pi-warden 0.71.0 → 0.74.0

package/CHANGELOG.md

@@ -8,6 +8,60 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 0.74.0
+
+### Added
+
+- `typesafeBackend` accepts `"commandcode"`: judgments go to api.commandcode.ai under `/provider/v1/systemone`, with the key from `COMMANDCODE_API_KEY` and the model `typesafe/jev`.
+- `typesafeBackend` accepts a caller-supplied endpoint object (`{ "label", "host", "path", "keyEnv", "defaultModel" }`, plus optional model-list fields) for a gateway that serves the same decisions protocol (pi-typesafe 0.8.0). The object is passed to the judge as written and validated on every call. It reads only its own `keyEnv` variable: the TypeSafe key and the `/typesafe login` store are never sent to it. `/warden status`, the `/warden enable` dialog, and the `/warden test` confirmation name the label, host, and model sent for any non-TypeSafe backend, and the consent disclosure names the real destination host.
+
+### Changed
+
+- An unknown `typesafeBackend` name, or an endpoint object the judge refuses, no longer silently falls back to `"typesafe"`: judgments turn off, the refusal message is shown once and in `/warden status`, and nothing is sent to api.typesafe.ai because a value was mistyped.
+
+## 0.73.1
+
+### Tests
+
+- `tests/host-compat.test.ts`: the fake host's per-handler timeout stays referenced while a dispatch runs and is cleared before `emit()` returns, so an awaited `emit()` always has a loop wakeup. The timer was unref'd, so on Node 22 the event loop could drain mid-dispatch and node:test cancelled the rest of the file with `Promise resolution is still pending but the event loop has already resolved`.
+
+## 0.73.0
+
+### Fixed
+
+- pi-warden runs on oh-my-pi and other hosts that load Pi extensions through a compatibility layer. `src/host-compat.ts` maps the host API onto the Pi contract: `before_agent_start` gets `systemPromptOptions` with the active skills, and an `appendSystemPrompt` becomes the host's `systemPrompt` array. An input the extension handles is also marked `handled`. `agent_settled` runs after pi-warden's `agent_end` handlers have been dispatched and the host becomes idle. If background work is cancelled without another `agent_end`, the adapter waits for that work to drain. Command contexts get `getSystemPromptOptions()`. On upstream Pi the API is not changed.
+- Data paths follow the host: the user config, the `/warden index` directory, and `holds.db` use the host's agent directory (`~/.pi/agent` on Pi, `~/.omp/agent` on oh-my-pi), and the project file uses the host's config directory (`.pi/pi-warden.json` or `.omp/pi-warden.json`).
+- On a host whose overlay handle cannot release focus, Escape closes the trace and config panels.
+- `import { defaultConfig } from "pi-warden"` works again without the optional `@earendil-works/pi-coding-agent` peer and now also without the optional `@earendil-works/pi-tui` peer: the library entry has no runtime import of either. Host directories come from the new injectable `HostDirs` parameter on every path function (`defaultHostDirs()` reads `PI_CODING_AGENT_DIR` and falls back to `~/.pi/agent`; existing callers keep working unchanged), and `src/extension.ts` builds them once from the host and passes them to every call. The entry's only pi-tui code — the rendered status stack — moved to `src/widget-render.ts`, which the entry does not re-export.
+- On a host whose agent directory is not the Pi default (oh-my-pi), an interactive session shows a one-time notice when `~/.pi/agent/pi-warden` exists and the notice has not been shown on this host: it names the target and legacy folders and a command that moves the fresh data aside and copies the legacy data in its place, and records a marker beside the data folder so it shows once. Headless sessions show nothing.
+
+### Docs
+
+- `docs/configuration.md`, `docs/data-handling.md`, `docs/commands.md`, and `docs/faq.md` say that paths follow the host. `docs/configuration.md` and `docs/data-handling.md` add a one-time migration note for existing oh-my-pi users: close all Pi and oh-my-pi sessions, then run `{ [ ! -e "$HOME/.omp/agent/pi-warden" ] || mv "$HOME/.omp/agent/pi-warden" "$HOME/.omp/agent/pi-warden.before-migration"; } && cp -R "$HOME/.pi/agent/pi-warden" "$HOME/.omp/agent/pi-warden"` and copy each project's `.pi/pi-warden.json` to `.omp/pi-warden.json` (keep the original). oh-my-pi shows this notice once per machine.
+
+## 0.72.0
+
+### Added
+
+- A project rule may cite where its wording came from with a `source: <file>:<line>` header beside `paths:`, for example `source: AGENTS.md:65`. `/warden rules` shows it, and when the rule fires the steer names it: `"<rule>" (from AGENTS.md line 65) ...`. A bad value is ignored and `/warden rules` reports the line.
+- `/warden init` compiles an existing `AGENTS.md` or `CLAUDE.md` into small rules. The prompt hands the agent the instruction file's lines with line numbers and asks for one rule per instruction that can be judged from one changed file, each with a `source:` header and a `paths:` header when the instruction concerns certain files, wording close to the source, and a concrete violation pattern. Instructions that need other files, repository history, or the task, and anything a linter or type checker enforces, are left out of the file and listed in the reply with the reason. The reply suggests `/warden rules check` when the user has a key; the check is never run automatically. When `pi-warden.md` already exists the prompt is unchanged.
+- `/warden rules audit [paths...] [--max N] [--yes]` judges existing files against the project rules as if each had just been written: one Jev request per file, at most four at a time, over the source files under the given paths (default: the project) that git does not ignore and at least one rule applies to, capped at `--max` (default 50) with the number left out reported. A confirm dialog names the file count and what leaves the machine before anything is sent; a headless run needs `--yes`. The output is a table by rule (files judged, files flagged, mean score) and the flagged files with their rule scores, worst first, plus a Markdown copy at `.pi-warden/rules-audit.md`. Nothing is recorded in the rules log. With no key or no consent it says so and sends nothing.
+- `/warden bench [--runs N]` (default 10) measures what a rules check costs on this machine: the fixed built-in sample file judged N times against the active rules, reporting p50 and p95 latency, requests, mean input tokens per check, and estimated cost per check and per 100 edits. No confirmation is needed — the sample is built in and no project content is sent — and with no key or no consent it says so and sends nothing.
+- `/warden rules calibrate [--commits N] [--max N] [--yes]` replays the changed files of the last N non-merge commits (default 20) through the project rules and reports, per rule, how often it applied and fired, the mean score, and the flags `fires on everything` and `undecided`, worst first, then the rules no file in the sample reached; a rule with no fire in the sample reports `no violation in sample` and is not flagged, because replayed commits are mostly compliant code. Each changed file is one `edit` request (the removed lines as `oldText`, the added lines as `newText`, the file after the commit as context), capped at `--max` (default 40); binary, generated, gitignored, `rules.exclude`, and `rules.skip` files are skipped, and a rule fires at its own `threshold:` cutoff. The scores go to the local rules log with `source: "calibrate"`, which `/warden report` counts apart from live verdicts. Nothing is sent before a confirm dialog showing the request count and the redacted diffs; a headless run needs the explicit `--yes`.
+- `/warden rules tune` sends the session's agent one prompt with the rules the latest calibrate flagged `fires on everything` or `undecided`, or that `/warden rules check` (this session) flagged: each rule's current text and why it was flagged, and the ask for a rewrite that is concrete and judgeable from one changed file. The agent edits `pi-warden.md` with its own tools. With nothing flagged it says so and sends nothing.
+- A project rule may carry `when: turn` beside `paths:`, `threshold:`, and `severity:` (default `edit`). A `when: turn` rule is judged once at the end of each agent run against the whole diff the run made and the user's task for that run, in one request, instead of on every edit — the home for rules one edit cannot answer, such as a change that adds more than the task asked for, a new abstraction with a single use, or logic duplicated across files. Turn rules are never asked about a single edit. The header lines parse in any order and at most once; a bad value is ignored and `/warden rules` reports the line.
+- The end-of-run pass also judges files that shell commands changed in ways the per-edit guard cannot see (`sed -i`, `patch`, `git apply`, a generator's output redirected to a file, a subagent's writes): each changed file that no `write`, `edit`, or literal shell write already judged during the run is judged once, with its diff as the edit and the same per-edit question. The baseline is a read-only snapshot of the working tree taken in the background at run start (a temporary index file; the working tree, the real index, and the stash list are never touched), diffed at run end and including new untracked files git does not ignore. Every git call is asynchronous, so no hook blocks while git hashes the tree; the run end waits for a snapshot still running. The diff is capped at `rules.maxChars` per file and in total with the cut named. The unseen-change requests are capped at five files per run — the same cap as the files one shell command writes — with the first files in diff order judged and the rest named in the trace. Findings are one steer at the end of the run through the done-check's delivery, at most once per run and within the per-run steer budget; nothing holds. With no `when: turn` rules and no change the per-edit guard missed, no request is made and nothing is said.
+
+### Tests
+
+- Offline coverage for the history replay: hunk extraction from `git log -p`, the skip rules (binary, generated, ignored, `rules.exclude`, `rules.skip`), the request cap, the confirm and `--yes` paths, the report flags and their order at the `/warden report` thresholds, the `source: "calibrate"` log records, and the tune prompt (with no prompt when nothing is flagged), on temporary git repositories with a fake judge.
+
+- Rules replay (`scripts/rules-replay.mjs`, `npm run eval:replay`): replays the `write` and `edit` calls of past Pi sessions in a project against that project's current rules, one request per judged call, and writes a review sheet (every flagged call plus a fixed-seed sample of unflagged calls) outside the repository beside aggregate counts. `--score` turns labelled sheets into precision on the flagged items and the estimated miss rate from the unflagged sample. The first run on this repository's own sessions is in `eval/reports/2026-09-27-rules-replay/`, unlabelled pending an independent reviewer. Offline tests cover the session replay and the output boundaries.
+
+### Docs
+
+- `docs/commands.md`, `docs/guards.md`, and `docs/data-handling.md` cover the two commands and what the replay sends.
+
 ## 0.71.0
 
 ### Added

package/dist/adaptive.d.ts

@@ -1,3 +1,4 @@
+import type { HostDirs } from "./host-dirs.js";
 import type { SteersConfig } from "./config.js";
 /**
  * Per-model steer adaptation. A steer kind that a model follows rarely or disputes often becomes trace-only for that
@@ -32,8 +33,8 @@ export interface MutedPair {
     followed: number;
     disputed: number;
 }
-/** Where the counts live: next to the user config, in pi-warden's data folder. */
-export declare function steerStatsPath(): string;
+/** Where the counts live: next to the user config, in pi-warden's data folder. `PI_WARDEN_STEER_STATS` overrides it. */
+export declare function steerStatsPath(dirs?: HostDirs): string;
 export declare const DEFAULT_STEERS: SteersConfig;
 /** True when the counts put the pair under the follow floor or over the dispute ceiling. */
 export declare function failing(kind: SteerKind, counts: Counts, config: SteersConfig): boolean;

package/dist/adaptive.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { writeFileAtomicSync } from "./atomic.js";
 import { userConfigPath } from "./config.js";
+import { defaultHostDirs } from "./host-dirs.js";
 export const STEER_KINDS = [
     "intent-mismatch", "off-task", "should-proceed", "warn-headless", "large-output", "slop", "rules", "sensitive-path",
     "security-write", "stuck", "repeat", "done", "prose", "conscience", "loops", "runaway", "subagent",
@@ -15,9 +16,9 @@ export const STEER_KINDS = [
 export const NEVER_MUTED = new Set([
     "hold", "confirm", "deny", "masking", "credential-notice", "done", "runaway", "subagent",
 ]);
-/** Where the counts live: next to the user config, in pi-warden's data folder. */
-export function steerStatsPath() {
-    return process.env.PI_WARDEN_STEER_STATS ?? join(dirname(userConfigPath()), "steer-stats.json");
+/** Where the counts live: next to the user config, in pi-warden's data folder. `PI_WARDEN_STEER_STATS` overrides it. */
+export function steerStatsPath(dirs = defaultHostDirs()) {
+    return process.env.PI_WARDEN_STEER_STATS ?? join(dirname(userConfigPath(dirs)), "steer-stats.json");
 }
 export const DEFAULT_STEERS = { adaptive: true, minSteers: 30, minFollowed: 0.2, maxDisputed: 0.4, recheckEvery: 30, probeEvery: 5 };
 const zero = () => ({ sent: 0, followed: 0, disputed: 0 });

package/dist/backend.d.ts

@@ -1,16 +1,37 @@
-import type { TypeSafeOptions } from "pi-typesafe";
-/** The judgment backend that receives pi-warden's Jev requests. */
-export type JudgmentBackend = "typesafe" | "openrouter";
-/** Why no judge is available: consent not given, no key for the backend, a saved 401 or 403, or the request budget spent. */
-export type JudgmentsOffReason = "no_consent" | "no_key" | "key_rejected" | "budget";
-/** The host the consent disclosure names as the destination, without scheme: `api.typesafe.ai`, `openrouter.ai`. */
-export declare function backendHost(backend: JudgmentBackend): string;
-/** The environment variable that carries the backend's key, for messages that tell the user what to set. */
-export declare function keyEnvFor(backend: JudgmentBackend): string;
-/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; pi-typesafe's `usesTypesafeKey`, which its package does not export. */
-export declare function loginStoresKey(backend: JudgmentBackend): boolean;
+import type { BackendSpec, TypeSafeOptions } from "pi-typesafe";
+/** The judgment backend: a registry name ("typesafe", "openrouter", "commandcode") or a caller-supplied endpoint object. */
+export type JudgmentBackend = BackendSpec;
+/** The judgment destination as the config carries it, plus the refusal that turns judgments off when the configured value was refused. */
+export interface BackendSetting {
+    /** The spec judgments go to; undefined only when the configured value was refused. */
+    readonly typesafeBackend: JudgmentBackend | undefined;
+    /** Why the configured value was refused: the once-per-session notice and `/warden status` quote it. */
+    readonly backendRefusal: string | undefined;
+}
+/** What a raw `typesafeBackend` value resolves to: the spec judgments go to, or the refusal that turns them off. Exactly one is set. */
+export type BackendResolution = {
+    readonly typesafeBackend: JudgmentBackend;
+    readonly backendRefusal?: undefined;
+} | {
+    readonly typesafeBackend?: undefined;
+    readonly backendRefusal: string;
+};
+/** Why no judge is available: consent not given, the backend refused, no key for the backend, a saved 401 or 403, or the request budget spent. */
+export type JudgmentsOffReason = "no_consent" | "bad_backend" | "no_key" | "key_rejected" | "budget";
+/**
+ * Resolve a raw config value to the spec judgments go to, kept as written, or to the refusal that turns judgments off.
+ * pi-typesafe validates the spec again on every call. An unknown name or an object it refuses is never silently mapped
+ * to the default backend: a mistyped value must not send judgments to api.typesafe.ai.
+ */
+export declare function resolveJudgmentBackend(raw: unknown): BackendResolution;
+/** The name messages show for a backend: the registry name, or an endpoint's validated label. */
+export declare function backendName(backend: JudgmentBackend | undefined): string;
+/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; true only for "typesafe". */
+export declare function loginStoresKey(backend: JudgmentBackend | undefined): boolean;
+/** One phrase naming where judgments go — the label, the host, and the model sent — for consent text and status lines. */
+export declare function describeBackend(backend: JudgmentBackend | undefined): string;
 /** Adapt the consent text to the active backend by substituting the destination host. */
-export declare function disclosureFor(backend: JudgmentBackend, disclosure: string): string;
+export declare function disclosureFor(backend: JudgmentBackend | undefined, disclosure: string): string;
 /**
  * Build the options forwarded to `createTypeSafe`.
  * The caller must gate on `authState({ backend }).usable` before calling `createTypeSafe`.
@@ -20,5 +41,3 @@ export declare function judgeOptions(config: {
     timeoutMs: number;
     typesafeBackend: JudgmentBackend;
 }): TypeSafeOptions;
-/** Resolve the effective backend from a raw config value; invalid values fall back to "typesafe". */
-export declare function resolveBackend(raw: unknown): JudgmentBackend;

package/dist/backend.js

@@ -1,19 +1,36 @@
-import { DECISIONS_BACKENDS, DEFAULT_BACKEND } from "pi-typesafe";
-/** The host the consent disclosure names as the destination, without scheme: `api.typesafe.ai`, `openrouter.ai`. */
-export function backendHost(backend) {
-    return new URL(DECISIONS_BACKENDS[backend].host).host;
+import { DEFAULT_BACKEND, backendHost, resolveBackend } from "pi-typesafe";
+/**
+ * Resolve a raw config value to the spec judgments go to, kept as written, or to the refusal that turns judgments off.
+ * pi-typesafe validates the spec again on every call. An unknown name or an object it refuses is never silently mapped
+ * to the default backend: a mistyped value must not send judgments to api.typesafe.ai.
+ */
+export function resolveJudgmentBackend(raw) {
+    if (raw === undefined || raw === null)
+        return { typesafeBackend: DEFAULT_BACKEND };
+    try {
+        resolveBackend(raw);
+    }
+    catch (error) {
+        return { backendRefusal: error instanceof Error ? error.message : String(error) };
+    }
+    return { typesafeBackend: raw };
 }
-/** The environment variable that carries the backend's key, for messages that tell the user what to set. */
-export function keyEnvFor(backend) {
-    return DECISIONS_BACKENDS[backend].keyEnv ?? DECISIONS_BACKENDS[DEFAULT_BACKEND].keyEnv ?? "TYPESAFE_API_KEY";
+/** The name messages show for a backend: the registry name, or an endpoint's validated label. */
+export function backendName(backend) {
+    return backend === undefined ? DEFAULT_BACKEND : typeof backend === "string" ? backend : resolveBackend(backend).label;
 }
-/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; pi-typesafe's `usesTypesafeKey`, which its package does not export. */
+/** Whether the backend takes the TypeSafe key, the only one `/typesafe login` stores; true only for "typesafe". */
 export function loginStoresKey(backend) {
-    return keyEnvFor(backend) === keyEnvFor(DEFAULT_BACKEND);
+    return backend === DEFAULT_BACKEND;
+}
+/** One phrase naming where judgments go — the label, the host, and the model sent — for consent text and status lines. */
+export function describeBackend(backend) {
+    const resolved = resolveBackend(backend);
+    return `${resolved.label} at ${backendHost(backend)}, model ${resolved.defaultModel ?? "none configured"}`;
 }
 /** Adapt the consent text to the active backend by substituting the destination host. */
 export function disclosureFor(backend, disclosure) {
-    return backend === DEFAULT_BACKEND ? disclosure : disclosure.replace(backendHost(DEFAULT_BACKEND), backendHost(backend));
+    return backend === undefined || backend === DEFAULT_BACKEND ? disclosure : disclosure.replace(backendHost(DEFAULT_BACKEND), backendHost(backend));
 }
 /**
  * Build the options forwarded to `createTypeSafe`.
@@ -26,7 +43,3 @@ export function judgeOptions(config) {
         ...(config.typesafeBackend === DEFAULT_BACKEND ? {} : { backend: config.typesafeBackend }),
     };
 }
-/** Resolve the effective backend from a raw config value; invalid values fall back to "typesafe". */
-export function resolveBackend(raw) {
-    return raw === "typesafe" || raw === "openrouter" ? raw : DEFAULT_BACKEND;
-}

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import type { JudgmentBackend } from "./backend.js";
+import type { HostDirs } from "./host-dirs.js";
 import type { WidgetConfig } from "./widget.js";
 export interface Threshold {
     /** P(yes) at or above this shows a warning and continues. */
@@ -367,8 +368,10 @@ export interface WardenConfig {
     enabled: boolean;
     /** Consent to send task and action summaries to api.typesafe.ai. Set by /warden enable; never by a project file. */
     typesafe: boolean;
-    /** The decisions service the judgments go to. User file only: a project must not redirect judgments to another vendor. */
-    typesafeBackend: JudgmentBackend;
+    /** The decisions service the judgments go to: a name ("typesafe", "openrouter", "commandcode") or a caller-supplied endpoint object. User file only: a project must not redirect judgments to another vendor. Undefined when the configured value was refused. */
+    typesafeBackend: JudgmentBackend | undefined;
+    /** Why the configured typesafeBackend was refused: judgments stay off, and the once-per-session notice and /warden status quote this. */
+    backendRefusal: string | undefined;
     /**
      * steer (default): a confirm-level call is held and the agent receives the judgment as its tool result, so it re-plans or asks
      * the user in chat. confirm: open a dialog and let the user decide (falls back to steer without a UI). advise: never hold; report only.
@@ -417,9 +420,9 @@ export declare const PACKAGE_NAME = "pi-warden";
 export declare const CONFIG_SCHEMA = 10;
 export declare const PROJECT_CONFIG_FILE = "pi-warden.json";
 export declare function defaultConfig(): WardenConfig;
-/** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */
-export declare function userConfigPath(): string;
-export declare function projectConfigPath(cwd: string): string;
+/** The user file is in the host's agent directory: `~/.pi/agent` on Pi, `~/.omp/agent` on oh-my-pi. `PI_CODING_AGENT_DIR` overrides it. */
+export declare function userConfigPath(dirs?: HostDirs): string;
+export declare function projectConfigPath(cwd: string, dirs?: HostDirs): string;
 type Json = Record<string, unknown>;
 export declare function isMode(value: unknown): value is WardenMode;
 /** Unknown keys and invalid values fall back to the base; nothing throws on a malformed file. */
@@ -430,13 +433,15 @@ export interface LoadOptions {
     cwd?: string;
     /** Project overrides are applied only when the caller vouches for the project (Pi's trust decision). */
     projectTrusted?: boolean;
+    /** Host directories; defaults to `defaultHostDirs()`. */
+    dirs?: HostDirs;
 }
 export declare function loadConfig(options?: LoadOptions): WardenConfig;
 /** Reads only the user file, for editing and persisting consent. */
-export declare function readUserConfig(): Json;
-export declare function writeUserConfig(raw: Json): string;
+export declare function readUserConfig(dirs?: HostDirs): Json;
+export declare function writeUserConfig(raw: Json, dirs?: HostDirs): string;
 /** Persists one top-level user setting without disturbing the rest of the file. */
-export declare function setUserSetting(key: "typesafe" | "enabled" | "mode", value: boolean | WardenMode): string;
+export declare function setUserSetting(key: "typesafe" | "enabled" | "mode", value: boolean | WardenMode, dirs?: HostDirs): string;
 export declare function setNestedValue(obj: Record<string, unknown>, path: string, value: unknown): Record<string, unknown>;
 export declare function getNestedValue(obj: Record<string, unknown>, path: string): unknown;
 /** Coerce a CLI string into a JSON primitive so `/warden config set` stays ergonomic. */

package/dist/config.js

@@ -1,8 +1,8 @@
 import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { writeFileAtomicSync } from "./atomic.js";
-import { resolveBackend } from "./backend.js";
+import { resolveJudgmentBackend } from "./backend.js";
+import { defaultHostDirs } from "./host-dirs.js";
 import { COMMAND_TOOLS } from "./tools.js";
 import { defaultWidgetConfig } from "./widget.js";
 // Tests of UI code are proven by running them, not by looking at them.
@@ -31,6 +31,7 @@ export function defaultConfig() {
         enabled: true,
         typesafe: false,
         typesafeBackend: "typesafe",
+        backendRefusal: undefined,
         mode: "steer",
         timeoutMs: 5000,
         maxRequests: 500,
@@ -89,16 +90,12 @@ export function defaultConfig() {
         waste: { enabled: true, tip: false, every: 20, sleep: true, paging: true, search: true, recheck: true },
     };
 }
-/** Mirrors Pi's agent directory rule so the file sits next to pi-typesafe's auth.json. */
-export function userConfigPath() {
-    const configured = process.env.PI_CODING_AGENT_DIR?.trim();
-    const agentDir = configured
-        ? (configured === "~" || configured.startsWith("~/") ? join(homedir(), configured.slice(1)) : configured)
-        : join(homedir(), ".pi", "agent");
-    return join(agentDir, PACKAGE_NAME, "config.json");
+/** The user file is in the host's agent directory: `~/.pi/agent` on Pi, `~/.omp/agent` on oh-my-pi. `PI_CODING_AGENT_DIR` overrides it. */
+export function userConfigPath(dirs = defaultHostDirs()) {
+    return join(dirs.agentDir, PACKAGE_NAME, "config.json");
 }
-export function projectConfigPath(cwd) {
-    return join(cwd, ".pi", PROJECT_CONFIG_FILE);
+export function projectConfigPath(cwd, dirs = defaultHostDirs()) {
+    return join(cwd, dirs.configDirName, PROJECT_CONFIG_FILE);
 }
 function isObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -486,10 +483,12 @@ export function applyUserOverrides(base, raw) {
     if (!isObject(raw))
         return base;
     const shared = applyShared(base, raw);
+    const backend = resolveJudgmentBackend(raw.typesafeBackend);
     return {
         enabled: boolean(raw.enabled, base.enabled),
         typesafe: boolean(raw.typesafe, base.typesafe),
-        typesafeBackend: resolveBackend(raw.typesafeBackend),
+        typesafeBackend: backend.typesafeBackend,
+        backendRefusal: backend.backendRefusal,
         mode: isMode(raw.mode) ? raw.mode : base.mode,
         ...shared,
         ...applyGuards(base, raw, shared.timeoutMs, "user"),
@@ -578,23 +577,24 @@ export function applyProjectOverrides(base, raw) {
     return { ...base, enabled: boolean(raw.enabled, base.enabled), ...applyGuards(base, raw, base.timeoutMs, "project"), prefs: applyPrefs(base.prefs, raw.prefs) };
 }
 export function loadConfig(options = {}) {
-    let config = applyUserOverrides(defaultConfig(), readJson(userConfigPath()));
+    const dirs = options.dirs ?? defaultHostDirs();
+    let config = applyUserOverrides(defaultConfig(), readJson(userConfigPath(dirs)));
     if (options.cwd && options.projectTrusted)
-        config = applyProjectOverrides(config, readJson(projectConfigPath(options.cwd)));
+        config = applyProjectOverrides(config, readJson(projectConfigPath(options.cwd, dirs)));
     return config;
 }
 /** Reads only the user file, for editing and persisting consent. */
-export function readUserConfig() {
-    return readJson(userConfigPath()) ?? {};
+export function readUserConfig(dirs = defaultHostDirs()) {
+    return readJson(userConfigPath(dirs)) ?? {};
 }
-export function writeUserConfig(raw) {
-    const path = userConfigPath();
+export function writeUserConfig(raw, dirs = defaultHostDirs()) {
+    const path = userConfigPath(dirs);
     writeFileAtomicSync(path, `${JSON.stringify(raw, null, 2)}\n`);
     return path;
 }
 /** Persists one top-level user setting without disturbing the rest of the file. */
-export function setUserSetting(key, value) {
-    return writeUserConfig({ ...readUserConfig(), [key]: value });
+export function setUserSetting(key, value, dirs = defaultHostDirs()) {
+    return writeUserConfig({ ...readUserConfig(dirs), [key]: value }, dirs);
 }
 export function setNestedValue(obj, path, value) {
     const keys = path.split(".");

package/dist/conscience.d.ts

@@ -66,7 +66,7 @@ export interface AssessmentResult {
     /** Number of judge requests issued for this assessment. */
     requestCount: number;
 }
-export type SkipReason = "disabled" | "no_consent" | "no_key" | "key_rejected" | "no_match" | "already_supplied" | "awaiting_user" | "timeout" | "error" | "stale" | "catalog_unavailable" | "catalog_limit" | "metadata_unsafe" | "budget" | "explicit_skill" | "origin_unknown" | "below_threshold";
+export type SkipReason = "disabled" | "no_consent" | "bad_backend" | "no_key" | "key_rejected" | "no_match" | "already_supplied" | "awaiting_user" | "timeout" | "error" | "stale" | "catalog_unavailable" | "catalog_limit" | "metadata_unsafe" | "budget" | "explicit_skill" | "origin_unknown" | "below_threshold";
 /** Score levels for the usefulness question. Levels are ordered from least to most useful. */
 export declare const SCORE_LEVELS: readonly ["No useful contribution to the current request, or conflicts with the supplied constraints.", "Related to the subject, but already covered, premature, or unable to resolve the current need.", "Addresses a concrete unmet need at the current step without displacing the active workflow.", "Supplies a missing prerequisite or directly applicable documented method needed for the current step."];
 /** Strip absolute paths, URLs, and credentials from a description. */

package/dist/extension.d.ts

@@ -1,5 +1,6 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { JudgmentBackend, JudgmentsOffReason } from "./backend.js";
+import type { HostDirs } from "./host-dirs.js";
+import type { BackendSetting, JudgmentsOffReason } from "./backend.js";
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
@@ -36,7 +37,7 @@ export declare function assistantPlan(ctx: ExtensionContext, visibleAction?: boo
  * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
  * names a key value or a path.
  */
-export declare function judgmentsOffText(reason: Exclude<JudgmentsOffReason, "budget">, backend: JudgmentBackend, headless: boolean, rejectedEnv?: string): string;
+export declare function judgmentsOffText(reason: Exclude<JudgmentsOffReason, "budget">, setting: BackendSetting, headless: boolean, rejectedEnv?: string): string;
 export declare function confirmMessage(verdict: Verdict): string;
 /** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
 export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[], counts: Record<SlopSymptom, number>): string;
@@ -48,4 +49,14 @@ export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[
 export declare function guardCurrentSections(result: ShapeResult): ShapeResult;
 /** Test-only: set the index-running state and write paths for the action guard bypass. */
 export declare function _testSetIndexRunning(running: boolean, paths?: string[]): void;
-export default function wardenExtension(pi: ExtensionAPI): void;
+/**
+ * The one-time migration message for a host whose agent directory is not Pi's default, when data
+ * still lives only under the default and this host has not shown the notice yet: undefined
+ * otherwise. The caller checks the filesystem for data and the marker. The directories are compared
+ * in absolute, symlink-free form: the same directory under another spelling (trailing slash, `.`
+ * segment, symlink) gets no notice, because the command would move the only copy aside. The command
+ * moves the fresh data this host may have created aside (non-destructive, and works when the target
+ * folder does not exist) and copies the legacy data whole in its place.
+ */
+export declare function legacyDataNotice(dirs: HostDirs, piDefault: HostDirs, exists: (path: string) => boolean): string | undefined;
+export default function wardenExtension(host: ExtensionAPI): void;