pi-warden 0.60.0 → 0.64.1

package/CHANGELOG.md

@@ -8,6 +8,51 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.64.1
+
+### Fixed
+
+- A recursive `rm` of recorded session scratch now keeps its hold when the same command also moves, links, copies, extracts, or mounts data: `mv`, `ln`, `cp`, `tar` (also `g`- or `bsd`-prefixed), `rsync`, `mount`, `hdiutil`, `bindfs`, or `git … clone`, anywhere in the command and also quoted or escaped (`\mv`, `"ln"`, `l''n`). The scratch tree walk runs before the command, so it could not see data the command itself put into the scratch path before its `rm`. A plain `rm -rf` of recorded scratch is still released.
+
+## 0.64.0
+
+### Added
+
+- Open loops. New agent tool `warden_loops` keeps what the agent promised to do later in this session: `add` (at most 160 characters, with an optional `when` condition such as "after CI passes"), `done`, `drop` with a reason, and `list`; its description tells the agent to add a loop whenever it promises something for later. The open loops (at most 8 and 600 characters) appear in the compaction appendix, in one end-of-run notice for the next turn (counted against the steer budget as `loops`, never twice for the same unchanged list), and in one message on resume. Loops are stored per session and project in pi-warden's data folder, so they survive compaction and resume and never reach another session or project. `/warden loops` lists them for the user.
+- New agent tool `warden_recall`: the failed attempts of this session with their error lines, the last passing check with whether the code changed since, and the saved-output paths. It prints the same sections the compaction appendix builds, from the same session state. Read-only.
+- Both run in code, with no TypeSafe request.
+
+## 0.63.0
+
+### Changed
+
+- An intent mismatch on a call with no visible effect is trace-only: the trace, the warn notice, and the status line (`N off plan (M trace-only)`) record it, and the agent gets no steer. A commit, push, merge, tag, reset, pull request, release, or publish still steers (decided in code by `isVisibleCommand`), and so does any call Jev judges `visible` at 0.8 or more, such as an install, a launched program, or a message sent from a script. The steer reaches the agent only after the call ran: on 275 recorded intent-mismatch steers over 7 days, 275 arrived after the call, and a strict course change (the agent asked the user, reverted, or changed approach) followed 8% of them. New `action.intentTraceOnly` sets which mismatches are trace-only: `"invisible"` (default), `"all"`, or `"none"` (every mismatch steers, as before).
+
+## 0.62.0
+
+### Changed
+
+- `prefs.inject` is on by default, and strict: a wrong memory is worse than none. A standing preference reaches the agent only when you typed it, in a standing form (no question and no temporary word; `now`, `until`, `this PR`, `this branch`, and `for this` join `yet`, `for now`, `today`, and `this time`), not bound to one task (a pronoun-only object such as "don't commit it", a ticket, branch, PR number, or hash), in 3 or more sessions on 2 or more days, last within 30 days, not lifted by a later message of the opposite polarity ("do use subagents here"), and not weakening a check (skipping tests, checks, reviews, or confirmations, turning warden off, or pushing, deploying, or deleting without asking; the markers are in `WEAKENS_CHECK`). At most 5 items and 400 characters, each quoted as said with its session count, ending with "If the current request says otherwise, follow the current request." Still one message per session, not a steer, and not repeated on resume.
+- `/warden prefs` shows each item as injected or the rule that kept it out ("not injected: seen in 2 sessions", "not injected: weakens a check"). `/warden prefs forget <n>` drops an item for the project for good, rewordings included; the key is kept in pi-warden's data folder.
+- New agent tool `warden_remember`: after a user correction, or a stuck, repeat, or done-check steer, within the last 5 assistant turns of the run, the agent can record one standing lesson (at most 160 characters) for the project. The same rules apply; a lesson that repeats a stored lesson or a listed preference confirms it instead of adding one. A lesson is injected only once confirmed (recorded again in a later session, or said by the user), after your preferences, marked `(agent lesson)`, and expires after 30 days without a confirmation. Lessons are stored with the date and session id under pi-warden's data folder, never in a rules file or a session file. Preference and lesson text goes to the session model only, never to TypeSafe.
+
+## 0.61.0
+
+### Added
+
+- The context saver cuts repeated runs. In a new tool result, a run of at least 20 lines and 1500 characters that exactly matches text already in context on the current branch becomes one pointer line naming where the earlier copy is and the file that holds the full text. The last 2000 characters and images are never changed. The ledger counts the removed bytes and their token-turns; `/warden status` shows the repeats cut. `context.dedupeRuns` (default `true`) turns it off. `context.dedupeMessages` (default `false`) applies the same cut to new user and custom messages; it is off by default because a repeat the user sends can itself carry meaning.
+
+### Tests
+
+- A repeated report in a new tool result, and with `context.dedupeMessages` in a custom or user message, is cut to one pointer line; messages stay whole by default; one changed line breaks the match; the tail stays; the stored copy holds the full text and reading it back is a recall; `context.dedupeRuns: false` leaves everything whole.
+
+## 0.60.1
+
+### Fixed
+
+- Message text in a command is no longer read as a command. The quoted values of `--body`, `-b`, `--title`, `-t`, and `--notes` on `gh pr|issue|release create|edit|comment`, and of `-m` and `--message` on `git commit` and `git tag`, are blanked before the patterns run, also in `=` form and as `$'…'`. A body that held `;`, `&&`, or new lines was cut into segments before, so a PR body that quoted `rm -rf /` was held as destructive. A value with `$(`, backticks, or an unclosed quote is still read, because the shell runs it.
+- A recursive `rm` right after a backtick (`` `rm -rf ~` ``) is now classified like one after `$(`.
+
 ## 0.60.0
 
 ### Changed

package/dist/compact.d.ts

@@ -56,9 +56,17 @@ export interface CompactSnapshot {
     verification: Verification | undefined;
     stuck: StuckState | undefined;
     activeTask: string | undefined;
+    /** The session's open loops, already formatted and capped by `formatOpenLoops`; absent or empty when none is open. */
+    openLoops?: string;
 }
 /** Returns empty string for an empty snapshot. Capped at 2 000 chars. */
 export declare function compactAppendix(snapshot: CompactSnapshot): string;
+/**
+ * `warden_recall`: what was already tried in this session, from the same snapshot and the same section text as the
+ * compaction appendix: the failed attempts with their error lines, the last passing check with whether the code
+ * changed since, and the saved-output paths. Capped like the appendix.
+ */
+export declare function recallText(snapshot: CompactSnapshot): string;
 /** The line of a failed output most likely to name the error: the last specific error line, else the last line. */
 export declare function errorLine(output: string): string;
 /** Distinct failed calls, the latest occurrence of each, oldest first; at most `MAX_FAILED`. */
@@ -101,4 +109,5 @@ export declare function buildCompactSnapshot(options: {
     evidence?: Pick<RunEvidence, "mutations" | "checks" | "checksBeforeMutation">;
     activeTask: string | undefined;
     runs: number;
+    openLoops?: string;
 }): CompactSnapshot;

package/dist/compact.js

@@ -8,8 +8,10 @@ const TASK_CHARS_WHEN_OVER = 300;
 function clip(text, limit) {
     return text.length <= limit ? text : `${text.slice(0, Math.max(0, limit - 1))}…`;
 }
-function render(snapshot) {
+/** Every section in appendix order; `warden_recall` prints some of the same strings, so the two never disagree. */
+function renderSections(snapshot) {
     const sections = [];
+    const push = (name, text) => sections.push([name, text]);
     if (snapshot.failedAttempts.length) {
         const items = snapshot.failedAttempts.map(attempt => {
             const call = clip(redact(attempt.call), FAILED_CALL_CHARS);
@@ -17,39 +19,46 @@ function render(snapshot) {
             const entry = error ? `${call} → ${clip(error, FAILED_ENTRY_CHARS - call.length - 3)}` : call;
             return `- ${entry}`;
         }).join("\n");
-        sections.push(`### Tried and failed\nDo not retry these unchanged.\n${items}`);
+        push("failed", `### Tried and failed\nDo not retry these unchanged.\n${items}`);
     }
     if (snapshot.verification) {
         const v = snapshot.verification;
         const line = v.kind === "passed"
             ? `- last passing check: ${redact(v.command)}; code changed since last passing check: ${v.changedSince ? "yes" : "no"}`
             : "- no check has passed yet; code was changed";
-        sections.push(`### Verification\n${line}`);
+        push("verification", `### Verification\n${line}`);
+    }
+    if (snapshot.openLoops) {
+        push("loops", `### Open loops\nPromised earlier in this session and not done yet; close each with warden_loops done or drop.\n${snapshot.openLoops}`);
     }
     if (snapshot.checks.length) {
         const items = snapshot.checks
             .map(c => `- ${c.passed ? "✓" : "✗"} ${c.when}: ${redact(c.command)}`)
             .join("\n");
-        sections.push(`### Last checks\n${items}`);
+        push("checks", `### Last checks\n${items}`);
     }
     if (snapshot.stuck) {
-        sections.push(`### Stuck state\n- failures: ${snapshot.stuck.failures} of the last ${snapshot.stuck.window} tool results`);
+        push("stuck", `### Stuck state\n- failures: ${snapshot.stuck.failures} of the last ${snapshot.stuck.window} tool results`);
     }
     if (snapshot.holds.length) {
         const items = snapshot.holds
             .map(h => `- ${redact(h.tool)}: ${redact(h.outcome)}${h.preview ? ` (${redact(h.preview)})` : ""}`)
             .join("\n");
-        sections.push(`### Held actions\n${items}`);
+        push("holds", `### Held actions\n${items}`);
     }
     if (snapshot.savedOutputs.length) {
         const items = snapshot.savedOutputs
             .map(item => `- ${item.tool ? `${redact(item.tool)} → ` : ""}${redact(item.path)}${item.bytes === undefined ? "" : ` (${item.bytes} bytes)`}`)
             .join("\n");
-        sections.push(`### Saved full outputs\n${items}`);
+        push("saved", `### Saved full outputs\n${items}`);
     }
     if (snapshot.activeTask) {
-        sections.push(`### Active task\n${redact(snapshot.activeTask)}`);
+        push("task", `### Active task\n${redact(snapshot.activeTask)}`);
     }
+    return sections;
+}
+function render(snapshot) {
+    const sections = renderSections(snapshot).map(([, text]) => text);
     if (sections.length === 0)
         return "";
     return [
@@ -61,8 +70,9 @@ function render(snapshot) {
     ].join("\n");
 }
 /**
- * Lower-value content goes first when the appendix is over the cap. Failed attempts and the verification line are
- * never reduced here; they come first in the text, so the final cut reaches them last.
+ * Lower-value content goes first when the appendix is over the cap. Failed attempts, the verification line, and the
+ * open loops (at most 600 characters) are never reduced here; they come first in the text, so the final cut reaches
+ * them last.
  */
 const REDUCERS = [
     s => ({ ...s, savedOutputs: s.savedOutputs.slice(-SAVED_KEEP_WHEN_OVER) }),
@@ -88,6 +98,19 @@ export function compactAppendix(snapshot) {
     const marker = "\n… [truncated]";
     return appendix.slice(0, MAX_CHARS - marker.length) + marker;
 }
+/**
+ * `warden_recall`: what was already tried in this session, from the same snapshot and the same section text as the
+ * compaction appendix: the failed attempts with their error lines, the last passing check with whether the code
+ * changed since, and the saved-output paths. Capped like the appendix.
+ */
+export function recallText(snapshot) {
+    const kept = renderSections(snapshot).filter(([name]) => name === "failed" || name === "verification" || name === "saved").map(([, text]) => text);
+    const text = kept.length ? kept.join("\n\n") : "Nothing recorded yet in this session: no failed attempt, no check, and no saved output.";
+    if (text.length <= MAX_CHARS)
+        return text;
+    const marker = "\n… [truncated]";
+    return text.slice(0, MAX_CHARS - marker.length) + marker;
+}
 const ERROR_LINE = /\b(?:error|errors|fail(?:ed|ure|s)?|exception|cannot|can't|could not|not found|no such|denied|refused|invalid|unexpected|missing|undefined|timed? ?out|abort(?:ed)?|panic|fatal|traceback)\b|✗|✖|✘/i;
 /** Runner tallies ("Found 1 error.", "3 failing") say that something failed, not what; an earlier line says what. */
 const SUMMARY_LINE = /^(?:found \d+ errors?\b|\d+ (?:failing|failed|errors?)\b|tests?:\s|ℹ fail \d+|npm (?:err!|error) (?:code|errno|a complete log|command failed|lifecycle)|error: command failed|command failed with exit code)/i;
@@ -159,5 +182,6 @@ export function buildCompactSnapshot(options) {
         verification: options.evidence ? verificationOf(options.evidence) : undefined,
         stuck,
         activeTask,
+        ...(options.openLoops ? { openLoops: options.openLoops } : {}),
     };
 }

package/dist/config.d.ts

@@ -41,6 +41,8 @@ export interface ActionGuardConfig {
     intentMismatch: number;
     /** The same, for a command whose effect is visible outside the working tree (commit, push, merge, publish, launch): less mismatch is enough. */
     visibleMismatch: number;
+    /** Which intent mismatches stay in the trace without a steer: "invisible" (default) a call with no visible effect (neither a commit, push, merge, tag, reset, pull request, release, or publish by `isVisibleCommand`, nor judged `visible` at 0.8 or more), "all" every one, "none" none. The steer arrives after the call ran: 275 of 275 recorded steers did. */
+    intentTraceOnly: "invisible" | "all" | "none";
     /** Low P(should_proceed) is trace-only unless steer is enabled; hold is the inclusive threshold, not a blocking decision. Calibration: AUC 0.26 against regret, 44% flagged at 0.6 (100 targeted sessions, 2026-09-20). */
     shouldProceed: {
         hold: number;
@@ -215,6 +217,10 @@ export interface ContextConfig {
     formatConfidence: number;
     /** Append a compact evidence appendix to the summary during compaction. */
     compactAppendix: boolean;
+    /** A run of at least 20 lines and 1500 characters in a new tool result that repeats text already in context becomes one pointer line (code only). */
+    dedupeRuns: boolean;
+    /** The same for user and custom messages, when `dedupeRuns` is also on. Off by default: a repeat the user sends can itself carry meaning ("here it is again, still failing"). */
+    dedupeMessages: boolean;
     /** Prevention before the call: a bash action request asks whether the command will print far more than the agent needs. Never holds. */
     largeOutput: LargeOutputConfig;
 }
@@ -267,7 +273,7 @@ export type WardenMode = "steer" | "confirm" | "advise";
 export interface PrefsConfig {
     /** Read this project's earlier session files for preferences the user repeated (`/warden prefs`). Local, code only. */
     enabled: boolean;
-    /** At session start, send the standing preferences to the agent as one context message. Off by default. */
+    /** At session start, send the standing preferences that pass every injection rule to the agent as one context message. */
     inject: boolean;
 }
 export interface LearningConfig {

package/dist/config.js

@@ -42,6 +42,7 @@ export function defaultConfig() {
             offTask: { warn: 0.6, steer: 0.85 },
             intentMismatch: 0.9,
             visibleMismatch: 0.8,
+            intentTraceOnly: "invisible",
             shouldProceed: { hold: 0.6, steer: false },
             feedbackLog: true,
             commandRules: [],
@@ -57,7 +58,7 @@ export function defaultConfig() {
         slop: { enabled: true, threshold: 0.7, prose: { enabled: true, audience: "technical", threshold: 0.7, trend: 2, minChars: 200 } },
         security: { enabled: true, threshold: 0.7, maskOutput: true },
         rules: { enabled: true, threshold: 0.7, files: [], fallback: true, maxChars: 8000, exclude: [], skip: [], sensitivePaths: {} },
-        context: { enabled: true, tailMinChars: 12000, confidence: 0.8, duplicateMinChars: 2000, recallTool: "auto", formatConfidence: 0.7, compactAppendix: true, largeOutput: { enabled: true, threshold: 0.85 } },
+        context: { enabled: true, tailMinChars: 12000, confidence: 0.8, duplicateMinChars: 2000, recallTool: "auto", formatConfidence: 0.7, compactAppendix: true, dedupeRuns: true, dedupeMessages: false, largeOutput: { enabled: true, threshold: 0.85 } },
         runaway: { enabled: true, repeats: 4, thinkingRepeats: 10, minChars: 400, recover: true },
         notify: { enabled: false, cooldownMs: 10000, command: [] },
         judge: { cooldownMs: 60000, failuresBeforeCooldown: 3 },
@@ -82,7 +83,7 @@ export function defaultConfig() {
             advanceThreshold: 0.70,
             loadThreshold: 1.0,
         },
-        prefs: { enabled: true, inject: false },
+        prefs: { enabled: true, inject: true },
     };
 }
 /** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */
@@ -284,6 +285,7 @@ function applyAction(base, raw, timeoutMs, source) {
         offTask: offTaskThreshold(raw.offTask, base.offTask),
         intentMismatch: probability(raw.intentMismatch, base.intentMismatch),
         visibleMismatch: Math.min(probability(raw.visibleMismatch, base.visibleMismatch), probability(raw.intentMismatch, base.intentMismatch)),
+        intentTraceOnly: raw.intentTraceOnly === "invisible" || raw.intentTraceOnly === "all" || raw.intentTraceOnly === "none" ? raw.intentTraceOnly : base.intentTraceOnly,
         shouldProceed: {
             hold: probability(raw.shouldProceed?.hold, base.shouldProceed.hold),
             steer: boolean(raw.shouldProceed?.steer, base.shouldProceed.steer),
@@ -464,6 +466,8 @@ function applyGuards(base, raw, timeoutMs, source) {
             recallTool: isRecallTool(raw.context.recallTool) ? raw.context.recallTool : base.context.recallTool,
             formatConfidence: probability(raw.context.formatConfidence, base.context.formatConfidence),
             compactAppendix: boolean(raw.context.compactAppendix, base.context.compactAppendix),
+            dedupeRuns: boolean(raw.context.dedupeRuns, base.context.dedupeRuns),
+            dedupeMessages: boolean(raw.context.dedupeMessages, base.context.dedupeMessages),
             largeOutput: isObject(raw.context.largeOutput) ? {
                 enabled: boolean(raw.context.largeOutput.enabled, base.context.largeOutput.enabled),
                 threshold: probability(raw.context.largeOutput.threshold, base.context.largeOutput.threshold),

package/dist/dedupe.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Repeated-run detection: a new tool result or message that pastes again a long block the agent already has in context
+ * (a relayed report that quotes every earlier turn) keeps only its new part. Exact line matches only, after trimming
+ * trailing spaces; near-duplicates are never collapsed. Deterministic; no requests.
+ */
+/** A run shorter than this, in lines or characters, is kept: a short repeat costs less than the pointer that replaces it. */
+export declare const RUN_MIN_LINES = 20;
+export declare const RUN_MIN_CHARS = 1500;
+/** Errors and verdicts usually sit at the end of a result, so the last characters are never replaced. */
+export declare const TAIL_KEEP_CHARS = 2000;
+export interface RepeatedRun {
+    /** First line of the run in the new text, 0-based. */
+    start: number;
+    lines: number;
+    chars: number;
+    /** Where the earlier copy is, e.g. "an earlier bash result". */
+    where: string;
+}
+/** One text the agent has in context, with a stable identity so a sync adds it once. */
+export interface SeenItem {
+    key: unknown;
+    where: string;
+    texts: string[];
+}
+export declare class SeenText {
+    /** Interned normalized lines; ids start at 1 so 0 marks a line never seen. */
+    private readonly lineIds;
+    private readonly docs;
+    private readonly windows;
+    private readonly keys;
+    clear(): void;
+    /** Match the index to what is in context now: a compaction or a move to another branch drops texts, so it rebuilds. */
+    sync(items: SeenItem[]): void;
+    add(text: string, where: string): void;
+    /** Runs of `text` that repeat one earlier text exactly, longest match first at each position, outside the kept tail. */
+    find(text: string): RepeatedRun[];
+}
+/** Replaces each run with one pointer line; `path` holds the full original text. */
+export declare function collapseRuns(text: string, runs: RepeatedRun[], path: string): string;
+/** The texts a session entry puts in context and where the agent saw them. Thinking, images, and summaries are not indexed. */
+export declare function seenItem(entry: unknown): SeenItem | undefined;

package/dist/dedupe.js

@@ -0,0 +1,162 @@
+/**
+ * Repeated-run detection: a new tool result or message that pastes again a long block the agent already has in context
+ * (a relayed report that quotes every earlier turn) keeps only its new part. Exact line matches only, after trimming
+ * trailing spaces; near-duplicates are never collapsed. Deterministic; no requests.
+ */
+/** A run shorter than this, in lines or characters, is kept: a short repeat costs less than the pointer that replaces it. */
+export const RUN_MIN_LINES = 20;
+export const RUN_MIN_CHARS = 1500;
+/** Errors and verdicts usually sit at the end of a result, so the last characters are never replaced. */
+export const TAIL_KEEP_CHARS = 2000;
+const BASE = 1_000_003;
+/** BASE^(RUN_MIN_LINES - 1) mod 2^32, for the rolling window hash. */
+const TOP = (() => { let power = 1; for (let index = 1; index < RUN_MIN_LINES; index++)
+    power = Math.imul(power, BASE); return power; })();
+/** Several earlier copies of one window are enough to find the longest match; more only cost memory. */
+const MAX_POSITIONS = 4;
+/** Hash of every RUN_MIN_LINES-line window, by start line. */
+function windowHashes(ids) {
+    const hashes = [];
+    if (ids.length < RUN_MIN_LINES)
+        return hashes;
+    let hash = 0;
+    for (let index = 0; index < RUN_MIN_LINES; index++)
+        hash = (Math.imul(hash, BASE) + ids[index]) | 0;
+    hashes.push(hash);
+    for (let index = RUN_MIN_LINES; index < ids.length; index++) {
+        hash = (Math.imul((hash - Math.imul(ids[index - RUN_MIN_LINES], TOP)) | 0, BASE) + ids[index]) | 0;
+        hashes.push(hash);
+    }
+    return hashes;
+}
+export class SeenText {
+    /** Interned normalized lines; ids start at 1 so 0 marks a line never seen. */
+    lineIds = new Map();
+    docs = [];
+    windows = new Map();
+    keys = new Set();
+    clear() {
+        this.lineIds.clear();
+        this.docs.length = 0;
+        this.windows.clear();
+        this.keys.clear();
+    }
+    /** Match the index to what is in context now: a compaction or a move to another branch drops texts, so it rebuilds. */
+    sync(items) {
+        const current = new Set(items.map(item => item.key));
+        for (const key of this.keys)
+            if (!current.has(key)) {
+                this.clear();
+                break;
+            }
+        for (const item of items) {
+            if (this.keys.has(item.key))
+                continue;
+            this.keys.add(item.key);
+            for (const text of item.texts)
+                this.add(text, item.where);
+        }
+    }
+    add(text, where) {
+        const lines = text.split("\n");
+        if (lines.length < RUN_MIN_LINES)
+            return;
+        const ids = lines.map(line => {
+            const normalized = line.trimEnd();
+            let id = this.lineIds.get(normalized);
+            if (id === undefined) {
+                id = this.lineIds.size + 1;
+                this.lineIds.set(normalized, id);
+            }
+            return id;
+        });
+        const doc = this.docs.push({ where, ids }) - 1;
+        windowHashes(ids).forEach((hash, line) => {
+            const positions = this.windows.get(hash);
+            if (!positions)
+                this.windows.set(hash, [[doc, line]]);
+            else if (positions.length < MAX_POSITIONS)
+                positions.push([doc, line]);
+        });
+    }
+    /** Runs of `text` that repeat one earlier text exactly, longest match first at each position, outside the kept tail. */
+    find(text) {
+        const lines = text.split("\n");
+        const cutoff = text.length - TAIL_KEEP_CHARS;
+        let limit = 0;
+        for (let offset = 0; limit < lines.length; limit++) {
+            const end = offset + lines[limit].length + 1;
+            if (end > cutoff)
+                break;
+            offset = end;
+        }
+        if (limit < RUN_MIN_LINES)
+            return [];
+        const ids = lines.slice(0, limit).map(line => this.lineIds.get(line.trimEnd()) ?? 0);
+        const hashes = windowHashes(ids);
+        const runs = [];
+        let index = 0;
+        while (index + RUN_MIN_LINES <= limit) {
+            let best;
+            for (const [doc, line] of this.windows.get(hashes[index]) ?? []) {
+                const seen = this.docs[doc].ids;
+                let length = 0;
+                while (index + length < limit && line + length < seen.length && ids[index + length] !== 0 && ids[index + length] === seen[line + length])
+                    length++;
+                if (length >= RUN_MIN_LINES && (!best || length > best.length))
+                    best = { doc, length };
+            }
+            if (best) {
+                let chars = 0;
+                for (let line = index; line < index + best.length; line++)
+                    chars += lines[line].length + 1;
+                if (chars >= RUN_MIN_CHARS) {
+                    runs.push({ start: index, lines: best.length, chars, where: this.docs[best.doc].where });
+                    index += best.length;
+                    continue;
+                }
+            }
+            index++;
+        }
+        return runs;
+    }
+}
+/** Replaces each run with one pointer line; `path` holds the full original text. */
+export function collapseRuns(text, runs, path) {
+    if (!runs.length)
+        return text;
+    const lines = text.split("\n");
+    const kept = [];
+    let index = 0;
+    for (const run of runs) {
+        kept.push(...lines.slice(index, run.start), `[pi-warden: the next ${run.lines} lines repeat ${run.where} — omitted; full text: ${path}]`);
+        index = run.start + run.lines;
+    }
+    kept.push(...lines.slice(index));
+    return kept.join("\n");
+}
+function textsOf(content) {
+    if (typeof content === "string")
+        return [content];
+    if (!Array.isArray(content))
+        return [];
+    return content.filter(part => part?.type === "text" && typeof part.text === "string").map(part => part.text);
+}
+/** The texts a session entry puts in context and where the agent saw them. Thinking, images, and summaries are not indexed. */
+export function seenItem(entry) {
+    if (!entry || typeof entry !== "object")
+        return undefined;
+    const record = entry;
+    const key = typeof record.id === "string" ? record.id : entry;
+    if (record.type === "custom_message")
+        return { key, where: `an earlier ${String(record.customType ?? "custom")} message`, texts: textsOf(record.content) };
+    if (record.type !== "message" || !record.message)
+        return undefined;
+    const { role } = record.message;
+    const where = role === "toolResult" ? `an earlier ${String(record.message.toolName ?? "tool")} result`
+        : role === "user" ? "an earlier user message"
+            : role === "assistant" ? "an earlier assistant reply"
+                : role === "custom" ? `an earlier ${String(record.message.customType ?? "custom")} message`
+                    : undefined;
+    return where ? { key, where, texts: textsOf(record.message.content) } : undefined;
+}

package/dist/extension.d.ts

@@ -5,7 +5,7 @@ import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
 export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit (or a bash command that writes a file with its content in the command) in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /** Which guard spent the user's attention. The status line reports one count per guard. */
-export type SteerGuard = "action" | "rules" | "security" | "stuck" | "repeat" | "done" | "prose" | "runaway" | "subagent" | "conscience";
+export type SteerGuard = "action" | "rules" | "security" | "stuck" | "repeat" | "done" | "prose" | "runaway" | "subagent" | "conscience" | "loops";
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
  * message count; the line says so instead of hiding it. Worst offender first: that is the number worth acting on.