pi-warden 0.71.0 → 0.74.0

package/dist/extension.js

@@ -1,17 +1,20 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { join, resolve as pathResolve } from "node:path";
 import { homedir } from "node:os";
+import { CONFIG_DIR_NAME, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { defaultHostDirs } from "./host-dirs.js";
 import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
-import { authState, createTypeSafe, describeAuth } from "pi-typesafe";
+import { authState, backendHost, createTypeSafe, describeAuth, resolveBackend } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
-import { backendHost, disclosureFor, judgeOptions, keyEnvFor, loginStoresKey, resolveBackend } from "./backend.js";
+import { backendName, describeBackend, disclosureFor, judgeOptions, loginStoresKey } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
-import { assistantView, formatMuted, NEVER_MUTED, STEER_KINDS, SteerStats, SteerWatch } from "./adaptive.js";
+import { adaptHost } from "./host-compat.js";
+import { assistantView, formatMuted, NEVER_MUTED, STEER_KINDS, SteerStats, SteerWatch, steerStatsPath } from "./adaptive.js";
 import { ArmingTracker, unparseableArmingRules } from "./arming.js";
 import * as configModule from "./config.js";
-import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
+import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, PROJECT_CONFIG_FILE, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, isVisualCheck, needsDoneCheck, recordOutcome as recordDoneOutcome, recordUi } from "./done.js";
 import { createdScratch, evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, largeOutputNotice, offTaskSteer, pruneScratch, scratchCandidates, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, wardenHostPaths, writeSinkTargets, isVisibleCommand } from "./guard.js";
 import { commandOf } from "./tools.js";
@@ -22,8 +25,11 @@ import { evaluateProse, proseNudge, ProseTrend, RESTATE_MIN_SENTENCES, RESTATE_S
 import { compressOutput, duplicateNote, evaluateOutput, mergeOutput, outputKey, saveOutput, securityNotice, CompressionLearner } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
 import { maskSecrets, redact } from "./redact.js";
-import { formatRules, pathNoteSteer, projectPath, RulesGuard, rulesSteer, RULES_FILE, FALLBACK_FILES } from "./rules.js";
+import { formatRules, pathNoteSteer, projectPath, RulesGuard, rulesSteer, RULES_FILE, FALLBACK_FILES, turnRulesFor } from "./rules.js";
+import { evaluateTurnRun, SHELL_RULES_CHECKS, snapshotTree, turnSteer } from "./turn-rules.js";
 import { checkRules, formatRulesCheck } from "./rules-lint.js";
+import { parseRulesAuditArgs, parseBenchArgs, runRulesAudit, runBench, formatRulesAudit, formatBench } from "./rules-audit.js";
+import { calibrate, calibrateGate, calibrationNotice, collectHistory, formatCalibration, planCalibration, tuneRequest, CALIBRATE_DEFAULT_COMMITS, CALIBRATE_DEFAULT_MAX } from "./rules-calibrate.js";
 import { readRulesLog, RulesLog, rulesLogPath } from "./rules-log.js";
 import { buildRulesReport, formatRulesReport, REPORT_DEFAULT_DAYS } from "./rules-report.js";
 import { checkPiWardenMissing } from "./rules-file.js";
@@ -48,12 +54,11 @@ import { changePrefsStore, emptyWordCounts, evaluatePrefs, forgetPref, formatPre
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
 import { TraceFile, judgmentsState, traceDir, traceFilePath } from "./trace-file.js";
-import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, rulesTokens, SENTENCE_TEMPLATES, statusWidget, TOKEN_NAMES } from "./widget.js";
+import { actionTokens, DEFAULT_TEMPLATES, LEVEL_COLOR, pickSentenceTemplate, proseTokens, renderTemplate, rulesTokens, SENTENCE_TEMPLATES, TOKEN_NAMES } from "./widget.js";
+import { statusWidget } from "./widget-render.js";
 export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request, the task spine it is judged against (the first request of the thread and up to four redacted earlier requests), and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); the resolved active rules file content (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback, token-aware truncated at ~4000 tokens) sent with every action request unless the rules guard is off (`rules.enabled: false`), which keeps that content on this machine; for a write or edit (or a bash command that writes a file with its content in the command) in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); a redacted sample of an async subagent report that names a failure, a stop, or a question, with your latest request, when warden decides whether that report should wake the agent; and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. For the conscience coach (recommend mode): your current request (2000 redacted characters), the same task spine (the first request of the thread and up to four redacted earlier requests), up to four recent user/assistant text messages (500 redacted characters each with roles), and sanitized candidate metadata (skill/tool name, role, lead, useWhen, examples when an index entry matches; bare description otherwise; full skill instructions never go to Jev). The index is built locally by the session model; only sanitized entries reach Jev; advertised locations never do. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory; an owner-only SQLite database under Pi's agent directory stores redacted hold context (plan, summary, redacted command preview, outcomes) for held and judged-allowed calls, for learning and retention (configurable, default 365 days). Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-/** Rules requests one bash command may start; the other files it writes are recorded as skipped. */
-const SHELL_RULES_CHECKS = 5;
 const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, offPlanTraceOnly: 0, offTask: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0, cooldownSkips: 0, steers: 0, steersSkipped: 0, steersMuted: 0, steerGuards: {}, subagentReports: 0, subagentWoken: 0, restatements: 0 });
 /**
  * One steer message can carry notes from more than one guard, so the per-guard numbers may add up to more than the
@@ -196,10 +201,11 @@ function planForCall(entries) {
  * variable that holds a rejected key, or undefined when the rejected key is the one `/typesafe login` saved. Never
  * names a key value or a path.
  */
-export function judgmentsOffText(reason, backend, headless, rejectedEnv) {
+export function judgmentsOffText(reason, setting, headless, rejectedEnv) {
     switch (reason) {
         case "no_consent": return `warden: Jev judgments are off (no consent). ${headless ? "Set PI_WARDEN_ENABLED=1." : "Run /warden enable."}`;
-        case "no_key": return `warden: Jev judgments are off (no key for ${backend}). Set ${keyEnvFor(backend)}${loginStoresKey(backend) ? " or run /typesafe login" : ""}.`;
+        case "bad_backend": return `warden: Jev judgments are off (typesafeBackend refused: ${setting.backendRefusal ?? "the configured value is not usable"})`;
+        case "no_key": return `warden: Jev judgments are off (no key for ${backendName(setting.typesafeBackend)}). Set ${resolveBackend(setting.typesafeBackend).keyEnv}${loginStoresKey(setting.typesafeBackend) ? " or run /typesafe login" : ""}.`;
         case "key_rejected": return rejectedEnv
             ? `warden: Jev judgments are off (the key in ${rejectedEnv} was rejected). Check the key, then run /warden status.`
             : "warden: Jev judgments are off (the key saved by /typesafe login was rejected). Run /typesafe login.";
@@ -304,7 +310,50 @@ export function _testSetIndexRunning(running, paths = []) {
     indexRunning = running;
     indexWritePaths = paths;
 }
-export default function wardenExtension(pi) {
+/* ─── One-time migration notice ─────────────────────────────────────── */
+const MIGRATION_MARKER = ".pi-warden-migration-notice-shown";
+/** Single-quote a path for /bin/sh; an embedded quote ends the string, escapes itself, and reopens. */
+function shellQuote(value) {
+    return `'` + value.replaceAll("'", `'\\''`) + `'`;
+}
+/** The absolute, symlink-free, on-disk-case form of a directory; a missing directory falls back to its absolute path. */
+function canonicalDirectory(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return pathResolve(path);
+    }
+}
+/**
+ * The one-time migration message for a host whose agent directory is not Pi's default, when data
+ * still lives only under the default and this host has not shown the notice yet: undefined
+ * otherwise. The caller checks the filesystem for data and the marker. The directories are compared
+ * in absolute, symlink-free form: the same directory under another spelling (trailing slash, `.`
+ * segment, symlink) gets no notice, because the command would move the only copy aside. The command
+ * moves the fresh data this host may have created aside (non-destructive, and works when the target
+ * folder does not exist) and copies the legacy data whole in its place.
+ */
+export function legacyDataNotice(dirs, piDefault, exists) {
+    const agentDir = canonicalDirectory(dirs.agentDir);
+    const piAgentDir = canonicalDirectory(piDefault.agentDir);
+    if (agentDir === piAgentDir)
+        return undefined;
+    const legacy = join(piAgentDir, PACKAGE_NAME);
+    if (!exists(legacy))
+        return undefined;
+    const target = join(agentDir, PACKAGE_NAME);
+    if (exists(join(agentDir, MIGRATION_MARKER)))
+        return undefined;
+    const command = `{ [ ! -e ${shellQuote(target)} ] || mv ${shellQuote(target)} ${shellQuote(`${target}.before-migration`)}; } && cp -R ${shellQuote(legacy)} ${shellQuote(target)}`;
+    return `pi-warden now keeps its data in ${target}. Your earlier config and learning data are in ${legacy}. To keep them, close all Pi and oh-my-pi sessions, then run \`${command}\`. Also copy each project's ${join(piDefault.configDirName, PROJECT_CONFIG_FILE)} to ${join(dirs.configDirName, PROJECT_CONFIG_FILE)} and keep the original.`;
+}
+export default function wardenExtension(host) {
+    const pi = adaptHost(host);
+    // The host boundary: this module already imports the Pi peer at runtime (via load.js), so it reads
+    // the host's agent directory here once and passes it to every library path call below. The library
+    // modules stay free of runtime Pi imports.
+    const dirs = { agentDir: getAgentDir(), configDirName: CONFIG_DIR_NAME };
     // The beta policy is held in this closure and passed to the activation gate on every delivery
     // check; there is no module state. A question-wording change breaks the hash test and the gate
     // fail-closes (no delivery) until the policy is re-measured.
@@ -362,12 +411,20 @@ export default function wardenExtension(pi) {
     let fullOutputs = new Map();
     let evidence = emptyEvidence();
     let doneNudged = false;
+    // Turn rules: the read-only working-tree snapshot started at run start and awaited at run end, and the files a
+    // per-edit judgment saw.
+    let turnSnapshot;
+    let turnJudged = new Set();
     /** True from a delivered warden follow-up that starts a turn until the next run starts: that run keeps the evidence. */
     let wardenContinuation = false;
     let warnedFallback = false;
     let warnedMissingRules = false;
     /** True while /warden init is sending a prompt and waiting for the agent to generate pi-warden.md. */
     let initRunning = false;
+    /** The most recent /warden rules calibrate result; /warden rules tune reads its flagged rules. */
+    let lastCalibration;
+    /** The most recent /warden rules check result of this session; /warden rules tune reads its flagged rules. */
+    let lastCheck;
     /** True while /warden audit is sending a prompt and waiting for the agent to write the report. */
     let auditRunning = false;
     const prose = new ProseTrend();
@@ -412,7 +469,7 @@ export default function wardenExtension(pi) {
     /** The scan, the project's lesson file, and every listed item with its status; read fresh so `forget` numbers match. */
     const evaluatedPrefs = async (ctx) => {
         const scan = await standingPrefs(ctx);
-        const path = prefsStorePath(scan.project);
+        const path = prefsStorePath(scan.project, dirs);
         return { scan, path, items: evaluatePrefs(scan, await readPrefsStore(path)) };
     };
     // Assistant turns this session, and the turn of the last user correction or stuck, repeat, or done-check steer in this
@@ -426,7 +483,7 @@ export default function wardenExtension(pi) {
     const loopsFile = (ctx) => {
         const manager = ctx.sessionManager;
         const id = typeof manager?.getSessionId === "function" ? manager.getSessionId() : undefined;
-        return id ? loopsPath(ctx.cwd, id) : undefined;
+        return id ? loopsPath(ctx.cwd, id, dirs) : undefined;
     };
     /**
      * On resume, one message lists the loops still open, so a session picked up later knows what it promised. Not a steer.
@@ -457,7 +514,7 @@ export default function wardenExtension(pi) {
     let inertReported = false;
     let unparseableReported = false;
     const configFor = (ctx) => {
-        const { config, missing } = guardCurrentSections(completeConfig(loadConfig({ cwd: ctx.cwd, projectTrusted: ctx.isProjectTrusted() })));
+        const { config, missing } = guardCurrentSections(completeConfig(loadConfig({ cwd: ctx.cwd, projectTrusted: ctx.isProjectTrusted(), dirs })));
         if (missing.length && !shapeReported) {
             shapeReported = true;
             // A namespace read stays undefined (not a link error) when an older config module lacks the export.
@@ -501,11 +558,15 @@ export default function wardenExtension(pi) {
     const consentGiven = (config) => config.typesafe || process.env.PI_WARDEN_ENABLED === "1";
     /** Why no judge is available, or undefined when one is. The notice, the trace file, and the conscience all use it. */
     const judgmentsOffReason = (config) => {
+        // A refused backend is a config error the user must see even before consent or keys matter.
+        const backend = config.typesafeBackend;
+        if (config.backendRefusal !== undefined || backend === undefined)
+            return "bad_backend";
         if (!consentGiven(config))
             return "no_consent";
         if (budgetExhausted)
             return "budget";
-        const auth = authState({ backend: config.typesafeBackend });
+        const auth = authState({ backend });
         if (auth.usable)
             return undefined;
         // No key in effect, or one whose last request came back 401 or 403.
@@ -522,8 +583,8 @@ export default function wardenExtension(pi) {
         if (reason === undefined || reason === "budget" || judgmentsReported.has(reason))
             return;
         judgmentsReported.add(reason);
-        const auth = reason === "key_rejected" ? authState({ backend: config.typesafeBackend }) : undefined;
-        judgmentsNotify?.(judgmentsOffText(reason, config.typesafeBackend, judgmentsHeadless, auth?.kind === "environment" ? auth.keyName : undefined));
+        const auth = reason === "key_rejected" && config.typesafeBackend !== undefined ? authState({ backend: config.typesafeBackend }) : undefined;
+        judgmentsNotify?.(judgmentsOffText(reason, config, judgmentsHeadless, auth?.kind === "environment" ? auth.keyName : undefined));
     };
     const consentSource = (config) => config.typesafe ? "/warden enable" : process.env.PI_WARDEN_ENABLED === "1" ? "PI_WARDEN_ENABLED" : undefined;
     /** A consent flag is not proof that judgments happen; check the key state for the chosen backend. */
@@ -538,7 +599,26 @@ export default function wardenExtension(pi) {
             stats.cooldownSkips++;
             return undefined;
         }
-        return client ??= watched(createTypeSafe(judgeOptions(config)));
+        if (client)
+            return client;
+        const backend = config.typesafeBackend;
+        // Reached only if a config ever sets no backend and no refusal at once; treating it as off keeps the invariant.
+        if (backend === undefined)
+            return undefined;
+        try {
+            client = watched(createTypeSafe(judgeOptions({ maxRequests: config.maxRequests, timeoutMs: config.timeoutMs, typesafeBackend: backend })));
+        }
+        catch (error) {
+            // An endpoint the config accepts can still be unusable (one that names no defaultModel); a hook must never crash.
+            const message = error instanceof Error ? error.message : String(error);
+            if (!judgmentsReported.has("bad_backend")) {
+                judgmentsReported.add("bad_backend");
+                traceFile?.judgments(judgmentsState("bad_backend"));
+                judgmentsNotify?.(`warden: Jev judgments are off (typesafeBackend refused: ${message})`);
+            }
+            return undefined;
+        }
+        return client;
     };
     /** Every guard reaches the backend through `evaluate`, so this one seam sees each failure and each success. */
     const watched = (typesafe) => new Proxy(typesafe, {
@@ -569,7 +649,7 @@ export default function wardenExtension(pi) {
         }
         const seconds = Math.round(event.ms / 1000);
         const remedy = event.kind === "auth"
-            ? ` Set ${keyEnvFor(judgeConfig?.typesafeBackend ?? "typesafe")} or run /warden enable.`
+            ? ` Set ${resolveBackend(judgeConfig?.typesafeBackend).keyEnv} or run /warden enable.`
             : event.kind === "configuration" ? " /warden status shows the backend setup." : "";
         noticeUi.notify(`warden: judgments paused for ${seconds}s after a ${event.kind} failure; pattern checks run alone until then.${remedy}`, "warning");
     };
@@ -608,7 +688,7 @@ export default function wardenExtension(pi) {
             configPanel.close();
             return;
         }
-        const opened = openConfigPanel(ui, config, { width: config.widget.panelWidth });
+        const opened = openConfigPanel(ui, config, { width: config.widget.panelWidth, dirs });
         configPanel = opened;
         opened.closed.catch(() => undefined).finally(() => { if (configPanel === opened)
             configPanel = undefined; });
@@ -740,7 +820,7 @@ export default function wardenExtension(pi) {
                 trace.amend(entry, outcomeNote(item));
             const idPromise = learningIds.get(item.id);
             if (idPromise && item.outcome !== "pending") {
-                idPromise.then(id => recordOutcome(id, item.outcome)).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
+                idPromise.then(id => recordOutcome(id, item.outcome, dirs)).catch(err => console.warn("pi-warden: recordOutcome failed:", err));
             }
         }
         if (config.action.feedbackLog && holds.records().length)
@@ -757,7 +837,7 @@ export default function wardenExtension(pi) {
     const CRITICAL_STEER_GUARDS = new Set(["stuck", "done", "runaway", "subagent"]);
     let steersThisRun = 0;
     /** Follow and dispute counts per (model, steer kind), kept across sessions; and the sent steers still waiting for a reply. */
-    const steerStats = new SteerStats();
+    const steerStats = new SteerStats(steerStatsPath(dirs));
     const steerWatch = new SteerWatch();
     /** Session generation counter for conscience invalidation. Incremented on steer, abort, reload, switch, or config change. */
     let conscienceGeneration = 0;
@@ -914,6 +994,19 @@ export default function wardenExtension(pi) {
         if (ctx.hasUI)
             lastUi = ctx.ui;
         noticeUi = ctx.hasUI ? ctx.ui : undefined;
+        // The one-time migration notice runs before any call creates <agentDir>/pi-warden (the
+        // initSchema below does). Interactive sessions only: a headless session neither consumes the
+        // notice nor injects a cp instruction into the agent, and the marker records what was shown.
+        const migrationMessage = ctx.hasUI ? legacyDataNotice(dirs, defaultHostDirs(), existsSync) : undefined;
+        if (migrationMessage) {
+            try {
+                writeFileSync(join(dirs.agentDir, MIGRATION_MARKER), "", { mode: 0o600 });
+            }
+            catch (err) {
+                console.warn("pi-warden: could not record the migration notice marker:", err);
+            }
+            ctx.ui.notify(`warden: ${migrationMessage}`, "info");
+        }
         cooldown.reset();
         if (_event.reason === "reload" || _event.reason === "new")
             conscienceGeneration++;
@@ -922,7 +1015,9 @@ export default function wardenExtension(pi) {
         warnedFallback = false;
         warnedMissingRules = false;
         initRunning = false;
-        await initSchema(loadConfig().learning.retentionDays);
+        lastCalibration = undefined;
+        lastCheck = undefined;
+        await initSchema(loadConfig({ dirs }).learning.retentionDays, dirs);
         stats = freshStats();
         steerWatch.clear();
         widget.clear();
@@ -934,8 +1029,8 @@ export default function wardenExtension(pi) {
         holds.reset();
         regretCandidates = [];
         const sessionId = typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid);
-        holdLog = new HoldLog(holdLogPath(sessionId));
-        rulesLog = new RulesLog(ctx.cwd, sessionId, { onFailure: message => record(ctx, loadConfig(), "rules", "rules log write failed", [message]) });
+        holdLog = new HoldLog(holdLogPath(sessionId, new Date(), dirs));
+        rulesLog = new RulesLog(ctx.cwd, sessionId, { path: rulesLogPath(ctx.cwd, dirs), onFailure: message => record(ctx, loadConfig({ dirs }), "rules", "rules log write failed", [message]) });
         unsubscribeTraceFile?.();
         unsubscribeTraceFile = undefined;
         traceFile = undefined;
@@ -945,14 +1040,14 @@ export default function wardenExtension(pi) {
             ctx.ui.notify(text, "warning");
         else
             pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
-        sessionHostPaths = wardenHostPaths();
+        sessionHostPaths = wardenHostPaths(undefined, dirs);
         const dir = traceDir();
         if (dir) {
             const warn = (text) => { if (ctx.hasUI)
                 ctx.ui.notify(text, "warning");
             else
                 pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: text, display: true }); };
-            const opening = loadConfig();
+            const opening = loadConfig({ dirs });
             traceFile = new TraceFile(traceFilePath(dir, sessionId), dir, { sessionId, cwd: ctx.cwd, mode: opening.mode, judgments: judgmentsState(judgmentsOffReason(opening)) }, warn);
             unsubscribeTraceFile = trace.subscribe(traceFile.listener);
         }
@@ -998,8 +1093,8 @@ export default function wardenExtension(pi) {
         lessonSignalTurn = undefined;
         loopsReminded = undefined;
         // Load capability indexes (once per session, overwritten on every /warden index run).
-        globalIndexFile = readIndex(indexPath("global")) ?? undefined;
-        projectIndexFile = readIndex(indexPath("project", ctx.cwd)) ?? undefined;
+        globalIndexFile = readIndex(indexPath("global", undefined, undefined, dirs)) ?? undefined;
+        projectIndexFile = readIndex(indexPath("project", ctx.cwd, undefined, dirs)) ?? undefined;
         indexNudged = false;
         indexRunning = false;
         for (const symptom of Object.keys(slopCounts))
@@ -1007,7 +1102,7 @@ export default function wardenExtension(pi) {
         if (ctx.hasUI)
             ctx.ui.setWidget(WIDGET, undefined);
         // One-time notice when confirm mode falls back to steer (headless).
-        if (!warnedFallback && loadConfig().mode === "confirm" && !ctx.hasUI) {
+        if (!warnedFallback && loadConfig({ dirs }).mode === "confirm" && !ctx.hasUI) {
             warnedFallback = true;
             const msg = "warden: confirm mode requires a UI; falling back to steer mode for this session.";
             if (ctx.hasUI)
@@ -1355,10 +1450,19 @@ export default function wardenExtension(pi) {
     });
     // Each low-level run collects its own evidence of changes and checks. A run that a warden follow-up started continues
     // the previous run's work, so it keeps that evidence: the changes behind a done-check nudge still need a passing check.
-    pi.on("agent_start", async () => {
+    pi.on("agent_start", async (_event, ctx) => {
         if (!wardenContinuation)
             evidence = emptyEvidence();
         wardenContinuation = false;
+        // Turn rules need a baseline of the working tree. The snapshot starts here as a promise and is awaited at
+        // agent_end, so this hook never waits for git to hash the changed and untracked files. One trace line when a run
+        // with turn rules gets no baseline. With no turn rules a failed snapshot is silent: a project without them sees
+        // no change.
+        turnJudged = new Set();
+        turnSnapshot = undefined;
+        const turnConfig = configFor(ctx);
+        if (turnConfig.enabled && turnConfig.rules.enabled)
+            turnSnapshot = snapshotTree(ctx.cwd);
     });
     // Every turn that runs after a compression is a turn that did not carry the removed text.
     pi.on("turn_end", async (_event, ctx) => {
@@ -1494,6 +1598,16 @@ export default function wardenExtension(pi) {
             : undefined;
         // Each file is one rules request, so a script that writes many files would start as many requests at once.
         const shellFiles = mergeWrites(shell?.writes ?? []);
+        // Turn rules: a file these checks judge is not judged again at the end of the run.
+        if (config.rules.enabled) {
+            const inputPath = typeof event.input.path === "string" ? event.input.path : "";
+            const seen = event.toolName === "write" || event.toolName === "edit" ? [inputPath] : shellFiles.slice(0, SHELL_RULES_CHECKS).map(write => write.path);
+            for (const path of seen) {
+                const rel = projectPath(path, ctx.cwd);
+                if (rel)
+                    turnJudged.add(rel);
+            }
+        }
         const shellSkips = [...(shell?.skips ?? []), ...shellFiles.slice(SHELL_RULES_CHECKS).map(write => ({ path: write.path, reason: `only the first ${SHELL_RULES_CHECKS} files a command writes are judged` }))];
         const rulesChecks = !config.rules.enabled ? []
             : event.toolName === "write" || event.toolName === "edit" ? [{ check: rulesGuard.inspect(call, siblings, rulesOptions) }]
@@ -1605,7 +1719,7 @@ export default function wardenExtension(pi) {
             // The promise and map entry must exist before noteOutcomes so that an outcome
             // known at record time (e.g. dialog-approved) is not lost to the race.
             const preview = redact(verdict.summary.command ?? verdict.summary.path ?? "");
-            const holdPromise = recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores, held }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: held ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined, preview })).catch(err => { console.warn("pi-warden: recordHold failed:", err); return -1; });
+            const holdPromise = recordHold(toHoldRecord({ at: item.at, tool: item.tool, level: item.level, reasons: item.reasons, scores: item.scores, held }, ctx.cwd, { task: task ? redact(task) : task, plan: verdict.plan, contextSummary: ctxSummary, agentReason: held ? steerReason(deliveryVerdict, { canApprove: judge !== undefined }) : undefined, preview }), dirs).catch(err => { console.warn("pi-warden: recordHold failed:", err); return -1; });
             learningIds.set(item.id, holdPromise);
             pruneLearningIds();
             noteOutcomes(config, outcome ? [item] : []);
@@ -2387,6 +2501,62 @@ export default function wardenExtension(pi) {
                 }
             }
         }
+        // ── Turn rules: one end-of-run judgment against the whole diff, and the files no per-edit check saw ──
+        // One steer for the findings, through the done-check's delivery; the verdicts land in the rules log like the rest.
+        if (config.rules.enabled && turnSnapshot) {
+            // The run end waits for the snapshot the run start began; a run that ended first has been waiting since.
+            const snapshot = await turnSnapshot;
+            turnSnapshot = undefined;
+            const set = rulesGuard.store.load(ctx.cwd, config.rules);
+            if (!snapshot.tree) {
+                if (set && turnRulesFor(set).length)
+                    record(ctx, config, "rules", `warden · rules · turn rules skipped this run: ${snapshot.reason}`, ["trigger: agent_end", "no working-tree snapshot: the end-of-run pass will not run this turn rules check"]);
+            }
+            else {
+                const turnRun = await evaluateTurnRun({ cwd: ctx.cwd, config: config.rules, set, judge, timeoutMs: config.timeoutMs, signal: ctx.signal, task: latestUserPrompt(ctx), startTree: snapshot.tree, alreadyJudged: turnJudged });
+                if (turnRun.skipped) {
+                    record(ctx, config, "rules", `warden · rules · end-of-run pass skipped: ${turnRun.skipped}`, ["trigger: agent_end"]);
+                }
+                // One trace line names the files the per-run cap left unjudged, like the skips of one command's shell writes.
+                if (turnRun.skips.length) {
+                    const paths = turnRun.skips.flatMap(skip => (skip.path ? [skip.path] : []));
+                    record(ctx, config, "rules", renderTemplate(config.widget.rules, { guard: "rules", tool: "unseen change", path: paths.length ? paths.join(", ") : "file change", status: "skipped" }), turnRun.skips.map(skip => `unseen change not judged${skip.path ? ` (${skip.path})` : ""}: ${skip.reason}`));
+                }
+                let counts = new Map();
+                for (const verdict of turnRun.verdicts)
+                    counts = rulesGuard.count(verdict);
+                const hasFindings = turnRun.verdicts.some(verdict => verdict.findings.length > 0);
+                const told = hasFindings && adaptiveSend(ctx, config, "rules") ? turnSteer(turnRun.verdicts, counts) : undefined;
+                const delivered = told ? steer(config, "rules", told, { deliverAs: "followUp", triggerTurn: true }) : false;
+                if (delivered)
+                    watchSteer(ctx, config, ["rules"]);
+                for (const verdict of turnRun.verdicts) {
+                    const shown = renderTemplate(config.widget.rules, { ...rulesTokens(verdict), tool: verdict.tool === "turn" ? "turn" : "unseen change", path: verdict.tool === "turn" ? "the run's diff" : verdict.path });
+                    const cuts = verdict.tool === "turn" && turnRun.cuts.length ? [`diff caps cut: ${turnRun.cuts.join("; ")}`] : [];
+                    if (verdict.source !== "skipped") {
+                        stats.ruleChecks++;
+                        if (verdict.error)
+                            noteError(ctx, verdict.error, verdict.errorCode);
+                        if (verdict.source === "typesafe") {
+                            for (const observation of rulesLog?.record(verdict, config.rules.threshold, Date.now(), config.rules.softThreshold) ?? []) {
+                                if (observation.cleared)
+                                    record(ctx, config, "rules", `rules: ${observation.name} now clear on ${verdict.path}`, [`clear: a later judgment on this path scored ${observation.violation.toFixed(2)}, below the ${config.rules.threshold} threshold`]);
+                            }
+                        }
+                        if (verdict.findings.length) {
+                            stats.ruleViolations++;
+                            if (ctx.hasUI && config.notices)
+                                ctx.ui.notify(`warden · rules · ${verdict.tool === "turn" ? "this run's changes" : verdict.path}: ${verdict.findings.map(finding => `${finding.name} (${finding.violation.toFixed(2)})`).join("; ")}`, "warning");
+                        }
+                        const agentTold = told && delivered ? `agent told: ${told}` : told ? `steer recorded, not delivered (a repeat or the per-run budget): ${told}` : undefined;
+                        record(ctx, config, "rules", shown, [...cuts, ...rulesDetails(verdict, agentTold)]);
+                    }
+                    else {
+                        record(ctx, config, "rules", shown, [`${verdict.tool} ${verdict.path}: ${verdict.skippedReason}`]);
+                    }
+                }
+            }
+        }
         if (!finalMessage || !judge)
             return;
         // Pi shows the agent as working until this hook returns, so the two independent checks share one round trip.
@@ -2440,7 +2610,7 @@ export default function wardenExtension(pi) {
         }
     });
     // Shortcuts are registered once at load; a shape check keeps a typo in the config file from being registered.
-    const shortcut = loadConfig().widget.shortcut;
+    const shortcut = loadConfig({ dirs }).widget.shortcut;
     if (/^(?:(?:ctrl|shift|alt|super)\+)+[a-z0-9]+$|^f\d{1,2}$/i.test(shortcut)) {
         pi.registerShortcut(shortcut, {
             description: "Toggle the pi-warden trace sidebar",
@@ -2468,7 +2638,7 @@ export default function wardenExtension(pi) {
             const manager = ctx.sessionManager;
             const session = typeof manager.getSessionId === "function" ? manager.getSessionId() : "unknown";
             const scan = await standingPrefs(ctx);
-            const path = prefsStorePath(scan.project);
+            const path = prefsStorePath(scan.project, dirs);
             const reply = await changePrefsStore(path, store => {
                 const result = recordLesson({ lesson, session, now: Date.now(), signal, scan, store });
                 return { value: result.reply, ...(result.store ? { store: result.store } : {}) };
@@ -2508,14 +2678,20 @@ export default function wardenExtension(pi) {
             return toolReply(recallText(evidenceSnapshot(ctx)));
         },
     });
-    const actions = ["status", "rules", "report", "enable", "disable", "mode", "config", "test", "trace", "init", "audit", "index", "prefs", "loops", "recommend", "unmute"];
+    const actions = ["status", "rules", "report", "enable", "disable", "mode", "config", "test", "trace", "init", "audit", "index", "prefs", "loops", "recommend", "unmute", "bench"];
     pi.registerCommand("warden", {
         description: "pi-warden status, active rules, config (set/get/editor), TypeSafe consent, mode, trace panel, recommend, standing preferences, open loops, and a synthetic guard test",
         getArgumentCompletions(prefix) {
             const matches = actions.filter(action => action.startsWith(prefix)).map(action => ({ value: action, label: action }));
-            // `rules check` is the one two-word action: `rules` on its own stays the local list.
+            // `rules check`, `rules audit`, `rules calibrate`, and `rules tune` are two-word actions: `rules` on its own stays the local list.
             if ("rules check".startsWith(prefix))
                 matches.push({ value: "rules check", label: "rules check", description: "which of the active rules the guard cannot judge well" });
+            if ("rules audit".startsWith(prefix))
+                matches.push({ value: "rules audit", label: "rules audit", description: "judge existing files against the project rules as if they had just been written" });
+            if ("rules calibrate".startsWith(prefix))
+                matches.push({ value: "rules calibrate", label: "rules calibrate", description: "replay recent commits through the active rules and flag the ones that fire on everything or cannot decide" });
+            if ("rules tune".startsWith(prefix))
+                matches.push({ value: "rules tune", label: "rules tune", description: "ask the agent to rewrite the rules the latest calibrate or rules check flagged" });
             return matches.length ? matches : null;
         },
         async handler(args, ctx) {
@@ -2534,45 +2710,199 @@ export default function wardenExtension(pi) {
             try {
                 const config = configFor(ctx);
                 if (action === "status") {
-                    const auth = describeAuth(authState({ backend: config.typesafeBackend }));
+                    // A refused backend has no key to describe; the refusal itself is the status line.
+                    const backend = config.typesafeBackend;
+                    const auth = config.backendRefusal !== undefined || backend === undefined ? undefined : describeAuth(authState({ backend }));
                     const source = consentSource(config);
                     const usage = client?.getUsage();
                     const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.rules.enabled && "rules", config.context.enabled && "context", config.runaway.enabled && "runaway", config.subagent.enabled && "subagent triage", config.notify.enabled && "desktop notifications"].filter(Boolean).join(", ");
-                    const ls = await holdStats(ctx.cwd);
+                    const ls = await holdStats(ctx.cwd, dirs);
                     const lifetimeLine = ls.labeled === 0
                         ? `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, not yet measurable (${ls.allowed} allowed).`
                         : `Lifetime here: ${ls.held} hold${ls.held === 1 ? "" : "s"}, ${ls.labeled} labeled, ${ls.declined + ls.replanned} stood (${ls.declined + ls.replanned}/${ls.labeled}), ${ls.allowed} allowed (${ls.accepted} accepted, ${ls.regretted} regretted).`;
                     report([
-                        `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.typesafeBackend !== "typesafe" ? ` (${config.typesafeBackend})` : ""}; ${auth.text}`,
+                        `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `consented via ${source}` : "not consented (run /warden enable)"}${config.backendRefusal !== undefined || backend === undefined || backend === "typesafe" ? "" : ` (${describeBackend(backend)})`}; ${config.backendRefusal !== undefined ? `judgments are off: typesafeBackend refused: ${config.backendRefusal}` : auth?.text ?? ""}`,
                         `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan (${stats.offPlanTraceOnly} trace-only), ${stats.offTask} off task, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.subagentWoken}/${stats.subagentReports} subagent reports woken, ${stats.restatements} restatements, ${stats.errors} TypeSafe errors, ${stats.cooldownSkips} checks without Jev during a judge cooldown; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}. Steer budget: ${config.steerBudget === 0 ? "off" : `${config.steerBudget} per run`}.`,
                         formatSteers(stats),
                         `${formatMuted(steerStats.muted(), config.steers)}${stats.steersMuted ? ` This session: ${stats.steersMuted} steer${stats.steersMuted === 1 ? "" : "s"} kept in the trace only.` : ""}`,
                         `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / steer ${config.action.offTask.steer} (never holds); intent mismatch ${config.action.intentMismatch} (${config.action.visibleMismatch} on a visible action, trace-only: ${config.action.intentTraceOnly}); stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
-                        ...(config.learning.patternAnalysis ? [`Learning: ${(await generateRecommendations(ctx.cwd)).length} recommendations, steer effectiveness ${Math.round((await analyzeSteerEffectivenessReport(ctx.cwd)).overall * 100)}% (use /warden recommend for details)`] : []),
+                        ...(config.learning.patternAnalysis ? [`Learning: ${(await generateRecommendations(ctx.cwd, dirs)).length} recommendations, steer effectiveness ${Math.round((await analyzeSteerEffectivenessReport(ctx.cwd, dirs)).overall * 100)}% (use /warden recommend for details)`] : []),
                         `${formatHolds(holds.snapshot(), config.action.feedbackLog ? holdLog?.path : undefined)}${holdLog?.lastFailure ? ` Log write failed: ${holdLog.lastFailure}.` : ""}`,
                         lifetimeLine,
                         `Rules: ${config.rules.enabled ? `${rulesGuard.describe(ctx.cwd, config.rules)}${Object.keys(config.rules.sensitivePaths).length ? `; ${Object.keys(config.rules.sensitivePaths).length} sensitive path${Object.keys(config.rules.sensitivePaths).length === 1 ? "" : "s"}` : ""}` : "off"}.`,
                         ...(config.action.armingRules.length > 0 ? [`Arming: ${arming.statusLine() || "no rules armed"}.`] : []),
                         `Desktop notifications: ${config.notify.enabled ? `on (${config.notify.command.length ? `command ${config.notify.command[0]}` : (await (notifier ??= detectNotifier())) ?? "no notifier found on this machine"}; cooldown ${config.notify.cooldownMs} ms)` : "off (\"notify\": { \"enabled\": true } in the config turns them on)"}.`,
-                        `Config: ${userConfigPath()}${ctx.isProjectTrusted() ? ` and ${projectConfigPath(ctx.cwd)}` : ""}.`,
+                        `Config: ${userConfigPath(dirs)}${ctx.isProjectTrusted() ? ` and ${projectConfigPath(ctx.cwd, dirs)}` : ""}.`,
                         widget.size ? `Last: ${[...widget.values()].join(" | ")}` : "No guarded activity yet this session.",
                         `Trace: ${trace.entries().length} events (/warden trace${shortcut ? `, ${shortcut}` : ""}, or click the status line in fullscreen mode; each toggles the sidebar). Widget templates in config.widget: action tokens ${TOKEN_NAMES.action.map(name => `{${name}}`).join(" ")}.`,
                     ].join(" "));
                     return;
                 }
+                if (action === "rules" && argument === "audit") {
+                    const parsed = parseRulesAuditArgs(tokens.slice(2));
+                    if (parsed.error) {
+                        report(parsed.error, "warning");
+                        return;
+                    }
+                    const off = judgmentsOffReason(config);
+                    const judge = judgeFor(config);
+                    const result = await runRulesAudit({
+                        cwd: ctx.cwd, paths: parsed.paths, max: parsed.max, yes: parsed.yes, config: config.rules,
+                        set: rulesGuard.store.load(ctx.cwd, config.rules), judge, timeoutMs: config.timeoutMs, signal: ctx.signal,
+                        destination: backendHost(config.typesafeBackend),
+                        confirm: ctx.hasUI ? (title, body) => ctx.ui.confirm(title, body, ctx.signal ? { signal: ctx.signal } : {}) : undefined,
+                    });
+                    switch (result.status) {
+                        // No key, no consent, or a spent budget: say why and send nothing.
+                        case "no-judge":
+                            report(`Rules audit sent nothing: Jev judgments are off${off === "budget" ? " (the request budget is used up)" : ""}.${off && off !== "budget" ? ` ${judgmentsOffText(off, config, !ctx.hasUI)}` : ""}`);
+                            return;
+                        case "no-files":
+                            report(`Rules audit sent nothing: ${result.reason}.`);
+                            return;
+                        case "needs-yes":
+                            report(`Rules audit sent nothing: a headless run needs --yes before ${result.files} file samples go to ${backendHost(config.typesafeBackend)} (${result.leftOut} more files left out at the --max ${parsed.max} cap).`, "warning");
+                            return;
+                        case "cancelled":
+                            report("Rules audit cancelled. Nothing was sent.");
+                            return;
+                        case "done":
+                            report(formatRulesAudit(result.outcome));
+                            return;
+                    }
+                    return;
+                }
+                if (action === "bench") {
+                    const parsed = parseBenchArgs(tokens.slice(1));
+                    if (parsed.error) {
+                        report(parsed.error, "warning");
+                        return;
+                    }
+                    const off = judgmentsOffReason(config);
+                    const judge = judgeFor(config);
+                    const result = await runBench({ runs: parsed.runs, cwd: ctx.cwd, config: config.rules, set: rulesGuard.store.load(ctx.cwd, config.rules), judge, getUsage: judge ? () => judge.getUsage() : undefined, timeoutMs: config.timeoutMs, signal: ctx.signal });
+                    switch (result.status) {
+                        // No key, no consent, or a spent budget: say why and send nothing.
+                        case "no-judge":
+                            report(`Bench sent nothing: Jev judgments are off${off === "budget" ? " (the request budget is used up)" : ""}.${off && off !== "budget" ? ` ${judgmentsOffText(off, config, !ctx.hasUI)}` : ""}`);
+                            return;
+                        case "skipped":
+                            report(`Bench sent nothing: ${result.reason}.`);
+                            return;
+                        case "done":
+                            report(formatBench(result));
+                            return;
+                    }
+                    return;
+                }
                 if (action === "rules") {
                     if (argument === "check") {
                         const off = judgmentsOffReason(config);
                         const result = await checkRules({ set: rulesGuard.store.load(ctx.cwd, config.rules), judge: judgeFor(config), timeoutMs: config.timeoutMs, signal: ctx.signal });
                         if (result.source === "skipped") {
                             // No key, no consent, or a spent budget: say why and send nothing.
-                            report(`Rules check sent nothing: Jev judgments are off${off === "budget" ? " (the request budget is used up)" : ""}.${off && off !== "budget" ? ` ${judgmentsOffText(off, config.typesafeBackend, !ctx.hasUI)}` : ""} /warden rules shows the rule set locally.`);
+                            report(`Rules check sent nothing: Jev judgments are off${off === "budget" ? " (the request budget is used up)" : ""}.${off && off !== "budget" ? ` ${judgmentsOffText(off, config, !ctx.hasUI)}` : ""} /warden rules shows the rule set locally.`);
                             return;
                         }
+                        if (result.source === "typesafe")
+                            lastCheck = result;
                         report(formatRulesCheck(result));
                         return;
                     }
+                    if (argument === "calibrate") {
+                        const usage = "Usage: /warden rules calibrate [--commits N] [--max N] [--yes].";
+                        const commitsMatch = /(?:^|\s)--commits\s+(\S+)/.exec(tail);
+                        const maxMatch = /(?:^|\s)--max\s+(\S+)/.exec(tail);
+                        const yes = /(?:^|\s)--yes(?:\s|$)/.test(tail);
+                        const commits = commitsMatch ? Number(commitsMatch[1]) : CALIBRATE_DEFAULT_COMMITS;
+                        const max = maxMatch ? Number(maxMatch[1]) : CALIBRATE_DEFAULT_MAX;
+                        if ((commitsMatch && (!Number.isInteger(commits) || commits < 1)) || (maxMatch && (!Number.isInteger(max) || max < 1))) {
+                            report(usage, "warning");
+                            return;
+                        }
+                        const set = rulesGuard.store.load(ctx.cwd, config.rules);
+                        if (!set) {
+                            report("No rules file detected. Run /warden init to create project-specific rules.");
+                            return;
+                        }
+                        if (set.proseOnly) {
+                            report(`No rules to calibrate: ${set.sources.join(", ")} has no rule-shaped sections, so the guard judges nothing there.`);
+                            return;
+                        }
+                        if (set.aggregate !== undefined && !set.rules.length) {
+                            report(`No separate rules to calibrate: ${set.sources.join(", ")} has no rule headings, so the guard judges it as one document.`);
+                            return;
+                        }
+                        const off = judgmentsOffReason(config);
+                        const judge = judgeFor(config);
+                        if (!judge) {
+                            report(`Rules calibrate sent nothing: Jev judgments are off${off === "budget" ? " (the request budget is used up)" : ""}.${off && off !== "budget" ? ` ${judgmentsOffText(off, config, !ctx.hasUI)}` : ""} /warden rules shows the rule set locally.`);
+                            return;
+                        }
+                        let history;
+                        try {
+                            history = collectHistory(ctx.cwd, commits);
+                        }
+                        catch (error) {
+                            report(`Rules calibrate could not read the git history: ${error instanceof Error ? error.message : String(error)}`, "warning");
+                            return;
+                        }
+                        const plan = planCalibration(history, { set, config: config.rules, cwd: ctx.cwd, maxRequests: max });
+                        if (!plan.requests) {
+                            report(`Rules calibrate sent nothing: no changed file in the last ${commits} non-merge commit${commits === 1 ? "" : "s"} is judgeable${plan.skipped.length ? ` (${plan.skipped.length} change${plan.skipped.length === 1 ? "" : "s"} skipped)` : ""}.`);
+                            return;
+                        }
+                        // Nothing leaves the machine before this gate: the dialog shows the count and the redacted diffs, and a
+                        // headless run needs the explicit --yes.
+                        const gate = calibrateGate({ hasUI: ctx.hasUI, yes });
+                        if (gate.kind === "refuse") {
+                            report(gate.reason, "warning");
+                            return;
+                        }
+                        if (gate.kind === "confirm" && !await ctx.ui.confirm(`warden: send ${plan.requests} calibration request${plan.requests === 1 ? "" : "s"}?`, calibrationNotice(plan))) {
+                            report("Cancelled. Nothing was sent.");
+                            return;
+                        }
+                        const result = await calibrate(history, { set, config: config.rules, cwd: ctx.cwd, judge, timeoutMs: config.timeoutMs, maxRequests: max, signal: ctx.signal });
+                        (rulesLog ??= new RulesLog(ctx.cwd, String(process.pid))).appendRecords(result.records);
+                        lastCalibration = result;
+                        report(formatCalibration(result));
+                        return;
+                    }
+                    if (argument === "tune") {
+                        const request = tuneRequest({ calibration: lastCalibration, check: lastCheck, rules: rulesGuard.store.load(ctx.cwd, config.rules)?.rules ?? [] });
+                        if ("reason" in request) {
+                            report(request.reason);
+                            return;
+                        }
+                        initRunning = true;
+                        let sent = true;
+                        if (ctx.hasUI)
+                            ctx.ui.notify("pi-warden: Sending the rules rewrite prompt...", "info");
+                        try {
+                            // sendUserMessage throws when the agent is not idle. Brief wait so a
+                            // just-closing confirm dialog does not cause a race.
+                            for (let attempt = 0; attempt < 40; attempt++) {
+                                if (ctx.isIdle())
+                                    break;
+                                await new Promise(resolve => setTimeout(resolve, 250));
+                            }
+                            pi.sendUserMessage(request.prompt);
+                            await ctx.waitForIdle();
+                        }
+                        catch (err) {
+                            sent = false;
+                            const detail = err instanceof Error ? err.message : String(err);
+                            report(`pi-warden rules tune failed: ${detail}.`, "error");
+                        }
+                        finally {
+                            initRunning = false;
+                        }
+                        if (sent)
+                            report("Rewrite prompt sent. The agent edits pi-warden.md with its own tools; review the changes.");
+                        return;
+                    }
                     report(rulesGuard.details(ctx.cwd, config.rules));
                     return;
                 }
@@ -2583,9 +2913,13 @@ export default function wardenExtension(pi) {
                         report("Usage: /warden report [--days N], where N is at least 1. Default: 30 days.", "warning");
                         return;
                     }
-                    const records = await readRulesLog(rulesLogPath(ctx.cwd));
+                    const all = await readRulesLog(rulesLogPath(ctx.cwd, dirs));
+                    // Calibration replays carry `source: "calibrate"`; the live verdict report counts only the live records and
+                    // says how many replays it set apart.
+                    const replays = all.filter(record => record.source === "calibrate").length;
                     const set = rulesGuard.store.load(ctx.cwd, config.rules);
-                    report(formatRulesReport(buildRulesReport(records, { days, currentRules: set?.rules.map(rule => ({ id: rule.id, name: rule.name })) ?? [] })));
+                    const text = formatRulesReport(buildRulesReport(all, { days, currentRules: set?.rules.map(rule => ({ id: rule.id, name: rule.name })) ?? [], source: "live" }));
+                    report(replays ? `${text}\n${replays} calibration replay record${replays === 1 ? "" : "s"} in this log, counted apart (source: calibrate).` : text);
                     return;
                 }
                 if (action === "trace") {
@@ -2641,8 +2975,8 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "recommend") {
                     // Learning-driven recommendations based on hold history
-                    const recommendations = await generateRecommendations(ctx.cwd);
-                    const steerReport = await analyzeSteerEffectivenessReport(ctx.cwd);
+                    const recommendations = await generateRecommendations(ctx.cwd, dirs);
+                    const steerReport = await analyzeSteerEffectivenessReport(ctx.cwd, dirs);
                     const lines = [];
                     lines.push("pi-warden learning recommendations:");
                     if (recommendations.length === 0 && steerReport.suggestions.length === 0) {
@@ -2683,27 +3017,36 @@ export default function wardenExtension(pi) {
                     return;
                 }
                 if (action === "enable") {
+                    if (config.backendRefusal !== undefined) {
+                        report(`Cannot enable judgments: typesafeBackend refused: ${config.backendRefusal} Fix the value in ${userConfigPath(dirs)}, then run /warden enable again.`, "warning");
+                        return;
+                    }
+                    const backend = config.typesafeBackend;
                     if (!ctx.hasUI) {
-                        report(`Consent needs an interactive session. For headless runs set PI_WARDEN_ENABLED=1 and ${keyEnvFor(config.typesafeBackend)} explicitly.`, "warning");
+                        report(`Consent needs an interactive session. For headless runs set PI_WARDEN_ENABLED=1 and ${resolveBackend(backend).keyEnv} explicitly.`, "warning");
                         return;
                     }
-                    if (!await ctx.ui.confirm("Enable TypeSafe judgments for pi-warden?", disclosure))
+                    // For a non-TypeSafe backend the dialog names who answers: the label, host, and model sent.
+                    const consentText = backend === undefined || backend === "typesafe"
+                        ? disclosure
+                        : `Judgments go to ${describeBackend(backend)}. ${disclosureFor(backend, disclosure)}`;
+                    if (!await ctx.ui.confirm("Enable TypeSafe judgments for pi-warden?", consentText))
                         return;
                     // One flow: consent, then a key if none is configured yet. TypeSafe prompts, verifies, and stores the key for every
                     // pi-typesafe consumer; any other backend has no login, so a missing key is reported with the variable to set.
-                    const key = await ensureApiKey(ctx, { backend: config.typesafeBackend });
+                    const key = await ensureApiKey(ctx, backend === undefined ? {} : { backend });
                     if (!key) {
                         report("No key entered; pi-warden stays on pattern checks only. Run /warden enable again when you have a key from console.typesafe.ai.", "warning");
                         return;
                     }
-                    const path = setUserSetting("typesafe", true);
+                    const path = setUserSetting("typesafe", true, dirs);
                     client = undefined;
                     budgetExhausted = false;
-                    report(`TypeSafe judgments enabled and saved to ${path}${key.login ? `; key verified (${key.login.models} model${key.login.models === 1 ? "" : "s"}) and stored at ${key.login.path}` : ` using the ${key.source === "stored" ? "stored key" : `key from ${keyEnvFor(config.typesafeBackend)}`}`}. This stays on in new sessions until /warden disable.`);
+                    report(`TypeSafe judgments enabled and saved to ${path}${key.login ? `; key verified (${key.login.models} model${key.login.models === 1 ? "" : "s"}) and stored at ${key.login.path}` : ` using the ${key.source === "stored" ? "stored key" : `key from ${resolveBackend(config.typesafeBackend).keyEnv}`}`}. This stays on in new sessions until /warden disable.`);
                     return;
                 }
                 if (action === "disable") {
-                    const path = setUserSetting("typesafe", false);
+                    const path = setUserSetting("typesafe", false, dirs);
                     report(`TypeSafe judgments disabled in ${path}. Offline pattern checks stay active; set enabled to false there to turn pi-warden off entirely.`);
                     return;
                 }
@@ -2712,7 +3055,7 @@ export default function wardenExtension(pi) {
                         report(`Mode is ${activeMode(config, ctx.hasUI)}${process.env.PI_WARDEN_MODE ? " (from PI_WARDEN_MODE)" : ""}. Use /warden mode steer | confirm | advise. steer holds risky calls and tells the agent why; confirm asks you with a dialog; advise only reports.`);
                         return;
                     }
-                    const path = setUserSetting("mode", argument);
+                    const path = setUserSetting("mode", argument, dirs);
                     report(`Mode set to ${argument} in ${path}.`);
                     return;
                 }
@@ -2732,23 +3075,23 @@ export default function wardenExtension(pi) {
                         const keyPath = rest.slice(0, spaceIndex).trim();
                         const rawValue = rest.slice(spaceIndex + 1).trim();
                         const value = parseConfigValue(rawValue);
-                        const current = readUserConfig();
+                        const current = readUserConfig(dirs);
                         const updated = setNestedValue(current, keyPath, value);
-                        const savedPath = writeUserConfig(updated);
+                        const savedPath = writeUserConfig(updated, dirs);
                         client = undefined;
                         report(`Saved ${keyPath} = ${JSON.stringify(value)}.`);
                         return;
                     }
                     if (tail.startsWith("get ")) {
                         const keyPath = tail.slice(4).trim();
-                        const current = readUserConfig();
+                        const current = readUserConfig(dirs);
                         const value = getNestedValue(current, keyPath);
                         const defaultValue = getNestedValue(defaultConfig(), keyPath);
                         report(value === undefined ? `${keyPath} not set (default: ${JSON.stringify(defaultValue)})` : `${keyPath} = ${JSON.stringify(value)}`);
                         return;
                     }
                     if (!ctx.hasUI || !lastUi) {
-                        report(`Edit ${userConfigPath()} directly. Use /warden config set <key> <value> for quick changes.`);
+                        report(`Edit ${userConfigPath(dirs)} directly. Use /warden config set <key> <value> for quick changes.`);
                         return;
                     }
                     toggleConfigPanel(lastUi, config);
@@ -2841,7 +3184,10 @@ export default function wardenExtension(pi) {
                 }
                 if (action === "test") {
                     const judge = judgeFor(config);
-                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Prepare the demo environment") goes to ${backendHost(config.typesafeBackend)} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
+                    // For a non-TypeSafe backend the confirmation names who answers: the label, host, and model sent.
+                    const backend = config.typesafeBackend;
+                    const destination = backend === undefined || backend === "typesafe" ? backendHost(backend) : describeBackend(backend);
+                    if (judge && ctx.hasUI && !await ctx.ui.confirm("Send one synthetic pi-warden test request?", `A synthetic action ("rm -rf /tmp/pi-warden-demo" for the task "Prepare the demo environment") goes to ${destination} and may incur charges. ${disclosureFor(config.typesafeBackend, disclosure)}`))
                         return;
                     const verdict = await evaluateAction({ tool: "bash", input: { command: "rm -rf /tmp/pi-warden-demo" }, cwd: ctx.cwd, task: "Prepare the demo environment" }, { config: { ...config.action, enabled: true, tools: ["bash"] }, judge, rules: config.rules });
                     const deliveryVerdict = ctx.hasUI ? verdict : agentDeliveryVerdict(verdict);
@@ -2907,11 +3253,11 @@ export default function wardenExtension(pi) {
                     catch {
                         toolInfosForIndex = [];
                     }
-                    const globalPath = indexPath("global");
-                    const projectPath = indexPath("project", ctx.cwd);
-                    ensureIndexDir("global");
-                    ensureIndexDir("project");
-                    const prompt = buildIndexPrompt(ctx.cwd, skillsForIndex, toolInfosForIndex, { global: globalPath, project: projectPath });
+                    const globalPath = indexPath("global", undefined, undefined, dirs);
+                    const projectPath = indexPath("project", ctx.cwd, undefined, dirs);
+                    ensureIndexDir("global", undefined, dirs);
+                    ensureIndexDir("project", undefined, dirs);
+                    const prompt = buildIndexPrompt(ctx.cwd, skillsForIndex, toolInfosForIndex, { global: globalPath, project: projectPath }, dirs);
                     // Snapshot files before the model runs so we can detect whether it wrote anything.
                     const snap = (p) => { try {
                         const s = statSync(p);