOutcome = "read" | "mutation" | "check-pass" | "check-fail" | "u
  * What a finished tool call contributes to the run's evidence. Only write/edit count as code changes: shell side effects
  * (deleting a temp dir, installing a package) are too varied to demand a test run for. Custom tools are unknown.
  */
-export declare function classifyToolResult(tool: string, input: Record<string, unknown>, failed: boolean): ToolOutcome;
+export declare function classifyToolResult(tool: string, input: Record<string, unknown>, failed: boolean, output?: string): ToolOutcome;
+/**
+ * Recognise a test/type-check runner's own summary in tool output: node:test, jest/vitest, pytest, cargo, go test,
+ * tsc. Returns the outcome the summary reports, or undefined when no runner summary is present.
+ */
+export declare function checkSummary(output: string): "pass" | "fail" | undefined;
 export interface RunEvidence {
     mutations: number;
     checks: Array<{

package/dist/done.js

@@ -9,7 +9,7 @@ const CHECK_COMMAND = /\b(?:(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|lin
  * What a finished tool call contributes to the run's evidence. Only write/edit count as code changes: shell side effects
  * (deleting a temp dir, installing a package) are too varied to demand a test run for. Custom tools are unknown.
  */
-export function classifyToolResult(tool, input, failed) {
+export function classifyToolResult(tool, input, failed, output) {
     if (tool === "write" || tool === "edit")
         return "mutation";
     if (tool === "read" || tool === "grep" || tool === "find" || tool === "ls")
@@ -19,8 +19,35 @@ export function classifyToolResult(tool, input, failed) {
         return "unknown";
     if (CHECK_COMMAND.test(view.command))
         return failed ? "check-fail" : "check-pass";
+    // A test runner launched from inside a script (ctx_execute JavaScript, a Python wrapper) leaves no runner name in the
+    // command text, but its output still carries the runner's summary. Judge that summary instead.
+    const summary = output === undefined ? undefined : checkSummary(output);
+    if (summary)
+        return summary === "fail" || failed ? "check-fail" : "check-pass";
     return view.shell && isReadOnlyCommand(view.command) ? "read" : "unknown";
 }
+/**
+ * Recognise a test/type-check runner's own summary in tool output: node:test, jest/vitest, pytest, cargo, go test,
+ * tsc. Returns the outcome the summary reports, or undefined when no runner summary is present.
+ */
+export function checkSummary(output) {
+    const tail = output.slice(-6000);
+    const nodeTest = /\u2139 (?:tests|pass|fail) \d+/.test(tail) && /\u2139 fail (\d+)/.exec(tail);
+    if (nodeTest)
+        return Number(nodeTest[1]) > 0 ? "fail" : "pass";
+    const jest = /^Tests:\s+(?:(\d+) failed, )?.*?\d+ total/m.exec(tail);
+    if (jest)
+        return jest[1] && Number(jest[1]) > 0 ? "fail" : "pass";
+    const pytest = /^=+ .*?(?:(\d+) failed|(\d+) error).*?in [\d.]+s/m.exec(tail) ?? /^=+ (\d+) passed.*? in [\d.]+s =+$/m.exec(tail);
+    if (pytest)
+        return /\d+ (?:failed|error)/.test(pytest[0]) ? "fail" : "pass";
+    const cargoOrGo = /^test result: (ok|FAILED)\./m.exec(tail) ?? /^(ok|FAIL)\s+\S+\s+[\d.]+s$/m.exec(tail);
+    if (cargoOrGo)
+        return cargoOrGo[1] === "ok" ? "pass" : "fail";
+    if (/\berror TS\d{4}:/.test(tail))
+        return "fail";
+    return undefined;
+}
 export function emptyEvidence() {
     return { mutations: 0, checks: [] };
 }

package/dist/extension.d.ts

@@ -1,6 +1,15 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { SlopSymptom, Verdict } from "./guard.js";
 export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; and redacted tool-output samples for security and tail compression. Compression stores an exact, owner-only copy in a temporary file on this machine. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+/**
+ * Tool calls of the assistant message being preflighted. Pi runs `tool_call` hooks for sibling calls one after another,
+ * so judging them one request at a time costs one round trip per call; judging them together costs one round trip.
+ */
+export declare function siblingToolCalls(ctx: ExtensionContext): Array<{
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+}>;
 export declare function confirmMessage(verdict: Verdict): string;
 /** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
 export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[], counts: Record<SlopSymptom, number>): string;

package/dist/extension.js

@@ -53,6 +53,27 @@ function recentTaskContext(ctx) {
     }
     return messages.reverse();
 }
+/**
+ * Tool calls of the assistant message being preflighted. Pi runs `tool_call` hooks for sibling calls one after another,
+ * so judging them one request at a time costs one round trip per call; judging them together costs one round trip.
+ */
+export function siblingToolCalls(ctx) {
+    const entries = ctx.sessionManager.getBranch();
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "message")
+            continue;
+        if (entry.message.role !== "assistant")
+            return [];
+        const content = entry.message.content;
+        if (!Array.isArray(content))
+            return [];
+        return content.flatMap(part => part.type === "toolCall" && typeof part.id === "string" && typeof part.name === "string"
+            ? [{ id: part.id, name: part.name, input: (part.arguments ?? {}) }]
+            : []);
+    }
+    return [];
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -76,7 +97,6 @@ export function confirmMessage(verdict) {
     lines.push("Judgments are model output, not authorization. Yes runs the tool; No blocks it and tells the agent.");
     return lines.join("\n");
 }
-const callKey = (tool, input) => `${tool}\0${JSON.stringify(input)}`;
 const SLOP_FIXES = {
     stub: "replace stubs, placeholders, and hard-coded fake data with the working implementation, or state in your reply exactly what is left unimplemented and why",
     comments: "delete comments that restate the code; keep only those that explain intent, constraints, or non-obvious behaviour",
@@ -99,8 +119,15 @@ export default function wardenExtension(pi) {
     const trace = new Trace();
     let panel;
     let lastUi;
-    /** Calls held in steer mode, with the user prompt current at that time; a retry after the user replies asks Jev about approval. */
-    const held = new Map();
+    /** Judgments for tool calls of the current assistant message, keyed by tool call id; `used` marks preflighted ones. */
+    const prejudged = new Map();
+    /**
+     * Steer-mode hold state. After a hold, the next guarded call that runs under a *new* user prompt asks Jev whether that
+     * prompt approves it. The retry rarely repeats the held string byte for byte (a `command -v` dropped, a different
+     * timeout), so approval is judged against the action itself, not matched against the earlier command text.
+     */
+    let lastHoldPrompt;
+    let holdPending = false;
     let attempts = new AttemptWindow(defaultConfig().stuck.window);
     let evidence = emptyEvidence();
     let doneNudged = false;
@@ -179,7 +206,8 @@ export default function wardenExtension(pi) {
         widget.clear();
         trace.clear();
         panel?.close();
-        held.clear();
+        lastHoldPrompt = undefined;
+        holdPending = false;
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
@@ -194,6 +222,7 @@ export default function wardenExtension(pi) {
     pi.on("before_agent_start", async (_event, ctx) => {
         attempts = new AttemptWindow(configFor(ctx).stuck.window);
         doneNudged = false;
+        prejudged.clear();
     });
     // Each low-level run collects its own evidence of changes and checks.
     pi.on("agent_start", async () => {
@@ -202,6 +231,8 @@ export default function wardenExtension(pi) {
     // Every turn that runs after a compression is a turn that did not carry the removed text.
     pi.on("turn_end", async () => {
         ledger.turnEnd();
+        // Siblings that were never preflighted (an earlier one terminated the batch, or Esc) do not outlive their turn.
+        prejudged.clear();
     });
     pi.on("tool_call", async (event, ctx) => {
         const config = configFor(ctx);
@@ -215,11 +246,29 @@ export default function wardenExtension(pi) {
             return;
         stats.inspected++;
         const task = latestUserPrompt(ctx);
-        const key = callKey(event.toolName, event.input);
-        const heldAt = held.get(key);
-        const retryAfterHold = held.has(key) && heldAt !== task;
+        // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
+        const retryAfterHold = holdPending && lastHoldPrompt !== task;
         const judge = judgeFor(config);
-        const verdict = await evaluateAction({ tool: event.toolName, input: event.input, cwd: ctx.cwd, task, context: recentTaskContext(ctx) }, { config: config.action, judge, signal: ctx.signal, slop: config.slop, security: config.security, retryAfterHold });
+        const context = recentTaskContext(ctx);
+        const options = { config: config.action, judge, signal: ctx.signal, slop: config.slop, security: config.security, retryAfterHold };
+        const judgeCall = (tool, input) => evaluateAction({ tool, input, cwd: ctx.cwd, task, context }, options);
+        // Sibling calls in the same assistant message are preflighted one after another; their requests go out together.
+        // A retry after a hold stays sequential because an approval consumed by one sibling changes the question for the next.
+        if (judge && !retryAfterHold) {
+            for (const sibling of siblingToolCalls(ctx)) {
+                if (sibling.id === event.toolCallId || prejudged.has(sibling.id) || !config.action.tools.includes(sibling.name))
+                    continue;
+                const verdict = judgeCall(sibling.name, sibling.input);
+                verdict.catch(() => undefined);
+                prejudged.set(sibling.id, { key: JSON.stringify(sibling.input), verdict, used: false });
+            }
+        }
+        // An earlier hook may have changed this call's input; a stale judgment is discarded, not reused.
+        const key = JSON.stringify(event.input);
+        const ready = prejudged.get(event.toolCallId);
+        const pending = ready && !ready.used && ready.key === key && !retryAfterHold ? ready.verdict : judgeCall(event.toolName, event.input);
+        prejudged.set(event.toolCallId, { key, verdict: pending, used: true });
+        const verdict = await pending;
         if (verdict.source === "skipped")
             return;
         if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
@@ -237,7 +286,7 @@ export default function wardenExtension(pi) {
         }
         if (verdict.approvedByUser) {
             stats.approved++;
-            held.delete(key);
+            holdPending = false;
         }
         const mode = activeMode(config, ctx.hasUI);
         const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
@@ -275,7 +324,10 @@ export default function wardenExtension(pi) {
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         stats.held++;
-        held.set(key, task);
+        // A re-hold under the user's reply keeps the original reference prompt; otherwise the reply could never approve anything.
+        if (!holdPending)
+            lastHoldPrompt = task;
+        holdPending = true;
         if (ctx.hasUI)
             ctx.ui.notify(`warden · held ${event.toolName}: ${reasons}. The agent was told why and asked to re-plan or ask you.`, "warning");
         return { block: true, reason: told ?? steerReason(verdict, { canApprove: judge !== undefined }) };
@@ -286,6 +338,17 @@ export default function wardenExtension(pi) {
             return;
         const textBlocks = event.content.filter(part => part.type === "text");
         const text = textBlocks.map(part => part.text).join("\n");
+        // Repeat detection uses the original result, so its request goes out together with the output check.
+        const failed = resultFailed(event.isError, event.details, event.content);
+        const stuckCheck = (() => {
+            if (!config.stuck.enabled)
+                return undefined;
+            attempts.push(makeAttempt(event.toolName, event.input, event.content, failed));
+            if (!attempts.shouldJudge(config.stuck))
+                return undefined;
+            stats.stuckChecks++;
+            return evaluateStuck(attempts, latestUserPrompt(ctx), { config: config.stuck, judge: judgeFor(config), timeoutMs: config.timeoutMs, signal: ctx.signal });
+        })();
         const output = await evaluateOutput(event.toolName, text, latestUserPrompt(ctx), {
             security: config.security, context: config.context, judge: judgeFor(config), timeoutMs: config.timeoutMs,
             signal: ctx.signal, compressible: textBlocks.length === 1, taskContext: recentTaskContext(ctx),
@@ -336,17 +399,12 @@ export default function wardenExtension(pi) {
             ]);
         }
         const patch = content === event.content ? undefined : { content };
-        // Checks and repeat detection use the original result, not the excerpts or security banner.
-        const failed = resultFailed(event.isError, event.details, event.content);
+        // Checks use the original result, not the excerpts or security banner.
         if (config.done.enabled)
-            recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed), event.input, event.toolName);
-        if (!config.stuck.enabled)
+            recordOutcome(evidence, classifyToolResult(event.toolName, event.input, failed, text), event.input, event.toolName);
+        const verdict = await stuckCheck;
+        if (!verdict)
             return patch;
-        attempts.push(makeAttempt(event.toolName, event.input, event.content, failed));
-        if (!attempts.shouldJudge(config.stuck))
-            return patch;
-        stats.stuckChecks++;
-        const verdict = await evaluateStuck(attempts, latestUserPrompt(ctx), { config: config.stuck, judge: judgeFor(config), timeoutMs: config.timeoutMs, signal: ctx.signal });
         if (verdict.error)
             noteError(ctx, verdict.error, undefined);
         if (verdict.source === "repeat" && !verdict.stuck)
@@ -370,9 +428,17 @@ export default function wardenExtension(pi) {
         const judge = judgeFor(config);
         if (!finalMessage || !judge)
             return;
-        if (config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars) {
+        // Pi shows the agent as working until this hook returns, so the two independent checks share one round trip.
+        const task = latestUserPrompt(ctx);
+        const proseCheck = config.slop.enabled && config.slop.prose.enabled && finalMessage.length >= config.slop.prose.minChars
+            ? evaluateProse(task, finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
+            : undefined;
+        const doneCheck = config.done.enabled && !doneNudged && needsDoneCheck(evidence)
+            ? evaluateDone(task, finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
+            : undefined;
+        if (proseCheck) {
             stats.proseChecks++;
-            const verdict = await evaluateProse(latestUserPrompt(ctx), finalMessage, { config: config.slop.prose, judge, timeoutMs: config.timeoutMs, signal: ctx.signal });
+            const verdict = await proseCheck;
             if (verdict.error)
                 noteError(ctx, verdict.error, undefined);
             else
@@ -391,10 +457,10 @@ export default function wardenExtension(pi) {
                 steer(config, nudge, { deliverAs: "nextTurn" });
             }
         }
-        if (!config.done.enabled || doneNudged || !needsDoneCheck(evidence))
+        if (!doneCheck)
             return;
         stats.doneChecks++;
-        const verdict = await evaluateDone(latestUserPrompt(ctx), finalMessage, evidence, { config: config.done, judge, timeoutMs: config.timeoutMs, signal: ctx.signal });
+        const verdict = await doneCheck;
         if (verdict.error)
             noteError(ctx, verdict.error, undefined);
         const nudge = verdict.unverified && config.done.nudge ? doneNudge(verdict) : undefined;

package/dist/guard.js

@@ -287,7 +287,12 @@ export async function evaluateAction(action, options) {
     const patterns = matchPatterns(action.tool, action.input, action.cwd);
     const reasons = [];
     let level = "allow";
+    // A shell command that merely mentions a secrets file (grep for key names, cat .env.example) is decided after Jev
+    // says whether it can write; write/edit on such a path, and offline runs, keep the immediate warning.
+    const deferSensitive = judge !== undefined && (action.tool !== "write" && action.tool !== "edit");
     for (const hit of patterns) {
+        if (hit.severity === "sensitive" && deferSensitive)
+            continue;
         level = higher(level, hit.severity === "destructive" ? "confirm" : "warn");
         reasons.push(`${hit.severity}: ${hit.label}`);
     }
@@ -323,6 +328,18 @@ export async function evaluateAction(action, options) {
             judgment.approved = answers.approved.noul;
         if (typeof answers.mutates?.noul === "number")
             judgment.mutates = answers.mutates.noul;
+        if (deferSensitive) {
+            for (const hit of patterns) {
+                if (hit.severity !== "sensitive")
+                    continue;
+                if ((judgment.mutates ?? 1) >= 0.5) {
+                    level = higher(level, "warn");
+                    reasons.push(`${hit.severity}: ${hit.label}`);
+                }
+                else
+                    reasons.push(`${hit.label} (read-only, not warned)`);
+            }
+        }
         // write/edit always change something; a command that Jev judges read-only is warned about, never held, for scope alone.
         const canChange = summary.tool === "write" || summary.tool === "edit" || (judgment.mutates ?? 1) >= 0.5;
         if (judgment.irreversible >= config.irreversible.confirm) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Guardrails for Pi built on pi-typesafe that steer the agent instead of interrupting you: Jev judges irreversible and off-task tool calls before they run, detects stuck loops, checks unverified done claims, and flags slop.",
   "type": "module",
   "license": "MIT",